prism-mcp-server 20.17.3 → 20.18.1

package/README.md

@@ -42,6 +42,9 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
   offline last-good recovery.
 - **Hook-free startup** — MCP metadata and native instructions request Prism's
   startup context without requiring lifecycle hooks or a Prism-owned launcher.
+  Where a host offers hooks (Claude Code, Codex), `prism connect` adds two
+  small ones on top: mid-session prompt routing, and a post-compaction
+  re-injection of the protected-floor digest.
 - **Safe escalation and observability** — inference outcomes are explicit,
   reserved content remains fail-closed, and local/cloud usage is recorded for
   review.
@@ -83,14 +86,18 @@ behind it are in the
 Prism also ships as a plugin, which registers the MCP server and the startup
 skill for you.
 
-**Claude Code** — from the community marketplace:
+Both hosts install straight from this repository. There is nothing to host and
+no server to run: the catalogue is the `.claude-plugin/marketplace.json` file
+committed here, and your client clones it from GitHub.
+
+**Claude Code:**
 
 ```bash
-/plugin marketplace add anthropics/claude-plugins-community
-/plugin install prism-coder@claude-community
+claude plugin marketplace add dcostenco/prism-coder
+claude plugin install prism-coder@prism
 ```
 
-**Codex** — this repository is itself a plugin marketplace:
+**Codex:**
 
 ```bash
 codex plugin marketplace add dcostenco/prism-coder
@@ -138,6 +145,88 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.18.1
+
+### Task skills survive compaction and update in place
+
+- **Prompt-routed task skills now return after compaction.** The hook restores
+  the three most recently active task skills alongside the protected-floor
+  digest, so a short follow-up such as `continue` keeps the workflow and visual
+  verification rules that governed the work before context was compacted.
+- **A completed managed-skill sync refreshes active task rules on the next
+  prompt.** The hook compares the materialized generation on disk with its
+  per-session state, re-authorizes every restored name against the current
+  manifest, and injects the current bodies. A downgrade clears stale paid task
+  state; Prism-managed directories cannot use the user-owned local-skill
+  exception.
+- **User-owned local skills now route with their actual body.** A local
+  `SKILL.md` remains usable while signed out, while an entitled platform body
+  takes precedence if both sources use the same name.
+- **Codex hook context is anchored to the user's request.** Routed rules tell
+  the model to execute the preceding user request with the rules applied,
+  avoiding the trailing developer-context placement being mistaken for a new
+  task. The anchor and all restored content share the 9,800-character limit.
+- **Hook version 5 enforces its command version.** A still-running host with a
+  trusted v4 command cannot execute the rewritten v5 script. After upgrading,
+  run `prism connect --refresh --no-models`; Codex must trust both new v5 hook
+  entries in `/hooks`. Restart the host if it has not reloaded the new hook
+  definitions. Once v5 is active, later skill-body generations refresh on the
+  next prompt without another host restart.
+- State names are validated and bounded before they become CLI arguments, and
+  the two-call refresh paths fit inside the host's 15-second hook timeout.
+
+## What's New in v20.18.0
+
+### The protected floor rides the bootstrap — and survives compaction
+
+- **`session_bootstrap` now inlines a digest of the protected floor** on
+  paid tiers at standard and deep depth: one inert line per rule, derived
+  from each skill's first paragraph (or its pinned `digest:`), plus its
+  section map, ~5.6K chars for the full floor. Small-context hosts such as
+  Codex were re-reading the sixteen SKILL.md files every session (median 8
+  re-reads / 36KB, worst 823 / 5.1MB in rollout logs) because the bootstrap
+  only *named* them. The digest is paid for on top of the context budget, so
+  the ledger/handoff share at every depth is byte-identical to before. Quick
+  depth stays names-only — the opt-out.
