prism-mcp-server 20.18.0 → 20.18.1

package/README.md

@@ -86,14 +86,18 @@ behind it are in the
 Prism also ships as a plugin, which registers the MCP server and the startup
 skill for you.
 
-**Claude Code** — from the community marketplace:
+Both hosts install straight from this repository. There is nothing to host and
+no server to run: the catalogue is the `.claude-plugin/marketplace.json` file
+committed here, and your client clones it from GitHub.
+
+**Claude Code:**
 
 ```bash
-/plugin marketplace add anthropics/claude-plugins-community
-/plugin install prism-coder@claude-community
+claude plugin marketplace add dcostenco/prism-coder
+claude plugin install prism-coder@prism
 ```
 
-**Codex** — this repository is itself a plugin marketplace:
+**Codex:**
 
 ```bash
 codex plugin marketplace add dcostenco/prism-coder
@@ -141,6 +145,36 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.18.1
+
+### Task skills survive compaction and update in place
+
+- **Prompt-routed task skills now return after compaction.** The hook restores
+  the three most recently active task skills alongside the protected-floor
+  digest, so a short follow-up such as `continue` keeps the workflow and visual
+  verification rules that governed the work before context was compacted.
+- **A completed managed-skill sync refreshes active task rules on the next
+  prompt.** The hook compares the materialized generation on disk with its
+  per-session state, re-authorizes every restored name against the current
+  manifest, and injects the current bodies. A downgrade clears stale paid task
+  state; Prism-managed directories cannot use the user-owned local-skill
+  exception.
+- **User-owned local skills now route with their actual body.** A local
+  `SKILL.md` remains usable while signed out, while an entitled platform body
+  takes precedence if both sources use the same name.
+- **Codex hook context is anchored to the user's request.** Routed rules tell
+  the model to execute the preceding user request with the rules applied,
+  avoiding the trailing developer-context placement being mistaken for a new
+  task. The anchor and all restored content share the 9,800-character limit.
+- **Hook version 5 enforces its command version.** A still-running host with a
+  trusted v4 command cannot execute the rewritten v5 script. After upgrading,
+  run `prism connect --refresh --no-models`; Codex must trust both new v5 hook
+  entries in `/hooks`. Restart the host if it has not reloaded the new hook
+  definitions. Once v5 is active, later skill-body generations refresh on the
+  next prompt without another host restart.
+- State names are validated and bounded before they become CLI arguments, and
+  the two-call refresh paths fit inside the host's 15-second hook timeout.
+
 ## What's New in v20.18.0
 
 ### The protected floor rides the bootstrap — and survives compaction
@@ -1434,27 +1468,32 @@ Prism works alongside these tools — use whichever fits your workflow.
 
 ### Web IDE — Prism Coder
 
-A browser-based IDE at [synalux.ai/coder](https://synalux.ai/coder). Import any GitHub repo and get:
+Open [synalux.ai/coder](https://synalux.ai/coder), sign in, connect GitHub, and import a repository you can access. Select a branch, open a file, edit, and save back to GitHub.
 
-- **Monaco editor** with multi-tab, split view, syntax highlighting, and VS Code keybindings
-- **In-browser Node.js** via WebContainer (your code runs in the browser sandbox, not on a server)
-- **Integrated terminal** — WebContainer shell in-browser; optional server PTY via WebSocket when connected to a dev server
-- **AI Agent Mode** — describe a task and the agent creates files, runs type-checks, and verifies
-- **Source control** — commit, branch, push/pull, stash, blame, tag management
-- **Live Share** — real-time collaborative editing with session links
-- **Node.js debugger** via Chrome DevTools Protocol
-- **Tasks runner** (VS Code `tasks.json` compatible), **Problems panel** (Monaco diagnostics)
-- **12-language i18n** — full UI localization
+- **Monaco editor** — multiple tabs, split view, syntax highlighting, and familiar VS Code keybindings.
+- **GitHub editing** — branch selection, file saves, history, and conflict protection. If a file changes remotely, a conflicting save keeps your local draft for recovery. Binary renames preserve bytes, and Unicode paths are supported.
+- **AI Agent Mode** — describe a task, review proposed file changes, apply selected changes, and save on an isolated agent branch. Rollback discards that branch and returns to your previous work.
