prism-mcp-server 20.17.2 → 20.18.0

package/README.md

@@ -42,6 +42,9 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
   offline last-good recovery.
 - **Hook-free startup** — MCP metadata and native instructions request Prism's
   startup context without requiring lifecycle hooks or a Prism-owned launcher.
+  Where a host offers hooks (Claude Code, Codex), `prism connect` adds two
+  small ones on top: mid-session prompt routing, and a post-compaction
+  re-injection of the protected-floor digest.
 - **Safe escalation and observability** — inference outcomes are explicit,
   reserved content remains fail-closed, and local/cloud usage is recorded for
   review.
@@ -87,14 +90,14 @@ skill for you.
 
 ```bash
 /plugin marketplace add anthropics/claude-plugins-community
-/plugin install synalux-prism@claude-community
+/plugin install prism-coder@claude-community
 ```
 
 **Codex** — this repository is itself a plugin marketplace:
 
 ```bash
 codex plugin marketplace add dcostenco/prism-coder
-codex plugin add synalux-prism@prism
+codex plugin add prism-coder@prism
 ```
 
 The plugin registers `prism-mcp` via `npx -y prism-mcp-server`. If you already
@@ -138,6 +141,69 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.18.0
+
+### The protected floor rides the bootstrap — and survives compaction
+
+- **`session_bootstrap` now inlines a digest of the protected floor** on
+  paid tiers at standard and deep depth: one inert line per rule, derived
+  from each skill's first paragraph (or its pinned `digest:`), plus its
+  section map, ~5.6K chars for the full floor. Small-context hosts such as
+  Codex were re-reading the sixteen SKILL.md files every session (median 8
+  re-reads / 36KB, worst 823 / 5.1MB in rollout logs) because the bootstrap
+  only *named* them. The digest is paid for on top of the context budget, so
+  the ledger/handoff share at every depth is byte-identical to before. Quick
+  depth stays names-only — the opt-out.
+- **A second hook re-injects the digest after compaction.** `prism connect`
+  registers the prism-route script on `SessionStart` matched to `compact`
+  (Claude Code and Codex); it runs `prism floor-digest`, which applies the
+  same tier and depth decisions as the bootstrap, and adds nothing on
+  startup/resume/clear. Hosts without hooks (Gemini, Cursor) still get the
+  digest on every bootstrap. **Codex: UNVERIFIED against a live compaction.**
+  The hook is registered and the script accepts the documented payload
+  spellings, but no Codex compaction has been observed end-to-end; on a
+  payload it does not recognise it re-injects nothing rather than something
+  wrong. If the digest comes from a generation whose skill files never
+  finished syncing, the re-injected block carries the same STALE warning the
+  bootstrap shows.
+- **Codex trust is reported honestly after a hook rewrite.** Approvals are
+  keyed by definition hash, so a rewritten `hooks.json` — this release adds
+  the SessionStart entry — voids prior trust: connect prints AWAITING TRUST
+  for both entries instead of a green ✓ for a hook Codex would silently skip,
+  and trust recorded for an older hook version is never mistaken for current.
+- **A host config that no longer parses is left alone.** If
+  `~/.claude/settings.json` or `~/.codex/hooks.json` exists but is not valid
+  JSON, connect keeps it byte-identical, registers no hook there, and says so
+  — it no longer replaces the file with a minimal hooks-only one. The npm
+  postinstall notice says the same, instead of asking you to trust a Codex
+  hook it never registered.
+- Fixed: a symptom-routed skill whose closing frontmatter fence is its last
+  line was inlined with its YAML (triggers included) as if it were the rule.
+- Fixed: a digest line that crosses into a new section keeps that section's
+  heading in front of it — whatever opened the section (an H2, a mid-document
+  H1, an empty heading, a setext underline) — so "Delegate to" / "Do NOT
+  delegate" rules cannot read with the wrong polarity once joined. A skill
+  file on disk is used only when it digests: empty, cut off inside its
+  frontmatter, or frontmatter-only files fall back to the stored copy instead
+  of rendering YAML as the rule.
+- Fixed: on Windows, a Codex hook approval is recognised even though Codex
+  stores the path with escaped backslashes.
+- The publish gate now refuses release notes that run *ahead* of the package
+  version (CHANGELOG, README, translated READMEs) — reading the newest
+  version on the heading line, so a `v20.17.3 – v20.18.0` range counts as
+  20.18.0, and surviving a typographic apostrophe or a BOM.
+
+## What's New in v20.17.3
+
+- **A plugin install can no longer enable the prompt-routing hook.** The
+  package's maintenance paths (npm postinstall, server startup) now only
+  refresh a hook that an explicit `prism connect` previously installed —
+  a prism MCP registration in host config no longer counts as consent.
+  First install of the hook happens through `prism connect` or not at all.
+- **The Claude Code plugin launcher is fully deterministic.** It runs the
+  exact pinned server version with npm lifecycle scripts disabled, and
+  the plugin now documents its security posture in `plugins/prism/README.md`.
+
 ## What's New in v20.17.2
 
