prism-mcp-server 20.13.1 → 20.15.0

package/README.md

@@ -724,6 +724,12 @@ Every conversation feeds a persistent store. The next session loads the right co
 
 The dashboard shows your current project state, pending TODOs, intent health, and a neural knowledge graph — all built automatically from your agent sessions.
 
+It runs on loopback and is gated by a per-startup token by default — open the
+tokenized URL printed in the startup log (`http://localhost:3000/?token=…`).
+Requests with an untrusted `Host`/`Origin` are refused, closing the DNS-rebinding
+exposure fixed in GHSA-9cvx-7x8q-3g6m. See [docs/IDE_SETUP.md](docs/IDE_SETUP.md#securing-the-dashboard)
+to pin the token, disable it, or configure Basic Auth / JWKS.
+
 ### Export — read the record outside the agent
 
 `session_export_memory` writes your memory out as plain files you can read,

package/dist/cli.js

@@ -221,6 +221,7 @@ program
     .option('--dry-run', 'Preview configuration changes without writing files')
     .option('--refresh', 'Refresh only entries previously created by Prism; custom entries stay untouched')
     .option('--no-self-update', 'Skip the npm self-update check; configure with the currently installed version')
+    .option('--no-models', 'Skip model convergence; keep whatever model versions are installed')
     .action(async (options) => {
     try {
         // ── Converge the PACKAGE first, then the configs ──────────────
@@ -447,6 +448,17 @@ program
         if (!summary.usedApiKey) {
             console.log('PRISM_SYNALUX_API_KEY is not set; no Synalux subscription key was copied into new registrations.');
         }
+        // ── Converge the MODELS last ────────────────────────────────
+        // selfUpdate above is the package half of convergence; without this
+        // half a machine kept vision-less models for four days after the
+        // registry carried the fix (2026-08-18), and `ollama cp` aliases are
+        // snapshots that silently detach from their source on every re-pull.
+        // Failures here never fail connect — runOllamaConverge reports and
+        // returns.
+        if (options.models !== false) {
+            const { runOllamaConverge } = await import('./modelConvergeRunner.js');
+            await runOllamaConverge({ dryRun: options.dryRun === true });
+        }
     }
     catch (err) {
         console.error(`Connect failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1028,6 +1040,20 @@ scmCmd
         process.exit(1);
     }
 });
+// ─── prism update-models ──────────────────────────────────────
+// Standalone model convergence: pull each installed prism-coder tier from
+// the registry and repair its local alias. connect runs this automatically;
+// this command is for updating models without touching host configuration.
+program
+    .command('update-models')
+    .description('Pull installed prism-coder models from the registry and repair stale local aliases')
+    .option('--dry-run', 'Print what would be pulled/re-aliased without executing')
+    .action(async (options) => {
+    const { runOllamaConverge } = await import('./modelConvergeRunner.js');
+    const outcomes = await runOllamaConverge({ dryRun: options.dryRun === true });
+    if (outcomes.every(o => o.action === 'failed'))
+        process.exitCode = 1;
+});
 // ─── prism register-models ────────────────────────────────────
 // Convenience: alias namespaced HF-style prism-coder tags
 // (`dcostenco/prism-coder:9b`) to the bare tags (`prism-coder:9b`)

