prism-mcp-server 20.21.16 → 20.21.18

package/README.md

@@ -158,6 +158,23 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.18
+
+- Fixed: when a save was refused with `context_not_loaded`, the instructions
+  Prism installs for Claude Code, Codex and Gemini CLI forbade the one call
+  that recovers. The refusal now prints that call, `session_load_context`
+  with the same project and conversation_id, and the installed instructions
+  allow it. First-turn startup is unchanged.
+
+## What's New in v20.21.17
+
+- Fixed: the on-device screen refused some ordinary coding requests. With a
+  Synalux account (free included), it now reads each request through a policy
+  that Synalux serves, pinned by its SHA-256. Without an account, or with
+  images attached, the screen is unchanged.
+- `prism_infer` route mode: set `allow_parallel_calls` to keep a reply that
+  calls several of the tools you offered in `allowed_tools`.
+
 ## What's New in v20.21.16
 
 ### Conversations: checked on your device, and free with an account
@@ -1387,7 +1404,7 @@ Prism exposes 40+ MCP tools. The core memory loop:
 | Tool | What it does |
 |---|---|
 | `session_bootstrap` | Hook-free first-turn greeting and dashboard-configured context |
-| `session_load_context` | Explicit project reload or older-server startup fallback |
+| `session_load_context` | Explicit project reload, recovery after a `context_not_loaded` save refusal, or older-server startup fallback |
 | `session_save_ledger` | Append an immutable session log entry |
 | `session_save_handoff` | Save live state for the next session |
 | `knowledge_search` | Semantic + keyword search over all memories |

package/dist/connect.js

@@ -4,6 +4,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 as w
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { CONTEXT_RECOVERY_POLICY_LINES } from "./contextRecoveryPolicy.js";
 import { EVIDENCE_WORKFLOW_POLICY_LINES } from "./evidenceWorkflowPolicy.js";
 import { LOCAL_FIRST_POLICY_ID, LOCAL_FIRST_POLICY_LINES } from "./localFirstPolicy.js";
 export const CONNECT_HOSTS = [
@@ -44,11 +45,13 @@ const CODEX_STARTUP_BODY = [
     "reformat, or omit any returned section. Preserve its order and line content. For a greeting-only prompt, stop",
     "after the verbatim startup display. If `session_bootstrap` is deferred, use native tool discovery to load that",
     "exact tool, then invoke it. Do not use shell commands, file reads, subagents, or unrelated tool inspection as",
-    "a substitute. Do not call `session_load_context`. If discovery or invocation fails, report",
+    "a substitute, and do not use `session_load_context` in place of it. If discovery or invocation fails, report",
     "`Prism startup failure` and stop. Reuse the `conversation_id` returned on the `<prism_session />` line for every",
     "session_save_ledger, session_save_handoff, and session_detect_drift call in this conversation. This hook-free",
     "block is managed by `prism connect`; do not edit it manually.",
     "",
+    ...CONTEXT_RECOVERY_POLICY_LINES,
+    "",
     ...LOCAL_FIRST_POLICY_LINES,
     "",
     ...EVIDENCE_WORKFLOW_POLICY_LINES,
@@ -578,11 +581,13 @@ function serializeClaudeStartupBlock(newline) {
         "content. For a greeting-only prompt, stop after the verbatim startup display. If `session_bootstrap` is",
         "deferred, use native tool discovery/ToolSearch to load that",
         "exact tool, then invoke it. Do not use shell commands, file reads, subagents, or unrelated tool inspection",
-        "as a substitute. Do not call `session_load_context`. If discovery or invocation fails, report",
+        "as a substitute, and do not use `session_load_context` in place of it. If discovery or invocation fails, report",
         "`Prism startup failure` and stop. Reuse the `conversation_id` returned on the `<prism_session />` line for every",
         "session_save_ledger, session_save_handoff, and session_detect_drift call in this conversation. This block is",
         "managed by `prism connect`; do not edit it manually.",
         "",
+        ...CONTEXT_RECOVERY_POLICY_LINES,
+        "",
         ...LOCAL_FIRST_POLICY_LINES,
         "",
         ...EVIDENCE_WORKFLOW_POLICY_LINES,
@@ -671,10 +676,12 @@ function serializeGeminiStartupBlock(newline) {
         "reformat, or omit any returned section. Preserve its order and line content. For a greeting-only prompt, stop",
         "after the verbatim startup display. If `session_bootstrap` is deferred, use native tool discovery/ToolSearch",
         "to load that exact tool, then invoke it.",
-        "Do not use shell commands, file reads, subagents, or unrelated tool inspection as a substitute. Do not call",
-        "`session_load_context`. If discovery or invocation fails, report `Prism startup failure` and stop. Reuse the",
-        "`conversation_id` returned on the `<prism_session />` line for session_save_ledger, session_save_handoff, and",
-        "session_detect_drift calls. This block is managed by `prism connect`; do not edit it manually.",
+        "Do not use shell commands, file reads, subagents, or unrelated tool inspection as a substitute, and do not use",
+        "`session_load_context` in place of it. If discovery or invocation fails, report `Prism startup failure` and stop.",
+        "Reuse the `conversation_id` returned on the `<prism_session />` line for session_save_ledger, session_save_handoff,",
+        "and session_detect_drift calls. This block is managed by `prism connect`; do not edit it manually.",
+        "",
+        ...CONTEXT_RECOVERY_POLICY_LINES,
         "",
         ...LOCAL_FIRST_POLICY_LINES,
         "",

