prism-mcp-server 20.2.7 → 20.2.9

package/README.md

@@ -25,6 +25,10 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 - **Local-first inference** — bounded work is routed through local Ollama models
   first, with automatic 2B/4B/9B/27B selection based on installed models,
   available RAM, context fit, and subscription entitlements.
+- **Route-output enforcement** — route mode returns only well-formed calls to
+  tools the host actually advertised. Standard and higher plans can add
+  authenticated deterministic correction; `route_guard: "local"` keeps the
+  prompt and draft entirely on-device.
 - **One setup for every agent** — `prism connect` configures Claude Code,
   Claude Desktop, Cursor, Gemini CLI, and Codex while preserving unrelated
   settings.
@@ -144,10 +148,16 @@ that would require a host lifecycle hook, launcher, extension, or Prism-owned
 panel. Context loading itself remains complete even when a host shortens the
 visible reply.
 
-Free accounts receive the protected 12-skill foundation. Paid accounts receive
-the current subscribed routing set. Upgrades install newly entitled packages;
-downgrades remove only Prism-owned packages while preserving local skills and
-locally modified conflicts.
+Free accounts receive only the public hook-free `prism-startup` package; the MCP
+server still supplies a compact, non-proprietary safety and evidence contract.
+Authenticated paid accounts receive the protected behavioral and engineering
+packages plus the current subscribed routing set. The paid
+`evidence-first-protocol` keeps ordinary coding lightweight: one correlated
+reproduction is enough to begin an edit, while strict acceptance starts only
+before a completion claim, push, or release and inspects only the exact artifacts
+used as proof. Upgrades install newly entitled packages; verified downgrades
+remove only Prism-owned packages while preserving local skills and locally
+modified conflicts.
 
 When upgrading an older Claude Code installation, `prism connect` removes only
 the exact Prism-owned startup, skill-sync, handoff, and drift hook actions from
@@ -448,10 +458,15 @@ The free tier runs entirely on your machine. Paid tiers add cloud sync through t
 | Inference | Local Ollama models | Local models + Gemini 3.6 Flash fallback |
 | API keys required | None | Synalux subscription key |
 | Web search / scrape | Not included | Via Synalux portal (provider keys server-side) |
-| What leaves your machine | Nothing | Memory text + file paths + search queries, sent to the portal over TLS (PHI-redacted before transit) |
+| What leaves your machine | Nothing | Memory text, file paths, search queries, and inference prompts/drafts when their cloud feature is used, sent to the portal over TLS. Cloud memory writes are PHI-redacted; inference and route requests are transient. |
 | Works offline | ✅ | Local features yes; sync/cloud no |
 
-**Handling sensitive data.** All cloud writes pass through automatic redaction (SSNs, dates of birth, medical record numbers, phone numbers, emails, and clinical identifiers are stripped before transit). For regulated workloads, run the **local tier** for full air-gap, or use **Enterprise** which includes a HIPAA Business Associate Agreement.
+**Handling sensitive data.** Cloud memory writes pass through automatic
+redaction (SSNs, dates of birth, medical record numbers, phone numbers, emails,
+and clinical identifiers are stripped before storage). Cloud inference and
+route correction send the request over TLS for processing and do not store it
+as Prism memory; use `route_guard: "local"` or the **local tier** for a full
+air-gap. **Enterprise** includes a HIPAA Business Associate Agreement.
 
 ---
 
@@ -461,6 +476,14 @@ The `prism-coder` fleet uses Qwen3.5 for MCP tool-routing AND general inference.
 
 `prism_infer` supports three modes: `route` (tool routing, fast, nothink), `chat` (conversation with thinking), and `code` (code generation with thinking). In chat/code modes, the model uses `<think>` blocks for chain-of-thought reasoning, which are stripped before the response is served. If the local model fails a quality gate (empty, think-only, or truncated), paid tiers automatically escalate to Gemini 3.6 Flash via the Synalux portal.
 