package/dist/dashboard/dashboardToken.js

@@ -0,0 +1,43 @@
+import { randomBytes } from "crypto";
+import { safeCompare } from "./authUtils.js";
+function isTruthy(v) {
+    const s = (v || "").trim().toLowerCase();
+    return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+/**
+ * Resolve the active dashboard token, or null when token mode is off. A pinned
+ * token wins over a random one so operators can share a stable URL; an empty or
+ * whitespace-only pin is ignored (falls back to a random token).
+ */
+export function resolveDashboardToken(cfg) {
+    if (cfg.authEnabled)
+        return null; // real auth is the gate
+    if (isTruthy(cfg.optOut))
+        return null; // explicit opt-out (Host guard still applies)
+    const pinned = (cfg.pinnedToken || "").trim();
+    if (pinned)
+        return pinned;
+    return randomBytes(32).toString("hex");
+}
+/** Extract the prism_dashboard_token cookie value, if present. */
+export function tokenFromCookie(cookieHeader) {
+    // Capture the whole value (any run of non-";", non-space) so pinned tokens
+    // with hyphens/underscores match; the name is anchored to start-or-"; " so a
+    // look-alike cookie (evil_prism_dashboard_token=…) cannot match.
+    const m = (cookieHeader || "").match(/(?:^|;\s*)prism_dashboard_token=([^;\s]+)/);
+    return m ? m[1] : null;
+}
+/**
+ * True when the request presents the active token via the cookie, the
+ * X-Prism-Dashboard-Token header, or a ?token= query param. Every comparison is
+ * timing-safe and only runs against the single active token.
+ */
+export function requestHasToken(headers, queryToken, activeToken) {
+    const candidates = [tokenFromCookie(headers.cookie), headers.headerToken ?? null, queryToken];
+    return candidates.some((c) => c !== null && safeCompare(c, activeToken));
+}
+/** Build the Set-Cookie value that stores the token for a browser session. */
+export function buildTokenCookie(token, maxAgeMs, secure) {
+    return (`prism_dashboard_token=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
+        `Max-Age=${Math.floor(maxAgeMs / 1000)}${secure ? "; Secure" : ""}`);
+}

package/dist/dashboard/hostGuard.js

@@ -0,0 +1,92 @@
+/**
+ * Host / Origin allow-listing for the Mind Palace dashboard.
+ *
+ * GHSA-9cvx-7x8q-3g6m: the dashboard auto-starts on every MCP boot, binds
+ * loopback, and by default runs with auth disabled. Loopback binding does NOT
+ * stop DNS rebinding — a page the developer merely visits can rebind its own
+ * hostname to 127.0.0.1 and reach this server as "same-origin", carrying an
+ * attacker-chosen Host/Origin. The server must therefore reject any request
+ * whose Host (or, when present, Origin) is not a trusted local name or the
+ * operator-configured public origin, BEFORE any route runs and independent of
+ * whether auth is configured. This mirrors the standard fix for the class
+ * (Host-header validation, cf. CVE-2025-10193).
+ *
+ * Matching by hostname only (port-agnostic) is deliberate and safe: the attack
+ * requires an attacker-controlled *name*, so `localhost` / `127.0.0.1` / `[::1]`
+ * are trustworthy on any port — which also keeps the guard correct when the
