prism-mcp-server 20.17.0 → 20.17.2

package/README.md

@@ -138,21 +138,45 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.17.2
+
+- **Pasted logs can no longer falsely activate skills.** Symptom-triggered
+  routing now strips fenced blocks and routable skill-name mentions (including
+  inside compound identifiers like container/pod names) from the routing view
+  of a prompt, so quoting an agent log or a skill list doesn't load skills the
+  text merely mentions. Skills named by ordinary words keep routing normally.
+- **Symptom-routed skills now arrive whole.** Startup budgets deliver the full
+  rule text at every depth that fits; when a rule genuinely cannot fit, the
+  display says exactly how much is missing and how to load the rest, instead
+  of silently truncating.
+- **Routing can no longer be silently disabled by one bad skill.** Corrupt or
+  hostile trigger tables — wrong value shapes, patterns named after object
+  prototype properties — are skipped per entry instead of taking down all
+  prompt routing (or, in one case, the vault export) for the session.
+
+## What's New in v20.17.1
+
+- **Fixes a broken CLI in 20.17.0** — a command-name collision made every
+  `prism` CLI invocation exit with a commander error at startup (the MCP
+  server was unaffected). The handoff-sync command is `prism handoff …`;
+  `prism sync` remains cross-backend data synchronization. If you installed
+  20.17.0, update.
+
 ## What's New in v20.17.0
 
 ### Cross-Machine Session Handoff — End-to-End Encrypted
 
-- **Resume a session on any of your machines.** With `prism sync enable` (paid,
+- **Resume a session on any of your machines.** With `prism handoff enable` (paid,
   off by default), each `session_save_handoff` seals the handoff to all your
   account's device keys and relays the CIPHERTEXT; another machine pulls with
-  `sync_pull_handoff` (or `prism sync pull <project>`) and opens it locally.
+  `sync_pull_handoff` (or `prism handoff pull <project>`) and opens it locally.
 - **The relay stores ciphertext only** — X25519 + AES-256-GCM sealed
   envelopes. No key that opens a handoff ever exists server-side. The channel
   is deliberately separate from savings sync, which carries counters only.
 - **TOFU device pinning** surfaces a compromised relay: sealing to a key this
   machine has never seen warns loudly, keyed on the client-derived recipient
   id so a swapped key can't hide behind a familiar device name.
-- `prism sync status|devices` to inspect; revoke a lost machine from the portal.
+- `prism handoff status|devices` to inspect; revoke a lost machine from the portal.
 
 ## What's New in v20.16.0
 

package/dist/cli.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { spawnSync } from 'node:child_process';
-import { readFileSync, mkdirSync, readdirSync, statSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { readFileSync } from 'node:fs';
 import { SqliteStorage } from './storage/sqlite.js';
 import { handleVerifyStatus, handleGenerateHarness } from './verification/cliHandler.js';
 import * as path from 'path';
@@ -495,31 +494,12 @@ program
 // that can fail a turn gets uninstalled; a hook that is slow gets noticed.
 /** Deliberate offload for payloads over the host inline cap. The host's own
  *  overflow path swaps the payload for a 2KB preview with no instruction to
- *  read the rest; this file plus the inline pointer is the recoverable form. */
-function writeRouteOffload(fullText) {
-    try {
-        const dir = path.join(homedir(), '.prism-mcp', 'route-context');
-        mkdirSync(dir, { recursive: true });
-        try {
-            // Best-effort prune: one file per over-budget routed prompt, kept a week.
-            for (const f of readdirSync(dir)) {
-                const p = path.join(dir, f);
-                try {
-                    if (Date.now() - statSync(p).mtimeMs > 7 * 86_400_000)
-                        rmSync(p);
-                }
-                catch { /* skip unstat-able entries */ }
-            }
-        }
-        catch { /* prune failure never blocks the write */ }
-        const target = path.join(dir, `route-${Date.now()}-${process.pid}.md`);
-        writeFileSync(target, fullText);
-        return target;
-    }
-    catch {
-        return undefined; // reshape degrades to the loud in-band fallback
-    }
-}
+ *  read the rest; this file plus the inline pointer is the recoverable form.
+ *  Round-2 review: this file kept its own UNBOUNDED copy after the shared
+ *  extraction — two implementations, one fixed, the hook path (the hotter
+ *  one) still stat-ing every entry. One shared implementation serves both. */
+import { writeRouteOffload as sharedWriteRouteOffload } from './utils/routeOffload.js';
+const writeRouteOffload = (fullText) => sharedWriteRouteOffload(fullText, 'route');
 program
     .command('route-prompt')
     .description('Match a prompt (stdin) against skill triggers; prints {names, text} JSON. Used by the prism-route host hook.')
@@ -1134,12 +1114,14 @@ program
         process.exit(1);
     }
 });
-// ─── prism sync ───────────────────────────────────────────────
-// Cross-machine handoff sync controls. Push happens automatically on
-// session_save_handoff once enabled; everything E2E lives in src/crypto/.
+// ─── prism handoff ────────────────────────────────────────────
+// Cross-machine handoff sync controls ('sync' was taken by cross-backend
+// data synchronization above — a collision the stale local dist hid until
+// CI built fresh). Push happens automatically on session_save_handoff once
+// enabled; everything E2E lives in src/crypto/.
 program
-    .command('sync <action> [project]')
-    .description('Cross-machine handoff sync: enable | disable | status | pull <project> | devices')
+    .command('handoff <action> [project]')
+    .description('Cross-machine handoff sync (E2E): enable | disable | status | pull <project> | devices')
     .action(async (action, project) => {
     try {
         switch (action) {
@@ -1150,7 +1132,7 @@ program
                 console.log(action === 'enable'
                     ? 'Handoff sync enabled. On each session_save_handoff, the handoff is sealed to your '
                         + 'account devices (end-to-end encrypted — the relay stores ciphertext only) and uploaded. '
-                        + 'Paid plans; disable anytime with: prism sync disable'
+                        + 'Paid plans; disable anytime with: prism handoff disable'
                     : 'Handoff sync disabled. Nothing further leaves this machine on this channel.');
                 return;
             }
@@ -1166,7 +1148,7 @@ program
             }
             case 'pull': {
                 if (!project) {
-                    console.error('Usage: prism sync pull <project>');
+                    console.error('Usage: prism handoff pull <project>');
                     process.exit(1);
                 }
                 const { pullHandoff, renderPulledHandoff } = await import('./sync/handoffSync.js');

