prism-mcp-server 20.17.2 → 20.18.0

package/dist/promptRouteHostHook.js

@@ -1,5 +1,6 @@
 /**
- * prism-route — self-installing UserPromptSubmit hook for Claude Code + Codex.
+ * prism-route — self-installing UserPromptSubmit + SessionStart(compact) hook
+ * for Claude Code + Codex.
  *
  * WHY A HOST HOOK. An MCP server never sees the user's prompt; the protocol
  * carries only what a tool call carries. session_route_prompt (the MCP tool)
@@ -8,6 +9,17 @@
  * prompt regardless of model behaviour, on both hosts, which is what the
  * operator requires ("i need automatic").
  *
+ * WHY A SECOND EVENT. Compaction discards the bootstrap with the rest of the
+ * transcript, and nothing the MCP server can do brings it back — the server
+ * is never told a compaction happened. Both hosts run SessionStart hooks
+ * with source "compact" before the next model request (Claude Code:
+ * matcher "compact"; Codex hooks reference, verified 2026-09-01: "SessionStart
+ * hooks that match source: compact run before the next model request"). The
+ * same script answers that event with `prism floor-digest` — the protected
+ * floor, one line per rule — so the model does not spend the rest of the
+ * session re-reading SKILL.md files it can no longer see. Once per
+ * compaction, zero per-prompt cost.
+ *
  * WHY SELF-INSTALLING. The previous generation of prism hooks was provisioned
  * by a bootstrap script once, then hand-maintained per machine — which is why
  * this machine has them and the other team machines do not. This module is
@@ -28,7 +40,11 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSy
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 /** Bump to force the on-disk script to be rewritten on the next ensure. */
-export const PROMPT_ROUTE_HOOK_VERSION = "3";
+export const PROMPT_ROUTE_HOOK_VERSION = "4";
+/** SessionStart matcher: only the post-compaction fire carries the digest.
+ *  The script re-checks `source` itself, so a host that ignores matchers on
+ *  this event still injects nothing at startup/resume. */
+const SESSION_START_MATCHER = "compact";
 const MARKER_FILE = ".prism-managed.json";
 const SCRIPT_FILE = "on_prompt.py";
 const HOOK_DIR = "prism-route";
@@ -66,6 +82,9 @@ export const PROMPT_ROUTE_HOOK_SCRIPT = `#!/usr/bin/env python3
 
 Routes every user prompt through the on-device skill matcher via
 'prism route-prompt'. Injects newly matched skill bodies as context.
+On SessionStart with source "compact" (the host just discarded the
+transcript, bootstrap included) it re-injects the protected-floor digest
+via 'prism floor-digest' instead.
 Managed by prism; edits are overwritten on version bumps.
 """
 import json
@@ -76,16 +95,106 @@ import subprocess
 import sys
 
 
-def emit(extra=None):
+def emit(extra=None, event="UserPromptSubmit"):
     out = {"continue": True, "suppressOutput": True}
     if extra:
         out["hookSpecificOutput"] = {
-            "hookEventName": "UserPromptSubmit",
+            "hookEventName": event,
             "additionalContext": extra,
         }
     print(json.dumps(out))
 
