prism-mcp-server 19.2.8 → 19.3.0

package/dist/utils/layer1.js

@@ -0,0 +1,110 @@
+/**
+ * Layer 1 semantic pre-classifier for prism_infer.
+ * ─────────────────────────────────────────────────────────────
+ * Calls dcostenco/prism-coder:4b via Ollama to classify whether
+ * a prompt is OBVIOUS_RESERVED, OBVIOUS_NOT_RESERVED, or UNCERTAIN.
+ *
+ * Fail-closed contract:
+ *   OBVIOUS_NOT_RESERVED → the ONLY verdict that permits local routing
+ *   OBVIOUS_RESERVED     → escalate to cloud
+ *   UNCERTAIN            → escalate to cloud (conservative)
+ *   ERROR                → escalate to cloud (never fail-open)
+ *
+ * The prompt below is VERBATIM from §E of prism-infer-boundaries/SKILL.md.
+ * It is duplicated here (not imported) because prism is a thin client with no
+ * access to the skills tree at runtime. A drift test asserts byte-for-byte match.
+ *
+ * Must not run when mode="route" and max_tokens<=16 — that IS a Layer 1 call.
+ */
+// VERBATIM — §E prism-infer-boundaries/SKILL.md. Do not edit without re-running eval-layer1.mjs.
+export const LAYER1_PROMPT = `Classify this request with exactly one word: OBVIOUS_RESERVED, OBVIOUS_NOT_RESERVED, or UNCERTAIN.
+
+OBVIOUS_RESERVED — clearly involves:
+- Behavioral crisis: de-escalation, meltdown management, rage episode, violent behavior response
+- Physical restraint, holds, containment, physical management of clients
+- Self-harm: client bites/hits/scratches/bangs self, draws blood, injures self
+- Suicide, homicide, harm to self or others, safety planning
+- Client physical elopement incidents — client ran away, bolted, or escaped (with prior documented incidents)
+- Writing auth/login/JWT/token/session validation code
+- Determining if code bypasses auth or allows unauthenticated access
+- Assessing whether code actually exposes PHI or constitutes a HIPAA violation
+- Whether to push, ship, deploy, or block a production release
+- Diagnosis code assignment
+
+OBVIOUS_NOT_RESERVED — general coding, code review, analysis, documentation, test generation, data processing.
+
+UNCERTAIN — if the request touches reserved vocabulary but the task is non-security, non-clinical operational work (e.g., deleting or renaming a file, adding a non-auth data field to a form, reviewing existing code for dead exports or hook order) rather than writing clinical safety protocols, implementing auth or security code, making push or deploy decisions, or determining compliance.
+
+Request: "{prompt}"
+
+Answer (one word):`;
+const VALID = new Set([
+    "OBVIOUS_RESERVED",
+    "OBVIOUS_NOT_RESERVED",
+    "UNCERTAIN",
+]);
+/**
+ * Parse the model's raw text into a verdict. Extracts the first token of
+ * letters/underscores (ignoring leading punctuation, quotes, whitespace).
+ * Anything not in the valid set → ERROR, which the caller escalates.
+ * Note: OBVIOUS_NOT_RESERVED contains "RESERVED" as a substring — whole-token
+ * matching via Set prevents the substring trap from inverting the gate.
+ */
+export function parseLayer1(raw) {
+    if (!raw)
+        return "ERROR";
+    const m = raw.trim().toUpperCase().match(/[A-Z_]+/);
+    if (!m)
+        return "ERROR";
+    const token = m[0];
+    return VALID.has(token) ? token : "ERROR";
+}
+// p95 measured 484–511ms on warm 4b; 1500ms is a generous ceiling that still
+// fails closed on model stall without blocking the handler for too long.
+const LAYER1_TIMEOUT_MS = 1_500;
+/**
+ * Run the Layer 1 classifier. Returns a verdict; never throws.
+ * On ANY failure path returns "ERROR" so the caller escalates to cloud.
+ *
+ * @param userPrompt  the end-user prompt being classified (NOT the LAYER1_PROMPT)
+ * @param ollamaUrl   Ollama base URL
+ * @param model       classifier model tag (caller-resolved via resolveOllamaName)
+ * @param fetchImpl   injected for tests; defaults to global fetch
+ */
+export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch) {
+    if (!userPrompt || !userPrompt.trim())
+        return "ERROR";
+    let res;
+    try {
+        res = await fetchImpl(`${ollamaUrl}/api/chat`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                model,
+                messages: [
+                    { role: "user", content: LAYER1_PROMPT.replace("{prompt}", userPrompt) },
+                ],
+                stream: false,
+                think: false,
+                options: { num_predict: 16, temperature: 0 },
+            }),
+            signal: AbortSignal.timeout(LAYER1_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return "ERROR";
+    }
+    if (!res.ok)
+        return "ERROR";
+    let data;
+    try {
+        data = await res.json();
+    }
+    catch {
+        return "ERROR";
+    }
+    if (data?.error)
+        return "ERROR";
+    const text = data?.message?.content;
+    return parseLayer1(text);
+}

