prism-mcp-server 20.21.13 → 20.21.15

package/README.md

@@ -158,6 +158,39 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.15
+
+### Follow-ups: see what runs locally, and a stricter screen when the classifier is down
+
+- `local_savings` (and `prism savings`) shows a line for follow-ups, calls that
+  carried your conversation. It covers how many the local model answered (and
+  how many of those the 9b answered), how many the on-device screen refused and
+  at which stage, how many your plan's multi-turn limits refused, and how many
+  went to the cloud.
+- A short chat answer ("16", "Yes") counts as an answer. Before, the quality
+  gate treated it as empty, and a paid plan re-asked the cloud.
+- When the on-device classifier fails every read on a follow-up, the follow-up
+  is no longer answered on a keyword check alone. It goes to the cloud if your
+  plan allows it, and is refused otherwise.
+
+## What's New in v20.21.14
+
+### Skills load when they help, and you can see why they loaded
+
+- Background task notifications, reports from other agents and continuation
+  summaries no longer load skills in the middle of a task, so a word inside an
+  agent's report cannot pull in unrelated rules.
+- Pasting Prism's startup output into a prompt no longer loads skills that
+  happen to share a word with it.
+- Tasks that say they need host tools or reserved judgment stay with the host
+  instead of failing on the local worker.
+- Every routed-skills header ends with the routing table version (for example
+  "Routing table v41."), so a past skill load can be checked against the exact
+  rules that chose it.
+- Skills with their own triggers now load even when their file uses Windows
+  line endings or mentions `prompt_triggers:` in its description; before, they
+  were delivered but silently never loaded.
+
 ## What's New in v20.21.13
 
 ### Paid plans and trials are clear in Account & Settings
@@ -1427,11 +1460,11 @@ It is paid because it cannot run without Synalux behind it:
 ```typescript
 // Call 1
 prism_infer({ prompt: "My project codename is Nightjar. Reply OK.", mode: "chat" })
-// → "OK"                                  (local 9b, $0)
+// → "OK"                                  (local model, $0)
 
 // Call 2 — the model never saw call 1
 prism_infer({ prompt: "What is my codename? One word.", mode: "chat" })
-// → "I don't have that information."      (local 9b, correct and useless)
+// → "I don't have that information."      (local model, correct and useless)
 
 // Call 3 — a coding follow-up with no thread
 prism_infer({ prompt: "Now add a timeout parameter to it.", mode: "code" })
@@ -1456,7 +1489,7 @@ prism_infer({
     prompt: "What is my codename? One word.",
     mode: "chat",
 })
-// → "Nightjar"                            (local 9b, $0; history_turns: 2)
+// → "Nightjar"                            (local model, $0; history_turns: 2)
 
 prism_infer({
     messages: [
@@ -1466,7 +1499,7 @@ prism_infer({
     prompt: "Write the one-line call that stores its result in n.",
     mode: "code",
 })
-// → "n = countActiveUsers(data)"          (local 9b, $0)
+// → "n = countActiveUsers(data)"          (local model, $0)
 
 // A turn the on-device screen finds uncertain, alone or in context, is not
 // served locally: it goes to Synalux cloud on a paid plan, or is refused with
@@ -1483,9 +1516,14 @@ prism_infer({
 // → "SYN-4471"                            (Gemini 3.6 Flash; used_cloud: true)
 ```
 
-Measured on the real 9b through the real handler with cloud off: 7 of 12
-benign follow-ups are served locally, the rest refuse and name the reason;
-every injection variant the reviewers built refuses.
+Measured on 20.21.14 through the real handler, on the local 9b with cloud off:
+- Every benign follow-up that reached the local 9b with its conversation
+  attached was answered correctly. Without the conversation, most answers were
+  invented.
+- The on-device screen still refuses too many benign follow-ups: 11 of 26 in
+  our tests. Each refusal names its reason. Cutting these false refusals is
+  the current work.
+- Every reserved multi-turn probe was refused before any generation (11 of 11).
 </details>
 
 | Mode | Think | Model | Use case |
@@ -1538,6 +1576,10 @@ host, or run `prism savings` from a terminal — `--period all|month|week|sessio
     prism-coder:9b: 41 call(s), ~505K tokens
     prism-coder:4b: 12 call(s), ~4.8K tokens
 
+  Follow-ups with your conversation:
+    12 answered locally (12 by the 9b) · 2 refused by the on-device screen · 0 sent to cloud
+    Refusals by stage: follow-up alone 1 · turns together 1
+
   Counts tokens a local model handled instead of your cloud model. On the token
   axis, the token count is measured — a floor, with known undercounts listed
   when present. On the displacement axis, prism cannot observe the call your
@@ -1559,6 +1601,21 @@ the same tokens; and most users are on flat plans where a currency figure means
 nothing at all. Tokens are the one unit prism measured itself. If you know your
 own effective rate, multiply — the split is printed for exactly that reason.
 