package/dist/sync/handoffSync.js

@@ -232,7 +232,7 @@ export async function pushHandoffFromArgs(args) {
     const result = await pushHandoff(project, o);
     if (result.pushed && result.new_devices?.length) {
         console.error(`[handoff-sync] ⚠ NEW sync device(s) on your account: ${result.new_devices.join(", ")}. ` +
-            `If you did not add a machine, revoke it: prism sync devices`);
+            `If you did not add a machine, revoke it: prism handoff devices`);
     }
 }
 export async function pullHandoff(project, fetchImpl = fetch) {
@@ -289,7 +289,7 @@ export async function pullHandoff(project, fetchImpl = fetch) {
 export function renderPulledHandoff(r) {
     if (!r.ok || !r.payload) {
         const why = {
-            disabled: "Handoff sync is off on this machine. Enable: prism sync enable",
+            disabled: "Handoff sync is off on this machine. Enable: prism handoff enable",
             no_blob: "No synced handoff exists for this project yet.",
             not_recipient: "A handoff exists but was sealed before this device joined — it will include this machine after the next save elsewhere.",
             not_entitled: "Cross-machine sync needs a paid plan and a signed-in account.",

package/dist/tools/ledgerHandlers.js

@@ -109,10 +109,61 @@ const MAX_SYMPTOM_SKILLS = 5;
  * instruction rewrites failed for that reason before it was found. Inlining
  * removes the indirection entirely: the rule is simply in context.
  */
-const SYMPTOM_SKILL_INLINE_MAX = 1_800;
+/**
+ * Ceiling on an inlined rule — deliberately ABOVE every depth's budget share so
+ * the SHARE governs, not this constant.
+ *
+ * It was 1_800, which made it the binding constraint at every depth that has
+ * room: standard allots 8_000*0.4 = 3_200 and deep allots 30_000*0.4 = 12_000,
+ * so deep discarded 10_200 chars of already-budgeted space. Every super-skill
+ * is 8-15 KB, so a symptom-routed super-skill always arrived at 12-23% of its
+ * text while the same display instructed the agent to "follow them before
+ * proposing any change" — compliance demanded against a rule mostly absent.
+ * At 12_000 a full dev-engineering-super-skill (8_863) now fits whole at deep
+ * depth; quick is unchanged because its share (1_600) is still the smaller.
+ */
+const SYMPTOM_SKILL_INLINE_MAX = 12_000;
 const SYMPTOM_SKILL_BUDGET_SHARE = 0.4;
 /** Below this the inlined rule is too clipped to be worth the space it costs. */
 const SYMPTOM_SKILL_INLINE_MIN = 400;
+/**
+ * Upper bound on the suffix chrome beyond the body for ONE inlined skill:
+ * names line + imperative (~230), truncation notice (~200 + the name twice),
+ * offload pointer (~30 + path, ≤ ~180 under $HOME). Round-2 review measured
+ * the old flat 600 undercounting by 2-3x for long names — this is a FUNCTION
+ * of the name so the reserve is honest for every name the table allows
+ * (≤128 chars), and a property test pins estimate ≥ measured chrome. The
+ * final cap guarantee in capNativeStartupText remains the hard backstop.
+ */
+export function symptomChromeUpperBound(name) {
+    return 480 + 2 * name.length + 220; // imperative+notice + 2×name + path slack
+}
+/**
+ * Render one symptom-routed skill body for the startup display. EXPORTED and
+ * pure so tests execute the REAL rendering: the first test suite asserted the
+ * notice strings existed in source text, which a dead-code wrap around the
+ * call site would have satisfied while shipping nothing (adversarial review,
+ * confirmed). A test that calls this function fails the moment the strings —
+ * or the branch — stop being live.
+ *
+ * When the body exceeds `cap`, the excerpt says how much is missing, names
+ * the skill so ANY host can load it by name (hosts without hooks — Codex —
+ * or without filesystem tools cannot follow a path), and forbids treating
+ * the excerpt as the whole rule. The offload path is an extra route only.
+ */
+export function formatSymptomSkillInline(name, body, cap, offloadPath) {
+    if (body.length <= cap) {
+        return `\n--- ${name} ---\n${body}\n`;
+    }
+    const missing = body.length - cap;
+    return (`\n--- ${name} (showing ${cap} of ${body.length} chars) ---\n` +
+        `${sliceCodepointSafe(body, cap).trimEnd()}\n` +
+        `… TRUNCATED — ${missing} chars of this rule are NOT shown above. ` +
+        `Load the full skill by name (\`${name}\`) before acting on it; ` +
+        `do not treat the excerpt as the whole rule.` +
+        (offloadPath ? ` Complete text also saved at: ${offloadPath}` : "") +
+        `\n`);
+}
 /**
  * The character budget a native startup display will actually be capped to.
  *
@@ -442,13 +493,36 @@ async function readDashboardUrl() {
     });
     return healthy ? `http://localhost:${port}` : null;
 }
-function capNativeStartupText(text, level, requestedMaxChars, suffix = "") {
+/** slice() that never ends on a lone high surrogate — round-2 review showed