 
+def run_cli_json(cli, args, stdin_text=""):
+    """Run a prism CLI subcommand; return its last JSON stdout line or None."""
+    try:
+        result = subprocess.run(
+            [cli] + args,
+            input=stdin_text,
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+    except Exception:
+        return None
+    if result.returncode != 0:
+        return None
+    # Parse the LAST line that is JSON: wrappers hooked into node via
+    # NODE_OPTIONS (dotenv banners and the like) print to stdout BEFORE the
+    # CLI's own output, and one polluted line must not kill routing.
+    for line in reversed(result.stdout.strip().splitlines()):
+        line = line.strip()
+        if line.startswith("{"):
+            try:
+                data = json.loads(line)
+            except Exception:
+                continue
+            return data if isinstance(data, dict) else None
+    return None
+
+
+def session_state_path(payload):
+    session = str(
+        payload.get("session_id")
+        or payload.get("sessionId")
+        or payload.get("conversation_id")
+        or "default"
+    )
+    session = re.sub(r"[^A-Za-z0-9._-]", "_", session).lstrip(".")[:80] or "default"
+    state_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "state")
+    return state_dir, os.path.join(state_dir, session + ".json")
+
+
+def payload_field(payload, *keys):
+    """First non-empty string among alternative spellings of one field.
+
+    Claude Code documents snake_case keys; Codex's payloads are described as
+    Claude-compatible, not Claude-identical, which is why the prompt lookup
+    below already hedges three ways. The SessionStart detection used to read
+    exactly one spelling, so a Codex payload spelled hookEventName/trigger
+    would fall to the prompt path and pass through with no digest and no
+    signal (round-11 review).
+    """
+    for key in keys:
+        value = payload.get(key)
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    return ""
+
+
+def event_name(payload):
+    name = payload_field(payload, "hook_event_name", "hookEventName", "event_name", "eventName", "event")
+    return re.sub(r"[^a-z]", "", name.lower())
+
+
+def on_session_start(payload):
+    # Only the post-compaction fire: at startup/resume the bootstrap carries
+    # the digest itself, and a second copy would be pure cost. "compact",
+    # "compaction", "compacted" all mean the transcript was just discarded.
+    source = payload_field(payload, "source", "trigger", "reason").lower()
+    if not source.startswith("compact"):
+        emit(event="SessionStart")
+        return
+    # The skills injected before compaction are gone with it; forget the
+    # dedupe list so the next matching prompt can bring them back.
+    state_dir, state_path = session_state_path(payload)
+    try:
+        os.remove(state_path)
+    except Exception:
+        pass
+    cli = find_cli()
+    if not cli:
+        emit(event="SessionStart")
+        return
+    data = run_cli_json(cli, ["floor-digest"])
+    text = (data or {}).get("text") or ""
+    names = [n for n in ((data or {}).get("names") or []) if isinstance(n, str)]
+    if not names or not isinstance(text, str) or not text:
+        emit(event="SessionStart")
+        return
+    emit(text, event="SessionStart")
+
+
 def find_cli():
     override = os.environ.get("PRISM_ROUTE_CLI")
     if override and os.path.exists(override):
@@ -111,6 +220,12 @@ def main():
         payload = json.loads(raw) if raw.strip() else {}
     except Exception:
         payload = {}
+    if not isinstance(payload, dict):
+        payload = {}
+
+    if event_name(payload) == "sessionstart":
+        on_session_start(payload)
+        return
 
     prompt = str(
         payload.get("prompt")
@@ -127,16 +242,7 @@ def main():
     # stretch, and the CLI caps identically on its side.
     prompt = prompt[:100_000]
 
-    session = str(
-        payload.get("session_id")
-        or payload.get("sessionId")
-        or payload.get("conversation_id")
-        or "default"
-    )
-    session = re.sub(r"[^A-Za-z0-9._-]", "_", session).lstrip(".")[:80] or "default"
-
-    state_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "state")
-    state_path = os.path.join(state_dir, session + ".json")
+    state_dir, state_path = session_state_path(payload)
     loaded = []
     try:
         with open(state_path) as fh:
@@ -151,34 +257,8 @@ def main():
         emit()
         return
 