+Every route-mode result is parsed locally and checked against `allowed_tools`
+before it reaches the host. Malformed or unadvertised calls become `NO_TOOL`.
+With `route_guard: "auto"` (the default), Standard and higher plans also send
+a well-formed draft for one of Prism's seven trained tools—or an unadvertised
+draft that may need correction—to Synalux for authenticated deterministic
+correction. Advertised custom host tools remain local. Set
+`route_guard: "local"` for a fully on-device route path.
+
 | Model | Ollama tag | Size | [BFCL](https://gorilla.cs.berkeley.edu/blogs/12_bfcl_v3_multi_turn.html) Accuracy | Role | Automatic routing tier |
 |---|---|---|---|---|---|
 | Qwen3.5-4B Q3_K_M | `prism-coder:2b` | 2.3 GB | 99.1% × 3 seeds | iPhone / mobile first gate | Free |
@@ -486,17 +509,25 @@ query → prism-coder:9b (local router, default)
 
 ### Multi-Layer Verification
 
-Every tool-grounded answer on paid tiers passes through deterministic L3 routing rules and an NLI grounding verifier before reaching the user. Free-tier users get the deterministic gates (L1, L3-Tool, L3-Tier0) without the model-based NLI check.
+Route output and evidence-grounded answers use separate gates. Every tier gets
+the local route parser and advertised-tool registry; Standard and higher plans
+can add the private deterministic route correction. Evidence verification is
+opt-in (or automatic when evidence is supplied) and remains separate from route
+selection.
 
 | Layer | What | Model | Cost |
 |---|---|---|---|
 | **L1** | Crisis/medical safety gate | None (regex) | 0 ms |
-| **L3-Tool** | Tool name remap + false-positive rejection | None (deterministic) | 0 ms |
+| **L3-Registry** | Envelope validation + advertised-tool enforcement (all tiers) | None | 0 ms |
+| **L3-Route** | Authenticated deterministic route correction (Standard+) | None | Network latency |
 | **L3-Tier0** | Integer grounding (set membership) | None (deterministic) | 0 ms |
 | **L3-Tier2** | NLI verifier (claim → ENTAILED/NEUTRAL/CONTRADICTED) | prism-coder:2b | ~200 ms |
 | **L4** | Hallucination judge (opt-out for clinical) | prism-coder:4b | ~500 ms |
 
-Fail-closed on the verified path: when the grounding verifier runs (Standard tier and up), timeout, ambiguity, or missing evidence yields a refusal, not pass-through. Free-tier users get the deterministic L1/L3-Tool gates but not the NLI verifier.
+Fail-closed on the verified path: when the grounding verifier runs, timeout,
+ambiguity, or missing evidence yields a refusal, not pass-through. If the paid
+route correction is unavailable, the local registry still blocks malformed
+and unadvertised calls and reports an allowed preserved route as degraded.
 
 ---
 

package/dist/cli.js

@@ -12,6 +12,7 @@ import { configureClaudeAgentPolicy, configureClaudeNativeStartup, configureCode
 import { runBrowserCli } from './browserCli.js';
 import { filterPrismMemoryContext } from './utils/memoryQuality.js';
 import { isRecoverableStartupStorageError } from './utils/startupRecovery.js';
+import { verifyBehaviorHandler } from './tools/behavioralVerifierHandler.js';
 const program = new Command();
 /** Build the stable `prism load --json` envelope from depth-specific context. */
 export function buildLoadJsonOutput(project, data, level, metadata) {
@@ -111,6 +112,50 @@ program
     .command('bootstrap')
     .description('Print the canonical dashboard-configured first-turn Prism greeting')
     .action(runBootstrapCommand);
+/**
+ * One-shot fallback for hosts whose long-lived MCP transport has closed.
+ * This calls the canonical handler, including its authenticated portal path
+ * and fail-closed offline scenario; it never asks the host to invent one.
+ */
+export async function runVerifyBehaviorCommand(options) {
+    try {
+        const baseUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() ||
+            process.env.SYNALUX_BASE_URL?.trim() ||
+            (await getSetting('PRISM_SYNALUX_BASE_URL', '')).trim() ||
+            (await getSetting('SYNALUX_BASE_URL', '')).trim() ||
+            'https://synalux.ai';
+        const apiKey = process.env.PRISM_SYNALUX_API_KEY?.trim() ||
+            (await getSetting('PRISM_SYNALUX_API_KEY', '')).trim();
+        process.env.PRISM_SYNALUX_BASE_URL = baseUrl.replace(/\/+$/, '');
+        if (apiKey)
+            process.env.PRISM_SYNALUX_API_KEY = apiKey;
+        const result = await verifyBehaviorHandler({
+            file_path: options.file,
+            change_summary: options.summary,
+            ...(options.project ? { project: options.project } : {}),
+            ...(options.workspaceId ? { workspace_id: options.workspaceId } : {}),
+        });
+        const output = result.content
+            ?.map((part) => part?.text)
+            .filter(Boolean)
+            .join('\n') || '';
+        if (!output)
+            throw new Error('verify_behavior returned no scenario');
+        console.log(output);
+    }
+    catch (err) {
+        console.error(`Behavioral verification failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+    }
+}
+program
+    .command('verify-behavior')
+    .description('Get the behavioral edit scenario when an MCP transport is unavailable')
+    .requiredOption('--file <path>', 'Path of the file about to be edited')
+    .requiredOption('--summary <text>', 'Brief description of the intended change')
+    .option('--project <project>', 'Project identifier for workspace-scoped scenarios')
+    .option('--workspace-id <id>', 'Workspace ID for custom scenarios')
+    .action(runVerifyBehaviorCommand);
 // Parsed by the direct dispatch at the bottom so all Python CLI flags pass
 // through unchanged. Registering it here keeps the command visible in help.
 program

