fix mcp graph and file uploads

[Prasanna721]

Fixes cross-host graph rendering and moves widget uploads off the JSON/base64 tool transport.

• render graph data from the launcher result without a second tool call
• stream multipart uploads through one-time, short-lived upload sessions
• remove temporary widget diagnostics and redundant unit tests

Tested with Biome, TypeScript, 17 unit tests, a Wrangler deployment dry-run, and live graph rendering in ChatGPT and Claude. Authenticated E2E setup is currently blocked by the saved OAuth refresh session returning invalid_grant: session not found.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	130a136	Aug 01 2026, 05:16 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	130a136	Commit Preview URL Branch Preview URL	Aug 01 2026, 05:18 PM

[claude]

Claude finished @Prasanna721's task in 2m 10s —— View job

---

Review Complete

• Fetch PR diff and existing review comments
• Analyze changes for bugs, security issues, and logic errors
• Review key files in context
• Submit review with findings

Summary: Reviewed 35 changed files focusing on the upload session mechanism and graph rendering changes. No bugs, security issues, or logic errors found. The new upload session design is secure (hashed tokens, atomic one-time consumption, TTL expiry) and the graph simplification correctly passes data via structuredContent rather than requiring a second tool call.

Score: 10/10 — Clean code, ready to ship.

[claude]

Overview: Replaces base64-over-tool-transport file uploads with secure one-time upload sessions and simplifies graph rendering by passing document data directly in structuredContent.

Issues found: None — this looks good to ship.

Details:

The upload session mechanism is well-designed:

• Tokens are SHA-256 hashed before storage
• Sessions are consumed atomically in a transaction (one-time use)
• 2-minute TTL with alarm-based cleanup
• UUID validation on upload endpoint

The graph refactor correctly removes the second fetch-graph-data tool call from the widget — documents now arrive directly via the tool's structuredContent, which fixes cross-host rendering issues (no need for the widget to establish its own MCP connection to fetch data).

Test cleanup looks intentional — the deleted tests covered code paths that no longer exist (base64 decoding, widget diagnostic logging, etc.).

Score: 10/10

[polylane]

Note

Production impact unlikely.

Checked the upload proxy, DO methods, graph, and widget changes against supermemory-mcp (~150 req/h, 0 errors). New /upload route is additive, containerTag matches the API docs, MCP_PUBLIC_ORIGIN has a correct fallback.

View the full analysis →

_{Polylane analysed 130a136 for production impact.}