prism-mcp-server 20.21.13 → 20.21.14

package/README.md

@@ -158,6 +158,24 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.14
+
+### Skills load when they help, and you can see why they loaded
+
+- Background task notifications, reports from other agents and continuation
+  summaries no longer load skills in the middle of a task, so a word inside an
+  agent's report cannot pull in unrelated rules.
+- Pasting Prism's startup output into a prompt no longer loads skills that
+  happen to share a word with it.
+- Tasks that say they need host tools or reserved judgment stay with the host
+  instead of failing on the local worker.
+- Every routed-skills header ends with the routing table version (for example
+  "Routing table v41."), so a past skill load can be checked against the exact
+  rules that chose it.
+- Skills with their own triggers now load even when their file uses Windows
+  line endings or mentions `prompt_triggers:` in its description; before, they
+  were delivered but silently never loaded.
+
 ## What's New in v20.21.13
 
 ### Paid plans and trials are clear in Account & Settings

package/dist/tools/ledgerHandlers.js

@@ -1693,7 +1693,7 @@ export async function sessionLoadContextHandler(args, options = {}) {
         // skill budget.
         if (typeof prompt === "string" && prompt.trim()) {
             try {
-                const { resolvePromptSkillNames } = await import("./skillRouting.js");
+                const { resolvePromptRouting } = await import("./skillRouting.js");
                 // The manifest's routing_version is the only version signal available
                 // here; without it a stale cached table would never be detected on
                 // this path, since there is no portal response to compare against.
@@ -1704,7 +1704,8 @@ export async function sessionLoadContextHandler(args, options = {}) {
                 // `prompt_triggers` in their own frontmatter and are matched here, on
                 // device, from bodies already cached for injection.
                 const scoped = await collectSkillTriggersOnThisMachine();
-                const matched = (await resolvePromptSkillNames(prompt, Number.isFinite(manifestVersion) && manifestVersion > 0 ? manifestVersion : undefined, scoped?.triggers)).filter((name) => entitledSkillNames.has(name) || scoped?.localNames.has(name));
+                const routed = await resolvePromptRouting(prompt, Number.isFinite(manifestVersion) && manifestVersion > 0 ? manifestVersion : undefined, scoped?.triggers);
+                const matched = routed.names.filter((name) => entitledSkillNames.has(name) || scoped?.localNames.has(name));
                 if (matched.length > 0) {
                     const shown = matched.slice(0, MAX_SYMPTOM_SKILLS);
                     const overflow = matched.length - shown.length;
@@ -1717,7 +1718,8 @@ export async function sessionLoadContextHandler(args, options = {}) {
                     symptomSkillSuffix = `\n\n**Symptom-triggered skills:** ${shown.join(", ")}` +
                         (overflow > 0 ? `, … ${overflow} more` : "") +
                         `\nThe first message matches these skills' trigger rules. Follow them before ` +
-                        `proposing any change.\n`;
+                        `proposing any change.\n` +
+                        (typeof routed.tableVersion === "number" ? `Routing table v${routed.tableVersion}.\n` : "");
                     // INLINE the top match's body rather than pointing at it. Naming a
                     // skill is not delivering it: bodies reach agents only as files under
                     // the canonical root, and hosts outside that mirror have no path to
@@ -2213,7 +2215,7 @@ export async function collectSkillTriggersOnThisMachine() {
  */
 export async function runPromptRouteFromCache(prompt, loaded) {
     const { routePrompt } = await import("./promptRouteHandler.js");
-    const { resolvePromptSkillNames, _setStorage } = await import("./skillRouting.js");
+    const { resolvePromptSkillNames, resolvePromptRouting, _setStorage } = await import("./skillRouting.js");
     // The CLI is a fresh process per prompt: without storage wiring the keyword
     // table can neither be read from disk (offline = dead routing) nor
     // persisted after a fetch (every prompt = a network GET). The server paths
@@ -2221,6 +2223,7 @@ export async function runPromptRouteFromCache(prompt, loaded) {
     _setStorage(async (key, value) => { await setSetting(key, value); }, async (key) => getSetting(key, ""));
     return routePrompt(prompt, loaded, {
         resolvePromptSkillNames,
+        resolvePromptRouting,
         collectTriggers: collectSkillTriggersOnThisMachine,
         entitledNames: async () => {
             try {