-    try:
-        result = subprocess.run(
-            [cli, "route-prompt", "--loaded", ",".join(loaded)],
-            input=prompt,
-            capture_output=True,
-            text=True,
-            timeout=10,
-        )
-    except Exception:
-        emit()
-        return
-    if result.returncode != 0:
-        emit()
-        return
-
-    # Parse the LAST line that is JSON: wrappers hooked into node via
-    # NODE_OPTIONS (dotenv banners and the like) print to stdout BEFORE the
-    # CLI's own output, and one polluted line must not kill routing.
-    data = None
-    for line in reversed(result.stdout.strip().splitlines()):
-        line = line.strip()
-        if line.startswith("{"):
-            try:
-                data = json.loads(line)
-                break
-            except Exception:
-                continue
-    if not isinstance(data, dict):
+    data = run_cli_json(cli, ["route-prompt", "--loaded", ",".join(loaded)], prompt)
+    if data is None:
         emit()
         return
     names = [n for n in (data.get("names") or []) if isinstance(n, str)]
@@ -205,21 +285,10 @@ if __name__ == "__main__":
         print(json.dumps({"continue": True, "suppressOutput": True}))
         sys.exit(0)
 `;
-/** Evidence that this host was already prism-integrated by explicit action. */
-function hostShowsPriorConsent(spec, homeDir) {
-    if (existsSync(join(spec.root, "hooks", HOOK_DIR, MARKER_FILE)))
-        return true;
-    const evidenceFiles = spec.host === "claude"
-        ? [join(homeDir, ".claude.json"), spec.configPath]
-        : [join(spec.root, "config.toml"), spec.configPath];
-    for (const file of evidenceFiles) {
-        try {
-            if (/prism/i.test(readFileSync(file, "utf8")))
-                return true;
-        }
-        catch { /* unreadable = no evidence */ }
-    }
-    return false;
+/** A prior EXPLICIT install left our managed marker; only that authorizes
+ *  the auto paths to touch this host again (refresh/upgrade). */
+function hostHasManagedHook(spec) {
+    return existsSync(join(spec.root, "hooks", HOOK_DIR, MARKER_FILE));
 }
 function hostSpecs(homeDir, env) {
     const codexHome = env.CODEX_HOME?.trim() ? resolve(env.CODEX_HOME.trim()) : join(homeDir, ".codex");
@@ -232,22 +301,37 @@ function hostSpecs(homeDir, env) {
 /**
  * Coarse Codex approval detection. Codex persists hook approvals as a
  * [hooks.state] table in config.toml keyed by definition hash; the hashing
- * algorithm is not public, so the only honest signals are "a state section
- * exists and mentions our hook path" (detected) or anything else
- * (pending-or-unknown). Never treat unknown as approved.
+ * algorithm is not public, so the only honest signal is the state section
+ * naming the EXACT command we register — `… --v<version>` — once per event
+ * (two hooks, two approvals). The version-agnostic path alone is not
+ * evidence: a v3 approval names the same script, and Codex will skip the
+ * v4 definition it never saw. Matching the bare path let a stale approval
+ * read as "detected" from the second `prism connect` after every hook
+ * bump (round-8 review). Never treat unknown as approved.
  */
-function detectCodexApproval(codexRoot) {
+function detectCodexApproval(codexRoot, wantedCommand) {
     try {
-        const toml = readFileSync(join(codexRoot, "config.toml"), "utf8");
-        const hasState = /\[hooks\.state/.test(toml);
-        if (hasState && toml.includes(COMMAND_SIGNATURE))
+        // A Windows path lands in a TOML basic string with its backslashes
+        // ESCAPED (`C:\\Users\\…`); one-for-one replacement turned that into
+        // `C://Users//…` and the approval never matched (round-10 review). A
+        // run of backslashes is one separator.
+        const toml = readFileSync(join(codexRoot, "config.toml"), "utf8").replace(/\\+/g, "/");
+        if (!/\[hooks\.state/.test(toml))
+            return "pending-or-unknown";
+        const wanted = wantedCommand.replace(/\\+/g, "/");
+        const exact = toml.split(wanted).length - 1;
+        if (exact >= 2)
             return "detected";
-        // Approvals are keyed by definition hash (algorithm not public). Once ANY
-        // trust state exists we cannot distinguish ours from here — and claiming
-        // AWAITING TRUST after the operator pressed t would be a false alarm