+ *  UTF-16 slicing emitting broken pairs that corrupt downstream rendering. */
+export function sliceCodepointSafe(text, end) {
+    const cut = text.slice(0, Math.max(0, end));
+    const last = cut.charCodeAt(cut.length - 1);
+    return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
+}
+export function capNativeStartupText(text, level, requestedMaxChars, suffix = "") {
     const maxChars = effectiveNativeBudget(level, requestedMaxChars);
     if (text.length + suffix.length <= maxChars)
         return text + suffix;
     const marker = `\n\n… Additional ${level} context omitted to keep native startup within its display budget.`;
-    const keepChars = Math.max(0, maxChars - marker.length - suffix.length);
-    return text.slice(0, keepChars).trimEnd() + marker + suffix;
+    // FINAL guarantee, not best-effort. The old keepChars=max(0, …) silently
+    // returned marker+suffix UNCHECKED when the suffix alone exceeded the
+    // budget — at heavily-divided multi-project bootstrap budgets the response
+    // then blew past the per-project cap, recreating at the host layer exactly
+    // the arbitrary truncation this display exists to prevent (adversarial
+    // review, reproduced). If the suffix cannot fit beside the marker, the
+    // suffix itself is trimmed with its own honest marker; the return is never
+    // longer than maxChars.
+    let cappedSuffix = suffix;
+    const suffixBudget = maxChars - marker.length;
+    if (cappedSuffix.length > suffixBudget) {
+        const suffixMarker = `\n… symptom-skill excerpt shortened to fit this project's startup budget; load the skill by name for the full rule.`;
+        cappedSuffix = sliceCodepointSafe(cappedSuffix, suffixBudget - suffixMarker.length).trimEnd() + suffixMarker;
+        if (cappedSuffix.length > suffixBudget)
+            cappedSuffix = sliceCodepointSafe(cappedSuffix, suffixBudget);
+    }
+    const keepChars = Math.max(0, maxChars - marker.length - cappedSuffix.length);
+    return sliceCodepointSafe(text, keepChars).trimEnd() + marker + cappedSuffix;
 }
 function compactWithOmissionCount(value, maxChars) {
     const text = typeof value === "string" ? value.trim() : String(value ?? "").trim();
@@ -1469,14 +1543,21 @@ export async function sessionLoadContextHandler(args, options = {}) {
                     const body = stripSkillFrontmatter(await readNativeSkillBody(shown[0]));
                     // Size against the budget this display will ACTUALLY be capped to,
                     // not the level constant — bootstrap divides it across projects.
-                    const cap = Math.min(SYMPTOM_SKILL_INLINE_MAX, Math.floor(effectiveNativeBudget(level, options.nativeMaxChars) * SYMPTOM_SKILL_BUDGET_SHARE));
+                    // Reserve the suffix chrome (a function of the name — see
+                    // symptomChromeUpperBound) so body+chrome stay inside the share
+                    // instead of overflowing into the context's portion at small
+                    // divided budgets.
+                    const budgetForLevel = effectiveNativeBudget(level, options.nativeMaxChars);
+                    const cap = Math.min(SYMPTOM_SKILL_INLINE_MAX, Math.floor(budgetForLevel * SYMPTOM_SKILL_BUDGET_SHARE), Math.max(0, budgetForLevel - symptomChromeUpperBound(shown[0])));
                     // Too tight to carry a useful rule: keep the name line, which is
                     // small, and leave the remaining budget to the session context.
                     if (body && cap >= SYMPTOM_SKILL_INLINE_MIN) {
-                        const clipped = body.length > cap
-                            ? `${body.slice(0, cap).trimEnd()}\n… (rule truncated to fit the startup budget)`
-                            : body;
-                        symptomSkillSuffix += `\n--- ${shown[0]} ---\n${clipped}\n`;
+                        let offload;
+                        if (body.length > cap) {
+                            const { writeRouteOffload } = await import("../utils/routeOffload.js");
+                            offload = writeRouteOffload(`# ${shown[0]}\n\n${body}`, "skill");
+                        }
+                        symptomSkillSuffix += formatSymptomSkillInline(shown[0], body, cap, offload);
                     }
                 }
             }
@@ -1867,7 +1948,10 @@ export function buildSessionFactsLine(facts) {
 export async function collectSkillTriggersOnThisMachine() {
     try {
         const { collectScopedTriggers, collectLocalSkillTriggers } = await import("./scopedSkillTriggers.js");
-        const merged = {};
+        // Null-prototype for the same reason as the accumulators in
+        // scopedSkillTriggers.ts (round-5): a user-authored pattern named
+        // __proto__/constructor must be a plain data key, not an inherited read.
+        const merged = Object.create(null);
         const localNames = new Set();
         const errors = [];
         const settings = await getAllSettings();