+**Follow-ups.** Calls that carried your conversation (`messages`) get their
+own line:
+- how many the local model answered, and how many of those the 9b answered;
+- how many the on-device screen refused, and at which stage (the follow-up read
+  alone, an earlier turn read alone, or the turns read together);
+- how many went to the cloud.
+
+A refused follow-up went back to your host instead of being answered locally,
+so this line shows how much of your follow-up work local serving actually
+took. Refusals because your plan does not include multi-turn history, or the
+history is over its cap, are counted on their own line. They are recorded only
+when the host asks for a report (`escalation: "report"`); otherwise they fail
+before anything is recorded. The line appears for the `week`, `month`, `all`
+and `--days` views, which read the durable ledger.
+
 Refused calls are excluded, the VS Code panel-playground share is disclosed
 separately, and the known sources of undercount are listed inline rather than
 left implicit — so the durable (`week`/`month`/`all`/`--days`) headline is a

package/dist/storage/inferMetricsLedger.js

@@ -284,6 +284,32 @@ export async function queryLocalSavings(sinceTs) {
                   GROUP BY COALESCE(model, backend)`,
             args: whereArgs,
         });
+        const followWhere = `WHERE history_turns > 0${sinceTs != null ? " AND ts >= ?" : ""}`;
+        const PLAN_REFUSAL = `COALESCE(refusal_reason, '') IN ('multi_turn_not_in_plan', 'history_over_plan_cap')`;
+        // A 9b model: '9b' right after a non-digit, so a future '19b' is not counted.
+        const NINE_B = `(LOWER(COALESCE(model, backend)) GLOB '*[^0-9]9b*' OR LOWER(COALESCE(model, backend)) GLOB '9b*')`;
+        const follow = await client.execute({
+            sql: `SELECT
+                SUM(CASE WHEN ${SERVED_LOCAL} THEN 1 ELSE 0 END) AS served,
+                SUM(CASE WHEN ${SERVED_LOCAL} AND ${NINE_B} THEN 1 ELSE 0 END) AS served_9b,
+                SUM(CASE WHEN used_cloud = 1 THEN 1 ELSE 0 END) AS cloud,
+                SUM(CASE WHEN used_cloud = 0 AND NOT (${SERVED_LOCAL}) AND NOT (${PLAN_REFUSAL}) THEN 1 ELSE 0 END) AS refused,
+                SUM(CASE WHEN used_cloud = 0 AND NOT (${SERVED_LOCAL}) AND ${PLAN_REFUSAL} THEN 1 ELSE 0 END) AS refused_by_plan
+                  FROM infer_metrics ${followWhere}`,
+            args: whereArgs,
+        });
+        const followLayers = await client.execute({
+            sql: `SELECT COALESCE(refusal_layer, 'unrecorded') AS layer, COUNT(*) AS n
+                  FROM infer_metrics ${followWhere} AND used_cloud = 0 AND NOT (${SERVED_LOCAL})
+                        AND NOT (${PLAN_REFUSAL})
+                  GROUP BY COALESCE(refusal_layer, 'unrecorded')`,
+            args: whereArgs,
+        });
+        const f = follow.rows[0];
+        const refused_by_layer = {};
+        for (const row of followLayers.rows) {
+            refused_by_layer[String(row.layer)] = Number(row.n ?? 0);
+        }
         const r = agg.rows[0];
         const by_model = {};
         for (const row of byM.rows) {
@@ -310,6 +336,14 @@ export async function queryLocalSavings(sinceTs) {
             first_ts: r.first_ts == null ? null : Number(r.first_ts),
             last_ts: r.last_ts == null ? null : Number(r.last_ts),
             by_model,
+            followups: {
+                served_local: Number(f.served ?? 0),
+                served_local_9b: Number(f.served_9b ?? 0),
+                refused: Number(f.refused ?? 0),
+                refused_by_plan: Number(f.refused_by_plan ?? 0),
+                cloud: Number(f.cloud ?? 0),
+                refused_by_layer,
+            },
         };
     }
     catch (e) {