+- **Live Share** — start a session and share its invite with repository members for synchronized edits and labeled remote cursors. First-party signaling is enabled on the hosted IDE.
+- **In-browser Node.js and terminal** — WebContainer runs package scripts and previews when the browser supports its runtime. The optional server PTY and Node.js debugger require a connected development server.
+- **Tasks and diagnostics** — a `tasks.json` runner and a Problems panel for Monaco diagnostics; localized interface strings are available in 12 languages.
 
-<p align="center">
-  <img src="docs/screenshots/agent-mode.png" alt="Prism Coder IDE — Agent Mode creating a component with auto-fix and type-checking" width="500" />
-</p>
+**Production session, September 8, 2026.** The following screenshots were captured from the live IDE using a private test repository. The session exercised GitHub import/save, conflict recovery, binary rename, Unicode files, Agent review/apply/save/rollback, and Live Share text and cursors in both directions.
 
-<p align="center">
-  <img src="docs/screenshots/collaboration.png" alt="Prism Coder IDE — Live Share with team members and real-time cursor tracking" width="500" />
-</p>
+**Review an Agent proposal before applying it.** The diff below proposes a new `add(a, b)` function. Selected changes were then applied and the exact file was saved to the agent branch; rollback was checked afterward.
+
+![Live Coder Agent diff showing a proposed add function and Apply selected changes](docs/screenshots/coder-agent-diff-20260908.png)
+
+**Keep your draft when a remote edit conflicts.** The status bar reports the conflict while the unsaved local edit remains in the editor. Draft recovery was also checked after reloading.
+
+![Coder file editor retaining an unsaved draft with a remote-change conflict message](docs/screenshots/coder-conflict-draft-20260908.png)
+
+**See collaborators' edits and cursors.** The host receives the guest's edit and cursor in the first capture. The guest receives the host's return edit and cursor in the second. These captures show two Safari tabs using the same authorized account; separate-user and cross-device connections were not covered by this run.
+
+![Live Share host with two participants and the guest cursor on a synchronized edit](docs/screenshots/coder-liveshare-host-20260908.png)
+
+![Live Share guest receiving the host return edit and labeled remote cursor](docs/screenshots/coder-liveshare-guest-20260908.png)
 
-Standard+ plans get cloud AI and higher rate limits. Free tier works with local Ollama. Code execution uses the in-browser WebContainer by default; Live Share and the optional PTY terminal connect to external servers when explicitly enabled.
+**Runtime requirements.** Chrome or Edge is recommended for WebContainer package installation, tests, and previews; see [WebContainer browser support](https://developer.stackblitz.com/platform/webcontainers/browser-support). Safari editing and the workflows shown above were exercised, but npm installation still failed in this Safari session. Successful editing does not establish successful code execution. Agent test and type-check execution also depends on the runtime. Cloud AI requires the applicable plan and configured service; local Ollama requires an explicit connection.
 
 ### VS Code Extension — Synalux
 

package/dist/cli.js

@@ -531,7 +531,11 @@ program
         const shaped = result.names.length > 0
             ? reshapeForInlineBudget(result, HOOK_INLINE_SAFE_CHARS, writeRouteOffload)
             : { text: '' };
-        const payload = JSON.stringify({ names: result.names, text: result.names.length > 0 ? shaped.text : '' });
+        const payload = JSON.stringify({
+            names: result.names,
+            alreadyLoaded: result.alreadyLoaded,
+            text: result.names.length > 0 ? shaped.text : '',
+        });
         await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
     }
     catch {
@@ -546,6 +550,41 @@ program
         process.exit(0);
     }
 });
+// Re-inject the most recently active task skills after the host discards its
+// transcript, or immediately after a new managed manifest reaches disk. Names
+// are re-authorized against the cached manifest before any body is returned.
+program
+    .command('reinject-skills')
+    .description('Render previously active, still-entitled skills for the host hook.')
