prism-mcp-server 20.18.2 → 20.20.0

package/dist/tools/skillRouting.js

@@ -313,8 +313,8 @@ async function fetchKeywordTable(expectVersion) {
  * string that happens to appear in material they pasted as evidence. Observed
  * 2026-08-31: a user asked "what's going on with skill loading?" and pasted a
  * startup log; the log listed installed skill names, and the literal token
- * `fusa-bss-billing` inside it satisfied that skill's own trigger
- * `\bfusa\b.{0,20}\b(billing|invoice)\b`. Two unrelated private skills loaded
+ * `acme-xyz-billing` inside it satisfied that skill's own trigger
+ * `\bacme\b.{0,20}\b(billing|invoice)\b`. Two unrelated private skills loaded
  * and were injected as binding rules for a debugging question — pasting a log
  * that NAMES a skill should never activate it.
  *
@@ -322,7 +322,7 @@ async function fetchKeywordTable(expectVersion) {
  *   1. Fenced code blocks — pasted output, by convention.
  *   2. Hyphenated skill-name tokens (`foo-bar-baz`). A bare skill name is
  *      metadata about the system, not a description of work. Removing only the
- *      NAME SPAN keeps its constituent words available: "fusa billing invoice"
+ *      NAME SPAN keeps its constituent words available: "acme billing invoice"
  *      typed by the user still matches, because that text is not a name token.
  *
  * Deliberately NOT length-capped: a long prompt is not evidence of pasting,
@@ -357,7 +357,7 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
     // false positive being fixed. Using the actual routable names is exact.
     //
     // Deliberate consequence, not an oversight: a user who TYPES a skill's name
-    // ("update fusa-bss-billing's invoice rate") no longer trigger-routes that
+    // ("update acme-xyz-billing's invoice rate") no longer trigger-routes that
     // skill. That is acceptable because the agent reads the raw prompt and can
     // invoke a literally-named skill directly — trigger routing exists for
     // SYMPTOM text, where the name is absent. A pasted log naming skills must
@@ -382,7 +382,7 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
         // the whole prompt — the sibling _applyPromptRouting swallows bad
         // patterns for the same reason (adversarial review, confirmed).
         // Only IDENTIFIER-SHAPED names are stripped: at least two segments joined
-        // by - or _ (fusa-bss-billing, training-results-gate). Round-3 review
+        // by - or _ (acme-xyz-billing, training-results-gate). Round-3 review
         // proved the unconditional version was self-defeating for skills whose
         // name is an ordinary word: stripping `sentry` from "check sentry for
         // recent errors" killed that skill's OWN trigger (\bsentry\b) — 100% of
@@ -395,7 +395,7 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
         // name must not butt directly against a letter/digit, but MAY butt
         // against segment glue (-/_). Round 3's stricter (?<![\w-]) anchors
         // refused to strip the name out of longer compounds — a pasted
-        // `fusa-bss-billing-worker` container name survived intact, and because
+        // `acme-xyz-billing-worker` container name survived intact, and because
         // \b fires at every internal hyphen, the skill's own trigger still
         // matched inside it: the exact incident class this function exists to
         // kill. Alignment on segment edges strips those compounds while still

