prism-mcp-server 20.2.5 → 20.2.7

package/dist/session/sessionContext.js

@@ -1,11 +1,11 @@
 /**
- * Session state tracking — connection-scoped, in-process.
+ * Session state tracking — in-process hot path with a durable local receipt.
  *
  * This is NOT business logic — it's MCP connection lifecycle state.
  * Business logic (skill routing, budget tranching, content resolution)
  * lives in the synalux portal at /api/v1/prism/skills.
  *
- * What stays here (connection-scoped, cannot be portal-side):
+ * What stays here (host lifecycle state, cannot be portal-side):
  *   markContextLoaded / requireContextLoaded — write-gate for session tools
  *   noteInferenceForSession — telemetry counter
  *   drift timer — connection-scoped GATE 5 enforcement
@@ -14,9 +14,12 @@
  *   Skill routing, budget tranching, content loading, phantom detection,
  *   prompt-keyword matching, user-local skill loading, context-discovery.
  */
+import { createHash } from "node:crypto";
 import { BOUNDARIES_VERSION as CURRENT_BOUNDARIES_VERSION } from "../boundaries/boundaries.js";
+import * as configStorage from "../storage/configStorage.js";
 const SESSION_TTL_MS = 6 * 60 * 60 * 1000; // 6 h — conversation-scoped
 const MAX_SESSIONS = 10_000;
+const RECEIPT_CLOCK_SKEW_MS = 60_000;
 /**
  * Connection-scoped fallback: remember the last conversation_id seen via
  * markContextLoaded so that tools which don't carry conversation_id
@@ -81,6 +84,62 @@ export function markContextLoaded(conversationId, project, boundariesVersion) {
     s.boundariesVersion = boundariesVersion;
     lastSeenConversationId = conversationId;
 }
+function contextNotLoadedError(project) {
+    const projectNote = project
+        ? " the requested project was not loaded for this conversation."
+        : "";
+    return {
+        blocked: true,
+        error: "context_not_loaded:" + projectNote + " Call session_bootstrap(conversation_id) or " +
+            "session_load_context(project, conversation_id) " +
+            "before this action. This project-scoped tool needs confirmed working context " +
+            "to act correctly. (Enforced server-side — applies to every host.)",
+    };
+}
+function contextExpiredError() {
+    return {
+        blocked: true,
+        error: "context_not_loaded: session expired (6 h TTL). Call " +
+            "session_bootstrap(conversation_id) or session_load_context(project, conversation_id) again. " +
+            "(Enforced server-side — applies to every host.)",
+    };
+}
+function hashReceiptScope(kind, value) {
+    return createHash("sha256").update(`prism-session-${kind}\0${value}`).digest("hex");
+}
+async function persistContextReceipt(conversationId, project, boundariesVersion, loadedAt) {
+    const now = Date.now();
+    const receipt = {
+        conversationHash: hashReceiptScope("conversation", conversationId),
+        projectHash: hashReceiptScope("project", project),
+        project,
+        boundariesVersion,
+        loadedAt,
+        lastSeen: now,
+    };
+    await configStorage.saveSessionContextReceipt(receipt, now - SESSION_TTL_MS);
+}
+async function persistContextReceiptBestEffort(conversationId, project, boundariesVersion, loadedAt) {
+    try {
+        await persistContextReceipt(conversationId, project, boundariesVersion, loadedAt);
+    }
+    catch (error) {
+        // Keep the established same-process path available on read-only or damaged
+        // config stores, but make degraded restart recovery visible to operators.
+        console.error(`[sessionContext] Durable context receipt unavailable for project "${project}": ` +
+            `${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Registers successful context materialization and persists an opaque receipt.
+ * The conversation_id never leaves this process unhashed.