package/dist/tools/scopedSkillTriggers.js

@@ -101,7 +101,17 @@ function unquote(value) {
  * reader already used by skill_save so the two agree on what a skill file is.
  */
 export function extractSkillTriggers(skillName, content) {
-    const result = { triggers: {}, errors: [] };
+    // NULL-PROTOTYPE accumulator (round-5 review): `prompt_triggers` is
+    // user-authored text, and a pattern whose TEXT is an inherited property
+    // name (__proto__, constructor, toString…) made the plain-object merge
+    // idiom `(triggers[pattern] ||= []).push(…)` read the inherited value —
+    // truthy, no .push → throw. That throw escaped collectScopedTriggers and
+    // was swallowed by collectSkillTriggersOnThisMachine's outer catch,
+    // silently discarding EVERY skill's triggers on this machine, not just
+    // the poisoned one. A null prototype has nothing to inherit, so the
+    // idiom is a plain data-property op for any key. Same treatment at every
+    // trigger accumulator in this file and in ledgerHandlers' merge.
+    const result = { triggers: Object.create(null), errors: [] };
     const frontmatter = content.match(/^---\n([\s\S]*?)\n---/);
     if (!frontmatter)
         return result;
@@ -173,7 +183,7 @@ export function extractSkillTriggers(skillName, content) {
 const MAX_LOCAL_SKILLS = 300;
 const MAX_LOCAL_FILE_BYTES = 64 * 1024;
 export async function collectLocalSkillTriggers(roots, fs, join) {
-    const merged = { triggers: {}, errors: [], names: [] };
+    const merged = { triggers: Object.create(null), errors: [], names: [] };
     let budget = MAX_LOCAL_SKILLS;
     const seen = new Set();
     for (const root of roots) {
@@ -214,7 +224,7 @@ export async function collectLocalSkillTriggers(roots, fs, join) {
     return merged;
 }
 export function collectScopedTriggers(skills) {
-    const merged = { triggers: {}, errors: [] };
+    const merged = { triggers: Object.create(null), errors: [] };
     for (const [name, content] of skills) {
         if (!content || !content.includes("prompt_triggers"))
             continue; // cheap pre-filter

