prism-mcp-server 20.17.3 → 20.18.0

package/README.md

@@ -42,6 +42,9 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
   offline last-good recovery.
 - **Hook-free startup** — MCP metadata and native instructions request Prism's
   startup context without requiring lifecycle hooks or a Prism-owned launcher.
+  Where a host offers hooks (Claude Code, Codex), `prism connect` adds two
+  small ones on top: mid-session prompt routing, and a post-compaction
+  re-injection of the protected-floor digest.
 - **Safe escalation and observability** — inference outcomes are explicit,
   reserved content remains fail-closed, and local/cloud usage is recorded for
   review.
@@ -138,6 +141,58 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.18.0
+
+### The protected floor rides the bootstrap — and survives compaction
+
+- **`session_bootstrap` now inlines a digest of the protected floor** on
+  paid tiers at standard and deep depth: one inert line per rule, derived
+  from each skill's first paragraph (or its pinned `digest:`), plus its
+  section map, ~5.6K chars for the full floor. Small-context hosts such as
+  Codex were re-reading the sixteen SKILL.md files every session (median 8
+  re-reads / 36KB, worst 823 / 5.1MB in rollout logs) because the bootstrap
+  only *named* them. The digest is paid for on top of the context budget, so
+  the ledger/handoff share at every depth is byte-identical to before. Quick
+  depth stays names-only — the opt-out.
+- **A second hook re-injects the digest after compaction.** `prism connect`
+  registers the prism-route script on `SessionStart` matched to `compact`
+  (Claude Code and Codex); it runs `prism floor-digest`, which applies the
+  same tier and depth decisions as the bootstrap, and adds nothing on
+  startup/resume/clear. Hosts without hooks (Gemini, Cursor) still get the
+  digest on every bootstrap. **Codex: UNVERIFIED against a live compaction.**
+  The hook is registered and the script accepts the documented payload
+  spellings, but no Codex compaction has been observed end-to-end; on a
+  payload it does not recognise it re-injects nothing rather than something
+  wrong. If the digest comes from a generation whose skill files never
+  finished syncing, the re-injected block carries the same STALE warning the
+  bootstrap shows.
+- **Codex trust is reported honestly after a hook rewrite.** Approvals are
+  keyed by definition hash, so a rewritten `hooks.json` — this release adds
+  the SessionStart entry — voids prior trust: connect prints AWAITING TRUST
+  for both entries instead of a green ✓ for a hook Codex would silently skip,
+  and trust recorded for an older hook version is never mistaken for current.
+- **A host config that no longer parses is left alone.** If
+  `~/.claude/settings.json` or `~/.codex/hooks.json` exists but is not valid
+  JSON, connect keeps it byte-identical, registers no hook there, and says so
+  — it no longer replaces the file with a minimal hooks-only one. The npm
+  postinstall notice says the same, instead of asking you to trust a Codex
+  hook it never registered.
+- Fixed: a symptom-routed skill whose closing frontmatter fence is its last
+  line was inlined with its YAML (triggers included) as if it were the rule.
+- Fixed: a digest line that crosses into a new section keeps that section's
+  heading in front of it — whatever opened the section (an H2, a mid-document
+  H1, an empty heading, a setext underline) — so "Delegate to" / "Do NOT
+  delegate" rules cannot read with the wrong polarity once joined. A skill
+  file on disk is used only when it digests: empty, cut off inside its
+  frontmatter, or frontmatter-only files fall back to the stored copy instead
+  of rendering YAML as the rule.
+- Fixed: on Windows, a Codex hook approval is recognised even though Codex
+  stores the path with escaped backslashes.
+- The publish gate now refuses release notes that run *ahead* of the package
+  version (CHANGELOG, README, translated READMEs) — reading the newest
+  version on the heading line, so a `v20.17.3 – v20.18.0` range counts as
+  20.18.0, and surviving a typographic apostrophe or a BOM.
+
 ## What's New in v20.17.3
 
 - **A plugin install can no longer enable the prompt-routing hook.** The
@@ -579,8 +634,8 @@ the host's final verification responsibility are unchanged.
 materializes entitled packages in the native `~/.agents/skills` directory
 before the command exits. Codex therefore sees the current skillset on its
 first launch instead of requiring a second restart. Prism rechecks the same
-snapshot at MCP startup, session load, and every five minutes—without host
-lifecycle hooks.
+snapshot at MCP startup, session load, and every five minutes—skill delivery
+never depends on a host lifecycle hook.
 
 On the first user turn, Prism's native skill, MCP metadata, and managed host
 instructions request one `session_bootstrap({})` call. Prism then uses the
@@ -613,7 +668,10 @@ sections from `~/CLAUDE.md`, preserves every other instruction, and installs a
 small ownership-marked native block that selects `session_bootstrap({})` on the
 first turn. User hooks, custom instruction sections, and near matches remain
 untouched; native skills and server-side reminders preserve those Prism
-features without host lifecycle hooks. Because hosts expose no native
+features without depending on host lifecycle hooks. On Claude Code and Codex
+connect additionally registers the prism-route script twice: on every prompt
+(mid-session skill routing) and on `SessionStart` matched to `compact` only
+(post-compaction protected-floor digest). Because hosts expose no native
 session-end callback, handoff at shutdown is instruction-driven rather than a
 guaranteed lifecycle event.
 

package/dist/cli.js

@@ -348,10 +348,16 @@ program
                             const { ensurePromptRouteHook } = await import('./promptRouteHostHook.js');
                             for (const r of ensurePromptRouteHook({ hosts: hookHosts, mode: 'explicit' })) {
                                 const state = r.script === 'unchanged' && r.config === 'unchanged' ? 'up to date' : 'installed';
-                                if (r.host === 'codex' && r.codexApproval === 'pending-or-unknown') {
+                                if (r.config === 'skipped-unparseable') {
+                                    // The file was left byte-identical on purpose: replacing
+                                    // it would have wiped the operator's own settings along
+                                    // with the syntax error.
+                                    console.log(`⚠ ${r.host}: ${r.configPath} is not valid JSON — prism-route hooks NOT registered; fix the file and re-run prism connect`);
+                                }
+                                else if (r.host === 'codex' && r.codexApproval === 'pending-or-unknown') {
                                     // Codex silently skips untrusted hooks — a green "installed"
                                     // here would be the "configured and inert" lie.
-                                    console.log(`⚠ codex: prism-route hook ${state}, AWAITING TRUST — run codex, then /hooks, and trust the entry ending prism-route/on_prompt.py`);
+                                    console.log(`⚠ codex: prism-route hook ${state}, AWAITING TRUST — run codex, then /hooks, and trust BOTH entries ending prism-route/on_prompt.py (UserPromptSubmit and SessionStart)`);
                                 }
                                 else if (r.host === 'codex' && r.codexApproval === 'state-present-unverifiable') {
                                     // Approvals are keyed by definition hash, whose algorithm is
@@ -362,7 +368,7 @@ program
                                     console.log(`− codex: prism-route hook ${state}; trust state exists but is not verifiable from here — confirm once in /hooks`);
                                 }
                                 else {
-                                    console.log(`✓ ${r.host}: prism-route prompt hook ${state} (${r.scriptPath})`);
+                                    console.log(`✓ ${r.host}: prism-route hooks ${state} — prompt routing + post-compaction floor (${r.scriptPath})`);
                                 }
                             }
                         }
@@ -540,6 +546,33 @@ program
         process.exit(0);
     }
 });
+// ── floor-digest ──────────────────────────────────────────────
+// Called by the same hook on SessionStart with source "compact": the host
+// just discarded the bootstrap along with the rest of the transcript, and
+// this is the protected floor coming back in one line per rule. Same
+// contract as route-prompt — exit 0, one JSON line, cached DB and the local
+// skills root only. Fires once per compaction, never per prompt.
+program
+    .command('floor-digest')
+    .description('Print the protected-floor digest as {names, text} JSON. Used by the prism-route host hook after a context compaction.')
+    .action(async () => {
+    try {
+        const { renderProtectedFloorDigestForHook } = await import('./tools/ledgerHandlers.js');
+        const result = await renderProtectedFloorDigestForHook();
+        const payload = JSON.stringify({ names: result.names, text: result.text });
+        await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
+    }
+    catch {
+        await new Promise((resolveWrite) => process.stdout.write('{"names":[],"text":""}\n', () => resolveWrite()));
+    }
+    finally {
+        try {
+            await closeStorage();
+        }
+        catch { /* exit anyway */ }
+        process.exit(0);
+    }
+});
 program
     .command('load <project>')
     .description('Load session context for a project (same output as session_load_context MCP tool)')