package/dist/connect.js

@@ -4,6 +4,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 as w
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { EVIDENCE_WORKFLOW_POLICY_LINES } from "./evidenceWorkflowPolicy.js";
 import { LOCAL_FIRST_POLICY_ID, LOCAL_FIRST_POLICY_LINES } from "./localFirstPolicy.js";
 export const CONNECT_HOSTS = [
     "claude-code",
@@ -46,6 +47,8 @@ const CODEX_STARTUP_BODY = [
     "block is managed by `prism connect`; do not edit it manually.",
     "",
     ...LOCAL_FIRST_POLICY_LINES,
+    "",
+    ...EVIDENCE_WORKFLOW_POLICY_LINES,
 ];
 const CONNECT_STORAGE_BACKENDS = ["auto", "local", "synalux", "supabase"];
 const LEGACY_CLAUDE_PROJECT_PRISM_ENTRY = {
@@ -542,6 +545,8 @@ function serializeClaudeStartupBlock(newline) {
         "managed by `prism connect`; do not edit it manually.",
         "",
         ...LOCAL_FIRST_POLICY_LINES,
+        "",
+        ...EVIDENCE_WORKFLOW_POLICY_LINES,
         CLAUDE_STARTUP_MANAGED_END,
         "",
     ].join(newline);
@@ -617,6 +622,8 @@ function serializeGeminiStartupBlock(newline) {
         "session_detect_drift calls. This block is managed by `prism connect`; do not edit it manually.",
         "",
         ...LOCAL_FIRST_POLICY_LINES,
+        "",
+        ...EVIDENCE_WORKFLOW_POLICY_LINES,
         GEMINI_STARTUP_MANAGED_END,
         "",
     ].join(newline);

package/dist/evidenceWorkflowPolicy.js

@@ -0,0 +1,19 @@
+/**
+ * Minimum evidence contract shared by every MCP host.
+ *
+ * Native-skill hosts also receive the full evidence-first protocol. Keep this
+ * compact copy in MCP initialize instructions so hosts without a filesystem
+ * skill surface, including Claude Desktop, still follow the same workflow.
+ */
+export const EVIDENCE_WORKFLOW_POLICY_LINES = [
+    "## Prism evidence workflow",
+    "During diagnosis and editing, one trustworthy correlated reproduction is enough; do not block coding on",
+    "inspecting unrelated diagnostic screenshots, trace frames, or abandoned attempts.",
+    "Before a completion claim, push, or release, exercise the corrected path with fresh evidence from the current",
+    "build and bind stateful proof to the exact run and entity. Inspect every artifact used to support the claim.",
+    "When a screenshot is requested or used as proof, the active agent must open it and compare its visible state",
+    "with the issue's expected and forbidden states. Complete that review yourself; do not ask the user to verify it.",
+    "A screenshot is an observation, not absolute truth. Reject stale, wrong-run, wrong-entity, or visibly failing",
+    "evidence even when its metadata says passed.",
+];
+export const EVIDENCE_WORKFLOW_POLICY_TEXT = EVIDENCE_WORKFLOW_POLICY_LINES.join(" ");