package/dist/tools/taskRouterHandler.js

@@ -300,6 +300,47 @@ const WEIGHTS = {
  * memory size, installed models, live RAM, entitlements, and explicit caller
  * overrides.
  */
+/**
+ * Follow-up cues. Deliberately narrow: leading connectives and explicit
+ * references to prior work. Bare pronouns ("fix it") are NOT cues — "fix
+ * the typo in it" is a normal standalone task and a false positive here
+ * would make the host attach history to everything.
+ */
+const FOLLOW_UP_CUES = [
+    /^\s*(same as before|as before|like before)\b/i,
+    // "last" dropped: "restore the last version of the file from git" is a
+    // standalone task (review 2026-09-16).
+    /\b(the|that) (same|previous|earlier) (one|version|function|file|answer|approach|code|result|output|draft)\b/i,
+    /\byour (last|previous|earlier) (answer|version|output|draft|reply)\b/i,
+    /\b(as|what) (we|you) (just |already )?(did|discussed|agreed|wrote|said|made|decided)\b/i,
+    /\b(from|like) (before|last time|earlier)\b/i,
+    /\b(continue|carry on|keep going|pick up) (from )?(where|what)\b/i,
+    // A bare "continue" / "please continue" / "keep going" is a follow-up by
+    // definition (review 2026-09-16).
+    // The bare verb, optionally "from/where/with …", and nothing else:
+    // "Continue integration tests for the parser" and "Go on-call rotation
+    // doc" are standalone tasks (review round 3).
+    // "please/now/ok, continue <anything>" is conversational continuation
+    // (so "Please continue integration tests for the parser" IS a cue — the
+    // prefix is the signal, accepted false positives included); the bare verb
+    // counts only as the whole message (or "from/where/with…"), so "Continue
+    // integration tests for the parser" stays standalone (review rounds 3–18:
+    // the prefixed forms were dropped once and restored).
+    /^\s*(please|ok|now)(,\s*|\s+)(continue|carry on|keep going|go on)\b/i,
+    /^\s*(continue|carry on|keep going|go on)(\s+(from|where|with)\b.*)?\s*[.!?]?\s*$/i,
+    /\b(redo|repeat) (it|that)\b|\bdo (it|that) again\b/i,
+];
+/** A leading connective alone is not a cue: "Next.js 15 migration plan",
+ *  "Also fix the typo in README", "Now write a unit test for parseDate()" are
+ *  standalone tasks (review 2026-09-16). It counts only with an anaphor that
+ *  points at prior work. */
+const LEADING_CONNECTIVE = /^\s*(now|also|then|next|again|and now|and then|after that)\b/i;
+const ANAPHOR = /\b(it|that|this|those|these|them|the same)\b|\b(as|like) before\b/i;
+export function looksLikeFollowUp(description) {
+    if (FOLLOW_UP_CUES.some((r) => r.test(description)))
+        return true;
+    return LEADING_CONNECTIVE.test(description) && ANAPHOR.test(description);
+}
 function buildRecommendedArgs(args, complexityScore) {
     return {
         prompt: args.task_description,
@@ -321,6 +362,7 @@ export function computeRoute(args) {
         return {
             target: "host",
             confidence: 0.5,
+            needs_history: false,
             complexity_score: 5,
             rationale: "Insufficient information for confident routing. Defaulting to host model.",
             recommended_tool: null,
@@ -383,6 +425,9 @@ export function computeRoute(args) {
     if (delegability.hardHostBoundary) {
         signals.push(`host boundary: ${delegability.reasons.join(", ")}`);
     }
+    const needs_history = looksLikeFollowUp(task_description);
+    if (needs_history)
+        signals.push("follow-up to earlier work: pass the accepted prior turns as `messages`");
     const rationale = target === "claw"
         ? `Task is delegable to the local agent. Signals: ${signals.join("; ") || "neutral"}.`
         : `Task should remain with the host model. Signals: ${signals.join("; ") || "neutral"}.`;
@@ -391,6 +436,7 @@ export function computeRoute(args) {
         confidence,
         complexity_score,
         rationale,
+        needs_history,
         recommended_tool: target === "claw" ? "prism_infer" : null,
         ...(target === "claw" ? {
             recommended_args: buildRecommendedArgs(args, complexity_score),
@@ -433,6 +479,7 @@ export async function sessionTaskRouteHandler(args) {
                         complexity_score: 5,
                         rationale: "Local delegation was explicitly disabled in Prism settings.",
                         recommended_tool: null,
+                        needs_history: false,
                         delegation_enabled: false,
                     }),
                 }],