+    .requiredOption('--names <names>', 'Comma-separated skill names from the hook session state')
+    .option('--budget <chars>', 'Maximum inline characters', String(9_800))
+    .action(async (options) => {
+    try {
+        const names = options.names.split(',').map((name) => name.trim()).filter(Boolean);
+        const requestedBudget = Number.parseInt(options.budget ?? '', 10);
+        const { runNamedSkillRouteFromCache } = await import('./tools/ledgerHandlers.js');
+        const { reshapeForInlineBudget, HOOK_INLINE_SAFE_CHARS } = await import('./tools/promptRouteHandler.js');
+        const budget = Number.isFinite(requestedBudget)
+            ? Math.max(256, Math.min(HOOK_INLINE_SAFE_CHARS, requestedBudget))
+            : HOOK_INLINE_SAFE_CHARS;
+        const result = await runNamedSkillRouteFromCache(names);
+        const shaped = result.names.length > 0
+            ? reshapeForInlineBudget(result, budget, writeRouteOffload)
+            : { text: '' };
+        const payload = JSON.stringify({ ok: true, names: result.names, text: result.names.length > 0 ? shaped.text : '' });
+        await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
+    }
+    catch {
+        await new Promise((resolveWrite) => process.stdout.write('{"ok":false,"names":[],"text":""}\n', () => resolveWrite()));
+    }
+    finally {
+        try {
+            await closeStorage();
+        }
+        catch { /* exit anyway */ }
+        process.exit(0);
+    }
+});
 // ── floor-digest ──────────────────────────────────────────────
 // Called by the same hook on SessionStart with source "compact": the host
 // just discarded the bootstrap along with the rest of the transcript, and

package/dist/promptRouteHostHook.js

@@ -40,7 +40,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSy
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 /** Bump to force the on-disk script to be rewritten on the next ensure. */
-export const PROMPT_ROUTE_HOOK_VERSION = "4";
+export const PROMPT_ROUTE_HOOK_VERSION = "5";
 /** SessionStart matcher: only the post-compaction fire carries the digest.
  *  The script re-checks `source` itself, so a host that ignores matchers on
  *  this event still injects nothing at startup/resume. */
@@ -52,7 +52,8 @@ const HOOK_DIR = "prism-route";
 const COMMAND_SIGNATURE = `${HOOK_DIR}/${SCRIPT_FILE}`;
 /**
  * The command registered in the host config carries the version as an
- * argument (the script ignores argv — it reads stdin). This is a SECURITY
+ * argument. The script reads stdin for the hook payload and rejects a stale
+ * version argument before executing routing logic. This is a SECURITY
  * property, found by an external probe of Codex 0.146: Codex's hook-trust
  * hash covers the CONFIGURED DEFINITION, not the file the command points at.
  * With a stable command and a version-refreshed script, every prism upgrade
@@ -94,13 +95,27 @@ import shutil
 import subprocess
 import sys
 
+INLINE_CONTEXT_CAP = 9800
+CLI_TIMEOUT_SECONDS = 6
+MAX_STATE_SKILLS = 500
+SKILL_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,127}$")
+TASK_CONTEXT_ANCHOR = (
+    "[Context attached to the user's request above. Do not acknowledge this context separately. "
+    "Execute the user's request now, applying the following task rules.]"