+ */
+export async function registerContextLoaded(conversationId, project, boundariesVersion) {
+    markContextLoaded(conversationId, project, boundariesVersion);
+    noteDriftSessionStart(conversationId);
+    const s = sessions.get(conversationId);
+    await persistContextReceiptBestEffort(conversationId, project, boundariesVersion, s?.driftSessionStart ?? Date.now());
+}
 /**
  * Soft gate for handlers that need project context to be CORRECT (not safe).
  *
@@ -108,21 +167,10 @@ export function requireContextLoaded(conversationId) {
     // even if no write has triggered eviction yet. Evict immediately on detection.
     if (s && (Date.now() - s.lastSeen) > SESSION_TTL_MS) {
         sessions.delete(conversationId);
-        return {
-            blocked: true,
-            error: "context_not_loaded: session expired (6 h TTL). Call " +
-                "session_bootstrap(conversation_id) or session_load_context(project, conversation_id) again. " +
-                "(Enforced server-side — applies to every host.)",
-        };
+        return contextExpiredError();
     }
     if (!s || !s.contextLoaded) {
-        return {
-            blocked: true,
-            error: "context_not_loaded: call session_bootstrap(conversation_id) or " +
-                "session_load_context(project, conversation_id) " +
-                "before this action. This project-scoped tool needs confirmed working context " +
-                "to act correctly. (Enforced server-side — applies to every host.)",
-        };
+        return contextNotLoadedError();
     }
     // Touch on valid read — maintains LRU order.
     touch(conversationId, s);
@@ -139,6 +187,56 @@ export function requireContextLoaded(conversationId) {
     }
     return null;
 }
+/**
+ * Project-scoped durable gate used by ledger and handoff writes.
+ *
+ * The in-memory state remains the hot path. If another MCP process loaded the
+ * requested project, or this process restarted, an unexpired hashed receipt
+ * restores only that exact project. Unknown, malformed, expired, and
+ * cross-project lookups remain fail-closed.
+ */
+export async function requireContextLoadedForProject(conversationId, project) {
+    if (conversationId === undefined)
+        return null;
+    if (!conversationId || !project.trim())
+        return contextNotLoadedError(project || undefined);
+    const memoryGate = requireContextLoaded(conversationId);
+    const memoryState = sessions.get(conversationId);
+    if (memoryState?.contextLoaded && memoryState.project === project &&
+        !(memoryGate && memoryGate.blocked)) {
+        await persistContextReceiptBestEffort(conversationId, project, memoryState.boundariesVersion ?? CURRENT_BOUNDARIES_VERSION, memoryState.driftSessionStart ?? memoryState.lastSeen);
+        return memoryGate;
+    }
+    let receipt = null;
+    try {
+        receipt = await configStorage.getSessionContextReceipt(hashReceiptScope("conversation", conversationId), hashReceiptScope("project", project));
+    }
+    catch (error) {
+        console.error(`[sessionContext] Durable context receipt lookup failed for project "${project}": ` +
+            `${error instanceof Error ? error.message : String(error)}`);
+        return memoryGate && memoryGate.blocked ? memoryGate : contextNotLoadedError(project);
+    }
+    if (!receipt)
+        return memoryGate?.blocked ? memoryGate : contextNotLoadedError(project);
+    const now = Date.now();
+    const invalidReceipt = receipt.project !== project ||
+        !Number.isFinite(receipt.loadedAt) ||
+        !Number.isFinite(receipt.lastSeen) ||
+        receipt.loadedAt <= 0 ||
+        receipt.loadedAt > receipt.lastSeen ||
+        receipt.lastSeen > now + RECEIPT_CLOCK_SKEW_MS;
+    if (invalidReceipt)
+        return contextNotLoadedError(project);
+    if ((now - receipt.lastSeen) > SESSION_TTL_MS)
+        return contextExpiredError();
+    markContextLoaded(conversationId, project, receipt.boundariesVersion);
+    const restored = sessions.get(conversationId);
+    if (restored)
+        restored.driftSessionStart = receipt.loadedAt;
+    const restoredGate = requireContextLoaded(conversationId);
+    await persistContextReceiptBestEffort(conversationId, project, receipt.boundariesVersion, receipt.loadedAt);
+    return restoredGate;
+}
 /** Best-effort telemetry from prism_infer. Never affects a safety decision. */
 export function noteInferenceForSession(conversationId, info) {
     // Only update sessions that already exist — don't create ghost stubs for

package/dist/storage/configStorage.js

@@ -61,6 +61,17 @@ export async function initConfigStorage() {
         owner TEXT NOT NULL DEFAULT 'prism',
         updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
       )
+    `);
+        await client.execute(`
+      CREATE TABLE IF NOT EXISTS session_context_receipts (
+        conversation_hash TEXT NOT NULL,
+        project_hash TEXT NOT NULL,
+        project TEXT NOT NULL,
+        boundaries_version TEXT NOT NULL,
+        loaded_at INTEGER NOT NULL,
+        last_seen INTEGER NOT NULL,
+        PRIMARY KEY (conversation_hash, project_hash)
+      )
     `);
         // Preload all rows into the cache so subsequent reads are zero-cost.
