prism-mcp-server 20.18.0 → 20.18.2

package/README.md

@@ -86,14 +86,18 @@ behind it are in the
 Prism also ships as a plugin, which registers the MCP server and the startup
 skill for you.
 
-**Claude Code** — from the community marketplace:
+Both hosts install straight from this repository. There is nothing to host and
+no server to run: the catalogue is the `.claude-plugin/marketplace.json` file
+committed here, and your client clones it from GitHub.
+
+**Claude Code:**
 
 ```bash
-/plugin marketplace add anthropics/claude-plugins-community
-/plugin install prism-coder@claude-community
+claude plugin marketplace add dcostenco/prism-coder
+claude plugin install prism-coder@prism
 ```
 
-**Codex** — this repository is itself a plugin marketplace:
+**Codex:**
 
 ```bash
 codex plugin marketplace add dcostenco/prism-coder
@@ -141,6 +145,36 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.18.1
+
+### Task skills survive compaction and update in place
+
+- **Prompt-routed task skills now return after compaction.** The hook restores
+  the three most recently active task skills alongside the protected-floor
+  digest, so a short follow-up such as `continue` keeps the workflow and visual
+  verification rules that governed the work before context was compacted.
+- **A completed managed-skill sync refreshes active task rules on the next
+  prompt.** The hook compares the materialized generation on disk with its
+  per-session state, re-authorizes every restored name against the current
+  manifest, and injects the current bodies. A downgrade clears stale paid task
+  state; Prism-managed directories cannot use the user-owned local-skill
+  exception.
+- **User-owned local skills now route with their actual body.** A local
+  `SKILL.md` remains usable while signed out, while an entitled platform body
+  takes precedence if both sources use the same name.
+- **Codex hook context is anchored to the user's request.** Routed rules tell
+  the model to execute the preceding user request with the rules applied,
+  avoiding the trailing developer-context placement being mistaken for a new
+  task. The anchor and all restored content share the 9,800-character limit.
+- **Hook version 5 enforces its command version.** A still-running host with a
+  trusted v4 command cannot execute the rewritten v5 script. After upgrading,
+  run `prism connect --refresh --no-models`; Codex must trust both new v5 hook
+  entries in `/hooks`. Restart the host if it has not reloaded the new hook
+  definitions. Once v5 is active, later skill-body generations refresh on the
+  next prompt without another host restart.
+- State names are validated and bounded before they become CLI arguments, and
+  the two-call refresh paths fit inside the host's 15-second hook timeout.
+
 ## What's New in v20.18.0
 
 ### The protected floor rides the bootstrap — and survives compaction
@@ -1434,27 +1468,32 @@ Prism works alongside these tools — use whichever fits your workflow.
 
 ### Web IDE — Prism Coder
 
-A browser-based IDE at [synalux.ai/coder](https://synalux.ai/coder). Import any GitHub repo and get:
+Open [synalux.ai/coder](https://synalux.ai/coder), sign in, connect GitHub, and import a repository you can access. Select a branch, open a file, edit, and save back to GitHub.
 
-- **Monaco editor** with multi-tab, split view, syntax highlighting, and VS Code keybindings
-- **In-browser Node.js** via WebContainer (your code runs in the browser sandbox, not on a server)
-- **Integrated terminal** — WebContainer shell in-browser; optional server PTY via WebSocket when connected to a dev server
-- **AI Agent Mode** — describe a task and the agent creates files, runs type-checks, and verifies
-- **Source control** — commit, branch, push/pull, stash, blame, tag management
-- **Live Share** — real-time collaborative editing with session links
-- **Node.js debugger** via Chrome DevTools Protocol
-- **Tasks runner** (VS Code `tasks.json` compatible), **Problems panel** (Monaco diagnostics)
-- **12-language i18n** — full UI localization
+- **Monaco editor** — multiple tabs, split view, syntax highlighting, and familiar VS Code keybindings.
+- **GitHub editing** — branch selection, file saves, history, and conflict protection. If a file changes remotely, a conflicting save keeps your local draft for recovery. Binary renames preserve bytes, and Unicode paths are supported.
+- **AI Agent Mode** — describe a task, review proposed file changes, apply selected changes, and save on an isolated agent branch. Rollback discards that branch and returns to your previous work.
+- **Live Share** — start a session and share its invite with repository members for synchronized edits and labeled remote cursors. First-party signaling is enabled on the hosted IDE.
+- **In-browser Node.js and terminal** — WebContainer runs package scripts and previews when the browser supports its runtime. The optional server PTY and Node.js debugger require a connected development server.
+- **Tasks and diagnostics** — a `tasks.json` runner and a Problems panel for Monaco diagnostics; localized interface strings are available in 12 languages.
 
-<p align="center">
-  <img src="docs/screenshots/agent-mode.png" alt="Prism Coder IDE — Agent Mode creating a component with auto-fix and type-checking" width="500" />
-</p>
+**Production session, September 8, 2026.** The following screenshots were captured from the live IDE using a private test repository. The session exercised GitHub import/save, conflict recovery, binary rename, Unicode files, Agent review/apply/save/rollback, and Live Share text and cursors in both directions.