-        // against their own action. Distinct state, distinct wording.
-        if (hasState)
-            return "state-present-unverifiable";
+        // Our script is named, but not under the current definition: positive
+        // evidence that the trust on file is for an OLDER hook version, which
+        // Codex will not honour for this one.
+        if (exact === 0 && toml.includes(COMMAND_SIGNATURE))
+            return "pending-or-unknown";
+        // Trust state exists (one of our two entries, or hash-only entries that
+        // never name a command) and we cannot distinguish ours from here.
+        // Claiming AWAITING TRUST after the operator pressed t would be a false
+        // alarm against their own action. Distinct state, distinct wording.
+        return "state-present-unverifiable";
     }
     catch { /* unreadable = no evidence */ }
     return "pending-or-unknown";
@@ -299,60 +383,78 @@ function ensureRegistered(configPath, scriptPath, host) {
     // alone, not stripped).
     const wantsLimit = host === "codex";
     let config = {};
-    let originalText;
-    try {
-        originalText = readFileSync(configPath, "utf8");
-        const parsed = JSON.parse(originalText);
-        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    if (existsSync(configPath)) {
+        // An existing file we cannot parse is the operator's file with a syntax
+        // slip in it (model, env, permissions…) — "replace with {hooks}" would
+        // be a silent wipe. Register nothing; the caller reports it.
+        try {
+            const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return "skipped-unparseable";
             config = parsed;
         }
-    }
-    catch {
-        /* missing or unreadable — create minimal */
+        catch {
+            return "skipped-unparseable";
+        }
     }
     const hooks = (config.hooks && typeof config.hooks === "object" && !Array.isArray(config.hooks)
         ? config.hooks
         : {});
-    const entries = Array.isArray(hooks.UserPromptSubmit) ? hooks.UserPromptSubmit : [];
     const wanted = hookCommand(scriptPath);
-    let stale = false;
-    for (const entry of entries) {
-        if (!entry || typeof entry !== "object")
-            continue;
-        const inner = entry.hooks;
-        if (!Array.isArray(inner))
-            continue;
-        for (const h of inner) {
-            if (!h || typeof h !== "object")
+    let updated = false;
+    let registered = false;
+    // One script, two events. Each event is converged independently so a
+    // machine registered under an older release (UserPromptSubmit only) gains
+    // the SessionStart entry on refresh, and a hand-removed entry is not
+    // resurrected by the other event still being current — the disabled marker
+    // is the opt-out for both.
+    const converge = (event, matcher) => {
+        const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
+        let found = false;
+        for (const entry of entries) {
+            if (!entry || typeof entry !== "object")
                 continue;
-            // Normalize separators: on Windows join() registers a backslash path,
-            // and a forward-slash signature would never match — so every ensure
-            // would re-register a duplicate entry.
-            const command = String(h.command ?? "");
-            if (!command.replace(/\\/g, "/").includes(COMMAND_SIGNATURE))
+            const inner = entry.hooks;
+            if (!Array.isArray(inner))
                 continue;
-            const limitCurrent = !wantsLimit || h.additionalContextLimit === 0;
-            if (command === wanted && limitCurrent)
-                return "unchanged";
-            // Same hook, older definition: UPDATE it in place. This is what makes a
-            // refresh visible to Codex's definition-hash — and on Claude it is a
-            // harmless argv change.
-            h.command = wanted;
-            if (wantsLimit)
-                h.additionalContextLimit = 0;
-            stale = true;
+            for (const h of inner) {
+                if (!h || typeof h !== "object")
+                    continue;
+                // Normalize separators: on Windows join() registers a backslash path,
+                // and a forward-slash signature would never match — so every ensure