package/dist/postinstall.js

@@ -23,9 +23,16 @@ try {
     // approval impossible to miss. Approval is per hook-version, not per
     // release: it recurs only when the hook script itself changes.
     const codex = results.find((r) => r.host === "codex");
-    if (codex && codex.codexApproval === "pending-or-unknown") {
+    if (codex && codex.config === "skipped-unparseable") {
+        // Nothing was registered, so there is nothing to trust: telling the
+        // operator to press t in /hooks would send them looking for an entry
+        // that does not exist. The file was left byte-identical on purpose.
+        console.error(`\n[prism] Codex ${codex.configPath} is not valid JSON — prism-route hooks NOT registered.\n` +
+            "[prism]   Fix the file, then run: prism connect --host codex\n");
+    }
+    else if (codex && codex.codexApproval === "pending-or-unknown") {
         console.error("\n[prism] Codex hook installed but NOT yet trusted — Codex silently skips it until you approve it once:\n" +
-            "[prism]   codex  ->  /hooks  ->  entry ending prism-route/on_prompt.py  ->  press t\n");
+            "[prism]   codex  ->  /hooks  ->  BOTH entries ending prism-route/on_prompt.py (UserPromptSubmit + SessionStart)  ->  press t\n");
     }
 }
 catch {

package/dist/promptRouteHostHook.js

@@ -1,5 +1,6 @@
 /**
- * prism-route — self-installing UserPromptSubmit hook for Claude Code + Codex.
+ * prism-route — self-installing UserPromptSubmit + SessionStart(compact) hook
+ * for Claude Code + Codex.
  *
  * WHY A HOST HOOK. An MCP server never sees the user's prompt; the protocol
  * carries only what a tool call carries. session_route_prompt (the MCP tool)
@@ -8,6 +9,17 @@
  * prompt regardless of model behaviour, on both hosts, which is what the
  * operator requires ("i need automatic").
  *
+ * WHY A SECOND EVENT. Compaction discards the bootstrap with the rest of the
+ * transcript, and nothing the MCP server can do brings it back — the server
+ * is never told a compaction happened. Both hosts run SessionStart hooks
+ * with source "compact" before the next model request (Claude Code:
+ * matcher "compact"; Codex hooks reference, verified 2026-09-01: "SessionStart
+ * hooks that match source: compact run before the next model request"). The
+ * same script answers that event with `prism floor-digest` — the protected
+ * floor, one line per rule — so the model does not spend the rest of the
+ * session re-reading SKILL.md files it can no longer see. Once per
+ * compaction, zero per-prompt cost.
+ *
  * WHY SELF-INSTALLING. The previous generation of prism hooks was provisioned
  * by a bootstrap script once, then hand-maintained per machine — which is why
  * this machine has them and the other team machines do not. This module is
@@ -28,7 +40,11 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSy
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 /** Bump to force the on-disk script to be rewritten on the next ensure. */
-export const PROMPT_ROUTE_HOOK_VERSION = "3";
+export const PROMPT_ROUTE_HOOK_VERSION = "4";
+/** SessionStart matcher: only the post-compaction fire carries the digest.
+ *  The script re-checks `source` itself, so a host that ignores matchers on
+ *  this event still injects nothing at startup/resume. */
+const SESSION_START_MATCHER = "compact";
 const MARKER_FILE = ".prism-managed.json";
 const SCRIPT_FILE = "on_prompt.py";
 const HOOK_DIR = "prism-route";
@@ -66,6 +82,9 @@ export const PROMPT_ROUTE_HOOK_SCRIPT = `#!/usr/bin/env python3
 
 Routes every user prompt through the on-device skill matcher via
 'prism route-prompt'. Injects newly matched skill bodies as context.
+On SessionStart with source "compact" (the host just discarded the
+transcript, bootstrap included) it re-injects the protected-floor digest
+via 'prism floor-digest' instead.
 Managed by prism; edits are overwritten on version bumps.
 """
 import json
@@ -76,16 +95,106 @@ import subprocess
 import sys
 
 
-def emit(extra=None):
+def emit(extra=None, event="UserPromptSubmit"):
     out = {"continue": True, "suppressOutput": True}
     if extra:
         out["hookSpecificOutput"] = {
-            "hookEventName": "UserPromptSubmit",
+            "hookEventName": event,
             "additionalContext": extra,
         }
     print(json.dumps(out))
 
 
+def run_cli_json(cli, args, stdin_text=""):
+    """Run a prism CLI subcommand; return its last JSON stdout line or None."""
+    try:
+        result = subprocess.run(
+            [cli] + args,
+            input=stdin_text,
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+    except Exception:
+        return None
+    if result.returncode != 0:
+        return None
+    # Parse the LAST line that is JSON: wrappers hooked into node via
+    # NODE_OPTIONS (dotenv banners and the like) print to stdout BEFORE the
+    # CLI's own output, and one polluted line must not kill routing.
+    for line in reversed(result.stdout.strip().splitlines()):
+        line = line.strip()
+        if line.startswith("{"):
+            try:
+                data = json.loads(line)
+            except Exception:
+                continue
+            return data if isinstance(data, dict) else None
+    return None
+
+
+def session_state_path(payload):
+    session = str(
+        payload.get("session_id")
+        or payload.get("sessionId")
+        or payload.get("conversation_id")
+        or "default"
+    )
+    session = re.sub(r"[^A-Za-z0-9._-]", "_", session).lstrip(".")[:80] or "default"
+    state_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "state")
+    return state_dir, os.path.join(state_dir, session + ".json")
+
+
+def payload_field(payload, *keys):
+    """First non-empty string among alternative spellings of one field.
+
+    Claude Code documents snake_case keys; Codex's payloads are described as
+    Claude-compatible, not Claude-identical, which is why the prompt lookup
+    below already hedges three ways. The SessionStart detection used to read
+    exactly one spelling, so a Codex payload spelled hookEventName/trigger
+    would fall to the prompt path and pass through with no digest and no
+    signal (round-11 review).
+    """
+    for key in keys:
+        value = payload.get(key)
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    return ""
+
+
+def event_name(payload):
+    name = payload_field(payload, "hook_event_name", "hookEventName", "event_name", "eventName", "event")
+    return re.sub(r"[^a-z]", "", name.lower())
+
+
+def on_session_start(payload):
+    # Only the post-compaction fire: at startup/resume the bootstrap carries
+    # the digest itself, and a second copy would be pure cost. "compact",
+    # "compaction", "compacted" all mean the transcript was just discarded.
+    source = payload_field(payload, "source", "trigger", "reason").lower()
+    if not source.startswith("compact"):
+        emit(event="SessionStart")
+        return
+    # The skills injected before compaction are gone with it; forget the
+    # dedupe list so the next matching prompt can bring them back.
+    state_dir, state_path = session_state_path(payload)
+    try:
+        os.remove(state_path)
+    except Exception:
+        pass
+    cli = find_cli()
+    if not cli:
+        emit(event="SessionStart")
+        return
+    data = run_cli_json(cli, ["floor-digest"])
+    text = (data or {}).get("text") or ""
+    names = [n for n in ((data or {}).get("names") or []) if isinstance(n, str)]
+    if not names or not isinstance(text, str) or not text:
+        emit(event="SessionStart")
+        return
+    emit(text, event="SessionStart")
+
+
 def find_cli():
     override = os.environ.get("PRISM_ROUTE_CLI")
     if override and os.path.exists(override):
@@ -111,6 +220,12 @@ def main():
         payload = json.loads(raw) if raw.strip() else {}
     except Exception:
         payload = {}
+    if not isinstance(payload, dict):
+        payload = {}
+
+    if event_name(payload) == "sessionstart":
+        on_session_start(payload)
+        return
 