package/dist/utils/braveApi.js

@@ -29,6 +29,8 @@
  * The Brave Answers endpoint uses a separate BRAVE_ANSWERS_API_KEY via Bearer token.
  */
 import { BRAVE_API_KEY, BRAVE_ANSWERS_API_KEY } from "../config.js";
+import { debugLog } from "./logger.js";
+import { isPortalPlanRefusal } from "./portalError.js";
 import { SYNALUX_SEARCH_AVAILABLE, synaluxWebSearch, synaluxWebSearchRaw, synaluxLocalSearch, synaluxLocalSearchRaw, synaluxBraveAnswers, } from "./synaluxSearch.js";
 const BRAVE_API_KEY_MISSING_ERROR = "BRAVE_API_KEY is not configured";
 const BRAVE_ANSWERS_API_KEY_MISSING_ERROR = "BRAVE_ANSWERS_API_KEY is not configured";
@@ -38,14 +40,37 @@ function requireBraveApiKey() {
         throw new Error(BRAVE_API_KEY_MISSING_ERROR);
     return BRAVE_API_KEY;
 }
+/**
+ * Portal first. A configured Synalux account is a privacy boundary:
+ * provider credentials and query redaction stay portal-side, so an outage,
+ * a quota, or an expired login never turns into a direct provider call
+ * with the original query.
+ *
+ * The one exception is the portal's PLAN refusal (403 on a free plan). That
+ * account is not entitled to portal search at all, so a user who configured
+ * their own key gets it used — the same footing as a user who never signed
+ * in. Without an own key the refusal propagates unchanged.
+ */
+async function portalFirst(viaPortal, ownKey, viaOwnKey) {
+    try {
+        return await viaPortal();
+    }
+    catch (err) {
+        if (ownKey && isPortalPlanRefusal(err)) {
+            debugLog("[braveApi] portal refused this plan; using the locally configured key instead");
+            return viaOwnKey();
+        }
+        throw err;
+    }
+}
 // Brave Answers API call (AI Grounding/OpenAI-compatible)
 export async function performBraveAnswers(query, model = "brave") {
-    // A configured Synalux account is a privacy boundary: provider
-    // credentials and redaction stay portal-side. Never escape to a direct
-    // provider with the original query when that portal request fails.
     if (SYNALUX_SEARCH_AVAILABLE) {
-        return synaluxBraveAnswers(query, model);
+        return portalFirst(() => synaluxBraveAnswers(query, model), BRAVE_ANSWERS_API_KEY, () => braveAnswersDirect(query, model));
     }
+    return braveAnswersDirect(query, model);
+}
+async function braveAnswersDirect(query, model) {
     if (!BRAVE_ANSWERS_API_KEY) {
         throw new Error(BRAVE_ANSWERS_API_KEY_MISSING_ERROR);
     }
@@ -80,8 +105,12 @@ export async function performWebSearchRaw(query, count = 10, offset = 0) {
     if (SYNALUX_SEARCH_AVAILABLE) {
         if (offset !== 0)
             throw new Error(SYNALUX_OFFSET_UNSUPPORTED_ERROR);
-        return synaluxWebSearchRaw(query, count);
+        return portalFirst(() => synaluxWebSearchRaw(query, count), BRAVE_API_KEY, () => braveWebSearchRaw(query, count, offset));
     }
+    return braveWebSearchRaw(query, count, offset);
+}
+// Direct Brave web search on the locally configured key
+async function braveWebSearchRaw(query, count, offset) {
     const braveApiKey = requireBraveApiKey();
     const url = new URL("https://api.search.brave.com/res/v1/web/search");
     url.searchParams.set("q", query);
@@ -105,9 +134,13 @@ export async function performWebSearch(query, count = 10, offset = 0) {
     if (SYNALUX_SEARCH_AVAILABLE) {
         if (offset !== 0)
             throw new Error(SYNALUX_OFFSET_UNSUPPORTED_ERROR);
-        return synaluxWebSearch(query, count);
+        return portalFirst(() => synaluxWebSearch(query, count), BRAVE_API_KEY, () => braveWebSearch(query, count, offset));
     }
-    const textData = await performWebSearchRaw(query, count, offset);
+    return braveWebSearch(query, count, offset);
+}
+// Direct Brave web search, formatted
+async function braveWebSearch(query, count, offset) {
+    const textData = await braveWebSearchRaw(query, count, offset);
     const data = JSON.parse(textData);
     // Extract just web results
     const results = (data.web?.results || []).map((result) => ({
@@ -165,8 +198,12 @@ function chunkArray(arr, size) {
 // Raw local search API call with poi/details payload
 export async function performLocalSearchRaw(query, count = 5) {
     if (SYNALUX_SEARCH_AVAILABLE) {
-        return synaluxLocalSearchRaw(query, count);
+        return portalFirst(() => synaluxLocalSearchRaw(query, count), BRAVE_API_KEY, () => braveLocalSearchRaw(query, count));
     }
+    return braveLocalSearchRaw(query, count);
+}
+// Direct Brave local search on the locally configured key
+async function braveLocalSearchRaw(query, count) {
     const braveApiKey = requireBraveApiKey();
     // Initial search to get location IDs
     const webUrl = new URL("https://api.search.brave.com/res/v1/web/search");
@@ -190,7 +227,8 @@ export async function performLocalSearchRaw(query, count = 5) {
         ?.filter((r) => r.id != null)
         .map((r) => r.id) || [];
     if (locationIds.length === 0) {
-        const fallback = await performWebSearch(query, count);
+        // Already on the direct path: stay on it rather than re-asking the portal.
+        const fallback = await braveWebSearch(query, count, 0);
         return JSON.stringify({
             source: "web_fallback",
             query,
@@ -223,9 +261,13 @@ export async function performLocalSearchRaw(query, count = 5) {
 // Local search API call with poi details
 export async function performLocalSearch(query, count = 5) {
     if (SYNALUX_SEARCH_AVAILABLE) {
-        return synaluxLocalSearch(query, count);
+        return portalFirst(() => synaluxLocalSearch(query, count), BRAVE_API_KEY, () => braveLocalSearch(query, count));
     }
-    const rawData = await performLocalSearchRaw(query, count);
+    return braveLocalSearch(query, count);
+}
+// Direct Brave local search, formatted
+async function braveLocalSearch(query, count) {
+    const rawData = await braveLocalSearchRaw(query, count);
     const parsed = JSON.parse(rawData);
     if (parsed.source === "web_fallback") {
         return parsed.formattedText || "No local results found";

