prism-mcp-server 20.17.2 → 20.18.0

package/dist/tools/ledgerHandlers.js

@@ -32,6 +32,7 @@ import { getLLMProvider } from "../utils/llm/factory.js";
 import { getCurrentGitState, getGitDrift } from "../utils/git.js";
 import { getSetting, setSetting, getAllSettings, refreshConfigStorageCache } from "../storage/configStorage.js";
 import { MATERIALIZED_GENERATION_KEY } from "../skillManifestSync.js";
+import { renderFloorDigestBlock, skillDigestFromSource, splitSkillFrontmatter } from "../utils/skillDigest.js";
 import { mergeHandoff, dbToHandoffSchema, sanitizeForMerge } from "../utils/crdtMerge.js";
 import { resolveProject } from "../utils/projectResolver.js";
 import { getUpdateNotice } from "../updateNotice.js";
@@ -196,15 +197,10 @@ function effectiveNativeBudget(level, requestedMaxChars) {
  * both "no body" and "frontmatter only".
  */
 function stripSkillFrontmatter(raw) {
-    const text = (raw ?? "").trim();
-    if (!text.startsWith("---"))
-        return text;
-    // Closing fence must be its own line; a body line of "---" mid-document is
-    // not a terminator, so anchor on the newline pair.
-    const end = text.indexOf("\n---", 3);
-    if (end === -1)
-        return text; // unterminated frontmatter — inline as-is
-    return text.slice(text.indexOf("\n", end + 1) + 1).trim();
+    // One fence parser for every inline path. The local copy this replaced
+    // returned the WHOLE document — frontmatter included — for a file whose
+    // closing fence is its last line (no newline after it, indexOf → -1).
+    return splitSkillFrontmatter(raw).body;
 }
 /**
  * Room reserved for the trailing <prism_session /> facts line so it never
@@ -215,11 +211,32 @@ function stripSkillFrontmatter(raw) {
  * skill block this whole fix exists to deliver.
  */
 const SESSION_FACTS_RESERVE = 256;
+/**
+ * Project/session-context budget per depth. This also bounds the standalone
+ * session_load_context / `prism load` output, which render no System Ready
+ * block — so the floor digest is NOT folded in here: the bootstrap adds the
+ * digest's own length on top (see startupMaxChars), and the context share at
+ * every depth stays exactly what it was before the digest existed.
+ */
 const NATIVE_STARTUP_MAX_CHARS = {
     quick: 4_000,
     standard: 8_000,
     deep: 30_000,
 };
+/**
+ * Protected-floor digest allowance per depth (chars), paid on top of the
+ * context budget above. The bootstrap names the floor; the digest carries
+ * one line of each rule so the model knows what is in force without
+ * re-reading SKILL.md — measured 2026-09-01 on Codex rollout logs: median 8
+ * re-reads / 36KB per session, 823 / 5.1MB in the worst. quick stays
+ * names-only: sixteen useful lines are ~5.6K, more than the whole quick
+ * budget, and a partial digest would make the omitted rules look absent.
+ */
+const NATIVE_FLOOR_DIGEST_MAX_CHARS = {
+    quick: 0,
+    standard: 6_000,
+    deep: 6_000,
+};
 const NATIVE_CONTEXT_LIMITS = {
     quick: {
         warnings: [2, 200],
@@ -276,6 +293,10 @@ function parseNativeSkillNames(value) {
         return [];
     }
 }
+/** The dashboard's default_context_depth, validated; anything else is standard. */
+function nativeDepthFromSetting(value) {
+    return ["quick", "standard", "deep"].includes(value) ? value : "standard";
+}
 async function resolveNativeSkillManifestSnapshot(syncResult) {
     const { FREE_NATIVE_SKILL_NAMES, REQUIRED_NATIVE_SKILL_NAMES } = await import("./skillRouting.js");
     const [storedNamesValue, storedTierValue, committedGeneration, materializedGeneration] = await Promise.all([
@@ -368,10 +389,102 @@ function escapeNativeMarkdown(value) {
 function sanitizeNativeIdentity(value) {
     return value.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").replace(/\s+/g, " ").trim();
 }
+/**
+ * The protected floor's rules, one line each, for the names in `names`.