 
-<p align="center">
-  <img src="docs/screenshots/collaboration.png" alt="Prism Coder IDE — Live Share with team members and real-time cursor tracking" width="500" />
-</p>
+**Review an Agent proposal before applying it.** The diff below proposes a new `add(a, b)` function. Selected changes were then applied and the exact file was saved to the agent branch; rollback was checked afterward.
+
+![Live Coder Agent diff showing a proposed add function and Apply selected changes](docs/screenshots/coder-agent-diff-20260908.png)
+
+**Keep your draft when a remote edit conflicts.** The status bar reports the conflict while the unsaved local edit remains in the editor. Draft recovery was also checked after reloading.
+
+![Coder file editor retaining an unsaved draft with a remote-change conflict message](docs/screenshots/coder-conflict-draft-20260908.png)
+
+**See collaborators' edits and cursors.** The host receives the guest's edit and cursor in the first capture. The guest receives the host's return edit and cursor in the second. These captures show two Safari tabs using the same authorized account; separate-user and cross-device connections were not covered by this run.
+
+![Live Share host with two participants and the guest cursor on a synchronized edit](docs/screenshots/coder-liveshare-host-20260908.png)
+
+![Live Share guest receiving the host return edit and labeled remote cursor](docs/screenshots/coder-liveshare-guest-20260908.png)
 
-Standard+ plans get cloud AI and higher rate limits. Free tier works with local Ollama. Code execution uses the in-browser WebContainer by default; Live Share and the optional PTY terminal connect to external servers when explicitly enabled.
+**Runtime requirements.** Chrome or Edge is recommended for WebContainer package installation, tests, and previews; see [WebContainer browser support](https://developer.stackblitz.com/platform/webcontainers/browser-support). Safari editing and the workflows shown above were exercised, but npm installation still failed in this Safari session. Successful editing does not establish successful code execution. Agent test and type-check execution also depends on the runtime. Cloud AI requires the applicable plan and configured service; local Ollama requires an explicit connection.
 
 ### VS Code Extension — Synalux
 

package/dist/cli.js

@@ -531,7 +531,11 @@ program
         const shaped = result.names.length > 0
             ? reshapeForInlineBudget(result, HOOK_INLINE_SAFE_CHARS, writeRouteOffload)
             : { text: '' };
-        const payload = JSON.stringify({ names: result.names, text: result.names.length > 0 ? shaped.text : '' });
+        const payload = JSON.stringify({
+            names: result.names,
+            alreadyLoaded: result.alreadyLoaded,
+            text: result.names.length > 0 ? shaped.text : '',
+        });
         await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
     }
     catch {
@@ -546,6 +550,41 @@ program
         process.exit(0);
     }
 });
+// Re-inject the most recently active task skills after the host discards its
+// transcript, or immediately after a new managed manifest reaches disk. Names
+// are re-authorized against the cached manifest before any body is returned.
+program
+    .command('reinject-skills')
+    .description('Render previously active, still-entitled skills for the host hook.')
+    .requiredOption('--names <names>', 'Comma-separated skill names from the hook session state')
+    .option('--budget <chars>', 'Maximum inline characters', String(9_800))
+    .action(async (options) => {
+    try {
+        const names = options.names.split(',').map((name) => name.trim()).filter(Boolean);
+        const requestedBudget = Number.parseInt(options.budget ?? '', 10);
+        const { runNamedSkillRouteFromCache } = await import('./tools/ledgerHandlers.js');
+        const { reshapeForInlineBudget, HOOK_INLINE_SAFE_CHARS } = await import('./tools/promptRouteHandler.js');
+        const budget = Number.isFinite(requestedBudget)
+            ? Math.max(256, Math.min(HOOK_INLINE_SAFE_CHARS, requestedBudget))
+            : HOOK_INLINE_SAFE_CHARS;
+        const result = await runNamedSkillRouteFromCache(names);
+        const shaped = result.names.length > 0
+            ? reshapeForInlineBudget(result, budget, writeRouteOffload)
+            : { text: '' };
+        const payload = JSON.stringify({ ok: true, names: result.names, text: result.names.length > 0 ? shaped.text : '' });
+        await new Promise((resolveWrite) => process.stdout.write(payload + '\n', () => resolveWrite()));
+    }
+    catch {
+        await new Promise((resolveWrite) => process.stdout.write('{"ok":false,"names":[],"text":""}\n', () => resolveWrite()));
+    }
+    finally {
+        try {
+            await closeStorage();
+        }
+        catch { /* exit anyway */ }
+        process.exit(0);
+    }
+});
 // ── floor-digest ──────────────────────────────────────────────
 // Called by the same hook on SessionStart with source "compact": the host
 // just discarded the bootstrap along with the rest of the transcript, and

package/dist/config.js

@@ -8,7 +8,10 @@ import { fileURLToPath } from "node:url";
  * validates required ones, and exports them for use throughout the server.
