superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/ui/js/od-team.js

@@ -0,0 +1,258 @@
+// od-team.js — Team & Access (RBAC / C3) card renderer.
+// Renders into window.odRenderTeam(container). Mounted inside the Operations
+// pane (#od-team-mount). Lets a non-technical admin manage who can use this
+// workspace and at what role — entirely from the dashboard.
+//
+// Backend: /api/rbac/{whoami,status,login,logout,users,members,policy}
+// Auth: same-origin loopback = machine owner (implicit root); a logged-in
+// user carries an HttpOnly session cookie set by /api/rbac/login.
+//
+// CSP-safe: no inline handlers — every control is wired via addEventListener.
+//
+// Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar — AGPL-3.0
+
+/* global window, document, fetch */
+(function () {
+  'use strict';
+
+  function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+
+  function getJSON(url) {
+    return fetch(url, { cache: 'no-store' })
+      .then(function (r) { return r.ok ? r.json() : null; })
+      .catch(function () { return null; });
+  }
+
+  function postJSON(url, body, method) {
+    return fetch(url, {
+      method: method || 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body || {}),
+    }).then(function (r) {
+      return r.json().catch(function () { return {}; }).then(function (d) {
+        return { ok: r.ok, status: r.status, data: d };
+      });
+    });
+  }
+
+  var ROLES = ['admin', 'member', 'viewer'];
+
+  function roleOptions(selected) {
+    return ROLES.map(function (r) {
+      return '<option value="' + r + '"' + (r === selected ? ' selected' : '') + '>' +
+        r.charAt(0).toUpperCase() + r.slice(1) + '</option>';
+    }).join('');
+  }
+
+  // ─── Render ────────────────────────────────────────────────────────────────
+
+  function odRenderTeam(container) {
+    if (!container) return;
+    container.innerHTML =
+      '<div class="card-head"><h3>Team &amp; access</h3></div>' +
+      '<div class="card-pad" id="od-team-body">' +
+      '<p class="muted">Loading team &amp; access…</p></div>';
+
+    Promise.all([
+      getJSON('/api/rbac/whoami'),
+      getJSON('/api/rbac/status'),
+    ]).then(function (res) {
+      var who = res[0] || { kind: 'owner', permissions: [], role: 'owner' };
+      var status = res[1] || { rbac_active: false, require_login: false, user_count: 0 };
+      var canManage = (who.permissions || []).indexOf('manage') !== -1;
+
+      var extras = canManage
+        ? Promise.all([getJSON('/api/rbac/users'), getJSON('/api/rbac/members')])
+        : Promise.resolve([null, null]);
+
+      extras.then(function (mgmt) {
+        var users = (mgmt[0] && mgmt[0].users) || [];
+        var members = (mgmt[1] && mgmt[1].members) || [];
+        paint(container, who, status, canManage, users, members);
+      });
+    });
+  }
+
+  function identityLine(who) {
+    if (who.kind === 'user') {
+      return '<div class="row" style="justify-content:space-between;align-items:center">' +
+        '<div>Signed in as <strong>' + esc(who.display_name || who.username) + '</strong>' +
+        ' — role <strong>' + esc(who.role || 'none') + '</strong> on workspace <code>' +
+        esc(who.profile) + '</code></div>' +
+        '<button class="btn sm" id="od-team-logout">Sign out</button></div>';
+    }
+    return '<div>Operating as the <strong>machine owner</strong> (full control). ' +
+      'Sign in as a user below to act with a specific role.</div>';
+  }
+
+  function loginForm() {
+    return '<div class="card" style="margin-top:12px;max-width:520px">' +
+      '<div class="card-head"><h4 style="margin:0">Sign in</h4></div>' +
+      '<div class="card-pad">' +
+      '<div class="row" style="gap:8px;flex-wrap:wrap;align-items:center">' +
+      '<input id="od-team-login-user" class="input sm" placeholder="Username" autocomplete="username">' +
+      '<input id="od-team-login-pass" class="input sm" type="password" placeholder="Password" autocomplete="current-password">' +
+      '<button class="btn sm primary" id="od-team-login-btn">Sign in</button>' +
+      '</div><p class="muted" id="od-team-login-msg" style="margin:8px 0 0"></p>' +
+      '</div></div>';
+  }
+
+  function usersTable(users, members) {
+    var roleByUser = {};
+    members.forEach(function (m) { roleByUser[m.user_id] = m.role; });
+    if (!users.length) {
+      return '<p class="muted">No users yet. Add your first admin below.</p>';
+    }
+    var rows = users.map(function (u) {
+      var role = roleByUser[u.user_id] || '';
+      return '<tr>' +
+        '<td>' + esc(u.username) + '</td>' +
+        '<td>' + esc(u.display_name || '') + '</td>' +
+        '<td><select class="input sm od-team-role" data-uid="' + esc(u.user_id) + '">' +
+        '<option value="">— none —</option>' + roleOptions(role) + '</select></td>' +
+        '<td>' + esc(u.status) + '</td>' +
+        '<td><button class="btn sm danger od-team-del" data-uid="' + esc(u.user_id) +
+        '" data-uname="' + esc(u.username) + '">Remove</button></td>' +
+        '</tr>';
+    }).join('');
+    return '<table class="tbl"><thead><tr>' +
+      '<th>Username</th><th>Name</th><th>Role (this workspace)</th><th>Status</th><th></th>' +
+      '</tr></thead><tbody>' + rows + '</tbody></table>';
+  }
+
+  function manageBlock(status, users, members) {
+    return '<div class="card" style="margin-top:12px">' +
+      '<div class="card-head"><h4 style="margin:0">Users &amp; roles</h4></div>' +
+      '<div class="card-pad">' +