+ * Bodies come from the canonical skills root — what the host itself reads —
+ * with the manifest DB as fallback for a body committed but not yet on disk
+ * (validated-partial). Returns null when the budget cannot carry every name.
+ *
+ * Shared by the bootstrap block and the `prism floor-digest` CLI so a rule
+ * digested one way at startup is never digested another way after a
+ * compaction.
+ */
+async function buildProtectedFloorDigest(names, options) {
+    if (names.length === 0 || options.maxChars <= 0)
+        return null;
+    const { readNativeSkillBody, resolveCanonicalSkillsDir } = await import("../skillManifestSync.js");
+    const entries = await Promise.all(names.map(async (name) => {
+        // The file on disk wins only when it digests. A truncated
+        // materialization — zero bytes, whitespace, a header cut off before its
+        // closing fence, a fenced header with no body — is not a body, and the
+        // DB copy the fallback exists for must win over it; before, any
+        // non-empty file shadowed the committed rule, and one cut mid-header
+        // rendered its YAML as the rule in force.
+        const onDisk = await readNativeSkillBody(name);
+        const source = skillDigestFromSource(onDisk) !== null
+            ? onDisk
+            : (await getSetting(`skill:${name}`, "")) || onDisk || "";
+        return { name, source };
+    }));
+    return renderFloorDigestBlock(entries, {
+        maxChars: options.maxChars,
+        linePrefix: options.linePrefix,
+        skillsRoot: resolveCanonicalSkillsDir(),
+    });
+}
+/**
+ * Protected floor ∩ entitled manifest, in floor order — the set the digest
+ * covers. prism-startup (free-tier chrome whose whole body is "call
+ * session_bootstrap") never gets a digest line because it is not on
+ * REQUIRED_PROTECTED_SKILL_NAMES at all — tests/skill-routing.test.ts pins
+ * the free and protected lists disjoint. An earlier `!free.has(name)` filter
+ * here re-stated that in code no input could ever exercise (round-11 review).
+ */
+async function entitledProtectedFloorNames(provisionedNames) {
+    const { REQUIRED_PROTECTED_SKILL_NAMES } = await import("./skillRouting.js");
+    const provisioned = new Set(provisionedNames);
+    return REQUIRED_PROTECTED_SKILL_NAMES.filter((name) => provisioned.has(name));
+}
+/**
+ * The post-compaction payload for the prism-route host hook (SessionStart
+ * with source "compact"): the same digest the bootstrap rendered, without
+ * the blockquote chrome, from the last-synced manifest — cache only, never a
+ * portal round-trip, exactly like route-prompt.
+ *
+ * Same entitlement and depth decisions as the bootstrap, through the same
+ * code: the manifest snapshot re-filters the committed names by the stored
+ * tier (a free-tier DB can hold paid names — the resolver never trusts the
+ * list alone), and quick depth is names-only here too. Round-7 review found
+ * this path reading the raw names: bootstrap said "free, 1 skill" while the
+ * hook injected sixteen paid rules from the same database.
+ */
+export async function renderProtectedFloorDigestForHook() {
+    // No sync on this path — "unchanged" is what the committed state is.
+    const snapshot = await resolveNativeSkillManifestSnapshot({
+        status: "unchanged", installed: [], updated: [], pruned: [], conflicts: [],
+    });
+    const depth = nativeDepthFromSetting(await getSetting("default_context_depth", "standard"));
+    const names = await entitledProtectedFloorNames(snapshot.names);
+    const block = await buildProtectedFloorDigest(names, {
+        maxChars: NATIVE_FLOOR_DIGEST_MAX_CHARS[depth],
+        linePrefix: "",
+    });
+    if (!block)
+        return { names: [], text: "" };
+    // Post-compaction is exactly when the bootstrap's STALE line is no longer
+    // on screen, so a digest rendered from a generation that never reached the
+    // skill roots must say so itself (round-11 review; the bootstrap copy of
+    // this warning is undeliveredWarning below).