     prompt = str(
         payload.get("prompt")
@@ -127,16 +242,7 @@ def main():
     # stretch, and the CLI caps identically on its side.
     prompt = prompt[:100_000]
 
-    session = str(
-        payload.get("session_id")
-        or payload.get("sessionId")
-        or payload.get("conversation_id")
-        or "default"
-    )
-    session = re.sub(r"[^A-Za-z0-9._-]", "_", session).lstrip(".")[:80] or "default"
-
-    state_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "state")
-    state_path = os.path.join(state_dir, session + ".json")
+    state_dir, state_path = session_state_path(payload)
     loaded = []
     try:
         with open(state_path) as fh:
@@ -151,34 +257,8 @@ def main():
         emit()
         return
 
-    try:
-        result = subprocess.run(
-            [cli, "route-prompt", "--loaded", ",".join(loaded)],
-            input=prompt,
-            capture_output=True,
-            text=True,
-            timeout=10,
-        )
-    except Exception:
-        emit()
-        return
-    if result.returncode != 0:
-        emit()
-        return
-
-    # Parse the LAST line that is JSON: wrappers hooked into node via
-    # NODE_OPTIONS (dotenv banners and the like) print to stdout BEFORE the
-    # CLI's own output, and one polluted line must not kill routing.
-    data = None
-    for line in reversed(result.stdout.strip().splitlines()):
-        line = line.strip()
-        if line.startswith("{"):
-            try:
-                data = json.loads(line)
-                break
-            except Exception:
-                continue
-    if not isinstance(data, dict):
+    data = run_cli_json(cli, ["route-prompt", "--loaded", ",".join(loaded)], prompt)
+    if data is None:
         emit()
         return
     names = [n for n in (data.get("names") or []) if isinstance(n, str)]
@@ -221,22 +301,37 @@ function hostSpecs(homeDir, env) {
 /**
  * Coarse Codex approval detection. Codex persists hook approvals as a
  * [hooks.state] table in config.toml keyed by definition hash; the hashing
- * algorithm is not public, so the only honest signals are "a state section
- * exists and mentions our hook path" (detected) or anything else
- * (pending-or-unknown). Never treat unknown as approved.
+ * algorithm is not public, so the only honest signal is the state section
+ * naming the EXACT command we register — `… --v<version>` — once per event
+ * (two hooks, two approvals). The version-agnostic path alone is not
+ * evidence: a v3 approval names the same script, and Codex will skip the
+ * v4 definition it never saw. Matching the bare path let a stale approval
+ * read as "detected" from the second `prism connect` after every hook
+ * bump (round-8 review). Never treat unknown as approved.
  */
-function detectCodexApproval(codexRoot) {
+function detectCodexApproval(codexRoot, wantedCommand) {
     try {
-        const toml = readFileSync(join(codexRoot, "config.toml"), "utf8");
-        const hasState = /\[hooks\.state/.test(toml);
-        if (hasState && toml.includes(COMMAND_SIGNATURE))
+        // A Windows path lands in a TOML basic string with its backslashes
+        // ESCAPED (`C:\\Users\\…`); one-for-one replacement turned that into
+        // `C://Users//…` and the approval never matched (round-10 review). A
+        // run of backslashes is one separator.
+        const toml = readFileSync(join(codexRoot, "config.toml"), "utf8").replace(/\\+/g, "/");
+        if (!/\[hooks\.state/.test(toml))
+            return "pending-or-unknown";
+        const wanted = wantedCommand.replace(/\\+/g, "/");
+        const exact = toml.split(wanted).length - 1;
+        if (exact >= 2)
             return "detected";
-        // Approvals are keyed by definition hash (algorithm not public). Once ANY
-        // trust state exists we cannot distinguish ours from here — and claiming
-        // AWAITING TRUST after the operator pressed t would be a false alarm
-        // against their own action. Distinct state, distinct wording.
-        if (hasState)
-            return "state-present-unverifiable";
+        // Our script is named, but not under the current definition: positive
+        // evidence that the trust on file is for an OLDER hook version, which
+        // Codex will not honour for this one.
+        if (exact === 0 && toml.includes(COMMAND_SIGNATURE))
+            return "pending-or-unknown";
+        // Trust state exists (one of our two entries, or hash-only entries that
+        // never name a command) and we cannot distinguish ours from here.
+        // Claiming AWAITING TRUST after the operator pressed t would be a false
+        // alarm against their own action. Distinct state, distinct wording.
+        return "state-present-unverifiable";
     }
     catch { /* unreadable = no evidence */ }
     return "pending-or-unknown";
@@ -288,60 +383,78 @@ function ensureRegistered(configPath, scriptPath, host) {
     // alone, not stripped).
     const wantsLimit = host === "codex";
     let config = {};
-    let originalText;
-    try {
-        originalText = readFileSync(configPath, "utf8");
-        const parsed = JSON.parse(originalText);
-        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    if (existsSync(configPath)) {
+        // An existing file we cannot parse is the operator's file with a syntax
+        // slip in it (model, env, permissions…) — "replace with {hooks}" would
+        // be a silent wipe. Register nothing; the caller reports it.
+        try {
+            const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return "skipped-unparseable";
             config = parsed;
         }
-    }
-    catch {
-        /* missing or unreadable — create minimal */
+        catch {
+            return "skipped-unparseable";
+        }
     }
     const hooks = (config.hooks && typeof config.hooks === "object" && !Array.isArray(config.hooks)
         ? config.hooks
         : {});
-    const entries = Array.isArray(hooks.UserPromptSubmit) ? hooks.UserPromptSubmit : [];
     const wanted = hookCommand(scriptPath);
-    let stale = false;
-    for (const entry of entries) {
-        if (!entry || typeof entry !== "object")
-            continue;
-        const inner = entry.hooks;
-        if (!Array.isArray(inner))
-            continue;
-        for (const h of inner) {
-            if (!h || typeof h !== "object")
+    let updated = false;
+    let registered = false;
+    // One script, two events. Each event is converged independently so a
+    // machine registered under an older release (UserPromptSubmit only) gains
+    // the SessionStart entry on refresh, and a hand-removed entry is not
+    // resurrected by the other event still being current — the disabled marker
+    // is the opt-out for both.
+    const converge = (event, matcher) => {
+        const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
+        let found = false;
+        for (const entry of entries) {
+            if (!entry || typeof entry !== "object")
                 continue;
-            // Normalize separators: on Windows join() registers a backslash path,
-            // and a forward-slash signature would never match — so every ensure
-            // would re-register a duplicate entry.
-            const command = String(h.command ?? "");
-            if (!command.replace(/\\/g, "/").includes(COMMAND_SIGNATURE))
+            const inner = entry.hooks;
+            if (!Array.isArray(inner))
                 continue;
-            const limitCurrent = !wantsLimit || h.additionalContextLimit === 0;
-            if (command === wanted && limitCurrent)
-                return "unchanged";
-            // Same hook, older definition: UPDATE it in place. This is what makes a
-            // refresh visible to Codex's definition-hash — and on Claude it is a
-            // harmless argv change.
-            h.command = wanted;
-            if (wantsLimit)
-                h.additionalContextLimit = 0;
-            stale = true;
+            for (const h of inner) {
+                if (!h || typeof h !== "object")
+                    continue;
+                // Normalize separators: on Windows join() registers a backslash path,
+                // and a forward-slash signature would never match — so every ensure
+                // would re-register a duplicate entry.
+                const command = String(h.command ?? "");
+                if (!command.replace(/\\/g, "/").includes(COMMAND_SIGNATURE))
+                    continue;
+                found = true;
+                const limitCurrent = !wantsLimit || h.additionalContextLimit === 0;
+                if (command === wanted && limitCurrent)
+                    continue;
+                // Same hook, older definition: UPDATE it in place. This is what makes a
+                // refresh visible to Codex's definition-hash — and on Claude it is a
+                // harmless argv change.
+                h.command = wanted;
+                if (wantsLimit)
+                    h.additionalContextLimit = 0;
+                updated = true;
+            }
         }
-    }
-    if (!stale) {
-        entries.push({
-            matcher: "*",
-            hooks: [{ type: "command", command: wanted, timeout: 15, ...(wantsLimit ? { additionalContextLimit: 0 } : {}) }],
-        });
-    }
-    hooks.UserPromptSubmit = entries;
+        if (!found) {
+            entries.push({
+                matcher,
+                hooks: [{ type: "command", command: wanted, timeout: 15, ...(wantsLimit ? { additionalContextLimit: 0 } : {}) }],
+            });
+            registered = true;
+        }
+        hooks[event] = entries;
+    };
+    converge("UserPromptSubmit", "*");
+    converge("SessionStart", SESSION_START_MATCHER);
+    if (!updated && !registered)
+        return "unchanged";
     config.hooks = hooks;
     writeAtomically(configPath, `${JSON.stringify(config, null, 2)}\n`);
-    return stale ? "updated" : "registered";
+    return registered ? "registered" : "updated";
 }
 /**
  * Idempotently install the prism-route hook for both hosts.
@@ -371,7 +484,14 @@ export function ensurePromptRouteHook(options = {}) {
                 // Never report a green "registered" as if it were active: Codex
                 // SILENTLY SKIPS untrusted hooks, and "installed but inert" is the
                 // exact failure class this feature exists to end.
-                result.codexApproval = detectCodexApproval(spec.root);
+                //
+                // Approvals are keyed by definition hash, so a hooks.json we just
+                // rewrote (new entry, changed command) carries definitions the
+                // operator has never trusted — whatever config.toml says about the
+                // OLD ones. Only an untouched config can inherit prior trust.
+                result.codexApproval = config === "unchanged"
+                    ? detectCodexApproval(spec.root, hookCommand(result.scriptPath))
+                    : "pending-or-unknown";
             }
             results.push(result);
         }