package/dist/contextRecoveryPolicy.js

@@ -0,0 +1,21 @@
+/**
+ * Canonical context-recovery contract shared by every host instruction file.
+ *
+ * Startup is one `session_bootstrap` call. A later save can still be refused
+ * with `context_not_loaded`, and the refusal names one remedy; the host block
+ * must say the same thing instead of forbidding it. Keep this host-neutral: the
+ * Claude Code, Gemini CLI and Codex blocks splice these lines unchanged, and
+ * the server instructions, tool descriptions and refusal text state the same
+ * rule in their own words (pinned by tests/startup-recovery-contract.test.ts).
+ */
+export const CONTEXT_RECOVERY_POLICY_LINES = [
+    "## Prism context recovery",
+    "Startup is the one turn-one `session_bootstrap` call. Prism can still refuse `session_save_ledger` or",
+    "`session_save_handoff` with `context_not_loaded`: it has no record that this conversation loaded that project",
+    "(after a restart, a long idle gap, or for a project startup did not load). That is a recovery step, not a second",
+    "startup. Call `session_load_context` with the same `project` and the same `conversation_id` as the refused save",
+    "(the refusal prints the exact call; discover the tool the same way if it is deferred), then retry the save once.",
+    "Do not repeat `session_bootstrap` or print a startup display for it. If the reload or the retry fails, tell the",
+    "user; a local note is a fallback after that, never a substitute for the reload.",
+];
+export const CONTEXT_RECOVERY_POLICY_TEXT = CONTEXT_RECOVERY_POLICY_LINES.join(" ");

package/dist/server.js

@@ -361,8 +361,10 @@ export const PRISM_SERVER_INSTRUCTIONS = `Prism MCP — The Mind Palace for AI A
     `Emit no preamble. Print the complete tool result verbatim as the entire first-turn startup display, before any optional ` +
     `answer. Do not summarize, paraphrase, rename headings, reformat, or omit any returned section. Preserve its order and ` +
     `line content. For a greeting-only prompt, stop after the verbatim startup display. ` +
-    `Do not substitute session_load_context while session_bootstrap is available; use session_load_context ` +
-    `only for an explicit project reload or as an older-server fallback. ` +
+    `Do not substitute session_load_context for the startup call while session_bootstrap is available. Use ` +
+    `session_load_context to recover when a save is refused with context_not_loaded (pass that save's project ` +
+    `and conversation_id, then retry the save once; recovery is not a second startup), for an explicit project ` +
+    `reload, or as an older-server fallback. ` +
     `Use session_save_ledger to log completed work and session_save_handoff to preserve state for the next session. ` +
     `Reuse the conversation_id from session_bootstrap's <prism_session /> line for those saves and for ` +
     `session_detect_drift, the 60-minute goal-alignment drift check. Do not add the id to the visible greeting.\n\n` +

