prism-mcp-server 20.19.0 → 20.21.0

package/README.md

@@ -32,8 +32,11 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
   undercounts inline — a number you can check, not marketing.
 - **Route-output enforcement** — route mode returns only well-formed calls to
   tools the host actually advertised. Standard and higher plans can add
-  authenticated deterministic correction; `route_guard: "local"` keeps the
-  prompt and draft entirely on-device.
+  authenticated deterministic correction; `route_guard: "local"` disables that
+  correction only. `cloud_fallback: false` forbids cloud inference fallback and
+  `verify: false` (with no `evidence`) disables the grounding verifier. With all
+  three off, no request carries your prompt, draft or evidence; the per-call
+  entitlement check and telemetry still contact the portal and carry neither.
 - **One setup for every agent** — `prism connect` configures Claude Code,
   Claude Desktop, Cursor, Gemini CLI, and Codex while preserving unrelated
   settings.
@@ -46,7 +49,8 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
   small ones on top: mid-session prompt routing, and a post-compaction
   re-injection of the protected-floor digest.
 - **Safe escalation and observability** — inference outcomes are explicit,
-  reserved content remains fail-closed, and local/cloud usage is recorded for
+  reserved text remains fail-closed (clinical images are processed locally,
+  never sent to the cloud), and local/cloud usage is recorded for
   review.
 
 ## Get started
@@ -781,7 +785,7 @@ Qwen 3.5 models (9B/27B) with thinking enabled could burn all tokens on `<think>
 ## What's New in v20.0.3
 
 ### Layer 1 Cold-Model Resilience
-The reserved-category classifier now retries once with a longer timeout on cold-model failure, then falls back to a deterministic keyword backstop before refusing. Over-length prompts (>4K chars) are classified as UNCERTAIN before reaching the classifier — prompt padding can no longer force the ERROR branch. This eliminates the cold-start refusal problem without weakening the safety gate.
+(As shipped in an earlier release; the current contract is the header of `src/utils/layer1.ts`.) The reserved-category classifier retries once with a longer timeout on cold-model failure, then falls back to a deterministic keyword backstop; keyword-clean text is served locally. Over-length prompts (>4K chars) get the full-text keyword floor plus a head+middle+tail excerpt read and a distinct UNCERTAIN_LENGTH marker — prompt padding cannot force the ERROR branch. This eliminates the cold-start refusal problem without weakening the safety gate.
 
 ### Keyword Backstop for Reserved Content
 When the LLM classifier fails (timeout, injection, resource pressure), a deterministic regex floor catches reserved vocabulary (restraint, seclusion, self-harm, suicide, overdose, crisis de-escalation, etc.) including inflected and verb forms. Blocks prompt-padding and classifier-injection attacks on the ERROR path.
@@ -1033,8 +1037,10 @@ The free tier runs entirely on your machine. Paid tiers add cloud sync through t
 redaction (SSNs, dates of birth, medical record numbers, phone numbers, emails,
 and clinical identifiers are stripped before storage). Cloud inference and
 route correction send the request over TLS for processing and do not store it
-as Prism memory; use `route_guard: "local"` or the **local tier** for a full
-air-gap. **Enterprise** includes a HIPAA Business Associate Agreement.
+as Prism memory. The **local tier** (no Synalux key) is the air-gap;
+`route_guard: "local"` only skips the route correction, and `cloud_fallback`
+and `verify` govern the other two channels. **Enterprise** includes a HIPAA
+Business Associate Agreement.
 