package/dist/tools/promptRouteHandler.js

@@ -44,6 +44,44 @@ export const MAX_ROUTED_CHARS = 30_000;
  *  this bounds what may ride INLINE through a hook — anything larger must be
  *  our own offload file with an imperative pointer, not the host's silent one. */
 export const HOOK_INLINE_SAFE_CHARS = 9_800;
+/**
+ * Turns a host delivers as if a person typed them, although no person wrote
+ * them. Measured 2026-09-23 over 30 days of Claude Code sessions: most of the
+ * prompt hook's skill loads came from these turns, and few of those loads
+ * helped the task. A reviewer agent's report that mentions Supabase is not a
+ * request for the Supabase skill.
+ *
+ * Matched at the START only, never as a substring: a person who pastes a
+ * notification after their own words still routes. Tags are matched without
+ * their closing ">" so attributes do not hide them, and the relay line needs
+ * its colon so a sentence that merely begins with the same words still
+ * routes. The known cost is the reverse: a message that BEGINS with one of
+ * these markers, such as a raw notification pasted with nothing before it, is
+ * treated as machine-written.
+ */
+const MACHINE_TURN_PREFIXES = [
+    "<task-notification",
+    "<agent-message",
+    "Another Claude session sent a message:",
+    "<cross-session-message",
+    "This session is being continued from a previous conversation",
+];
+/**
+ * The part of a turn that routing reads. A person's text passes through
+ * unchanged, and a machine-written turn yields "". The exception is a finished
+ * BACKGROUND COMMAND: its one-line summary names the command the agent itself
+ * chose to run ("Build the app for the simulator"), so the summary routes.
+ * Its output never does.
+ */
+export function routableText(prompt) {
+    const text = (prompt || "").trimStart();
+    if (text.startsWith("<task-notification")) {
+        const head = text.split("<result>")[0];
+        const summary = /<summary>([\s\S]*?)<\/summary>/.exec(head)?.[1]?.trim() ?? "";
+        return summary.startsWith("Background command") ? summary : "";
+    }
+    return MACHINE_TURN_PREFIXES.some((marker) => text.startsWith(marker)) ? "" : prompt;
+}
 /**
  * Match a prompt and return ONLY skills the caller does not already have.
  *
@@ -51,15 +89,27 @@ export const HOOK_INLINE_SAFE_CHARS = 9_800;
  * the thing under test.
  */
 export async function routePrompt(prompt, loaded, deps) {
-    const trimmed = (prompt || "").trim();
-    if (!trimmed) {
+    const supplied = (prompt || "").trim();
+    if (!supplied) {
         return { names: [], alreadyLoaded: [], overflow: [], text: "No prompt supplied — nothing to route." };
     }
+    const trimmed = routableText(supplied).trim();
+    if (!trimmed) {
+        return { names: [], alreadyLoaded: [], overflow: [], text: "Machine-written turn — not routed." };
+    }
     const scoped = await deps.collectTriggers().catch(() => undefined);
     const version = await deps.manifestVersion().catch(() => undefined);
     let matched = [];
+    let tableVersion;
     try {
-        matched = await deps.resolvePromptSkillNames(trimmed, version, scoped?.triggers);
+        if (deps.resolvePromptRouting) {
+            const routed = await deps.resolvePromptRouting(trimmed, version, scoped?.triggers);
+            matched = routed.names;
+            tableVersion = routed.tableVersion;
+        }
+        else {
+            matched = await deps.resolvePromptSkillNames(trimmed, version, scoped?.triggers);
+        }
     }
     catch (error) {
         // Routing must never take down the turn that asked for it.
@@ -124,9 +174,12 @@ export async function routePrompt(prompt, loaded, deps) {
     const overflowNote = overflow.length > 0
         ? `\n\nAlso matched, not injected: ${overflowShown.join(", ")}${overflow.length > overflowShown.length ? ` (+${overflow.length - overflowShown.length} more)` : ""}.`
         : "";
+    // The table version makes a recorded load attributable after the table
+    // changes; without it, a transcript cannot say which rules produced a load.
+    const versionNote = typeof tableVersion === "number" ? `\n\nRouting table v${tableVersion}.` : "";
     const header = `**Skills now active for this task:** ${delivered.join(", ")}\n\n` +
         `These apply to the work you are about to do. Read and follow them before proceeding.` +
-        overflowNote;
+        overflowNote + versionNote;
     return { names: delivered, alreadyLoaded, overflow, header, blocks, text: `${header}\n\n${blocks.join("\n\n")}` };
 }
 /**