+- **A second hook re-injects the digest after compaction.** `prism connect`
+  registers the prism-route script on `SessionStart` matched to `compact`
+  (Claude Code and Codex); it runs `prism floor-digest`, which applies the
+  same tier and depth decisions as the bootstrap, and adds nothing on
+  startup/resume/clear. Hosts without hooks (Gemini, Cursor) still get the
+  digest on every bootstrap. **Codex: UNVERIFIED against a live compaction.**
+  The hook is registered and the script accepts the documented payload
+  spellings, but no Codex compaction has been observed end-to-end; on a
+  payload it does not recognise it re-injects nothing rather than something
+  wrong. If the digest comes from a generation whose skill files never
+  finished syncing, the re-injected block carries the same STALE warning the
+  bootstrap shows.
+- **Codex trust is reported honestly after a hook rewrite.** Approvals are
+  keyed by definition hash, so a rewritten `hooks.json` — this release adds
+  the SessionStart entry — voids prior trust: connect prints AWAITING TRUST
+  for both entries instead of a green ✓ for a hook Codex would silently skip,
+  and trust recorded for an older hook version is never mistaken for current.
+- **A host config that no longer parses is left alone.** If
+  `~/.claude/settings.json` or `~/.codex/hooks.json` exists but is not valid
+  JSON, connect keeps it byte-identical, registers no hook there, and says so
+  — it no longer replaces the file with a minimal hooks-only one. The npm
+  postinstall notice says the same, instead of asking you to trust a Codex
+  hook it never registered.
+- Fixed: a symptom-routed skill whose closing frontmatter fence is its last
+  line was inlined with its YAML (triggers included) as if it were the rule.
+- Fixed: a digest line that crosses into a new section keeps that section's
+  heading in front of it — whatever opened the section (an H2, a mid-document
+  H1, an empty heading, a setext underline) — so "Delegate to" / "Do NOT
+  delegate" rules cannot read with the wrong polarity once joined. A skill
+  file on disk is used only when it digests: empty, cut off inside its
+  frontmatter, or frontmatter-only files fall back to the stored copy instead
+  of rendering YAML as the rule.
+- Fixed: on Windows, a Codex hook approval is recognised even though Codex
+  stores the path with escaped backslashes.
+- The publish gate now refuses release notes that run *ahead* of the package
+  version (CHANGELOG, README, translated READMEs) — reading the newest
+  version on the heading line, so a `v20.17.3 – v20.18.0` range counts as
+  20.18.0, and surviving a typographic apostrophe or a BOM.
+
 ## What's New in v20.17.3
 
 - **A plugin install can no longer enable the prompt-routing hook.** The
@@ -579,8 +668,8 @@ the host's final verification responsibility are unchanged.
 materializes entitled packages in the native `~/.agents/skills` directory
 before the command exits. Codex therefore sees the current skillset on its
 first launch instead of requiring a second restart. Prism rechecks the same
-snapshot at MCP startup, session load, and every five minutes—without host
-lifecycle hooks.
+snapshot at MCP startup, session load, and every five minutes—skill delivery
+never depends on a host lifecycle hook.
 
 On the first user turn, Prism's native skill, MCP metadata, and managed host
 instructions request one `session_bootstrap({})` call. Prism then uses the
@@ -613,7 +702,10 @@ sections from `~/CLAUDE.md`, preserves every other instruction, and installs a
 small ownership-marked native block that selects `session_bootstrap({})` on the
 first turn. User hooks, custom instruction sections, and near matches remain
 untouched; native skills and server-side reminders preserve those Prism
-features without host lifecycle hooks. Because hosts expose no native
+features without depending on host lifecycle hooks. On Claude Code and Codex
+connect additionally registers the prism-route script twice: on every prompt
+(mid-session skill routing) and on `SessionStart` matched to `compact` only
+(post-compaction protected-floor digest). Because hosts expose no native
 session-end callback, handoff at shutdown is instruction-driven rather than a
 guaranteed lifecycle event.
