prism-mcp-server 20.21.0 → 20.21.3

package/dist/cli.js

@@ -223,6 +223,17 @@ program
     .option('--no-models', 'Skip model convergence; keep whatever model versions are installed')
     .action(async (options) => {
     try {
+        // Take the subscription key from the settings store when the environment
+        // does not carry it. connect writes into each host's MCP env block only
+        // what it can see, so without this a machine that logged in once lost its
+        // subscription on the next re-registration and every search fell through
+        // to a Brave key in the server's own environment, which a host launched
+        // from the graphical shell does not carry.
+        {
+            const { hydrateSynaluxCredentials } = await import('./utils/synaluxSearch.js');
+            const { getSetting } = await import('./storage/configStorage.js');
+            await hydrateSynaluxCredentials(getSetting);
+        }
         // ── Converge the PACKAGE first, then the configs ──────────────
         // connect is the one command the operator runs to make a machine
         // current; leaving it configuring with stale code produced the

package/dist/connect.js

@@ -1163,6 +1163,9 @@ function buildMcpEntry(nodePath, serverPath, env) {
         PRISM_SYNALUX_BASE_URL: env.PRISM_SYNALUX_BASE_URL || "https://synalux.ai",
         PRISM_STORAGE: storage,
     };
+    // process.env is hydrated from the settings store before connect runs, so a
+    // machine that logged in once keeps its subscription across re-registration
+    // instead of silently dropping to unauthenticated search.
     if (env.PRISM_SYNALUX_API_KEY) {
         serverEnv.PRISM_SYNALUX_API_KEY = env.PRISM_SYNALUX_API_KEY;
     }

package/dist/scholar/webScholar.js

@@ -12,7 +12,7 @@ import { searchYahooFree, scrapeArticleLocal } from "./freeSearch.js";
 // The same capability flag performWebSearchRaw itself branches on, imported
 // from the same module so the gate and the transport cannot disagree about
 // whether a web search is possible.
-import { SYNALUX_SEARCH_AVAILABLE } from "../utils/synaluxSearch.js";
+import { synaluxSearchAvailable } from "../utils/synaluxSearch.js";
 // ─── Hivemind Integration Helpers ────────────────────────────
 const SCHOLAR_PROJECT = "prism-scholar";
 const SCHOLAR_ROLE = "scholar";
@@ -208,7 +208,7 @@ export async function runWebScholar(overrideTopic, overrideProject) {
         //
         // Google Custom Search used to take priority over both; now removed
         // because Google discontinues that API on 2027-01-01.
-        const useWebSearch = SYNALUX_SEARCH_AVAILABLE || !!BRAVE_API_KEY;
+        const useWebSearch = synaluxSearchAvailable() || !!BRAVE_API_KEY;
         const topic = overrideTopic || await selectTopic();
         const project = overrideProject || SCHOLAR_PROJECT;
         if (!topic) {

package/dist/server.js

@@ -76,9 +76,10 @@ import { SKILL_SAVE_TOOL, SKILL_MANAGE_TOOL, skillSaveHandler, skillManageHandle
 // error wrapper. Now uses getStorage() which routes through the
 // correct backend (Supabase or SQLite) with proper error handling.
 import { getStorage } from "./storage/index.js";
-import { getSettingSync, initConfigStorage } from "./storage/configStorage.js";
+import { getSetting, getSettingSync, initConfigStorage } from "./storage/configStorage.js";
 import { sanitizeMcpOutput } from "./utils/sanitizer.js";
-import { sanitizeForLog } from "./utils/logger.js";
+import { debugLog, sanitizeForLog } from "./utils/logger.js";
+import { hydrateSynaluxCredentials } from "./utils/synaluxSearch.js";
 import { getTracer, initTelemetry } from "./utils/telemetry.js";
 import { context as otelContext, trace, SpanStatusCode } from "@opentelemetry/api";
 import { ddInfo, ddError as ddLogError } from "./utils/ddLogger.js";
@@ -1290,6 +1291,18 @@ export async function startServer() {
     // synchronously. This is a synchronous call — no await needed.
     // No-op when otel_enabled=false (the default).
     initTelemetry();
+    // Put the subscription key in process.env before anything asks whether the
+    // portal is reachable. `prism connect` copies it into the host's MCP env
+    // block only if it was in the environment when connect ran; otherwise it is
+    // in the settings store, and a paid subscriber's searches were failing on a
+    // Brave key in the server's own environment, which a host launched from the
+    // graphical shell does not carry.
+    // getSetting reads the cache initConfigStorage() just warmed, so this adds
+    // no I/O to the path the Initialize handshake waits on.
+    const portalSearchReady = await hydrateSynaluxCredentials(getSetting);
+    if (!portalSearchReady) {
+        debugLog("[Prism] no Synalux subscription key in the environment or the settings store — search falls back to BRAVE_API_KEY");
+    }
     const server = createServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/storage/index.js