package/dist/tools/scopedSkillTriggers.js

@@ -112,7 +112,9 @@ export function extractSkillTriggers(skillName, content) {
     // idiom is a plain data-property op for any key. Same treatment at every
     // trigger accumulator in this file and in ledgerHandlers' merge.
     const result = { triggers: Object.create(null), errors: [] };
-    const frontmatter = content.match(/^---\n([\s\S]*?)\n---/);
+    // A SKILL.md saved with Windows line endings failed the `^---\n` match and
+    // loaded with no triggers and no error. skillDigest already accepts \r\n.
+    const frontmatter = content.replace(/\r\n?/g, "\n").match(/^---\n([\s\S]*?)\n---/);
     if (!frontmatter)
         return result;
     const body = frontmatter[1];
@@ -128,7 +130,9 @@ export function extractSkillTriggers(skillName, content) {
     else {
         const blockStart = body.match(/^prompt_triggers:\s*$/m);
         if (blockStart) {
-            const after = body.slice(body.indexOf(blockStart[0]) + blockStart[0].length);
+            // The match's own index, not indexOf: the key text can also end an
+            // earlier line (a description), and indexOf would start there.
+            const after = body.slice((blockStart.index ?? 0) + blockStart[0].length);
             for (const line of after.split("\n")) {
                 // Stop at the next top-level key: an unterminated list must not swallow
                 // the rest of the frontmatter and turn `description:` into a trigger.