package/dist/utils/entitlements.js

@@ -11,6 +11,30 @@
 import { getSynaluxJwt } from "./synaluxJwt.js";
 import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED } from "../config.js";
 import { debugLog } from "./logger.js";
+/** What a host with NO portal (unconfigured), a portal that says nothing
+ *  (older deployment), or an assumed-free fallback gets: OFF. Multi-turn is
+ *  a paid-plan feature (owner decision 2026-09-15); a client default that
+ *  enabled it would hand a paid feature to anyone without an account. The
+ *  caps here are what a paid plan gets when the portal omits them. */
+export const DEFAULT_MULTI_TURN = { enabled: false, max_turns: 12, max_chars: 32_000 };
+/** Structural ceiling no plan can exceed: the portal's own inference route
+ *  takes at most 50 messages INCLUDING the current turn appended on
+ *  escalation, hence 49 prior turns; 128k chars ≈ 32k tokens — the largest
+ *  local window. Above this the payload is malformed, not merely over plan. */
+export const ABSOLUTE_MULTI_TURN = { enabled: true, max_turns: 49, max_chars: 128_000 };
+/** The policy prism_infer enforces for these entitlements: portal values
+ *  when present, clamped into the absolute ceiling; the default otherwise. */
+export function multiTurnPolicy(ent) {
+    const raw = ent.multi_turn;
+    if (!raw || typeof raw !== "object")
+        return DEFAULT_MULTI_TURN;
+    const clampInt = (v, fallback, max) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.min(Math.floor(v), max) : fallback;
+    return {
+        enabled: typeof raw.enabled === "boolean" ? raw.enabled : DEFAULT_MULTI_TURN.enabled,
+        max_turns: clampInt(raw.max_turns, DEFAULT_MULTI_TURN.max_turns, ABSOLUTE_MULTI_TURN.max_turns),
+        max_chars: clampInt(raw.max_chars, DEFAULT_MULTI_TURN.max_chars, ABSOLUTE_MULTI_TURN.max_chars),
+    };
+}
 // ── Free-tier defaults (no auth) ──────────────────────────────────
 export const FREE_ENTITLEMENTS = {
     plan: "free",
@@ -191,6 +215,14 @@ export async function getEntitlements() {
 /**
  * Force cache invalidation (e.g. after plan upgrade).
  */
+/** Cached entitlements WITHOUT a network round-trip, or null when cold.
+ *  For display surfaces (the startup line) that must never add a portal
+ *  fetch to startup; the first prism_infer result carries the policy anyway. */
+export function peekEntitlements() {
+    // Honour the TTL: a stale plan's caps must not be advertised at startup
+    // (review 2026-09-16); an expired cache reads as cold.
+    return cache && cache.expiresAt > Date.now() ? cache.entitlements : null;
+}
 export function invalidateEntitlements() {
     cache = null;
     negativeCache = null;