package/dist/utils/projectResolver.js

@@ -2,8 +2,7 @@
  * Prism Project Resolver — Local Storage Variant
  * ================================================
  *
- * Same contract as the synalux portal resolver
- * (synalux-private/portal/src/lib/prism-project-resolver.ts) but
+ * Same contract as the Synalux portal resolver but
  * sources the project registry from local prism-config.db settings
  * (`repo_path:<project>` keys) instead of the `prism_projects`
  * Supabase table.
@@ -13,8 +12,7 @@
  * portal resolver becomes authoritative and this one becomes a noop
  * for the same write.
  *
- * Background: see synalux-private project ledger entry
- * 2026-04-30-thin-client-architecture-directive — the prism-aac
+ * Background: thin-client architecture directive 2026-04-30 — the prism-aac
  * Azure-leak memory-loss bug was caused by the absence of this
  * validation.
  */

package/dist/utils/qualityGate.js

@@ -7,19 +7,29 @@
  *
  * Returns: { pass: boolean, reason?: string }
  */
+/**
+ * Signal 5 — Tool-call bleed: pipe-delimited format leaking into non-tool turns.
+ * Matches <|tool_call|> and <|tool_call_end|> only — NOT angle-bracket <tool_call> variants
+ * (those are normalized by normalizeToolCallFormat, not gated as failures).
+ */
+export const TOOL_CALL_BLEED_RE = /<\|tool_call\|>|<\|tool_call_end\|>/;
 /**
  * Check if a model response passes the quality gate.
  * @param stripped  Response AFTER think-stripping (use stripThink first)
  * @param thinkOnly  True if the response was only <think> blocks with no answer
  * @param finishReason  Ollama's finish_reason if available (e.g. "length" = truncated)
+ * @param mode  Inference mode — "route" uses length===0 floor; "code"/"chat" keep <5
  */
-export function passesQualityGate(stripped, thinkOnly, finishReason) {
+export function passesQualityGate(stripped, thinkOnly, finishReason, mode) {
     // Signal 1: Think-only — model reasoned but produced no answer (check before empty)
     if (thinkOnly) {
         return { pass: false, reason: "think_only" };
     }
-    // Signal 2: Empty or near-empty after stripping
-    if (stripped.trim().length < 5) {
+    // Signal 2: Mode-aware empty floor.
+    // Route legitimately returns 1–4 char labels ("P1", "YES", "CO4", "FIXED").
+    // Use length===0 for route; keep <5 for code/chat where single-word answers are invalid.
+    const emptyFloor = mode === "route" ? 0 : 4;
+    if (stripped.trim().length <= emptyFloor) {
         return { pass: false, reason: "empty_response" };
     }
     // Signal 3: Hard truncation — Ollama reports finish_reason="length"
@@ -27,6 +37,12 @@ export function passesQualityGate(stripped, thinkOnly, finishReason) {
     if (finishReason === "length") {
         return { pass: false, reason: "hard_truncation" };
     }
+    // Signal 5: Tool-call bleed — fine-tuned 4b emits <|tool_call|> format in non-tool turns.
+    // Pipe-delimited format only; angle-bracket variants are handled by normalizeToolCallFormat.
+    // False-positive guard: requires the literal pipe tokens, not the words "tool call".
+    if (TOOL_CALL_BLEED_RE.test(stripped)) {
+        return { pass: false, reason: "tool_call_bleed" };
+    }
     // Signal 4: Exact-loop detection (two passes).
     //
     // Pass A (prose-only, threshold ≥3): strip structural markdown that

