prism-mcp-server 20.12.0 → 20.12.1

package/README.md

@@ -116,6 +116,16 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.12.1
+
+- **`prism connect --refresh` now converges every registration it owns**, not
+  just the top-level one — directory-scoped entries could otherwise keep
+  launching an old build indefinitely.
+- **`prism update` checks the installed package**, not the CLI that happens to
+  be running, so it can no longer report "current" while the install is stale.
+- **The opt-in scheduled updater can actually start** — the LaunchAgent now
+  carries a PATH that includes node and npm.
+
 ## What's New in v20.12.0
 
 - **Prism now tells you when it's out of date.** Session startup shows a

package/dist/autoUpdate.js

@@ -31,6 +31,22 @@ function defaultFetchLatest() {
         timeout: 15_000,
     }).trim();
 }
+/** Read the version of the globally installed package. npm puts it under
+ *  <prefix>/lib/node_modules on POSIX and <prefix>/node_modules on Windows. */
+function defaultInstalledVersion() {
+    const prefix = execFileSync("npm", ["prefix", "-g"], { encoding: "utf8", timeout: 15_000 }).trim();
+    for (const candidate of [
+        join(prefix, "lib", "node_modules", PACKAGE, "package.json"),
+        join(prefix, "node_modules", PACKAGE, "package.json"),
+    ]) {
+        if (existsSync(candidate)) {
+            const version = JSON.parse(readFileSync(candidate, "utf8"))?.version;
+            if (typeof version === "string" && version.trim())
+                return version.trim();
+        }
+    }
+    return "";
+}
 function defaultInstall(version) {
     execFileSync("npm", ["install", "-g", `${PACKAGE}@${version}`], {
         stdio: "inherit",
@@ -95,9 +111,6 @@ export function runPackageUpdate(deps) {
     if ((env.VITEST || env.NODE_ENV === "test") && !deps.fetchLatest) {
         return { action: "skipped", detail: "test environment" };
     }
-    if (deps.currentVersion.includes("-")) {
-        return { action: "skipped", detail: `dev build ${deps.currentVersion} — not touching it` };
-    }
     if (deps.ifIdle) {
         let running;
         try {
@@ -116,6 +129,28 @@ export function runPackageUpdate(deps) {
             };
         }
     }
+    // The version that matters is the INSTALLED one; the running CLI may be a
+    // checkout, a shim, or an older global. Probing shells out to npm, so tests
+    // reach it only through an injected dep.
+    let targetVersion = deps.currentVersion;
+    // Test detection must read the REAL process env: suites pass env: {} to
+    // exercise the policy guards, and that would otherwise let this probe shell
+    // out to npm from inside the test run (caught by a 57ms test that suddenly
+    // consulted the machine's actual install).
+    const inTest = Boolean(env.VITEST || env.NODE_ENV === "test" ||
+        process.env.VITEST || process.env.NODE_ENV === "test");
+    const mayProbe = Boolean(deps.installedVersion) || !inTest;
+    if (mayProbe) {
+        try {
+            const installed = (deps.installedVersion ?? defaultInstalledVersion)().trim();
+            if (installed)
+                targetVersion = installed;
+        }
+        catch { /* not installed / npm unavailable — compare the running version */ }
+    }
+    if (targetVersion.includes("-")) {
+        return { action: "skipped", detail: `dev build ${targetVersion} — not touching it` };
+    }
     const release = (deps.acquireLock ?? defaultAcquireLock)();
     if (!release) {
         return { action: "locked", detail: "another prism update is already running" };
@@ -131,10 +166,10 @@ export function runPackageUpdate(deps) {
         if (!SEMVER.test(latest)) {
             return { action: "failed", detail: `registry returned unexpected version "${latest}"` };
         }
-        if (!isNewer(deps.currentVersion, latest)) {
-            return { action: "current", detail: `${deps.currentVersion} is current`, latest };
+        if (!isNewer(targetVersion, latest)) {
+            return { action: "current", detail: `installed package ${targetVersion} is current`, latest };
         }
-        log(`prism ${deps.currentVersion} → ${latest}: updating the global package …`);
+        log(`prism ${targetVersion} → ${latest}: updating the global package …`);
         try {
             (deps.install ?? defaultInstall)(latest);
         }
@@ -151,8 +186,27 @@ export function runPackageUpdate(deps) {
 export function autoupdatePlistPath() {
     return join(homedir(), "Library", "LaunchAgents", `${AUTOUPDATE_LABEL}.plist`);
 }
+function xmlEscape(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+/** The PATH a scheduled run needs. launchd hands an agent a minimal
+ *  PATH (/usr/bin:/bin:/usr/sbin:/sbin) that excludes /usr/local/bin and
+ *  /opt/homebrew/bin — where node and npm live on a standard macOS install.
+ *  Measured 2026-08-14: without this the agent died at `env: node: No such
+ *  file or directory` before running a single line of Prism. The directory
+ *  of the interpreter running this code leads, because that is provably the