         const rs = await client.execute("SELECT key, value FROM system_settings");
@@ -192,6 +203,95 @@ export function getSettingSync(key, defaultValue = "") {
         return defaultValue;
     return settingsCache[key] ?? defaultValue;
 }
+const SHA256_HEX_RE = /^[a-f0-9]{64}$/;
+function validateSessionContextReceipt(receipt) {
+    if (!SHA256_HEX_RE.test(receipt.conversationHash) ||
+        !SHA256_HEX_RE.test(receipt.projectHash) ||
+        !receipt.project.trim() ||
+        !receipt.boundariesVersion.trim() ||
+        !Number.isFinite(receipt.loadedAt) ||
+        !Number.isFinite(receipt.lastSeen)) {
+        throw new Error("Invalid session context receipt");
+    }
+}
+/**
+ * Persists only hashes of the caller-supplied identifiers. The project name is
+ * retained so recovery can verify that a hash lookup did not cross scopes.
+ * Expired rows are pruned in the same transaction to keep the local table
+ * bounded by active sessions rather than process lifetime.
+ */
+export async function saveSessionContextReceipt(receipt, expiresBefore) {
+    validateSessionContextReceipt(receipt);
+    if (!Number.isFinite(expiresBefore))
+        throw new Error("Invalid session receipt expiry");
+    await initConfigStorage();
+    const client = getClient();
+    await client.batch([
+        {
+            sql: "DELETE FROM session_context_receipts WHERE last_seen < ?",
+            args: [expiresBefore],
+        },
+        {
+            sql: `
+        INSERT INTO session_context_receipts (
+          conversation_hash,
+          project_hash,
+          project,
+          boundaries_version,
+          loaded_at,
+          last_seen
+        )
+        VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(conversation_hash, project_hash) DO UPDATE SET
+          project = excluded.project,
+          boundaries_version = excluded.boundaries_version,
+          loaded_at = excluded.loaded_at,
+          last_seen = excluded.last_seen
+      `,
+            args: [
+                receipt.conversationHash,
+                receipt.projectHash,
+                receipt.project,
+                receipt.boundariesVersion,
+                receipt.loadedAt,
+                receipt.lastSeen,
+            ],
+        },
+    ], "write");
+}
+export async function getSessionContextReceipt(conversationHash, projectHash) {
+    if (!SHA256_HEX_RE.test(conversationHash) || !SHA256_HEX_RE.test(projectHash)) {
+        return null;
+    }
+    await initConfigStorage();
+    const rs = await getClient().execute({
+        sql: `
+      SELECT project, boundaries_version, loaded_at, last_seen
+      FROM session_context_receipts
+      WHERE conversation_hash = ? AND project_hash = ?