+      '<div id="od-team-users">' + usersTable(users, members) + '</div>' +
+      '<div class="row" style="gap:8px;flex-wrap:wrap;align-items:center;margin-top:12px">' +
+      '<input id="od-team-new-user" class="input sm" placeholder="Username">' +
+      '<input id="od-team-new-name" class="input sm" placeholder="Display name (optional)">' +
+      '<input id="od-team-new-pass" class="input sm" type="password" placeholder="Password (min 8)">' +
+      '<select id="od-team-new-role" class="input sm">' + roleOptions('member') + '</select>' +
+      '<button class="btn sm primary" id="od-team-add-btn">Add user</button>' +
+      '</div><p class="muted" id="od-team-msg" style="margin:8px 0 0"></p>' +
+      '</div></div>' +
+      // Policy
+      '<div class="card" style="margin-top:12px;max-width:640px">' +
+      '<div class="card-head"><h4 style="margin:0">Access policy</h4></div>' +
+      '<div class="card-pad">' +
+      '<label class="row" style="gap:8px;align-items:center;cursor:pointer">' +
+      '<input type="checkbox" id="od-team-require-login"' +
+      (status.require_login ? ' checked' : '') + '>' +
+      '<span>Require every person to sign in before reading or writing memory ' +
+      '(company mode). The machine owner can always manage users.</span></label>' +
+      '<p class="muted" id="od-team-policy-msg" style="margin:8px 0 0"></p>' +
+      '</div></div>';
+  }
+
+  function paint(container, who, status, canManage, users, members) {
+    var body = container.querySelector('#od-team-body');
+    if (!body) return;
+    var html = identityLine(who);
+    if (who.kind !== 'user') html += loginForm();
+    if (canManage) html += manageBlock(status, users, members);
+    else if (who.kind === 'user') {
+      html += '<p class="muted" style="margin-top:12px">Your role does not include ' +
+        'user administration. Ask a workspace admin to change roles.</p>';
+    }
+    body.innerHTML = html;
+    wire(container, who);
+  }
+
+  // ─── Wiring (CSP-safe) ───────────────────────────────────────────────────────
+
+  function wire(container, who) {
+    var q = function (id) { return container.querySelector('#' + id); };
+    var reload = function () { odRenderTeam(container); };
+
+    var loginBtn = q('od-team-login-btn');
+    if (loginBtn) {
+      loginBtn.addEventListener('click', function () {
+        var u = (q('od-team-login-user') || {}).value || '';
+        var p = (q('od-team-login-pass') || {}).value || '';
+        var msg = q('od-team-login-msg');
+        postJSON('/api/rbac/login', { username: u, password: p }).then(function (r) {
+          if (r.ok) { reload(); }
+          else if (msg) { msg.textContent = (r.data && r.data.detail) || 'Sign in failed.'; }
+        });
+      });
+    }
+
+    var logoutBtn = q('od-team-logout');
+    if (logoutBtn) {
+      logoutBtn.addEventListener('click', function () {
+        postJSON('/api/rbac/logout', {}).then(reload);
+      });
+    }
+
+    var addBtn = q('od-team-add-btn');
+    if (addBtn) {
+      addBtn.addEventListener('click', function () {
+        var msg = q('od-team-msg');
+        var body = {
+          username: (q('od-team-new-user') || {}).value || '',
+          password: (q('od-team-new-pass') || {}).value || '',
+          display_name: (q('od-team-new-name') || {}).value || '',
+          role: (q('od-team-new-role') || {}).value || 'member',
+        };
+        addBtn.disabled = true;
+        postJSON('/api/rbac/users', body).then(function (r) {
+          addBtn.disabled = false;
+          if (r.ok) { reload(); }
+          else if (msg) { msg.textContent = (r.data && r.data.detail) || 'Could not add user.'; }
+        });
+      });
+    }
+
+    // Role change dropdowns
+    container.querySelectorAll('.od-team-role').forEach(function (sel) {
+      sel.addEventListener('change', function () {
+        var uid = sel.getAttribute('data-uid');
+        var role = sel.value;
+        var msg = q('od-team-msg');
+        var done = function (r) {
+          if (!r.ok && msg) msg.textContent = (r.data && r.data.detail) || 'Role change failed.';
+          reload();
+        };
+        if (!role) {
+          postJSON('/api/rbac/members', { user_id: uid }, 'DELETE').then(done);
+        } else {
+          postJSON('/api/rbac/members', { user_id: uid, role: role }).then(done);
+        }
+      });
+    });
+
+    // Remove user
+    container.querySelectorAll('.od-team-del').forEach(function (btn) {
+      btn.addEventListener('click', function () {
+        var uid = btn.getAttribute('data-uid');
+        var uname = btn.getAttribute('data-uname');
+        if (!window.confirm('Remove user "' + uname + '"? This deletes their account and access.')) return;
+        postJSON('/api/rbac/users/' + encodeURIComponent(uid), {}, 'DELETE').then(reload);
+      });
+    });
+
+    // Require-login policy toggle
+    var reqLogin = q('od-team-require-login');
+    if (reqLogin) {
+      reqLogin.addEventListener('change', function () {
+        var msg = q('od-team-policy-msg');
+        postJSON('/api/rbac/policy', { require_login: reqLogin.checked }).then(function (r) {
+          if (msg) {
+            msg.textContent = r.ok
+              ? (reqLogin.checked ? 'Company mode on — everyone must sign in.'
+                                  : 'Company mode off — single-operator use.')
+              : ((r.data && r.data.detail) || 'Could not update policy.');
+          }
+        });
+      });
+    }
+  }
+
+  window.odRenderTeam = odRenderTeam;
+}());