+ *  node the operator uses. */
+export function schedulerPath(execPath = process.execPath) {
+    const lastSlash = execPath.lastIndexOf("/");
+    const nodeDir = lastSlash > 0 ? execPath.slice(0, lastSlash) : "/usr/local/bin";
+    const defaults = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"];
+    return [nodeDir, ...defaults.filter((dir) => dir !== nodeDir)].join(":");
+}
 /** Daily 03:30 local, catch-up on wake (LaunchAgents coalesce missed runs). */
-export function buildAutoupdatePlist(prismBin) {
+export function buildAutoupdatePlist(prismBin, pathEnv = schedulerPath()) {
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -160,10 +214,14 @@ export function buildAutoupdatePlist(prismBin) {
   <key>Label</key><string>${AUTOUPDATE_LABEL}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${prismBin}</string>
+    <string>${xmlEscape(prismBin)}</string>
     <string>update</string>
     <string>--if-idle</string>
   </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${xmlEscape(pathEnv)}</string>
+  </dict>
   <key>StartCalendarInterval</key>
   <dict>
     <key>Hour</key><integer>3</integer>
@@ -181,28 +239,62 @@ export function autoupdateStatus() {
         return { supported: false, enabled: false, plistPath, detail: "scheduled updates are macOS-only for now (LaunchAgent)" };
     }
     const enabled = existsSync(plistPath);
+    if (!enabled) {
+        return { supported: true, enabled, plistPath, detail: "disabled" };
+    }
+    // 20.12.0 wrote a plist with no PATH. launchd hands an agent
+    // /usr/bin:/bin:/usr/sbin:/sbin, which excludes the directories holding node
+    // and npm on a standard macOS install, so that generation could never run —
+    // and it failed into a log file nobody reads. Say so instead of reporting a
+    // confident "enabled".
+    let healthy = false;
+    try {
+        healthy = readFileSync(plistPath, "utf8").includes("<key>PATH</key>");
+    }
+    catch { /* unreadable — treat as needing repair */ }
     return {
         supported: true,
         enabled,
         plistPath,
-        detail: enabled ? `enabled — daily 03:30, log: /tmp/${AUTOUPDATE_LABEL}.log` : "disabled",
+        detail: healthy
+            ? `enabled — daily 03:30, log: /tmp/${AUTOUPDATE_LABEL}.log`
+            // Deliberately "may not run", not "cannot": launchd's default PATH does
+            // contain /usr/bin, so an operator whose node lives there is fine. On a
+            // standard install (Homebrew, /usr/local) it never runs. Claiming a
+            // certain failure we have not measured on THIS machine would be the same
+            // overclaim in the other direction.
+            : "enabled, but this agent predates the PATH fix and may not run (launchd's default PATH omits /usr/local/bin and /opt/homebrew/bin) — re-run `prism autoupdate enable` to repair",
     };
 }
-/** Resolve the `prism` bin the LaunchAgent should run. Warns (does not
- *  refuse) when it resolves outside node_modules — a checkout CLI still
- *  updates the global package, but the operator should know which code
- *  their scheduler runs. */
-export function resolvePrismBin(log) {
-    const bin = execFileSync("which", ["prism"], { encoding: "utf8", timeout: 5_000 }).trim();
-    if (!bin)
-        throw new Error("`prism` not found on PATH — install with: npm install -g prism-mcp-server");
+export function resolvePrismBin(log, deps = {}) {
+    const exists = deps.exists ?? existsSync;
+    let globalBin;
     try {
-        const real = execFileSync("readlink", ["-f", bin], { encoding: "utf8", timeout: 5_000 }).trim();
-        if (real && !real.includes("node_modules")) {
-            log(`⚠ ${bin} resolves to a source checkout (${real}); the scheduled update will run that CLI (it still updates only the global package)`);
+        const prefix = (deps.npmPrefix ?? (() => execFileSync("npm", ["prefix", "-g"], { encoding: "utf8", timeout: 15_000 })))().trim();
+        if (prefix) {
+            const candidate = join(prefix, "bin", "prism");
+            if (exists(candidate))
+                globalBin = candidate;
         }
     }
-    catch { /* readlink unavailable — proceed with the raw path */ }
+    catch { /* npm unavailable — fall back to PATH lookup */ }
+    if (globalBin)
+        return globalBin;
+    let bin = "";
+    try {
+        bin = (deps.whichPrism ?? (() => execFileSync("which", ["prism"], { encoding: "utf8", timeout: 5_000 })))().trim();
+    }
+    catch { /* not on PATH */ }
+    if (!bin)
+        throw new Error("`prism` not found — install it with: npm install -g prism-mcp-server");
+    let real = bin;
+    try {
+        real = (deps.readlink ?? ((p) => execFileSync("readlink", ["-f", p], { encoding: "utf8", timeout: 5_000 })))(bin).trim() || bin;
+    }
+    catch { /* keep bin */ }
+    if (!real.includes("node_modules") && /\/dist\/[^/]+$/.test(real)) {
+        log(`⚠ ${bin} resolves to a source checkout (${real}); the scheduled job will run that CLI — it still updates only the global package`);
+    }
     return bin;
 }
 export function enableAutoupdate(log) {