+    const staleLine = snapshot.undeliveredGeneration
+        ? `⚠️ Skill files are STALE: the entitlement DB is at generation ` +
+            `\`${snapshot.undeliveredGeneration.slice(0, 12)}…\` but its files never finished reaching ` +
+            `the skill roots, so this digest may be older than the rules in force. Run a sync ` +
+            `(restart the host or \`prism connect\`).\n`
+        : "";
+    return {
+        names,
+        text: `Prism: context was compacted. The protected floor below is still in force for the rest of this session.\n${staleLine}${block}`,
+    };
+}
 async function buildNativeSystemReadyBlock(snapshot, depth) {
     const { REQUIRED_NATIVE_SKILL_NAMES } = await import("./skillRouting.js");
     const provisioned = new Set(snapshot.names);
     const coreSkills = REQUIRED_NATIVE_SKILL_NAMES.filter((name) => provisioned.has(name));
+    // Directly under the names line, inside the blockquote: the digest is part
+    // of the same fact ("these rules are in force"), and the head of this block
+    // is what capped depths keep.
+    const floorDigest = await buildProtectedFloorDigest(await entitledProtectedFloorNames(snapshot.names), { maxChars: NATIVE_FLOOR_DIGEST_MAX_CHARS[depth], linePrefix: "> " });
+    const floorDigestLines = floorDigest ? `${floorDigest}\n` : "";
     const coreSkillSet = new Set(REQUIRED_NATIVE_SKILL_NAMES);
     const superSkills = snapshot.names.filter((name) => name.endsWith("-super-skill"));
     const superSkillAliases = superSkills.map((name) => `${name.slice(0, -"-super-skill".length)} (${name})`);
@@ -407,37 +520,41 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
             `reaching the skill roots. Agents are reading older skills. Run a sync ` +
             `(restart the host or \`prism connect\`) and report this if it persists.`
         : "";
+    const wrap = (text) => ({ text, floorDigestChars: floorDigestLines.length });
     if (snapshot.source === "validated-partial") {
-        return `> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
+        return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
             `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
             `> - 📦 **Entitled skills (materialization incomplete):** ${snapshot.names.length}\n` +
             `> - 📚 **Core/protected entitlements:** ${formatBoundedSkillNames(coreSkills, "entitled")}\n` +
+            floorDigestLines +
             `> - 🧩 **Super-skill entitlements:** ${formatBoundedSkillNames(superSkillAliases, "entitled")}\n` +
             `> - 🛠️ **Other tier entitlements:** ${formatBoundedSkillNames(otherTierSkills, "entitled")}\n` +
             `> - 🧠 **Context depth:** ${depth}\n` +
             `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · native materialization incomplete${conflictSuffix}` +
             conflictWarning +
-            freeTierUpgradeLine(snapshot.tier);
+            freeTierUpgradeLine(snapshot.tier));
     }
     if (snapshot.source === "tier-fallback") {
-        return `> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
+        return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
             `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
             `> - 🛡️ **Fallback skill names:** ${formatBoundedSkillNames(snapshot.names, "fallback")}\n` +
+            floorDigestLines +
             `> - 🧠 **Context depth:** ${depth}\n` +
             `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · no committed manifest${conflictSuffix}` +
             conflictWarning +
-            freeTierUpgradeLine(snapshot.tier);
+            freeTierUpgradeLine(snapshot.tier));
     }
-    return `> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
+    return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
         `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
         `> - 📦 **Provisioned skills:** ${snapshot.names.length}\n` +
         `> - 📚 **Core/protected skills provisioned:** ${formatBoundedSkillNames(coreSkills, "provisioned")}\n` +
+        floorDigestLines +
         `> - 🧩 **Super-skills provisioned:** ${formatBoundedSkillNames(superSkillAliases, "provisioned")}\n` +
         `> - 🛠️ **Other tier skills provisioned:** ${formatBoundedSkillNames(otherTierSkills, "provisioned")}\n` +
         `> - 🧠 **Context depth:** ${depth}\n` +
         `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · committed manifest${conflictSuffix}` +
         conflictWarning +
-        freeTierUpgradeLine(snapshot.tier);
+        freeTierUpgradeLine(snapshot.tier));
 }
 /**
  * The paid funnel's one startup line. Before 2026-08-05 the upgrade_url was
@@ -500,8 +617,12 @@ export function sliceCodepointSafe(text, end) {
     const last = cut.charCodeAt(cut.length - 1);
     return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
 }
-export function capNativeStartupText(text, level, requestedMaxChars, suffix = "") {
-    const maxChars = effectiveNativeBudget(level, requestedMaxChars);
+export function capNativeStartupText(text, level, requestedMaxChars, suffix = "", additiveChars = 0) {
+    // additiveChars rides on top of the depth budget: the protected-floor
+    // digest is paid for by its own allowance (NATIVE_FLOOR_DIGEST_MAX_CHARS)
+    // on every bootstrap path, so it never displaces the session or the
+    // System Ready tail — the projects path adds it the same way.