+ * server falls back to PORT+1/PORT+2 on an address-in-use conflict.
+ */
+/** Loopback host names browsers use for the local dashboard. Exact match only. */
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * Lowercased hostname (never the port) of a Host authority (`host[:port]`) or a
+ * full Origin URL. Returns null when the value cannot be parsed — a malformed or
+ * opaque value (e.g. the literal `null` Origin) is never trusted.
+ */
+function hostnameOf(value, asUrl = false) {
+    try {
+        const u = asUrl ? new URL(value) : new URL(`http://${value}`);
+        return u.hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/** The set of hostnames that may be served: loopback + configured origin. */
+function trustedHostnames(cfg) {
+    const names = new Set(LOOPBACK_HOSTNAMES);
+    if (cfg.configuredOrigin) {
+        const h = hostnameOf(cfg.configuredOrigin, true);
+        if (h)
+            names.add(h);
+    }
+    return names;
+}
+/**
+ * True when a request target addresses a sensitive dashboard route — the memory
+ * API (`/api/*`) or the MCP HTTP transport (`/sse`, `/messages`) — and must
+ * therefore pass the Host/Origin gate.
+ *
+ * Scoping MUST use the same normalized pathname the router resolves, or a
+ * dot-segment target like `/x/../api/settings` slips past a raw-string prefix
+ * check while the router still collapses it to `/api/settings` and serves the
+ * data. A fixed base keeps this independent of the attacker-supplied Host; an
+ * unparseable target is treated as guarded (fail closed). Public routes (the
+ * static shell, PWA assets, the Smithery manifest) carry no session data and
+ * are intentionally out of scope.
+ */
+export function isRebindGuardedPath(requestTarget) {
+    let pathname;
+    try {
+        pathname = new URL(requestTarget || "/", "http://prism-dashboard.invalid").pathname;
+    }
+    catch {
+        return true; // unparseable target → fail closed
+    }
+    return pathname.startsWith("/api/") || pathname === "/sse" || pathname === "/messages";
+}
+/** True when the HTTP Host header names a trusted local or configured host. */
+export function isTrustedHost(hostHeader, cfg) {
+    if (!hostHeader)
+        return false; // HTTP/1.1 requires Host; absence is not trusted.
+    const name = hostnameOf(hostHeader);
+    return name !== null && trustedHostnames(cfg).has(name);
+}
+/**
+ * True when the Origin header (if the request carries one) is trusted. A request
+ * with no Origin — a top-level navigation or a non-CORS GET — is not rejected on
+ * Origin grounds; the Host check is the load-bearing gate there.
+ */
+export function isTrustedOrigin(originHeader, cfg) {
+    if (!originHeader)
+        return true; // absent Origin defers to the Host check
+    const name = hostnameOf(originHeader, true);
+    return name !== null && trustedHostnames(cfg).has(name);
+}
+/**
+ * Combined DNS-rebinding gate: the request must pass BOTH the Host and the
+ * (when present) Origin check. Call this before serving any sensitive route.
+ */
+export function isTrustedRequest(headers, cfg) {
+    return isTrustedHost(headers.host, cfg) && isTrustedOrigin(headers.origin, cfg);
+}