package/dist/session/sessionContext.js

@@ -84,24 +84,75 @@ export function markContextLoaded(conversationId, project, boundariesVersion) {
     s.boundariesVersion = boundariesVersion;
     lastSeenConversationId = conversationId;
 }
+const ENFORCED = " (Enforced server-side — applies to every host.)";
+/**
+ * The one remedy every refusal names, so the three variants cannot drift apart
+ * and the host instruction blocks (src/contextRecoveryPolicy.ts), the server
+ * instructions and the tool descriptions can say the same thing. A block that
+ * forbids the call a refusal asks for leaves an agent with no way forward
+ * (tests/startup-recovery-contract.test.ts pins every surface).
+ */
+const CONTEXT_RECOVERY = " To recover, call session_load_context with the same project and the same conversation_id you " +
+    "passed to this save, then retry the save once. You do not need to repeat session_bootstrap (it " +
+    "reloads only the dashboard Auto-Load projects and reprints the startup display). A recovery load " +
+    "is not a second startup. If the retry is refused too, stop and tell the user.";
 function contextNotLoadedError(project) {
     const projectNote = project
         ? " the requested project was not loaded for this conversation."
-        : "";
+        : " no context is registered for this conversation.";
+    return {
+        blocked: true,
+        error: "context_not_loaded:" + projectNote + CONTEXT_RECOVERY +
+            " This project-scoped tool needs confirmed working context to act correctly." + ENFORCED,
+    };
+}
+/**
+ * A save whose conversation_id is the empty string can never be recovered by
+ * "the same conversation_id you passed": the load handler registers nothing for
+ * an empty id. Say what is actually wrong and where the real id comes from.
+ */
+function emptyConversationIdError() {
     return {
         blocked: true,
-        error: "context_not_loaded:" + projectNote + " Call session_bootstrap(conversation_id) or " +
-            "session_load_context(project, conversation_id) " +
-            "before this action. This project-scoped tool needs confirmed working context " +
-            "to act correctly. (Enforced server-side — applies to every host.)",
+        error: "context_not_loaded: conversation_id is empty, so no context can be registered for it." +
+            " Pass this conversation's conversation_id (the value on session_bootstrap's <prism_session /> line)," +
+            " call session_load_context with that conversation_id and this project, then retry the save once." +
+            " If the retry is refused too, stop and tell the user." + ENFORCED,
     };
 }
 function contextExpiredError() {
     return {
         blocked: true,
-        error: "context_not_loaded: session expired (6 h TTL). Call " +
-            "session_bootstrap(conversation_id) or session_load_context(project, conversation_id) again. " +
-            "(Enforced server-side — applies to every host.)",
+        error: "context_not_loaded: session expired (6 h TTL)." + CONTEXT_RECOVERY + ENFORCED,
+    };
+}
+/**
+ * Longest project or conversation_id a refusal echoes back. A longer value gets
+ * the remedy without a literal call: a clipped value would register the wrong
+ * project, and the retry would be refused again.
+ */
+const MAX_ECHOED_VALUE = 200;
+/**
+ * Print the literal recovery call, built from the arguments the refused save
+ * used, so "the same project and conversation_id" cannot be mistyped or
+ * replaced by a host session id. Values are JSON-escaped and echoed whole, only
+ * to the caller that just sent them; a value too long to echo gets no call.
+ */
+function withExactCall(gate, conversationId, project) {
+    if (!gate || !gate.blocked || !conversationId || !project.trim() || !gate.error.endsWith(ENFORCED)) {
+        return gate;
+    }
+    if (project.length > MAX_ECHOED_VALUE || conversationId.length > MAX_ECHOED_VALUE)
+        return gate;
+    const call = JSON.stringify({
+        project,
+        conversation_id: conversationId,
+        toolAction: "Reload context",
+        toolSummary: "Recover from context_not_loaded",
+    });
+    return {
+        blocked: true,
+        error: gate.error.slice(0, -ENFORCED.length) + ` Exact call: session_load_context(${call}).` + ENFORCED,
     };
 }
 function hashReceiptScope(kind, value) {
@@ -196,9 +247,15 @@ export function requireContextLoaded(conversationId) {
  * cross-project lookups remain fail-closed.
  */
 export async function requireContextLoadedForProject(conversationId, project) {
+    const gate = await evaluateContextGateForProject(conversationId, project);
+    return conversationId === undefined ? gate : withExactCall(gate, conversationId, project);
+}
+async function evaluateContextGateForProject(conversationId, project) {
     if (conversationId === undefined)
         return null;
-    if (!conversationId || !project.trim())
+    if (!conversationId)
+        return emptyConversationIdError();
+    if (!project.trim())
         return contextNotLoadedError(project || undefined);
     const memoryGate = requireContextLoaded(conversationId);
     const memoryState = sessions.get(conversationId);