@@ -2,6 +2,7 @@ import { PRISM_STORAGE as ENV_PRISM_STORAGE, SUPABASE_CONFIGURED, SYNALUX_CONFIG
 import { debugLog } from "../utils/logger.js";
 import { SupabaseStorage } from "./supabase.js";
 import { getSetting } from "./configStorage.js";
+import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
 export function isValidHttpUrl(url) {
     try {
         const parsed = new URL(url);
@@ -42,23 +43,7 @@ export function isValidHttpUrl(url) {
  * listener the connection fails afterwards, and the log line is what explains
  * why.
  */
-export function upgradeInsecureCloudUrl(raw) {
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== "http:")
-            return raw;
-        const host = parsed.hostname;
-        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
-            return raw;
-        parsed.protocol = "https:";
-        const upgraded = parsed.toString().replace(/\/+$/, "");
-        debugLog(`[Prism Storage] Upgraded ${raw} to ${upgraded}: session content is never sent over plaintext to a remote host.`);
-        return upgraded;
-    }
-    catch {
-        return raw;
-    }
-}
+export { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
 /**
  * Probe for synalux credentials: env vars first, then config DB.
  * Returns true if usable credentials are now in process.env.

package/dist/tools/prismInferHandler.js

@@ -30,6 +30,7 @@ import { getEntitlements, clampCeiling, multiTurnPolicy, ABSOLUTE_MULTI_TURN } f
 import { ddLog } from "../utils/ddLogger.js";
 import { stripThink } from "../utils/thinkStrip.js";
 import { passesQualityGate } from "../utils/qualityGate.js";
+import { passesClinicalQualityGate, formatClinicalSections, } from "../utils/clinicalQualityPolicy.js";
 import { applyDeterministicCodingRepairs, buildCodingRepairPrompt, passesCodingQualityGate, } from "../utils/codingQualityPolicy.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
 import { callLayer1 as defaultCallLayer1, classifyDeterministicLayer1, keywordBackstop, reservedCategory, MAX_CLASSIFIER_PROMPT_LENGTH } from "../utils/layer1.js";
@@ -402,7 +403,9 @@ export const PRISM_INFER_TOOL = {
         "For a FOLLOW-UP to an earlier prism_infer answer, pass the accepted prior turns as `messages` " +
         "(paid plans): without them the worker answers the follow-up from nothing and fabricates. " +
         "Every entitlement-resolved result reports `multi_turn` (your plan's caps) and `history_turns` (what was sent); " +
-        "the crisis intercept reports only `history_turns`. " +
+        "the crisis intercept reports only `history_turns`. "
+        +
+            "A behaviour-plan request also reports `clinical_sections` — how many required sections were found and which were not. That is a structural census, never a clinical endorsement: a section can be present and still be wrong, and a credentialed BCBA decides whether a plan is adequate. " +
         "History over the plan's caps is refused (history_over_plan_cap), never trimmed; a free plan " +
         "or a host with no portal is refused (multi_turn_not_in_plan). Hosts that compact large " +
         "schemas may drop parameter text, so the contract lives here.",
@@ -2239,6 +2242,21 @@ export async function runInfer(args, deps) {
                 if (gate.pass && mode === "code") {
                     gate = passesCodingQualityGate(args.prompt, output);
                 }
+                // Clinical structural check runs in EVERY mode. A behaviour plan
+                // arrives as chat as readily as code, and the mode a caller picked
+                // must not decide whether clinical output is inspected. The gate
+                // self-gates on the prompt, so it is a no-op for everything else.
+                // A clinical reason does not match the repair loop's code_/python_
+                // prefixes, so it escalates instead of being locally patched —
+                // deliberate: a local model inventing a missing decision-rules
+                // section produces plausible unratified clinical text.
+                let clinicalSections;
+                if (gate.pass) {
+                    const clinical = passesClinicalQualityGate(args.prompt, output);
+                    clinicalSections = clinical.sections;
+                    if (!clinical.pass)
+                        gate = { pass: false, reason: clinical.reason };
+                }
                 // Hard-truncation retry: the budget went on <think> and the answer
                 // was cut mid-emission. Previously this only escalated to cloud, or
                 // served the truncated text when no cloud was available — neither
@@ -2377,6 +2395,7 @@ export async function runInfer(args, deps) {
                     prompt_tokens: result.promptTokens,
                     completion_tokens: result.completionTokens,
                     quality_gate_failed: gate.pass ? undefined : true,
+                    clinical_sections: clinicalSections,
                     gate_outcome: gate.pass
                         ? { status: "success", served_anyway: false }
                         : { status: "degraded", reason: gate.reason, served_anyway: true },