 
@@ -1376,27 +1468,32 @@ Prism works alongside these tools — use whichever fits your workflow.
 
 ### Web IDE — Prism Coder
 
-A browser-based IDE at [synalux.ai/coder](https://synalux.ai/coder). Import any GitHub repo and get:
+Open [synalux.ai/coder](https://synalux.ai/coder), sign in, connect GitHub, and import a repository you can access. Select a branch, open a file, edit, and save back to GitHub.
 
-- **Monaco editor** with multi-tab, split view, syntax highlighting, and VS Code keybindings
-- **In-browser Node.js** via WebContainer (your code runs in the browser sandbox, not on a server)
-- **Integrated terminal** — WebContainer shell in-browser; optional server PTY via WebSocket when connected to a dev server
-- **AI Agent Mode** — describe a task and the agent creates files, runs type-checks, and verifies
-- **Source control** — commit, branch, push/pull, stash, blame, tag management
-- **Live Share** — real-time collaborative editing with session links
-- **Node.js debugger** via Chrome DevTools Protocol
-- **Tasks runner** (VS Code `tasks.json` compatible), **Problems panel** (Monaco diagnostics)
-- **12-language i18n** — full UI localization
+- **Monaco editor** — multiple tabs, split view, syntax highlighting, and familiar VS Code keybindings.
+- **GitHub editing** — branch selection, file saves, history, and conflict protection. If a file changes remotely, a conflicting save keeps your local draft for recovery. Binary renames preserve bytes, and Unicode paths are supported.
+- **AI Agent Mode** — describe a task, review proposed file changes, apply selected changes, and save on an isolated agent branch. Rollback discards that branch and returns to your previous work.
+- **Live Share** — start a session and share its invite with repository members for synchronized edits and labeled remote cursors. First-party signaling is enabled on the hosted IDE.
+- **In-browser Node.js and terminal** — WebContainer runs package scripts and previews when the browser supports its runtime. The optional server PTY and Node.js debugger require a connected development server.
+- **Tasks and diagnostics** — a `tasks.json` runner and a Problems panel for Monaco diagnostics; localized interface strings are available in 12 languages.
 
-<p align="center">
-  <img src="docs/screenshots/agent-mode.png" alt="Prism Coder IDE — Agent Mode creating a component with auto-fix and type-checking" width="500" />
-</p>
+**Production session, September 8, 2026.** The following screenshots were captured from the live IDE using a private test repository. The session exercised GitHub import/save, conflict recovery, binary rename, Unicode files, Agent review/apply/save/rollback, and Live Share text and cursors in both directions.
 
-<p align="center">
-  <img src="docs/screenshots/collaboration.png" alt="Prism Coder IDE — Live Share with team members and real-time cursor tracking" width="500" />
-</p>
+**Review an Agent proposal before applying it.** The diff below proposes a new `add(a, b)` function. Selected changes were then applied and the exact file was saved to the agent branch; rollback was checked afterward.
+
+![Live Coder Agent diff showing a proposed add function and Apply selected changes](docs/screenshots/coder-agent-diff-20260908.png)
+
+**Keep your draft when a remote edit conflicts.** The status bar reports the conflict while the unsaved local edit remains in the editor. Draft recovery was also checked after reloading.
+
+![Coder file editor retaining an unsaved draft with a remote-change conflict message](docs/screenshots/coder-conflict-draft-20260908.png)
+
+**See collaborators' edits and cursors.** The host receives the guest's edit and cursor in the first capture. The guest receives the host's return edit and cursor in the second. These captures show two Safari tabs using the same authorized account; separate-user and cross-device connections were not covered by this run.
+
+![Live Share host with two participants and the guest cursor on a synchronized edit](docs/screenshots/coder-liveshare-host-20260908.png)
+
+![Live Share guest receiving the host return edit and labeled remote cursor](docs/screenshots/coder-liveshare-guest-20260908.png)
 
-Standard+ plans get cloud AI and higher rate limits. Free tier works with local Ollama. Code execution uses the in-browser WebContainer by default; Live Share and the optional PTY terminal connect to external servers when explicitly enabled.