package/dist/tools/ledgerHandlers.js

@@ -1693,7 +1693,7 @@ export async function sessionLoadContextHandler(args, options = {}) {
         // skill budget.
         if (typeof prompt === "string" && prompt.trim()) {
             try {
-                const { resolvePromptSkillNames } = await import("./skillRouting.js");
+                const { resolvePromptRouting } = await import("./skillRouting.js");
                 // The manifest's routing_version is the only version signal available
                 // here; without it a stale cached table would never be detected on
                 // this path, since there is no portal response to compare against.
@@ -1704,7 +1704,8 @@ export async function sessionLoadContextHandler(args, options = {}) {
                 // `prompt_triggers` in their own frontmatter and are matched here, on
                 // device, from bodies already cached for injection.
                 const scoped = await collectSkillTriggersOnThisMachine();
-                const matched = (await resolvePromptSkillNames(prompt, Number.isFinite(manifestVersion) && manifestVersion > 0 ? manifestVersion : undefined, scoped?.triggers)).filter((name) => entitledSkillNames.has(name) || scoped?.localNames.has(name));
+                const routed = await resolvePromptRouting(prompt, Number.isFinite(manifestVersion) && manifestVersion > 0 ? manifestVersion : undefined, scoped?.triggers);
+                const matched = routed.names.filter((name) => entitledSkillNames.has(name) || scoped?.localNames.has(name));
                 if (matched.length > 0) {
                     const shown = matched.slice(0, MAX_SYMPTOM_SKILLS);
                     const overflow = matched.length - shown.length;
@@ -1717,7 +1718,8 @@ export async function sessionLoadContextHandler(args, options = {}) {
                     symptomSkillSuffix = `\n\n**Symptom-triggered skills:** ${shown.join(", ")}` +
                         (overflow > 0 ? `, … ${overflow} more` : "") +
                         `\nThe first message matches these skills' trigger rules. Follow them before ` +
-                        `proposing any change.\n`;
+                        `proposing any change.\n` +
+                        (typeof routed.tableVersion === "number" ? `Routing table v${routed.tableVersion}.\n` : "");
                     // INLINE the top match's body rather than pointing at it. Naming a
                     // skill is not delivering it: bodies reach agents only as files under
                     // the canonical root, and hosts outside that mirror have no path to
@@ -2213,7 +2215,7 @@ export async function collectSkillTriggersOnThisMachine() {
  */
 export async function runPromptRouteFromCache(prompt, loaded) {
     const { routePrompt } = await import("./promptRouteHandler.js");
-    const { resolvePromptSkillNames, _setStorage } = await import("./skillRouting.js");
+    const { resolvePromptSkillNames, resolvePromptRouting, _setStorage } = await import("./skillRouting.js");
     // The CLI is a fresh process per prompt: without storage wiring the keyword
     // table can neither be read from disk (offline = dead routing) nor
     // persisted after a fetch (every prompt = a network GET). The server paths
@@ -2221,6 +2223,7 @@ export async function runPromptRouteFromCache(prompt, loaded) {
     _setStorage(async (key, value) => { await setSetting(key, value); }, async (key) => getSetting(key, ""));
     return routePrompt(prompt, loaded, {
         resolvePromptSkillNames,
+        resolvePromptRouting,
         collectTriggers: collectSkillTriggersOnThisMachine,
         entitledNames: async () => {
             try {

package/dist/tools/prismInferHandler.js

@@ -1744,6 +1744,17 @@ export async function runInfer(args, deps) {
                         break;
                 }
             }
+            // A classifier that answered none of this request's window reads
+            // read none of them: the keyword net must not become their sole
+            // guard (review round 16). The consecutive-ERROR breaker catches
+            // this only from its third read, and a follow-up that re-sends the
+            // same turns leaves one or two uncached windows (measured
+            // 2026-09-25: a dead classifier, two failed reads, served locally
+            // on the keyword net).
+            if (budget.calls > 0 && budget.consecutiveErrors === budget.calls && !budget.tripped) {
+                budget.tripped = true;
+                attempts.push({ tier: "layer1", reason: "layer1_screen_all_reads_failed" });
+            }
             // A budget or breaker trip raises to UNCERTAIN whatever the cache
             // held (text: cloud or refused; with an image: local only).
             if (budget.tripped)

