release: merge audited 1.1.0 client aggregate

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "engraphis-memory",
       "source": "./",
       "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.",
-      "version": "1.0.1"
+      "version": "1.1.0"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engraphis-memory",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.",
   "author": {
     "name": "The Engraphis Authors",

.claude-plugin/skill-assets.sha256

@@ -1,5 +1,5 @@
-5c5336f5cc0e46c118dd13aace779555c07df1d5ec89828c02b1763a39bb637b  .claude-plugin/marketplace.json
-5dcc1fed4a7f2a527b1f756b90dc12d9b80fe393df0090e22a603f71c1b4faba  .claude-plugin/plugin.json
+f02c452829de41bae8ab81a6e74a3a9f89895c51dc9ba01cd3947c4baf0622e2  .claude-plugin/marketplace.json
+a17b520f3c1f3002aeba29d9312f9091d5a281035996c2e9c90b0397f4fb9fb9  .claude-plugin/plugin.json
 89bf2728e44a3c877e31982d387fcfab10fbe065eb6441b2792375ca5105c07c  skills/engraphis-memory/SKILL.md
 a295b0448e2ff372ddd8ea4e0bc8dc53f3d4bd56ff1fbd0d88cf4b6179511ce1  skills/engraphis-memory/references/CONVENTIONS.md
 45f4b4ad9dbfd39f2b377083d9b3eec5eed7cba7cb8fa139e3f420bdd6105343  skills/engraphis-memory/references/SCOPING.md

.env.example

@@ -10,7 +10,9 @@ ENGRAPHIS_PORT=8700
 # clients. Hosted vendor, relay, compute, and worker roles are not distributed here.
 ENGRAPHIS_SERVICE_MODE=customer
 # The dashboard base URL is derived from ENGRAPHIS_HOST:ENGRAPHIS_PORT.
-# Set ENGRAPHIS_DASHBOARD_URL for a canonical public HTTPS URL behind a reverse proxy.
+# Set ENGRAPHIS_DASHBOARD_URL for a canonical public HTTPS URL behind a reverse proxy;
+# it extends the dashboard MCP origin allow-list and drives legacy-inspector redirects.
+# ENGRAPHIS_DASHBOARD_URL=https://engraphis.example.com
 
 # Update reminder. When on (default), the server checks for a newer Engraphis release
 # once a day and surfaces it in the dashboard banner, the startup log, and over MCP.
@@ -151,7 +153,17 @@ ENGRAPHIS_LLM_API_KEY=sk-your-key-here
 # ENGRAPHIS_CLOUD_COMPUTE_URL=https://compute.engraphis.com
 # ENGRAPHIS_CLOUD_ORGANIZATION_ID=org_replace_me
 
-# Prefer the owner-only ~/.engraphis/cloud_session.json created during hosted onboarding.
+# Prefer the owner-only ~/.engraphis/cloud_session.json written by `engraphis connect`:
+#
+#   engraphis connect --token engr_ct_...        # the command your account portal shows
+#   printf %s "$TOKEN" | engraphis connect --token -   # keep the token out of shell history
+#
+# That is the supported way to connect a client. It redeems the one-time connect token, saves
+# the rotating refresh credential with 0600 permissions, and keeps it rotated afterwards, so
+# none of the variables below are needed on an interactive machine. Set
+# ENGRAPHIS_CLOUD_COMPUTE_URL (or pass --compute-url) only if your account portal shows a
+# compute endpoint different from the default. See docs/AGENT_CONNECT.md.
+#
 # For non-interactive deployments a refresh credential may be injected as a bootstrap secret.
 # It rotates on use; the owner-only saved replacement takes precedence afterward, even while
 # the environment variable remains set. Never commit it. Bind environment-only bootstrap
@@ -203,3 +215,65 @@ ENGRAPHIS_LLM_API_KEY=sk-your-key-here
 