package/dist/tools/sessionMemoryDefinitions.js

@@ -1958,7 +1958,7 @@ export const SYNC_PULL_HANDOFF_TOOL = {
     description: "Pulls this account's synced handoff for a project from the E2E relay and " +
         "opens it with THIS machine's device key. The relay stores ciphertext only; " +
         "a handoff is readable here only if it was sealed to this device. Requires " +
-        "handoff sync enabled (prism sync enable), a paid plan, and a signed-in " +
+        "handoff sync enabled (prism handoff enable), a paid plan, and a signed-in " +
         "account. Push happens automatically on session_save_handoff.",
     inputSchema: {
         type: "object",

package/dist/tools/skillRouting.js

@@ -109,6 +109,10 @@ export function _setStorage(persist, read) {
     persistFn = persist;
     readFn = read;
 }
+/** Test-only handle, matching this file's underscore convention for
+ *  internals exposed to tests (round-2 review). Production callers use the
+ *  module-internal function directly. */
+export const _toResolvedSkillsWithPrompt = (...args) => toResolvedSkillsWithPrompt(...args);
 function synaluxBase() {
     return (process.env.PRISM_SYNALUX_BASE_URL?.trim() ||
         process.env.SYNALUX_BASE_URL?.trim() || PRISM_SYNALUX_BASE_URL ||
@@ -199,6 +203,29 @@ function isKeywordTable(v) {
     return !!t && typeof t.version === 'number' && !!t.prompt_keywords
         && typeof t.prompt_keywords === 'object';
 }
+/**
+ * Enforce the table's value contract at INGEST, once, for every consumer.
+ * isKeywordTable only proves prompt_keywords is an object — round-4 review
+ * showed a string value ('notarray') sails through and the matcher's
+ * `for (const skillName of skills)` iterates it CHARACTER BY CHARACTER,
+ * synthesizing bogus one-letter "skill names". Non-array values are dropped,
+ * non-string members filtered, matching the scoped-trigger merge's policy.
+ * The result is NULL-PROTOTYPE so a hostile pattern key ('__proto__',
+ * 'constructor') can neither read an inherited value nor mutate a prototype
+ * downstream.
+ */
+function sanitizePromptKeywords(raw) {
+    const clean = Object.create(null);
+    for (const [pattern, names] of Object.entries(raw)) {
+        if (!Array.isArray(names))
+            continue;
+        const strings = names.filter((n) => typeof n === 'string');
+        if (strings.length === 0)
+            continue;
+        clean[pattern] = strings;
+    }
+    return clean;
+}
 /**
  * @param expectVersion routing_version the portal just reported. A mismatch
  *   means our cached copy predates a routing deploy, so drop it and refetch
@@ -222,8 +249,9 @@ async function fetchKeywordTable(expectVersion) {
             const stored = await readFn(TABLE_STORAGE_KEY);
             const parsed = stored ? JSON.parse(stored) : null;
             if (isKeywordTable(parsed) && parsed.version === expectVersion) {
-                kwCache = { table: parsed, at: Date.now() };
-                return parsed;
+                const table = { version: parsed.version, prompt_keywords: sanitizePromptKeywords(parsed.prompt_keywords) };
+                kwCache = { table, at: Date.now() };
+                return table;
             }
         }
         catch { /* fall through to network */ }
@@ -242,7 +270,7 @@ async function fetchKeywordTable(expectVersion) {
                 const raw = await res.json();
                 if (!isKeywordTable(raw))
                     throw new Error('malformed routing table');
-                const table = { version: raw.version, prompt_keywords: raw.prompt_keywords };
+                const table = { version: raw.version, prompt_keywords: sanitizePromptKeywords(raw.prompt_keywords) };
                 kwCache = { table, at: Date.now() };
                 if (persistFn) {
                     try {
@@ -262,8 +290,9 @@ async function fetchKeywordTable(expectVersion) {
                         const stored = await readFn(TABLE_STORAGE_KEY);
                         const parsed = stored ? JSON.parse(stored) : null;
                         if (isKeywordTable(parsed)) {
-                            kwCache = { table: parsed, at: 0 }; // at:0 → retry live on next call
-                            return parsed;
+                            const table = { version: parsed.version, prompt_keywords: sanitizePromptKeywords(parsed.prompt_keywords) };
+                            kwCache = { table, at: 0 }; // at:0 → retry live on next call
+                            return table;
                         }
                     }
                     catch { /* fall through to null */ }
@@ -277,6 +306,113 @@ async function fetchKeywordTable(expectVersion) {
     }
     return kwInflight;
 }
+/**
+ * Strip QUOTED EVIDENCE from a prompt before trigger matching.
+ *
