prism-mcp-server 20.13.0 → 20.14.0

package/dist/cli.js

@@ -221,6 +221,7 @@ program
     .option('--dry-run', 'Preview configuration changes without writing files')
     .option('--refresh', 'Refresh only entries previously created by Prism; custom entries stay untouched')
     .option('--no-self-update', 'Skip the npm self-update check; configure with the currently installed version')
+    .option('--no-models', 'Skip model convergence; keep whatever model versions are installed')
     .action(async (options) => {
     try {
         // ── Converge the PACKAGE first, then the configs ──────────────
@@ -447,6 +448,17 @@ program
         if (!summary.usedApiKey) {
             console.log('PRISM_SYNALUX_API_KEY is not set; no Synalux subscription key was copied into new registrations.');
         }
+        // ── Converge the MODELS last ────────────────────────────────
+        // selfUpdate above is the package half of convergence; without this
+        // half a machine kept vision-less models for four days after the
+        // registry carried the fix (2026-08-18), and `ollama cp` aliases are
+        // snapshots that silently detach from their source on every re-pull.
+        // Failures here never fail connect — runOllamaConverge reports and
+        // returns.
+        if (options.models !== false) {
+            const { runOllamaConverge } = await import('./modelConvergeRunner.js');
+            await runOllamaConverge({ dryRun: options.dryRun === true });
+        }
     }
     catch (err) {
         console.error(`Connect failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1028,6 +1040,20 @@ scmCmd
         process.exit(1);
     }
 });
+// ─── prism update-models ──────────────────────────────────────
+// Standalone model convergence: pull each installed prism-coder tier from
+// the registry and repair its local alias. connect runs this automatically;
+// this command is for updating models without touching host configuration.
+program
+    .command('update-models')
+    .description('Pull installed prism-coder models from the registry and repair stale local aliases')
+    .option('--dry-run', 'Print what would be pulled/re-aliased without executing')
+    .action(async (options) => {
+    const { runOllamaConverge } = await import('./modelConvergeRunner.js');
+    const outcomes = await runOllamaConverge({ dryRun: options.dryRun === true });
+    if (outcomes.every(o => o.action === 'failed'))
+        process.exitCode = 1;
+});
 // ─── prism register-models ────────────────────────────────────
 // Convenience: alias namespaced HF-style prism-coder tags
 // (`dcostenco/prism-coder:9b`) to the bare tags (`prism-coder:9b`)

