prism-mcp-server 20.2.2 → 20.2.4

package/dist/utils/memoryQuality.js

@@ -0,0 +1,51 @@
+const SOURCE_LABEL_PATTERN = /^\s*\[[^\]]+\]\s*/u;
+const GREETING_ONLY_PATTERN = /^(?:hi|hello|hey|ready)(?:[\s.!?,…—-]|[\u{1F300}-\u{1FAFF}]|\uFE0F)*$/iu;
+const GREETING_OPENING_PATTERN = /^(?:hi(?:\s+there)?|hello|hey)\b/iu;
+const ASSISTANCE_INVITATION_PATTERN = /\b(?:(?:how|what)\s+(?:can|may)\s+i\s+(?:help|assist)|let\s+me\s+know\s+what\s+you\s+need)\b/iu;
+const SUBSTANTIVE_OUTCOME_PATTERN = /\b(?:added|built|changed|completed|configured|created|debugged|deployed|fixed|implemented|investigated|removed|repaired|resolved|tested|updated|verified|wrote)\b/iu;
+const STRUCTURED_WORK_FIELDS = ["decisions", "todos", "files_changed"];
+function hasStructuredWork(entry) {
+    return STRUCTURED_WORK_FIELDS.some((field) => {
+        const value = entry[field];
+        if (value === undefined || value === null)
+            return false;
+        return !Array.isArray(value) || value.length > 0;
+    });
+}
+/** Greeting-only assistant replies are presentation, not durable work. */
+export function isGreetingOnlyMemoryEntry(entry) {
+    if (hasStructuredWork(entry))
+        return false;
+    if (typeof entry.event_type === "string" && entry.event_type !== "session")
+        return false;
+    if (typeof entry.summary !== "string")
+        return false;
+    const summary = entry.summary.replace(SOURCE_LABEL_PATTERN, "").trim();
+    if (!summary)
+        return false;
+    if (GREETING_ONLY_PATTERN.test(summary))
+        return true;
+    return GREETING_OPENING_PATTERN.test(summary)
+        && ASSISTANCE_INVITATION_PATTERN.test(summary)
+        && !SUBSTANTIVE_OUTCOME_PATTERN.test(summary);
+}
+export function filterGreetingOnlyMemoryEntries(entries) {
+    return entries.filter((entry) => !isGreetingOnlyMemoryEntry(entry));
+}
+/**
+ * Defensive local-storage fallback for the portal-owned memory policy.
+ * Returns a copy so storage responses remain immutable for other consumers.
+ */
+export function filterPrismMemoryContext(data) {
+    const filtered = { ...data };
+    if (isGreetingOnlyMemoryEntry({ summary: data.last_summary })) {
+        filtered.last_summary = null;
+    }
+    if (Array.isArray(data.recent_sessions)) {
+        filtered.recent_sessions = filterGreetingOnlyMemoryEntries(data.recent_sessions);
+    }
+    if (Array.isArray(data.session_history)) {
+        filtered.session_history = filterGreetingOnlyMemoryEntries(data.session_history);
+    }
+    return filtered;
+}

package/dist/utils/startupRecovery.js

@@ -0,0 +1,13 @@
+const RECOVERABLE_STARTUP_STORAGE_ERROR = /(?:rate limit|(?:HTTP|status)\s*(?:408|425|429|5\d{2})\b|network error|fetch failed|timed?\s*out|timeout|ECONN(?:RESET|REFUSED)|ENOTFOUND|EAI_AGAIN|socket hang up)/i;
+const RECOVERABLE_ENTITLEMENT_PROBE_ERROR = /\[Prism Storage\]\s+Could not verify the Synalux cloud-memory entitlement\b/i;
+export const LOCAL_STARTUP_FALLBACK_NOTICE = "⚠️ Synalux cloud context is temporarily unavailable; showing local last-good context for this startup only.";
+/**
+ * Startup may degrade to the local last-good snapshot only for transient
+ * storage failures. Validation, formatting, and programmer errors must still
+ * fail loud instead of being hidden by an unrelated fallback.
+ */
+export function isRecoverableStartupStorageError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return RECOVERABLE_STARTUP_STORAGE_ERROR.test(message)
+        || RECOVERABLE_ENTITLEMENT_PROBE_ERROR.test(message);
+}