+      LIMIT 1
+    `,
+        args: [conversationHash, projectHash],
+    });
+    if (rs.rows.length === 0)
+        return null;
+    const row = rs.rows[0];
+    const receipt = {
+        conversationHash,
+        projectHash,
+        project: String(row.project ?? ""),
+        boundariesVersion: String(row.boundaries_version ?? ""),
+        loadedAt: Number(row.loaded_at),
+        lastSeen: Number(row.last_seen),
+    };
+    try {
+        validateSessionContextReceipt(receipt);
+        return receipt;
+    }
+    catch {
+        return null;
+    }
+}
 export async function getSetting(key, defaultValue = "") {
     await initConfigStorage();
     // Serve from cache when warm (the common case after startup).

package/dist/tools/graphHandlers.js

@@ -63,7 +63,7 @@ export async function knowledgeSearchHandler(args) {
     }
     // Phase 1: destructure enable_trace (defaults to false for backward compat)
     const { project, query, category, limit = 10, enable_trace = false, activation } = args;
-    debugLog(`[knowledge_search] Searching: project=${project || "all"}, query="${query || ""}", category=${category || "any"}, limit=${limit}`);
+    debugLog(`[knowledge_search] Searching: project=${project || "all"}, query_chars=${query?.length || 0}, category=${category || "any"}, limit=${limit}`);
     // Phase 1: Capture total start time for latency measurement
     const totalStart = performance.now();
     const storage = await getStorage();
@@ -89,7 +89,8 @@ export async function knowledgeSearchHandler(args) {
     });
     const storageMs = performance.now() - storageStart;
     const totalMs = performance.now() - totalStart;
-    if (!data) {
+    const resultCount = Array.isArray(data?.results) ? data.results.length : 0;
+    if (!data || resultCount === 0) {
         // Phase 1: Use contentBlocks array instead of inline object
         // so we can conditionally push the trace block at content[1]
         const contentBlocks = [{
@@ -135,14 +136,14 @@ export async function knowledgeSearchHandler(args) {
     // Phase 1: Wrap in contentBlocks array for optional trace attachment
     const contentBlocks = [{
             type: "text",
-            text: `🧠 Found ${data.count} knowledge entries:\n\n${JSON.stringify(data.results || data, null, 2)}`,
+            text: `🧠 Found ${resultCount} knowledge entries:\n\n${JSON.stringify(data.results, null, 2)}`,
         }];
     // Phase 1: Attach MemoryTrace with strategy="keyword" and timing data
     if (enable_trace) {
         const trace = createMemoryTrace({
             strategy: "keyword",
             query: query || "",
-            resultCount: data.count,
+            resultCount,
             topScore: null, // keyword search doesn't produce similarity scores
             threshold: null, // keyword search has no threshold concept
             embeddingMs: 0, // no embedding needed for keyword search

package/dist/tools/handlers.js

@@ -57,7 +57,7 @@ export async function braveWebSearchCodeModeHandler(args) {
         };
     }
     // 1. Fetch raw data
-    debugLog(`Fetching web search for code mode: "${query}"`);
+    debugLog(`Fetching web search for code mode: query_chars=${query.length}`);
     const rawDataStr = await performWebSearchRaw(query, count, offset);
     const beforeSizeKB = (Buffer.byteLength(rawDataStr, 'utf8') / 1024).toFixed(1);
     // 2. Run code mode sandbox
@@ -94,7 +94,7 @@ export async function braveLocalSearchCodeModeHandler(args) {
             isError: true,
         };
     }
-    debugLog(`Fetching local search for code mode: "${query}"`);
+    debugLog(`Fetching local search for code mode: query_chars=${query.length}`);
     const rawDataStr = await performLocalSearchRaw(query, count);
     const beforeSizeKB = (Buffer.byteLength(rawDataStr, "utf8") / 1024).toFixed(1);
     debugLog("Executing local search code mode sandbox...");

package/dist/tools/ledgerHandlers.js

@@ -275,8 +275,8 @@ export async function sessionSaveLedgerHandler(args) {
     // silently wrong write. Does NOT gate safety — prism_infer handles that.
