prism-mcp-server 20.2.2 → 20.2.3

package/README.md

@@ -18,6 +18,45 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ---
 
+## What Prism gives you
+
+- **Session memory that survives restarts** — resume projects with handoff notes,
+  recent work, open TODOs, and configurable quick, standard, or deep context.
+- **Local-first inference** — bounded work is routed through local Ollama models
+  first, with automatic 2B/4B/9B/27B selection based on installed models,
+  available RAM, context fit, and subscription entitlements.
+- **One setup for every agent** — `prism connect` configures Claude Code,
+  Claude Desktop, Cursor, Gemini CLI, and Codex while preserving unrelated
+  settings.
+- **Subscription-aware skills** — entitled skills are synchronized before the
+  host launches, with safe upgrades, downgrades, conflict preservation, and
+  offline last-good recovery.
+- **Hook-free startup** — MCP metadata and native instructions request Prism's
+  startup context without requiring lifecycle hooks or a Prism-owned launcher.
+- **Safe escalation and observability** — inference outcomes are explicit,
+  reserved content remains fail-closed, and local/cloud usage is recorded for
+  review.
+
+## Get started
+
+```bash
+npm install -g prism-mcp-server
+prism connect
+```
+
+Use `prism connect --dry-run` to preview changes, `prism connect --all` to
+configure every detected host, or `prism connect --refresh` to reconcile
+Prism-managed entries after an upgrade. Restart the host after connecting.
+
+Prism works locally without an account, API key, or cloud subscription. Add a
+Synalux subscription when you want cloud memory, paid-tier skills, or team
+features.
+
+---
+
+<details>
+<summary>Release history (optional)</summary>
+
 ## What's New in v20.2.2
 
 ### One Local-First Workflow Across Every Agent
@@ -186,6 +225,8 @@ External contributions now require signing the [Individual CLA](./CLA.md). The C
 
 ---
 
+</details>
+
 ## Quickstart
 
 The free tier needs no account, no API key, and no cloud. Install Prism, then
@@ -521,42 +562,44 @@ The quality gate detected repeated sentences (≥3 of the same sentence in ≥6
 
 ### vs AI coding assistants
 
-These tables are the maintainer's assessment as of June 2026. Verify claims that matter to you — products change fast.
-
-| Feature | Prism Coder | GitHub Copilot | Cursor | Windsurf | Amazon Q | Devin |
-|---|:---:|:---:|:---:|:---:|:---:|:---:|
-| Local inference (open-weight) | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Works fully offline | ✅ (free tier) | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Persistent cross-session memory | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
-| Session drift detection | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
-| L3 grounding verifier | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Behavioral verification (pre-edit) | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
-| MCP server (tools + memory) | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Web IDE | ✅ | ✅ | ❌ | ❌ | ✅ | ✅ |
-| VS Code extension | ✅ | ✅ | — | — | ✅ | ❌ |
-| Flat-rate team pricing | ✅ | ❌ (per-seat) | ❌ (per-seat) | ❌ | ❌ | ❌ |
-| HIPAA BAA available | ✅ (Enterprise) | ❌ | ❌ | ❌ | ❌ | ❌ |
+Product capabilities and plans change frequently. The comparison below is
+intentionally limited to publicly documented differences; it is not a claim
+that another product lacks an unlisted feature.
+
+Legend: ✅ documented, ◐ conditional or plan-dependent, — not compared, ? verify
+with the provider.
+
+| Capability | Prism Coder | GitHub Copilot | Cursor | Amazon Q Developer |
+|---|:---:|:---:|:---:|:---:|
+| Local/open-weight inference | ✅ | ◐ | ◐ | ◐ |
+| Offline workflow | ✅ | ◐ | ? | ? |
+| Cross-session memory | ✅ | ◐ ([docs](https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference)) | ◐ | ◐ |
+| MCP integration | ✅ | ✅ ([docs](https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference)) | ✅ ([pricing](https://cursor.com/en-US/pricing)) | ◐ |
+| Local-first model routing | ✅ | ◐ | ◐ | ◐ |
+| Session drift and grounding checks | ✅ | — | — | — |
+| Setup surface | ✅ five hosts | ✅ CLI/IDE | ✅ editor/agents | ✅ IDE/CLI ([overview](https://aws.amazon.com/q/developer/build/)) |
+| Pricing model | ✅ Synalux tiers | ◐ | ◐ ([pricing](https://cursor.com/en-US/pricing)) | ✅ free + $19 Pro ([pricing](https://aws.amazon.com/q/developer/pricing/)) |
+
+Prism-specific compliance, contractual, and pricing terms are documented in
+the Synalux service agreement. Do not infer a competitor's HIPAA, BAA, or data
+handling status from this table.
 