@@ -2609,6 +2628,55 @@ export async function inferText(prompt, opts = {}) {
         return null;
     }
 }
+/** The one-line header the host sees above the model output.
+ *
+ *  Pure and exported so the reporting contract in PRISM_INFER_TOOL.description
+ *  ("every entitlement-resolved result reports multi_turn and history_turns")
+ *  is assertable without standing up Ollama.
+ *
+ *  Both fields were set on the result and written to the ledger for a release
+ *  before anything rendered them here, so the only way to learn what a call
+ *  carried was to open the SQLite ledger. An agent benchmarking multi-turn
+ *  sent no `messages` across three turns, saw nothing in the response saying
+ *  so, and published the resulting degradation as a model defect. */
+export function inferResponseHeader(result, memory) {
+    const tokenStr = result.prompt_tokens != null || result.completion_tokens != null
+        ? ` tokens=${result.prompt_tokens ?? "?"}in/${result.completion_tokens ?? "?"}out`
+        : "";
+    return (`[prism_infer] backend=${result.backend}` +
+        ` model=${result.model_picked ?? "n/a"}` +
+        ` plan=${result.plan ?? "unknown"}` +
+        ` free_ram=${result.ram_free_mb}MB` +
+        ` latency=${result.latency_ms}ms` +
+        ` used_cloud=${result.used_cloud}` +
+        tokenStr +
+        // What this call actually carried, on every response including zero.
+        // A caller that meant to send history and did not must be able to see
+        // that here; omitting the zero is what made the failure silent.
+        (result.history_turns != null ? ` history_turns=${result.history_turns}` : "") +
+        (result.multi_turn
+            ? ` multi_turn=${result.multi_turn.enabled
+                ? `${result.multi_turn.max_turns}/${result.multi_turn.max_chars}`
+                : "off"}`
+            : "") +
+        // Raise-only: a count of the sections found, and the names of those that
+        // were not. Never a pass/fail word — presence is not clinical soundness.
+        (result.clinical_sections ? ` ${formatClinicalSections(result.clinical_sections)}` : "") +
+        (result.quality_gate_failed ? ` quality_gate_failed=true` : "") +
+        (result.gate_outcome && result.gate_outcome.status !== "success"
+            ? ` gate=${result.gate_outcome.status}${result.gate_outcome.reason ? `:${result.gate_outcome.reason}` : ""}`
+            : "") +
+        (result.entitlements_source && result.entitlements_source !== "portal"
+            ? ` ent_source=${result.entitlements_source}`
+            : "") +
+        (result.verification ? ` verify=${result.verification.action}` : "") +
+        (result.route_guard
+            ? ` route_guard=${result.route_guard.source}:${result.route_guard.action}` +
+                (result.route_guard.reason ? `:${result.route_guard.reason}` : "")
+            : "") +
+        (memory ? ` memory=${memory.project}:${memory.depth}` : "") +
+        (result.attempts.length ? ` attempts=${JSON.stringify(result.attempts)}` : ""));
+}
 export async function prismInferHandler(args) {
     if (!isPrismInferArgs(args)) {
         const raw = typeof args === "object" && args !== null ? args : {};
@@ -2653,30 +2721,7 @@ export async function prismInferHandler(args) {
                 latency_ms: result.latency_ms,
             });
         }
-        const tokenStr = result.prompt_tokens != null || result.completion_tokens != null
-            ? ` tokens=${result.prompt_tokens ?? "?"}in/${result.completion_tokens ?? "?"}out`
-            : "";
-        const headerBase = `[prism_infer] backend=${result.backend}` +
-            ` model=${result.model_picked ?? "n/a"}` +
-            ` plan=${result.plan ?? "unknown"}` +
-            ` free_ram=${result.ram_free_mb}MB` +
-            ` latency=${result.latency_ms}ms` +
-            ` used_cloud=${result.used_cloud}` +
-            tokenStr +
-            (result.quality_gate_failed ? ` quality_gate_failed=true` : "") +
-            (result.gate_outcome && result.gate_outcome.status !== "success"
-                ? ` gate=${result.gate_outcome.status}${result.gate_outcome.reason ? `:${result.gate_outcome.reason}` : ""}`
-                : "") +
-            (result.entitlements_source && result.entitlements_source !== "portal"
-                ? ` ent_source=${result.entitlements_source}`
-                : "") +
-            (result.verification ? ` verify=${result.verification.action}` : "") +
-            (result.route_guard
-                ? ` route_guard=${result.route_guard.source}:${result.route_guard.action}` +
-                    (result.route_guard.reason ? `:${result.route_guard.reason}` : "")
-                : "") +
-            (prepared.memory ? ` memory=${prepared.memory.project}:${prepared.memory.depth}` : "") +
-            (result.attempts.length ? ` attempts=${JSON.stringify(result.attempts)}` : "");
+        const headerBase = inferResponseHeader(result, prepared.memory);
         // Append periodic session-level stats to the header line.
         // compact=true is threshold-gated (PRISM_METRICS_EVERY, default every 5 calls)
         // so it doesn't appear on every response — only as a rolling summary.