package/src/superlocalmemory/ui/js/profiles.js

@@ -41,46 +41,169 @@ async function loadProfiles() {
     }
 }
 
-async function createProfile(nameOverride) {
-    var name = nameOverride || document.getElementById('new-profile-name').value.trim();
-    if (!name) {
-        name = prompt('Enter new profile name:');
-        if (!name || !name.trim()) return;
-        name = name.trim();
-    }
-
-    if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
-        showToast('Invalid name. Use letters, numbers, dashes, underscores.');
-        return;
-    }
+var PROFILE_NAME_RE = /^[a-zA-Z0-9_-]+$/;
 
+// POST /api/profiles/create → { ok, status, detail }. Pure API step, no UI.
+async function _postCreateProfile(name) {
     try {
         var response = await fetch('/api/profiles/create', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ profile_name: name })
         });
-        var data = await response.json();
-        if (response.status === 409) {
-            showToast('Profile "' + name + '" already exists');
+        var data = {};
+        try { data = await response.json(); } catch (e) { /* empty body */ }
+        return { ok: response.ok, status: response.status, detail: data.detail || '' };
+    } catch (error) {
+        console.error('Error creating profile:', error);
+        return { ok: false, status: 0, detail: 'Network error creating profile' };
+    }
+}
+
+// Refresh every profile-aware surface after a successful create.
+function _afterProfileMutation() {
+    // Small delay so the backend has persisted to both stores before re-read.
+    setTimeout(function () {
+        loadProfiles();
+        if (typeof loadProfilesTable === 'function') loadProfilesTable();
+    }, 300);
+}
+
+// Entry point used by the sidebar "+", the legacy Profiles-tab form, and the
+// data-act-click="create-profile" button. Resolves a name from (a) an explicit
+// override, (b) the legacy #new-profile-name input, or (c) an OD-styled modal —
+// never the native prompt() (crude for the non-technical dashboard users).
+async function createProfile(nameOverride) {
+    var name = (typeof nameOverride === 'string' && nameOverride) ? nameOverride : '';
+    if (!name) {
+        var input = document.getElementById('new-profile-name');
+        if (input && input.value.trim()) name = input.value.trim();
+    }
+    if (!name) {
+        openCreateProfileModal();
+        return;
+    }
+    if (!PROFILE_NAME_RE.test(name)) {
+        showToast('Invalid name. Use letters, numbers, dashes, underscores.');
+        return;
+    }
+    var res = await _postCreateProfile(name);
+    if (res.status === 409) { showToast('Profile "' + name + '" already exists'); return; }
+    if (!res.ok) { showToast(res.detail || 'Failed to create profile'); return; }
+    showToast('Profile "' + name + '" created');
+    var legacyInput = document.getElementById('new-profile-name');
+    if (legacyInput) legacyInput.value = '';
+    _afterProfileMutation();
+}
+
+// OD-styled create-profile dialog. Lazily built, reused across opens. Inline
+// validation + 409 handling; ESC / backdrop / Cancel dismiss; Enter submits.
+function openCreateProfileModal() {
+    var existing = document.getElementById('od-create-profile-overlay');
+    if (existing) { existing.remove(); }
+
+    var overlay = document.createElement('div');
+    overlay.id = 'od-create-profile-overlay';
+    overlay.setAttribute('role', 'dialog');
+    overlay.setAttribute('aria-modal', 'true');
+    overlay.setAttribute('aria-label', 'Create a new profile');
+    overlay.style.cssText =
+        'position:fixed;inset:0;z-index:11000;display:flex;align-items:center;' +
+        'justify-content:center;background:rgba(0,0,0,0.45);backdrop-filter:blur(2px);';
+
+    var card = document.createElement('div');
+    card.style.cssText =
+        'width:min(420px,92vw);background:var(--card,#1a1f2e);color:var(--fg,#e8ecf3);' +
+        'border:1px solid var(--border,rgba(255,255,255,0.1));border-radius:14px;' +
+        'box-shadow:0 20px 60px rgba(0,0,0,0.4);padding:22px 22px 18px;';
+
+    var h = document.createElement('h3');
+    h.textContent = 'Create a new profile';