package/dist/dashboard/server.js

@@ -33,6 +33,8 @@ import { buildVaultDirectory } from "../utils/vaultExporter.js";
 import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
+import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
+import { resolveDashboardToken, requestHasToken, buildTokenCookie, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
 /** Read HTTP request body as string (Buffer-based to avoid GC thrash on large imports) */
@@ -95,6 +97,16 @@ export async function startDashboardServer() {
     }
     const SESSION_TTL_MS = parseInt(process.env.PRISM_SESSION_TTL_MS ?? String(24 * 60 * 60 * 1000), 10);
     const activeSessions = new Map();
+    // ─── SECURITY: default-on dashboard token (GHSA-9cvx-7x8q-3g6m, remediation #2) ───
+    // Null when real auth is configured (that is the gate) or explicitly opted
+    // out; otherwise a random per-startup secret gates the data API as a second
+    // layer beneath the Host guard. Surfaced only in the startup log below.
+    const DASHBOARD_TOKEN = resolveDashboardToken({
+        authEnabled: AUTH_ENABLED,
+        pinnedToken: process.env.PRISM_DASHBOARD_TOKEN,
+        optOut: process.env.PRISM_DASHBOARD_NO_TOKEN,
+    });
+    const COOKIE_SECURE = !!process.env.PRISM_DASHBOARD_ORIGIN?.startsWith("https://") || !!process.env.PRISM_DASHBOARD_SECURE;
     // Auth config object — injectable for testing via authUtils.ts
     const authConfig = {
         authEnabled: AUTH_ENABLED,
@@ -199,8 +211,49 @@ return false;}
             res.writeHead(204);
             return res.end();
         }
+        // ─── SECURITY: Host / Origin allow-list (GHSA-9cvx-7x8q-3g6m) ───
+        // Reject DNS-rebinding requests before any sensitive route runs, independent
+        // of AUTH_ENABLED. A rebound browser reaches this loopback server carrying an
+        // attacker-controlled Host/Origin; only a trusted local name or the operator-
+        // configured PRISM_DASHBOARD_ORIGIN may be served the memory API / MCP
+        // transport. The public Smithery manifest (/.well-known/...) is intentionally
+        // left out of scope — it exposes no session data.
+        if (isRebindGuardedPath(req.url) &&
+            !isTrustedRequest({ host: req.headers.host, origin: req.headers.origin }, { configuredOrigin: process.env.PRISM_DASHBOARD_ORIGIN })) {
+            res.writeHead(403, { "Content-Type": "application/json" });
+            return res.end(JSON.stringify({ error: "Forbidden: untrusted Host or Origin (possible DNS rebinding)" }));
+        }
         // ─── v5.1: Auth login endpoint (always accessible) ───
         const reqUrl = new URL(req.url || "/", `http://${req.headers.host}`);
+        // ─── SECURITY: dashboard token gate (GHSA-9cvx-7x8q-3g6m, remediation #2) ───
+        // Second layer beneath the Host guard. Inert when DASHBOARD_TOKEN is null
+        // (real auth configured, or opted out). A page load carrying a valid ?token=
+        // is bootstrapped into a SameSite cookie so the SPA's later same-origin
+        // fetches authenticate transparently; the data API otherwise requires the
+        // token via cookie, X-Prism-Dashboard-Token header, or ?token= query.
+        if (DASHBOARD_TOKEN) {
+            const qToken = reqUrl.searchParams.get("token");
+            const isApiPath = reqUrl.pathname.startsWith("/api/");
+            if (!isApiPath && qToken && safeCompare(qToken, DASHBOARD_TOKEN)) {
+                reqUrl.searchParams.delete("token");
+                const cleanTarget = reqUrl.pathname + (reqUrl.search ? reqUrl.search : "");
+                res.writeHead(302, {
+                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE),
+                    Location: cleanTarget,
+                });
+                return res.end();
+            }
+            if (isApiPath &&
+                !requestHasToken({
+                    cookie: req.headers.cookie,
+                    headerToken: req.headers["x-prism-dashboard-token"] || null,
+                }, qToken, DASHBOARD_TOKEN)) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                return res.end(JSON.stringify({
+                    error: "Dashboard token required — open the tokenized URL printed in the Prism startup log.",
+                }));
+            }
+        }
         if (AUTH_ENABLED && reqUrl.pathname === "/api/auth/login" && req.method === "POST") {
             // v6.5.1: Rate limiting — prevent brute-force attacks
             const clientIP = (req.socket?.remoteAddress || "unknown").replace(/^::ffff:/, "");
@@ -260,7 +313,8 @@ return false;}
                         version: SERVER_CONFIG.version,
                     },
                     authentication: {
-                        required: AUTH_ENABLED
+                        // True when either configured auth or the default token gate is active.
+                        required: AUTH_ENABLED || !!DASHBOARD_TOKEN
                     },
                     configSchema: {
                         type: "object",
@@ -1406,7 +1460,14 @@ self.addEventListener('message', (e) => {
     catch {
         // Non-fatal — just means the user has to know the port
     }
-    console.error(`[Prism] 🧠 Mind Palace Dashboard → http://localhost:${boundPort}`);
+    if (DASHBOARD_TOKEN) {
+        console.error(`[Prism] 🔐 Mind Palace Dashboard → http://localhost:${boundPort}/?token=${DASHBOARD_TOKEN}`);
+        console.error(`[Prism]    Data API is token-gated by default (GHSA-9cvx-7x8q-3g6m). Open the URL above once; ` +
+            `pin it with PRISM_DASHBOARD_TOKEN, or disable with PRISM_DASHBOARD_NO_TOKEN=1.`);
+    }
+    else {
+        console.error(`[Prism] 🧠 Mind Palace Dashboard → http://localhost:${boundPort}`);
+    }
     // ─── v3.1: TTL Sweep — runs at startup + every 12 hours ───────────
     // NOTE (v5.4): The Background Scheduler in server.ts now also handles
     // TTL sweeps. This dashboard sweep is kept as a legacy fallback for