package/dist/tools/promptRouteHandler.js

@@ -44,6 +44,44 @@ export const MAX_ROUTED_CHARS = 30_000;
  *  this bounds what may ride INLINE through a hook — anything larger must be
  *  our own offload file with an imperative pointer, not the host's silent one. */
 export const HOOK_INLINE_SAFE_CHARS = 9_800;
+/**
+ * Turns a host delivers as if a person typed them, although no person wrote
+ * them. Measured 2026-09-23 over 30 days of Claude Code sessions: most of the
+ * prompt hook's skill loads came from these turns, and few of those loads
+ * helped the task. A reviewer agent's report that mentions Supabase is not a
+ * request for the Supabase skill.
+ *
+ * Matched at the START only, never as a substring: a person who pastes a
+ * notification after their own words still routes. Tags are matched without
+ * their closing ">" so attributes do not hide them, and the relay line needs
+ * its colon so a sentence that merely begins with the same words still
+ * routes. The known cost is the reverse: a message that BEGINS with one of
+ * these markers, such as a raw notification pasted with nothing before it, is
+ * treated as machine-written.
+ */
+const MACHINE_TURN_PREFIXES = [
+    "<task-notification",
+    "<agent-message",
+    "Another Claude session sent a message:",
+    "<cross-session-message",
+    "This session is being continued from a previous conversation",
+];
+/**
+ * The part of a turn that routing reads. A person's text passes through
+ * unchanged, and a machine-written turn yields "". The exception is a finished
+ * BACKGROUND COMMAND: its one-line summary names the command the agent itself
+ * chose to run ("Build the app for the simulator"), so the summary routes.
+ * Its output never does.
+ */
+export function routableText(prompt) {
+    const text = (prompt || "").trimStart();
+    if (text.startsWith("<task-notification")) {
+        const head = text.split("<result>")[0];
+        const summary = /<summary>([\s\S]*?)<\/summary>/.exec(head)?.[1]?.trim() ?? "";
+        return summary.startsWith("Background command") ? summary : "";
+    }
+    return MACHINE_TURN_PREFIXES.some((marker) => text.startsWith(marker)) ? "" : prompt;
+}
 /**
  * Match a prompt and return ONLY skills the caller does not already have.
  *
@@ -51,15 +89,27 @@ export const HOOK_INLINE_SAFE_CHARS = 9_800;
  * the thing under test.
  */
 export async function routePrompt(prompt, loaded, deps) {
-    const trimmed = (prompt || "").trim();
-    if (!trimmed) {
+    const supplied = (prompt || "").trim();
+    if (!supplied) {
         return { names: [], alreadyLoaded: [], overflow: [], text: "No prompt supplied — nothing to route." };
     }
+    const trimmed = routableText(supplied).trim();
+    if (!trimmed) {
+        return { names: [], alreadyLoaded: [], overflow: [], text: "Machine-written turn — not routed." };
+    }
     const scoped = await deps.collectTriggers().catch(() => undefined);
     const version = await deps.manifestVersion().catch(() => undefined);
     let matched = [];
+    let tableVersion;
     try {
-        matched = await deps.resolvePromptSkillNames(trimmed, version, scoped?.triggers);
+        if (deps.resolvePromptRouting) {
+            const routed = await deps.resolvePromptRouting(trimmed, version, scoped?.triggers);
+            matched = routed.names;
+            tableVersion = routed.tableVersion;
+        }
+        else {
+            matched = await deps.resolvePromptSkillNames(trimmed, version, scoped?.triggers);
+        }
     }
     catch (error) {
         // Routing must never take down the turn that asked for it.
@@ -124,9 +174,12 @@ export async function routePrompt(prompt, loaded, deps) {
     const overflowNote = overflow.length > 0
         ? `\n\nAlso matched, not injected: ${overflowShown.join(", ")}${overflow.length > overflowShown.length ? ` (+${overflow.length - overflowShown.length} more)` : ""}.`
         : "";
+    // The table version makes a recorded load attributable after the table
+    // changes; without it, a transcript cannot say which rules produced a load.
+    const versionNote = typeof tableVersion === "number" ? `\n\nRouting table v${tableVersion}.` : "";
     const header = `**Skills now active for this task:** ${delivered.join(", ")}\n\n` +
         `These apply to the work you are about to do. Read and follow them before proceeding.` +
-        overflowNote;
+        overflowNote + versionNote;
     return { names: delivered, alreadyLoaded, overflow, header, blocks, text: `${header}\n\n${blocks.join("\n\n")}` };
 }
 /**