package/dist/tools/ledgerHandlers.js

@@ -32,6 +32,7 @@ import { getLLMProvider } from "../utils/llm/factory.js";
 import { getCurrentGitState, getGitDrift } from "../utils/git.js";
 import { getSetting, setSetting, getAllSettings, refreshConfigStorageCache } from "../storage/configStorage.js";
 import { MATERIALIZED_GENERATION_KEY } from "../skillManifestSync.js";
+import { renderFloorDigestBlock, skillDigestFromSource, splitSkillFrontmatter } from "../utils/skillDigest.js";
 import { mergeHandoff, dbToHandoffSchema, sanitizeForMerge } from "../utils/crdtMerge.js";
 import { resolveProject } from "../utils/projectResolver.js";
 import { getUpdateNotice } from "../updateNotice.js";
@@ -196,15 +197,10 @@ function effectiveNativeBudget(level, requestedMaxChars) {
  * both "no body" and "frontmatter only".
  */
 function stripSkillFrontmatter(raw) {
-    const text = (raw ?? "").trim();
-    if (!text.startsWith("---"))
-        return text;
-    // Closing fence must be its own line; a body line of "---" mid-document is
-    // not a terminator, so anchor on the newline pair.
-    const end = text.indexOf("\n---", 3);
-    if (end === -1)
-        return text; // unterminated frontmatter — inline as-is
-    return text.slice(text.indexOf("\n", end + 1) + 1).trim();
+    // One fence parser for every inline path. The local copy this replaced
+    // returned the WHOLE document — frontmatter included — for a file whose
+    // closing fence is its last line (no newline after it, indexOf → -1).
+    return splitSkillFrontmatter(raw).body;
 }
 /**
  * Room reserved for the trailing <prism_session /> facts line so it never
@@ -215,11 +211,32 @@ function stripSkillFrontmatter(raw) {
  * skill block this whole fix exists to deliver.
  */
 const SESSION_FACTS_RESERVE = 256;
+/**
+ * Project/session-context budget per depth. This also bounds the standalone
+ * session_load_context / `prism load` output, which render no System Ready
+ * block — so the floor digest is NOT folded in here: the bootstrap adds the
+ * digest's own length on top (see startupMaxChars), and the context share at
+ * every depth stays exactly what it was before the digest existed.
+ */
 const NATIVE_STARTUP_MAX_CHARS = {
     quick: 4_000,
     standard: 8_000,
     deep: 30_000,
 };
+/**
+ * Protected-floor digest allowance per depth (chars), paid on top of the
+ * context budget above. The bootstrap names the floor; the digest carries
+ * one line of each rule so the model knows what is in force without
+ * re-reading SKILL.md — measured 2026-09-01 on Codex rollout logs: median 8
+ * re-reads / 36KB per session, 823 / 5.1MB in the worst. quick stays
+ * names-only: sixteen useful lines are ~5.6K, more than the whole quick
+ * budget, and a partial digest would make the omitted rules look absent.
+ */
+const NATIVE_FLOOR_DIGEST_MAX_CHARS = {
+    quick: 0,
+    standard: 6_000,
+    deep: 6_000,
+};
 const NATIVE_CONTEXT_LIMITS = {
     quick: {
         warnings: [2, 200],
@@ -276,6 +293,10 @@ function parseNativeSkillNames(value) {
         return [];
     }
 }
+/** The dashboard's default_context_depth, validated; anything else is standard. */
+function nativeDepthFromSetting(value) {
+    return ["quick", "standard", "deep"].includes(value) ? value : "standard";
+}
 async function resolveNativeSkillManifestSnapshot(syncResult) {
     const { FREE_NATIVE_SKILL_NAMES, REQUIRED_NATIVE_SKILL_NAMES } = await import("./skillRouting.js");
     const [storedNamesValue, storedTierValue, committedGeneration, materializedGeneration] = await Promise.all([
@@ -368,10 +389,102 @@ function escapeNativeMarkdown(value) {
 function sanitizeNativeIdentity(value) {
     return value.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").replace(/\s+/g, " ").trim();
 }
+/**
+ * The protected floor's rules, one line each, for the names in `names`.
+ * Bodies come from the canonical skills root — what the host itself reads —
+ * with the manifest DB as fallback for a body committed but not yet on disk
+ * (validated-partial). Returns null when the budget cannot carry every name.
+ *
+ * Shared by the bootstrap block and the `prism floor-digest` CLI so a rule
+ * digested one way at startup is never digested another way after a
+ * compaction.
+ */
+async function buildProtectedFloorDigest(names, options) {
+    if (names.length === 0 || options.maxChars <= 0)
+        return null;
+    const { readNativeSkillBody, resolveCanonicalSkillsDir } = await import("../skillManifestSync.js");
+    const entries = await Promise.all(names.map(async (name) => {
+        // The file on disk wins only when it digests. A truncated
+        // materialization — zero bytes, whitespace, a header cut off before its
+        // closing fence, a fenced header with no body — is not a body, and the
+        // DB copy the fallback exists for must win over it; before, any
+        // non-empty file shadowed the committed rule, and one cut mid-header
+        // rendered its YAML as the rule in force.
+        const onDisk = await readNativeSkillBody(name);
+        const source = skillDigestFromSource(onDisk) !== null
+            ? onDisk
+            : (await getSetting(`skill:${name}`, "")) || onDisk || "";
+        return { name, source };
+    }));
+    return renderFloorDigestBlock(entries, {
+        maxChars: options.maxChars,
+        linePrefix: options.linePrefix,
+        skillsRoot: resolveCanonicalSkillsDir(),
+    });
+}
+/**
+ * Protected floor ∩ entitled manifest, in floor order — the set the digest
+ * covers. prism-startup (free-tier chrome whose whole body is "call
+ * session_bootstrap") never gets a digest line because it is not on
+ * REQUIRED_PROTECTED_SKILL_NAMES at all — tests/skill-routing.test.ts pins
+ * the free and protected lists disjoint. An earlier `!free.has(name)` filter
+ * here re-stated that in code no input could ever exercise (round-11 review).
+ */
+async function entitledProtectedFloorNames(provisionedNames) {
+    const { REQUIRED_PROTECTED_SKILL_NAMES } = await import("./skillRouting.js");
+    const provisioned = new Set(provisionedNames);
+    return REQUIRED_PROTECTED_SKILL_NAMES.filter((name) => provisioned.has(name));
+}
+/**
+ * The post-compaction payload for the prism-route host hook (SessionStart
+ * with source "compact"): the same digest the bootstrap rendered, without
+ * the blockquote chrome, from the last-synced manifest — cache only, never a
+ * portal round-trip, exactly like route-prompt.
+ *
+ * Same entitlement and depth decisions as the bootstrap, through the same
+ * code: the manifest snapshot re-filters the committed names by the stored
+ * tier (a free-tier DB can hold paid names — the resolver never trusts the
+ * list alone), and quick depth is names-only here too. Round-7 review found
+ * this path reading the raw names: bootstrap said "free, 1 skill" while the
+ * hook injected sixteen paid rules from the same database.
+ */
+export async function renderProtectedFloorDigestForHook() {
+    // No sync on this path — "unchanged" is what the committed state is.
+    const snapshot = await resolveNativeSkillManifestSnapshot({
+        status: "unchanged", installed: [], updated: [], pruned: [], conflicts: [],
+    });
+    const depth = nativeDepthFromSetting(await getSetting("default_context_depth", "standard"));
+    const names = await entitledProtectedFloorNames(snapshot.names);
+    const block = await buildProtectedFloorDigest(names, {
+        maxChars: NATIVE_FLOOR_DIGEST_MAX_CHARS[depth],
+        linePrefix: "",
+    });
+    if (!block)
+        return { names: [], text: "" };
+    // Post-compaction is exactly when the bootstrap's STALE line is no longer
+    // on screen, so a digest rendered from a generation that never reached the
+    // skill roots must say so itself (round-11 review; the bootstrap copy of
+    // this warning is undeliveredWarning below).
+    const staleLine = snapshot.undeliveredGeneration
+        ? `⚠️ Skill files are STALE: the entitlement DB is at generation ` +
+            `\`${snapshot.undeliveredGeneration.slice(0, 12)}…\` but its files never finished reaching ` +
+            `the skill roots, so this digest may be older than the rules in force. Run a sync ` +