 # Optional credential-redacted JSON logs for hosted customer deployments.
 # ENGRAPHIS_JSON_LOGS=1
+
+# ── Advanced / Operational ───────────────────────────────────────────────
+# These settings are used by advanced deployments, operators, and internal
+# subsystems. Leave commented unless your deployment needs them.
+
+# Logging — defaults to INFO, text format.
+# ENGRAPHIS_LOG_LEVEL=INFO
+# ENGRAPHIS_LOG_FORMAT=text
+# ENGRAPHIS_LOG_JSON=0
+
+# CORS — comma-separated origins allowed to call the dashboard REST API.
+# Default: http://127.0.0.1:<ENGRAPHIS_PORT> and
+# http://localhost:<ENGRAPHIS_PORT>. Explicit values replace both loopback origins.
+# ENGRAPHIS_CORS_ORIGINS=https://myapp.example.com
+
+# Rate limiting — requests per window. Default: 0 (disabled), with a 60s window
+# used when ENGRAPHIS_RATE_LIMIT is set above zero.
+# ENGRAPHIS_RATE_LIMIT=0
+# ENGRAPHIS_RATE_WINDOW=60
+
+# HTTPS security origin — used for HTTP-to-HTTPS redirects and security headers.
+# ENGRAPHIS_PUBLIC_URL wins; when unset, security falls back to
+# ENGRAPHIS_DASHBOARD_URL, then the legacy ENGRAPHIS_RELAY_PUBLIC_URL setting.
+# These settings do not change CORS; configure ENGRAPHIS_CORS_ORIGINS separately.
+# ENGRAPHIS_PUBLIC_URL=https://engraphis.example.com
+# ENGRAPHIS_RELAY_PUBLIC_URL=https://relay.example.com
+
+# Trusted local peers — comma-separated addresses exempt from rate limiting.
+# ENGRAPHIS_LOCAL_TRUSTED_PEERS=127.0.0.1,::1
+
+# Import roots — semicolon-separated (Windows) or colon-separated (POSIX)
+# directories allowed as import sources.
+# ENGRAPHIS_IMPORT_ROOTS=/srv/docs:/home/user/notes
+
+# Memory engine tuning — decay halflife (days), chunk sizing (tokens),
+# proactive context loop, and reranker model.
+# ENGRAPHIS_DECAY_HALFLIFE_DAYS=30
+# ENGRAPHIS_CHUNK_TOKENS=512
+# ENGRAPHIS_CHUNK_MAX=2048
+# ENGRAPHIS_CHUNK_OVERLAP=64
+# ENGRAPHIS_LOOP_INTERVAL=300
+# ENGRAPHIS_LOOP_TOP_K=10
+# ENGRAPHIS_RERANK_MODEL=cross-encoder/ms-marco-MiniLM-L-6-v2
+
+# Workspace allow-list — comma-separated names. Empty = all allowed.
+# ENGRAPHIS_WORKSPACES=acme,personal
+
+# Cloud Sync relay — endpoint and optional token for self-hosted relay.
+# ENGRAPHIS_RELAY_URL=https://relay.example.com
+# ENGRAPHIS_SYNC_TOKEN=
+# ENGRAPHIS_SYNC_READ_ONLY=0
+
+# Hosted plan upgrade URLs — override the default upgrade landing pages.
+# ENGRAPHIS_UPGRADE_URL=
+# ENGRAPHIS_PRO_UPGRADE_URL=
+# ENGRAPHIS_TEAM_UPGRADE_URL=
+
+# Update check cache duration (seconds). Default: 86400 (1 day).
+# ENGRAPHIS_UPDATE_CACHE=86400
+
+# Legacy inspector port (retired 2026-07-10; redirects to dashboard).
+# ENGRAPHIS_INSPECTOR_PORT=8710

.gitignore

@@ -16,6 +16,8 @@ undelivered_license_keys.tsv
 # lives next to the DB or in ~/.engraphis/). Regenerable local state, not content.
 automation.json
 autosync.json
+# Dashboard update-check cache; machine-local, regenerable runtime state.
+.engraphis_update_check.json
 .venv/
 venv/
 dist/

CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to Engraphis are documented here. Format loosely follows
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-07-26
+
+Public 1.1.0 hosted-connect and graph-experience release.
+
 ### Removed
 
 - **"Signed compliance export" is no longer advertised on any surface.** It was granted to
@@ -25,6 +29,35 @@ All notable changes to Engraphis are documented here. Format loosely follows
     the capability is not implemented and name the working alternative, instead of implying
     it is available in Engraphis Cloud.
 