+)
+
+
+def content_cap():
+    return INLINE_CONTEXT_CAP - len(TASK_CONTEXT_ANCHOR) - 2
+
 
 def emit(extra=None, event="UserPromptSubmit"):
     out = {"continue": True, "suppressOutput": True}
     if extra:
+        anchored = TASK_CONTEXT_ANCHOR + "\\n\\n" + extra[:content_cap()]
         out["hookSpecificOutput"] = {
             "hookEventName": event,
-            "additionalContext": extra,
+            "additionalContext": anchored,
         }
     print(json.dumps(out))
 
@@ -113,7 +128,7 @@ def run_cli_json(cli, args, stdin_text=""):
             input=stdin_text,
             capture_output=True,
             text=True,
-            timeout=10,
+            timeout=CLI_TIMEOUT_SECONDS,
         )
     except Exception:
         return None
@@ -145,6 +160,70 @@ def session_state_path(payload):
     return state_dir, os.path.join(state_dir, session + ".json")
 
 
+def read_state(state_path):
+    try:
+        with open(state_path) as fh:
+            value = json.load(fh)
+    except Exception:
+        return {"generation": "", "names": []}
+    if isinstance(value, list):
+        return {"generation": "", "names": clean_names(value)}
+    if not isinstance(value, dict):
+        return {"generation": "", "names": []}
+    generation = value.get("generation") if isinstance(value.get("generation"), str) else ""
+    names = value.get("names") if isinstance(value.get("names"), list) else []
+    return {"generation": generation, "names": clean_names(names)}
+
+
+def clean_names(values):
+    kept = []
+    seen = set()
+    for value in values:
+        if not isinstance(value, str) or not SKILL_NAME_RE.fullmatch(value) or value in seen:
+            continue
+        kept.append(value)
+        seen.add(value)
+    return kept[-MAX_STATE_SKILLS:]
+
+
+def write_state(state_dir, state_path, generation, names):
+    temp_path = state_path + ".tmp-" + str(os.getpid())
+    try:
+        os.makedirs(state_dir, exist_ok=True)
+        with open(temp_path, "w") as fh:
+            json.dump({"generation": generation, "names": names}, fh)
+        os.replace(temp_path, state_path)
+    except Exception:
+        try:
+            os.remove(temp_path)
+        except Exception:
+            pass
+
+
+def current_generation():
+    override = os.environ.get("PRISM_ROUTE_SKILLS_INDEX")
+    index_path = override or os.path.expanduser("~/.agents/skills/.prism-managed-skills.json")
+    try:
+        with open(index_path) as fh:
+            value = json.load(fh)
+        generation = value.get("generation") if isinstance(value, dict) else ""
+        return generation if isinstance(generation, str) else ""
+    except Exception:
+        return ""
+
+
+def reinject(cli, names, budget):
+    selected = names[-3:]
+    if not selected or budget < 256:
+        return {"ok": True, "names": [], "text": ""}
+    data = run_cli_json(cli, [
+        "reinject-skills", "--names", ",".join(selected), "--budget", str(budget)
+    ])
+    if not isinstance(data, dict) or data.get("ok") is not True:
+        return {"ok": False, "names": [], "text": ""}
+    return data
+
+
 def payload_field(payload, *keys):
     """First non-empty string among alternative spellings of one field.
 
@@ -175,24 +254,32 @@ def on_session_start(payload):
     if not source.startswith("compact"):
         emit(event="SessionStart")
         return
-    # The skills injected before compaction are gone with it; forget the
-    # dedupe list so the next matching prompt can bring them back.
     state_dir, state_path = session_state_path(payload)
-    try:
-        os.remove(state_path)
-    except Exception:
-        pass
+    state = read_state(state_path)
+    generation = current_generation()
     cli = find_cli()
     if not cli:
         emit(event="SessionStart")
         return
     data = run_cli_json(cli, ["floor-digest"])
-    text = (data or {}).get("text") or ""
-    names = [n for n in ((data or {}).get("names") or []) if isinstance(n, str)]
-    if not names or not isinstance(text, str) or not text:
-        emit(event="SessionStart")
-        return
-    emit(text, event="SessionStart")
+    raw_floor_text = (data or {}).get("text") or ""
+    floor_names = clean_names((data or {}).get("names") or [])
+    floor_text = raw_floor_text if floor_names and isinstance(raw_floor_text, str) else ""
+    remaining = content_cap() - len(floor_text) - (2 if floor_text else 0)
+    restored = reinject(cli, state["names"], remaining)
+    restored_names = clean_names(restored.get("names") or [])
+    restored_text = restored.get("text") if isinstance(restored.get("text"), str) else ""
+    # If the floor consumes the whole host budget or the CLI fails, keep the
+    # names but leave the generation stale so the next prompt retries. A
+    # successful empty result means the current entitlement revoked them.
+    if remaining < 256 and state["names"]:
+        write_state(state_dir, state_path, "", state["names"])
+    elif restored.get("ok") is not True:
+        write_state(state_dir, state_path, "", state["names"])
+    else:
+        write_state(state_dir, state_path, generation, restored_names)
+    combined = "\\n\\n".join(part for part in (floor_text, restored_text if restored_names else "") if part)
+    emit(combined[:content_cap()], event="SessionStart")
 
 
 def find_cli():
@@ -233,27 +320,59 @@ def main():
         or payload.get("user_prompt")
         or ""
     ).strip()
-    # Slash commands and micro-prompts ("ok", "merge") never route; skipping
-    # them keeps the common turn free.