  *
  * Environment variable guide:
- *   BRAVE_API_KEY          — (required) API key for Brave Search Pro. Get one at https://brave.com/search/api/
+ *   BRAVE_API_KEY          — (required for search) API key for Brave Search Pro, and the only
+ *                            thing search needs in fully-local operation. A configured Synalux
+ *                            account supplies it portal-side instead, so exactly one of the two
+ *                            is needed. Get one at https://brave.com/search/api/
  *   GOOGLE_API_KEY         — (optional) API key for Google AI Studio / Gemini. Enables paper analysis.
  *   BRAVE_ANSWERS_API_KEY  — (optional) API key for Brave Answers (AI grounding). Enables brave_answers tool.
  *   SUPABASE_URL           — (optional) Your Supabase project URL. Enables session memory tools.
@@ -18,9 +21,15 @@ import { fileURLToPath } from "node:url";
  *   VOYAGE_API_KEY         — (optional) Voyage AI API key for embeddings.
  *                            Set embedding_provider=voyage to use. https://dash.voyageai.com
  *
- * If a required key is missing, the process exits immediately.
- * If an optional key is missing, a warning is logged but the server continues
- * with reduced functionality (the corresponding tools will be unavailable).
+ * No key is enforced at startup. Nothing here calls process.exit, so a missing
+ * key never stops the server — it starts with reduced functionality and the
+ * affected tools error when they are actually called. Missing keys log a
+ * warning, except BRAVE_API_KEY, which warns only under PRISM_DEBUG_LOGGING.
+ *
+ * Said plainly because the old wording ("the process exits immediately") was
+ * describing behaviour no key has ever had, and read as a hard startup
+ * dependency on a Brave + Firecrawl pair — see issue #188, filed on exactly
+ * that premise.
  */
 // ─── Server Identity ──────────────────────────────────────────
 function resolveServerVersion() {

package/dist/promptRouteHostHook.js

@@ -40,7 +40,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSy
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 /** Bump to force the on-disk script to be rewritten on the next ensure. */
-export const PROMPT_ROUTE_HOOK_VERSION = "4";
+export const PROMPT_ROUTE_HOOK_VERSION = "5";
 /** SessionStart matcher: only the post-compaction fire carries the digest.
  *  The script re-checks `source` itself, so a host that ignores matchers on
  *  this event still injects nothing at startup/resume. */
@@ -52,7 +52,8 @@ const HOOK_DIR = "prism-route";
 const COMMAND_SIGNATURE = `${HOOK_DIR}/${SCRIPT_FILE}`;
 /**
  * The command registered in the host config carries the version as an
- * argument (the script ignores argv — it reads stdin). This is a SECURITY
+ * argument. The script reads stdin for the hook payload and rejects a stale
+ * version argument before executing routing logic. This is a SECURITY
  * property, found by an external probe of Codex 0.146: Codex's hook-trust
  * hash covers the CONFIGURED DEFINITION, not the file the command points at.
  * With a stable command and a version-refreshed script, every prism upgrade
@@ -94,13 +95,27 @@ import shutil
 import subprocess
 import sys
 
+INLINE_CONTEXT_CAP = 9800
+CLI_TIMEOUT_SECONDS = 6
+MAX_STATE_SKILLS = 500
+SKILL_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,127}$")
+TASK_CONTEXT_ANCHOR = (
+    "[Context attached to the user's request above. Do not acknowledge this context separately. "
+    "Execute the user's request now, applying the following task rules.]"
+)
+
+
+def content_cap():
+    return INLINE_CONTEXT_CAP - len(TASK_CONTEXT_ANCHOR) - 2
+
 
 def emit(extra=None, event="UserPromptSubmit"):
     out = {"continue": True, "suppressOutput": True}
     if extra:
+        anchored = TASK_CONTEXT_ANCHOR + "\\n\\n" + extra[:content_cap()]
         out["hookSpecificOutput"] = {
             "hookEventName": event,
-            "additionalContext": extra,
+            "additionalContext": anchored,
         }
     print(json.dumps(out))
 
@@ -113,7 +128,7 @@ def run_cli_json(cli, args, stdin_text=""):
             input=stdin_text,
             capture_output=True,
             text=True,
-            timeout=10,
+            timeout=CLI_TIMEOUT_SECONDS,
         )
     except Exception:
         return None
@@ -145,6 +160,70 @@ def session_state_path(payload):
     return state_dir, os.path.join(state_dir, session + ".json")
 
 
+def read_state(state_path):
+    try:
+        with open(state_path) as fh:
+            value = json.load(fh)
+    except Exception:
+        return {"generation": "", "names": []}
+    if isinstance(value, list):
+        return {"generation": "", "names": clean_names(value)}
+    if not isinstance(value, dict):
+        return {"generation": "", "names": []}
+    generation = value.get("generation") if isinstance(value.get("generation"), str) else ""
+    names = value.get("names") if isinstance(value.get("names"), list) else []
+    return {"generation": generation, "names": clean_names(names)}
+
+
+def clean_names(values):
+    kept = []
+    seen = set()
+    for value in values:
+        if not isinstance(value, str) or not SKILL_NAME_RE.fullmatch(value) or value in seen:
+            continue
+        kept.append(value)
+        seen.add(value)
+    return kept[-MAX_STATE_SKILLS:]
+
+
+def write_state(state_dir, state_path, generation, names):
+    temp_path = state_path + ".tmp-" + str(os.getpid())
+    try:
+        os.makedirs(state_dir, exist_ok=True)
+        with open(temp_path, "w") as fh:
+            json.dump({"generation": generation, "names": names}, fh)
+        os.replace(temp_path, state_path)
+    except Exception:
+        try:
+            os.remove(temp_path)
+        except Exception:
+            pass
+
+
+def current_generation():
+    override = os.environ.get("PRISM_ROUTE_SKILLS_INDEX")
+    index_path = override or os.path.expanduser("~/.agents/skills/.prism-managed-skills.json")
+    try:
+        with open(index_path) as fh:
+            value = json.load(fh)
+        generation = value.get("generation") if isinstance(value, dict) else ""
+        return generation if isinstance(generation, str) else ""
+    except Exception:
+        return ""
+
+
+def reinject(cli, names, budget):
+    selected = names[-3:]
+    if not selected or budget < 256:
+        return {"ok": True, "names": [], "text": ""}
+    data = run_cli_json(cli, [
+        "reinject-skills", "--names", ",".join(selected), "--budget", str(budget)
+    ])
+    if not isinstance(data, dict) or data.get("ok") is not True:
+        return {"ok": False, "names": [], "text": ""}
+    return data
+
+
 def payload_field(payload, *keys):
     """First non-empty string among alternative spellings of one field.