+                // would re-register a duplicate entry.
+                const command = String(h.command ?? "");
+                if (!command.replace(/\\/g, "/").includes(COMMAND_SIGNATURE))
+                    continue;
+                found = true;
+                const limitCurrent = !wantsLimit || h.additionalContextLimit === 0;
+                if (command === wanted && limitCurrent)
+                    continue;
+                // Same hook, older definition: UPDATE it in place. This is what makes a
+                // refresh visible to Codex's definition-hash — and on Claude it is a
+                // harmless argv change.
+                h.command = wanted;
+                if (wantsLimit)
+                    h.additionalContextLimit = 0;
+                updated = true;
+            }
         }
-    }
-    if (!stale) {
-        entries.push({
-            matcher: "*",
-            hooks: [{ type: "command", command: wanted, timeout: 15, ...(wantsLimit ? { additionalContextLimit: 0 } : {}) }],
-        });
-    }
-    hooks.UserPromptSubmit = entries;
+        if (!found) {
+            entries.push({
+                matcher,
+                hooks: [{ type: "command", command: wanted, timeout: 15, ...(wantsLimit ? { additionalContextLimit: 0 } : {}) }],
+            });
+            registered = true;
+        }
+        hooks[event] = entries;
+    };
+    converge("UserPromptSubmit", "*");
+    converge("SessionStart", SESSION_START_MATCHER);
+    if (!updated && !registered)
+        return "unchanged";
     config.hooks = hooks;
     writeAtomically(configPath, `${JSON.stringify(config, null, 2)}\n`);
-    return stale ? "updated" : "registered";
+    return registered ? "registered" : "updated";
 }
 /**
  * Idempotently install the prism-route hook for both hosts.
@@ -369,7 +471,7 @@ export function ensurePromptRouteHook(options = {}) {
             continue;
         if (onlyExisting && !existsSync(spec.root))
             continue;
-        if ((options.mode ?? "explicit") === "auto" && !hostShowsPriorConsent(spec, homeDir))
+        if ((options.mode ?? "explicit") === "auto" && !hostHasManagedHook(spec))
             continue;
         try {
             const hookDir = join(spec.root, "hooks", HOOK_DIR);
@@ -382,7 +484,14 @@ export function ensurePromptRouteHook(options = {}) {
                 // Never report a green "registered" as if it were active: Codex
                 // SILENTLY SKIPS untrusted hooks, and "installed but inert" is the
                 // exact failure class this feature exists to end.
-                result.codexApproval = detectCodexApproval(spec.root);
+                //
+                // Approvals are keyed by definition hash, so a hooks.json we just
+                // rewrote (new entry, changed command) carries definitions the
+                // operator has never trusted — whatever config.toml says about the
+                // OLD ones. Only an untouched config can inherit prior trust.
+                result.codexApproval = config === "unchanged"
+                    ? detectCodexApproval(spec.root, hookCommand(result.scriptPath))
+                    : "pending-or-unknown";
             }
             results.push(result);
         }

package/dist/server.js

@@ -265,9 +265,11 @@ let storageIsReady = false;
 // native host complies with the hook-free first-turn instruction.
 let contextLoadedByClient = false;
 // ─── prism-route hook self-heal ──────────────────────────────
-// The safety net of the three install paths (connect, postinstall, here):
-// covers installs that skipped npm scripts and machines that never re-ran
-// connect. Idempotent and version-marked, so the steady-state cost is two
+// REFRESH-ONLY safety net: repairs/upgrades a hook that a prior EXPLICIT
+// `prism connect` installed (managed marker present). It never performs a
+// first install — a machine that merely installed this package (or the
+// Claude Code plugin, which registers prism-mcp in host config) is not
+// touched. Idempotent and version-marked, so the steady-state cost is two
 // stat calls a few seconds after boot. Opt out: PRISM_DISABLE_HOOK_AUTOINSTALL=1.
 // Guarded against test runners: five suites import this module, and a
 // module-scope timer would otherwise rewrite the DEVELOPER'S real host