+    const maxChars = effectiveNativeBudget(level, requestedMaxChars) + Math.max(0, additiveChars);
     if (text.length + suffix.length <= maxChars)
         return text + suffix;
     const marker = `\n\n… Additional ${level} context omitted to keep native startup within its display budget.`;
@@ -2088,9 +2209,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         getSetting("agent_name", ""),
         getSetting("default_role", ""),
     ]);
-    const depth = ["quick", "standard", "deep"].includes(configuredDepth)
-        ? configuredDepth
-        : "standard";
+    const depth = nativeDepthFromSetting(configuredDepth);
     const projects = [...new Set(configuredProjects.split(",").map((project) => project.trim()).filter(Boolean))];
     const configuredGreetingName = sanitizeNativeIdentity(agentName);
     const greetingName = configuredGreetingName
@@ -2098,7 +2217,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         : "developer";
     const role = sanitizeNativeIdentity(defaultRole) || "global";
     const manifestSnapshot = await resolveNativeSkillManifestSnapshot(skillSyncResult);
-    const systemReadyBlock = await buildNativeSystemReadyBlock(manifestSnapshot, depth);
+    const { text: systemReadyBlock, floorDigestChars } = await buildNativeSystemReadyBlock(manifestSnapshot, depth);
     // First run = the dashboard has never been touched: no agent identity AND no
     // projects. Measured 2026-08-05: a brand-new free-tier install was greeted
     // with "Welcome back", three "Not loaded" rows, a warning, and three
@@ -2159,7 +2278,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
             return {
                 content: [{
                         type: "text",
-                        text: capNativeStartupText(firstRunText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth, first_run: true })}`),
+                        text: capNativeStartupText(firstRunText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth, first_run: true })}`, floorDigestChars),
                     }],
                 isError: false,
             };
@@ -2172,12 +2291,16 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         return {
             content: [{
                     type: "text",
-                    text: capNativeStartupText(noProjectsText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth })}`),
+                    text: capNativeStartupText(noProjectsText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth })}`, floorDigestChars),
                 }],
             isError: false,
         };
     }
-    const startupMaxChars = NATIVE_STARTUP_MAX_CHARS[depth];
+    // The digest is additive: the project/session share is computed against
+    // the same budget it had before the digest existed, at every depth. Round-7
+    // review measured deep losing 5,630 chars of ledger/handoff per bootstrap
+    // when only standard had been raised to cover it.
+    const startupMaxChars = NATIVE_STARTUP_MAX_CHARS[depth] + floorDigestChars;
     let renderedProjectCount = projects.length;
     let omittedProjectsText = "";
     let perProjectMaxChars = 0;

package/dist/utils/skillBudget.js

@@ -38,8 +38,13 @@ function render(e) {
  * skills inline even when the budget is already blown (assembleSkillBlock), and
  * the repo-measured v26 floor is ~39k chars on its own — so the ceiling here is
  * roughly 87k - 39k - memory. `standard` matches the 8,400-char tranche the
- * existing v26 shape test already treats as the standard budget (60% of 14k
- * tokens); `deep` doubles it and still leaves headroom for deep history.
+ * existing v26 shape test already treats as the standard budget — the 60%
+ * share of a 4k-token response at 3.5 chars/token, i.e. exactly
+ * `resolveSkillBudgetChars(4_000)` below (~2,400 tokens, NOT 8,400: an
+ * earlier version of this comment called it "60% of 14k tokens", which is
+ * the same arithmetic in tokens instead of chars — 14k tokens would be a
+ * 29,400-char tranche); `deep` doubles it and still leaves headroom for
+ * deep history.
  *
  * `quick` is deliberately near-nothing — it is the setting a caller picks to
  * minimize context, and before this it still inlined the full skill payload,

package/dist/utils/skillDigest.js

@@ -0,0 +1,363 @@
+/**
+ * Protected-floor digest — the context-augmented half of skill delivery.