package/dist/modelConvergeRunner.js

@@ -0,0 +1,94 @@
+/**
+ * Production wiring for model convergence — real Ollama, real registry.
+ *
+ * Kept out of cli.ts so the pure logic (utils/modelConverge.ts) stays
+ * testable with injected deps, and out of utils/ because this half owns
+ * process spawning. `ollama pull` runs with inherited stdio deliberately:
+ * a multi-GB download with no progress bar reads as a hang, and ollama's
+ * own progress output is better than anything we would reimplement.
+ *
+ * Adversarial review 2026-08-18 (pre-20.14.0), two findings fixed here:
+ *
+ * 1. SPLIT-BRAIN DAEMON TARGETING: listTags read /api/tags from
+ *    PRISM_LOCAL_LLM_URL while the spawned `ollama` CLI targeted whatever
+ *    OLLAMA_HOST the user's shell had (default localhost). On a machine
+ *    with a remote Ollama, convergence read tags from one daemon and
+ *    pulled/re-aliased against another. The spawn env now pins OLLAMA_HOST
+ *    to the SAME url the tags came from — one daemon, one truth.
+ *
+ * 2. SILENT MULTI-GB DOWNLOADS: connect gave no warning before pulling.
+ *    Measured the day this shipped: the registry 27b had just changed
+ *    bytes, so every 27b holder's first converge pulls ~16 GB. The plan
+ *    is now announced up front, with the --no-models escape hatch named,
+ *    before any network transfer starts.
+ */
+import { spawn } from "node:child_process";
+import { convergeModels, MODEL_NAMESPACE, LOCAL_PREFIX, CONVERGE_TIERS } from "./utils/modelConverge.js";
+const OLLAMA_URL = process.env.PRISM_LOCAL_LLM_URL || "http://localhost:11434";
+/**
+ * Env for spawned `ollama` processes. OLLAMA_HOST is pinned to the same
+ * daemon /api/tags was read from — never the shell's ambient value — so
+ * list, pull, and cp can never disagree about which Ollama they act on.
+ * Exported for tests.
+ */
+export function convergeEnv(base, ollamaUrl = OLLAMA_URL) {
+    return { ...base, OLLAMA_HOST: ollamaUrl };
+}
+function runOllama(args, inheritStdio) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("ollama", args, {
+            stdio: inheritStdio ? "inherit" : "ignore",
+            env: convergeEnv(process.env),
+        });
+        child.on("error", (err) => reject(new Error(`ollama ${args[0]}: ${err.message}`)));
+        child.on("close", (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`ollama ${args.join(" ")} exited ${code}`));
+        });
+    });
+}
+export async function runOllamaConverge(opts = {}) {
+    // Announce the plan BEFORE any network transfer: which tiers are
+    // installed (and will be checked), that pulls can be large, and how to
+    // opt out. A 16 GB download must never be the first sign convergence
+    // is running.
+    let installedTiers = [];
+    try {
+        const res = await fetch(`${OLLAMA_URL}/api/tags`, { signal: AbortSignal.timeout(5_000) });
+        if (res.ok) {
+            const data = (await res.json());
+            const names = new Set((data.models ?? []).map((m) => m.name));
+            installedTiers = CONVERGE_TIERS.filter((t) => names.has(`${MODEL_NAMESPACE}:${t}`) || names.has(`${LOCAL_PREFIX}:${t}`));
+        }
+    }
+    catch {
+        // convergeModels handles the unreachable case with its own message
+    }
+    if (installedTiers.length > 0) {
+        console.log(`\nConverging ${installedTiers.length} installed model tier(s) [${installedTiers.join(", ")}] against the registry.`);
+        console.log("  Updated models download in full (can be multiple GB). Skip with: prism connect --no-models");
+    }
+    else {
+        console.log("\nConverging local models against the registry…");
+    }
+    const outcomes = await convergeModels({
+        listTags: async () => {
+            const res = await fetch(`${OLLAMA_URL}/api/tags`, { signal: AbortSignal.timeout(5_000) });
+            if (!res.ok)
+                throw new Error(`Ollama /api/tags HTTP ${res.status}`);
+            const data = (await res.json());
+            return (data.models ?? []).map((m) => ({ name: m.name, digest: m.digest }));
+        },
+        pull: (ref) => runOllama(["pull", ref], true),
+        copy: (from, to) => runOllama(["cp", from, to], false),
+        log: (line) => console.log(`  ${line}`),
+        dryRun: opts.dryRun,
+    });
+    const failed = outcomes.filter((o) => o.action === "failed" && o.detail !== "ollama_unreachable");
+    if (failed.length > 0) {
+        console.log(`  ⚠ ${failed.length} tier(s) did not converge — re-run \`prism update-models\` when the network allows`);
+    }
+    return outcomes;
+}