 
@@ -175,24 +254,32 @@ def on_session_start(payload):
     if not source.startswith("compact"):
         emit(event="SessionStart")
         return
-    # The skills injected before compaction are gone with it; forget the
-    # dedupe list so the next matching prompt can bring them back.
     state_dir, state_path = session_state_path(payload)
-    try:
-        os.remove(state_path)
-    except Exception:
-        pass
+    state = read_state(state_path)
+    generation = current_generation()
     cli = find_cli()
     if not cli:
         emit(event="SessionStart")
         return
     data = run_cli_json(cli, ["floor-digest"])
-    text = (data or {}).get("text") or ""
-    names = [n for n in ((data or {}).get("names") or []) if isinstance(n, str)]
-    if not names or not isinstance(text, str) or not text:
-        emit(event="SessionStart")
-        return
-    emit(text, event="SessionStart")
+    raw_floor_text = (data or {}).get("text") or ""
+    floor_names = clean_names((data or {}).get("names") or [])
+    floor_text = raw_floor_text if floor_names and isinstance(raw_floor_text, str) else ""
+    remaining = content_cap() - len(floor_text) - (2 if floor_text else 0)
+    restored = reinject(cli, state["names"], remaining)
+    restored_names = clean_names(restored.get("names") or [])
+    restored_text = restored.get("text") if isinstance(restored.get("text"), str) else ""
+    # If the floor consumes the whole host budget or the CLI fails, keep the
+    # names but leave the generation stale so the next prompt retries. A
+    # successful empty result means the current entitlement revoked them.
+    if remaining < 256 and state["names"]:
+        write_state(state_dir, state_path, "", state["names"])
+    elif restored.get("ok") is not True:
+        write_state(state_dir, state_path, "", state["names"])
+    else:
+        write_state(state_dir, state_path, generation, restored_names)
+    combined = "\\n\\n".join(part for part in (floor_text, restored_text if restored_names else "") if part)
+    emit(combined[:content_cap()], event="SessionStart")
 
 
 def find_cli():
@@ -233,27 +320,59 @@ def main():
         or payload.get("user_prompt")
         or ""
     ).strip()
-    # Slash commands and micro-prompts ("ok", "merge") never route; skipping
-    # them keeps the common turn free.
-    if len(prompt) < 6 or prompt.startswith("/"):
+    state_dir, state_path = session_state_path(payload)
+    state = read_state(state_path)
+    loaded = state["names"]
+    generation = current_generation()
+    generation_changed = bool(loaded and generation and generation != state["generation"])
+
+    cli = find_cli()
+    if not cli:
+        emit()
+        return
+
+    # Slash commands never route. A micro-prompt normally stays free, but a
+    # just-materialized generation must replace any older task rules before
+    # even "continue" reaches the model.
+    if prompt.startswith("/"):
+        emit()
+        return
+    if len(prompt) < 6:
+        if generation_changed:
+            restored = reinject(cli, loaded, content_cap())
+            restored_names = clean_names(restored.get("names") or [])
+            restored_text = restored.get("text") if isinstance(restored.get("text"), str) else ""
+            if restored.get("ok") is True:
+                write_state(state_dir, state_path, generation, restored_names)
+            else:
+                write_state(state_dir, state_path, "", loaded)
+            if restored_names and restored_text:
+                emit(restored_text)
+                return
         emit()
         return
     # A pasted log can be megabytes; triggers live in the first human-sized
     # stretch, and the CLI caps identically on its side.
     prompt = prompt[:100_000]
 
-    state_dir, state_path = session_state_path(payload)
-    loaded = []
-    try:
-        with open(state_path) as fh:
-            data = json.load(fh)
-            if isinstance(data, list):
-                loaded = [n for n in data if isinstance(n, str)]
-    except Exception:
-        pass
-
-    cli = find_cli()
-    if not cli:
+    if generation_changed:
+        # Ask the normal matcher what this prompt needs, then rebuild one
+        # current-generation payload from the prior active set plus new hits.