+    h.style.cssText = 'margin:0 0 4px;font-size:1.05rem;font-weight:600;';
+    var sub = document.createElement('p');
+    sub.textContent = 'Each profile is a fully isolated memory space.';
+    sub.style.cssText = 'margin:0 0 16px;font-size:0.8125rem;color:var(--fg-3,#8b93a7);';
+
+    var input = document.createElement('input');
+    input.type = 'text';
+    input.maxLength = 32;
+    input.placeholder = 'e.g. work, personal, project-x';
+    input.setAttribute('aria-label', 'Profile name');
+    input.style.cssText =
+        'width:100%;box-sizing:border-box;padding:10px 12px;font-size:0.9rem;' +
+        'background:var(--page,rgba(255,255,255,0.04));color:var(--fg,#e8ecf3);' +
+        'border:1px solid var(--border,rgba(255,255,255,0.14));border-radius:8px;outline:none;';
+
+    var err = document.createElement('div');
+    err.style.cssText = 'min-height:18px;margin:6px 2px 0;font-size:0.75rem;color:#ff6b6b;';
+
+    var actions = document.createElement('div');
+    actions.style.cssText = 'display:flex;gap:8px;justify-content:flex-end;margin-top:16px;';
+
+    var cancel = document.createElement('button');
+    cancel.type = 'button';
+    cancel.textContent = 'Cancel';
+    cancel.style.cssText =
+        'padding:8px 14px;font-size:0.85rem;border-radius:8px;cursor:pointer;' +
+        'background:transparent;color:var(--fg-3,#8b93a7);' +
+        'border:1px solid var(--border,rgba(255,255,255,0.14));';
+
+    var create = document.createElement('button');
+    create.type = 'button';
+    create.textContent = 'Create profile';
+    create.style.cssText =
+        'padding:8px 16px;font-size:0.85rem;border-radius:8px;cursor:pointer;' +
+        'background:var(--violet,#7c5cff);color:#fff;border:1px solid transparent;font-weight:600;';
+
+    actions.appendChild(cancel);
+    actions.appendChild(create);
+    card.appendChild(h);
+    card.appendChild(sub);
+    card.appendChild(input);
+    card.appendChild(err);
+    card.appendChild(actions);
+    overlay.appendChild(card);
+    document.body.appendChild(overlay);
+    setTimeout(function () { input.focus(); }, 30);
+
+    function close() {
+        document.removeEventListener('keydown', onKey);
+        overlay.remove();
+    }
+    function onKey(e) {
+        if (e.key === 'Escape') { close(); }
+        else if (e.key === 'Enter') { submit(); }
+    }
+    async function submit() {
+        var name = input.value.trim();
+        if (!name) { err.textContent = 'Please enter a profile name.'; return; }
+        if (!PROFILE_NAME_RE.test(name)) {
+            err.textContent = 'Use only letters, numbers, dashes and underscores.';
             return;
         }
-        if (!response.ok) {
-            showToast(data.detail || 'Failed to create profile');
+        create.disabled = true;
+        create.textContent = 'Creating…';
+        err.textContent = '';
+        var res = await _postCreateProfile(name);
+        if (res.status === 409) {
+            err.textContent = 'A profile named "' + name + '" already exists.';
+            create.disabled = false; create.textContent = 'Create profile';
+            return;
+        }
+        if (!res.ok) {
+            err.textContent = res.detail || 'Failed to create profile.';
+            create.disabled = false; create.textContent = 'Create profile';
             return;
         }
+        close();
         showToast('Profile "' + name + '" created');
-        var input = document.getElementById('new-profile-name');
-        if (input) input.value = '';
-        // Force reload with small delay to ensure backend has persisted
-        setTimeout(function() {
-            loadProfiles();
-            if (typeof loadProfilesTable === 'function') loadProfilesTable();
-        }, 300);
-    } catch (error) {
-        console.error('Error creating profile:', error);
-        showToast('Error creating profile');
+        _afterProfileMutation();
     }
+
+    cancel.addEventListener('click', close);
+    create.addEventListener('click', submit);
+    overlay.addEventListener('click', function (e) { if (e.target === overlay) close(); });
+    document.addEventListener('keydown', onKey);
 }
 