package/dist/utils/braveApi.js

@@ -31,7 +31,7 @@
 import { BRAVE_API_KEY, BRAVE_ANSWERS_API_KEY } from "../config.js";
 import { debugLog } from "./logger.js";
 import { isPortalPlanRefusal } from "./portalError.js";
-import { SYNALUX_SEARCH_AVAILABLE, synaluxWebSearch, synaluxWebSearchRaw, synaluxLocalSearch, synaluxLocalSearchRaw, synaluxBraveAnswers, } from "./synaluxSearch.js";
+import { synaluxSearchAvailable, synaluxWebSearch, synaluxWebSearchRaw, synaluxLocalSearch, synaluxLocalSearchRaw, synaluxBraveAnswers, } from "./synaluxSearch.js";
 const BRAVE_API_KEY_MISSING_ERROR = "BRAVE_API_KEY is not configured";
 const BRAVE_ANSWERS_API_KEY_MISSING_ERROR = "BRAVE_ANSWERS_API_KEY is not configured";
 const SYNALUX_OFFSET_UNSUPPORTED_ERROR = "Configured Synalux search does not support search offsets";
@@ -65,7 +65,7 @@ async function portalFirst(viaPortal, ownKey, viaOwnKey) {
 }
 // Brave Answers API call (AI Grounding/OpenAI-compatible)
 export async function performBraveAnswers(query, model = "brave") {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         return portalFirst(() => synaluxBraveAnswers(query, model), BRAVE_ANSWERS_API_KEY, () => braveAnswersDirect(query, model));
     }
     return braveAnswersDirect(query, model);
@@ -102,7 +102,7 @@ async function braveAnswersDirect(query, model) {
 }
 // Raw web search API call
 export async function performWebSearchRaw(query, count = 10, offset = 0) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         if (offset !== 0)
             throw new Error(SYNALUX_OFFSET_UNSUPPORTED_ERROR);
         return portalFirst(() => synaluxWebSearchRaw(query, count), BRAVE_API_KEY, () => braveWebSearchRaw(query, count, offset));
@@ -131,7 +131,7 @@ async function braveWebSearchRaw(query, count, offset) {
 }
 // Web search API call
 export async function performWebSearch(query, count = 10, offset = 0) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         if (offset !== 0)
             throw new Error(SYNALUX_OFFSET_UNSUPPORTED_ERROR);
         return portalFirst(() => synaluxWebSearch(query, count), BRAVE_API_KEY, () => braveWebSearch(query, count, offset));
@@ -197,7 +197,7 @@ function chunkArray(arr, size) {
 }
 // Raw local search API call with poi/details payload
 export async function performLocalSearchRaw(query, count = 5) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         return portalFirst(() => synaluxLocalSearchRaw(query, count), BRAVE_API_KEY, () => braveLocalSearchRaw(query, count));
     }
     return braveLocalSearchRaw(query, count);
@@ -260,7 +260,7 @@ async function braveLocalSearchRaw(query, count) {
 }
 // Local search API call with poi details
 export async function performLocalSearch(query, count = 5) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         return portalFirst(() => synaluxLocalSearch(query, count), BRAVE_API_KEY, () => braveLocalSearch(query, count));
     }
     return braveLocalSearch(query, count);
@@ -278,20 +278,29 @@ async function braveLocalSearch(query, count) {
 export function formatLocalResults(poisData, descData) {
     return ((poisData.results || [])
         .map((poi) => {
-        const address = [
-            poi.address?.streetAddress ?? "",
-            poi.address?.addressLocality ?? "",
-            poi.address?.addressRegion ?? "",
-            poi.address?.postalCode ?? "",
-        ]
-            .filter((part) => part !== "")
-            .join(", ") || "N/A";
-        return `Name: ${poi.name || poi.title || "N/A"}
+        // Brave sends postal_address.displayAddress, contact.telephone and
+        // opening_hours. The streetAddress/phone/openingHours shapes below have
+        // never appeared on a POI, which is why every venue came back N/A while
+        // the name resolved through the title fallback. Measured 2026-09-16.
+        const today = poi.opening_hours?.current_day?.[0];
+        const hours = (poi.openingHours || []).join(", ")
+            || (today?.opens && today?.closes ? `${today.opens}-${today.closes}` : "")
+            || "N/A";
+        const address = poi.postal_address?.displayAddress ||
+            [
+                poi.address?.streetAddress ?? "",
+                poi.address?.addressLocality ?? "",
+                poi.address?.addressRegion ?? "",
+                poi.address?.postalCode ?? "",
+            ]
+                .filter((part) => part !== "")
+                .join(", ") || "N/A";
+        return `Name: ${poi.title || poi.name || "N/A"}
 Address: ${address}
-Phone: ${poi.phone || "N/A"}
-Rating: ${poi.rating?.ratingValue ?? "N/A"} (${poi.rating?.ratingCount ?? 0} reviews)
-Price Range: ${poi.priceRange || "N/A"}
-Hours: ${(poi.openingHours || []).join(", ") || "N/A"}
+Phone: ${poi.contact?.telephone || poi.phone || "N/A"}
+Rating: ${poi.rating?.ratingValue ?? "N/A"} (${poi.rating?.reviewCount ?? poi.rating?.ratingCount ?? 0} reviews)
+Price Range: ${poi.price_range || poi.priceRange || "N/A"}
+Hours: ${hours}
 Description: ${descData.descriptions[poi.id] || "No description available"}
 `;
     })