+        # Emitting the matcher text directly would lose the old active rules
+        # whenever this prompt happened to match a different skill.
+        data = run_cli_json(cli, ["route-prompt", "--loaded", ""], prompt)
+        routed_names = clean_names((data or {}).get("names") or [])
+        active = [n for n in state["names"] if n not in routed_names] + routed_names
+        restored = reinject(cli, active, content_cap())
+        restored_names = clean_names(restored.get("names") or [])
+        restored_text = restored.get("text") if isinstance(restored.get("text"), str) else ""
+        if restored.get("ok") is True:
+            write_state(state_dir, state_path, generation, restored_names)
+        else:
+            write_state(state_dir, state_path, "", active)
+        if restored_names and restored_text:
+            emit(restored_text)
+            return
         emit()
         return
 
@@ -261,24 +380,27 @@ def main():
     if data is None:
         emit()
         return
-    names = [n for n in (data.get("names") or []) if isinstance(n, str)]
+    names = clean_names(data.get("names") or [])
     text = data.get("text") or ""
     if not names or not text:
+        touched = clean_names(data.get("alreadyLoaded") or [])
+        if touched and not generation_changed:
+            reordered = [n for n in loaded if n not in touched] + touched
+            write_state(state_dir, state_path, generation, reordered)
         emit()
         return
 
-    try:
-        os.makedirs(state_dir, exist_ok=True)
-        merged = loaded + [n for n in names if n not in loaded]
-        with open(state_path, "w") as fh:
-            json.dump(merged, fh)
-    except Exception:
-        pass  # dedupe degrades, injection still happens
+    touched = clean_names(data.get("alreadyLoaded") or [])
+    merged = [n for n in loaded if n not in touched and n not in names] + touched + names
+    write_state(state_dir, state_path, generation, clean_names(merged))
 
     emit(text)
 
 
 if __name__ == "__main__":
+    if "--v${PROMPT_ROUTE_HOOK_VERSION}" not in sys.argv[1:]:
+        print(json.dumps({"continue": True, "suppressOutput": True}))
+        sys.exit(0)
     try:
         main()
     except Exception:

package/dist/skillManifestSync.js

@@ -256,6 +256,109 @@ async function listFiles(root, current = root) {
     }
     return files.sort();
 }
+/**
+ * Artifacts nobody authors. ADMISSION RULE for these lists — an entry must be
+ * (1) machine-generated as a side effect of USING or BROWSING the directory,
+ * (2) regenerated on demand at no cost, and (3) never shippable content. Any
+ * other untracked file is a local edit and must keep conflicting. Do not widen
+ * this into "ignore files we do not recognise".
+ */
+const DERIVED_ARTIFACT_DIRS = new Set(["__pycache__"]);
+/** Compared lowercased: Explorer writes both `Thumbs.db` and `thumbs.db`. */
+const DERIVED_ARTIFACT_FILES = new Set([".ds_store", "thumbs.db", "desktop.ini"]);
+const DERIVED_ARTIFACT_EXT = /\.py[co]$/;
+function isDerivedArtifactFile(name) {
+    const lower = name.toLocaleLowerCase("en-US");
+    return DERIVED_ARTIFACT_FILES.has(lower) || DERIVED_ARTIFACT_EXT.test(lower);
+}
+/**
+ * Remove regenerable junk from a marker-owned skill directory.
+ *
+ * `isPristineMarkedSkill` compares the FULL recursive file list against the
+ * marker's key list, so ONE untracked file classifies the skill as a conflict —
+ * frozen, silently skipped by every later sync. Two ways that happens without
+ * anyone editing anything:
+ *
+ *   - CPython writes `__pycache__/<mod>.cpython-XX.pyc` beside any module it
+ *     IMPORTS (exec'ing a script does not). Observed 2026-09-14:
+ *     dead-link-prevention froze after something imported check_links.py.
+ *   - Finder drops `.DS_Store` into any directory a user OPENS, and Explorer
+ *     drops `Thumbs.db`/`desktop.ini`. Reproduced 2026-09-14: browsing a
+ *     managed skill folder is enough to stop it updating. Windows is a
+ *     supported host, so both families belong here.
+ *
+ * PURGE, never ignore. Exempting these from the integrity walk would turn a
+ * noisy false conflict into a code-execution hole: CPython loads a cached .pyc
+ * in preference to its source whenever the pyc header's recorded source mtime
+ * and size match the .py, and both of those fields live in the attacker-written
+ * pyc. An ignored .pyc is arbitrary bytecode that executes while sync still
+ * reports the skill pristine and keeps updating it. Deleting restores integrity
+ * instead — the next import regenerates the cache from the .py the marker
+ * actually verifies, and any OTHER untracked file still conflicts as before.