-    if len(prompt) < 6 or prompt.startswith("/"):
+    state_dir, state_path = session_state_path(payload)
+    state = read_state(state_path)
+    loaded = state["names"]
+    generation = current_generation()
+    generation_changed = bool(loaded and generation and generation != state["generation"])
+
+    cli = find_cli()
+    if not cli:
+        emit()
+        return
+
+    # Slash commands never route. A micro-prompt normally stays free, but a
+    # just-materialized generation must replace any older task rules before
+    # even "continue" reaches the model.
+    if prompt.startswith("/"):
+        emit()
+        return
+    if len(prompt) < 6:
+        if generation_changed:
+            restored = reinject(cli, loaded, content_cap())
+            restored_names = clean_names(restored.get("names") or [])
+            restored_text = restored.get("text") if isinstance(restored.get("text"), str) else ""
+            if restored.get("ok") is True:
+                write_state(state_dir, state_path, generation, restored_names)
+            else:
+                write_state(state_dir, state_path, "", loaded)
+            if restored_names and restored_text:
+                emit(restored_text)
+                return
         emit()
         return
     # A pasted log can be megabytes; triggers live in the first human-sized
     # stretch, and the CLI caps identically on its side.
     prompt = prompt[:100_000]
 
-    state_dir, state_path = session_state_path(payload)
-    loaded = []
-    try:
-        with open(state_path) as fh:
-            data = json.load(fh)
-            if isinstance(data, list):
-                loaded = [n for n in data if isinstance(n, str)]
-    except Exception:
-        pass
-
-    cli = find_cli()
-    if not cli:
+    if generation_changed:
+        # Ask the normal matcher what this prompt needs, then rebuild one
+        # current-generation payload from the prior active set plus new hits.
+        # Emitting the matcher text directly would lose the old active rules
+        # whenever this prompt happened to match a different skill.
+        data = run_cli_json(cli, ["route-prompt", "--loaded", ""], prompt)
+        routed_names = clean_names((data or {}).get("names") or [])
+        active = [n for n in state["names"] if n not in routed_names] + routed_names
+        restored = reinject(cli, active, content_cap())
+        restored_names = clean_names(restored.get("names") or [])
+        restored_text = restored.get("text") if isinstance(restored.get("text"), str) else ""
+        if restored.get("ok") is True:
+            write_state(state_dir, state_path, generation, restored_names)
+        else:
+            write_state(state_dir, state_path, "", active)
+        if restored_names and restored_text:
+            emit(restored_text)
+            return
         emit()
         return
 
@@ -261,24 +380,27 @@ def main():
     if data is None:
         emit()
         return
-    names = [n for n in (data.get("names") or []) if isinstance(n, str)]
+    names = clean_names(data.get("names") or [])
     text = data.get("text") or ""
     if not names or not text:
+        touched = clean_names(data.get("alreadyLoaded") or [])
+        if touched and not generation_changed:
+            reordered = [n for n in loaded if n not in touched] + touched
+            write_state(state_dir, state_path, generation, reordered)
         emit()
         return
 
-    try:
-        os.makedirs(state_dir, exist_ok=True)
-        merged = loaded + [n for n in names if n not in loaded]
-        with open(state_path, "w") as fh:
-            json.dump(merged, fh)
-    except Exception:
-        pass  # dedupe degrades, injection still happens
+    touched = clean_names(data.get("alreadyLoaded") or [])
+    merged = [n for n in loaded if n not in touched and n not in names] + touched + names
+    write_state(state_dir, state_path, generation, clean_names(merged))
 
     emit(text)
 
 
 if __name__ == "__main__":
+    if "--v${PROMPT_ROUTE_HOOK_VERSION}" not in sys.argv[1:]:
+        print(json.dumps({"continue": True, "suppressOutput": True}))
+        sys.exit(0)
     try:
         main()
     except Exception:

package/dist/tools/ledgerHandlers.js

@@ -2074,6 +2074,7 @@ export async function collectSkillTriggersOnThisMachine() {
         // __proto__/constructor must be a plain data key, not an inherited read.