+ *
+ * The native bootstrap NAMES the protected floor and never carries its rules
+ * (bodies live on disk under the skills root). Measured 2026-09-01 across
+ * Codex rollout logs: the model re-reads SKILL.md files to recover them —
+ * median 8 reads / 36KB per session, 823 reads / 5.1MB across 498
+ * compactions in the worst — each a tool round trip on a host whose
+ * per-result cap is 10K tokens. On Gemini and Cursor there is no prompt hook
+ * at all, so the bootstrap is the only prism channel they ever get.
+ *
+ * A digest is not the rule. It is enough of the rule that the model knows
+ * what is in force and where the full text lives, in ~350 chars instead of
+ * ~3,000. Authors pin the wording with a `digest:` frontmatter key; without
+ * one it is derived from the body — the leading substantive paragraphs,
+ * each new section's heading kept in front of its first unit, then the
+ * section headings as a map — so it works on every skill that exists today
+ * with no pipeline change.
+ *
+ * Pure functions, no I/O: the bootstrap and the `prism floor-digest` CLI
+ * (post-compaction re-injection via the host hook) render through the same
+ * code so the two channels cannot drift.
+ */
+/** Per-skill ceiling. 16 floor skills × 360 ≈ 5.8K chars — under the 6K
+ *  block budget and far under Claude Code's 10K-char hook context cap. */
+export const SKILL_DIGEST_MAX_CHARS = 360;
+/** Below this a digest is a name with punctuation; render names only. */
+export const SKILL_DIGEST_MIN_CHARS = 80;
+/** Ceiling on the raw source a digest is derived from. Real floor bodies are
+ *  1.3–5.2K chars and the digest only ever uses the head; unbounded input is
+ *  regex food (a 128KB body measured 27s of bootstrap CPU before this cap). */
+export const SKILL_DIGEST_SOURCE_MAX_CHARS = 64_000;
+/**
+ * Split a SKILL.md into its frontmatter text and body — the one fence parser
+ * for every inline path (the bootstrap's symptom-skill inlining strips
+ * through this too). The closing fence must open a line, so a body line of
+ * "---" is not a terminator.
+ */
+export function splitSkillFrontmatter(raw) {
+    const text = (raw ?? "").trim();
+    if (!text.startsWith("---"))
+        return { frontmatter: "", body: text };
+    const end = text.indexOf("\n---", 3);
+    if (end === -1)
+        return { frontmatter: "", body: text };
+    const frontmatter = text.slice(3, end).trim();
+    // A closing fence on the last line has no newline after it: the body is
+    // empty, not the whole document.
+    const bodyStart = text.indexOf("\n", end + 1);
+    const body = bodyStart === -1 ? "" : text.slice(bodyStart + 1).trim();
+    return { frontmatter, body };
+}
+/**
+ * The author-pinned digest, when present. Supports the YAML shapes a skill
+ * author will actually type: `digest: text`, `digest: "quoted"`,
+ * `digest: 'quoted'`, and the block scalars `digest: >` / `digest: |` with
+ * indented continuation lines. Anything else (nested maps, anchors) is
+ * ignored rather than misread — the derived digest takes over.
+ */
+export function readFrontmatterDigest(frontmatter) {
+    const lines = frontmatter.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^digest:\s*(.*)$/.exec(lines[i]);
+        if (!m)
+            continue;
+        const inline = m[1].trim();
+        if (inline === ">" || inline === "|" || inline === ">-" || inline === "|-") {
+            const parts = [];
+            for (let j = i + 1; j < lines.length; j++) {
+                const line = lines[j];
+                if (line.trim() === "") {
+                    if (parts.length)
+                        parts.push("");
+                    continue;
+                }
+                if (!/^\s/.test(line))
+                    break; // dedented = next key
+                parts.push(line.trim());
+            }
+            const joined = parts.join(" ").replace(/\s+/g, " ").trim();
+            return joined || null;
+        }
+        let value = inline;
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        value = value.replace(/\s+/g, " ").trim();
+        return value || null;
+    }
+    return null;
+}
+/** slice() that never ends on a lone high surrogate. */
+function sliceCodepointSafe(text, end) {
+    const cut = text.slice(0, Math.max(0, end));
+    const last = cut.charCodeAt(cut.length - 1);
+    return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
+}
+function truncate(text, maxChars) {
+    if (text.length <= maxChars)
+        return text;
+    if (maxChars <= 1)
+        return "";
+    return sliceCodepointSafe(text, maxChars - 1).trimEnd() + "…";
+}
+/**
+ * One inert display line. Markdown emphasis is dropped (it renders as noise
+ * inside a list item), wiki-links keep their target name, and EVERY angle
+ * bracket becomes a guillemet — a host's markdown/HTML renderer eats `<x>`
+ * as an unknown tag (observed: a placeholder rendered as
+ * knowledge_search("")), and this text is model context: a body could
+ * otherwise carry a forged `<prism_session … />` line, which the server
+ * instructions tell the model to reuse. Brackets are replaced one by one,
+ * not as matched spans: a span rule let a tag split across two paragraphs,
+ * list items, or headings re-form when the assembler joined them (a
+ * verifier's repro), and CommonMark lets an inline tag span one line ending,
+ * so even two adjacent block lines could re-form one. With no `<` or `>` in
+ * any unit there is nothing to re-form; "› 60 min" still reads. The
+ * wiki-link class excludes `[` so a run of unclosed brackets cannot go
+ * quadratic.