package/dist/utils/safetyGate.js

@@ -56,6 +56,26 @@ const MEDICAL_INPUT_RE = [
     /(?:how\s+much|what\s+dose)\s+.*(?:should\s+I|do\s+I|can\s+I)\s+(?:inject|take|give)/i,
     /(?:dose|dosage)\s+(?:should\s+I|do\s+I|can\s+I)\s+(?:inject|take|give)/i,
 ];
+// ── Output: BCBA reserved category — physical management / restraint / seclusion ─
+//
+// These patterns are a BACKSTOP (Option 1) — high-precision/low-recall.
+// The structural safety mechanism is Option 4: consequence/crisis sections of BIPs
+// never generate locally. These regexes catch the obvious cases if section-routing fails.
+// They do NOT substitute for the structural gate; euphemistic phrasings ("guide the client
+// firmly to the floor") pass through, so the structural gate is the primary control.
+const BCBA_OUTPUT_RE = [
+    // Explicit restraint technique names
+    /\b(?:prone|supine|basket|therapeutic|manual)\s+(?:hold|restraint)\b/i,
+    /\btwo[-\s]?person\s+(?:hold|restraint)\b/i,
+    /\bphysical\s+(?:intervention|management|restraint)\b/i,
+    // Seclusion
+    /\bseclusion\s+(?:room|protocol|procedure|space)\b/i,
+    /\bplace\s+(?:the\s+)?client\s+in\s+(?:a\s+)?(?:seclusion|hold|timeout\s+room)\b/i,
+    // Staff-instruction framing (high-precision: requires staff + restraint verb + client)
+    /\bstaff\s+(?:should|must|will)\s+(?:physically\s+)?(?:hold|restrain|manage)\s+(?:the\s+)?client\b/i,
+    /\bcaregiver\s+(?:should|must|will)\s+(?:physically\s+)?(?:hold|restrain|manage)\s+(?:the\s+)?client\b/i,
+];
+export const BCBA_RESPONSE = "This output contains physical management content (restraint, hold, or seclusion procedure). Consequence strategy and crisis/safety sections require cloud review — they cannot generate locally per BCBA clinical standards. Escalating to cloud.";
 // ── Output: model providing dangerous instructions ───────────────────────────
 const CRISIS_OUTPUT_RE = [
     /\bhow many pills\s+to\b/i,
@@ -96,6 +116,8 @@ export function checkInputSafety(text) {
 }
 export function checkOutputSafety(response) {
     const r = normalize(response);
+    if (BCBA_OUTPUT_RE.some(re => re.test(r)))
+        return BCBA_RESPONSE;
     if (CRISIS_OUTPUT_RE.some(re => re.test(r)))
         return CRISIS_RESPONSE;
     if (MEDICAL_OUTPUT_RE.some(re => re.test(r)))

package/dist/vm/competitorImport.js

@@ -13,7 +13,7 @@
  *   - Eclipse
  *   - Flutter/Dart
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 export const COMPETITOR_PLATFORMS = [
     {

package/dist/vm/componentMarketplace.js

@@ -9,7 +9,7 @@
  *   - License enforcement and revenue sharing
  *   - Category-based discovery and search
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 export const MARKETPLACE_TIERS = {
     free: {

package/dist/vm/creativeStudio.js

@@ -8,7 +8,7 @@
  *   - Audio generation and production
  *   - All tier-gated through Synalux subscription
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 export const CREATIVE_STUDIO_TIERS = {
     free: {

package/dist/vm/ethicsEnforcement.js

@@ -14,7 +14,7 @@
  *   5. KILL SWITCH         — instant account suspension (remote, irreversible)
  *   6. AUDIT TRAIL         — tamper-proof logging for compliance investigations
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 /** Default prohibited use policy — hardcoded, cannot be overridden per-tenant */
 export const PROHIBITED_USE_POLICY = {
@@ -122,7 +122,7 @@ export const DEFAULT_USE_CASE_SCREENING = {
     human_review_queue: true,
     re_screening_interval_days: 30,
     prohibited_dependencies: [
-        // Placeholder patterns — real list maintained in synalux-private
+        // Placeholder patterns — see portal-side ethics enforcement config
         '@military/*', 'defense-*', 'weapon-*', 'surveillance-*',
     ],
     government_domain_patterns: [

package/dist/vm/gameEngine.js

@@ -15,7 +15,7 @@
  *   - Cross-platform build matrix
  *   - Plugin/SDK sandbox
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 /** Preset memory budgets for common platforms */
 export const MEMORY_BUDGETS = {

package/dist/vm/projectTemplates.js

@@ -8,7 +8,7 @@
  *   - Creative projects (3D visualization, VR experience, etc.)
  *   - Enterprise (dashboards, APIs, microservices)
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 // ══════════════════════════════════════════════════════════════════
 // 2. GAME TEMPLATES

package/dist/vm/types.js

@@ -7,8 +7,7 @@
  *
  * Only interfaces live in Prism — implementations stay in Synalux.
  *
- * @see synalux-private/portal/src/lib/vm-manager.ts
- * @see synalux-private/portal/src/lib/device-registry.ts
+ * @see Synalux portal — vm-manager, device-registry
  */
 /** Preset network conditions for load testing */
 export const NETWORK_PRESETS = {

package/dist/vm/vmManager.js

@@ -2,7 +2,7 @@
  * VM Manager — Prism IDE Hypervisor Abstraction
  * ==============================================
  * Interface layer for VM lifecycle management.
- * Implementations live in Synalux (synalux-private/portal/src/lib/vm-manager.ts).
+ * Implementations are portal-side (Synalux VM manager).
  *
  * Supports:
  * - VM creation from built-in templates or custom specs

package/dist/vm/workspaceLicensing.js

@@ -9,7 +9,7 @@
  * Required because the marketplace allows building, distributing, and selling apps.
  * License compliance is enforced at build, deploy, and publish time.
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 /** Workspace license presets */
 export const WORKSPACE_LICENSE_PRESETS = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "19.2.8",
+  "version": "19.3.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",