+            `(restart the host or \`prism connect\`).\n`
+        : "";
+    return {
+        names,
+        text: `Prism: context was compacted. The protected floor below is still in force for the rest of this session.\n${staleLine}${block}`,
+    };
+}
 async function buildNativeSystemReadyBlock(snapshot, depth) {
     const { REQUIRED_NATIVE_SKILL_NAMES } = await import("./skillRouting.js");
     const provisioned = new Set(snapshot.names);
     const coreSkills = REQUIRED_NATIVE_SKILL_NAMES.filter((name) => provisioned.has(name));
+    // Directly under the names line, inside the blockquote: the digest is part
+    // of the same fact ("these rules are in force"), and the head of this block
+    // is what capped depths keep.
+    const floorDigest = await buildProtectedFloorDigest(await entitledProtectedFloorNames(snapshot.names), { maxChars: NATIVE_FLOOR_DIGEST_MAX_CHARS[depth], linePrefix: "> " });
+    const floorDigestLines = floorDigest ? `${floorDigest}\n` : "";
     const coreSkillSet = new Set(REQUIRED_NATIVE_SKILL_NAMES);
     const superSkills = snapshot.names.filter((name) => name.endsWith("-super-skill"));
     const superSkillAliases = superSkills.map((name) => `${name.slice(0, -"-super-skill".length)} (${name})`);
@@ -407,37 +520,41 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
             `reaching the skill roots. Agents are reading older skills. Run a sync ` +
             `(restart the host or \`prism connect\`) and report this if it persists.`
         : "";
+    const wrap = (text) => ({ text, floorDigestChars: floorDigestLines.length });
     if (snapshot.source === "validated-partial") {
-        return `> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
+        return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
             `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
             `> - 📦 **Entitled skills (materialization incomplete):** ${snapshot.names.length}\n` +
             `> - 📚 **Core/protected entitlements:** ${formatBoundedSkillNames(coreSkills, "entitled")}\n` +
+            floorDigestLines +
             `> - 🧩 **Super-skill entitlements:** ${formatBoundedSkillNames(superSkillAliases, "entitled")}\n` +
             `> - 🛠️ **Other tier entitlements:** ${formatBoundedSkillNames(otherTierSkills, "entitled")}\n` +
             `> - 🧠 **Context depth:** ${depth}\n` +
             `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · native materialization incomplete${conflictSuffix}` +
             conflictWarning +
-            freeTierUpgradeLine(snapshot.tier);
+            freeTierUpgradeLine(snapshot.tier));
     }
     if (snapshot.source === "tier-fallback") {
-        return `> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
+        return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
             `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
             `> - 🛡️ **Fallback skill names:** ${formatBoundedSkillNames(snapshot.names, "fallback")}\n` +
+            floorDigestLines +
             `> - 🧠 **Context depth:** ${depth}\n` +
             `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · no committed manifest${conflictSuffix}` +
             conflictWarning +
-            freeTierUpgradeLine(snapshot.tier);
+            freeTierUpgradeLine(snapshot.tier));
     }
-    return `> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
+    return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
         `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
         `> - 📦 **Provisioned skills:** ${snapshot.names.length}\n` +
         `> - 📚 **Core/protected skills provisioned:** ${formatBoundedSkillNames(coreSkills, "provisioned")}\n` +
+        floorDigestLines +
         `> - 🧩 **Super-skills provisioned:** ${formatBoundedSkillNames(superSkillAliases, "provisioned")}\n` +
         `> - 🛠️ **Other tier skills provisioned:** ${formatBoundedSkillNames(otherTierSkills, "provisioned")}\n` +
         `> - 🧠 **Context depth:** ${depth}\n` +
         `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · committed manifest${conflictSuffix}` +
         conflictWarning +
-        freeTierUpgradeLine(snapshot.tier);
+        freeTierUpgradeLine(snapshot.tier));
 }
 /**
  * The paid funnel's one startup line. Before 2026-08-05 the upgrade_url was
@@ -500,8 +617,12 @@ export function sliceCodepointSafe(text, end) {
     const last = cut.charCodeAt(cut.length - 1);
     return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
 }
-export function capNativeStartupText(text, level, requestedMaxChars, suffix = "") {
-    const maxChars = effectiveNativeBudget(level, requestedMaxChars);
+export function capNativeStartupText(text, level, requestedMaxChars, suffix = "", additiveChars = 0) {
+    // additiveChars rides on top of the depth budget: the protected-floor
+    // digest is paid for by its own allowance (NATIVE_FLOOR_DIGEST_MAX_CHARS)
+    // on every bootstrap path, so it never displaces the session or the
+    // System Ready tail — the projects path adds it the same way.
+    const maxChars = effectiveNativeBudget(level, requestedMaxChars) + Math.max(0, additiveChars);
     if (text.length + suffix.length <= maxChars)
         return text + suffix;
     const marker = `\n\n… Additional ${level} context omitted to keep native startup within its display budget.`;
@@ -2088,9 +2209,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         getSetting("agent_name", ""),
         getSetting("default_role", ""),
     ]);
-    const depth = ["quick", "standard", "deep"].includes(configuredDepth)
-        ? configuredDepth
-        : "standard";
+    const depth = nativeDepthFromSetting(configuredDepth);
     const projects = [...new Set(configuredProjects.split(",").map((project) => project.trim()).filter(Boolean))];
     const configuredGreetingName = sanitizeNativeIdentity(agentName);
     const greetingName = configuredGreetingName
@@ -2098,7 +2217,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         : "developer";
     const role = sanitizeNativeIdentity(defaultRole) || "global";
     const manifestSnapshot = await resolveNativeSkillManifestSnapshot(skillSyncResult);
-    const systemReadyBlock = await buildNativeSystemReadyBlock(manifestSnapshot, depth);
+    const { text: systemReadyBlock, floorDigestChars } = await buildNativeSystemReadyBlock(manifestSnapshot, depth);
     // First run = the dashboard has never been touched: no agent identity AND no
     // projects. Measured 2026-08-05: a brand-new free-tier install was greeted
     // with "Welcome back", three "Not loaded" rows, a warning, and three
@@ -2159,7 +2278,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
             return {
                 content: [{
                         type: "text",
-                        text: capNativeStartupText(firstRunText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth, first_run: true })}`),
+                        text: capNativeStartupText(firstRunText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth, first_run: true })}`, floorDigestChars),
                     }],
                 isError: false,
             };
@@ -2172,12 +2291,16 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         return {
             content: [{
                     type: "text",
-                    text: capNativeStartupText(noProjectsText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth })}`),
+                    text: capNativeStartupText(noProjectsText, depth, undefined, `\n\n${buildSessionFactsLine({ conversation_id: conversationId, projects: "", depth })}`, floorDigestChars),
                 }],
             isError: false,
         };
     }
-    const startupMaxChars = NATIVE_STARTUP_MAX_CHARS[depth];
+    // The digest is additive: the project/session share is computed against
+    // the same budget it had before the digest existed, at every depth. Round-7
+    // review measured deep losing 5,630 chars of ledger/handoff per bootstrap
+    // when only standard had been raised to cover it.
+    const startupMaxChars = NATIVE_STARTUP_MAX_CHARS[depth] + floorDigestChars;
     let renderedProjectCount = projects.length;
     let omittedProjectsText = "";
     let perProjectMaxChars = 0;