 ### vs local AI / memory tools
 
 | Feature | Prism Coder | Ollama | LM Studio | Mem0 | Zep |
 |---|:---:|:---:|:---:|:---:|:---:|
-| Local inference cascade | ✅ | ✅ | ✅ | ❌ | ❌ |
-| Cloud fallback | ✅ | ❌ | ❌ | ❌ | ❌ |
-| Persistent cross-session memory | ✅ | ❌ | ❌ | ✅ | ✅ |
-| Knowledge ingestion (MCP + webhook) | ✅ | ❌ | ❌ | ❌ | ❌ |
-| Cognitive routing (3-store) | ✅ | ❌ | ❌ | ❌ | ❌ |
-| Session drift detection | ✅ | ❌ | ❌ | ❌ | ❌ |
-| Native MCP server | ✅ | ❌ | ❌ | ❌ | ❌ |
-| Web IDE + VS Code extension | ✅ | ❌ | ❌ | ❌ | ❌ |
-
-### Pricing — flat-rate, not per-seat
-
-| | **Prism Coder** | GitHub Copilot | Cursor | Amazon Q |
-|---|:---:|:---:|:---:|:---:|
-| **Individual** | **$19/mo** | $10/mo | $20/mo | $19/mo |
-| **Team (5 devs)** | **$49/mo flat** | $95/mo | $200/mo | $95/mo |
-| **Enterprise (25 devs)** | **$99/mo flat** | $195/mo | $1,000/mo | Custom |
+| Local inference cascade | ✅ | ✅ runtime | ✅ app | — | — |
+| Cloud fallback | ✅ optional | — | ◐ provider-dependent | ◐ | ◐ |
+| Persistent memory | ✅ | — | ◐ project context | ✅ | ✅ |
+| Knowledge/tool integration | ✅ MCP + ingestion | ◐ APIs | ◐ integrations | ✅ SDK/API | ✅ SDK/API |
+| MCP server | ✅ native | — | ◐ client integration | ◐ client integration | ◐ client integration |
+
+### Pricing
+
+Prism's current published tiers are listed below. Competitor pricing is
+usage- and plan-dependent, so consult the provider directly: [GitHub
+Copilot](https://github.com/features/copilot/plans), [Cursor](https://cursor.com/en-US/pricing),
+and [Amazon Q Developer](https://aws.amazon.com/q/developer/pricing/).
 
