prism-mcp-server 20.11.0 → 20.11.1

package/dist/tools/ledgerHandlers.js

@@ -499,25 +499,19 @@ export async function sessionSaveLedgerHandler(args) {
         };
     }
     const storage = await getStorage();
-    // ─── Project mismatch validation (v13 — hard-rejects on mismatch) ───
-    // Replaces the old soft-warning behavior that allowed cross-project
-    // writes. See projectResolver.ts for the lookup logic.
+    // ─── Project validation (v14 — warns, NEVER refuses the write) ───
+    // v13 hard-rejected on mismatch, trusting auto-created registry rows that
+    // turned out to be junk on a live machine (home-dir and relative-path
+    // entries) — agents got contradictory rejections and sessions ended
+    // UNSAVED. A memory product must not drop data to enforce taxonomy.
     let resolverNote = "";
     const resolved = await resolveProject(project, files_changed);
-    if (!resolved.ok) {
-        return {
-            content: [{
-                    type: "text",
-                    text: `❌ ${resolved.error}\n` +
-                        (resolved.hint ? `Hint: ${resolved.hint}\n` : "") +
-                        `\nNo ledger entry was written. Re-issue the call with the correct project.`,
-                }],
-            isError: true,
-        };
-    }
     project = resolved.project;
+    if (resolved.warning) {
+        resolverNote = `\n⚠️ ${resolved.warning}`;
+    }
     if (resolved.autoCreated) {
-        resolverNote = `\n📝 Auto-registered project "${project}" with repo_path derived from files_changed.`;
+        resolverNote += `\n📝 Auto-registered project "${project}" with repo_path derived from files_changed.`;
     }
     debugLog(`[session_save_ledger] Saving ledger entry for project="${project}"`);
     // Auto-extract keywords from summary + decisions for knowledge accumulation

package/dist/utils/projectResolver.js

@@ -81,12 +81,22 @@ export async function resolveProject(declaredProject, filesChanged) {
     }
     const registry = await loadRegistry();
     const derivedProject = pickFromRegistry(registry, filesChanged);
+    // 2026-08-13: this used to HARD-REJECT on mismatch — and the registry it
+    // trusted was auto-created junk (a live machine carried a repo_path entry
+    // pointing at the HOME DIRECTORY, which contains every absolute path, plus
+    // five relative-path rows). Agents got contradictory rejections, ping-ponged
+    // by the hint, and sessions ended UNSAVED — a memory product dropping data to
+    // enforce taxonomy. The declaration now always wins; the derivation is an
+    // advisory warning. (The wrong-project class this gate was built for —
+    // a 2026-04-30 memory-loss incident — is still surfaced, as a warning
+    // the agent sees at save time instead of a refusal the user never does.)
     if (derivedProject && derivedProject !== declaredProject) {
         return {
-            ok: false,
-            error: `Project mismatch: declared "${declaredProject}" but files_changed indicate "${derivedProject}".`,
-            hint: `Re-issue the request with project="${derivedProject}". ` +
-                `If you genuinely intended "${declaredProject}", first add it to the registry with a non-overlapping repo_path.`,
+            ok: true,
+            project: declaredProject,
+            warning: `Registry suggests these files belong to "${derivedProject}", but the entry was saved under ` +
+                `"${declaredProject}" as declared. If "${derivedProject}" is correct, re-save with that project; ` +
+                `if the registry is wrong, its repo_path for "${derivedProject}" needs repair.`,
         };
     }
     if (derivedProject && derivedProject === declaredProject) {
@@ -96,7 +106,7 @@ export async function resolveProject(declaredProject, filesChanged) {
         return { ok: true, project: declaredProject };
     }
     const prefix = commonPathPrefix(filesChanged);
-    if (prefix) {
+    if (prefix && isRegistrablePrefix(prefix, registry)) {
         try {
             await setSetting(`${REPO_PATH_PREFIX}${declaredProject}`, prefix);
             debugLog(`[projectResolver] auto-created repo_path:${declaredProject} = ${prefix}`);
@@ -108,3 +118,26 @@ export async function resolveProject(declaredProject, filesChanged) {
     }
     return { ok: true, project: declaredProject };
 }
+/**
+ * Auto-create hygiene, added 2026-08-13. Every class rejected here was FOUND
+ * in a live registry, where it poisoned later saves:
+ *  - relative prefixes ("Tests/UITests") match or miss depending on the path
+ *    style a later save happens to use;
+ *  - short prefixes (a 2-segment home directory) contain every absolute
+ *    path on the machine;
+ *  - an ancestor of an existing entry re-creates the same containment bomb
+ *    one level down.
+ * Refusing to register is safe: the save proceeds either way, and the next
+ * save with a cleaner file list can still register the project.
+ */
+function isRegistrablePrefix(prefix, registry) {
+    if (!prefix.startsWith("/"))
+        return false;
+    if (prefix.split("/").filter(Boolean).length < 3)
+        return false;
+    for (const entry of registry) {
+        if (isUnder(entry.repo_path, prefix))
+            return false; // ancestor of an existing entry
+    }
+    return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.11.0",
+  "version": "20.11.1",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",