package/dist/tools/prismInferHandler.js

@@ -35,7 +35,7 @@ import { passesClinicalQualityGate, clinicalPlanScaffold, formatClinicalSections
 import { applyDeterministicCodingRepairs, buildCodingRepairPrompt, passesCodingQualityGate, } from "../utils/codingQualityPolicy.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
 import { callLayer1 as defaultCallLayer1, classifyDeterministicLayer1, keywordBackstop, reservedCategory, MAX_CLASSIFIER_PROMPT_LENGTH, layer1ClassifierContent, secondReadExclusion } from "../utils/layer1.js";
-import { getSecondReadPolicy, getAnswerCheckPolicy } from "../utils/inferencePolicy.js";
+import { getSecondReadPolicy, getAnswerCheckPolicy, getClassifierInputPolicy } from "../utils/inferencePolicy.js";
 import { pseudonymizeForCheck } from "../utils/pseudonymize.js";
 import { answerGroundingBytes, answerGroundingContent, parseGroundingVerdict, arithmeticSlips, arithmeticCorrection, ANSWER_GROUNDING_OUTPUT_TOKENS, ANSWER_GROUNDING_THINK, ANSWER_GROUNDING_THINK_TOKENS, ANSWER_GROUNDING_TIMEOUT_MS, ANSWER_GROUNDING_RETRY_TIMEOUT_MS, ANSWER_GROUNDING_FOLLOW_UP_TOKENS } from "../utils/answerGrounding.js";
 import { recordInference, recordThinkOnlyRetry, formatInferenceMetrics, estimateTokens } from "../utils/inferenceMetrics.js";
@@ -256,7 +256,7 @@ export function _resetLayer1HistoryCacheForTest() { layer1HistoryCache.clear();
  *    probe and read races the time left, and no clearance is accepted after it. */
 export const LAYER1_SECOND_READ_MAX_CALLS = 48;
 export const LAYER1_SECOND_READ_DEADLINE_MS = 30_000;
-/** Reads in flight at once: ONE (owner decision 2026-09-26, after review).
+/** Reads in flight at once: ONE.
  *  Two at once made each classifier read about twice as slow and some reads
  *  abort at the classifier's first-attempt timeout (an aborted read keeps the
  *  hedge: refusal or cloud), for little clearance time gained. The per-read
@@ -269,6 +269,8 @@ function layer1HistoryCached(model, window) {
     const hit = layer1HistoryCache.get(key);
     return hit !== undefined && hit.expiresAt > performance.now();
 }
+/** How long the screen waits for the classifier-input policy on its first load. */
+const CLASSIFIER_INPUT_LOAD_MS = 3_000;
 /** Tokens the classifier may generate (callLayer1's num_predict); they share
  *  the context with the request. */
 export const LAYER1_CLASSIFIER_OUTPUT_TOKENS = 16;
@@ -765,6 +767,11 @@ export const PRISM_INFER_TOOL = {
                     "Synalux deterministic route correction. 'local': skips that correction only.",
                 default: "auto",
             },
+            allow_parallel_calls: {
+                type: "boolean",
+                description: "Route: keep a reply of several calls only if every call is in allowed_tools.",
+                default: false,
+            },
             think: {
                 type: "boolean",
                 description: "<think> reasoning. Default true for chat/code, false for route; better on complex " +
@@ -772,10 +779,8 @@ export const PRISM_INFER_TOOL = {
             },
             strict_entitlements: {
                 type: "boolean",
-                description: "Fail loud instead of running with ASSUMED free-tier limits: when entitlements " +
-                    "fell back to free because the portal was unreachable (source='fallback_free'), " +
-                    "throw instead of silently applying free clamps. Portal-confirmed free plans and " +
-                    "unconfigured machines are unaffected.",
+                description: "Throw rather than apply assumed free limits when the portal was unreachable " +
+                    "(source='fallback_free'). Confirmed-free and unconfigured setups are unaffected.",
                 default: false,
             },
             escalation: {
@@ -874,6 +879,8 @@ export function isPrismInferArgs(args) {
     if (a.route_guard !== undefined &&
         !["auto", "local"].includes(a.route_guard))
         return false;
+    if (a.allow_parallel_calls !== undefined && typeof a.allow_parallel_calls !== "boolean")
+        return false;
     if (a.allowed_tools !== undefined) {
         if (!Array.isArray(a.allowed_tools) || a.allowed_tools.length > MAX_ROUTE_TOOLS)
             return false;
@@ -1491,8 +1498,8 @@ function makeReservedRefusal(verdict, attempts, category = null, cloudWasAllowed
     });
     return new ReservedRefusalError(verdict, attempts, category, cloudWasAllowed);
 }
-/** Portal cap on the flattened conversation (`ROLE: content` lines) — see
- *  portal/src/app/api/v1/prism/inference/route.ts MAX_PROMPT_BYTES. */
+/** Server cap on the flattened conversation (`ROLE: content` lines): the
+ *  Synalux inference endpoint enforces the same limit. */
 export const CLOUD_HISTORY_CAP_BYTES = 32 * 1024;
 /** Exported for tests: the cap check must be provable without a portal. */
 export async function callSynaluxInference(prompt, maxTokens, timeoutMs, opts) {
@@ -1878,6 +1885,7 @@ export async function runInfer(args, deps) {
             "Retry, or drop strict_entitlements to accept free clamps.");
     }
     const mode = args.mode ?? "route";
+    const gateOptions = { allowParallelCalls: mode === "route" && args.allow_parallel_calls === true };
     // Model choice belongs here—not in session_task_route—because this layer
     // owns every viability input and the explicit caller override contract.
     const requestedCeiling = resolveRequestedModelCeiling(args);
@@ -2156,10 +2164,15 @@ export async function runInfer(args, deps) {
         // kept: reserved and uncertain fail closed for text, error follows
         // the single-prompt error path), then each turn and the prompt in
         // context (raise only) — see below.
