prism-mcp-server 20.0.7 → 20.0.8

package/README.md

@@ -18,6 +18,16 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ---
 
+## What's New in v20.0.8
+
+### verify_behavior Works Again
+The `verify_behavior` tool crashed on every call (`-32602 expected object, received string`) — the handler returned a bare string instead of an MCP `CallToolResult` object. Fixed, with contract + fail-closed regression tests so the safety gate can never silently break again. If you're on 20.0.6/20.0.7, update.
+
+### From v20.0.7: Reserved-Content Safety, Skills Auth, Delegation Metrics
+Reserved clinical content is now Claude-or-refuse (never served by a smaller model than the one that refused it), skill delivery gained a JWT auth fallback (paid-tier skills now reach machines using only `PRISM_SYNALUX_API_KEY`), and every `prism_infer` call is recorded in a persistent `infer_metrics` ledger. Full details in [CHANGELOG.md](CHANGELOG.md).
+
+---
+
 ## What's New in v20.0.5
 
 ### Local-First Delegation — 15 Categories, Measured Rate

package/dist/tools/behavioralVerifierHandler.js

@@ -23,7 +23,16 @@ const FALLBACK_SCENARIO = [
     "",
     "Answer concretely. If you cannot, READ THE FILE FIRST.",
 ].join("\n");
+/**
+ * MCP tool entrypoint. Every tool handler MUST return a CallToolResult
+ * object ({ content: [{ type: "text", text }] }) — returning a bare string
+ * makes the MCP SDK reject the result ("expected object, received string",
+ * -32602). See the dispatch contract in server.ts (result.content usage).
+ */
 export async function verifyBehaviorHandler(args) {
+    return { content: [{ type: "text", text: await buildScenarioText(args) }] };
+}
+async function buildScenarioText(args) {
     if (!SYNALUX_CONFIGURED || !PRISM_SYNALUX_BASE_URL) {
         return FALLBACK_SCENARIO;
     }

package/dist/utils/groundingVerifier.js

@@ -9,9 +9,9 @@
  * stateless MCP), pointed at free-form generation instead of tool-call
  * responses.
  *
- * Cascade role: prism-coder:4b is the default verifier (fast, 2.5GB).
+ * Cascade role: qwen3.5:4b is the default verifier (fast, 2.5GB).
  * 14b drafts; 4b verifies. Different model = Patronus rule satisfied.
- * Falls back to 1b7 on devices with <4GB free RAM.
+ * Falls back to 2b on devices with <4GB free RAM.
  *
  * Failure modes:
  *   - Verifier model unreachable / timeout → fail-closed refusal
@@ -93,7 +93,7 @@ function refusalText(action, failedClaim) {
     }
 }
 export async function verifyGrounding(opts) {
-    const verifierModel = opts.verifierModel ?? "prism-coder:4b";
+    const verifierModel = opts.verifierModel ?? "qwen3.5:4b";
     const timeoutMs = opts.timeoutMs ?? 2000;
     const ollamaUrl = opts.ollamaUrl ?? PRISM_LOCAL_LLM_URL;
     const fetchImpl = opts.fetchImpl ?? fetch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.0.7",
+  "version": "20.0.8",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",