package/dist/tools/savingsHandler.js

@@ -129,6 +129,44 @@ function basisLine(s) {
         "your host would have made, so whether all of it would have hit the cloud is an assumption. " +
         `Read it as: at most this much displacement, of ${volumeWord} this token volume.`;
 }
+/** Plain names for the on-device screen's stages, as recorded in refusal_layer. */
+const FOLLOWUP_STAGE_NAMES = {
+    isolated: "earlier turn alone",
+    prompt: "follow-up alone",
+    context: "turns together",
+    rules: "rules",
+    backstop: "keyword net",
+    budget: "screening limit",
+};
+/**
+ * Follow-ups: calls that carried the conversation. Shown even when none was
+ * served, because refusals are the part a user needs to see: a follow-up the
+ * screen refused went back to the host instead of being answered locally.
+ */
+export function followupLines(f) {
+    if (!f)
+        return [];
+    const total = f.served_local + f.refused + f.refused_by_plan + f.cloud;
+    if (total === 0)
+        return [];
+    const nineB = f.served_local > 0 ? ` (${fmt(f.served_local_9b)} by the 9b)` : "";
+    const lines = [
+        "",
+        "  Follow-ups with your conversation:",
+        `    ${fmt(f.served_local)} answered locally${nineB} · ${fmt(f.refused)} refused by the on-device screen · ${fmt(f.cloud)} sent to cloud`,
+    ];
+    if (f.refused_by_plan > 0) {
+        lines.push(`    ${fmt(f.refused_by_plan)} refused by your plan's multi-turn limits`);
+    }
+    // Most refusals first; ties in a fixed stage order, so the line never depends on SQL row order.
+    const order = (k) => { const i = Object.keys(FOLLOWUP_STAGE_NAMES).indexOf(k); return i < 0 ? 99 : i; };
+    const stages = Object.entries(f.refused_by_layer).filter(([, n]) => n > 0)
+        .sort((a, b) => b[1] - a[1] || order(a[0]) - order(b[0]) || a[0].localeCompare(b[0]));
+    if (stages.length > 0) {
+        lines.push(`    Refusals by stage: ${stages.map(([k, n]) => `${FOLLOWUP_STAGE_NAMES[k] ?? k} ${fmt(n)}`).join(" · ")}`);
+    }
+    return lines;
+}
 export function renderSavings(s, period, customDays) {
     const label = customDays !== undefined && Number.isFinite(customDays) && customDays > 0
         ? `LAST ${Math.floor(customDays)} DAYS`
@@ -144,6 +182,7 @@ export function renderSavings(s, period, customDays) {
         lines.push(period === "session"
             ? "  Delegate work with prism_infer, or use session_task_route to pick targets automatically."
             : "  Once prism starts serving locally, displaced token volume shows up here.");
+        lines.push(...followupLines(s.followups));
         return { text: lines.join("\n"), data: { ...s, period } };
     }
     const totalRouted = s.local_calls + s.cloud_calls;
@@ -162,6 +201,7 @@ export function renderSavings(s, period, customDays) {
             lines.push(`    ${name}: ${fmt(m.calls)} call(s), ~${abbreviate(t)} tokens`);
         }
     }
+    lines.push(...followupLines(s.followups));
     lines.push("");
     lines.push(`  ${basisLine(s)}`);
     const caveats = caveatsFor(s);

package/dist/tools/scopedSkillTriggers.js

@@ -112,7 +112,9 @@ export function extractSkillTriggers(skillName, content) {
     // idiom is a plain data-property op for any key. Same treatment at every
     // trigger accumulator in this file and in ledgerHandlers' merge.
     const result = { triggers: Object.create(null), errors: [] };
-    const frontmatter = content.match(/^---\n([\s\S]*?)\n---/);
+    // A SKILL.md saved with Windows line endings failed the `^---\n` match and
+    // loaded with no triggers and no error. skillDigest already accepts \r\n.
+    const frontmatter = content.replace(/\r\n?/g, "\n").match(/^---\n([\s\S]*?)\n---/);
     if (!frontmatter)
         return result;
     const body = frontmatter[1];
@@ -128,7 +130,9 @@ export function extractSkillTriggers(skillName, content) {
     else {
         const blockStart = body.match(/^prompt_triggers:\s*$/m);
         if (blockStart) {
-            const after = body.slice(body.indexOf(blockStart[0]) + blockStart[0].length);
+            // The match's own index, not indexOf: the key text can also end an
+            // earlier line (a description), and indexOf would start there.
+            const after = body.slice((blockStart.index ?? 0) + blockStart[0].length);
             for (const line of after.split("\n")) {
                 // Stop at the next top-level key: an unterminated list must not swallow
                 // the rest of the frontmatter and turn `description:` into a trigger.