package/dist/storage/synalux.js

@@ -29,6 +29,8 @@
  *     - getHistory        → POST /api/v1/prism/memory  action=memory_history
  *     - patchLedger       → POST /api/v1/prism/memory  action=save_embedding
  *     - getEntriesMissingEmbeddings → POST /api/v1/prism/memory  action=list_missing_embeddings
+ *     - listProjects      → POST /api/v1/prism/memory  action=list_projects
+ *     - exportLedger      → POST /api/v1/prism/memory  action=export_memory (paginated)
  *
  *   Methods still falling through to SupabaseStorage (Phase 3 Tier B+):
  *   save_experience direct entrypoint, compactLedger, image ops,
@@ -449,6 +451,58 @@ export class SynaluxStorage extends SupabaseStorage {
         const entries = Array.isArray(result.entries) ? result.entries : [];
         return entries;
     }
+    // ─── Project inventory + export ──────────────────────────────
+    // Both portal actions shipped in Phase 3 but the client was never
+    // wired: listProjects and the export path fell through to
+    // SupabaseStorage and threw "Supabase not configured" on every
+    // paid-tier install (2026-08-18 audit).
+    async listProjects() {
+        const result = await this.portalPost("/api/v1/prism/memory", {
+            action: "list_projects",
+        });
+        // Strict on drift: a 200 without a projects ARRAY is a contract change,
+        // not "no projects" — the portal returns projects:[] for genuinely none.
+        // Coercing drift to [] would make callers report empty inventories while
+        // claiming success. (R1 adversarial review 2026-08-18.)
+        if (!Array.isArray(result.projects)) {
+            throw new Error("[SynaluxStorage] list_projects: portal response missing projects[] — contract drift");
+        }
+        return result.projects
+            .map((p) => (typeof p === "string" ? p : p?.project))
+            .filter((name) => typeof name === "string" && name.length > 0);
+    }
+    async exportLedger(project) {
+        // action=export_memory is paginated (EXPORT_PAGE_SIZE=1000). Follow
+        // next_offset until has_more is false, capped at 10 pages to match the
+        // local path's 10k-row OOM guard.
+        //
+        // Strict on drift (R1 adversarial review 2026-08-18): this feeds a
+        // BACKUP. A 200 missing ledger[] or page{} must throw, not degrade —
+        // coercing either would write an empty or silently-truncated export
+        // file that reports ✅ success, which is worse than any error.
+        const rows = [];
+        let offset = 0;
+        for (let page = 0; page < 10; page++) {
+            const result = await this.portalPost("/api/v1/prism/memory", {
+                action: "export_memory",
+                project,
+                offset,
+                limit: 1000,
+            });
+            if (!Array.isArray(result.ledger)) {
+                throw new Error("[SynaluxStorage] export_memory: portal response missing ledger[] — contract drift");
+            }
+            const pageInfo = result.page;
+            if (typeof pageInfo?.has_more !== "boolean") {
+                throw new Error("[SynaluxStorage] export_memory: portal response missing page.has_more — refusing a possibly-truncated export");
+            }
+            rows.push(...result.ledger);
+            if (!pageInfo.has_more || typeof pageInfo.next_offset !== "number")
+                break;
+            offset = pageInfo.next_offset;
+        }
+        return rows;
+    }
     // ─── Time Travel ─────────────────────────────────────────────
     // Phase 3 Tier B: route memory_history through portal instead of
     // falling through to SupabaseStorage (which requires a direct

package/dist/tools/ledgerHandlers.js

@@ -2719,12 +2719,24 @@ export async function sessionExportMemoryHandler(args) {
             debugLog(`[session_export_memory] Exporting project "${project}" as ${format}`);
             // Fetch handoff (live context)
             const ctx = await storage.loadContext(project, "deep", PRISM_USER_ID);
-            // Fetch full ledger (all non-deleted entries, capped at 10k as OOM guard)
-            const ledger = await storage.getLedgerEntries({
-                project: `eq.${project}`,
-                order: "created_at.asc",
-                limit: "10000",
-            });
+            // Fetch full ledger (all non-deleted entries, capped at 10k as OOM guard).
+            // Portal-backed installs export via action=export_memory (exportLedger);
+            // local/direct backends keep the getLedgerEntries assembly. Without this
+            // branch, paid thin-client installs threw "Supabase not configured" here.
+            const ledger = (typeof storage.exportLedger === "function"
+                ? await storage.exportLedger(project)
+                : await storage.getLedgerEntries({
+                    project: `eq.${project}`,
+                    // R1 adversarial review 2026-08-18: without this filter the
+                    // direct/local paths exported TOMBSTONED rows — content the user
+                    // had asked session_forget_memory to erase shipped in every
+                    // backup (GDPR Art. 17 leak; the portal export always excluded
+                    // them, so the two paths also disagreed). Both PostgREST and the
+                    // sqlite filter parser support is.null.
+                    deleted_at: "is.null",
+                    order: "created_at.asc",
+                    limit: "10000",
+                }));
             // Strip raw embedding vectors from the export (large binary / not human-useful)
             // embedding: raw float32 JSON array (~12KB/entry)
             // embedding_compressed: TurboQuant binary blob (~400B/entry, base64 in JSON)