+ */
+function inertLine(text) {
+    return text
+        .replace(/\[\[([^\[\]]+)\]\]/g, "$1")
+        .replace(/\*\*|__/g, "")
+        .replace(/(^|\s)[*_](\S[^*_]*\S)[*_](?=\s|[.,;:!?]|$)/g, "$1$2")
+        .replace(/</g, "‹")
+        .replace(/>/g, "›")
+        .replace(/[\u200b-\u200d\ufeff]/g, "")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+const HEADING = /^(#{1,6})\s+(.*)$/;
+const LIST_MARKER = /^(?:[-*+]|\d+[.)])\s+/;
+const BLOCKQUOTE_MARKER = /^(?:>\s*)+/;
+/**
+ * Derive a digest from a body: the leading substantive units — paragraphs
+ * and individual list items (headings, tables, fences and rules skipped) —
+ * as many as fit, then the section headings as a map when room remains. The
+ * first unit is always present, truncated if it alone exceeds the cap. List
+ * items are units of their own because a floor skill's rules are usually a
+ * numbered list: folded into one paragraph they never fit and the digest
+ * degenerated to the one-line intro (pre-push-audit: 160 of 360 chars).
+ *
+ * A unit that opens a new section carries its heading (`Do NOT delegate:
+ * Tasks requiring …`). Without it the join reads as one continuous
+ * instruction, and a heading is where a skill's polarity flips: measured
+ * on this machine, local-inference-first digested to "…your first action is
+ * prism_infer. … Tasks requiring current conversation context" — the first
+ * bullet of its "Do NOT delegate" section, presented as a thing to route.
+ */
+export function deriveSkillDigest(body, maxChars = SKILL_DIGEST_MAX_CHARS) {
+    return assembleSkillDigest(parseSkillDigestBody(body), maxChars);
+}
+/** Label for a heading whose text is nothing once inert (`## **`). The
+ *  boundary still has to show in the digest — dropping it would join the
+ *  next unit onto the previous section. */
+const UNTITLED_SECTION = "(untitled)";
+function parseSkillDigestBody(body) {
+    const units = [];
+    const headings = [];
+    let current = [];
+    let currentIsList = false;
+    let section = null;
+    let headingSeen = false;
+    let inFence = false;
+    const flush = () => {
+        if (current.length) {
+            const text = inertLine(current.join(" "));
+            if (text)
+                units.push({ text, section });
+        }
+        current = [];
+        currentIsList = false;
+    };
+    const openSection = (level, rawText) => {
+        // The first heading of the document, when it is an H1 that precedes
+        // every unit, is the title (the name says it) and owns nothing. Any
+        // other heading — including a LATER H1 — owns the units that follow
+        // it: an H1 or H4 "Never" flips polarity as surely as an H2 does, so a
+        // level is never a reason to reset the section to the intro. H2 is the
+        // map; H3 only when a skill has no H2 at all
+        // (absence-of-evidence-protocol is all H3); a mid-document H1 maps as
+        // an H2.