package/dist/cli.js

@@ -11,7 +11,7 @@ import { getSetting } from './storage/configStorage.js';
 import { PRISM_USER_ID, SERVER_CONFIG } from './config.js';
 import { getCurrentGitState } from './utils/git.js';
 import { sessionBootstrapHandler, sessionLoadContextHandler, sessionSaveLedgerHandler, sessionSaveHandoffHandler, } from './tools/ledgerHandlers.js';
-import { configureClaudeAgentPolicy, configureClaudeNativeStartup, configureCodexAgentPolicy, configureCodexNativeStartup, configureGeminiAgentPolicy, configureGeminiNativeStartup, connectHosts, migrateLegacyClaudeHooks, migrateLegacyClaudeInstructions, migrateLegacyClaudeManagedStartup, migrateLegacyClaudeProjectMcp, normalizeHostName, } from './connect.js';
+import { configureClaudeAgentPolicy, configureClaudeNativeStartup, configureCodexAgentPolicy, configureCodexNativeStartup, configureGeminiAgentPolicy, configureGeminiNativeStartup, connectHosts, migrateLegacyClaudeHooks, migrateLegacyClaudeInstructions, migrateLegacyClaudeManagedStartup, migrateLegacyClaudeProjectMcp, connectResultLine, normalizeHostName, } from './connect.js';
 import { runBrowserCli } from './browserCli.js';
 import { filterPrismMemoryContext } from './utils/memoryQuality.js';
 import { isRecoverableStartupStorageError } from './utils/startupRecovery.js';
@@ -261,24 +261,12 @@ program
             return;
         }
         for (const result of summary.results) {
-            if (result.status === 'registered') {
-                console.log(`✓ ${result.label}: registered (${result.path})`);
-            }
-            else if (result.status === 'would-register') {
-                console.log(`• ${result.label}: would register (${result.path})`);
-            }
-            else if (result.status === 'refreshed') {
-                console.log(`✓ ${result.label}: Prism-managed entry refreshed (${result.path})`);
-            }
-            else if (result.status === 'would-refresh') {
-                console.log(`• ${result.label}: would refresh Prism-managed entry (${result.path})`);
-            }
-            else if (result.status === 'existing') {
-                console.log(`− ${result.label}: already registered — untouched (${result.path})`);
+            if (result.status === 'error') {
+                console.error(connectResultLine(result));
+                process.exitCode = 1;
             }
             else {
-                console.error(`✗ ${result.label}: ${result.message || 'registration failed'} (${result.path})`);
-                process.exitCode = 1;
+                console.log(connectResultLine(result));
             }
         }
         const connectedClaude = summary.results.some((result) => result.host === 'claude-code' && result.status !== 'error' && result.startupCompatible);