+        // The account's classifier-input policy; without one the classifier
+        // reads the prompt as written.
+        const classifierInput = await (deps.classifierInputPolicy ?? (() => getClassifierInputPolicy({ deadlineMs: CLASSIFIER_INPUT_LOAD_MS })))().catch(() => null);
         let l1;
         if (!args.messages?.length) {
-            // Single turn: the exact call it always was.
-            l1 = await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages);
+            // Single turn: one call; the classifier-input policy is passed when there is one.
+            l1 = classifierInput
+                ? await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages, { classifierInput })
+                : await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages);
             if (l1 !== "OBVIOUS_NOT_RESERVED")
                 l1Layer = "prompt";
         }
@@ -2250,7 +2263,7 @@ export async function runInfer(args, deps) {
             // (review round 19: skipping it there bypassed that floor).
             const promptFastPath = promptRoutine && args.prompt.length <= MAX_CLASSIFIER_PROMPT_LENGTH && (resolvedImages?.length ?? 0) === 0;
             if (l1 !== "OBVIOUS_RESERVED" && !promptFastPath) {
-                l1 = raise(l1, await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages, { deterministic: false }), "prompt");
+                l1 = raise(l1, await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages, { deterministic: false, ...(classifierInput ? { classifierInput } : {}) }), "prompt");
             }
             // 3. Context, raise only: one window per turn and one for the
             // prompt (see contextWindows), cached like any window. Skipped
@@ -2844,7 +2857,7 @@ export async function runInfer(args, deps) {
                 let { stripped, thinkOnly } = stripThink(result.text);
                 let output = stripped;
                 // Quality gate — all modes. Route uses mode-aware empty floor (length===0).
-                let gate = passesQualityGate(output, thinkOnly, result.doneReason, mode);
+                let gate = passesQualityGate(output, thinkOnly, result.doneReason, mode, gateOptions);
                 if (gate.pass && mode === "code") {
                     gate = passesCodingQualityGate(args.prompt, output);
                 }
@@ -2883,7 +2896,7 @@ export async function runInfer(args, deps) {
                     const retried = await deps.callLocal(deps.ollamaUrl, ollamaName, args.prompt, effectiveSystem, tierTokens, temperature, timeout, false, resolvedImages, ...historyArgs(args));
                     if (retried.ok) {
                         const retriedStrip = stripThink(retried.text);
-                        const retriedGate = passesQualityGate(retriedStrip.stripped, retriedStrip.thinkOnly, retried.doneReason, mode);
+                        const retriedGate = passesQualityGate(retriedStrip.stripped, retriedStrip.thinkOnly, retried.doneReason, mode, gateOptions);
                         // Keep the retry only if it is actually better — a retry that
                         // truncates too must not overwrite the original with a
                         // shorter fragment.
@@ -2913,7 +2926,7 @@ export async function runInfer(args, deps) {
                     const deterministicRepair = applyDeterministicCodingRepairs(output, failedReason);
                     if (deterministicRepair.changes.length > 0) {
                         output = deterministicRepair.output;
-                        gate = passesQualityGate(output, false, result.doneReason, mode);
+                        gate = passesQualityGate(output, false, result.doneReason, mode, gateOptions);
                         if (gate.pass) {
                             gate = passesCodingQualityGate(args.prompt, output);
                         }
@@ -3181,6 +3194,7 @@ async function applyVerification(draft, args, deps, partial) {
     const mode = args.mode ?? "route";
     if (mode === "route") {
         const allowedTools = new Set(args.allowed_tools ?? DEFAULT_PRISM_ROUTE_TOOLS);
+        const contractOptions = { allowParallel: args.allow_parallel_calls === true };
         const parsed = parseRouteOutput(draft);
         const shouldUsePortal = args.route_guard !== "local" &&
             partial.plan !== "free" &&
@@ -3198,7 +3212,7 @@ async function applyVerification(draft, args, deps, partial) {
                 });
                 const portalOutcome = validatePortalRouteGuardOutcome(untrustedPortalOutcome, draft, allowedTools, args.prompt);
                 if (!portalOutcome) {
-                    const localCheck = applyLocalRouteContract(draft, allowedTools);
+                    const localCheck = applyLocalRouteContract(draft, allowedTools, contractOptions);
                     routeGuard = {
                         ...localCheck,
                         source: "local_fallback",
@@ -3220,7 +3234,7 @@ async function applyVerification(draft, args, deps, partial) {
                 }
             }
             catch (error) {
-                const localFallback = applyLocalRouteContract(draft, allowedTools);
+                const localFallback = applyLocalRouteContract(draft, allowedTools, contractOptions);
                 routeGuard = {
                     ...localFallback,
                     source: "local_fallback",
@@ -3239,7 +3253,7 @@ async function applyVerification(draft, args, deps, partial) {
             }
         }
         else {
-            routeGuard = applyLocalRouteContract(draft, allowedTools);
+            routeGuard = applyLocalRouteContract(draft, allowedTools, contractOptions);
         }
         routedDraft = routeGuard.output;
     }