package/dist/agent/agentTools.js

@@ -1,453 +0,0 @@
-/**
- * Agent Tools — Local workspace tools for the Prism Agent Terminal
- * =================================================================
- *
- * Provides file system, shell, and memory access tools that the AI agent
- * can invoke during an interactive `prism prompt` session. These are
- * declared as Gemini Function Declarations and executed locally.
- *
- * Mirrors the Synalux VS Code extension's local-tools.ts capabilities
- * but runs in a terminal context (no VS Code API dependency).
- */
-import * as fs from "fs";
-import * as path from "path";
-import { exec } from "child_process";
-import { promisify } from "util";
-import { SchemaType } from "@google/generative-ai";
-import { openUrlCommand, fetchUrlCommand, listFilesCommand, searchFilesCommand, resolveCli, IS_WINDOWS, } from "./platformUtils.js";
-const execAsync = promisify(exec);
-// ---------------------------------------------------------------------------
-// Tool Declarations (Gemini Function Calling Schema)
-// ---------------------------------------------------------------------------
-export const AGENT_TOOL_DECLARATIONS = [
-    {
-        name: "read_file",
-        description: "Read the contents of a file. Use when the user asks about code, configs, or any file. Supports optional line range.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                path: {
-                    type: SchemaType.STRING,
-                    description: "Absolute or relative file path to read",
-                },
-                start_line: {
-                    type: SchemaType.INTEGER,
-                    description: "Optional start line (1-indexed)",
-                },
-                end_line: {
-                    type: SchemaType.INTEGER,
-                    description: "Optional end line (1-indexed, inclusive)",
-                },
-            },
-            required: ["path"],
-        },
-    },
-    {
-        name: "list_files",
-        description: "List files and directories. Use when the user asks about project structure or wants to find files.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                directory: {
-                    type: SchemaType.STRING,
-                    description: "Directory path to list (default: current working directory)",
-                },
-                pattern: {
-                    type: SchemaType.STRING,
-                    description: "Optional glob pattern filter (e.g., '**/*.ts')",
-                },
-                max_depth: {
-                    type: SchemaType.INTEGER,
-                    description: "Maximum directory depth to traverse (default: 3)",
-                },
-            },
-        },
-    },
-    {
-        name: "search_files",
-        description: "Search for text or patterns across files using ripgrep. Use when the user wants to find where something is defined or used.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                query: {
-                    type: SchemaType.STRING,
-                    description: "Text or regex pattern to search for",
-                },
-                directory: {
-                    type: SchemaType.STRING,
-                    description: "Directory to search in (default: cwd)",
-                },
-                file_pattern: {
-                    type: SchemaType.STRING,
-                    description: "Glob to filter files (e.g., '*.ts')",
-                },
-                max_results: {
-                    type: SchemaType.INTEGER,
-                    description: "Maximum results (default: 20)",
-                },
-            },
-            required: ["query"],
-        },
-    },
-    {
-        name: "run_command",
-        description: "Execute a shell command and return stdout/stderr. Use for running tests, builds, git commands, etc. Commands have a 30-second timeout.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                command: {
-                    type: SchemaType.STRING,
-                    description: "Shell command to execute",
-                },
-                cwd: {
-                    type: SchemaType.STRING,
-                    description: "Working directory (default: cwd)",
-                },
-            },
-            required: ["command"],
-        },
-    },
-    {
-        name: "write_file",
-        description: "Create or overwrite a file with the given content. Creates parent directories if needed.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                path: {
-                    type: SchemaType.STRING,
-                    description: "File path to write to",
-                },
-                content: {
-                    type: SchemaType.STRING,
-                    description: "Content to write",
-                },
-            },
-            required: ["path", "content"],
-        },
-    },
-    {
-        name: "edit_file",
-        description: "Apply a targeted search-and-replace edit to a file. Use instead of write_file when making small changes.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                path: {
-                    type: SchemaType.STRING,
-                    description: "File path to edit",
-                },
-                search: {
-                    type: SchemaType.STRING,
-                    description: "Exact text to find and replace",
-                },
-                replace: {
-                    type: SchemaType.STRING,
-                    description: "Replacement text",
-                },
-            },
-            required: ["path", "search", "replace"],
-        },
-    },
-    {
-        name: "memory_search",
-        description: "Search the user's Prism memory (past sessions, decisions, TODOs). Use when the user asks about previous work or project history.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                query: {
-                    type: SchemaType.STRING,
-                    description: "Search query",
-                },
-                project: {