package/dist/lifecycle.js

@@ -262,4 +262,7 @@ export function registerShutdownHandlers() {
     process.stdin.on("close", () => {
         shutdown("CLIENT_DISCONNECTED_STDIN_CLOSED");
     });
+    return (reason) => {
+        void shutdown(reason);
+    };
 }

package/dist/mcpTransportHealth.js

@@ -0,0 +1,70 @@
+const DEFAULT_KEEPALIVE_INTERVAL_MS = 60_000;
+const DEFAULT_PING_TIMEOUT_MS = 15_000;
+/**
+ * Keeps long-idle stdio MCP sessions active and converts a silently dead
+ * client transport into a clean server shutdown. Some hosts retain the child
+ * pipes after their protocol worker closes, so stdin "close" alone cannot
+ * detect the failure.
+ */
+export function monitorMcpTransport(server, options) {
+    const intervalMs = options.intervalMs ?? DEFAULT_KEEPALIVE_INTERVAL_MS;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_PING_TIMEOUT_MS;
+    const previousOnClose = server.onclose;
+    let stopped = false;
+    let pingInFlight = false;
+    const stop = () => {
+        if (stopped)
+            return;
+        stopped = true;
+        clearInterval(timer);
+        if (server.onclose === handleClose) {
+            server.onclose = previousOnClose;
+        }
+    };
+    const fail = (reason, error) => {
+        if (stopped)
+            return;
+        stop();
+        options.onFailure(reason, error);
+    };
+    const handleClose = () => {
+        let closeError;
+        try {
+            previousOnClose?.();
+        }
+        catch (error) {
+            closeError = error instanceof Error ? error : new Error(String(error));
+        }
+        finally {
+            fail("MCP_TRANSPORT_CLOSED", closeError);
+        }
+    };
+    server.onclose = handleClose;
+    const check = async () => {
+        if (stopped || pingInFlight)
+            return;
+        pingInFlight = true;
+        let timeout;
+        try {
+            await Promise.race([
+                server.ping(),
+                new Promise((_, reject) => {
+                    timeout = setTimeout(() => reject(new Error(`MCP keepalive timed out after ${timeoutMs}ms`)), timeoutMs);
+                }),
+            ]);
+        }
+        catch (error) {
+            fail("MCP_KEEPALIVE_FAILED", error instanceof Error ? error : new Error(String(error)));
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+            pingInFlight = false;
+        }
+    };
+    const timer = setInterval(() => {
+        void check();
+    }, intervalMs);
+    timer.unref?.();
+    return stop;
+}

package/dist/server.js

@@ -39,6 +39,7 @@
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { monitorMcpTransport } from "./mcpTransportHealth.js";
 import { buildVSCodePrompt } from "./aba-protocol.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, 
 // ─── v0.4.0: MCP Prompts support (Enhancement #1) ───
@@ -84,6 +85,7 @@ import { inferenceMetricsHandler } from "./utils/inferenceMetrics.js";
 import { recordInvocation } from "./utils/analytics.js";
 import { BOUNDARIES_TEXT } from "./boundaries/boundaries.js";
 import { triggerSkillManifestSync } from "./skillManifestSync.js";
+import { EVIDENCE_WORKFLOW_POLICY_TEXT } from "./evidenceWorkflowPolicy.js";
 import { LOCAL_FIRST_POLICY_TEXT } from "./localFirstPolicy.js";
 // ─── Import Tool Definitions (schemas) and Handlers (implementations) ─────
 import { WEB_SEARCH_TOOL, BRAVE_WEB_SEARCH_CODE_MODE_TOOL, LOCAL_SEARCH_TOOL, BRAVE_LOCAL_SEARCH_CODE_MODE_TOOL, CODE_MODE_TRANSFORM_TOOL, BRAVE_ANSWERS_TOOL, RESEARCH_PAPER_ANALYSIS_TOOL, webSearchHandler, braveWebSearchCodeModeHandler, localSearchHandler, braveLocalSearchCodeModeHandler, codeModeTransformHandler, braveAnswersHandler, researchPaperAnalysisHandler, } from "./tools/index.js";
@@ -327,6 +329,7 @@ export const PRISM_SERVER_INSTRUCTIONS = `Prism MCP — The Mind Palace for AI A
     `Reuse the conversation_id returned by session_bootstrap in structuredContent for those saves and for ` +
     `session_detect_drift, the 60-minute goal-alignment drift check. Do not add the id to the visible greeting.\n\n` +
     `${LOCAL_FIRST_POLICY_TEXT}\n\n` +
+    `${EVIDENCE_WORKFLOW_POLICY_TEXT}\n\n` +
     `Architecture: session_save_ledger and session_save_handoff require context loaded by session_bootstrap ` +
     `or session_load_context when a conversation_id is supplied. ${BOUNDARIES_TEXT} ` +
     `All cloud inference routes through the Synalux portal for billing, tier-gating, and audit.`;
@@ -1252,7 +1255,15 @@ export async function startServer() {
     // Register graceful shutdown handlers (SIGTERM, SIGINT, SIGHUP, stdin close).
     // The stdin close handler is critical — when MCP clients disconnect, they
     // often just close the pipe without sending a signal, leaving zombie processes.
-    registerShutdownHandlers();
+    const requestShutdown = registerShutdownHandlers();
+    monitorMcpTransport(server, {
+        onFailure: (reason, error) => {
+            if (error) {
+                console.error(`[Prism] MCP transport health check failed: ${error.message}`);
+            }
+            requestShutdown(reason);
+        },
+    });
     // Pre-warm storage AFTER connecting — fired async so we never block the
     // stdio handshake. Supabase REST initialization can take 500ms–5s; blocking
     // on it before server.connect() was the root cause of the 1m 56s CLI delay.