package/dist/connect.js

@@ -1220,36 +1220,63 @@ function registerJsonHost(definition, entry, dryRun, refresh, beforeCommit) {
         : Object.prototype.hasOwnProperty.call(mcpServers, "prism")
             ? "prism"
             : undefined;
+    // Claude Code keeps ADDITIONAL, directory-scoped registrations under
+    // projects["<dir>"].mcpServers, and the scoped one wins for sessions started
+    // in that directory. Refreshing only the top-level entry left those pinned to
+    // a stale server path forever — measured live 2026-08-14 on a machine
+    // carrying three registrations, where `--refresh` converged exactly one and
+    // two directories kept launching an old build indefinitely. Only entries
+    // Prism itself created are eligible, and only under --refresh, so this
+    // cannot reach a hand-rolled entry. Hosts without a `projects` map are
+    // unaffected: the collector returns nothing.
+    const pendingProjects = refresh ? collectProjectScopedRefreshes(config, entry) : [];
+    const scopedCount = pendingProjects.length;
+    const scopedNoun = `${scopedCount} project-scoped ${scopedCount === 1 ? "entry" : "entries"}`;
+    const writeConfig = (status, message, compatible) => {
+        try {
+            writeTextAtomically(writePath, `${JSON.stringify(config, null, 2)}\n`, originalText, beforeCommit, symlinkPath);
+            return result(definition, status, message, compatible);
+        }
+        catch (error) {
+            return result(definition, "error", error instanceof Error ? error.message : String(error));
+        }
+    };
     if (existingKey) {
         const existingEntry = mcpServers[existingKey];
         const startupCompatible = existingKey === "prism-mcp"
             && isManagedPrismEntry(existingEntry)
             && isDeepStrictEqual(refreshManagedEntry(existingEntry, entry), existingEntry);
         if (!refresh || existingKey !== "prism-mcp" || !isManagedPrismEntry(existingEntry)) {
-            return result(definition, "existing", "Prism is already registered; existing entry left untouched", startupCompatible);
+            if (scopedCount === 0) {
+                return result(definition, "existing", "Prism is already registered; existing entry left untouched", startupCompatible);
+            }
+            if (dryRun) {
+                return result(definition, "would-refresh", `top-level entry left untouched; would refresh ${scopedNoun}`, startupCompatible);
+            }
+            applyProjectScopedRefreshes(config, pendingProjects);
+            return writeConfig("refreshed", `top-level entry left untouched; refreshed ${scopedNoun}`, startupCompatible);
         }
         const refreshedEntry = refreshManagedEntry(existingEntry, entry);
-        if (JSON.stringify(refreshedEntry) === JSON.stringify(existingEntry)) {
+        const topLevelStale = JSON.stringify(refreshedEntry) !== JSON.stringify(existingEntry);
+        if (!topLevelStale && scopedCount === 0) {
             return result(definition, "existing", "Prism-managed entry is already current", true);
         }
         if (dryRun) {
-            return result(definition, "would-refresh", undefined, true);
+            return result(definition, "would-refresh", scopedCount > 0 ? `also ${scopedNoun}` : undefined, true);
         }
-        mcpServers[existingKey] = refreshedEntry;
-        config.mcpServers = mcpServers;
-        try {
-            writeTextAtomically(writePath, `${JSON.stringify(config, null, 2)}\n`, originalText, beforeCommit, symlinkPath);
-            return result(definition, "refreshed", undefined, true);
-        }
-        catch (error) {
-            return result(definition, "error", error instanceof Error ? error.message : String(error));
+        if (topLevelStale) {
+            mcpServers[existingKey] = refreshedEntry;
+            config.mcpServers = mcpServers;
         }
+        applyProjectScopedRefreshes(config, pendingProjects);