package/dist/tools/prismInferHandler.js

@@ -1090,7 +1090,9 @@ export async function runInfer(args, deps) {
     // describe the request rather than a specific backend.
     const maxTokens = cloudMaxTokens;
     // Cloud fallback only for paid plans
-    const allowCloud = args.cloud_fallback === true && ent.features.cloud_fallback;
+    // let, not const: the reserved-image branch pins this off mid-call so no
+    // later escalation path can carry even the prompt text off-device.
+    let allowCloud = args.cloud_fallback === true && ent.features.cloud_fallback;
     // Verification only for paid plans (free users skip L3 grounding)
     const canVerify = ent.features.grounding_verifier;
     // The portal entitlement is authoritative. A paid plan alone must not
@@ -1106,7 +1108,10 @@ export async function runInfer(args, deps) {
     const verificationGatedArgs = canVerify
         ? args
         : { ...args, verify: false, evidence: undefined };
-    const gatedArgs = canUsePrivateRouteGuard
+    // let, not const: re-pinned below once images are resolved — an image
+    // request must not leave the device through ANY channel, including the
+    // paid ones this gate would otherwise leave enabled.
+    let gatedArgs = canUsePrivateRouteGuard
         ? verificationGatedArgs
         : { ...verificationGatedArgs, route_guard: "local" };
     // §5.2 failure contract: under escalation:"report", safety refusals return
@@ -1190,6 +1195,21 @@ export async function runInfer(args, deps) {
             // fail open: the original images are still in resolvedImages
         }
     }
+    if (resolvedImages?.length) {
+        // Adversarial review R1 (2026-08-18): serving image requests locally is
+        // not enough — two paid side doors still carried content DERIVED from
+        // the pixels off-device. The Synalux route guard POSTs the prompt and
+        // the draft; the Synalux grounding verifier POSTs the draft and the
+        // evidence. A draft written by a model that just read a clinical
+        // screenshot can quote it. Pin both local for EVERY image request, not
+        // just reserved-flagged ones: the content screen is FN-porous by
+        // design, so a clean screen is not a leak clearance. Text-only
+        // requests keep both features.
+        const wouldVerify = gatedArgs.verify ?? ((gatedArgs.evidence?.length ?? 0) > 0);
+        if (wouldVerify)
+            attempts.push({ tier: "verifier", reason: "verifier_skipped_images_stay_local" });
+        gatedArgs = { ...gatedArgs, route_guard: "local", verify: false };
+    }
     if (installed && !layer1RecursionGuard) {
         const l1fn = deps.callLayer1 ?? defaultCallLayer1;
         const l1Model = resolveOllamaName("prism-coder:4b", installed);
@@ -1222,7 +1242,26 @@ export async function runInfer(args, deps) {
         // Null when the deterministic floor did not fire — the verdict then came
         // from the semantic classifier, which has no per-rule attribution.
         const reservedCat = reservedCategory(args.prompt);
-        if (l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN") {
+        if ((l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN")
+            && (resolvedImages?.length ?? 0) > 0) {
+            // Clinical images are PROCESSED, never refused (ruling 2026-08-18:
+            // the standard BCBA role works from scanned assessments and
+            // screenshots — locally, or via the sanctioned prism cloud once it
+            // has an image channel). Local inference is exactly where that
+            // content is SAFE: nothing leaves the device. Refusing here broke
+            // screenshot verification and assessment work for the clinical
+            // enterprise tiers that need it most, while the actual no-leak
+            // property — images never reach unsanctioned cloud — is enforced
+            // architecturally either way. Serve locally with cloud pinned off
+            // for the rest of the call. No text-policy bypass results: an
+            // image-carrying request is STRICTER than the same words without
+            // one (local-only), so attaching an image can only reduce
+            // exposure. The verdict stays in attempts for the audit trail.
+            debugLog(`[prism_infer] Layer 1 verdict=${l1} with images — serving locally, cloud disabled for this call`);
+            attempts.push({ tier: "layer1", reason: `layer1_${l1.toLowerCase()}_image_local_only` });
+            allowCloud = false;
+        }
+        else if (l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN") {
             debugLog(`[prism_infer] Layer 1 verdict=${l1} — reserved content detected`);
             attempts.push({ tier: "layer1", reason: `layer1_${l1.toLowerCase()}` });
             // Images never leave the device, and callCloud has no image channel