package/dist/skillManifestSync.js

@@ -4,7 +4,7 @@ import { access, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realp
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { applyManagedSkillManifest, getSetting, refreshConfigStorageCache, } from "./storage/configStorage.js";
-import { REQUIRED_NATIVE_SKILL_NAMES } from "./tools/skillRouting.js";
+import { FREE_NATIVE_SKILL_NAMES, REQUIRED_NATIVE_SKILL_NAMES } from "./tools/skillRouting.js";
 import { getSynaluxJwt, invalidateSynaluxJwt } from "./utils/synaluxJwt.js";
 const OWNER = "prism-skill-sync-v1";
 const MARKER = ".prism-managed.json";
@@ -181,17 +181,20 @@ export function validateSkillManifest(payload) {
             }
         }
     }
-    const requiredNames = new Set(REQUIRED_NATIVE_SKILL_NAMES);
-    for (const required of REQUIRED_NATIVE_SKILL_NAMES) {
+    const requiredForTier = value.tier === "free"
+        ? FREE_NATIVE_SKILL_NAMES
+        : REQUIRED_NATIVE_SKILL_NAMES;
+    const requiredNames = new Set(requiredForTier);
+    for (const required of requiredForTier) {
         const requiredSkill = skills.find((skill) => skill.name === required);
         if (!requiredSkill)
-            throw new Error(`manifest is missing required protected skill: ${required}`);
+            throw new Error(`manifest is missing required native skill: ${required}`);
         if (!requiredSkill.metadata.protected || !requiredSkill.metadata.categories.includes("universal")) {
-            throw new Error(`required skill is not protected universal: ${required}`);
+            throw new Error(`required native skill is not protected universal: ${required}`);
         }
     }
     if (value.tier === "free" && (skills.length !== requiredNames.size || skills.some((skill) => !requiredNames.has(skill.name)))) {
-        throw new Error("free manifest must contain exactly the protected skill floor");
+        throw new Error("free manifest must contain exactly the public startup package");
     }
     const normalized = {
         schema_version: 1,