+ *
+ * Touches nothing Prism does not own, nothing the manifest shipped, and never
+ * follows a symlink out of the skill root.
+ */
+async function purgeDerivedArtifacts(path) {
+    // Self-guarding, not caller-guarded. Three sites call this now and the
+    // symlink check is the only thing standing between a delete primitive and an
+    // arbitrary target, so it lives HERE — a fourth caller that forgets to lstat
+    // must not be able to reintroduce the escape.
+    let rootStat;
+    try {
+        rootStat = await lstat(path);
+    }
+    catch {
+        return;
+    }
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        return;
+    const marker = await readJson(join(path, MARKER));
+    if (!marker || marker.owner !== OWNER || !marker.files || typeof marker.files !== "object")
+        return;
+    const shipped = new Set(Object.keys(marker.files));
+    const shippedPaths = [...shipped];
+    // BEST EFFORT, always. This runs inside materializeNative's try block before
+    // anything is staged, so letting an EACCES escape would convert one skill's
+    // junk file into a `partial` sync that freezes EVERY other skill — trading a
+    // one-skill problem for the whole-root outage shape this file's header
+    // describes. A delete we cannot do just means the pristine check conflicts
+    // that one skill, exactly as it did before this function existed.
+    const discard = async (child, recursive) => {
+        try {
+            await rm(child, { recursive, force: true });
+        }
+        catch { /* leave it; it conflicts */ }
+    };
+    const walk = async (current) => {
+        let entries;
+        try {
+            entries = await readdir(current, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const child = join(current, entry.name);
+            const rel = relative(path, child).split(sep).join("/");
+            // Never follow a symlink out of the skill root; listFiles still rejects it.
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                const shippedUnder = shippedPaths.some((file) => file === rel || file.startsWith(`${rel}/`));
+                if (DERIVED_ARTIFACT_DIRS.has(entry.name) && !shippedUnder) {
+                    await discard(child, true);
+                    continue;
+                }
+                await walk(child);
+            }
+            else if (entry.isFile() && isDerivedArtifactFile(entry.name) && !shipped.has(rel)) {
+                await discard(child, false);
+            }
+        }
+    };
+    await walk(path);
+}
 async function isPristineMarkedSkill(path, generation) {
     const marker = await readJson(join(path, MARKER));
     if (!marker || marker.owner !== OWNER || (generation && marker.generation !== generation) ||
@@ -404,6 +507,12 @@ async function enforceNativeEntitlements(incomingNames, agentsSkillsDir) {
         const target = join(agentsSkillsDir, name);
         if (!(await exists(target)))
             continue;
+        // Same reason as the materialize paths: junk nobody wrote must not make a
+        // clean skill look hand-edited. Here the misread is quieter but permanent —
+        // the skill leaves discovery either way, but a false "locally modified"
+        // parks it in quarantine forever instead of deleting it, and nothing ever
+        // collects that directory.
+        await purgeDerivedArtifacts(target);
         if (await isPristineMarkedSkill(target)) {
             await rm(target, { recursive: true, force: true });
             continue;
@@ -604,6 +713,8 @@ async function materializeNative(manifest, agentsSkillsDir, hooks) {
             if (!(await exists(target)))
                 continue;
             const stat = await lstat(target);
+            if (stat.isDirectory() && !stat.isSymbolicLink())
+                await purgeDerivedArtifacts(target);
             const pristine = stat.isDirectory() && !stat.isSymbolicLink() && await isPristineManagedSkill(target, true);
             if (!pristine) {
                 // Preserve locally modified managed content, but quarantine it outside
@@ -659,6 +770,8 @@ async function materializeNative(manifest, agentsSkillsDir, hooks) {
             }
             const stat = await lstat(target);
             const managedSkill = managedCandidates.has(skill.name);
+            if (stat.isDirectory() && !stat.isSymbolicLink())
+                await purgeDerivedArtifacts(target);
             if (!stat.isDirectory() || stat.isSymbolicLink() || !(await isPristineManagedSkill(target, managedSkill))) {
                 conflicts.push(skill.name);
                 if (managedSkill)

package/dist/tools/ledgerHandlers.js

@@ -496,13 +496,31 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
     const conflictSuffix = snapshot.conflicts.length > 0
         ? ` · ${snapshot.conflicts.length} conflict${snapshot.conflicts.length === 1 ? "" : "s"} — see warning`
         : "";
+    // Name the CONDITION, then hand over the procedure that reveals the cause.
+    // This used to read "local copy has no Prism ownership marker", which is one
+    // of several causes and not the common one. On 2026-09-14 dead-link-prevention
+    // tripped it with a marker that was present and digest-exact; the real cause
+    // was one extra untracked file. The sentence sent the operator to quarantine
+    // the directory and rerun `prism connect` (which rewrites host MCP config and
+    // wants every host closed) when the fix was deleting a regenerable cache dir.
+    // A wrong cause is worse than no cause: it buys a confident wrong repair.