package/dist/tools/skillRouting.js

@@ -336,7 +336,8 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
     // text (adversarial review, confirmed with a repro). Line-anchoring means
     // eating text now requires two line-start fences — which IS a fenced block.
     //
-    // Replacement must sever BOTH proximity-window classes in the real table:
+    // A removed FENCED BLOCK must sever BOTH proximity-window classes in the
+    // real table:
     //   - `.{0,N}` windows: `.` does not cross \n (no pattern uses the s-flag),
     //     so a newline severs them.
     //   - `\s*`/`\s+`-glued windows (34 of 58 live patterns, e.g.
@@ -346,7 +347,29 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
     //     includes \x1F (unit separator): non-space (blocks \s runs), non-word
     //     (leaves \b semantics as a space would), and severed from dot-windows
     //     by the flanking newlines.
+    // A removed skill NAME is replaced differently — see neutralize below.
     const SEVER = '\n\x1f\n';
+    // A stripped name keeps its length and each character's kind: ASCII
+    // lowercase letters become "q", ASCII uppercase "Q", ASCII digits "0", and
+    // every other character (separators, non-ASCII letters) stays as it was. \b, \w, \d, \s, ., [a-z] and the like read the same at every
+    // position as on the raw text, so a trigger stops matching only if it needs
+    // the identity of the name's letters — which is what stripping exists to remove.
+    // Earlier masks leaked: a line break cut "Draft an ABA <name> plan" apart
+    // (review round 1), a non-word \x1F run cut [-\w] windows (round 3), and
+    // "_" cut [ a-z-] windows (round 4).
+    // Known limitation, stated as a class: the mask keeps each ASCII letter's
+    // and digit's kind but not its identity. A trigger that can tell one letter (or one
+    // digit) from another — a word, a letter range such as [n-s], the mask
+    // letters themselves, or a backreference such as (\w)\1 — may match a
+    // stripped name differently, in either direction. A trigger that cannot
+    // tell them apart matches exactly as on the raw text. No mask smaller than
+    // the alphabet avoids this; triggers come from the routing table and
+    // account owners, so it is disclosed and pinned in tests, not defended.
+    // Also disclosed: a name glued to a following letter or digit other than
+    // a plural "s" ("…-protocol7") is not recognized as the name, so its
+    // trigger words still route; the segment anchor below is what keeps
+    // "fix-ci" from firing inside "prefix-ci".
+    const neutralize = (name) => name.replace(/[a-z]/g, 'q').replace(/[A-Z]/g, 'Q').replace(/[0-9]/g, '0');
     let out = prompt
         .replace(/^[ \t]*```[^\n]*\n[\s\S]*?\n[ \t]*```[ \t]*$/gm, SEVER)
         .replace(/^[ \t]*~~~[^\n]*\n[\s\S]*?\n[ \t]*~~~[ \t]*$/gm, SEVER);
@@ -374,8 +397,20 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
             if (typeof n === "string")
                 names.add(n);
     }
-    // Longest first, so a name that contains another is removed whole.
-    for (const name of [...names].sort((a, b) => b.length - a.length)) {
+    // Protected skills are never prompt-routed, so the table above does not name
+    // them, but every pasted startup log lists them and a protected name can
+    // carry another skill's trigger word: "aba-precision-protocol" satisfied the
+    // clinical \baba\b trigger. They are exact names, not English.
+    for (const n of REQUIRED_PROTECTED_SKILL_NAMES)
+        names.add(n);
+    // Every name is matched against the SAME unmasked text and the union of
+    // the spans is masked once below. Masking name by name let a longer name
+    // consume the head of an overlapping one, which then no longer matched and
+    // left its tail — and its trigger words — unmasked (new review, cycle 1).