package/dist/utils/skillBudget.js

@@ -38,8 +38,13 @@ function render(e) {
  * skills inline even when the budget is already blown (assembleSkillBlock), and
  * the repo-measured v26 floor is ~39k chars on its own — so the ceiling here is
  * roughly 87k - 39k - memory. `standard` matches the 8,400-char tranche the
- * existing v26 shape test already treats as the standard budget (60% of 14k
- * tokens); `deep` doubles it and still leaves headroom for deep history.
+ * existing v26 shape test already treats as the standard budget — the 60%
+ * share of a 4k-token response at 3.5 chars/token, i.e. exactly
+ * `resolveSkillBudgetChars(4_000)` below (~2,400 tokens, NOT 8,400: an
+ * earlier version of this comment called it "60% of 14k tokens", which is
+ * the same arithmetic in tokens instead of chars — 14k tokens would be a
+ * 29,400-char tranche); `deep` doubles it and still leaves headroom for
+ * deep history.
  *
  * `quick` is deliberately near-nothing — it is the setting a caller picks to
  * minimize context, and before this it still inlined the full skill payload,

package/dist/utils/skillDigest.js

@@ -0,0 +1,363 @@
+/**
+ * Protected-floor digest — the context-augmented half of skill delivery.
+ *
+ * The native bootstrap NAMES the protected floor and never carries its rules
+ * (bodies live on disk under the skills root). Measured 2026-09-01 across
+ * Codex rollout logs: the model re-reads SKILL.md files to recover them —
+ * median 8 reads / 36KB per session, 823 reads / 5.1MB across 498
+ * compactions in the worst — each a tool round trip on a host whose
+ * per-result cap is 10K tokens. On Gemini and Cursor there is no prompt hook
+ * at all, so the bootstrap is the only prism channel they ever get.
+ *
+ * A digest is not the rule. It is enough of the rule that the model knows
+ * what is in force and where the full text lives, in ~350 chars instead of
+ * ~3,000. Authors pin the wording with a `digest:` frontmatter key; without
+ * one it is derived from the body — the leading substantive paragraphs,
+ * each new section's heading kept in front of its first unit, then the
+ * section headings as a map — so it works on every skill that exists today
+ * with no pipeline change.
+ *
+ * Pure functions, no I/O: the bootstrap and the `prism floor-digest` CLI
+ * (post-compaction re-injection via the host hook) render through the same
+ * code so the two channels cannot drift.
+ */
+/** Per-skill ceiling. 16 floor skills × 360 ≈ 5.8K chars — under the 6K
+ *  block budget and far under Claude Code's 10K-char hook context cap. */
+export const SKILL_DIGEST_MAX_CHARS = 360;
+/** Below this a digest is a name with punctuation; render names only. */
+export const SKILL_DIGEST_MIN_CHARS = 80;
+/** Ceiling on the raw source a digest is derived from. Real floor bodies are
+ *  1.3–5.2K chars and the digest only ever uses the head; unbounded input is
+ *  regex food (a 128KB body measured 27s of bootstrap CPU before this cap). */
+export const SKILL_DIGEST_SOURCE_MAX_CHARS = 64_000;
+/**
+ * Split a SKILL.md into its frontmatter text and body — the one fence parser
+ * for every inline path (the bootstrap's symptom-skill inlining strips
+ * through this too). The closing fence must open a line, so a body line of
+ * "---" is not a terminator.
+ */
+export function splitSkillFrontmatter(raw) {
+    const text = (raw ?? "").trim();
+    if (!text.startsWith("---"))
+        return { frontmatter: "", body: text };
+    const end = text.indexOf("\n---", 3);
+    if (end === -1)
+        return { frontmatter: "", body: text };
+    const frontmatter = text.slice(3, end).trim();
+    // A closing fence on the last line has no newline after it: the body is
+    // empty, not the whole document.
+    const bodyStart = text.indexOf("\n", end + 1);
+    const body = bodyStart === -1 ? "" : text.slice(bodyStart + 1).trim();
+    return { frontmatter, body };
+}
+/**
+ * The author-pinned digest, when present. Supports the YAML shapes a skill
+ * author will actually type: `digest: text`, `digest: "quoted"`,
+ * `digest: 'quoted'`, and the block scalars `digest: >` / `digest: |` with
+ * indented continuation lines. Anything else (nested maps, anchors) is
+ * ignored rather than misread — the derived digest takes over.
+ */
+export function readFrontmatterDigest(frontmatter) {
+    const lines = frontmatter.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^digest:\s*(.*)$/.exec(lines[i]);
+        if (!m)
+            continue;
+        const inline = m[1].trim();
+        if (inline === ">" || inline === "|" || inline === ">-" || inline === "|-") {
+            const parts = [];
+            for (let j = i + 1; j < lines.length; j++) {
+                const line = lines[j];
+                if (line.trim() === "") {
+                    if (parts.length)
+                        parts.push("");
+                    continue;
+                }
+                if (!/^\s/.test(line))
+                    break; // dedented = next key
+                parts.push(line.trim());
+            }
+            const joined = parts.join(" ").replace(/\s+/g, " ").trim();
+            return joined || null;
+        }
+        let value = inline;
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        value = value.replace(/\s+/g, " ").trim();
+        return value || null;
+    }
+    return null;
+}
+/** slice() that never ends on a lone high surrogate. */
+function sliceCodepointSafe(text, end) {
+    const cut = text.slice(0, Math.max(0, end));
+    const last = cut.charCodeAt(cut.length - 1);
+    return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
+}
+function truncate(text, maxChars) {
+    if (text.length <= maxChars)
+        return text;
+    if (maxChars <= 1)
+        return "";
+    return sliceCodepointSafe(text, maxChars - 1).trimEnd() + "…";
+}
+/**
+ * One inert display line. Markdown emphasis is dropped (it renders as noise
+ * inside a list item), wiki-links keep their target name, and EVERY angle
+ * bracket becomes a guillemet — a host's markdown/HTML renderer eats `<x>`
+ * as an unknown tag (observed: a placeholder rendered as
+ * knowledge_search("")), and this text is model context: a body could