-                    type: SchemaType.STRING,
-                    description: "Project to search within",
-                },
-                limit: {
-                    type: SchemaType.INTEGER,
-                    description: "Max results (default: 5)",
-                },
-            },
-            required: ["query"],
-        },
-    },
-    {
-        name: "open_url",
-        description: "Open a URL in the user's default browser.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                url: {
-                    type: SchemaType.STRING,
-                    description: "URL to open",
-                },
-            },
-            required: ["url"],
-        },
-    },
-    {
-        name: "fetch_url",
-        description: "Fetch the text content of a web page and return it. Use when the user wants you to read, summarize, or analyze a web page.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                url: {
-                    type: SchemaType.STRING,
-                    description: "The URL to fetch content from",
-                },
-            },
-            required: ["url"],
-        },
-    },
-    {
-        name: "supabase_cli",
-        description: "Execute Supabase CLI commands (e.g., status, diff, push, db pull). Always use this for Supabase database management.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                args: {
-                    type: SchemaType.STRING,
-                    description: 'The arguments to pass to the supabase CLI (e.g., "db pull", "status")',
-                },
-            },
-            required: ["args"],
-        },
-    },
-    {
-        name: "stripe_cli",
-        description: "Execute Stripe CLI commands (e.g., listen, trigger, login). Always use this for Stripe operations.",
-        parameters: {
-            type: SchemaType.OBJECT,
-            properties: {
-                args: {
-                    type: SchemaType.STRING,
-                    description: 'The arguments to pass to the stripe CLI (e.g., "listen --forward-to localhost:3000/api/webhook")',
-                },
-            },
-            required: ["args"],
-        },
-    },
-];
-// ---------------------------------------------------------------------------
-// Tool Executor
-// ---------------------------------------------------------------------------
-/**
- * Resolve a path — if relative, resolve against cwd.
- */
-function resolvePath(filePath) {
-    if (path.isAbsolute(filePath))
-        return filePath;
-    return path.resolve(process.cwd(), filePath);
-}
-/**
- * Execute an agent tool and return the result as a string.
- */
-export async function executeAgentTool(toolName, args, project) {
-    switch (toolName) {
-        // ─── read_file ─────────────────────────────────────────────
-        case "read_file": {
-            const filePath = resolvePath(args.path);
-            if (!fs.existsSync(filePath))
-                return `Error: File not found: ${filePath}`;
-            const content = fs.readFileSync(filePath, "utf-8");
-            const lines = content.split("\n");
-            const start = Math.max(1, args.start_line || 1);
-            const end = Math.min(lines.length, args.end_line || lines.length);
-            const slice = lines.slice(start - 1, end);
-            // Add line numbers
-            const numbered = slice.map((l, i) => `${start + i}: ${l}`).join("\n");
-            return `File: ${filePath} (${lines.length} lines total, showing ${start}-${end})\n\n${numbered}`;
-        }
-        // ─── list_files ────────────────────────────────────────────
-        case "list_files": {
-            const dir = resolvePath(args.directory || ".");
-            if (!fs.existsSync(dir))
-                return `Error: Directory not found: ${dir}`;
-            const maxDepth = args.max_depth || 3;
-            const pattern = args.pattern;
-            const cmd = listFilesCommand(dir, maxDepth, pattern);
-            try {
-                const { stdout } = await execAsync(cmd, { timeout: 10000, shell: IS_WINDOWS ? "powershell.exe" : undefined });
-                const entries = stdout.trim().split("\n").filter(Boolean);
-                return `Directory: ${dir}\n${entries.length} items found:\n\n${entries.join("\n")}`;
-            }
-            catch {
-                // Fallback to Node.js readdir
-                const entries = fs.readdirSync(dir, { withFileTypes: true });
-                const lines = entries
-                    .slice(0, 50)
-                    .map((e) => `${e.isDirectory() ? "📁" : "📄"} ${e.name}`);
-                return `Directory: ${dir}\n${lines.join("\n")}`;
-            }
-        }
-        // ─── search_files ──────────────────────────────────────────
-        case "search_files": {
-            const query = args.query;
-            const dir = resolvePath(args.directory || ".");
-            const maxResults = args.max_results || 20;
-            const filePattern = args.file_pattern;
-            const cmd = searchFilesCommand(query, dir, maxResults, filePattern);
-            try {
-                const { stdout } = await execAsync(cmd, { timeout: 15000 });
-                if (!stdout.trim())
-                    return `No matches found for "${query}" in ${dir}`;
-                return `Search: "${query}" in ${dir}\n\n${stdout.trim()}`;
-            }
-            catch {
-                return `No matches found for "${query}" in ${dir}`;
-            }
-        }
-        // ─── run_command ───────────────────────────────────────────
-        case "run_command": {
-            const command = args.command;
-            const cwd = resolvePath(args.cwd || ".");
-            // Safety: block obviously dangerous commands
-            const blocked = ["rm -rf /", "mkfs", "dd if=", ":(){"];
-            if (blocked.some((b) => command.includes(b))) {
-                return "Error: Command blocked for safety reasons.";
-            }
-            try {
-                const { stdout, stderr } = await execAsync(command, {
-                    cwd,