package/scripts/dev/browse.py

@@ -1259,6 +1259,22 @@ def _enforce_max_edge(path, max_edge):
     try:
         import shutil as _shutil, subprocess as _subprocess
         if _shutil.which("sips"):
+            # `sips -Z` resamples in BOTH directions — it UPSCALES an image that
+            # is already smaller than max_edge. Unguarded, every macOS capture
+            # came out at exactly the cap on its long edge: a 1440x900 viewport
+            # was written as 1900x1187 and a 1920x1280 one as 1900x1266. That is
+            # not evidence of what rendered, and it breaks any acceptance gate
+            # that asserts a capture is viewport-bound. Measure first and only
+            # shrink when the image genuinely exceeds the cap — the Pillow branch
+            # below already guards this way.
+            probe = _subprocess.run(
+                ["sips", "-g", "pixelWidth", "-g", "pixelHeight", str(path)],
+                capture_output=True, timeout=30, text=True)
+            edges = [int(part.split(":")[1].strip())
+                     for part in probe.stdout.splitlines()
+                     if "pixelWidth:" in part or "pixelHeight:" in part]
+            if edges and max(edges) <= max_edge:
+                return None
             _subprocess.run(["sips", "-Z", str(max_edge), str(path)],
                             capture_output=True, timeout=30, check=True)
             return None
@@ -1306,11 +1322,15 @@ def cmd_screenshot(session, output=None, cleanup=False, full_page=True, selector
     # oversized capture early in a session poisons every later attach — the
     # agent that must LOOK at screenshots loses the ability to see them,
     # mid-conversation, permanently. Full-page captures routinely exceed
-    # 2000px in height, so every capture is normalized to a 1900px long edge
-    # here, at the source. sips is macOS-only; elsewhere we fall back to
-    # Pillow if present and otherwise WARN LOUDLY rather than emit poison
-    # silently.
-    _downscale_warning = _enforce_max_edge(path, 1900)
+    # 2000px in height, so oversized captures are shrunk here, at the source.
+    # sips is macOS-only; elsewhere we fall back to Pillow if present and
+    # otherwise WARN LOUDLY rather than emit poison silently.
+    #
+    # 2000, not 1900: the API limit quoted above is 2000px per dimension, and a
+    # 1900 cap sits just under the standard 1920-wide desktop viewport — so the
+    # single most common UI-evidence capture was resampled to 1900x1266 for no
+    # benefit, failing every gate that asserts a capture is viewport-bound.
+    _downscale_warning = _enforce_max_edge(path, 2000)
 
     size = path.stat().st_size
     audit_log("screenshot", str(path), f"size={size},ephemeral={cleanup}")