package/dist/tools/skillRouting.js

@@ -336,7 +336,8 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
     // text (adversarial review, confirmed with a repro). Line-anchoring means
     // eating text now requires two line-start fences — which IS a fenced block.
     //
-    // Replacement must sever BOTH proximity-window classes in the real table:
+    // A removed FENCED BLOCK must sever BOTH proximity-window classes in the
+    // real table:
     //   - `.{0,N}` windows: `.` does not cross \n (no pattern uses the s-flag),
     //     so a newline severs them.
     //   - `\s*`/`\s+`-glued windows (34 of 58 live patterns, e.g.
@@ -346,7 +347,29 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
     //     includes \x1F (unit separator): non-space (blocks \s runs), non-word
     //     (leaves \b semantics as a space would), and severed from dot-windows
     //     by the flanking newlines.
+    // A removed skill NAME is replaced differently — see neutralize below.
     const SEVER = '\n\x1f\n';
+    // A stripped name keeps its length and each character's kind: ASCII
+    // lowercase letters become "q", ASCII uppercase "Q", ASCII digits "0", and
+    // every other character (separators, non-ASCII letters) stays as it was. \b, \w, \d, \s, ., [a-z] and the like read the same at every
+    // position as on the raw text, so a trigger stops matching only if it needs
+    // the identity of the name's letters — which is what stripping exists to remove.
+    // Earlier masks leaked: a line break cut "Draft an ABA <name> plan" apart
+    // (review round 1), a non-word \x1F run cut [-\w] windows (round 3), and
+    // "_" cut [ a-z-] windows (round 4).
+    // Known limitation, stated as a class: the mask keeps each ASCII letter's
+    // and digit's kind but not its identity. A trigger that can tell one letter (or one
+    // digit) from another — a word, a letter range such as [n-s], the mask
+    // letters themselves, or a backreference such as (\w)\1 — may match a
+    // stripped name differently, in either direction. A trigger that cannot
+    // tell them apart matches exactly as on the raw text. No mask smaller than
+    // the alphabet avoids this; triggers come from the routing table and
+    // account owners, so it is disclosed and pinned in tests, not defended.
+    // Also disclosed: a name glued to a following letter or digit other than
+    // a plural "s" ("…-protocol7") is not recognized as the name, so its
+    // trigger words still route; the segment anchor below is what keeps
+    // "fix-ci" from firing inside "prefix-ci".
+    const neutralize = (name) => name.replace(/[a-z]/g, 'q').replace(/[A-Z]/g, 'Q').replace(/[0-9]/g, '0');
     let out = prompt
         .replace(/^[ \t]*```[^\n]*\n[\s\S]*?\n[ \t]*```[ \t]*$/gm, SEVER)
         .replace(/^[ \t]*~~~[^\n]*\n[\s\S]*?\n[ \t]*~~~[ \t]*$/gm, SEVER);
@@ -374,8 +397,20 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
             if (typeof n === "string")
                 names.add(n);
     }
-    // Longest first, so a name that contains another is removed whole.
-    for (const name of [...names].sort((a, b) => b.length - a.length)) {
+    // Protected skills are never prompt-routed, so the table above does not name
+    // them, but every pasted startup log lists them and a protected name can
+    // carry another skill's trigger word: "aba-precision-protocol" satisfied the
+    // clinical \baba\b trigger. They are exact names, not English.
+    for (const n of REQUIRED_PROTECTED_SKILL_NAMES)
+        names.add(n);
+    // Every name is matched against the SAME unmasked text and the union of
+    // the spans is masked once below. Masking name by name let a longer name
+    // consume the head of an overlapping one, which then no longer matched and
+    // left its tail — and its trigger words — unmasked (new review, cycle 1).
+    // A contained name is covered by the union, so order does not matter.
+    const source = out;
+    const masked = new Uint8Array(source.length);
+    for (const name of names) {
         // Bounds mirror the routing table's own name policy (≤128 chars). An
         // overlong or hostile name from a poisoned table must degrade to
         // "not stripped", never to a thrown SyntaxError that kills routing for
@@ -407,11 +442,26 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
             continue;
         try {
             const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            out = out.replace(new RegExp(`(?<![A-Za-z0-9])${escaped}(?![A-Za-z0-9])`, 'gi'), SEVER);
+            const re = new RegExp(`(?<![A-Za-z0-9])${escaped}s?(?![A-Za-z0-9])`, 'gi');
+            // exec, restarting one unit after each match START, so an occurrence
+            // that overlaps an earlier one of the same name ("aba-aba" twice in
+            // "aba-aba-aba") is found too; matchAll skips it. lastIndex strictly
+            // increases, so this stays linear for a bounded name length.
+            for (let m = re.exec(source); m; m = re.exec(source)) {
+                masked.fill(1, m.index, m.index + m[0].length);
+                re.lastIndex = m.index + 1;
+            }
         }
         catch { /* skip unbuildable names — same policy as the matcher */ }
     }
-    return out;
+    if (!masked.includes(1))
+        return source;
+    // split('') indexes UTF-16 code units, the same units matchAll reports.
+    const units = source.split('');
+    for (let i = 0; i < units.length; i++)
+        if (masked[i])
+            units[i] = neutralize(units[i]);
+    return units.join('');
 }
 /**
  * Verbatim port of portal resolve/route.ts prompt-matching block + the sort
@@ -470,8 +520,16 @@ export function _applyPromptRouting(base, prompt, promptKeywords) {
  *   indefinitely and never detect drift). The skill manifest carries one.
  */
 export async function resolvePromptSkillNames(prompt, expectVersion, scopedTriggers) {
+    return (await resolvePromptRouting(prompt, expectVersion, scopedTriggers)).names;
+}
+/**
+ * resolvePromptSkillNames, plus which routing table produced the match. A load
+ * recorded without its table version cannot be attributed after the table
+ * changes, so callers that show routed skills also show the version.
+ */
+export async function resolvePromptRouting(prompt, expectVersion, scopedTriggers) {
     if (!prompt)
-        return [];
+        return { names: [] };
     const kw = await fetchKeywordTable(expectVersion);
     // Scoped triggers must still route when the PUBLIC table is unavailable:
     // they are declared in skill bodies already on this machine and owe nothing
@@ -479,7 +537,7 @@ export async function resolvePromptSkillNames(prompt, expectVersion, scopedTrigg
     // depend on a public file it can never appear in.
     const publicKeywords = kw?.prompt_keywords ?? {};
     if (!kw && !scopedTriggers)
-        return [];
+        return { names: [] };
     // NULL-PROTOTYPE, not a literal (round-4 review): with a plain object, a
     // scoped pattern whose TEXT is an inherited property name made both sides
     // of the merge below misbehave — `combined['constructor'] ?? []` read the
@@ -500,7 +558,10 @@ export async function resolvePromptSkillNames(prompt, expectVersion, scopedTrigg
             continue;
         combined[pattern] = [...(combined[pattern] ?? []), ...clean];
     }
-    return _applyPromptRouting([], stripQuotedEvidenceForRouting(prompt, combined), combined).map((s) => s.name);
+    return {
+        names: _applyPromptRouting([], stripQuotedEvidenceForRouting(prompt, combined), combined).map((s) => s.name),
+        tableVersion: kw?.version,
+    };
 }
 /**
  * Free tier resolves to an empty set portal-side, so adding prompt-matched