 - **Pasted logs can no longer falsely activate skills.** Symptom-triggered
@@ -568,8 +634,8 @@ the host's final verification responsibility are unchanged.
 materializes entitled packages in the native `~/.agents/skills` directory
 before the command exits. Codex therefore sees the current skillset on its
 first launch instead of requiring a second restart. Prism rechecks the same
-snapshot at MCP startup, session load, and every five minutes—without host
-lifecycle hooks.
+snapshot at MCP startup, session load, and every five minutes—skill delivery
+never depends on a host lifecycle hook.
 
 On the first user turn, Prism's native skill, MCP metadata, and managed host
 instructions request one `session_bootstrap({})` call. Prism then uses the
@@ -602,7 +668,10 @@ sections from `~/CLAUDE.md`, preserves every other instruction, and installs a
 small ownership-marked native block that selects `session_bootstrap({})` on the
 first turn. User hooks, custom instruction sections, and near matches remain
 untouched; native skills and server-side reminders preserve those Prism
-features without host lifecycle hooks. Because hosts expose no native
+features without depending on host lifecycle hooks. On Claude Code and Codex
+connect additionally registers the prism-route script twice: on every prompt
+(mid-session skill routing) and on `SessionStart` matched to `compact` only
+(post-compaction protected-floor digest). Because hosts expose no native
 session-end callback, handoff at shutdown is instruction-driven rather than a
 guaranteed lifecycle event.
 