+ * Triggers are meant to fire on a symptom the user is REPORTING, not on every
+ * string that happens to appear in material they pasted as evidence. Observed
+ * 2026-08-31: a user asked "what's going on with skill loading?" and pasted a
+ * startup log; the log listed installed skill names, and the literal token
+ * `fusa-bss-billing` inside it satisfied that skill's own trigger
+ * `\bfusa\b.{0,20}\b(billing|invoice)\b`. Two unrelated private skills loaded
+ * and were injected as binding rules for a debugging question — pasting a log
+ * that NAMES a skill should never activate it.
+ *
+ * Two removals, both conservative:
+ *   1. Fenced code blocks — pasted output, by convention.
+ *   2. Hyphenated skill-name tokens (`foo-bar-baz`). A bare skill name is
+ *      metadata about the system, not a description of work. Removing only the
+ *      NAME SPAN keeps its constituent words available: "fusa billing invoice"
+ *      typed by the user still matches, because that text is not a name token.
+ *
+ * Deliberately NOT length-capped: a long prompt is not evidence of pasting,
+ * and truncating input would silently stop matching real symptoms stated late.
+ */
+export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
+    // Fences are LINE-ANCHORED: a pasted code block starts its ``` at the
+    // beginning of a line by convention. The first version paired ANY two
+    // occurrences of the marker anywhere in the string, so two incidental
+    // inline backtick-triples bracketing real user-typed symptom text ate that
+    // text (adversarial review, confirmed with a repro). Line-anchoring means
+    // eating text now requires two line-start fences — which IS a fenced block.
+    //
+    // Replacement must sever BOTH proximity-window classes in the real table:
+    //   - `.{0,N}` windows: `.` does not cross \n (no pattern uses the s-flag),
+    //     so a newline severs them.
+    //   - `\s*`/`\s+`-glued windows (34 of 58 live patterns, e.g.
+    //     `\bui\s*test\b`): \n IS \s, so a bare newline does NOT sever them —
+    //     round-2 review reproduced `ui <stripped-name> test` routing
+    //     xcuitest-ios-watch through exactly that gap. The separator therefore
+    //     includes \x1F (unit separator): non-space (blocks \s runs), non-word
+    //     (leaves \b semantics as a space would), and severed from dot-windows
+    //     by the flanking newlines.
+    const SEVER = '\n\x1f\n';
+    let out = prompt
+        .replace(/^[ \t]*```[^\n]*\n[\s\S]*?\n[ \t]*```[ \t]*$/gm, SEVER)
+        .replace(/^[ \t]*~~~[^\n]*\n[\s\S]*?\n[ \t]*~~~[ \t]*$/gm, SEVER);
+    // Strip only the names of skills that this very table could route. A generic
+    // "identifier-shaped token" heuristic was tried first and rejected by test:
+    // it also ate ordinary hyphenated English ("end-to-end", "well-formed"),
+    // which risks silently SUPPRESSING a real symptom — a worse failure than the
+    // false positive being fixed. Using the actual routable names is exact.
+    //
+    // Deliberate consequence, not an oversight: a user who TYPES a skill's name
+    // ("update fusa-bss-billing's invoice rate") no longer trigger-routes that
+    // skill. That is acceptable because the agent reads the raw prompt and can
+    // invoke a literally-named skill directly — trigger routing exists for
+    // SYMPTOM text, where the name is absent. A pasted log naming skills must
+    // not route them; a typed name doesn't need routing to be honored.
+    const names = new Set();
+    // Non-string entries (a corrupted cache serializes undefined → null) must
+    // never reach the sort comparator below — round-2 review reproduced an
+    // uncaught TypeError from `.length` on null OUTSIDE the try/catch, killing
+    // routing for the whole prompt. Filter at collection, the only choke point.
+    for (const list of Object.values(promptKeywords)) {
+        if (!Array.isArray(list))
+            continue;
+        for (const n of list)
+            if (typeof n === "string")
+                names.add(n);
+    }
+    // Longest first, so a name that contains another is removed whole.
+    for (const name of [...names].sort((a, b) => b.length - a.length)) {
+        // Bounds mirror the routing table's own name policy (≤128 chars). An
+        // overlong or hostile name from a poisoned table must degrade to
+        // "not stripped", never to a thrown SyntaxError that kills routing for
+        // the whole prompt — the sibling _applyPromptRouting swallows bad
+        // patterns for the same reason (adversarial review, confirmed).
+        // Only IDENTIFIER-SHAPED names are stripped: at least two segments joined
+        // by - or _ (fusa-bss-billing, training-results-gate). Round-3 review
+        // proved the unconditional version was self-defeating for skills whose