         const merged = Object.create(null);
         const localNames = new Set();
+        const localBodies = new Map();
         const errors = [];
         const settings = await getAllSettings();
         const bodies = [];
@@ -2105,8 +2106,12 @@ export async function collectSkillTriggersOnThisMachine() {
             for (const [pattern, names] of Object.entries(local.triggers)) {
                 (merged[pattern] ||= []).push(...names);
             }
-            for (const name of local.names)
+            for (const name of local.names) {
                 localNames.add(name);
+                const body = local.bodies.get(name);
+                if (body)
+                    localBodies.set(name, body);
+            }
             errors.push(...local.errors);
         }
         catch (error) {
@@ -2117,7 +2122,7 @@ export async function collectSkillTriggersOnThisMachine() {
             // feature fixes — a skill that is installed and never fires.
             debugLog(`[skill-triggers] ignored trigger in "${error.skill}": ${error.reason}`);
         }
-        return Object.keys(merged).length > 0 ? { triggers: merged, localNames } : undefined;
+        return Object.keys(merged).length > 0 ? { triggers: merged, localNames, localBodies } : undefined;
     }
     catch (error) {
         debugLog(`[skill-triggers] collection failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -2170,6 +2175,39 @@ export async function runPromptRouteFromCache(prompt, loaded) {
         },
     });
 }
+/**
+ * Rebuild task-specific hook context after compaction or a manifest update.
+ *
+ * The names came from this hook session's prior, entitlement-checked route.
+ * They still pass through the current cached entitlement set so a downgrade
+ * cannot resurrect a paid skill from stale hook state. This deliberately uses
+ * routePrompt's normal delivery and budget logic instead of reading native
+ * files in the host hook.
+ */
+export async function runNamedSkillRouteFromCache(names) {
+    const safeNames = [...new Set(names.filter((name) => NATIVE_SKILL_NAME.test(name)))];
+    if (safeNames.length === 0) {
+        return { names: [], alreadyLoaded: [], overflow: [], text: "No skills supplied — nothing to re-inject." };
+    }
+    const { routePrompt } = await import("./promptRouteHandler.js");
+    const { _setStorage } = await import("./skillRouting.js");
+    _setStorage(async (key, value) => { await setSetting(key, value); }, async (key) => getSetting(key, ""));
+    return routePrompt("restore task-specific skills after compaction", [], {
+        resolvePromptSkillNames: async () => safeNames,
+        collectTriggers: collectSkillTriggersOnThisMachine,
+        entitledNames: async () => {
+            try {
+                const parsed = JSON.parse(await getSetting("skill_manifest:names", "[]"));
+                return new Set(Array.isArray(parsed) ? parsed.filter((name) => typeof name === "string") : []);
+            }
+            catch {
+                return new Set();
+            }
+        },
+        getBody: (name) => getSetting(`skill:${name}`, ""),
+        manifestVersion: async () => undefined,
+    });
+}
 export async function sessionRoutePromptHandler(args) {
     const input = (typeof args === "object" && args !== null && !Array.isArray(args) ? args : {});
     const prompt = typeof input.prompt === "string" ? input.prompt : "";

package/dist/tools/promptRouteHandler.js

@@ -87,7 +87,13 @@ export async function routePrompt(prompt, loaded, deps) {
     const delivered = [];
     let budget = MAX_ROUTED_CHARS;
     for (const name of selected) {
-        const body = (await deps.getBody(name).catch(() => "")).trim();
+        // Select by the authorization source, not by which body happens to be
+        // non-empty. Otherwise an unentitled local same-name skill could expose a
+        // stale paid body left in the cache after a downgrade.
+        const platformAuthorized = entitled.has(name);
+        const body = (platformAuthorized
+            ? await deps.getBody(name).catch(() => "")
+            : scoped?.localBodies?.get(name) ?? "").trim();
         if (!body) {
             // Routed but undeliverable is the exact defect this feature exists to
             // surface. Say so rather than returning a name with nothing behind it.