package/dist/utils/clinicalQualityPolicy.js

@@ -0,0 +1,152 @@
+/**
+ * Structural gate for clinical behaviour-analytic output.
+ *
+ * The coding gate already proves the shape of this idea: a deterministic check
+ * names a concrete defect, and the named reason drives what happens next.
+ * Python has three static passes behind it. Clinical output had none, so a
+ * behaviour plan missing its decision rules or its data-collection procedure
+ * was served exactly like a complete one.
+ *
+ * Two hard constraints, both deliberate:
+ *
+ *  1. RAISE ONLY — it never certifies. A full section count is a statement
+ *     about presence, not about clinical soundness: a section can be present
+ *     and wrong. Nothing here may be read as "this plan is safe to implement".
+ *     The `bcba_ai_assistant` standard is that the checklist reports what is
+ *     present; a credentialed BCBA decides whether the plan is adequate.
+ *
+ *  2. IT DOES NOT TOUCH THE RESERVED LIST — crisis de-escalation, restraint,
+ *     SIB with injury history and risk assessment never reach a local model at
+ *     all; that boundary is enforced upstream in the Layer 1 screen and is not
+ *     relaxed, widened or re-implemented here. This gate governs the routine
+ *     band that is already local-eligible: operational definitions,
+ *     measurement, antecedent strategies, caregiver training.
+ *
+ * A failure is NOT auto-repaired. The coding repair loop re-prompts the same
+ * tier to fix a syntax defect, which is safe for code; asking a local model to
+ * invent a missing decision-rules section produces plausible unratified
+ * clinical text, which is worse than a visibly incomplete draft. A clinical
+ * reason therefore falls out of the repair loop and escalates instead.
+ */
+/** A full written plan was asked for — the whole section list applies. */
+const CLINICAL_PLAN_REQUEST_RE = /\b(bip\b|behavi(?:o|ou)r(?:al)?[ -](?:intervention|support|management)[ -]plan|behavi(?:o|ou)r plan|treatment plan|intervention plan)\b/i;
+/** An operational definition specifically was asked for. */
+const OPERATIONAL_DEFINITION_REQUEST_RE = /\boperational(?:ly)?[ -]?(?:defin\w*)|\bdefine the (?:target )?behaviou?r\b/i;
+/** Any behaviour-analytic context at all — gates the AAC safety check. */
+const CLINICAL_CONTEXT_RE = /\b(aba\b|bcba\b|behaviou?r analyst|functional behaviou?r assessment|\bfba\b|\bbip\b|replacement behaviou?r|target behaviou?r|reinforcement schedule|\bfct\b|\bdro\b|\bdra\b|\bncr\b)/i;
+/** Ordered so the report reads the way a plan is written. */
+const PLAN_SECTIONS = [
+    { name: "operational_definition", pattern: /operational(?:ly)?[ -]?defin|\bdefinition\b[\s\S]{0,80}\b(observable|measurable)\b/i },
+    { name: "function_hypothesis", pattern: /\b(hypothesi[sz]ed function|function of the behaviou?r|maintained by|\ba-?b-?c\b|antecedent[\s\S]{0,40}consequence)\b/i },
+    { name: "antecedent_strategies", pattern: /\b(antecedent (?:strateg|modificat|intervention)|prevention strateg|setting event|environmental modificat)/i },
+    { name: "replacement_behaviour", pattern: /\b(replacement behaviou?r|functional communication training|\bfct\b|alternative behaviou?r|\bdra\b)/i },
+    { name: "consequence_strategies", pattern: /\b(consequence (?:strateg|procedure)|reinforcement (?:schedule|procedure|strateg)|\bdro\b|\bncr\b|extinction)/i },
+    { name: "data_collection", pattern: /\b(data collection|data sheet|measurement (?:system|procedure)|frequency count|partial interval|momentary time sampling|\bioa\b|interobserver)/i },
+    { name: "decision_rules", pattern: /\b(decision rule|mastery criteri|criteri\w+ for (?:change|modificat|advancement)|review (?:schedule|trigger)|plan review)/i },
+    { name: "generalisation_maintenance", pattern: /\b(generali[sz]|maintenance)\b/i },
+    { name: "caregiver_training", pattern: /\b((?:caregiver|staff|parent|family)[ -]?training|train(?:ing)? (?:the )?(?:caregivers?|staff|parents?))/i },
+    { name: "bcba_review_disclaimer", pattern: /\b(reviewed and individuali[sz]ed|credentialed bcba|licensed behaviou?r analyst|must be reviewed)\b/i },
+];
+/**
+ * AAC access may never be removed, withheld or delayed as a consequence.
+ *
+ * A correct plan states this rule explicitly ("AAC access is never restricted"),
+ * so a bare co-occurrence of an AAC term and a restriction verb fires on GOOD
+ * text. The lookback suppresses a match when the clause is negated. It is
+ * approximate by construction, which is acceptable only because this raises and
+ * never clears: an escalation costs one call, and no output is marked safe here.
+ */
+const AAC_TERM = /\b(aac\b|speech[- ]generating device|\bsgd\b|communication device|communication board|\bpecs\b|talker\b)/i;