 async function deleteProfile(name) {
@@ -209,25 +332,15 @@ async function switchProfile(profileName) {
         var acknowledged = response.ok && data.success === true &&
             data.active_profile === profileName && Number.isInteger(data.generation);
         if (acknowledged) {
-            showToast('Switched to profile: ' + profileName);
-            loadProfiles();
-            loadStats();
-            if (typeof loadGraph === 'function') loadGraph();
-            loadProfilesTable();
-            // v2.7.4: Reload ALL tabs for new profile
-            if (typeof loadLearning === 'function') loadLearning();
-            if (typeof refreshFeedbackStats === 'function') refreshFeedbackStats();
-            if (typeof loadLearningDataStats === 'function') loadLearningDataStats();
-            if (typeof loadAgents === 'function') loadAgents();
-            if (typeof loadMemories === 'function') loadMemories();
-            if (typeof loadTimeline === 'function') loadTimeline();
-            if (typeof loadEvents === 'function') loadEvents();
-            // v2.8 tabs
-            if (typeof loadLifecycle === 'function') loadLifecycle();
-            if (typeof loadBehavioral === 'function') loadBehavioral();
-            if (typeof loadCompliance === 'function') loadCompliance();
-            var activeTab = document.querySelector('#mainTabs .nav-link.active');
-            if (activeTab) activeTab.click();
+            // A profile switch is a full context change: reload the whole
+            // dashboard so EVERY pane, KPI, graph, and table reflects the new
+            // profile. Piecemeal per-pane refresh (the legacy loadX pile) left
+            // stale cross-profile data in any pane that wasn't re-fetched, and
+            // the OD dashboard's panes aren't driven by those legacy loaders.
+            showToast('Switched to profile: ' + profileName + ' — refreshing…');
+            setTimeout(function () {
+                try { window.location.reload(); } catch (e) { /* headless/jsdom */ }
+            }, 350);
             return true;
         } else {
             showToast(data.detail || 'Daemon did not acknowledge the requested profile');