package/dist/utils/layer1.js

@@ -4,22 +4,34 @@
  * Calls dcostenco/prism-coder:4b via Ollama to classify whether
  * a prompt is OBVIOUS_RESERVED, OBVIOUS_NOT_RESERVED, or UNCERTAIN.
  *
- * Fail-closed contract:
+ * Contract (as the handler applies it):
  *   OBVIOUS_NOT_RESERVED → permits local routing
- *   OBVIOUS_RESERVED     → escalate to cloud
- *   UNCERTAIN            → escalate to cloud (conservative)
+ *   OBVIOUS_RESERVED     → text: cloud when allowed, else refused; with a
+ *                          current image: local only, never cloud (ruling
+ *                          2026-08-18, clinical images are processed)
+ *   UNCERTAIN            → the same as OBVIOUS_RESERVED (conservative)
  *   UNCERTAIN_LENGTH     → §5.3: prompt too long to classify in full, but the
- *                          full-text keyword floor is clean AND a head+tail
+ *                          full-text keyword floor is clean AND a head+middle+tail
  *                          excerpt classified clean — permits local routing
  *                          with a distinct audit marker ("too long to classify"
  *                          ≠ "semantically uncertain")
- *   ERROR                → escalate to cloud (never fail-open)
+ *   ERROR                → cloud when it is allowed and answers; otherwise
+ *                          the full-text keyword net decides and keyword-
+ *                          clean text is served locally (the one path that
+ *                          is not fail-closed: an availability policy; on a
+ *                          history screen three in a row become UNCERTAIN;
+ *                          with a current image callLayer1 maps ERROR to
+ *                          UNCERTAIN and the handler refuses one that
+ *                          reaches it, so an image ERROR is never served)
  *
  * The prompt below is VERBATIM from §E of prism-infer-boundaries/SKILL.md.
  * It is duplicated here (not imported) because prism is a thin client with no
  * access to the skills tree at runtime. A drift test asserts byte-for-byte match.
  *
- * Must not run when mode="route" and max_tokens<=16 — that IS a Layer 1 call.
+ * callLayer1 talks to Ollama directly and never re-enters prism_infer, so
+ * there is no call signature that must skip it (the old "mode=route +
+ * max_tokens<=16" skip was removed 2026-09-16: it was a caller-controlled
+ * bypass, never a recursion guard).
  */
 // VERBATIM — §E prism-infer-boundaries/SKILL.md.
 // Changes require the private Layer 1 evaluation gate before release.
@@ -74,7 +86,7 @@ const all = (...rules) => (prompt) => rules.every((rule) => rule(prompt));
 const CLINICAL_RESERVED_RULES = [
     all(has(/\b(?:de[- ]?escalat\w*|meltdown\w*|rage\s+episode|violent\w*)\b/i), has(/\b(?:draft|write|plan|procedure|protocol|manag\w*|what\s+(?:do|should)\b|respond\w*)\b/i)),
     all(has(/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i), has(/\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i)),
-    all(has(/\b(?:self[- ]?(?:harm|injur\w*)|bites?\s+(?:him|her|them)self|scratches?\s+(?:him|her|them)self|bangs?\s+(?:his|her|their)\s+head|harm\s+(?:himself|herself|themselves))\b/i), has(/\b(?:bleed\w*|blood|concrete|head\s+impact|medical\s+attention|risk(?:\s+of\s+injury)?|causes?\s+injury|actual\s+injury|assess\w*|screen\w*|want\w*)\b/i)),
+    all(has(/\b(?:self[- ]?(?:harm|injur\w*)|bites?\s+(?:him|her|them)self|bites?\s+(?:his|her|their)\s+own\b|scratches?\s+(?:him|her|them)self|scratches?\s+(?:his|her|their)\s+own\b|bangs?\s+(?:his|her|their)\s+head|harm\s+(?:himself|herself|themselves))\b/i), has(/\b(?:bleed\w*|blood|concrete|head\s+impact|medical\s+attention|risk(?:\s+of\s+injury)?|causes?\s+injury|actual\s+injury|assess\w*|screen\w*|want\w*)\b/i)),
     (prompt) => (/\b(?:punch\w*|attack\w*|aggress\w*|hit\s+staff)\b/i.test(prompt)
         && /\b(?:last\s+(?:week|month|year)|prior|previous|history|injur\w*)\b/i.test(prompt)
         && !/\bno\s+injur(?:y|ies)\b/i.test(prompt)