+const RESTRICT_VERB = /\b(remov\w+|withh\w+|restrict\w+|tak\w+ away|deni\w+|deny|block\w*|delay\w*|confiscat\w+|limit\w*)\b/i;
+const NEGATOR = /\b(never|not|n't|no|avoid\w*|prohibit\w*|must not|cannot|can't|without)\b/i;
+// Asymmetric on purpose. "remove the AAC device" puts the verb BEFORE the term,
+// so a forward-only window misses the most direct phrasing of the thing this
+// check exists to catch. The backward reach is kept short because a removal
+// sentence about something else ("remove the token board") sitting a paragraph
+// above an AAC mention is not a restriction of AAC.
+const AAC_WINDOW_AFTER = 120;
+const AAC_WINDOW_BEFORE = 40;
+const NEGATION_LOOKBACK = 60;
+/** Clause boundaries. The verb must act on the AAC term, not merely sit near it:
+ *  "AAC remains available at all times; remove the token board" removes a token
+ *  board, and scanning past the semicolon read it as removing AAC. */
+const CLAUSE_BREAK = /[.;:\n]|\bhowever\b|\bwhereas\b/i;
+function clauseAfter(text, from, limit) {
+    const slice = text.slice(from, from + limit);
+    const brk = CLAUSE_BREAK.exec(slice);
+    return brk ? slice.slice(0, brk.index) : slice;
+}
+function clauseBefore(text, end, limit) {
+    const slice = text.slice(Math.max(0, end - limit), end);
+    let last = -1;
+    for (const m of slice.matchAll(new RegExp(CLAUSE_BREAK.source, "gi"))) {
+        last = (m.index ?? 0) + m[0].length;
+    }
+    return last >= 0 ? slice.slice(last) : slice;
+}
+function aacRestrictedAsConsequence(output) {
+    for (const m of output.matchAll(new RegExp(AAC_TERM.source, "gi"))) {
+        const start = m.index ?? 0;
+        const before = clauseBefore(output, start, AAC_WINDOW_BEFORE);
+        const after = clauseAfter(output, start, AAC_WINDOW_AFTER);
+        const from = start - before.length;
+        const window = before + after;
+        const verb = RESTRICT_VERB.exec(window);
+        if (!verb)
+            continue;
+        const absolute = from + (verb.index ?? 0);
+        const lookback = output.slice(Math.max(0, absolute - NEGATION_LOOKBACK), absolute);
+        if (NEGATOR.test(lookback))
+            continue; // "AAC access is never removed"
+        return true;
+    }
+    return false;
+}
+/**
+ * Raise-only structural check. `pass: true` means nothing was detected as
+ * missing — it is not a clinical endorsement.
+ */
+export function passesClinicalQualityGate(prompt, output) {
+    // An operational-definition request is clinical on its own: "write an
+    // operational definition of elopement" names no ABA vocabulary the broad
+    // pattern looks for, and was silently skipped before.
+    const clinicalContext = CLINICAL_CONTEXT_RE.test(prompt)
+        || CLINICAL_PLAN_REQUEST_RE.test(prompt)
+        || OPERATIONAL_DEFINITION_REQUEST_RE.test(prompt);
+    if (!clinicalContext)
+        return { pass: true };
+    if (aacRestrictedAsConsequence(output)) {
+        return { pass: false, reason: "clinical_aac_restricted_as_consequence" };
+    }
+    if (OPERATIONAL_DEFINITION_REQUEST_RE.test(prompt)) {
+        const hasExamples = /\bexamples?\b/i.test(output);
+        const hasNonExamples = /\bnon-?examples?\b/i.test(output);
+        if (!hasExamples || !hasNonExamples) {
+            return { pass: false, reason: "clinical_operational_definition_incomplete" };
+        }
+    }
+    if (!CLINICAL_PLAN_REQUEST_RE.test(prompt))
+        return { pass: true };
+    const missing = PLAN_SECTIONS.filter(s => !s.pattern.test(output)).map(s => s.name);
+    const sections = {
+        required: PLAN_SECTIONS.length,
+        present: PLAN_SECTIONS.length - missing.length,
+        missing,
+    };
+    // An incomplete plan REPORTS; it does not fail. Failing the gate rejects the
+    // output, and when escalation is unavailable the caller receives nothing at
+    // all — measured in review: a 3-of-10 plan with cloud_fallback:true and an
+    // unreachable portal returned "no backend produced output". A draft labelled
+    // `clinical_sections=3/10 missing:...` is strictly more useful to a clinician
+    // than silence, and suppressing it contradicts the raise-only rule above.
+    //
+    // The two findings ABOVE do fail, because they are defects rather than
+    // incompleteness: AAC restricted as a consequence is a safety violation, and
+    // an operational definition without non-examples is wrong, not unfinished.
+    return { pass: true, sections };
+}
+/** Compact, raise-only header fragment. Counts only — never a verdict word. */
+export function formatClinicalSections(s) {
+    const base = `clinical_sections=${s.present}/${s.required}`;
+    return s.missing.length ? `${base} missing:${s.missing.join(",")}` : base;
+}