package/src/superlocalmemory/ui/js/settings.js

@@ -380,7 +380,7 @@ function _updateNavbarWidget(destinations) {
                 icon +
                 '<span style="flex:1;color:#e0e0e0;font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;">' + name + '</span>' +
                 '<span class="account-dest-badge ' + statusCls + '">' + statusText + '</span>' +
-                '<button class="btn btn-sm" onclick="disconnectDestination(\'' + dest.id + '\')" style="padding:0;border:0;color:#555;font-size:12px;" title="Disconnect"><i class="bi bi-x"></i></button>' +
+                '<button class="btn btn-sm" data-act-click="disconnect-destination" data-dest-id="' + dest.id + '" style="padding:0;border:0;color:#555;font-size:12px;" title="Disconnect"><i class="bi bi-x"></i></button>' +
                 '</div>';
         });
         accountList.innerHTML = html;
@@ -422,7 +422,7 @@ function renderCloudDestinations(destinations, container) {
             card.innerHTML = '<div class="card-body p-2">' +
                 '<div class="d-flex justify-content-between align-items-center">' +
                 '<div><i class="bi bi-' + icon + '"></i> <strong>' + dest.display_name + '</strong> ' + statusBadge + '</div>' +
-                '<button class="btn btn-outline-danger btn-sm" onclick="disconnectDestination(\'' + dest.id + '\')"><i class="bi bi-x-circle"></i></button>' +
+                '<button class="btn btn-outline-danger btn-sm" data-act-click="disconnect-destination" data-dest-id="' + dest.id + '"><i class="bi bi-x-circle"></i></button>' +
                 '</div>' +
                 '<div class="small text-muted mt-1">Last sync: ' + lastSync + '</div>' +
                 '</div>';
@@ -529,7 +529,21 @@ async function syncCloudNow() {
 async function exportBackup() {
     showToast('Preparing backup export...');
     try {
-        window.location.href = '/api/backup/export';
+        var response = await fetch('/api/backup/export', { method: 'POST' });
+        if (!response.ok) throw new Error('Export rejected');
+        var blob = await response.blob();
+        var disposition = response.headers.get('Content-Disposition') || '';
+        var match = disposition.match(/filename="?([^";]+)"?/i);
+        var objectUrl = URL.createObjectURL(blob);
+        var link = document.createElement('a');
+        link.href = objectUrl;
+        link.download = match ? match[1] : 'superlocalmemory-backup.db.gz';
+        link.style.display = 'none';
+        document.body.appendChild(link);
+        link.click();
+        link.remove();
+        URL.revokeObjectURL(objectUrl);
+        showToast('Backup export downloaded');
     } catch (error) {
         showToast('Export failed');
     }