@@ -182,7 +194,14 @@ const NON_OPERATIONAL_ARTIFACT_ACTION = /\b(?:review\b[\s\S]{0,120}\bhook\s+orde
  * clear routine BCBA work reaches local inference. Ambiguous prompts return
  * null and continue to the semantic classifier below.
  */
-export function classifyDeterministicLayer1(userPrompt) {
+/** The non-operational artifact exemption over a text. classifyDeterministic
+ *  Layer1 applies it to the text it is given; prism_infer's history screen
+ *  passes 7,200-char proximity slices, so the exemption reaches the clause it
+ *  sits in and nothing thousands of chars away (review rounds 4 and 10). */
+export function isNonOperationalArtifact(text) {
+    return NON_OPERATIONAL_ARTIFACT_CONTEXT.test(text) && NON_OPERATIONAL_ARTIFACT_ACTION.test(text);
+}
+export function classifyDeterministicLayer1(userPrompt, opts) {
     // The artifact exemption is checked BEFORE the reserved rules, and only for
     // the non-clinical ones.
     //
@@ -200,8 +219,10 @@ export function classifyDeterministicLayer1(userPrompt) {
     const clinicalReserved = matchesAny(userPrompt, CLINICAL_RESERVED_RULES);
     if (clinicalReserved)
         return "OBVIOUS_RESERVED";
-    if (NON_OPERATIONAL_ARTIFACT_CONTEXT.test(userPrompt) &&
-        NON_OPERATIONAL_ARTIFACT_ACTION.test(userPrompt)) {
+    if (opts?.operational === false) {
+        return matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES) ? "OBVIOUS_NOT_RESERVED" : null;
+    }
+    if (isNonOperationalArtifact(userPrompt)) {
         return "OBVIOUS_NOT_RESERVED";
     }
     if (matchesAny(userPrompt, RESERVED_INTENT_RULES))
@@ -290,10 +311,11 @@ const LAYER1_RETRY_TIMEOUT_MS = 5_000;
 // would otherwise smuggle through.
 const RESERVED_KEYWORDS = /\b(restrain\w*|seclu(?:sion|d\w*)|physical\s*holds?|(?:prone|supine|basket|therapeutic|manual|two[- ]?person)\s+holds?|hold(?:ing)?\s+(?:the\s+)?(?:client|child|student|patient)\s+down|containment|self[- ]?harm\w*|suicid\w*|overdos\w*|dos(?:age|ing)\s*(?:mg|schedule)|crisis\s*de[- ]?escalation|meltdown\s*management|rage\s+episode|elopement\s*incident)\b/i;
 /**
- * Deterministic keyword check — the ERROR-path floor.
+ * Deterministic keyword check — the ERROR-path floor, and the full-text
+ * floor for oversize input (over MAX_CLASSIFIER_PROMPT_LENGTH the classifier
+ * reads an excerpt, so this runs over the whole text first).
  * Returns OBVIOUS_RESERVED if reserved vocabulary is present,
- * OBVIOUS_NOT_RESERVED otherwise. Used only when the LLM classifier
- * fails (timeout, model not loaded, injection attack).
+ * OBVIOUS_NOT_RESERVED otherwise.
  */
 export function keywordBackstop(prompt) {
     return RESERVED_KEYWORDS.test(prompt) ? "OBVIOUS_RESERVED" : "OBVIOUS_NOT_RESERVED";
@@ -305,7 +327,7 @@ export function keywordBackstop(prompt) {
 // bounded head+tail excerpt. A clean floor + clean excerpt yields the
 // distinct UNCERTAIN_LENGTH verdict so callers can tell "too long to
 // classify" from "semantically uncertain".
-const MAX_CLASSIFIER_PROMPT_LENGTH = 4_000;
+export const MAX_CLASSIFIER_PROMPT_LENGTH = 4_000;
 // Excerpt budget: head + middle + tail must stay under the classifier cap
 // with room for the LAYER1_PROMPT template. The sampled middle window
 // narrows the region an attacker can hide paraphrased reserved content in
@@ -340,12 +362,12 @@ export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch
 /** Images accompanying the request. The classifier MUST see them: a
  *  screenshot of clinical material would otherwise pass a gate that only
  *  ever read the text prompt. */
-images) {
+images, opts) {
     if (!userPrompt || !userPrompt.trim())
         return "ERROR";
     const oversize = userPrompt.length > MAX_CLASSIFIER_PROMPT_LENGTH;
     const hasImages = !!images?.length;
-    const deterministic = classifyDeterministicLayer1(userPrompt);
+    const deterministic = opts?.deterministic === false ? null : classifyDeterministicLayer1(userPrompt);
     if (deterministic === "OBVIOUS_RESERVED")
         return deterministic;
     // The routine-work fast path may only skip the model when there is nothing