package/dist/tools/sessionMemoryDefinitions.js

@@ -4,7 +4,10 @@ export const SESSION_SAVE_LEDGER_TOOL = {
     description: "Save an immutable session log entry to the session ledger. " +
         "Use this at the END of each work session to record what was accomplished. " +
         "The ledger is append-only — entries cannot be updated or deleted. " +
-        "This creates a permanent audit trail of all agent work sessions.",
+        "This creates a permanent audit trail of all agent work sessions. " +
+        "The save is refused with context_not_loaded until session_bootstrap or session_load_context has loaded " +
+        "this exact project for this conversation_id; on that refusal call session_load_context with the same " +
+        "project and conversation_id, then retry the save once.",
     inputSchema: {
         type: "object",
         properties: {
@@ -60,7 +63,11 @@ export const SESSION_SAVE_HANDOFF_TOOL = {
         "Pass expected_version to enable concurrency control.\n\n" +
         "**v0.4.0 OCC**: If you received a version number from session_load_context, " +
         "/resume_session prompt, or memory resource attachment, you MUST pass it as " +
-        "expected_version to prevent overwriting another session's changes.",
+        "expected_version to prevent overwriting another session's changes.\n\n" +
+        "Pass the same conversation_id as session_save_ledger: the save is refused with context_not_loaded until " +
+        "session_bootstrap or session_load_context has loaded this exact project for it; on that refusal call " +
+        "session_load_context with the same project and conversation_id, then retry the save once, passing the " +
+        "version it shows as expected_version.",
     inputSchema: {
         type: "object",
         properties: {
@@ -101,7 +108,7 @@ export const SESSION_SAVE_HANDOFF_TOOL = {
             },
             conversation_id: {
                 type: "string",
-                description: "Optional. Session key for this conversation (same id used in session_load_context). When provided, the server verifies that session_load_context was called for this conversation before accepting the write.",
+                description: "Optional. Session key for this conversation (same id used in session_load_context). When provided, the server verifies that session_bootstrap or session_load_context loaded this exact project for this conversation before accepting the write.",
             },
         },
         required: ["project"],
@@ -111,7 +118,9 @@ export const SESSION_SAVE_HANDOFF_TOOL = {
 export const SESSION_LOAD_CONTEXT_TOOL = {
     name: "session_load_context",
     description: "Load session context for a project using progressive context loading. " +
-        "Use this for an explicit project reload, or as a startup fallback only when session_bootstrap is unavailable. " +
+        "Use this to recover when session_save_ledger or session_save_handoff is refused with context_not_loaded " +
+        "(pass that save's project and the same conversation_id, then retry the save once; a recovery load is not a " +
+        "second startup), for an explicit project reload, or as a startup fallback only when session_bootstrap is unavailable. " +
         "When session_bootstrap is available, do not substitute this tool for the first-turn bootstrap. " +
         "Three levels available:\n" +
         "- **quick**: Just the latest project state — keywords and open TODOs (~50 tokens)\n" +
@@ -148,7 +157,7 @@ export const SESSION_LOAD_CONTEXT_TOOL = {
             },
             conversation_id: {
                 type: "string",
-                description: "Optional. Session key for this conversation (same id used in session_save_ledger). When provided, marks the session as context-loaded server-side so project-scoped tools can verify working context without relying on hook-based enforcement. Required on non-Claude hosts.",
+                description: "Optional for a plain read. Pass it whenever this load is meant to unlock saves (startup fallback, or recovery from context_not_loaded), using the same conversation_id as the refused or upcoming save. When provided, marks this project as context-loaded server-side so project-scoped saves are accepted; without it nothing is registered.",
             },
             prompt: {
                 type: "string",
@@ -209,7 +218,7 @@ export const SESSION_BOOTSTRAP_TOOL = {
         "before any user-facing response, passing the user's verbatim first message as {prompt: \"<first user message>\"}. " +
         "The prompt is matched against prompt_keywords ON-DEVICE to load symptom-triggered skills on turn one; it is used " +
         "for routing only and never leaves the machine. Pass {} only when there is no user message. " +
-        "Do not substitute session_load_context when this tool is available. " +
+        "Do not substitute session_load_context for this startup call. " +
         "This starts a Prism-backed conversation without host hooks. " +
         "Prism reads the dashboard's Auto-Load Projects, Context Depth (quick/standard/deep), developer name, and default role, " +
         "then returns the greeting and correctly scoped prior-session context. Emit no preamble. Print the complete tool result " +
@@ -217,7 +226,10 @@ export const SESSION_BOOTSTRAP_TOOL = {
         "headings, reformat, or omit any returned section. Preserve its order and line content. For a greeting-only prompt, " +
         "stop after the verbatim startup display. Do not guess or pass a project or depth. Prism returns a stable " +
         "conversation_id on the trailing <prism_session /> line; reuse it for session_save_ledger, session_save_handoff, and " +
-        "session_detect_drift throughout this conversation without adding it to the visible greeting.",
+        "session_detect_drift throughout this conversation without adding it to the visible greeting. " +
+        "This is the first-turn startup call only: if a later save is refused with context_not_loaded, recover with " +
+        "session_load_context for that save's project and conversation_id, then retry the save once, rather than " +
+        "repeating this startup display.",
     annotations: {
         readOnlyHint: true,
         destructiveHint: false,