package/dist/modelConvergeRunner.js

@@ -0,0 +1,94 @@
+/**
+ * Production wiring for model convergence — real Ollama, real registry.
+ *
+ * Kept out of cli.ts so the pure logic (utils/modelConverge.ts) stays
+ * testable with injected deps, and out of utils/ because this half owns
+ * process spawning. `ollama pull` runs with inherited stdio deliberately:
+ * a multi-GB download with no progress bar reads as a hang, and ollama's
+ * own progress output is better than anything we would reimplement.
+ *
+ * Adversarial review 2026-08-18 (pre-20.14.0), two findings fixed here:
+ *
+ * 1. SPLIT-BRAIN DAEMON TARGETING: listTags read /api/tags from
+ *    PRISM_LOCAL_LLM_URL while the spawned `ollama` CLI targeted whatever
+ *    OLLAMA_HOST the user's shell had (default localhost). On a machine
+ *    with a remote Ollama, convergence read tags from one daemon and
+ *    pulled/re-aliased against another. The spawn env now pins OLLAMA_HOST
+ *    to the SAME url the tags came from — one daemon, one truth.
+ *
+ * 2. SILENT MULTI-GB DOWNLOADS: connect gave no warning before pulling.
+ *    Measured the day this shipped: the registry 27b had just changed
+ *    bytes, so every 27b holder's first converge pulls ~16 GB. The plan
+ *    is now announced up front, with the --no-models escape hatch named,
+ *    before any network transfer starts.
+ */
+import { spawn } from "node:child_process";
+import { convergeModels, MODEL_NAMESPACE, LOCAL_PREFIX, CONVERGE_TIERS } from "./utils/modelConverge.js";
+const OLLAMA_URL = process.env.PRISM_LOCAL_LLM_URL || "http://localhost:11434";
+/**
+ * Env for spawned `ollama` processes. OLLAMA_HOST is pinned to the same
+ * daemon /api/tags was read from — never the shell's ambient value — so
+ * list, pull, and cp can never disagree about which Ollama they act on.
+ * Exported for tests.
+ */
+export function convergeEnv(base, ollamaUrl = OLLAMA_URL) {
+    return { ...base, OLLAMA_HOST: ollamaUrl };
+}
+function runOllama(args, inheritStdio) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("ollama", args, {
+            stdio: inheritStdio ? "inherit" : "ignore",
+            env: convergeEnv(process.env),
+        });
+        child.on("error", (err) => reject(new Error(`ollama ${args[0]}: ${err.message}`)));
+        child.on("close", (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`ollama ${args.join(" ")} exited ${code}`));
+        });
+    });
+}
+export async function runOllamaConverge(opts = {}) {
+    // Announce the plan BEFORE any network transfer: which tiers are
+    // installed (and will be checked), that pulls can be large, and how to
+    // opt out. A 16 GB download must never be the first sign convergence
+    // is running.
+    let installedTiers = [];
+    try {
+        const res = await fetch(`${OLLAMA_URL}/api/tags`, { signal: AbortSignal.timeout(5_000) });
+        if (res.ok) {
+            const data = (await res.json());
+            const names = new Set((data.models ?? []).map((m) => m.name));
+            installedTiers = CONVERGE_TIERS.filter((t) => names.has(`${MODEL_NAMESPACE}:${t}`) || names.has(`${LOCAL_PREFIX}:${t}`));
+        }
+    }
+    catch {
+        // convergeModels handles the unreachable case with its own message
+    }
+    if (installedTiers.length > 0) {
+        console.log(`\nConverging ${installedTiers.length} installed model tier(s) [${installedTiers.join(", ")}] against the registry.`);
+        console.log("  Updated models download in full (can be multiple GB). Skip with: prism connect --no-models");
+    }
+    else {
+        console.log("\nConverging local models against the registry…");
+    }
+    const outcomes = await convergeModels({
+        listTags: async () => {
+            const res = await fetch(`${OLLAMA_URL}/api/tags`, { signal: AbortSignal.timeout(5_000) });
+            if (!res.ok)
+                throw new Error(`Ollama /api/tags HTTP ${res.status}`);
+            const data = (await res.json());
+            return (data.models ?? []).map((m) => ({ name: m.name, digest: m.digest }));
+        },
+        pull: (ref) => runOllama(["pull", ref], true),
+        copy: (from, to) => runOllama(["cp", from, to], false),
+        log: (line) => console.log(`  ${line}`),
+        dryRun: opts.dryRun,
+    });
+    const failed = outcomes.filter((o) => o.action === "failed" && o.detail !== "ollama_unreachable");
+    if (failed.length > 0) {
+        console.log(`  ⚠ ${failed.length} tier(s) did not converge — re-run \`prism update-models\` when the network allows`);
+    }
+    return outcomes;
+}