+    //
+    // Deliberately a PROCEDURE, not an enumeration of causes. Listing all of them
+    // is both longer and weaker — a list still leaves the operator guessing, while
+    // the file-list-vs-marker diff names the offender outright. Length is not
+    // cosmetic here: this block renders in the HEAD, which capNativeStartupText
+    // keeps while cutting the tail, so every extra character evicts session
+    // context. An enumerated draft measured 858 chars — 21% of the whole 4,000
+    // quick budget, against 9% for the wrong-but-short original.
     const conflictWarning = snapshot.conflicts.length > 0
-        ? `\n> - ⚠️ **SKILLS NOT UPDATING (local copy has no Prism ownership marker):** ` +
+        ? `\n> - ⚠️ **SKILLS NOT UPDATING (on-disk copy differs from the managed one):** ` +
             `${formatBoundedSkillNames([...snapshot.conflicts].sort(), "blocked")}. ` +
-            `Each named skill is frozen at whatever version is on disk — updates are ` +
-            `withheld to protect local edits. To resume updates: move the skill's ` +
-            `directory out of the native skills folder and rerun \`prism connect\` ` +
-            `(or a session bootstrap) to reinstall the managed copy.`
+            `Each is frozen at whatever version is on disk — updates are withheld to ` +
+            `protect local edits. To see why, compare the directory's file list with ` +
+            `the \`files\` keys in its \`.prism-managed.json\`. An extra file you do ` +
+            `not need? Delete it; the next sync adopts the skill again. A local edit ` +
+            `you want to discard? Move the directory out of the native skills folder ` +
+            `and rerun \`prism connect\` (or a session bootstrap).`
         : "";
     // Durable, not per-run: a later sync reports "unchanged" while the roots stay
     // frozen from an earlier failed materialization. This line is the difference
@@ -2074,6 +2092,7 @@ export async function collectSkillTriggersOnThisMachine() {
         // __proto__/constructor must be a plain data key, not an inherited read.
         const merged = Object.create(null);
         const localNames = new Set();
+        const localBodies = new Map();
         const errors = [];
         const settings = await getAllSettings();
         const bodies = [];
@@ -2105,8 +2124,12 @@ export async function collectSkillTriggersOnThisMachine() {
             for (const [pattern, names] of Object.entries(local.triggers)) {
                 (merged[pattern] ||= []).push(...names);
             }
-            for (const name of local.names)
+            for (const name of local.names) {
                 localNames.add(name);
+                const body = local.bodies.get(name);
+                if (body)
+                    localBodies.set(name, body);
+            }
             errors.push(...local.errors);
         }
         catch (error) {
@@ -2117,7 +2140,7 @@ export async function collectSkillTriggersOnThisMachine() {
             // feature fixes — a skill that is installed and never fires.
             debugLog(`[skill-triggers] ignored trigger in "${error.skill}": ${error.reason}`);
         }
-        return Object.keys(merged).length > 0 ? { triggers: merged, localNames } : undefined;
+        return Object.keys(merged).length > 0 ? { triggers: merged, localNames, localBodies } : undefined;
     }
     catch (error) {
         debugLog(`[skill-triggers] collection failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -2170,6 +2193,39 @@ export async function runPromptRouteFromCache(prompt, loaded) {
         },
     });
 }
+/**
+ * Rebuild task-specific hook context after compaction or a manifest update.
+ *
+ * The names came from this hook session's prior, entitlement-checked route.
+ * They still pass through the current cached entitlement set so a downgrade
+ * cannot resurrect a paid skill from stale hook state. This deliberately uses
+ * routePrompt's normal delivery and budget logic instead of reading native
+ * files in the host hook.
+ */
+export async function runNamedSkillRouteFromCache(names) {
+    const safeNames = [...new Set(names.filter((name) => NATIVE_SKILL_NAME.test(name)))];
+    if (safeNames.length === 0) {
+        return { names: [], alreadyLoaded: [], overflow: [], text: "No skills supplied — nothing to re-inject." };
+    }
+    const { routePrompt } = await import("./promptRouteHandler.js");
+    const { _setStorage } = await import("./skillRouting.js");
+    _setStorage(async (key, value) => { await setSetting(key, value); }, async (key) => getSetting(key, ""));
+    return routePrompt("restore task-specific skills after compaction", [], {
+        resolvePromptSkillNames: async () => safeNames,
+        collectTriggers: collectSkillTriggersOnThisMachine,
+        entitledNames: async () => {
+            try {
+                const parsed = JSON.parse(await getSetting("skill_manifest:names", "[]"));
+                return new Set(Array.isArray(parsed) ? parsed.filter((name) => typeof name === "string") : []);
+            }
+            catch {
+                return new Set();
+            }
+        },
+        getBody: (name) => getSetting(`skill:${name}`, ""),
+        manifestVersion: async () => undefined,
+    });
+}
 export async function sessionRoutePromptHandler(args) {
     const input = (typeof args === "object" && args !== null && !Array.isArray(args) ? args : {});
     const prompt = typeof input.prompt === "string" ? input.prompt : "";

package/dist/tools/promptRouteHandler.js

@@ -87,7 +87,13 @@ export async function routePrompt(prompt, loaded, deps) {
     const delivered = [];
     let budget = MAX_ROUTED_CHARS;
     for (const name of selected) {
-        const body = (await deps.getBody(name).catch(() => "")).trim();
+        // Select by the authorization source, not by which body happens to be
+        // non-empty. Otherwise an unentitled local same-name skill could expose a
+        // stale paid body left in the cache after a downgrade.