     let _saveLedgerGateWarning;
     {
-        const { requireContextLoaded } = await import("../session/sessionContext.js");
-        const gate = requireContextLoaded(args.conversation_id);
+        const { requireContextLoadedForProject } = await import("../session/sessionContext.js");
+        const gate = await requireContextLoadedForProject(args.conversation_id, args.project);
         if (gate !== null && gate.blocked) {
             return { content: [{ type: "text", text: gate.error }], isError: true };
         }
@@ -452,8 +452,8 @@ export async function sessionSaveHandoffHandler(args, server) {
     }
     let _saveHandoffGateWarning;
     {
-        const { requireContextLoaded } = await import("../session/sessionContext.js");
-        const gate = requireContextLoaded(args.conversation_id);
+        const { requireContextLoadedForProject } = await import("../session/sessionContext.js");
+        const gate = await requireContextLoadedForProject(args.conversation_id, args.project);
         if (gate !== null && gate.blocked) {
             return { content: [{ type: "text", text: gate.error }], isError: true };
         }
@@ -885,10 +885,9 @@ export async function sessionLoadContextHandler(args, options = {}) {
             }
         }
         if (convId) {
-            const { markContextLoaded, noteDriftSessionStart } = await import("../session/sessionContext.js");
+            const { registerContextLoaded } = await import("../session/sessionContext.js");
             const { BOUNDARIES_VERSION } = await import("../boundaries/boundaries.js");
-            markContextLoaded(convId, project, BOUNDARIES_VERSION);
-            noteDriftSessionStart(convId);
+            await registerContextLoaded(convId, project, BOUNDARIES_VERSION);
         }
         const freshText = `No session context found for project "${project}" at level ${level}.\n` +
             `This project has no previous session history. Starting fresh.` +
@@ -1163,10 +1162,9 @@ export async function sessionLoadContextHandler(args, options = {}) {
         }
         nativeContext += `\n**Session Version:** ${version === null || version === undefined ? "None" : compact(version, 40)}\n`;
         if (convId) {
-            const { markContextLoaded, noteDriftSessionStart } = await import("../session/sessionContext.js");
+            const { registerContextLoaded } = await import("../session/sessionContext.js");
             const { BOUNDARIES_VERSION } = await import("../boundaries/boundaries.js");
-            markContextLoaded(convId, project, BOUNDARIES_VERSION);
-            noteDriftSessionStart(convId);
+            await registerContextLoaded(convId, project, BOUNDARIES_VERSION);
         }
         return {
             content: [{
@@ -1407,10 +1405,9 @@ export async function sessionLoadContextHandler(args, options = {}) {
             responseText += `\n\n[ℹ️ Sections omitted to fit token budget (${maxTokens} tokens): ${droppedSections.join(", ")}. Skills and behavioral rules were preserved.]`;
         }
         if (convId) {
-            const { markContextLoaded, noteDriftSessionStart } = await import("../session/sessionContext.js");
+            const { registerContextLoaded } = await import("../session/sessionContext.js");
             const { BOUNDARIES_VERSION } = await import("../boundaries/boundaries.js");
-            markContextLoaded(convId, project, BOUNDARIES_VERSION);
-            noteDriftSessionStart(convId);
+            await registerContextLoaded(convId, project, BOUNDARIES_VERSION);
         }
         return {
             content: [{ type: "text", text: responseText + MEMORY_BOUNDARY_SUFFIX }],
@@ -1419,10 +1416,9 @@ export async function sessionLoadContextHandler(args, options = {}) {
     }
     let responseText = criticalPrefix + lowerPriority + historySection;
     if (convId) {
-        const { markContextLoaded, noteDriftSessionStart } = await import("../session/sessionContext.js");