package/dist/tools/skillRouting.js

@@ -13,8 +13,8 @@
  * regexes match, and the regexes are already public. Sending the raw first
  * message bought nothing a local match could not compute — and free-tier
  * callers paid that privacy cost for literally zero routing benefit, since
- * the portal gates them to an empty set (resolve/route.ts: `tier === 'paid' ?
- * resolved : []`). Paid skill CONTENT stays gated server-side at
+ * the server returns no prompt-matched skills to the free tier. Paid skill
+ * CONTENT stays gated server-side at
  * /api/v1/prism/skill-manifest, which this change does not touch.
  *
  * Cache: portal keyed on (project,role) — no longer per-prompt, which never
@@ -464,8 +464,8 @@ export function stripQuotedEvidenceForRouting(prompt, promptKeywords = {}) {
     return units.join('');
 }
 /**
- * Verbatim port of portal resolve/route.ts prompt-matching block + the sort
- * that follows it. Parity is the whole point: any divergence silently changes
+ * Port of the server resolver's prompt-matching step and the sort that
+ * follows it. Parity is the whole point: any divergence silently changes
  * which skills load. Do not "improve" this — the reference implementation and
  * a scenario-level parity test both pin it.
  *

package/dist/utils/entitlements.js

@@ -14,9 +14,9 @@ import { debugLog } from "./logger.js";
 import { resolvePortalBaseUrl, usablePortalKey } from "./synaluxSearch.js";
 /** What a host with NO portal (unconfigured), a portal that says nothing
  *  (older deployment), or an assumed-free fallback gets: OFF. Multi-turn
- *  needs a Synalux account, and a free one is enough (owner decision
- *  2026-09-26): the answer check it depends on is served per account. The
- *  caps here are what an account gets when the portal omits them. */
+ *  needs a Synalux account, and a free one is enough: the answer check it
+ *  depends on is served per account. The caps here are what an account gets
+ *  when the portal omits them. */
 export const DEFAULT_MULTI_TURN = { enabled: false, max_turns: 12, max_chars: 32_000 };
 /** Structural ceiling no plan can exceed: the portal's own inference route
  *  takes at most 50 messages INCLUDING the current turn appended on
@@ -38,9 +38,8 @@ export function multiTurnPolicy(ent) {
 }
 // ── Free-tier defaults (no auth) ──────────────────────────────────
 /** No account: everything local, with no cap on the model the user's own
- *  machine can run (owner decision 2026-09-26). Anything that needs Synalux
- *  (multi-turn with the answer check, cloud answers) needs an account; a free
- *  one is enough. */
+ *  machine can run. Anything that needs Synalux (multi-turn with the answer
+ *  check, cloud answers) needs an account; a free one is enough. */
 export const FREE_ENTITLEMENTS = {
     plan: "free",
     model_ceiling: "27b",