package/dist/storage/synalux.js

@@ -20,6 +20,7 @@
  *   Methods migrated to portal:
  *     - saveLedger        → POST /api/v1/prism/memory  action=save_ledger
  *     - saveHandoff       → POST /api/v1/prism/memory  action=save_handoff
+ *     - saveHistorySnapshot → POST /api/v1/prism/memory  action=save_history_snapshot
  *     - loadContext       → POST /api/v1/prism/memory  action=load_context
  *     - searchKnowledge   → POST /api/v1/prism/memory  action=search
  *     - softDeleteLedger  → POST /api/v1/prism/memory  action=forget_memory (Phase 3 Tier A)
@@ -203,7 +204,46 @@ export class SynaluxStorage extends SupabaseStorage {
             role: handoff.role,
             expected_version: expectedVersion ?? undefined,
         });
-        return (result.handoff ?? result);
+        const candidate = Object.prototype.hasOwnProperty.call(result, "result")
+            ? result.result
+            : Object.prototype.hasOwnProperty.call(result, "handoff")
+                ? result.handoff
+                : result;
+        if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+            throw new Error("[SynaluxStorage] Invalid save_handoff response: missing result");
+        }
+        const value = candidate;
+        if (value.status === "conflict" && Number.isSafeInteger(value.current_version)) {
+            return {
+                status: "conflict",
+                current_version: value.current_version,
+            };
+        }
+        if ((value.status === "created" || value.status === "updated")
+            && Number.isSafeInteger(value.version)) {
+            return {
+                status: value.status,
+                version: value.version,
+            };
+        }
+        // Older portal RPC wrappers returned only the new version. Preserve that
+        // rolling-upgrade contract without accepting an unversioned success.
+        if (value.status === undefined && Number.isSafeInteger(value.version)) {
+            return {
+                status: "updated",
+                version: value.version,
+            };
+        }
+        throw new Error("[SynaluxStorage] Invalid save_handoff response: malformed OCC result");
+    }
+    async saveHistorySnapshot(handoff, branch = "main") {
+        await this.portalPost("/api/v1/prism/memory", {
+            action: "save_history_snapshot",
+            project: handoff.project,
+            version: handoff.version,
+            snapshot: handoff,
+            branch,
+        });
     }
     // ─── Context ─────────────────────────────────────────────────
     async loadContext(project, level, userId, role) {

package/dist/tools/behavioralVerifierHandler.js

@@ -8,7 +8,7 @@
  * FAIL-CLOSED: if the portal is unreachable, returns a generic
  * verification challenge rather than skipping verification.
  */
-import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED } from "../config.js";
+import { PRISM_SYNALUX_BASE_URL } from "../config.js";
 import { getSynaluxJwt } from "../utils/synaluxJwt.js";
 const FALLBACK_SCENARIO = [
     "⚠️ BEHAVIORAL VERIFICATION (OFFLINE MODE)",
@@ -33,7 +33,13 @@ export async function verifyBehaviorHandler(args) {
     return { content: [{ type: "text", text: await buildScenarioText(args) }] };
 }
 async function buildScenarioText(args) {
-    if (!SYNALUX_CONFIGURED || !PRISM_SYNALUX_BASE_URL) {
+    const baseUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() ||
+        process.env.SYNALUX_BASE_URL?.trim() ||
+        PRISM_SYNALUX_BASE_URL;
+    // OAuth/JWT-backed installs intentionally do not copy a long-lived API key
+    // into host configuration. A valid portal URL is enough to attempt the
+    // short-lived JWT flow; getSynaluxJwt() remains the fail-closed auth gate.
+    if (!baseUrl) {
         return FALLBACK_SCENARIO;
     }
     const jwt = await getSynaluxJwt();
@@ -42,7 +48,7 @@ async function buildScenarioText(args) {
         return FALLBACK_SCENARIO;
     }
     try {
-        const url = `${PRISM_SYNALUX_BASE_URL}/api/v1/prism/verify-behavior`;
+        const url = `${baseUrl.replace(/\/+$/, "")}/api/v1/prism/verify-behavior`;
         const res = await fetch(url, {
             method: "POST",
             headers: {
@@ -60,7 +66,11 @@ async function buildScenarioText(args) {
             console.error(`[verify-behavior] ⚠️ portal returned ${res.status} — fail-closed. URL: ${url}`);
             return FALLBACK_SCENARIO;
         }
-        const data = (await res.json());
+        const data = await res.json();
+        if (!isVerifyBehaviorResult(data)) {
+            console.error("[verify-behavior] ⚠️ portal returned a malformed response — fail-closed");
+            return FALLBACK_SCENARIO;
+        }
         return formatResult(data);
     }
     catch (err) {
@@ -68,6 +78,12 @@ async function buildScenarioText(args) {
         return FALLBACK_SCENARIO;
     }
 }
+function isVerifyBehaviorResult(value) {
+    return typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        typeof value.requires_verification === "boolean";
+}
 function formatResult(data) {
     if (!data.requires_verification) {
         return JSON.stringify({ requires_verification: false, reason: data.reason || "non-behavioral file" });