+        const text = inertLine(rawText);
+        const isTitle = level === 1 && !headingSeen && units.length === 0;
+        headingSeen = true;
+        if (isTitle) {
+            section = null;
+            return;
+        }
+        section = text || UNTITLED_SECTION;
+        if (level <= 3)
+            headings.push(`${Math.max(level, 2)}:${text}`);
+    };
+    for (const rawLine of body.split("\n")) {
+        const line = rawLine.trim().replace(BLOCKQUOTE_MARKER, "");
+        if (line.startsWith("```") || line.startsWith("~~~")) {
+            inFence = !inFence;
+            flush();
+            continue;
+        }
+        if (inFence)
+            continue;
+        if (line === "") {
+            flush();
+            continue;
+        }
+        const heading = HEADING.exec(line);
+        if (heading) {
+            flush();
+            openSection(heading[1].length, heading[2]);
+            continue;
+        }
+        // Setext: a lone paragraph line underlined with `===` (H1) or `---`
+        // (H2) is a heading, not a paragraph followed by a rule.
+        if (current.length === 1 && !currentIsList && /^(?:=+|-+)$/.test(line)) {
+            const text = current[0];
+            current = [];
+            openSection(line.startsWith("=") ? 1 : 2, text);
+            continue;
+        }
+        if (/^(?:-{3,}|\*{3,}|_{3,})$/.test(line) || line.startsWith("|")) {
+            flush();
+            continue;
+        }
+        if (LIST_MARKER.test(line)) {
+            flush();
+            currentIsList = true;
+        }
+        current.push(line.replace(LIST_MARKER, ""));
+    }
+    flush();
+    const h2 = headings.filter((h) => h.startsWith("2:")).map((h) => h.slice(2));
+    const map = (h2.length ? h2 : headings.map((h) => h.slice(2))).filter(Boolean);
+    return { pinned: null, units, map };
+}
+/** Fit parsed material to a cap. Null when there is nothing to say — which
+ *  does not depend on the cap, so a block can count digestible entries
+ *  before it knows each one's share. */
+export function assembleSkillDigest(parsed, maxChars = SKILL_DIGEST_MAX_CHARS) {
+    if (!parsed)
+        return null;
+    if (parsed.pinned)
+        return truncate(parsed.pinned, maxChars);
+    const { units, map } = parsed;
+    if (units.length === 0 && map.length === 0)
+        return null;
+    let out = "";
+    let section = null;
+    for (const unit of units) {
+        // The heading is spent only where the section changes, so a run of
+        // bullets under one heading pays for it once.
+        const text = unit.section && unit.section !== section ? `${unit.section}: ${unit.text}` : unit.text;
+        if (!out) {
+            out = truncate(text, maxChars);
+            section = unit.section;
+            continue;
+        }
+        if (out.length + 1 + text.length > maxChars)
+            break;
+        out = `${out} ${text}`;
+        section = unit.section;
+    }
+    if (map.length) {
+        const sections = `Sections: ${map.join(" · ")}.`;
+        if (!out)
+            out = truncate(sections, maxChars);
+        else if (out.length + 1 + sections.length <= maxChars)
+            out = `${out} ${sections}`;
+        else if (maxChars - out.length - 1 >= 40)
+            out = `${out} ${truncate(sections, maxChars - out.length - 1)}`;
+    }
+    // Units were made inert one by one; the joins above are a new string, so
+    // it is made inert as a whole too (a `*` closing across a join, say).
+    // Every rule in inertLine shortens or preserves length, so this cannot
+    // push the digest back over maxChars.
+    return inertLine(out) || null;
+}
+/** A document that opens a frontmatter fence and never closes it — a
+ *  materialization cut off mid-header. `splitSkillFrontmatter` hands the
+ *  whole document back as the body in that case (right for the inline
+ *  path, which shows the file as it is); for a one-line digest that would
+ *  present the YAML — name, description, the on-device `prompt_triggers`
+ *  patterns — as the rule in force. It is not a body. */
+export function hasUnclosedFrontmatter(raw) {
+    const text = (raw ?? "").trim();
+    // The opener must be followed by a `key:`-shaped line — the first
+    // non-whitespace text after it decides, blank lines are skipped: a body
+    // that opens with a horizontal rule and then a heading or `Rule one.` is
+    // still a body. A body whose first text after the rule happens to be
+    // key-shaped (`Note: …`, with or without a blank line between) reads as an
+    // unclosed header — a deliberate false positive that fails toward "no
+    // digest", never toward presenting YAML as a rule (round-11/12 review).