-                    timeout: 30000,
-                    maxBuffer: 1024 * 1024,
-                    env: { ...process.env, PAGER: "cat" },
-                });
-                let result = "";
-                if (stdout.trim())
-                    result += `stdout:\n${stdout.trim()}\n`;
-                if (stderr.trim())
-                    result += `stderr:\n${stderr.trim()}\n`;
-                if (!result)
-                    result = "(command completed with no output)";
-                return result;
-            }
-            catch (err) {
-                const e = err;
-                let msg = `Command failed: ${command}\n`;
-                if (e.stdout)
-                    msg += `stdout:\n${e.stdout}\n`;
-                if (e.stderr)
-                    msg += `stderr:\n${e.stderr}\n`;
-                if (e.message && !e.stderr)
-                    msg += `error: ${e.message}`;
-                return msg;
-            }
-        }
-        // ─── write_file ────────────────────────────────────────────
-        case "write_file": {
-            const filePath = resolvePath(args.path);
-            const content = args.content;
-            // Create parent dirs
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
-            fs.writeFileSync(filePath, content, "utf-8");
-            return `✅ Written ${content.length} chars to ${filePath}`;
-        }
-        // ─── edit_file ─────────────────────────────────────────────
-        case "edit_file": {
-            const filePath = resolvePath(args.path);
-            if (!fs.existsSync(filePath))
-                return `Error: File not found: ${filePath}`;
-            const original = fs.readFileSync(filePath, "utf-8");
-            const search = args.search;
-            const replace = args.replace;
-            if (!original.includes(search)) {
-                return `Error: Search text not found in ${filePath}`;
-            }
-            const updated = original.replace(search, replace);
-            fs.writeFileSync(filePath, updated, "utf-8");
-            return `✅ Edited ${filePath} — replaced ${search.length} chars`;
-        }
-        // ─── memory_search ─────────────────────────────────────────
-        case "memory_search": {
-            const { knowledgeSearchHandler } = await import("../tools/graphHandlers.js");
-            const result = await knowledgeSearchHandler({
-                query: args.query,
-                project: args.project || project || "prism-mcp",
-                limit: args.limit || 5,
-            });
-            const text = result.content?.[0] && "text" in result.content[0]
-                ? result.content[0].text
-                : "No results found.";
-            return text;
-        }
-        // ─── open_url ──────────────────────────────────────────────
-        case "open_url": {
-            const url = args.url;
-            try {
-                await execAsync(openUrlCommand(url));
-                return `✅ Opened ${url} in default browser`;
-            }
-            catch {
-                return `Error: Failed to open ${url}`;
-            }
-        }
-        // ─── fetch_url ─────────────────────────────────────────────
-        case "fetch_url": {
-            const fetchUrl = args.url;
-            if (!fetchUrl?.match(/^https?:\/\//i)) {
-                return "Error: Invalid URL. Must start with http:// or https://";
-            }
-            try {
-                const cmd = fetchUrlCommand(fetchUrl);
-                const { stdout } = await execAsync(cmd, {
-                    timeout: 20000,
-                    maxBuffer: 1024 * 1024,
-                    shell: IS_WINDOWS ? "powershell.exe" : undefined,
-                });
-                const text = stdout.trim().slice(0, 8000);
-                return `Content from ${fetchUrl}:\n\n${text}${text.length >= 8000 ? "\n\n... (truncated)" : ""}`;
-            }
-            catch (err) {
-                const e = err;
-                return `Error: Failed to fetch ${fetchUrl} — ${e.message?.slice(0, 200) || "unknown error"}`;
-            }
-        }
-        // ─── supabase_cli ──────────────────────────────────────────
-        case "supabase_cli": {
-            const sbArgs = args.args;
-            const sbBin = resolveCli("supabase");
-            try {
-                const { stdout } = await execAsync(`${sbBin} ${sbArgs}`, {
-                    cwd: process.cwd(),
-                    timeout: 60000,
-                    maxBuffer: 1024 * 512,
-                    env: { ...process.env, PAGER: "cat" },
-                });
-                return `supabase ${sbArgs}:\n${stdout.trim().slice(0, 5000)}`;
-            }
-            catch (err) {
-                const e = err;
-                let msg = `supabase ${sbArgs} failed:\n`;
-                if (e.stdout)
-                    msg += e.stdout.slice(0, 3000);
-                if (e.stderr)
-                    msg += `\nstderr: ${e.stderr.slice(0, 1000)}`;
-                return msg;
-            }
-        }
-        // ─── stripe_cli ───────────────────────────────────────────
-        case "stripe_cli": {
-            const stripeArgs = args.args;
-            const stripeBin = resolveCli("stripe");
-            try {
-                const { stdout } = await execAsync(`${stripeBin} ${stripeArgs}`, {
-                    cwd: process.cwd(),
-                    timeout: 60000,
-                    maxBuffer: 1024 * 512,
-                    env: { ...process.env, PAGER: "cat" },
-                });
-                return `stripe ${stripeArgs}:\n${stdout.trim().slice(0, 5000)}`;
-            }
-            catch (err) {
-                const e = err;
-                let msg = `stripe ${stripeArgs} failed:\n`;
-                if (e.stdout)
-                    msg += e.stdout.slice(0, 3000);
-                if (e.stderr)
-                    msg += `\nstderr: ${e.stderr.slice(0, 1000)}`;
-                return msg;
-            }
-        }
-        default:
-            return `Error: Unknown tool \"${toolName}\"`;
-    }
-}