+### Added
+
+- **`engraphis connect --token engr_ct_…`** — the missing client half of device connect.
+  `cloud_session.save_bootstrap()` is the only writer of `~/.engraphis/cloud_session.json`,
+  and it had no production caller: the docs told paying customers to prefer a file nothing
+  created, so a purchased installation could not be connected without hand-writing state.
+  The new command redeems the one-time connect token from the account portal against
+  `POST /v1/devices/connect`, saves the returned session with owner-only permissions, and
+  verifies `cloud_session.configured()` before reporting success. The token is sent in the
+  request body and nowhere else — never printed, logged, or written to disk — and every
+  refusal maps to fixed, actionable copy (an expired or already-used token is not confused
+  with a lapsed subscription). Session storage is pre-flighted before the exchange, so an
+  unwritable state directory or a `cloud_session.json` replaced by a link fails the command
+  *without* spending the single-use token — the customer fixes the path and retries with the
+  same token instead of returning to the portal for a new one. Faults that can only happen
+  *after* the exchange — a reply truncated mid-body (`http.client.IncompleteRead`), or an
+  endpoint that stops resolving before the session is written (`CloudUrlUnresolved`) — are
+  reported as errors that say the token was already used, rather than escaping as tracebacks
+  that leave the customer unable to tell whether to retry. Also installed as
+  `engraphis-connect`.
+- An `engraphis` front-door command that dispatches to the existing `engraphis-<verb>`
+  entry points, so the command the account portal displays is runnable as shown.
+- A stable per-installation identity at `~/.engraphis/client_identity.json` (random ULIDs,
+  not a hardware fingerprint) so reconnecting a machine updates its existing installation
+  instead of registering a new device every time.
+- An opt-in canvas graph engine (`?graph-engine=next`) with the existing ForceGraph + D3
+  visual modes, deterministic communities, accessible classic fallback, lazy CSP-confined
+  assets, bounded simulations, and large/dense-graph rendering guards.
+
 ### Changed
 
 - Managed compute consent now travels with the cloud account: an installation connected to
@@ -34,6 +67,12 @@ All notable changes to Engraphis are documented here. Format loosely follows
   `ENGRAPHIS_MANAGED_COMPUTE_CONSENT` remains as an explicit operator override (`=0` opts a
   connected installation back out, `=1` forces it on regardless of session state) and is no
   longer surfaced anywhere in the UI.
+- Hosted plan presentation now follows the control plane's active, trial, expired, and
+  lapsed states; renewal follows the plan actually held, account actions use the
+  plan-neutral portal, and a spent trial is never offered again.
+- Device-connect and refresh responses validate credential fields as strings, preserve
+  single-use-token semantics across truncated responses, and refuse unsafe session-storage
+  paths before redeeming a token.
 
 ## [1.0.1] - 2026-07-24
 

MANIFEST.in

@@ -3,6 +3,7 @@ global-exclude *.pyo
 
 recursive-include engraphis/static *.html *.css *.js *.png *.ico
 recursive-include engraphis/static/vendor *
+recursive-include engraphis/dashboard_assets *.js
 include engraphis/commercial_manifest.json
 include LICENSE NOTICE README.md CHANGELOG.md
 include pyproject.toml

README.md

@@ -664,7 +664,7 @@ All via environment (or `.env`):
 | `ENGRAPHIS_LLM_MODEL` | `gpt-4o-mini` | Model name (provider-specific) |
 | `ENGRAPHIS_LLM_API_KEY` | — | API key for chat/synthesis, `llm` / `llm_structured` extraction, and structured consolidation |
 | `ENGRAPHIS_LLM_BASE_URL` | — | Base URL for openrouter / custom OpenAI-compatible endpoints |
-| `ENGRAPHIS_LLM_AUTO_EXTRACT` | `1` | After a successful live connection test, automatically switch the running engine to `llm_structured`; the dashboard's extraction Off button persists `0`, and its On button restores `1` |
+| `ENGRAPHIS_LLM_AUTO_EXTRACT` | `0` | Opt in to switching the running engine to `llm_structured` after a successful live connection test; the dashboard's extraction Off button persists `0`, and its On button restores `1` |
 | `ENGRAPHIS_FORWARDED_ALLOW_IPS` | *(none)* | Proxies trusted for forwarded client/TLS headers (`*` only when the service is reachable exclusively through that proxy) |
 | `ENGRAPHIS_LOCAL_TRUSTED_PEERS` | *(none)* | Exact peers/CIDRs treated as local without forwarding headers; intended for the shipped loopback-published Compose bridge, not public deployments |
 | `ENGRAPHIS_CLOUD_CONTROL_URL` | hosted default | Official entitlement, organization, and credential control API |

docs/AGENT_CONNECT.md

@@ -25,8 +25,9 @@ organization:
 