+    return /^---\r?\n\s*[A-Za-z_][\w-]*\s*:/.test(text) && text.indexOf("\n---", 3) === -1;
+}
+/** Parse a raw SKILL.md once: frontmatter `digest:` when pinned, else the
+ *  body's material. Null for no source, or for a truncated one. */
+export function parseSkillDigest(raw) {
+    if (!raw)
+        return null;
+    // The cap is applied first so a fence that closes beyond it reads as
+    // unclosed — the same slice is what gets split.
+    const source = raw.slice(0, SKILL_DIGEST_SOURCE_MAX_CHARS);
+    if (hasUnclosedFrontmatter(source))
+        return null;
+    const { frontmatter, body } = splitSkillFrontmatter(source);
+    const pinned = readFrontmatterDigest(frontmatter);
+    if (pinned)
+        return { pinned: inertLine(pinned), units: [], map: [] };
+    return parseSkillDigestBody(body);
+}
+/** Frontmatter `digest:` when pinned, else derived from the body. */
+export function skillDigestFromSource(raw, maxChars = SKILL_DIGEST_MAX_CHARS) {
+    return assembleSkillDigest(parseSkillDigest(raw), maxChars);
+}
+const HEADER_LEAD = "📖 Protected floor — rules in force this session";
+/** Line tail for a name whose body says nothing digestible (not on this
+ *  machine, or all fences and tables). The rule is still in force — the
+ *  server named it — so the line says why it is bare instead of looking like
+ *  a skill with nothing to say. */
+export const SKILL_DIGEST_UNAVAILABLE = "digest unavailable; read the full skill";
+/**
+ * Render the block, or null when the budget cannot carry a useful digest for
+ * every digestible name — a floor whose lines were squeezed below
+ * SKILL_DIGEST_MIN_CHARS would be names with punctuation, so the caller keeps
+ * its name-only line instead. A name whose body cannot be digested at any
+ * budget still renders, marked SKILL_DIGEST_UNAVAILABLE, so an absent rule is
+ * never mistaken for a silent one. The per-skill cap is derived from the
+ * budget BEFORE digesting, so the derivation fits its rules and section map
+ * to the room it actually has instead of being cut a second time; one long
+ * body cannot starve the rest; the result never exceeds maxChars.
+ */
+export function renderFloorDigestBlock(entries, options) {
+    if (entries.length === 0 || options.maxChars <= 0)
+        return null;
+    const prefix = options.linePrefix ?? "";
+    const root = options.skillsRoot ? ` (full text: ${options.skillsRoot}/‹name›/SKILL.md)` : "";
+    const header = `${prefix}- ${HEADER_LEAD}${root}:`;
+    // Parse each body exactly once; the share is derived from how many can say
+    // anything at all, which the assembler decides independently of the cap.
+    const parsed = entries.map((e) => parseSkillDigest(e.source));
+    const digestible = parsed.map((p) => assembleSkillDigest(p) !== null);
+    const withBody = digestible.filter(Boolean).length;
+    if (withBody === 0)
+        return null;
+    // Every char that is not digest: the per-line chrome, the newline, and the
+    // full marker line for a name that gets no digest at all.
+    const chrome = entries.reduce((sum, e, i) => sum + `${prefix}  - ${e.name} — `.length + (digestible[i] ? 0 : SKILL_DIGEST_UNAVAILABLE.length) + 1, 0);
+    const perSkill = Math.min(SKILL_DIGEST_MAX_CHARS, Math.floor((options.maxChars - header.length - 1 - chrome) / withBody));
+    if (perSkill < SKILL_DIGEST_MIN_CHARS)
+        return null;
+    const lines = [header];
+    entries.forEach((entry, index) => {
+        const digest = digestible[index] ? assembleSkillDigest(parsed[index], perSkill) : null;
+        lines.push(`${prefix}  - ${entry.name} — ${digest ?? SKILL_DIGEST_UNAVAILABLE}`);
+    });
+    // The bound is the arithmetic above: header + chrome + withBody × perSkill
+    // ≤ maxChars, and a digest never exceeds its cap. There is deliberately no
+    // post-hoc `length <= maxChars ? block : null` guard — one turned a
+    // budgeting slip into a silently missing floor that the budget sweep could
+    // not see (the mutant survived); the sweep asserts the bound directly.
+    return lines.join("\n");
+}