package/dist/cli.js

@@ -348,10 +348,16 @@ program
                             const { ensurePromptRouteHook } = await import('./promptRouteHostHook.js');
                             for (const r of ensurePromptRouteHook({ hosts: hookHosts, mode: 'explicit' })) {
                                 const state = r.script === 'unchanged' && r.config === 'unchanged' ? 'up to date' : 'installed';
-                                if (r.host === 'codex' && r.codexApproval === 'pending-or-unknown') {
+                                if (r.config === 'skipped-unparseable') {
+                                    // The file was left byte-identical on purpose: replacing
+                                    // it would have wiped the operator's own settings along
+                                    // with the syntax error.
+                                    console.log(`⚠ ${r.host}: ${r.configPath} is not valid JSON — prism-route hooks NOT registered; fix the file and re-run prism connect`);
+                                }
+                                else if (r.host === 'codex' && r.codexApproval === 'pending-or-unknown') {
                                     // Codex silently skips untrusted hooks — a green "installed"
                                     // here would be the "configured and inert" lie.
-                                    console.log(`⚠ codex: prism-route hook ${state}, AWAITING TRUST — run codex, then /hooks, and trust the entry ending prism-route/on_prompt.py`);
+                                    console.log(`⚠ codex: prism-route hook ${state}, AWAITING TRUST — run codex, then /hooks, and trust BOTH entries ending prism-route/on_prompt.py (UserPromptSubmit and SessionStart)`);
                                 }
                                 else if (r.host === 'codex' && r.codexApproval === 'state-present-unverifiable') {
                                     // Approvals are keyed by definition hash, whose algorithm is
@@ -362,7 +368,7 @@ program
                                     console.log(`− codex: prism-route hook ${state}; trust state exists but is not verifiable from here — confirm once in /hooks`);
                                 }
                                 else {
-                                    console.log(`✓ ${r.host}: prism-route prompt hook ${state} (${r.scriptPath})`);
+                                    console.log(`✓ ${r.host}: prism-route hooks ${state} — prompt routing + post-compaction floor (${r.scriptPath})`);
                                 }
                             }
                         }
@@ -540,6 +546,33 @@ program
         process.exit(0);
     }
 });
+// ── floor-digest ──────────────────────────────────────────────
+// Called by the same hook on SessionStart with source "compact": the host
+// just discarded the bootstrap along with the rest of the transcript, and
+// this is the protected floor coming back in one line per rule. Same
+// contract as route-prompt — exit 0, one JSON line, cached DB and the local
+// skills root only. Fires once per compaction, never per prompt.
+program
+    .command('floor-digest')
+    .description('Print the protected-floor digest as {names, text} JSON. Used by the prism-route host hook after a context compaction.')
+    .action(async () => {
+    try {
+        const { renderProtectedFloorDigestForHook } = await import('./tools/ledgerHandlers.js');
+        const result = await renderProtectedFloorDigestForHook();
+        const payload = JSON.stringify({ names: result.names, text: result.text });
+        await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
+    }
+    catch {
+        await new Promise((resolveWrite) => process.stdout.write('{"names":[],"text":""}\n', () => resolveWrite()));
+    }
+    finally {
+        try {
+            await closeStorage();
+        }
+        catch { /* exit anyway */ }
+        process.exit(0);
+    }
+});
 program
     .command('load <project>')
     .description('Load session context for a project (same output as session_load_context MCP tool)')

package/dist/postinstall.js

@@ -1,9 +1,12 @@
 /**
- * npm postinstall — the upgrade path for the prism-route hook.
- *
- * `prism connect` is only typed once per machine, so an upgrade that adds or
- * fixes the hook would otherwise reach no one until they reconnect. Silent
- * and always-exit-0: a hook installer must never break `npm install`.
+ * npm postinstall — the UPGRADE path for the prism-route hook, never the
+ * install path. `prism connect` is typed once per machine and is the only
+ * consent that first-installs the hook; this script merely refreshes hosts
+ * that carry the managed marker from that explicit install (mode "auto" is
+ * marker-gated in ensurePromptRouteHook). On any machine without the marker
+ * — including every Claude Code plugin install, where npx runs this
+ * package's lifecycle scripts — it is a no-op that writes nothing. Silent
+ * and always-exit-0: a lifecycle script must never break `npm install`.
  */
 import { ensurePromptRouteHook } from "./promptRouteHostHook.js";
 try {
@@ -20,9 +23,16 @@ try {
     // approval impossible to miss. Approval is per hook-version, not per
     // release: it recurs only when the hook script itself changes.
     const codex = results.find((r) => r.host === "codex");
-    if (codex && codex.codexApproval === "pending-or-unknown") {
+    if (codex && codex.config === "skipped-unparseable") {
+        // Nothing was registered, so there is nothing to trust: telling the
+        // operator to press t in /hooks would send them looking for an entry
+        // that does not exist. The file was left byte-identical on purpose.
+        console.error(`\n[prism] Codex ${codex.configPath} is not valid JSON — prism-route hooks NOT registered.\n` +
+            "[prism]   Fix the file, then run: prism connect --host codex\n");
+    }
+    else if (codex && codex.codexApproval === "pending-or-unknown") {
         console.error("\n[prism] Codex hook installed but NOT yet trusted — Codex silently skips it until you approve it once:\n" +
-            "[prism]   codex  ->  /hooks  ->  entry ending prism-route/on_prompt.py  ->  press t\n");
+            "[prism]   codex  ->  /hooks  ->  BOTH entries ending prism-route/on_prompt.py (UserPromptSubmit + SessionStart)  ->  press t\n");
     }
 }
 catch {