+ * otherwise carry a forged `<prism_session … />` line, which the server
+ * instructions tell the model to reuse. Brackets are replaced one by one,
+ * not as matched spans: a span rule let a tag split across two paragraphs,
+ * list items, or headings re-form when the assembler joined them (a
+ * verifier's repro), and CommonMark lets an inline tag span one line ending,
+ * so even two adjacent block lines could re-form one. With no `<` or `>` in
+ * any unit there is nothing to re-form; "› 60 min" still reads. The
+ * wiki-link class excludes `[` so a run of unclosed brackets cannot go
+ * quadratic.
+ */
+function inertLine(text) {
+    return text
+        .replace(/\[\[([^\[\]]+)\]\]/g, "$1")
+        .replace(/\*\*|__/g, "")
+        .replace(/(^|\s)[*_](\S[^*_]*\S)[*_](?=\s|[.,;:!?]|$)/g, "$1$2")
+        .replace(/</g, "‹")
+        .replace(/>/g, "›")
+        .replace(/[\u200b-\u200d\ufeff]/g, "")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+const HEADING = /^(#{1,6})\s+(.*)$/;
+const LIST_MARKER = /^(?:[-*+]|\d+[.)])\s+/;
+const BLOCKQUOTE_MARKER = /^(?:>\s*)+/;
+/**
+ * Derive a digest from a body: the leading substantive units — paragraphs
+ * and individual list items (headings, tables, fences and rules skipped) —
+ * as many as fit, then the section headings as a map when room remains. The
+ * first unit is always present, truncated if it alone exceeds the cap. List
+ * items are units of their own because a floor skill's rules are usually a
+ * numbered list: folded into one paragraph they never fit and the digest
+ * degenerated to the one-line intro (pre-push-audit: 160 of 360 chars).
+ *
+ * A unit that opens a new section carries its heading (`Do NOT delegate:
+ * Tasks requiring …`). Without it the join reads as one continuous
+ * instruction, and a heading is where a skill's polarity flips: measured
+ * on this machine, local-inference-first digested to "…your first action is
+ * prism_infer. … Tasks requiring current conversation context" — the first
+ * bullet of its "Do NOT delegate" section, presented as a thing to route.
+ */
+export function deriveSkillDigest(body, maxChars = SKILL_DIGEST_MAX_CHARS) {
+    return assembleSkillDigest(parseSkillDigestBody(body), maxChars);
+}
+/** Label for a heading whose text is nothing once inert (`## **`). The
+ *  boundary still has to show in the digest — dropping it would join the
+ *  next unit onto the previous section. */
+const UNTITLED_SECTION = "(untitled)";
+function parseSkillDigestBody(body) {
+    const units = [];
+    const headings = [];
+    let current = [];
+    let currentIsList = false;
+    let section = null;
+    let headingSeen = false;
+    let inFence = false;
+    const flush = () => {
+        if (current.length) {
+            const text = inertLine(current.join(" "));
+            if (text)
+                units.push({ text, section });
+        }
+        current = [];
+        currentIsList = false;
+    };
+    const openSection = (level, rawText) => {
+        // The first heading of the document, when it is an H1 that precedes
+        // every unit, is the title (the name says it) and owns nothing. Any
+        // other heading — including a LATER H1 — owns the units that follow
+        // it: an H1 or H4 "Never" flips polarity as surely as an H2 does, so a
+        // level is never a reason to reset the section to the intro. H2 is the
+        // map; H3 only when a skill has no H2 at all
+        // (absence-of-evidence-protocol is all H3); a mid-document H1 maps as
+        // an H2.
+        const text = inertLine(rawText);
+        const isTitle = level === 1 && !headingSeen && units.length === 0;
+        headingSeen = true;
+        if (isTitle) {
+            section = null;
+            return;
+        }
+        section = text || UNTITLED_SECTION;
+        if (level <= 3)
+            headings.push(`${Math.max(level, 2)}:${text}`);
+    };
+    for (const rawLine of body.split("\n")) {
+        const line = rawLine.trim().replace(BLOCKQUOTE_MARKER, "");
+        if (line.startsWith("```") || line.startsWith("~~~")) {
+            inFence = !inFence;
+            flush();
+            continue;
+        }
+        if (inFence)
+            continue;
+        if (line === "") {
+            flush();
+            continue;
+        }
+        const heading = HEADING.exec(line);
+        if (heading) {
+            flush();
+            openSection(heading[1].length, heading[2]);
+            continue;
+        }
+        // Setext: a lone paragraph line underlined with `===` (H1) or `---`
+        // (H2) is a heading, not a paragraph followed by a rule.
+        if (current.length === 1 && !currentIsList && /^(?:=+|-+)$/.test(line)) {
+            const text = current[0];
+            current = [];
+            openSection(line.startsWith("=") ? 1 : 2, text);
+            continue;
+        }
+        if (/^(?:-{3,}|\*{3,}|_{3,})$/.test(line) || line.startsWith("|")) {
+            flush();
+            continue;
+        }
+        if (LIST_MARKER.test(line)) {
+            flush();
+            currentIsList = true;
+        }
+        current.push(line.replace(LIST_MARKER, ""));
+    }
+    flush();
+    const h2 = headings.filter((h) => h.startsWith("2:")).map((h) => h.slice(2));
+    const map = (h2.length ? h2 : headings.map((h) => h.slice(2))).filter(Boolean);
+    return { pinned: null, units, map };
+}
+/** Fit parsed material to a cap. Null when there is nothing to say — which
+ *  does not depend on the cap, so a block can count digestible entries
+ *  before it knows each one's share. */
+export function assembleSkillDigest(parsed, maxChars = SKILL_DIGEST_MAX_CHARS) {
+    if (!parsed)
+        return null;
+    if (parsed.pinned)
+        return truncate(parsed.pinned, maxChars);
+    const { units, map } = parsed;
+    if (units.length === 0 && map.length === 0)
+        return null;
+    let out = "";
+    let section = null;
+    for (const unit of units) {
+        // The heading is spent only where the section changes, so a run of
+        // bullets under one heading pays for it once.
+        const text = unit.section && unit.section !== section ? `${unit.section}: ${unit.text}` : unit.text;
+        if (!out) {