package/docs/prism-browser.md

@@ -0,0 +1,89 @@
+# Prism Browser local testing
+
+`prism browser` is a packaged, agent-facing local browser runner powered by
+Python Playwright. It is intended for repeatable development and acceptance
+checks against applications you control. The npm package contains the runner,
+so a separate app or DMG is not required.
+
+## What it adds to Playwright
+
+- **One CLI across agents.** Codex, Claude, Gemini, Cursor, and shell workflows
+  can invoke the same structured commands when Prism is connected.
+- **Persistent named profiles.** `--profile NAME` reuses Chromium state across
+  launches instead of requiring every agent to build profile management.
+- **Low-overhead multi-step sessions.** Pipe and REPL modes keep one browser
+  session alive while several navigation, DOM, input, wait, and evaluation
+  commands run.
+- **Local preload helpers.** Repeatable `--inject` scripts run before page
+  scripts, allowing deterministic feature flags, fixtures, capability shims,
+  or instrumentation for localhost tests.
+- **A constrained injection boundary.** Injection requires `--local-only`,
+  which rejects public navigation and non-loopback subrequests.
+- **Private audit records.** The runner stores a local audit trail with private
+  filesystem permissions and removes URL credentials, query strings,
+  fragments, common email/phone patterns, and injected source text.
+
+These are orchestration and safety benefits. Prism Browser does not replace
+Playwright Test: use raw Playwright when you need its complete fixture,
+assertion, trace, project, or parallel-worker APIs. Compatibility patches are
+best effort and are not a CAPTCHA-bypass guarantee.
+
+## Install the local runtime
+
+```bash
+pip3 install playwright playwright-stealth
+python3 -m playwright install chromium
+```
+
+The npm package supplies `scripts/dev/browse.py`; the Python runtime supplies
+the browser engine. To use a specific Python installation, set
+`PRISM_PYTHON=/absolute/path/to/python3`.
+
+## Local acceptance flow
+
+```bash
+printf 'open http://127.0.0.1:3000\nwait-for #app\nread-dom #app\n' | \
+  prism browser --headless --local-only --profile acceptance pipe
+```
+
+To install a helper before the application's own scripts:
+
+```bash
+prism browser \
+  --headless \
+  --local-only \
+  --profile acceptance \
+  --inject ./tests/browser-init.js \
+  open http://127.0.0.1:3000
+```
+
+An injected file must be a regular, non-symlinked UTF-8 `.js` or `.mjs` file
+no larger than 256 KiB. The audit log records its SHA-256 digest, not its path
+or contents.
+
+## Verified acceptance cases
+
+The public test suite verifies that:
+
+1. The npm allowlist contains the runner and the compiled CLI resolves it.
+2. A named profile retains state across two separate Chromium launches.
+3. Pipe commands share one live page session.
+4. A preload helper is visible to the application's first page script.
+5. A public subrequest and direct public navigation are blocked in
+   `--local-only` mode.
+6. Audit files use private permissions and omit tested URL secrets, PHI-like
+   values, and injected source.
+7. Missing Python/Playwright dependencies fail with an actionable error.
+
+Run the focused contract with the repository watchdog:
+
+```bash
+MIN_FREE_GB=2 \
+  /path/to/playwright-watchdog.sh \
+  --exec npx vitest run tests/browser-cli.test.ts
+```
+
+The Synalux skill-routing tests separately verify that an authenticated paid
+skill request can receive `local-browser`, while a free request does not. The
+subscription controls skill delivery; the browser runtime still executes on
+the user's machine.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.2.2",
+  "version": "20.2.4",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",
@@ -13,7 +13,9 @@
     "prism-import": "dist/utils/universalImporter.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "scripts/dev/browse.py",
+    "docs/prism-browser.md"
   ],
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",