+        const { registerContextLoaded } = await import("../session/sessionContext.js");
         const { BOUNDARIES_VERSION } = await import("../boundaries/boundaries.js");
-        markContextLoaded(convId, project, BOUNDARIES_VERSION);
-        noteDriftSessionStart(convId);
+        await registerContextLoaded(convId, project, BOUNDARIES_VERSION);
     }
     return {
         content: [{ type: "text", text: responseText + MEMORY_BOUNDARY_SUFFIX }],

package/dist/tools/prismInferHandler.js

@@ -12,7 +12,7 @@
  *   4. On local fail, if cloud_fallback=true:
  *        - exchange synalux_sk_ → JWT (cached)
  *        - POST synalux portal /api/v1/prism/inference
- *        - portal runs its own cascade (9B/27B/Claude by tier)
+ *        - portal serves Gemini 3.6 Flash according to the user's tier
  *   5. Return { output, backend, model_picked, ram_free_mb, latency_ms, used_cloud }
  *
  * `prism_infer` is a thin client. It never calls Anthropic / OpenRouter
@@ -28,6 +28,7 @@ import { getEntitlements, clampCeiling } from "../utils/entitlements.js";
 import { ddLog } from "../utils/ddLogger.js";
 import { stripThink } from "../utils/thinkStrip.js";
 import { passesQualityGate } from "../utils/qualityGate.js";
+import { applyDeterministicCodingRepairs, buildCodingRepairPrompt, passesCodingQualityGate, } from "../utils/codingQualityPolicy.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
 import { callLayer1 as defaultCallLayer1, keywordBackstop } from "../utils/layer1.js";
 import { recordInference, recordThinkOnlyRetry, formatInferenceMetrics, estimateTokens } from "../utils/inferenceMetrics.js";
@@ -61,6 +62,7 @@ const MEMORY_HISTORY_LIMITS = {
 };
 const FAST_TASK_COMPLEXITY_MAX = 3;
 const BALANCED_TASK_COMPLEXITY_MAX = 6;
+const MAX_CODING_REPAIR_ATTEMPTS = 2;
 // ─── Tool Definition ────────────────────────────────────────────
 export const PRISM_INFER_TOOL = {
     name: "prism_infer",
@@ -68,7 +70,7 @@ export const PRISM_INFER_TOOL = {
         "Owns model selection across 27B / 9B / 4B / 2B using an explicit `model_ceiling` or " +
         "the caller's `task_complexity`, then validates loaded memory size, model context, " +
         "entitlements, installed models, and free RAM at call time. " +
-        "Falls through to the synalux portal cloud cascade (9B → 27B → Claude Opus 4.7) " +
+        "Falls through to the Synalux portal Gemini 3.6 Flash cloud fallback " +
         "only when local is unviable AND `cloud_fallback=true`. " +
         "When `project` is provided, loads the dashboard-configured quick/standard/deep handoff and bounded history " +
         "as untrusted historical context for a memory-aware local worker. " +
@@ -448,8 +450,8 @@ async function callSynaluxInference(prompt, maxTokens, timeoutMs, opts) {
         return { ok: false, reason: "jwt_exchange_failed" };
     const url = `${PRISM_SYNALUX_BASE_URL}/api/v1/prism/inference`;
     // reserved=true tells the portal this prompt was refused by local Layer-1
-    // as reserved clinical content: it must be served by Claude or refused —
-    // never by a small local model or OpenRouter (plan v2 §5.1).
+    // as reserved clinical content: it must be served by the portal's
+    // reserved-capable cloud backend or refused — never by a local model.
     const reqBody = JSON.stringify({ prompt, max_tokens: maxTokens, ...(opts?.reserved ? { reserved: true } : {}) });
     try {
         let res = await fetch(url, {
@@ -874,10 +876,82 @@ export async function runInfer(args, deps) {
                 result = await deps.callLocal(deps.ollamaUrl, ollamaName, args.prompt, args.system, maxTokens, temperature, timeout, false);
             }
             if (result.ok) {
-                const { stripped, thinkOnly } = stripThink(result.text);
-                const output = stripped;
+                let { stripped, thinkOnly } = stripThink(result.text);
+                let output = stripped;
                 // Quality gate — all modes. Route uses mode-aware empty floor (length===0).