package/dist/utils/modelConverge.js

@@ -34,6 +34,12 @@
 export const MODEL_NAMESPACE = "dcostenco/prism-coder";
 export const LOCAL_PREFIX = "prism-coder";
 export const CONVERGE_TIERS = ["2b", "4b", "9b", "27b"];
+/** Exit rule for the standalone command: one installed tier that did not
+ *  converge is a failure worth a non-zero exit, not only "every tier failed"
+ *  (a one-tier host reports three skipped_not_installed and would exit 0). */
+export function convergeFailed(outcomes) {
+    return outcomes.some(o => o.action === "failed");
+}
 export async function convergeModels(deps) {
     let tags;
     try {
@@ -75,9 +81,48 @@ export async function convergeModels(deps) {
                 continue;
             }
             const pulledNewBytes = digestBefore !== undefined && digestBefore !== sourceNow.digest;
-            const aliasStale = !aliasNow || aliasNow.digest !== sourceNow.digest;
-            if (aliasStale) {
+            let aliasStale = !aliasNow || aliasNow.digest !== sourceNow.digest;
+            // A digest mismatch is not always stale bytes. Adopting
+            // scripts/prism-coder-9b.Modelfile rebuilds the alias FROM the same
+            // weights with `PARAMETER num_ctx 32768`, which changes the manifest
+            // digest and nothing else — and this branch would have cp'd the
+            // unpinned upstream straight over it on the next converge, silently
+            // undoing the pin (found 2026-09-15 before it happened). Stale means
+            // OLD WEIGHTS: compare the blobs the two tags are built from.
+            let pinnedSameWeights = false;
+            let droppedPin = null;
+            if (aliasStale && aliasNow && deps.tagFacts) {
+                const [a, src] = await Promise.all([deps.tagFacts(alias), deps.tagFacts(source)]);
+                if (a && src) {
+                    if (a.weightsBlob === src.weightsBlob) {
+                        pinnedSameWeights = a.pinnedNumCtx !== null;
+                        aliasStale = false;
+                    }
+                    else if (a.pinnedNumCtx !== null) {
+                        droppedPin = a.pinnedNumCtx;
+                    }
+                }
+                else {
+                    // /api/show failed or had no FROM line: a local pin cannot
+                    // be detected, so do NOT overwrite — a digest mismatch may
+                    // be nothing but the pin (review 2026-09-16). Hosts without
+                    // tagFacts (older callers) keep the digest rule.
+                    outcomes.push({ tier, action: "failed", detail: "tag_facts_unavailable_pin_unknown" });
+                    deps.log(`? ${alias}: /api/show facts unavailable — left alone (a local num_ctx pin cannot be told from stale weights). Re-run when Ollama answers /api/show, or rebuild deliberately with: ollama cp ${source} ${alias}`);
+                    continue;
+                }
+            }
+            if (pinnedSameWeights) {
+                outcomes.push({ tier, action: "up_to_date", detail: "locally_pinned" });
+                deps.log(`= ${alias} is a local pin on the same weights as ${source} — left alone`);
+            }
+            else if (aliasStale) {
                 await deps.copy(source, alias);
+                if (droppedPin !== null) {
+                    outcomes.push({ tier, action: pulledNewBytes || !hadSource ? "pulled_and_aliased" : "aliased_only", detail: "pin_dropped_readopt" });
+                    deps.log(`⚠ ${alias} rebuilt on new weights; its num_ctx ${droppedPin} pin is GONE — re-adopt with: ollama create ${alias} -f scripts/${alias.replace(":", "-")}.Modelfile`);
+                    continue;
+                }
                 const action = pulledNewBytes || !hadSource ? "pulled_and_aliased" : "aliased_only";
                 outcomes.push({ tier, action });
                 deps.log(`✓ ${alias} ${aliasNow ? "re-aliased (was a stale snapshot)" : "aliased"} → ${sourceNow.digest.slice(0, 12)}`);

package/dist/utils/portalError.js

@@ -0,0 +1,41 @@
+/**
+ * Portal HTTP errors carry their status and body so a caller can tell a
+ * PLAN refusal — the account is signed in, but its plan does not include
+ * the feature — from an outage, a quota, or an expired login. Only the plan
+ * refusal may be answered with the user's own provider key (braveApi.ts);
+ * everything else stays inside the portal's privacy boundary.
+ */
+export class PortalHttpError extends Error {
+    portalPath;
+    portalStatus;
+    portalBody;
+    constructor(path, status, body) {
+        super(`[synaluxSearch] ${path} HTTP ${status}: ${body}`);
+        this.name = "PortalHttpError";
+        this.portalPath = path;
+        this.portalStatus = status;
+        this.portalBody = body;
+    }
+}
+/**
+ * True when the portal refused because of the account's plan: the
+ * `auth.plan === 'free'` gate on the prism search routes answers 403 with
+ * `{ error: "... requires Standard plan or higher.", upgrade_url: "/pricing" }`.
+ * Either signal — the word "plan" in the body, or a structured
+ * `upgrade_url` — is accepted, so a reworded message does not silently take
+ * a free user's own key away again. A 403 with neither is not a plan
+ * refusal, whatever else it may be.
+ */
+export function isPortalPlanRefusal(err) {
+    if (!(err instanceof PortalHttpError) || err.portalStatus !== 403)
+        return false;
+    if (/\bplan\b/i.test(err.portalBody))
+        return true;
+    try {
+        const body = JSON.parse(err.portalBody);
+        return typeof body?.upgrade_url === "string";
+    }
+    catch {
+        return false;
+    }
+}