+        // name is an ordinary word: stripping `sentry` from "check sentry for
+        // recent errors" killed that skill's OWN trigger (\bsentry\b) — 100% of
+        // its realistic phrasings routed nothing, same for linear/pdf/supabase.
+        // A single ordinary word cannot be distinguished from prose, so it is
+        // never stripped; the accepted residual is that a pasted skill LIST can
+        // still route single-word-named skills.
+        //
+        // Anchoring is SEGMENT-aligned, not token-aligned (round-4 review): the
+        // name must not butt directly against a letter/digit, but MAY butt
+        // against segment glue (-/_). Round 3's stricter (?<![\w-]) anchors
+        // refused to strip the name out of longer compounds — a pasted
+        // `fusa-bss-billing-worker` container name survived intact, and because
+        // \b fires at every internal hyphen, the skill's own trigger still
+        // matched inside it: the exact incident class this function exists to
+        // kill. Alignment on segment edges strips those compounds while still
+        // refusing mid-token overlaps (the name `fix-ci` never fires inside the
+        // unrelated word `prefix-ci`, whose own trigger must survive).
+        if (name.length < 3 || name.length > 128 || !/[a-z0-9]/i.test(name))
+            continue;
+        if (!/[-_]/.test(name))
+            continue;
+        try {
+            const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            out = out.replace(new RegExp(`(?<![A-Za-z0-9])${escaped}(?![A-Za-z0-9])`, 'gi'), SEVER);
+        }
+        catch { /* skip unbuildable names — same policy as the matcher */ }
+    }
+    return out;
+}
 /**
  * Verbatim port of portal resolve/route.ts prompt-matching block + the sort
  * that follows it. Parity is the whole point: any divergence silently changes
@@ -285,6 +421,11 @@ async function fetchKeywordTable(expectVersion) {
  *
  * `priority: 200 + resolved.length` reads the length AT PUSH TIME, so it
  * depends on how many skills precede it. Preserved exactly.
+ *
+ * NOTE: callers pass a prompt already run through
+ * `stripQuotedEvidenceForRouting`. The matching semantics here are untouched —
+ * only the INPUT is normalized — so the parity contract with the portal's
+ * reference implementation still holds for any given input string.
  */
 export function _applyPromptRouting(base, prompt, promptKeywords) {
     const resolved = base.map((s) => ({ ...s }));
@@ -339,11 +480,27 @@ export async function resolvePromptSkillNames(prompt, expectVersion, scopedTrigg
     const publicKeywords = kw?.prompt_keywords ?? {};
     if (!kw && !scopedTriggers)
         return [];
-    const combined = { ...publicKeywords };
+    // NULL-PROTOTYPE, not a literal (round-4 review): with a plain object, a
+    // scoped pattern whose TEXT is an inherited property name made both sides
+    // of the merge below misbehave — `combined['constructor'] ?? []` read the
+    // inherited constructor (truthy, not iterable → throw, blanking ALL
+    // routing for the turn), and `combined['__proto__'] = …` invoked the
+    // prototype setter instead of storing a pattern. A null prototype has
+    // nothing to inherit, so both operations are plain data-property access.
+    const combined = Object.assign(Object.create(null), publicKeywords);
     for (const [pattern, names] of Object.entries(scopedTriggers ?? {})) {
-        combined[pattern] = [...(combined[pattern] ?? []), ...names];
+        // A malformed skill body can hand this merge null/42/{} for a pattern —
+        // spreading that threw "names is not iterable" here, silently blanking
+        // ALL routing for the turn at both callers (round-3 review). Degrade to
+        // skip, matching the never-throw policy everywhere else in this path.
+        if (!Array.isArray(names))
+            continue;
+        const clean = names.filter((n) => typeof n === "string");
+        if (clean.length === 0)
+            continue;
+        combined[pattern] = [...(combined[pattern] ?? []), ...clean];
     }
-    return _applyPromptRouting([], prompt, combined).map((s) => s.name);
+    return _applyPromptRouting([], stripQuotedEvidenceForRouting(prompt, combined), combined).map((s) => s.name);
 }
 /**
  * Free tier resolves to an empty set portal-side, so adding prompt-matched
@@ -366,7 +523,7 @@ async function toResolvedSkillsWithPrompt(resp, prompt, isOffline) {
                         `prompt-matched skills may lag a routing deploy`);
                 }
             }
-            skills = _applyPromptRouting(skills, prompt, kw.prompt_keywords);
+            skills = _applyPromptRouting(skills, stripQuotedEvidenceForRouting(prompt, kw.prompt_keywords), kw.prompt_keywords);
         }
     }
     return {