+**Runtime requirements.** Chrome or Edge is recommended for WebContainer package installation, tests, and previews; see [WebContainer browser support](https://developer.stackblitz.com/platform/webcontainers/browser-support). Safari editing and the workflows shown above were exercised, but npm installation still failed in this Safari session. Successful editing does not establish successful code execution. Agent test and type-check execution also depends on the runtime. Cloud AI requires the applicable plan and configured service; local Ollama requires an explicit connection.
 
 ### VS Code Extension — Synalux
 

package/dist/cli.js

@@ -348,10 +348,16 @@ program
                             const { ensurePromptRouteHook } = await import('./promptRouteHostHook.js');
                             for (const r of ensurePromptRouteHook({ hosts: hookHosts, mode: 'explicit' })) {
                                 const state = r.script === 'unchanged' && r.config === 'unchanged' ? 'up to date' : 'installed';
-                                if (r.host === 'codex' && r.codexApproval === 'pending-or-unknown') {
+                                if (r.config === 'skipped-unparseable') {
+                                    // The file was left byte-identical on purpose: replacing
+                                    // it would have wiped the operator's own settings along
+                                    // with the syntax error.
+                                    console.log(`⚠ ${r.host}: ${r.configPath} is not valid JSON — prism-route hooks NOT registered; fix the file and re-run prism connect`);
+                                }
+                                else if (r.host === 'codex' && r.codexApproval === 'pending-or-unknown') {
                                     // Codex silently skips untrusted hooks — a green "installed"
                                     // here would be the "configured and inert" lie.
-                                    console.log(`⚠ codex: prism-route hook ${state}, AWAITING TRUST — run codex, then /hooks, and trust the entry ending prism-route/on_prompt.py`);
+                                    console.log(`⚠ codex: prism-route hook ${state}, AWAITING TRUST — run codex, then /hooks, and trust BOTH entries ending prism-route/on_prompt.py (UserPromptSubmit and SessionStart)`);
                                 }
                                 else if (r.host === 'codex' && r.codexApproval === 'state-present-unverifiable') {
                                     // Approvals are keyed by definition hash, whose algorithm is
@@ -362,7 +368,7 @@ program
                                     console.log(`− codex: prism-route hook ${state}; trust state exists but is not verifiable from here — confirm once in /hooks`);
                                 }
                                 else {
-                                    console.log(`✓ ${r.host}: prism-route prompt hook ${state} (${r.scriptPath})`);
+                                    console.log(`✓ ${r.host}: prism-route hooks ${state} — prompt routing + post-compaction floor (${r.scriptPath})`);
                                 }
                             }
                         }
@@ -525,7 +531,11 @@ program
         const shaped = result.names.length > 0
             ? reshapeForInlineBudget(result, HOOK_INLINE_SAFE_CHARS, writeRouteOffload)
             : { text: '' };
-        const payload = JSON.stringify({ names: result.names, text: result.names.length > 0 ? shaped.text : '' });
+        const payload = JSON.stringify({
+            names: result.names,
+            alreadyLoaded: result.alreadyLoaded,
+            text: result.names.length > 0 ? shaped.text : '',
+        });
         await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
     }
     catch {
@@ -540,6 +550,68 @@ program
         process.exit(0);
     }
 });
+// Re-inject the most recently active task skills after the host discards its
+// transcript, or immediately after a new managed manifest reaches disk. Names
+// are re-authorized against the cached manifest before any body is returned.
+program
+    .command('reinject-skills')
+    .description('Render previously active, still-entitled skills for the host hook.')