 ---
 
@@ -686,10 +729,37 @@ prism save                # save ledger + handoff
 prism search <query>      # search code across repos (exact / regex / symbol / semantic)
 prism review <files...>   # AI code review — security, performance, style
 prism scan <files...>     # security scan — secrets, licenses, Dockerfile
+prism browser ...         # persistent local browser testing and structured automation
 prism push                # push local SQLite to the cloud backend
 prism register-models     # alias dcostenco/prism-coder:* -> prism-coder:*
 ```
 
+### `prism browser` — local browser testing
+
+The npm package includes Prism's Python/Playwright browser runner; no separate
+Prism Browser app or DMG is required. It adds a stable agent-facing CLI around
+Playwright with reusable named profiles, multi-action pipe/REPL sessions,
+redacted local audit logs, and guarded preload scripts for local apps. Use pipe
+or REPL mode when several actions must share one page session:
+
+```bash
+printf 'open http://127.0.0.1:3000\nwait-for #app\nread-dom #app\n' | \
+  prism browser --headless --local-only pipe
+```
+
+Local apps can load repeatable pre-navigation test helpers with
+`--inject ./tests/browser-init.js`. Custom injection requires `--local-only`;
+public navigation and non-loopback requests are rejected in that mode. Install
+the local runtime once with `pip3 install playwright playwright-stealth` and
+`python3 -m playwright install chromium`.
+
+Use raw Playwright for authored suites that need its full assertion, tracing,
+fixture, and parallel-worker APIs. Use `prism browser` when an AI agent needs a
+small, persistent, auditable local browser session through one consistent CLI.
+The compatibility patches are best effort; they are not a CAPTCHA-bypass
+guarantee. See [Prism Browser local testing](docs/prism-browser.md) for the
+command surface, safety model, and verified acceptance cases.
+
 ### `prism search` — semantic code search
 
 <p align="center">

package/dist/browserCli.js

@@ -0,0 +1,56 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+export function resolveBundledBrowserScript() {
+    return fileURLToPath(new URL('../scripts/dev/browse.py', import.meta.url));
+}
+export function pythonCandidates(env = process.env, platform = process.platform) {
+    if (env.PRISM_PYTHON) {
+        return [{ executable: env.PRISM_PYTHON, prefixArgs: [] }];
+    }
+    return platform === 'win32'
+        ? [
+            { executable: 'py', prefixArgs: ['-3'] },
+            { executable: 'python', prefixArgs: [] },
+        ]
+        : [
+            { executable: 'python3', prefixArgs: [] },
+            { executable: 'python', prefixArgs: [] },
+        ];
+}
+export function resolvePythonCommand(env = process.env, platform = process.platform) {
+    for (const candidate of pythonCandidates(env, platform)) {
+        const result = spawnSync(candidate.executable, [...candidate.prefixArgs, '--version'], { env, encoding: 'utf8', shell: false });
+        if (!result.error && result.status === 0)
+            return candidate;
+    }
+    return null;
+}
+export function hasPlaywrightRuntime(python, env = process.env) {
+    const result = spawnSync(python.executable, [...python.prefixArgs, '-c', 'import playwright.sync_api'], { env, encoding: 'utf8', shell: false });
+    return !result.error && result.status === 0;
+}
+export async function runBrowserCli(args, env = process.env) {
+    const scriptPath = resolveBundledBrowserScript();
+    if (!existsSync(scriptPath)) {
+        throw new Error(`Bundled Prism Browser script is missing: ${scriptPath}`);
+    }
+    const python = resolvePythonCommand(env);
+    if (!python) {
+        throw new Error('Python 3 is required for Prism Browser. Set PRISM_PYTHON to a Python 3 executable.');
+    }
+    if (!args.includes('--help') && !args.includes('-h') && !hasPlaywrightRuntime(python, env)) {
+        throw new Error('Python Playwright is required. Run: pip3 install playwright playwright-stealth && python3 -m playwright install chromium');
+    }
+    return await new Promise((resolve, reject) => {
+        const child = spawn(python.executable, [...python.prefixArgs, scriptPath, ...args], { env, shell: false, stdio: 'inherit' });
+        child.once('error', reject);
+        child.once('exit', (code, signal) => {
+            if (signal) {
+                reject(new Error(`Prism Browser terminated by signal ${signal}`));
+                return;
+            }
+            resolve(code ?? 1);
+        });
+    });
+}

package/dist/cli.js

@@ -9,6 +9,7 @@ import { PRISM_USER_ID, SERVER_CONFIG } from './config.js';
 import { getCurrentGitState } from './utils/git.js';
 import { sessionBootstrapHandler, sessionLoadContextHandler, sessionSaveLedgerHandler, sessionSaveHandoffHandler, } from './tools/ledgerHandlers.js';
 import { configureClaudeAgentPolicy, configureClaudeNativeStartup, configureCodexAgentPolicy, configureCodexNativeStartup, configureGeminiAgentPolicy, configureGeminiNativeStartup, connectHosts, migrateLegacyClaudeHooks, migrateLegacyClaudeInstructions, migrateLegacyClaudeManagedStartup, migrateLegacyClaudeProjectMcp, normalizeHostName, } from './connect.js';
+import { runBrowserCli } from './browserCli.js';
 const program = new Command();