+        return writeConfig("refreshed", scopedCount > 0 ? `also refreshed ${scopedNoun}` : undefined, true);
     }
     if (dryRun) {
-        return result(definition, "would-register", undefined, true);
+        return result(definition, "would-register", scopedCount > 0 ? `also ${scopedNoun}` : undefined, true);
     }
     mcpServers["prism-mcp"] = entry;
     config.mcpServers = mcpServers;
+    applyProjectScopedRefreshes(config, pendingProjects);
     try {
         writeTextAtomically(writePath, `${JSON.stringify(config, null, 2)}\n`, originalText, beforeCommit, symlinkPath);
         return result(definition, "registered", undefined, true);
@@ -1563,6 +1590,22 @@ function result(definition, status, message, startupCompatible = false) {
         message,
     };
 }
+/** One operator-facing line per host result.
+ *  The `message` a host writer attaches (e.g. "also refreshed 2 project-scoped
+ *  entries") MUST survive to stdout: the earlier printer used canned per-status
+ *  text and dropped it, so a converged directory-scoped registration was
+ *  invisible to the person who asked for it. */
+export function connectResultLine(result) {
+    const detail = result.message ? ` — ${result.message}` : "";
+    switch (result.status) {
+        case "registered": return `✓ ${result.label}: registered${detail} (${result.path})`;
+        case "would-register": return `• ${result.label}: would register${detail} (${result.path})`;
+        case "refreshed": return `✓ ${result.label}: Prism-managed entry refreshed${detail} (${result.path})`;
+        case "would-refresh": return `• ${result.label}: would refresh Prism-managed entry${detail} (${result.path})`;
+        case "existing": return `− ${result.label}: already registered — untouched (${result.path})`;
+        default: return `✗ ${result.label}: ${result.message || "registration failed"} (${result.path})`;
+    }
+}
 function isJsonObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1576,6 +1619,46 @@ function isManagedPrismEntry(value) {
         && isJsonObject(value.env)
         && value.env.PRISM_INSTANCE === "prism-mcp";
 }
+/** Prism-managed, directory-scoped registrations that are out of date.
+ *  Claude Code stores these under projects["<dir>"].mcpServers; other hosts
+ *  have no `projects` map, so this returns nothing for them. */
+function collectProjectScopedRefreshes(config, desired) {
+    const projects = config.projects;
+    if (!isJsonObject(projects))
+        return [];
+    const pending = [];
+    for (const [project, projectConfig] of Object.entries(projects)) {
+        if (!isJsonObject(projectConfig))
+            continue;
+        const servers = projectConfig.mcpServers;
+        if (!isJsonObject(servers))
+            continue;
+        const existing = servers["prism-mcp"];
+        if (!isManagedPrismEntry(existing))
+            continue; // hand-rolled entries stay untouched
+        const refreshed = refreshManagedEntry(existing, desired);
+        if (JSON.stringify(refreshed) !== JSON.stringify(existing)) {
+            pending.push({ project, entry: refreshed });
+        }
+    }
+    return pending;
+}
+function applyProjectScopedRefreshes(config, pending) {
+    if (pending.length === 0)
+        return;
+    const projects = config.projects;
+    if (!isJsonObject(projects))
+        return;
+    for (const { project, entry } of pending) {
+        const projectConfig = projects[project];
+        if (!isJsonObject(projectConfig))
+            continue;
+        const servers = projectConfig.mcpServers;
+        if (!isJsonObject(servers))
+            continue;
+        servers["prism-mcp"] = entry;
+    }
+}
 function refreshManagedEntry(existing, desired) {
     const existingEnv = isJsonObject(existing.env) ? existing.env : {};
     const desiredEnv = isJsonObject(desired.env) ? desired.env : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.12.0",
+  "version": "20.12.1",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",