+    // A contained name is covered by the union, so order does not matter.
+    const source = out;
+    const masked = new Uint8Array(source.length);
+    for (const name of names) {
         // Bounds mirror the routing table's own name policy (≤128 chars). An
         // overlong or hostile name from a poisoned table must degrade to
         // "not stripped", never to a thrown SyntaxError that kills routing for
@@ -407,11 +442,26 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
             continue;
         try {
             const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            out = out.replace(new RegExp(`(?<![A-Za-z0-9])${escaped}(?![A-Za-z0-9])`, 'gi'), SEVER);
+            const re = new RegExp(`(?<![A-Za-z0-9])${escaped}s?(?![A-Za-z0-9])`, 'gi');
+            // exec, restarting one unit after each match START, so an occurrence
+            // that overlaps an earlier one of the same name ("aba-aba" twice in
+            // "aba-aba-aba") is found too; matchAll skips it. lastIndex strictly
+            // increases, so this stays linear for a bounded name length.
+            for (let m = re.exec(source); m; m = re.exec(source)) {
+                masked.fill(1, m.index, m.index + m[0].length);
+                re.lastIndex = m.index + 1;
+            }
         }
         catch { /* skip unbuildable names — same policy as the matcher */ }
     }
-    return out;
+    if (!masked.includes(1))
+        return source;
+    // split('') indexes UTF-16 code units, the same units matchAll reports.
+    const units = source.split('');
+    for (let i = 0; i < units.length; i++)
+        if (masked[i])
+            units[i] = neutralize(units[i]);
+    return units.join('');
 }
 /**
  * Verbatim port of portal resolve/route.ts prompt-matching block + the sort
@@ -470,8 +520,16 @@ export function _applyPromptRouting(base, prompt, promptKeywords) {
  *   indefinitely and never detect drift). The skill manifest carries one.
  */
 export async function resolvePromptSkillNames(prompt, expectVersion, scopedTriggers) {
+    return (await resolvePromptRouting(prompt, expectVersion, scopedTriggers)).names;
+}
+/**
+ * resolvePromptSkillNames, plus which routing table produced the match. A load
+ * recorded without its table version cannot be attributed after the table
+ * changes, so callers that show routed skills also show the version.
+ */
+export async function resolvePromptRouting(prompt, expectVersion, scopedTriggers) {
     if (!prompt)
-        return [];
+        return { names: [] };
     const kw = await fetchKeywordTable(expectVersion);
     // Scoped triggers must still route when the PUBLIC table is unavailable:
     // they are declared in skill bodies already on this machine and owe nothing
@@ -479,7 +537,7 @@ export async function resolvePromptSkillNames(prompt, expectVersion, scopedTrigg
     // depend on a public file it can never appear in.
     const publicKeywords = kw?.prompt_keywords ?? {};
     if (!kw && !scopedTriggers)
-        return [];
+        return { names: [] };
     // NULL-PROTOTYPE, not a literal (round-4 review): with a plain object, a
     // scoped pattern whose TEXT is an inherited property name made both sides
     // of the merge below misbehave — `combined['constructor'] ?? []` read the
@@ -500,7 +558,10 @@ export async function resolvePromptSkillNames(prompt, expectVersion, scopedTrigg
             continue;
         combined[pattern] = [...(combined[pattern] ?? []), ...clean];
     }
-    return _applyPromptRouting([], stripQuotedEvidenceForRouting(prompt, combined), combined).map((s) => s.name);
+    return {
+        names: _applyPromptRouting([], stripQuotedEvidenceForRouting(prompt, combined), combined).map((s) => s.name),
+        tableVersion: kw?.version,
+    };
 }
 /**
  * Free tier resolves to an empty set portal-side, so adding prompt-matched