package/dist/tools/scopedSkillTriggers.js

@@ -182,8 +182,17 @@ export function extractSkillTriggers(skillName, content) {
  */
 const MAX_LOCAL_SKILLS = 300;
 const MAX_LOCAL_FILE_BYTES = 64 * 1024;
+const MANAGED_SKILL_MARKER = ".prism-managed.json";
+const MANAGED_SKILL_INDEX = ".prism-managed-skills.json";
+const MANAGED_SKILL_OWNER = "prism-skill-sync-v1";
+const LOCAL_SKILL_NAME = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 export async function collectLocalSkillTriggers(roots, fs, join) {
-    const merged = { triggers: Object.create(null), errors: [], names: [] };
+    const merged = {
+        triggers: Object.create(null),
+        errors: [],
+        names: [],
+        bodies: new Map(),
+    };
     let budget = MAX_LOCAL_SKILLS;
     const seen = new Set();
     for (const root of roots) {
@@ -194,6 +203,21 @@ export async function collectLocalSkillTriggers(roots, fs, join) {
         catch {
             continue; // root absent — normal
         }
+        const indexedManaged = new Set();
+        try {
+            const index = JSON.parse(await fs.readFile(join(root, MANAGED_SKILL_INDEX)));
+            if (index && typeof index === "object" && !Array.isArray(index)
+                && index.owner === MANAGED_SKILL_OWNER
+                && Array.isArray(index.skills)) {
+                for (const value of index.skills) {
+                    if (typeof value === "string" && LOCAL_SKILL_NAME.test(value))
+                        indexedManaged.add(value);
+                }
+            }
+        }
+        catch {
+            // A missing index is normal for a machine with user-owned skills only.
+        }
         for (const name of entries) {
             if (budget-- <= 0)
                 break;
@@ -209,8 +233,20 @@ export async function collectLocalSkillTriggers(roots, fs, join) {
                     continue;
                 seen.add(name);
                 const extracted = extractSkillTriggers(name, content);
-                if (Object.keys(extracted.triggers).length > 0)
+                let prismManaged = indexedManaged.has(name);
+                try {
+                    const marker = JSON.parse(await fs.readFile(join(root, name, MANAGED_SKILL_MARKER)));
+                    prismManaged ||= Boolean(marker && typeof marker === "object" && !Array.isArray(marker)
+                        && marker.owner === MANAGED_SKILL_OWNER);
+                }
+                catch {
+                    // No valid Prism marker means the directory is user-owned local
+                    // content and remains eligible for the local entitlement exception.
+                }
+                if (Object.keys(extracted.triggers).length > 0 && !prismManaged) {
                     merged.names.push(name);
+                    merged.bodies.set(name, content);
+                }
                 for (const [pattern, names] of Object.entries(extracted.triggers)) {
                     (merged.triggers[pattern] ||= []).push(...names);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.18.0",
+  "version": "20.18.1",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
@@ -24,6 +24,7 @@
     "chmod-bins": "node -e \"['dist/cli.js','dist/server.js','dist/utils/universalImporter.js'].forEach(f => { try { require('fs').chmodSync(f, 0o755); } catch (e) { console.warn('chmod skipped', f, e.message); } })\"",
     "prepublishOnly": "node scripts/check-no-private-content.mjs && node scripts/check-publish-clean.mjs && npm run build",
     "lint:dashboard": "node scripts/lint-dashboard-es5.cjs",
+    "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "start": "node dist/server.js",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -78,11 +79,11 @@
   "overrides": {
     "@hono/node-server": "^2.0.5",
     "body-parser": "^2.3.0",
-    "fast-uri": "^3.1.4",
-    "hono": "^4.12.27",
+    "fast-uri": "^3.1.6",
+    "hono": "^4.13.5",
     "ip-address": "^10.2.0",
     "protobufjs": "^7.6.5",
-    "sharp": "^0.35.0",
+    "sharp": "^0.35.4",
     "tar": "^7.5.19",
     "nanoid": "^3.3.17"
   },
@@ -108,8 +109,9 @@
     "p-limit": "^7.3.0",
     "postcss": "8.5.23",
     "quickjs-emscripten": "^0.32.0",
-    "smol-toml": "^1.7.0",
-    "stream-json": "^2.0.0",
+    "smol-toml": "^1.7.1",
+    "stream-chain": "^4.2.5",
+    "stream-json": "^3.6.0",
     "tldts": "^7.0.27",
     "turndown": "^7.2.2",
     "zod": "^4.3.6"