package/dist/utils/modelConverge.js

@@ -0,0 +1,102 @@
+/**
+ * Model convergence for `prism connect` — the missing half of self-update.
+ *
+ * selfUpdate.ts converges the PACKAGE; nothing converged the MODELS. The gap
+ * was measured on 2026-08-18: the vision-restored artifacts had been on the
+ * Ollama registry for four days while a laptop that pulled earlier kept
+ * refusing image requests (layer1_classifier_no_vision) — and on the machine
+ * where this was written, the `prism-coder:2b` alias pointed at different
+ * bytes than `dcostenco/prism-coder:2b`, because `ollama cp` makes a
+ * SNAPSHOT: a re-pull updates the source name and silently leaves every
+ * alias behind.
+ *
+ * Design decisions, in order of importance:
+ *
+ * 1. DELEGATE freshness to `ollama pull`. The registry serves no
+ *    docker-content-digest header and its manifest body hash is not the
+ *    digest ollama reports locally, so a client-side digest comparison
+ *    would reimplement (and drift from) ollama's own logic. `ollama pull`
+ *    of an up-to-date tag is a manifest check that downloads nothing.
+ *
+ * 2. REPAIR the alias after every pull. `prism-coder:<t>` must equal
+ *    `dcostenco/prism-coder:<t>` byte-for-byte; when digests differ, re-cp.
+ *    This is the trap register-models cannot fix on its own — it only
+ *    aliases tags that are MISSING, not tags that are stale.
+ *
+ * 3. Converge only tiers the machine already has (either the alias or the
+ *    namespaced source). Convergence updates what you chose to install; it
+ *    never decides that a 16 GB model belongs on your laptop.
+ *
+ * 4. Models must never break connect. Ollama down, registry unreachable,
+ *    one tier failing — report and continue. A machine with stale models
+ *    and fresh config beats a machine with neither.
+ */
+export const MODEL_NAMESPACE = "dcostenco/prism-coder";
+export const LOCAL_PREFIX = "prism-coder";
+export const CONVERGE_TIERS = ["2b", "4b", "9b", "27b"];
+export async function convergeModels(deps) {
+    let tags;
+    try {
+        tags = await deps.listTags();
+    }
+    catch (err) {
+        deps.log(`− model convergence skipped: Ollama unreachable (${err instanceof Error ? err.message : String(err)})`);
+        return CONVERGE_TIERS.map((tier) => ({ tier, action: "failed", detail: "ollama_unreachable" }));
+    }
+    const byName = new Map(tags.map((t) => [t.name, t]));
+    const outcomes = [];
+    for (const tier of CONVERGE_TIERS) {
+        const source = `${MODEL_NAMESPACE}:${tier}`;
+        const alias = `${LOCAL_PREFIX}:${tier}`;
+        const hadSource = byName.has(source);
+        const hadAlias = byName.has(alias);
+        if (!hadSource && !hadAlias) {
+            outcomes.push({ tier, action: "skipped_not_installed" });
+            continue;
+        }
+        if (deps.dryRun) {
+            deps.log(`• would pull ${source} and repair the ${alias} alias if stale`);
+            outcomes.push({ tier, action: "up_to_date", detail: "dry_run" });
+            continue;
+        }
+        try {
+            const digestBefore = byName.get(source)?.digest;
+            await deps.pull(source);
+            // Re-list AFTER the pull: both the freshness answer and the alias
+            // comparison must come from post-pull state, or a pull that
+            // changed bytes looks identical to one that did nothing.
+            const after = await deps.listTags();
+            const afterByName = new Map(after.map((t) => [t.name, t]));
+            const sourceNow = afterByName.get(source);
+            const aliasNow = afterByName.get(alias);
+            if (!sourceNow) {
+                outcomes.push({ tier, action: "failed", detail: "source_missing_after_pull" });
+                deps.log(`⚠ ${source}: pull reported success but the tag is not installed`);
+                continue;
+            }
+            const pulledNewBytes = digestBefore !== undefined && digestBefore !== sourceNow.digest;
+            const aliasStale = !aliasNow || aliasNow.digest !== sourceNow.digest;
+            if (aliasStale) {
+                await deps.copy(source, alias);
+                const action = pulledNewBytes || !hadSource ? "pulled_and_aliased" : "aliased_only";
+                outcomes.push({ tier, action });
+                deps.log(`✓ ${alias} ${aliasNow ? "re-aliased (was a stale snapshot)" : "aliased"} → ${sourceNow.digest.slice(0, 12)}`);
+            }
+            else if (pulledNewBytes) {
+                // Alias digest already matches the fresh source — cp raced us
+                // or the user re-aliased by hand; either way converged.
+                outcomes.push({ tier, action: "pulled_and_aliased" });
+                deps.log(`✓ ${source} updated; ${alias} already matches`);
+            }
+            else {
+                outcomes.push({ tier, action: "up_to_date" });
+                deps.log(`= ${alias} up to date (${sourceNow.digest.slice(0, 12)})`);
+            }
+        }
+        catch (err) {
+            outcomes.push({ tier, action: "failed", detail: err instanceof Error ? err.message : String(err) });
+            deps.log(`⚠ ${source}: ${err instanceof Error ? err.message : String(err)} — continuing with the other tiers`);
+        }
+    }
+    return outcomes;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.13.0",
+  "version": "20.14.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",