package/dist/utils/modelConverge.js

@@ -0,0 +1,102 @@
+/**
+ * Model convergence for `prism connect` — the missing half of self-update.
+ *
+ * selfUpdate.ts converges the PACKAGE; nothing converged the MODELS. The gap
+ * was measured on 2026-08-18: the vision-restored artifacts had been on the
+ * Ollama registry for four days while a laptop that pulled earlier kept
+ * refusing image requests (layer1_classifier_no_vision) — and on the machine
+ * where this was written, the `prism-coder:2b` alias pointed at different
+ * bytes than `dcostenco/prism-coder:2b`, because `ollama cp` makes a
+ * SNAPSHOT: a re-pull updates the source name and silently leaves every
+ * alias behind.
+ *
+ * Design decisions, in order of importance:
+ *
+ * 1. DELEGATE freshness to `ollama pull`. The registry serves no
+ *    docker-content-digest header and its manifest body hash is not the
+ *    digest ollama reports locally, so a client-side digest comparison
+ *    would reimplement (and drift from) ollama's own logic. `ollama pull`
+ *    of an up-to-date tag is a manifest check that downloads nothing.
+ *
+ * 2. REPAIR the alias after every pull. `prism-coder:<t>` must equal
+ *    `dcostenco/prism-coder:<t>` byte-for-byte; when digests differ, re-cp.
+ *    This is the trap register-models cannot fix on its own — it only
+ *    aliases tags that are MISSING, not tags that are stale.
+ *
+ * 3. Converge only tiers the machine already has (either the alias or the
+ *    namespaced source). Convergence updates what you chose to install; it
+ *    never decides that a 16 GB model belongs on your laptop.
+ *
+ * 4. Models must never break connect. Ollama down, registry unreachable,
+ *    one tier failing — report and continue. A machine with stale models
+ *    and fresh config beats a machine with neither.
+ */
+export const MODEL_NAMESPACE = "dcostenco/prism-coder";
+export const LOCAL_PREFIX = "prism-coder";
+export const CONVERGE_TIERS = ["2b", "4b", "9b", "27b"];
+export async function convergeModels(deps) {
+    let tags;
+    try {
+        tags = await deps.listTags();
+    }
+    catch (err) {
+        deps.log(`− model convergence skipped: Ollama unreachable (${err instanceof Error ? err.message : String(err)})`);
+        return CONVERGE_TIERS.map((tier) => ({ tier, action: "failed", detail: "ollama_unreachable" }));
+    }
+    const byName = new Map(tags.map((t) => [t.name, t]));
+    const outcomes = [];
+    for (const tier of CONVERGE_TIERS) {
+        const source = `${MODEL_NAMESPACE}:${tier}`;
+        const alias = `${LOCAL_PREFIX}:${tier}`;
+        const hadSource = byName.has(source);
+        const hadAlias = byName.has(alias);
+        if (!hadSource && !hadAlias) {
+            outcomes.push({ tier, action: "skipped_not_installed" });
+            continue;
+        }
+        if (deps.dryRun) {
+            deps.log(`• would pull ${source} and repair the ${alias} alias if stale`);
+            outcomes.push({ tier, action: "up_to_date", detail: "dry_run" });
+            continue;
+        }
+        try {
+            const digestBefore = byName.get(source)?.digest;
+            await deps.pull(source);
+            // Re-list AFTER the pull: both the freshness answer and the alias
+            // comparison must come from post-pull state, or a pull that
+            // changed bytes looks identical to one that did nothing.
+            const after = await deps.listTags();
+            const afterByName = new Map(after.map((t) => [t.name, t]));
+            const sourceNow = afterByName.get(source);
+            const aliasNow = afterByName.get(alias);
+            if (!sourceNow) {
+                outcomes.push({ tier, action: "failed", detail: "source_missing_after_pull" });
+                deps.log(`⚠ ${source}: pull reported success but the tag is not installed`);
+                continue;
+            }
+            const pulledNewBytes = digestBefore !== undefined && digestBefore !== sourceNow.digest;
+            const aliasStale = !aliasNow || aliasNow.digest !== sourceNow.digest;
+            if (aliasStale) {
+                await deps.copy(source, alias);
+                const action = pulledNewBytes || !hadSource ? "pulled_and_aliased" : "aliased_only";
+                outcomes.push({ tier, action });
+                deps.log(`✓ ${alias} ${aliasNow ? "re-aliased (was a stale snapshot)" : "aliased"} → ${sourceNow.digest.slice(0, 12)}`);
+            }
+            else if (pulledNewBytes) {
+                // Alias digest already matches the fresh source — cp raced us
+                // or the user re-aliased by hand; either way converged.
+                outcomes.push({ tier, action: "pulled_and_aliased" });
+                deps.log(`✓ ${source} updated; ${alias} already matches`);
+            }
+            else {
+                outcomes.push({ tier, action: "up_to_date" });
+                deps.log(`= ${alias} up to date (${sourceNow.digest.slice(0, 12)})`);
+            }
+        }
+        catch (err) {
+            outcomes.push({ tier, action: "failed", detail: err instanceof Error ? err.message : String(err) });
+            deps.log(`⚠ ${source}: ${err instanceof Error ? err.message : String(err)} — continuing with the other tiers`);
+        }
+    }
+    return outcomes;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.13.1",
+  "version": "20.15.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",