+        const platformAuthorized = entitled.has(name);
+        const body = (platformAuthorized
+            ? await deps.getBody(name).catch(() => "")
+            : scoped?.localBodies?.get(name) ?? "").trim();
         if (!body) {
             // Routed but undeliverable is the exact defect this feature exists to
             // surface. Say so rather than returning a name with nothing behind it.

package/dist/tools/scopedSkillTriggers.js

@@ -182,8 +182,17 @@ export function extractSkillTriggers(skillName, content) {
  */
 const MAX_LOCAL_SKILLS = 300;
 const MAX_LOCAL_FILE_BYTES = 64 * 1024;
+const MANAGED_SKILL_MARKER = ".prism-managed.json";
+const MANAGED_SKILL_INDEX = ".prism-managed-skills.json";
+const MANAGED_SKILL_OWNER = "prism-skill-sync-v1";
+const LOCAL_SKILL_NAME = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 export async function collectLocalSkillTriggers(roots, fs, join) {
-    const merged = { triggers: Object.create(null), errors: [], names: [] };
+    const merged = {
+        triggers: Object.create(null),
+        errors: [],
+        names: [],
+        bodies: new Map(),
+    };
     let budget = MAX_LOCAL_SKILLS;
     const seen = new Set();
     for (const root of roots) {
@@ -194,6 +203,21 @@ export async function collectLocalSkillTriggers(roots, fs, join) {
         catch {
             continue; // root absent — normal
         }
+        const indexedManaged = new Set();
+        try {
+            const index = JSON.parse(await fs.readFile(join(root, MANAGED_SKILL_INDEX)));
+            if (index && typeof index === "object" && !Array.isArray(index)
+                && index.owner === MANAGED_SKILL_OWNER
+                && Array.isArray(index.skills)) {
+                for (const value of index.skills) {
+                    if (typeof value === "string" && LOCAL_SKILL_NAME.test(value))
+                        indexedManaged.add(value);
+                }
+            }
+        }
+        catch {
+            // A missing index is normal for a machine with user-owned skills only.
+        }
         for (const name of entries) {
             if (budget-- <= 0)
                 break;
@@ -209,8 +233,20 @@ export async function collectLocalSkillTriggers(roots, fs, join) {
                     continue;
                 seen.add(name);
                 const extracted = extractSkillTriggers(name, content);
-                if (Object.keys(extracted.triggers).length > 0)
+                let prismManaged = indexedManaged.has(name);
+                try {
+                    const marker = JSON.parse(await fs.readFile(join(root, name, MANAGED_SKILL_MARKER)));
+                    prismManaged ||= Boolean(marker && typeof marker === "object" && !Array.isArray(marker)
+                        && marker.owner === MANAGED_SKILL_OWNER);
+                }
+                catch {
+                    // No valid Prism marker means the directory is user-owned local
+                    // content and remains eligible for the local entitlement exception.
+                }
+                if (Object.keys(extracted.triggers).length > 0 && !prismManaged) {
                     merged.names.push(name);
+                    merged.bodies.set(name, content);
+                }
                 for (const [pattern, names] of Object.entries(extracted.triggers)) {
                     (merged.triggers[pattern] ||= []).push(...names);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.18.0",
+  "version": "20.18.2",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
@@ -24,6 +24,7 @@
     "chmod-bins": "node -e \"['dist/cli.js','dist/server.js','dist/utils/universalImporter.js'].forEach(f => { try { require('fs').chmodSync(f, 0o755); } catch (e) { console.warn('chmod skipped', f, e.message); } })\"",
     "prepublishOnly": "node scripts/check-no-private-content.mjs && node scripts/check-publish-clean.mjs && npm run build",
     "lint:dashboard": "node scripts/lint-dashboard-es5.cjs",
+    "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "start": "node dist/server.js",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -78,11 +79,11 @@
   "overrides": {
     "@hono/node-server": "^2.0.5",
     "body-parser": "^2.3.0",
-    "fast-uri": "^3.1.4",
-    "hono": "^4.12.27",
+    "fast-uri": "^3.1.6",
+    "hono": "^4.13.5",
     "ip-address": "^10.2.0",
     "protobufjs": "^7.6.5",
-    "sharp": "^0.35.0",
+    "sharp": "^0.35.4",
     "tar": "^7.5.19",
     "nanoid": "^3.3.17"
   },
@@ -108,8 +109,9 @@
     "p-limit": "^7.3.0",
     "postcss": "8.5.23",
     "quickjs-emscripten": "^0.32.0",
-    "smol-toml": "^1.7.0",
-    "stream-json": "^2.0.0",
+    "smol-toml": "^1.7.1",
+    "stream-chain": "^4.2.5",
+    "stream-json": "^3.6.0",
     "tldts": "^7.0.27",
     "turndown": "^7.2.2",
     "zod": "^4.3.6"