-                const gate = passesQualityGate(output, thinkOnly, result.doneReason, mode);
+                let gate = passesQualityGate(output, thinkOnly, result.doneReason, mode);
+                if (gate.pass && mode === "code") {
+                    gate = passesCodingQualityGate(args.prompt, output);
+                }
+                // High-precision coding failures get bounded same-tier repair
+                // attempts before cloud escalation. Multiple attempts matter
+                // when syntax repair exposes a second structural defect.
+                for (let repairAttempt = 0; repairAttempt < MAX_CODING_REPAIR_ATTEMPTS; repairAttempt++) {
+                    const codingGateFailure = !gate.pass &&
+                        mode === "code" &&
+                        (gate.reason?.startsWith("code_") === true ||
+                            gate.reason?.startsWith("python_") === true);
+                    if (!codingGateFailure)
+                        break;
+                    const failedReason = gate.reason ?? "code_quality";
+                    const deterministicRepair = applyDeterministicCodingRepairs(output, failedReason);
+                    if (deterministicRepair.changes.length > 0) {
+                        output = deterministicRepair.output;
+                        gate = passesQualityGate(output, false, result.doneReason, mode);
+                        if (gate.pass) {
+                            gate = passesCodingQualityGate(args.prompt, output);
+                        }
+                        attempts.push({
+                            tier: tier.tag,
+                            reason: `code_repair_deterministic:${deterministicRepair.changes.join(",")}`,
+                        });
+                        if (gate.pass)
+                            break;
+                    }
+                    const repair = buildCodingRepairPrompt(args.prompt, output, failedReason);
+                    const repairSystem = args.system
+                        ? `${args.system}\n\n${repair.system}`
+                        : repair.system;
+                    const repairPromptTokens = estimateTokens(repair.prompt) +
+                        estimateTokens(repairSystem) +
+                        CTX_TEMPLATE_MARGIN;
+                    if (repairPromptTokens <= tier.ctxTokens) {
+                        attempts.push({ tier: tier.tag, reason: `code_repair:${failedReason}` });
+                        const repaired = await deps.callLocal(deps.ollamaUrl, ollamaName, repair.prompt, repairSystem, maxTokens, 0, timeout, false);
+                        if (repaired.ok) {
+                            const repairedStripped = stripThink(repaired.text);
+                            const repairedGenericGate = passesQualityGate(repairedStripped.stripped, repairedStripped.thinkOnly, repaired.doneReason, mode);
+                            const repairedGate = repairedGenericGate.pass
+                                ? passesCodingQualityGate(args.prompt, repairedStripped.stripped)
+                                : repairedGenericGate;
+                            result = repaired;
+                            stripped = repairedStripped.stripped;
+                            thinkOnly = repairedStripped.thinkOnly;
+                            output = stripped;
+                            gate = repairedGate;
+                            if (!gate.pass) {
+                                attempts.push({
+                                    tier: tier.tag,
+                                    reason: `code_repair_failed:${gate.reason ?? "quality_gate"}`,
+                                });
+                            }
+                        }
+                        else {
+                            attempts.push({
+                                tier: tier.tag,
+                                reason: `code_repair_error:${repaired.reason}`,
+                            });
+                            break;
+                        }
+                    }
+                    else {
+                        attempts.push({
+                            tier: tier.tag,
+                            reason: "code_repair_skipped:ctx_insufficient",
+                        });
+                        break;
+                    }
+                }
                 if (!gate.pass && allowCloud) {
                     debugLog(`[prism_infer] quality gate FAIL (${gate.reason}) — escalating to cloud`);
                     attempts.push({ tier: tier.tag, reason: `quality_gate:${gate.reason}` });