 ---
 
@@ -1049,8 +1055,12 @@ before it reaches the host. Malformed or unadvertised calls become `NO_TOOL`.
 With `route_guard: "auto"` (the default), Standard and higher plans also send
 a well-formed draft for one of Prism's seven trained tools—or an unadvertised
 draft that may need correction—to Synalux for authenticated deterministic
-correction. Advertised custom host tools remain local. Set
-`route_guard: "local"` for a fully on-device route path.
+correction. Advertised custom host tools remain local. `route_guard: "local"`
+disables that correction only: cloud inference fallback is governed by
+`cloud_fallback`, and the grounding verifier is a separate channel with its
+own switch (`verify`, on by default when `evidence` is given). With all three
+off, no request carries your prompt, draft or evidence; the entitlement check
+and telemetry still contact the portal and carry neither.
 
 | Model | Ollama tag | Size | Vision | Routing accuracy¹ | Role | Automatic routing tier |
 |---|---|---|---|---|---|---|
@@ -1151,12 +1161,19 @@ check, the local 9B passed 2/3 tasks; the local 27B and Gemini 3.6 Flash each
 passed 3/3. This is a self-published regression signal, not an independent
 leaderboard or a claim of broad model equivalence.
 
-### Cloud Escalation (`cloud_fallback: true`)
+### Cloud Escalation (`cloud_fallback`)
 
 Prism always tries an eligible local model first. If the quality gate detects
-an empty, truncated, think-only, or looping response, paid tiers can retry the
-request through Gemini 3.6 Flash. Free-tier routing stays local and reports the
-quality-gate outcome without making a cloud call.
+an empty, truncated, think-only, or looping response, or the safety screen
+finds the request uncertain or reserved, a paid plan escalates the request
+through Gemini 3.6 Flash. Free-tier routing stays local and reports the
+outcome without making a cloud call.
+
+The flag follows the plan. Leave it unset and your plan decides: paid plans
+escalate, free plans never do. Pass `false` to forbid cloud inference fallback
+for a call, which the clinical delegation rules do for drafting; pass `true`
+to ask for it, which still requires a plan with cloud. A request that carries
+an image is never escalated; screenshots stay on this device.
 