 1. The organization owner starts Team or purchases a subscription in Engraphis Cloud.
 2. The owner invites named members and assigns roles in the hosted dashboard.
-3. A member accepts the invitation and creates a scoped agent/device credential.
-4. The member configures their agent with the hosted URL and the one-time credential.
+3. A member accepts the invitation and generates a one-time **connect token** (`engr_ct_…`).
+   The account portal shows the exact command to run.
+4. The member runs that command on the machine being connected (see below).
 5. The hosted service rechecks organization membership, role, scopes, entitlement version, and
    workspace binding on every request.
 
@@ -37,6 +38,53 @@ The hosted onboarding flow provides the exact endpoint and client snippet for th
 organization. Do not substitute the URL of a public self-hosted image: that image intentionally
 has no Team identity backend.
 
+## Connect a machine: `engraphis connect`
+
+Copy the command from your account portal and run it on the machine you are connecting:
+
+```bash
+engraphis connect --token engr_ct_...
+```
+
+That redeems the token against `POST /v1/devices/connect` on the control plane and writes the
+owner-only session file `~/.engraphis/cloud_session.json` (mode `0600`). The dashboard, the MCP
+server, and Cloud Sync all read that file, so no environment secret is needed afterwards. Rerun
+`engraphis connect` with a fresh token on every machine you want connected.
+
+Useful options:
+
+| Option | Effect |
+| --- | --- |
+| `--token -` | Read the token from stdin, so it never enters shell history. |
+| `--workspace WS_ID` | Bind this device to a single workspace. |
+| `--label TEXT` | Name this installation in your account portal. |
+| `--device-name TEXT` | Override the device name (defaults to the hostname). |
+| `--control-url URL` | Point at a non-default control plane. |
+| `--compute-url URL` | Set the managed compute endpoint (also `ENGRAPHIS_CLOUD_COMPUTE_URL`). |
+| `--json` | Print a redacted, machine-readable summary. |
+
+The same command is installed as `engraphis-connect`, matching the other `engraphis-*` scripts.
+
+Connect tokens are **single-use and short-lived**. The service answers every refusal — expired,
+already redeemed, or never valid — with the same `401`, so the client reports all three
+possibilities and the fix is always the same: generate a new token in the account portal. A `402`
+means the subscription itself has lapsed; fix billing rather than the token.
+
+Because the token is single-use, the client checks that it can actually write the session file
+*before* redeeming it. If the state directory is not writable, or `cloud_session.json` has been
+replaced by a symlink, a hard link, or a directory, the command fails immediately, names the path
+to fix, and sends nothing — your token is untouched, so you can correct the path and rerun the
+same command rather than issuing a new token.
+
+The token is a credential. It is sent in the request body and nowhere else — it is never
+printed, never logged, and never written to disk. What *is* written is the rotating refresh
+credential the service returns, which is why the session file is owner-only.
+
+The command also mints a stable per-installation identity at `~/.engraphis/client_identity.json`
+(random ULIDs, not a hardware fingerprint) so reconnecting the same machine updates the existing
+installation instead of registering a new device every time. Both files honour
+`ENGRAPHIS_STATE_DIR`; a distinct state directory is a distinct installation.
+
 ## Credential lifecycle
 
 Hosted access uses short-lived access tokens plus rotating refresh credentials. A refresh family
@@ -45,7 +93,10 @@ service; the raw replacement is returned once and must be kept in an owner-only
 or secrets manager.
 
 Customer-side environment variables are documented in [`.env.example`](../.env.example). Prefer
-the onboarding-created `~/.engraphis/cloud_session.json` over long-lived environment secrets.
+the `~/.engraphis/cloud_session.json` that `engraphis connect --token` writes over long-lived
+environment secrets: it holds a rotating credential, it is owner-only, and it is the path the
+client keeps up to date on its own. Environment secrets are for non-interactive deployments that
+cannot run the connect command.
 
 ## Trial and grace
 

engraphis/__init__.py

@@ -7,4 +7,4 @@
 except PackageNotFoundError:  # source tree without an installed distribution
     # Keep in step with [project] version in pyproject.toml — tests/test_packaging.py
     # pins the two together so a release cannot ship them out of sync.
-    __version__ = "1.0.1"
+    __version__ = "1.1.0"