package/dist/tools/taskRouterHandler.js

@@ -89,6 +89,35 @@ const HOST_TOOL_ACTION_GROUPS = [
         ],
     },
 ];
+/**
+ * Requirements the host states about its own task. Hosts write the task
+ * description, and many say outright that the work needs host tools or
+ * reserved judgment ("Needs host tools to inspect…", "Reserved security
+ * judgment: …"). The local worker cannot run tools, so these are hard host
+ * boundaries. The tool pattern must start at host/repository/repo/filesystem so
+ * "open-source tools" does not count.
+ *
+ * Any occurrence counts — negated, contrasted, or merely mentioned. Reading
+ * English negation with patterns kept misrouting ("do not skip host tools",
+ * "no host tools should be omitted"), and the costs are lopsided: a wrong
+ * host route costs one host turn, a wrong claw route a delegation that comes
+ * back refused or rejected. On two months of real routes, ignoring negation
+ * changed no decision.
+ */
+// Modifier chains are bounded ({0,3}): an unbounded chain restarted at every
+// "repository" and made a near-miss input quadratic. Modifiers and "reserved
+// … judgment" qualifiers are the closed sets seen in two months of real task
+// descriptions, so prose like "she reserved her judgment" does not match, and
+// "and" counts only before another modifier ("host git and shell tools", not
+// "the host and tools").
+const SELF_DECLARED_HOST_REQUIREMENTS = [
+    /\b(?:host|repository|repo|filesystem)(?:[- /](?:and[- ])?(?:side|repository|filesystem|file|source|shell|git|browser|test|web|docker|documentation|ci|process|external|deployment)){0,3}[- ]tools?\b/i,
+    /\breserved(?:[- /](?:adversarial|security|compliance|release|review|clinical|product|host|auth|phi|safety|tenant|lifecycle|isolation)){0,3}[- ]judge?ment\b/i,
+    /\b(?:security|compliance|tenant[- ]isolation)[- ]judge?ment\b/i,
+];
+function hasSelfDeclaredHostRequirement(description) {
+    return SELF_DECLARED_HOST_REQUIREMENTS.some((pattern) => pattern.test(description));
+}
 /** Complexity signals that should select 27B when the task is bounded. */
 const HIGH_COMPLEXITY_KEYWORDS = [
     "complex logic", "algorithm", "dynamic programming", "constraint solver",
@@ -170,6 +199,8 @@ function assessDelegability(args) {
         reasons.push("reserved host judgment");
     if (toolWorkflowHits > 0)
         reasons.push("host tools or external state required");
+    if (hasSelfDeclaredHostRequirement(description))
+        reasons.push("host requirement stated in the task");
     if (toolActionGroups.length >= HOST_TOOL_ACTION_GROUP_THRESHOLD) {
         reasons.push(`host workflow actions: ${toolActionGroups.join(", ")}`);
     }
@@ -362,13 +393,19 @@ export function computeRoute(args) {
     const { task_description, files_involved, estimated_scope } = args;
     // ── Cold-start / edge case: insufficient input ──
     if (!task_description || task_description.trim().length < 10) {
+        // A stated host requirement is a hard boundary on this path too: the
+        // handler's experience bias and local tie-break both gate on the flag.
+        const hostRequirement = hasSelfDeclaredHostRequirement(task_description ?? "");
         return {
             target: "host",
-            confidence: 0.5,
+            confidence: hostRequirement ? HARD_HOST_BOUNDARY_CONFIDENCE : 0.5,
             needs_history: false,
             complexity_score: 5,
-            rationale: "Insufficient information for confident routing. Defaulting to host model.",
+            rationale: hostRequirement
+                ? "Host boundary: host requirement stated in the task."
+                : "Insufficient information for confident routing. Defaulting to host model.",
             recommended_tool: null,
+            ...(hostRequirement ? { _hardHostBoundary: true } : {}),
         };
     }
     // ── Compute individual signals ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.13",
+  "version": "20.21.14",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",