 ---
 
@@ -1218,6 +1235,7 @@ All on-device models are free to run locally via Ollama on every tier. A subscri
 | Cloud search | -- | ✅ | ✅ | ✅ |
 | Max output tokens | 512 | 1,024 | 2,048 | 4,096 |
 | Cloud fallback | -- | Gemini 3.6 Flash | Gemini 3.6 Flash | Gemini 3.6 Flash (priority) |
+| Multi-turn `prism_infer` (conversation carried across calls) | -- | 12 turns / 32k chars | 20 turns / 64k chars | 30 turns / 96k chars |
 | Grounding verifier (fact-check AI output) | -- | ✅ | ✅ | ✅ |
 | Memory sync (cloud) | -- | ✅ | ✅ | ✅ |
 | Knowledge / session memory | limited | unlimited | unlimited | unlimited |
@@ -1270,8 +1288,115 @@ prism_infer({
 })
 // → 27B generates code locally ($0), with thinking for quality
 // → If quality gate fails + paid tier → auto-escalate to Gemini 3.6 Flash
+
+// Follow-ups carry the conversation (paid plans). The host curates the turns;
+// Prism bounds them to your plan's caps (user+assistant text only), safety-
+// screens every turn (each alone, then each in context; a short routine
+// request skips its own model read), counts them against
+// the tier's context, and never stores them. A free plan or a host with no
+// portal is refused: multi_turn_not_in_plan.
+prism_infer({
+    messages: [
+        { role: "user",      content: "Write a binary search in Python" },
+        { role: "assistant", content: "<the accepted answer>" },
+    ],
+    prompt: "Now make it return the insertion point when the value is absent",
+    mode: "code",
+})
 ```
 
+#### Multi-turn: why it matters, and why it is a paid feature
+
+A single `prism_infer` call has no memory. The host asks a question, the local
+model answers, and the next call starts from nothing: "now add a timeout to it"
+means nothing to a model that never saw "it". Without history the host either
+restates the whole context in every prompt (tokens, and the answer drifts) or
+gives up on local delegation and does the follow-up itself in the cloud. With
+`messages`, the host hands back the turns it accepted and the local model
+continues the thread at $0, which is what makes local delegation useful for
+real work instead of one-shot snippets.
+
+It is paid because it cannot run without Synalux behind it:
+
+- **The caps are served by the portal, per plan.** How many turns and how many
+  characters a conversation may carry is an entitlement your plan returns,
+  not a number the client decides. No portal, no policy, and the call is
+  refused as `multi_turn_not_in_plan`.
+- **Ambiguous turns go to Synalux cloud.** Every turn is safety-screened on
+  device, alone and in context. A turn the screen finds uncertain is never
+  served by the local model; it goes to the cloud when the plan allows it,
+  and is refused otherwise. Free has no cloud, so the only honest answer for
+  free is no history at all.
+- **Nothing is stored.** Prism bounds, screens, counts and forwards the turns
+  the host sends, and keeps none of them.
+
+<details>
+<summary>Without multi-turn (free plan, or no `messages`): every call starts cold</summary>
+
+```typescript
+// Call 1
+prism_infer({ prompt: "My project codename is Nightjar. Reply OK.", mode: "chat" })
+// → "OK"                                  (local 9b, $0)
+
+// Call 2 — the model never saw call 1
+prism_infer({ prompt: "What is my codename? One word.", mode: "chat" })
+// → "I don't have that information."      (local 9b, correct and useless)
+
+// Call 3 — a coding follow-up with no thread
+prism_infer({ prompt: "Now add a timeout parameter to it.", mode: "code" })
+// → guesses what "it" is, or asks         (the host has to redo the work)
+
+// A free plan that sends messages anyway:
+prism_infer({ messages: [/* … */], prompt: "…" })
+// → refused: multi_turn_not_in_plan       (no portal entitlement, no cloud)
+```
+</details>
+
+<details>
+<summary>With multi-turn (paid plan): the thread continues locally, and the screen decides per turn</summary>
+
+```typescript
+// The host keeps the turns it accepted and passes them back.
+prism_infer({
+    messages: [
+        { role: "user",      content: "My project codename is Nightjar. Reply OK." },
+        { role: "assistant", content: "OK" },
+    ],
+    prompt: "What is my codename? One word.",
+    mode: "chat",
+})
+// → "Nightjar"                            (local 9b, $0; history_turns: 2)
+
+prism_infer({
+    messages: [
+        { role: "user",      content: "We named the helper countActiveUsers(data). Confirm." },
+        { role: "assistant", content: "Confirmed." },
+    ],
+    prompt: "Write the one-line call that stores its result in n.",
+    mode: "code",
+})
+// → "n = countActiveUsers(data)"          (local 9b, $0)
+