package/dist/tools/taskRouterHandler.js

@@ -89,6 +89,35 @@ const HOST_TOOL_ACTION_GROUPS = [
         ],
     },
 ];
+/**
+ * Requirements the host states about its own task. Hosts write the task
+ * description, and many say outright that the work needs host tools or
+ * reserved judgment ("Needs host tools to inspect…", "Reserved security
+ * judgment: …"). The local worker cannot run tools, so these are hard host
+ * boundaries. The tool pattern must start at host/repository/repo/filesystem so
+ * "open-source tools" does not count.
+ *
+ * Any occurrence counts — negated, contrasted, or merely mentioned. Reading
+ * English negation with patterns kept misrouting ("do not skip host tools",
+ * "no host tools should be omitted"), and the costs are lopsided: a wrong
+ * host route costs one host turn, a wrong claw route a delegation that comes
+ * back refused or rejected. On two months of real routes, ignoring negation
+ * changed no decision.
+ */
+// Modifier chains are bounded ({0,3}): an unbounded chain restarted at every
+// "repository" and made a near-miss input quadratic. Modifiers and "reserved
+// … judgment" qualifiers are the closed sets seen in two months of real task
+// descriptions, so prose like "she reserved her judgment" does not match, and
+// "and" counts only before another modifier ("host git and shell tools", not
+// "the host and tools").
+const SELF_DECLARED_HOST_REQUIREMENTS = [
+    /\b(?:host|repository|repo|filesystem)(?:[- /](?:and[- ])?(?:side|repository|filesystem|file|source|shell|git|browser|test|web|docker|documentation|ci|process|external|deployment)){0,3}[- ]tools?\b/i,
+    /\breserved(?:[- /](?:adversarial|security|compliance|release|review|clinical|product|host|auth|phi|safety|tenant|lifecycle|isolation)){0,3}[- ]judge?ment\b/i,
+    /\b(?:security|compliance|tenant[- ]isolation)[- ]judge?ment\b/i,
+];
+function hasSelfDeclaredHostRequirement(description) {
+    return SELF_DECLARED_HOST_REQUIREMENTS.some((pattern) => pattern.test(description));
+}
 /** Complexity signals that should select 27B when the task is bounded. */
 const HIGH_COMPLEXITY_KEYWORDS = [
     "complex logic", "algorithm", "dynamic programming", "constraint solver",
@@ -170,6 +199,8 @@ function assessDelegability(args) {
         reasons.push("reserved host judgment");
     if (toolWorkflowHits > 0)
         reasons.push("host tools or external state required");
+    if (hasSelfDeclaredHostRequirement(description))
+        reasons.push("host requirement stated in the task");
     if (toolActionGroups.length >= HOST_TOOL_ACTION_GROUP_THRESHOLD) {
         reasons.push(`host workflow actions: ${toolActionGroups.join(", ")}`);
     }
@@ -362,13 +393,19 @@ export function computeRoute(args) {
     const { task_description, files_involved, estimated_scope } = args;
     // ── Cold-start / edge case: insufficient input ──
     if (!task_description || task_description.trim().length < 10) {
+        // A stated host requirement is a hard boundary on this path too: the
+        // handler's experience bias and local tie-break both gate on the flag.
+        const hostRequirement = hasSelfDeclaredHostRequirement(task_description ?? "");
         return {
             target: "host",
-            confidence: 0.5,
+            confidence: hostRequirement ? HARD_HOST_BOUNDARY_CONFIDENCE : 0.5,
             needs_history: false,
             complexity_score: 5,
-            rationale: "Insufficient information for confident routing. Defaulting to host model.",
+            rationale: hostRequirement
+                ? "Host boundary: host requirement stated in the task."
+                : "Insufficient information for confident routing. Defaulting to host model.",
             recommended_tool: null,
+            ...(hostRequirement ? { _hardHostBoundary: true } : {}),
         };
     }
     // ── Compute individual signals ──

package/dist/utils/qualityGate.js

@@ -10,7 +10,7 @@ export const TOOL_CALL_BLEED_RE = /<\|tool_call\|>|<\|tool_call_end\|>/;
  * @param stripped  Response AFTER think-stripping (use stripThink first)
  * @param thinkOnly  True if the response was only <think> blocks with no answer
  * @param finishReason  Ollama's finish_reason if available (e.g. "length" = truncated)
- * @param mode  Inference mode — "route" uses length===0 floor; "code"/"chat" keep <5
+ * @param mode  Inference mode — "route": empty only when blank; "chat": empty only with no letter or digit; "code"/unset: 4 chars or fewer
  */
 export function passesQualityGate(stripped, thinkOnly, finishReason, mode) {
     // Signal 1: Think-only — model reasoned but produced no answer (check before empty)
@@ -19,9 +19,17 @@ export function passesQualityGate(stripped, thinkOnly, finishReason, mode) {
     }
     // Signal 2: Mode-aware empty floor.
     // Route legitimately returns 1–4 char labels ("P1", "YES", "CO4", "FIXED").
-    // Use length===0 for route; keep <5 for code/chat where single-word answers are invalid.
-    const emptyFloor = mode === "route" ? 0 : 4;
-    if (stripped.trim().length <= emptyFloor) {
+    // Chat answers can be one short value: a follow-up asking "what is x times
+    // 6?" is correctly answered "42". Measured 2026-09-24: under the old <5
+    // floor, correct chat answers "16" and "36" failed here and, on a paid
+    // plan, were thrown away and re-asked of the cloud. So chat is empty only
+    // when it has no letter or digit at all.
+    // Code keeps <5: a 1–4 char code answer ("Hi", "DONE") is not an answer.
+    const trimmed = stripped.trim();
+    const empty = mode === "route" ? trimmed.length === 0
+        : mode === "chat" ? !/[\p{L}\p{N}]/u.test(trimmed)
+            : trimmed.length <= 4;
+    if (empty) {
         return { pass: false, reason: "empty_response" };
     }
     // Signal 3: Hard truncation — Ollama reports finish_reason="length"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.13",
+  "version": "20.21.15",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",