 /** Build the stable `prism load --json` envelope from depth-specific context. */
 export function buildLoadJsonOutput(project, data, level, metadata) {
@@ -82,6 +83,11 @@ program
     .command('bootstrap')
     .description('Print the canonical dashboard-configured first-turn Prism greeting')
     .action(runBootstrapCommand);
+// Parsed by the direct dispatch at the bottom so all Python CLI flags pass
+// through unchanged. Registering it here keeps the command visible in help.
+program
+    .command('browser')
+    .description('Run the packaged local Prism Browser automation CLI');
 // ─── prism connect ────────────────────────────────────────────
 // Registers this installed package with supported MCP hosts. The
 // merge is additive: an existing `prism` or `prism-mcp` entry is
@@ -834,4 +840,17 @@ program
     if (fail > 0)
         process.exit(1);
 });
-await program.parseAsync(process.argv);
+if (process.argv[2] === 'browser') {
+    try {
+        const exitCode = await runBrowserCli(process.argv.slice(3));
+        if (exitCode !== 0)
+            process.exitCode = exitCode;
+    }
+    catch (err) {
+        console.error(`Prism Browser failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+    }
+}
+else {
+    await program.parseAsync(process.argv);
+}

package/docs/prism-browser.md

@@ -0,0 +1,89 @@
+# Prism Browser local testing
+
+`prism browser` is a packaged, agent-facing local browser runner powered by
+Python Playwright. It is intended for repeatable development and acceptance
+checks against applications you control. The npm package contains the runner,
+so a separate app or DMG is not required.
+
+## What it adds to Playwright
+
+- **One CLI across agents.** Codex, Claude, Gemini, Cursor, and shell workflows
+  can invoke the same structured commands when Prism is connected.
+- **Persistent named profiles.** `--profile NAME` reuses Chromium state across
+  launches instead of requiring every agent to build profile management.
+- **Low-overhead multi-step sessions.** Pipe and REPL modes keep one browser
+  session alive while several navigation, DOM, input, wait, and evaluation
+  commands run.
+- **Local preload helpers.** Repeatable `--inject` scripts run before page
+  scripts, allowing deterministic feature flags, fixtures, capability shims,
+  or instrumentation for localhost tests.
+- **A constrained injection boundary.** Injection requires `--local-only`,
+  which rejects public navigation and non-loopback subrequests.
+- **Private audit records.** The runner stores a local audit trail with private
+  filesystem permissions and removes URL credentials, query strings,
+  fragments, common email/phone patterns, and injected source text.
+
+These are orchestration and safety benefits. Prism Browser does not replace
+Playwright Test: use raw Playwright when you need its complete fixture,
+assertion, trace, project, or parallel-worker APIs. Compatibility patches are
+best effort and are not a CAPTCHA-bypass guarantee.
+
+## Install the local runtime
+
+```bash
+pip3 install playwright playwright-stealth
+python3 -m playwright install chromium
+```
+
+The npm package supplies `scripts/dev/browse.py`; the Python runtime supplies
+the browser engine. To use a specific Python installation, set
+`PRISM_PYTHON=/absolute/path/to/python3`.
+
+## Local acceptance flow
+
+```bash
+printf 'open http://127.0.0.1:3000\nwait-for #app\nread-dom #app\n' | \
+  prism browser --headless --local-only --profile acceptance pipe
+```
+
+To install a helper before the application's own scripts:
+
+```bash
+prism browser \
+  --headless \
+  --local-only \
+  --profile acceptance \
+  --inject ./tests/browser-init.js \
+  open http://127.0.0.1:3000
+```
+
+An injected file must be a regular, non-symlinked UTF-8 `.js` or `.mjs` file
+no larger than 256 KiB. The audit log records its SHA-256 digest, not its path
+or contents.
+
+## Verified acceptance cases
+
+The public test suite verifies that:
+
+1. The npm allowlist contains the runner and the compiled CLI resolves it.
+2. A named profile retains state across two separate Chromium launches.
+3. Pipe commands share one live page session.
+4. A preload helper is visible to the application's first page script.
+5. A public subrequest and direct public navigation are blocked in
+   `--local-only` mode.
+6. Audit files use private permissions and omit tested URL secrets, PHI-like
+   values, and injected source.
+7. Missing Python/Playwright dependencies fail with an actionable error.
+
+Run the focused contract with the repository watchdog:
+
+```bash
+MIN_FREE_GB=2 \
+  /path/to/playwright-watchdog.sh \
+  --exec npx vitest run tests/browser-cli.test.ts
+```
+
+The Synalux skill-routing tests separately verify that an authenticated paid
+skill request can receive `local-browser`, while a free request does not. The
+subscription controls skill delivery; the browser runtime still executes on
+the user's machine.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.2.2",
+  "version": "20.2.3",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",
@@ -13,7 +13,9 @@
     "prism-import": "dist/utils/universalImporter.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "scripts/dev/browse.py",
+    "docs/prism-browser.md"
   ],
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",