package/dist/utils/entitlements.js

@@ -9,8 +9,9 @@
  * Authenticated users get their plan from the portal (5-minute cache).
  */
 import { getSynaluxJwt } from "./synaluxJwt.js";
-import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED } from "../config.js";
+import { SYNALUX_CONFIGURED } from "../config.js";
 import { debugLog } from "./logger.js";
+import { resolvePortalBaseUrl, usablePortalKey } from "./synaluxSearch.js";
 /** What a host with NO portal (unconfigured), a portal that says nothing
  *  (older deployment), or an assumed-free fallback gets: OFF. Multi-turn is
  *  a paid-plan feature (owner decision 2026-09-15); a client default that
@@ -101,10 +102,13 @@ export function clampCeiling(requested, planCeiling) {
 }
 // ── Fetch ─────────────────────────────────────────────────────────
 async function fetchEntitlements() {
-    // Re-read process.env because dashboard/bootstrap configuration can inject
-    // credentials after config.ts captured its module-load constants.
-    const baseUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || PRISM_SYNALUX_BASE_URL;
-    const apiKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
+    // Resolve through the SAME helper the search client uses. These two answered
+    // "is the portal usable" differently before: entitlements ignored the legacy
+    // SYNALUX_BASE_URL alias, accepted an unexpanded ${...} template, and never
+    // checked the value was a URL, so a host whose alias arrived after load had
+    // working search and a free-tier plan. Measured 2026-09-16.
+    const baseUrl = resolvePortalBaseUrl();
+    const apiKey = usablePortalKey();
     if ((!SYNALUX_CONFIGURED && !apiKey) || !baseUrl) {
         debugLog("[entitlements] no Synalux auth configured — free tier");
         return { ...FREE_ENTITLEMENTS, source: "unconfigured" };

package/dist/utils/secureUrl.js

@@ -0,0 +1,30 @@
+/**
+ * One definition of "never send this over plaintext".
+ *
+ * This lived inside storage/index.ts, so only the storage path applied it. When
+ * startup hydration began publishing PRISM_SYNALUX_BASE_URL from the settings
+ * store, it bypassed the control entirely: a self-hosted portal stored as
+ * `http://portal.internal.example` was published unchanged, and the search
+ * client then POSTed the query plus `Authorization: Bearer <JWT>` to it in the
+ * clear. Measured 2026-09-16.
+ *
+ * Loopback is exempt because there is no network to intercept.
+ */
+import { debugLog } from "./logger.js";
+export function upgradeInsecureCloudUrl(raw) {
+    try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== "http:")
+            return raw;
+        const host = parsed.hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+            return raw;
+        parsed.protocol = "https:";
+        const upgraded = parsed.toString().replace(/\/+$/, "");
+        debugLog(`[Prism] Upgraded ${raw} to ${upgraded}: content is never sent over plaintext to a remote host.`);
+        return upgraded;
+    }
+    catch {
+        return raw;
+    }
+}