package/dist/utils/routeOffload.js

@@ -0,0 +1,59 @@
+/**
+ * Overflow sink for routed skill text that cannot fit an inline budget.
+ *
+ * Extracted from cli.ts (the UserPromptSubmit hook path) so the BOOTSTRAP path
+ * can use the same mechanism. Before this was shared, bootstrap had no overflow
+ * at all: it clipped a routed rule at SYMPTOM_SKILL_INLINE_MAX (1,800 chars)
+ * and appended "… (rule truncated to fit the startup budget)". Every
+ * super-skill is 8-15 KB, so a symptom-routed super-skill always arrived at
+ * 12-23% of its text — while the same display told the agent to "follow them
+ * before proposing any change". An agent cannot comply with a rule it can only
+ * see a fifth of, and nothing pointed at the rest.
+ */
+import { mkdirSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** One file per over-budget routed payload, pruned after a week. */
+const RETENTION_MS = 7 * 86_400_000;
+export function routeOffloadDir() {
+    return join(homedir(), ".prism-mcp", "route-context");
+}
+/**
+ * Write `fullText` to the offload directory and return its path.
+ *
+ * Returns undefined on any failure — callers MUST degrade loudly in-band
+ * rather than assume the text was delivered. Never throws: this runs inside
+ * startup, which must not fail over an unwritable disk.
+ */
+export function writeRouteOffload(fullText, prefix = "route") {
+    try {
+        const dir = routeOffloadDir();
+        mkdirSync(dir, { recursive: true });
+        try {
+            // Bounded: this runs synchronously on the STARTUP hot path (adversarial
+            // review). A directory that has somehow accumulated thousands of files
+            // must not turn bootstrap into an O(n) stat storm — cap the work and let
+            // later calls finish the prune incrementally.
+            // Sorted so the bounded scan hits OLDEST files first (names embed a
+            // millisecond timestamp, so lexicographic ≈ chronological): a busy dir
+            // cannot starve the prune by always presenting fresh entries first.
+            const entries = readdirSync(dir).sort();
+            const PRUNE_SCAN_LIMIT = 256;
+            for (const f of entries.slice(0, PRUNE_SCAN_LIMIT)) {
+                const p = join(dir, f);
+                try {
+                    if (Date.now() - statSync(p).mtimeMs > RETENTION_MS)
+                        rmSync(p);
+                }
+                catch { /* skip unstat-able entries */ }
+            }
+        }
+        catch { /* prune failure never blocks the write */ }
+        const target = join(dir, `${prefix}-${Date.now()}-${process.pid}.md`);
+        writeFileSync(target, fullText);
+        return target;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/utils/vaultExporter.js

@@ -137,7 +137,14 @@ export function buildVaultDirectory(exportData, pkmFlavor = 'plain') {
         addFile("Visual_Memory/Index.md", visualMd);
     }
     // 4. Ledger/ and Keywords/ processing
-    const keywordMentions = {};
+    // NULL-PROTOTYPE (round-6 review): keywords are auto-extracted from the
+    // user's free-text summaries, so an ordinary word like "constructor"
+    // slugifies to an inherited Object.prototype property name. On a plain
+    // object the truthiness guard below then read the inherited function,
+    // skipped the [] init, and .push threw — and because session_export_memory
+    // wraps the whole multi-project loop in one try/catch, a single such
+    // keyword in ANY ledger entry aborted the ENTIRE vault export.
+    const keywordMentions = Object.create(null);
     // O(1) filename collision counter: key = "YYYY-MM-DD_slug", value = next suffix number
     const filenameCounters = new Map();
     if (Array.isArray(d.ledger)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.17.0",
+  "version": "20.17.2",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",