package/dist/utils/safetyGate.js

@@ -20,7 +20,17 @@ const CRISIS_INPUT_RE = [
     /want\s+to\s+(?:commit\s+)?suicide/i,
     /cut(?:ting)?\s+(?:my)?self/i,
     /(?:hang|hanging)\s+(?:my)?self/i,
-    /jump(?:ing)?\s+off/i,
+    // "a jumping off point for the refactor" is engineering, not a disclosure
+    // (measured false positive, review round 3, 2026-09-16). Exempt ONLY the
+    // idiom as a noun phrase: a determiner + "jump(ing) off point(s)" ("a
+    // jumping off point for the refactor", "good jumping off points"). "I
+    // plan to jump off point of the roof" has no determiner and matches;
+    // "jumping off pointlessly", "jumping off a bridge" and the hyphenated
+    // "jump-off the roof" match; "a jumping-off point" is exempt. Source of
+    // truth: the private repo's safety/patterns.json (bounded lookbehind for the
+    // Swift copy); the generator's other patterns drift from this file —
+    // reported; apply single lines, and keep the portal copy in step.
+    /(?:(?<!\b(?:a|an|the|this|that|good|great|solid|useful|our|your|my|as)\s{1,4})\bjump(?:ing)?[\s-]+off\b|\bjump(?:ing)?[\s-]+off\b(?![\s-]+points?\b))/i,
     /how\s+(?:many|much|to).*(?:pills|overdose|die)/i,
     // Spanish — block hyperbole nouns only (NOT hunger/thirst/cold — may be literal for neglected child)
     /quiero\s+morir(?!\s+de\s+(?:risa|la\s+risa|vergüenza|ganas|envidia|aburrimiento)\b)/i,

package/dist/utils/synaluxSearch.js

@@ -17,6 +17,7 @@
  * SYNALUX_SEARCH_AVAILABLE before calling.
  */
 import { debugLog } from "./logger.js";
+import { PortalHttpError } from "./portalError.js";
 import { getSynaluxJwt, invalidateSynaluxJwt } from "./synaluxJwt.js";
 import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED, } from "../config.js";
 // ─── Public availability flag ────────────────────────────────
@@ -59,7 +60,9 @@ async function portalPost(path, body, timeoutMs = 15_000) {
     }
     if (!res.ok) {
         const text = await res.text().catch(() => "(no body)");
-        throw new Error(`[synaluxSearch] ${path} HTTP ${res.status}: ${text}`);
+        // Same message as before; the typed error lets braveApi.ts recognise a
+        // plan refusal without parsing the message.
+        throw new PortalHttpError(path, res.status, text);
     }
     return (await res.json());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.18.2",
+  "version": "20.20.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",

package/dist/utils/googleSearchApi.js

@@ -1,42 +0,0 @@
-import { debugLog } from "./logger.js";
-/**
- * Google Custom Search API Utility
- * ===============================
- *
- * Performs a web search using the Google Custom Search JSON API.
- * Requires: API Key and Search Engine ID (CX).
- *
- * @param apiKey - Google Search API Key
- * @param cx - Search Engine ID (CX)
- * @param query - The search query
- * @param count - Number of results to return (max 10)
- * @returns Array of result objects { title, url, snippet }
- */
-export async function performGoogleSearch(apiKey, cx, query, count = 5) {
-    try {
-        const safeCount = Math.min(Math.max(1, count), 10);
-        const url = new URL("https://customsearch.googleapis.com/customsearch/v1");
-        url.searchParams.append("key", apiKey);
-        url.searchParams.append("cx", cx);
-        url.searchParams.append("q", query);
-        url.searchParams.append("num", safeCount.toString());
-        const response = await fetch(url.toString(), {
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (!response.ok) {
-            const error = await response.json();
-            throw new Error(`Google Search API failed: ${JSON.stringify(error)}`);
-        }
-        const data = await response.json();
-        const items = data.items || [];
-        return items.map((item) => ({
-            title: item.title,
-            url: item.link,
-            snippet: item.snippet,
-        }));
-    }
-    catch (err) {
-        debugLog(`[GoogleSearch] Error: ${err instanceof Error ? err.message : String(err)}`);
-        return [];
-    }
-}