package/src/superlocalmemory/ui/js/timeline.js

@@ -14,20 +14,49 @@ async function loadTimeline() {
     }
 }
 
+// DASH-V5 (3.7.9): the /timeline endpoint returns individual events (with a
+// `timestamp` but no `count`/`date`), while this chart needs per-day buckets.
+// Reading a non-existent `count` produced a [0, NaN] y-domain and 300+ rects
+// with height="NaN". Aggregate events into per-day counts client-side (and
+// still accept a pre-aggregated {date,count} shape if the API ever provides it).
+function _bucketTimeline(timeline) {
+    var first = timeline[0] || {};
+    if (first.count !== undefined && (first.date || first.period)) {
+        return timeline
+            .map(function(d) { return { date: d.date || d.period, count: +d.count || 0 }; })
+            .filter(function(d) { return d.date; });
+    }
+    var byDay = {};
+    timeline.forEach(function(e) {
+        var ts = e.timestamp || e.date || e.period || '';
+        var day = String(ts).slice(0, 10);
+        if (day) byDay[day] = (byDay[day] || 0) + 1;
+    });
+    return Object.keys(byDay).sort().map(function(day) {
+        return { date: day, count: byDay[day] };
+    });
+}
+
 function renderTimeline(timeline) {
     var container = document.getElementById('timeline-chart');
     if (!timeline || timeline.length === 0) {
         showEmpty('timeline-chart', 'clock-history', 'No timeline data for the last 30 days.');
         return;
     }
+    var buckets = _bucketTimeline(timeline);
+    if (buckets.length === 0) {
+        showEmpty('timeline-chart', 'clock-history', 'No timeline data for the last 30 days.');
+        return;
+    }
     var margin = { top: 20, right: 20, bottom: 50, left: 50 };
-    var width = container.clientWidth - margin.left - margin.right;
+    var width = Math.max(10, (container.clientWidth || 600) - margin.left - margin.right);
     var height = 300 - margin.top - margin.bottom;
     container.textContent = '';
     var svg = d3.select('#timeline-chart').append('svg').attr('width', width + margin.left + margin.right).attr('height', height + margin.top + margin.bottom).append('g').attr('transform', 'translate(' + margin.left + ',' + margin.top + ')');
-    var x = d3.scaleBand().range([0, width]).domain(timeline.map(function(d) { return d.date || d.period; })).padding(0.1);
-    var y = d3.scaleLinear().range([height, 0]).domain([0, d3.max(timeline, function(d) { return d.count; })]);
+    var x = d3.scaleBand().range([0, width]).domain(buckets.map(function(d) { return d.date; })).padding(0.1);
+    var maxCount = d3.max(buckets, function(d) { return d.count; }) || 1;
+    var y = d3.scaleLinear().range([height, 0]).domain([0, maxCount]);
     svg.append('g').attr('transform', 'translate(0,' + height + ')').call(d3.axisBottom(x)).selectAll('text').attr('transform', 'rotate(-45)').style('text-anchor', 'end');
-    svg.append('g').call(d3.axisLeft(y));
-    svg.selectAll('.bar').data(timeline).enter().append('rect').attr('class', 'bar').attr('x', function(d) { return x(d.date || d.period); }).attr('y', function(d) { return y(d.count); }).attr('width', x.bandwidth()).attr('height', function(d) { return height - y(d.count); }).attr('fill', '#667eea').attr('rx', 3);
+    svg.append('g').call(d3.axisLeft(y).ticks(Math.min(maxCount, 8)));
+    svg.selectAll('.bar').data(buckets).enter().append('rect').attr('class', 'bar').attr('x', function(d) { return x(d.date); }).attr('y', function(d) { return y(d.count); }).attr('width', x.bandwidth()).attr('height', function(d) { return Math.max(0, height - y(d.count)); }).attr('fill', '#667eea').attr('rx', 3);
 }

package/src/superlocalmemory/ui/js/trust-dashboard.js

@@ -2,8 +2,8 @@
 // Loads and displays Bayesian trust scores per agent and per fact.
 //
 // v3.4.21 (Operations pane): /api/v3/trust/dashboard returns
-// thousands of rows in one shot (3,900+ agents on Varun's live DB).
-// Client-side pagination keeps the table bounded; the user chooses
+// thousands of rows in one shot; client-side pagination keeps the table bounded.
+// The user chooses
 // sort order + page size; all data stays real (no mock fallback).
 
 (function trustDashboard() {

package/src/superlocalmemory/vector/lancedb_backend.py

@@ -186,10 +186,12 @@ class LanceDBVectorBackend:
         if tier_filter is None:
             tier_filter = ["active", "warm"]
 
-        # F-27: Validate tiers
-        assert all(t in self.VALID_TIERS for t in tier_filter), (
-            f"Invalid tier filter: {set(tier_filter) - self.VALID_TIERS}"
-        )
+        # F-27 / LOW-1 (3.7.9): validate tiers with a real check, not assert —
+        # `python -O` strips asserts, which would let an invalid tier build an
+        # invalid LanceDB predicate.
+        invalid = set(tier_filter) - self.VALID_TIERS
+        if invalid:
+            raise ValueError(f"Invalid tier filter: {invalid}")
 
         try:
             search = self._table.search(query_vector).metric("cosine").limit(top_k)
@@ -289,7 +291,7 @@ class LanceDBVectorBackend:
         """Update tier for a single fact."""
         try:
             self._table.update(
-                where=f"fact_id = '{fact_id}'",
+                where=self._fact_predicate(fact_id),
                 values={"tier": new_tier},
             )
         except Exception as exc:
@@ -309,7 +311,7 @@ class LanceDBVectorBackend:
             for fact_id, tier in rows:
                 try:
                     self._table.update(
-                        where=f"fact_id = '{fact_id}'",
+                        where=self._fact_predicate(fact_id),
                         values={"tier": tier},
                     )
                     updated += 1

package/plugin-src/.mcp.json

@@ -1,12 +0,0 @@
-{
-  "mcpServers": {
-    "superlocalmemory": {
-      "command": "${CLAUDE_PLUGIN_ROOT}/scripts/slm-launch",
-      "args": [],
-      "env": {
-        "SLM_MCP_PROFILE": "code",
-        "SLM_DATA_DIR": "${CLAUDE_PLUGIN_DATA}"
-      }
-    }
-  }
-}