+// A turn the on-device screen finds uncertain, alone or in context, is not
+// served locally: it goes to Synalux cloud on a paid plan, or is refused with
+// cloud_fallback: false. The result names the reason (layer1_uncertain) so
+// the host can decide what to do with the thread.
+prism_infer({
+    messages: [
+        { role: "user",      content: "The ticket for this bug is SYN-4471. Acknowledge." },
+        { role: "assistant", content: "Acknowledged." },
+    ],
+    prompt: "Which ticket is this bug filed under?",
+    cloud_fallback: true,
+})
+// → "SYN-4471"                            (Gemini 3.6 Flash; used_cloud: true)
+```
+
+Measured on the real 9b through the real handler with cloud off: 7 of 12
+benign follow-ups are served locally, the rest refuse and name the reason;
+every injection variant the reviewers built refuses.
+</details>
+
 | Mode | Think | Model | Use case |
 |------|-------|-------|----------|
 | `route` | Off (fast) — except a tier that reasons better, e.g. 9B | 9B default | MCP tool routing |

package/dist/cli.js

@@ -1273,8 +1273,9 @@ program
     .option('--dry-run', 'Print what would be pulled/re-aliased without executing')
     .action(async (options) => {
     const { runOllamaConverge } = await import('./modelConvergeRunner.js');
+    const { convergeFailed } = await import('./utils/modelConverge.js');
     const outcomes = await runOllamaConverge({ dryRun: options.dryRun === true });
-    if (outcomes.every(o => o.action === 'failed'))
+    if (convergeFailed(outcomes))
         process.exitCode = 1;
 });
 // ─── prism register-models ────────────────────────────────────

package/dist/localFirstPolicy.js

@@ -9,7 +9,10 @@ export const LOCAL_FIRST_POLICY_LINES = [
     "## Prism local-first orchestration",
     "For bounded, verifiable delegated work, use Prism's local worker before any host-native or background subagent.",
     "When session_task_route is available, call it first. If it returns target `claw`, call `prism_infer` with the",
-    "recommended arguments, `cloud_fallback: false`, and the `project` and `conversation_id` from this session when known.",
+    "recommended arguments and the `project` and `conversation_id` from this session when known. Leave `cloud_fallback`",
+    "unset so the plan decides it; pass `false` to forbid cloud inference fallback.",
+    "If the route says `needs_history`, or the task follows up an earlier `prism_infer` answer, pass the accepted prior",
+    "turns as `messages` (paid plans); never send a follow-up without them, and never re-send a turn you rejected.",
     "Prism loads that project's dashboard-configured quick, standard, or deep memory and selects a RAM-safe local model.",
     "Never create host-native or background subagents for routine work, never fan out, and never nest agents.",
     "If local inference is unavailable, refused, degraded, or the task requires host tools or reserved judgment, continue",

package/dist/modelConvergeRunner.js

@@ -81,6 +81,20 @@ export async function runOllamaConverge(opts = {}) {
             const data = (await res.json());
             return (data.models ?? []).map((m) => ({ name: m.name, digest: m.digest }));
         },
+        tagFacts: async (name) => {
+            const res = await fetch(`${OLLAMA_URL}/api/show`, {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ model: name }), signal: AbortSignal.timeout(5_000),
+            });
+            if (!res.ok)
+                return null;
+            const data = (await res.json());
+            const from = /^FROM\s+(\S+)/m.exec(data.modelfile ?? "")?.[1];
+            if (!from)
+                return null;
+            const pin = /^\s*num_ctx\s+(\d+)\s*$/m.exec(data.parameters ?? "");
+            return { weightsBlob: from, pinnedNumCtx: pin ? Number(pin[1]) : null };
+        },
         pull: (ref) => runOllama(["pull", ref], true),
         copy: (from, to) => runOllama(["cp", from, to], false),
         log: (line) => console.log(`  ${line}`),

package/dist/storage/inferMetricsLedger.js

@@ -42,8 +42,8 @@ const LEDGER_UNAVAILABLE_ERROR = "Inference metrics ledger is unavailable";
 const INSERT_METRIC_SQL = `INSERT OR IGNORE INTO infer_metrics
     (ts, caller, mode, backend, model, used_cloud, gate_outcome,
      refusal_reason, prompt_tokens, completion_tokens, latency_ms, ram_free_mb,
-     source_event_id)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+     source_event_id, history_turns, refusal_layer)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
 function closeClient(context) {
     const activeClient = client;
     client = null;
@@ -83,17 +83,25 @@ function ensureTable() {
                     completion_tokens INTEGER,
                     latency_ms INTEGER,