package/dist/utils/synaluxSearch.js

@@ -14,22 +14,113 @@
  * Auth uses the shared JWT exchange from synaluxJwt.ts (same
  * refresh-token dance as SynaluxStorage, but without requiring
  * the full storage class). Falls back gracefully: callers check
- * SYNALUX_SEARCH_AVAILABLE before calling.
+ * synaluxSearchAvailable() before calling.
  */
 import { debugLog } from "./logger.js";
+import { upgradeInsecureCloudUrl } from "./secureUrl.js";
 import { PortalHttpError } from "./portalError.js";
 import { getSynaluxJwt, invalidateSynaluxJwt } from "./synaluxJwt.js";
-import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED, } from "../config.js";
+import { PRISM_SYNALUX_API_KEY, PRISM_SYNALUX_BASE_URL, } from "../config.js";
 // ─── Public availability flag ────────────────────────────────
-/** True when Synalux portal credentials are configured. */
-export const SYNALUX_SEARCH_AVAILABLE = SYNALUX_CONFIGURED;
+/** A `${...}` template the shell never expanded is not a credential. config.ts
+ *  rejects those at load; the live read rejects them too, or a half-written host
+ *  config sends every search to a portal that can only answer 401. */
+function usableEnvValue(raw) {
+    const trimmed = raw?.trim();
+    if (!trimmed || trimmed.includes("${"))
+        return undefined;
+    return trimmed;
+}
+function isHttpUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether the portal can serve a search, resolved at CALL time.
+ *
+ *  This used to be a module-load constant taken from SYNALUX_CONFIGURED, and
+ *  that was wrong for the most common installation. `prism connect` copies the
+ *  subscription key into the host's MCP env block only when the key already
+ *  happened to be in the environment; otherwise it lives in Prism's settings
+ *  store and reaches process.env during startup. A constant read before that
+ *  froze "unconfigured" for the life of the process, so a paying subscriber's
+ *  every search skipped the portal and demanded a Brave key they had no reason
+ *  to own — while entitlements, resolved later from the same hydrated key,
+ *  correctly reported their paid plan. Measured 2026-09-16.
+ *
+ *  The resolution order below is deliberately the same one fetchEntitlements()
+ *  uses (live env first, module-load constant as the fallback). Search and
+ *  entitlements answering "is the portal usable" differently IS the defect. */
+export function resolvePortalBaseUrl() {
+    // Each candidate is validated in turn: a typo in one host config must fall
+    // through to the settings store rather than disabling portal search outright.
+    for (const candidate of [
+        usableEnvValue(process.env.PRISM_SYNALUX_BASE_URL),
+        usableEnvValue(process.env.SYNALUX_BASE_URL),
+        PRISM_SYNALUX_BASE_URL,
+    ]) {
+        if (!candidate || !isHttpUrl(candidate))
+            continue;
+        // Never hand back a cleartext transport URL for a remote host: this client
+        // sends the query and a bearer JWT over it.
+        return upgradeInsecureCloudUrl(candidate).replace(/\/+$/, "");
+    }
+    return undefined;
+}
+/** The subscription key, resolved the one way every portal client resolves it. */
+export function usablePortalKey() {
+    return usableEnvValue(process.env.PRISM_SYNALUX_API_KEY) ?? PRISM_SYNALUX_API_KEY;
+}
+export function synaluxSearchAvailable() {
+    return !!resolvePortalBaseUrl() && !!usablePortalKey();
+}
+/** Put the subscription key where every consumer reads it — process.env —
+ *  taking the settings store as the fallback source. Idempotent, and it never
+ *  overwrites a value the environment already supplied. */
+export async function hydrateSynaluxCredentials(getSetting) {
+    try {
+        const baseUrl = usableEnvValue(process.env.PRISM_SYNALUX_BASE_URL)
+            ?? usableEnvValue(process.env.SYNALUX_BASE_URL)
+            ?? usableEnvValue(await getSetting("PRISM_SYNALUX_BASE_URL", ""))
+            ?? usableEnvValue(await getSetting("SYNALUX_BASE_URL", ""))
+            ?? PRISM_SYNALUX_BASE_URL;
+        // Validate AND secure before publishing. process.env is shared with storage
+        // and entitlements, so a settings row holding a non-URL would poison every
+        // portal client in the process — and a cleartext http:// row would put the
+        // bearer JWT of every one of them on the wire in the clear.
+        if (baseUrl && isHttpUrl(baseUrl)) {
+            process.env.PRISM_SYNALUX_BASE_URL =
+                upgradeInsecureCloudUrl(baseUrl).replace(/\/+$/, "");
+        }
+        const apiKey = usableEnvValue(process.env.PRISM_SYNALUX_API_KEY)
+            ?? usableEnvValue(await getSetting("PRISM_SYNALUX_API_KEY", ""))
+            ?? PRISM_SYNALUX_API_KEY;
+        if (apiKey)
+            process.env.PRISM_SYNALUX_API_KEY = apiKey;
+        return synaluxSearchAvailable();
+    }
+    catch {
+        return synaluxSearchAvailable(); // a settings read must never break startup
+    }
+}
 // ─── Internal helpers ────────────────────────────────────────
 /**
  * POST to a portal endpoint with JWT auth. Retries once on 401
  * (JWT may have just expired). Throws on network or HTTP errors.
  */
 async function portalPost(path, body, timeoutMs = 15_000) {
-    const baseUrl = PRISM_SYNALUX_BASE_URL.replace(/\/+$/, "");
+    // Resolved, never the module-load constant: availability is now decided from
+    // the live environment, so a portal that is reachable must also be addressable.
+    // Reading a frozen constant here would throw on the very installation this
+    // routing exists to serve.
+    const baseUrl = resolvePortalBaseUrl();
+    if (!baseUrl) {
+        throw new Error("[synaluxSearch] no Synalux portal base URL is configured");
+    }
     const url = `${baseUrl}${path}`;
     const send = async (jwt) => {
         return fetch(url, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.0",
+  "version": "20.21.3",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",