+            out = truncate(text, maxChars);
+            section = unit.section;
+            continue;
+        }
+        if (out.length + 1 + text.length > maxChars)
+            break;
+        out = `${out} ${text}`;
+        section = unit.section;
+    }
+    if (map.length) {
+        const sections = `Sections: ${map.join(" · ")}.`;
+        if (!out)
+            out = truncate(sections, maxChars);
+        else if (out.length + 1 + sections.length <= maxChars)
+            out = `${out} ${sections}`;
+        else if (maxChars - out.length - 1 >= 40)
+            out = `${out} ${truncate(sections, maxChars - out.length - 1)}`;
+    }
+    // Units were made inert one by one; the joins above are a new string, so
+    // it is made inert as a whole too (a `*` closing across a join, say).
+    // Every rule in inertLine shortens or preserves length, so this cannot
+    // push the digest back over maxChars.
+    return inertLine(out) || null;
+}
+/** A document that opens a frontmatter fence and never closes it — a
+ *  materialization cut off mid-header. `splitSkillFrontmatter` hands the
+ *  whole document back as the body in that case (right for the inline
+ *  path, which shows the file as it is); for a one-line digest that would
+ *  present the YAML — name, description, the on-device `prompt_triggers`
+ *  patterns — as the rule in force. It is not a body. */
+export function hasUnclosedFrontmatter(raw) {
+    const text = (raw ?? "").trim();
+    // The opener must be followed by a `key:`-shaped line — the first
+    // non-whitespace text after it decides, blank lines are skipped: a body
+    // that opens with a horizontal rule and then a heading or `Rule one.` is
+    // still a body. A body whose first text after the rule happens to be
+    // key-shaped (`Note: …`, with or without a blank line between) reads as an
+    // unclosed header — a deliberate false positive that fails toward "no
+    // digest", never toward presenting YAML as a rule (round-11/12 review).
+    return /^---\r?\n\s*[A-Za-z_][\w-]*\s*:/.test(text) && text.indexOf("\n---", 3) === -1;
+}
+/** Parse a raw SKILL.md once: frontmatter `digest:` when pinned, else the
+ *  body's material. Null for no source, or for a truncated one. */
+export function parseSkillDigest(raw) {
+    if (!raw)
+        return null;
+    // The cap is applied first so a fence that closes beyond it reads as
+    // unclosed — the same slice is what gets split.
+    const source = raw.slice(0, SKILL_DIGEST_SOURCE_MAX_CHARS);
+    if (hasUnclosedFrontmatter(source))
+        return null;
+    const { frontmatter, body } = splitSkillFrontmatter(source);
+    const pinned = readFrontmatterDigest(frontmatter);
+    if (pinned)
+        return { pinned: inertLine(pinned), units: [], map: [] };
+    return parseSkillDigestBody(body);
+}
+/** Frontmatter `digest:` when pinned, else derived from the body. */
+export function skillDigestFromSource(raw, maxChars = SKILL_DIGEST_MAX_CHARS) {
+    return assembleSkillDigest(parseSkillDigest(raw), maxChars);
+}
+const HEADER_LEAD = "📖 Protected floor — rules in force this session";
+/** Line tail for a name whose body says nothing digestible (not on this
+ *  machine, or all fences and tables). The rule is still in force — the
+ *  server named it — so the line says why it is bare instead of looking like
+ *  a skill with nothing to say. */
+export const SKILL_DIGEST_UNAVAILABLE = "digest unavailable; read the full skill";
+/**
+ * Render the block, or null when the budget cannot carry a useful digest for
+ * every digestible name — a floor whose lines were squeezed below
+ * SKILL_DIGEST_MIN_CHARS would be names with punctuation, so the caller keeps
+ * its name-only line instead. A name whose body cannot be digested at any
+ * budget still renders, marked SKILL_DIGEST_UNAVAILABLE, so an absent rule is
+ * never mistaken for a silent one. The per-skill cap is derived from the
+ * budget BEFORE digesting, so the derivation fits its rules and section map
+ * to the room it actually has instead of being cut a second time; one long
+ * body cannot starve the rest; the result never exceeds maxChars.
+ */
+export function renderFloorDigestBlock(entries, options) {
+    if (entries.length === 0 || options.maxChars <= 0)
+        return null;
+    const prefix = options.linePrefix ?? "";
+    const root = options.skillsRoot ? ` (full text: ${options.skillsRoot}/‹name›/SKILL.md)` : "";
+    const header = `${prefix}- ${HEADER_LEAD}${root}:`;
+    // Parse each body exactly once; the share is derived from how many can say
+    // anything at all, which the assembler decides independently of the cap.
+    const parsed = entries.map((e) => parseSkillDigest(e.source));
+    const digestible = parsed.map((p) => assembleSkillDigest(p) !== null);
+    const withBody = digestible.filter(Boolean).length;
+    if (withBody === 0)
+        return null;
+    // Every char that is not digest: the per-line chrome, the newline, and the
+    // full marker line for a name that gets no digest at all.
+    const chrome = entries.reduce((sum, e, i) => sum + `${prefix}  - ${e.name} — `.length + (digestible[i] ? 0 : SKILL_DIGEST_UNAVAILABLE.length) + 1, 0);
+    const perSkill = Math.min(SKILL_DIGEST_MAX_CHARS, Math.floor((options.maxChars - header.length - 1 - chrome) / withBody));
+    if (perSkill < SKILL_DIGEST_MIN_CHARS)
+        return null;
+    const lines = [header];
+    entries.forEach((entry, index) => {
+        const digest = digestible[index] ? assembleSkillDigest(parsed[index], perSkill) : null;
+        lines.push(`${prefix}  - ${entry.name} — ${digest ?? SKILL_DIGEST_UNAVAILABLE}`);
+    });
+    // The bound is the arithmetic above: header + chrome + withBody × perSkill
+    // ≤ maxChars, and a digest never exceeds its cap. There is deliberately no
+    // post-hoc `length <= maxChars ? block : null` guard — one turned a
+    // budgeting slip into a silently missing floor that the budget sweep could
+    // not see (the mutant survived); the sweep asserts the bound directly.
+    return lines.join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.17.3",
+  "version": "20.18.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",