                     ram_free_mb INTEGER,
-                    source_event_id TEXT
+                    source_event_id TEXT,
+                    history_turns INTEGER,
+                    refusal_layer TEXT
                 )`);
             // Existing ledgers predate external panel-spool ingestion. SQLite has
             // no ADD COLUMN IF NOT EXISTS, so use the repository's established
             // idempotent migration pattern and reject only unexpected failures.
-            try {
-                await client.execute(`ALTER TABLE infer_metrics ADD COLUMN source_event_id TEXT`);
-            }
-            catch (e) {
-                if (!(e instanceof Error) || !e.message.includes("duplicate column name"))
-                    throw e;
+            for (const column of [
+                "source_event_id TEXT",
+                "history_turns INTEGER",
+                "refusal_layer TEXT",
+            ]) {
+                try {
+                    await client.execute(`ALTER TABLE infer_metrics ADD COLUMN ${column}`);
+                }
+                catch (e) {
+                    if (!(e instanceof Error) || !e.message.includes("duplicate column name"))
+                        throw e;
+                }
             }
             await client.execute(`CREATE INDEX IF NOT EXISTS idx_infer_metrics_ts ON infer_metrics (ts)`);
             await client.execute(`CREATE UNIQUE INDEX IF NOT EXISTS idx_infer_metrics_source_event
@@ -149,6 +157,7 @@ function metricArgs(row) {
         row.refusal_reason ?? null, row.prompt_tokens ?? null,
         row.completion_tokens ?? null, row.latency_ms ?? null,
         row.ram_free_mb ?? null, row.source_event_id ?? null,
+        row.history_turns ?? null, row.refusal_layer ?? null,
     ];
 }
 /** Aggregate all persisted rows (optionally since a timestamp). */

package/dist/tools/ledgerHandlers.js

@@ -25,7 +25,7 @@ import { buildVaultDirectory } from "../utils/vaultExporter.js";
  * ═══════════════════════════════════════════════════════════════════
  */
 import { debugLog } from "../utils/logger.js";
-import { FREE_ENTITLEMENTS } from "../utils/entitlements.js";
+import { FREE_ENTITLEMENTS, peekEntitlements, multiTurnPolicy } from "../utils/entitlements.js";
 import { getStorage, activeStorageBackend } from "../storage/index.js";
 import { toKeywordArray } from "../utils/keywordExtractor.js";
 import { getLLMProvider } from "../utils/llm/factory.js";
@@ -550,6 +550,7 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
             `> - 🧠 **Context depth:** ${depth}\n` +
             `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · native materialization incomplete${conflictSuffix}` +
             conflictWarning +
+            localWorkerLine() +
             freeTierUpgradeLine(snapshot.tier));
     }
     if (snapshot.source === "tier-fallback") {
@@ -560,6 +561,7 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
             `> - 🧠 **Context depth:** ${depth}\n` +
             `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · no committed manifest${conflictSuffix}` +
             conflictWarning +
+            localWorkerLine() +
             freeTierUpgradeLine(snapshot.tier));
     }
     return wrap(`> **Prism System Ready**\n>` + undeliveredWarning + `\n` +
@@ -572,6 +574,7 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
         `> - 🧠 **Context depth:** ${depth}\n` +
         `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · committed manifest${conflictSuffix}` +
         conflictWarning +
+        localWorkerLine() +
         freeTierUpgradeLine(snapshot.tier));
 }
 /**
@@ -580,6 +583,22 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
  * queryMemoryNaturalHandler); the startup path — the only guaranteed
  * impression — referenced it zero times.
  */
+/**
+ * One startup line so the host knows, before its first delegation, whether
+ * the local worker takes conversation history and how much. Reads the
+ * entitlements CACHE only — never a portal fetch on the startup path; when
+ * cold, the first prism_infer result carries the same policy.
+ */
+function localWorkerLine() {
+    const ent = peekEntitlements();
+    if (!ent)
+        return "";
+    const p = multiTurnPolicy(ent);
+    return p.enabled
+        ? `\n> - 🧵 **Local worker multi-turn:** on — up to ${p.max_turns} turns / ` +
+            `${p.max_chars.toLocaleString("en-US")} chars per prism_infer call; pass accepted prior turns as \`messages\``
+        : `\n> - 🧵 **Local worker multi-turn:** off on the ${ent.plan} plan — a prism_infer follow-up is answered without context`;
+}
 function freeTierUpgradeLine(tier) {
     if (tier !== "free")
         return "";