+    .requiredOption('--names <names>', 'Comma-separated skill names from the hook session state')
+    .option('--budget <chars>', 'Maximum inline characters', String(9_800))
+    .action(async (options) => {
+    try {
+        const names = options.names.split(',').map((name) => name.trim()).filter(Boolean);
+        const requestedBudget = Number.parseInt(options.budget ?? '', 10);
+        const { runNamedSkillRouteFromCache } = await import('./tools/ledgerHandlers.js');
+        const { reshapeForInlineBudget, HOOK_INLINE_SAFE_CHARS } = await import('./tools/promptRouteHandler.js');
+        const budget = Number.isFinite(requestedBudget)
+            ? Math.max(256, Math.min(HOOK_INLINE_SAFE_CHARS, requestedBudget))
+            : HOOK_INLINE_SAFE_CHARS;
+        const result = await runNamedSkillRouteFromCache(names);
+        const shaped = result.names.length > 0
+            ? reshapeForInlineBudget(result, budget, writeRouteOffload)
+            : { text: '' };
+        const payload = JSON.stringify({ ok: true, names: result.names, text: result.names.length > 0 ? shaped.text : '' });
+        await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
+    }
+    catch {
+        await new Promise((resolveWrite) => process.stdout.write('{"ok":false,"names":[],"text":""}\n', () => resolveWrite()));
+    }
+    finally {
+        try {
+            await closeStorage();
+        }
+        catch { /* exit anyway */ }
+        process.exit(0);
+    }
+});
+// ── floor-digest ──────────────────────────────────────────────
+// Called by the same hook on SessionStart with source "compact": the host
+// just discarded the bootstrap along with the rest of the transcript, and
+// this is the protected floor coming back in one line per rule. Same
+// contract as route-prompt — exit 0, one JSON line, cached DB and the local
+// skills root only. Fires once per compaction, never per prompt.
+program
+    .command('floor-digest')
+    .description('Print the protected-floor digest as {names, text} JSON. Used by the prism-route host hook after a context compaction.')
+    .action(async () => {
+    try {
+        const { renderProtectedFloorDigestForHook } = await import('./tools/ledgerHandlers.js');
+        const result = await renderProtectedFloorDigestForHook();
+        const payload = JSON.stringify({ names: result.names, text: result.text });
+        await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
+    }
+    catch {
+        await new Promise((resolveWrite) => process.stdout.write('{"names":[],"text":""}\n', () => resolveWrite()));
+    }
+    finally {
+        try {
+            await closeStorage();
+        }
+        catch { /* exit anyway */ }
+        process.exit(0);
+    }
+});
 program
     .command('load <project>')
     .description('Load session context for a project (same output as session_load_context MCP tool)')

package/dist/postinstall.js

@@ -23,9 +23,16 @@ try {
     // approval impossible to miss. Approval is per hook-version, not per
     // release: it recurs only when the hook script itself changes.
     const codex = results.find((r) => r.host === "codex");
-    if (codex && codex.codexApproval === "pending-or-unknown") {
+    if (codex && codex.config === "skipped-unparseable") {
+        // Nothing was registered, so there is nothing to trust: telling the
+        // operator to press t in /hooks would send them looking for an entry
+        // that does not exist. The file was left byte-identical on purpose.
+        console.error(`\n[prism] Codex ${codex.configPath} is not valid JSON — prism-route hooks NOT registered.\n` +
+            "[prism]   Fix the file, then run: prism connect --host codex\n");
+    }
+    else if (codex && codex.codexApproval === "pending-or-unknown") {
         console.error("\n[prism] Codex hook installed but NOT yet trusted — Codex silently skips it until you approve it once:\n" +
-            "[prism]   codex  ->  /hooks  ->  entry ending prism-route/on_prompt.py  ->  press t\n");
+            "[prism]   codex  ->  /hooks  ->  BOTH entries ending prism-route/on_prompt.py (UserPromptSubmit + SessionStart)  ->  press t\n");
     }
 }
 catch {