package/dist/utils/inferencePolicy.js

@@ -1,7 +1,8 @@
 /**
- * Policies the on-device multi-turn features run with, served by Synalux to
- * plans with multi-turn: the second read's exclusion policy (the conversations
- * the 9b may not re-read after a 4b hedge) and the answer check's rules. Each
+ * Policies on-device features run with, served by Synalux to plans with
+ * multi-turn: the second read's exclusion policy (the conversations the 9b may
+ * not re-read after a 4b hedge), the answer check's rules, and the screen's
+ * classifier-input policy (layer1.ts classifierCopy). Each
  * release accepts exactly one artifact of each, pinned by its SHA-256, so the
  * policy a client runs is the one it was released and validated with.
  *
@@ -11,7 +12,8 @@
  * kept. Anything but the pinned, well-formed artifact is no policy: with
  * no second-read policy the second read does not run (the hedge stands); with
  * no answer-check policy a local answer to a conversation is unchecked (cloud,
- * else withheld).
+ * else withheld); with no classifier-input policy the classifier reads the
+ * request as written.
  */
 import { createHash } from "node:crypto";
 import { PRISM_SYNALUX_BASE_URL } from "../config.js";
@@ -25,10 +27,17 @@ export const SECOND_READ_POLICY_EVALUATOR = "second-read-exclusion/1";
 export const ANSWER_CHECK_POLICY_SHA256 = "ba12ab1f6858b68ed36b7c0551aa3381ffb45b6123eb0aacd09c9316efd27993";
 /** The mechanism this client implements (answerGrounding.ts, groundAnswer). */
 export const ANSWER_CHECK_POLICY_EVALUATOR = "answer-check/1";
+/** The classifier-input artifact this release runs. */
+export const CLASSIFIER_INPUT_POLICY_SHA256 = "6b215f9af8cb94c9467852d6bd20f93c3a5c33dd35c649bee77e5f69e0abe4b1";
+/** The mechanism this client implements (layer1.ts classifierCopy). */
+export const CLASSIFIER_INPUT_POLICY_EVALUATOR = "classifier-input/1";
 const MAX_ARTIFACT_BYTES = 64 * 1024;
 const MAX_PATTERN_CHARS = 1_024;
 const MIN_OPERATIONAL_TERMS = 8;
 const MIN_DEPLOY_DECISION = 2;
+const MIN_DROP_WORDS = 8;
+const MAX_WORD_CHARS = 40;
+const MAX_REQUIRED_GROUPS = 4;
 /** A list longer than this is not a policy this client was released with. */
 const MAX_LIST_ENTRIES = 1_000;
 /** A group whose body repeats may be repeated at most this many times. */
@@ -274,6 +283,66 @@ export function parseAnswerCheckPolicy(bytes, expectSha256 = ANSWER_CHECK_POLICY
         return null;
     }
 }
+/** The classifier-input policy from the artifact's exact bytes, or null for
+ *  anything but the expected artifact: another hash, schema or evaluator, a
+ *  word list below its floor or with an entry that is not one lowercase word,
+ *  no required group or a group or qualifier naming an unlisted word, no
+ *  words a kept sentence must offer, a token
+ *  pattern that is oversized, refers back, repeats a varying group or does not
+ *  compile. */
+export function parseClassifierInputPolicy(bytes, expectSha256 = CLASSIFIER_INPUT_POLICY_SHA256) {
+    if (Buffer.byteLength(bytes, "utf8") > MAX_ARTIFACT_BYTES)
+        return null;
+    if (sha256(bytes) !== expectSha256)
+        return null;
+    let a;
+    try {
+        a = JSON.parse(bytes);
+    }
+    catch {
+        return null;
+    }
+    const art = a;
+    if (art?.schema !== 1 || art.evaluator !== CLASSIFIER_INPUT_POLICY_EVALUATOR || typeof art.classifier_input !== "object" || art.classifier_input === null)
+        return null;
+    const s = art.classifier_input;
+    const words = s.drop_sentence_words;
+    const word = (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_WORD_CHARS && v === v.toLowerCase() && !/\s/.test(v);
+    if (!Array.isArray(words) || words.length < MIN_DROP_WORDS || words.length > MAX_LIST_ENTRIES || !words.every(word))
+        return null;
+    const listed = new Set(words);
+    const subset = (v) => Array.isArray(v) && v.length > 0 && v.length <= MAX_LIST_ENTRIES && v.every(w => typeof w === "string" && listed.has(w));
+    const groups = s.require_each;
+    if (!Array.isArray(groups) || groups.length === 0 || groups.length > MAX_REQUIRED_GROUPS || !groups.every(subset))
+        return null;
+    const after = s.only_after ?? {};
+    if (typeof after !== "object" || after === null || Array.isArray(after))
+        return null;
+    const afterEntries = Object.entries(after);
+    if (!afterEntries.every(([w, prev]) => listed.has(w) && subset(prev)))
+        return null;
+    const needed = s.kept_needs_one_of;
+    if (!Array.isArray(needed) || needed.length === 0 || needed.length > MAX_LIST_ENTRIES || !needed.every(word))
+        return null;
+    const tokenPattern = (v) => v === undefined || (typeof v === "string" && v.length > 0 && v.length <= MAX_PATTERN_CHARS && !/\\[1-9]|\\k</.test(v) && !hasNestedRepetition(v));
+    const also = s.also_match, afterPattern = s.only_after_pattern;
+    if (!tokenPattern(also) || !tokenPattern(afterPattern))
+        return null;
+    try {
+        // The client sets the flags (none); the artifact supplies the source only.
+        return {
+            dropWords: listed,
+            requireEach: groups.map(g => new Set(g)),
+            onlyAfter: new Map(afterEntries.map(([w, prev]) => [w, new Set(prev)])),
+            onlyAfterPattern: typeof afterPattern === "string" ? new RegExp(afterPattern) : null,
+            alsoMatch: typeof also === "string" ? new RegExp(also) : null,
+            keptNeedsOneOf: new Set(needed),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /** One pinned artifact: loaded once, shared by concurrent callers, retried
  *  after RETRY_AFTER_MS when a load fails, and dropped by reset() when the
  *  account changes (a sign-in can switch the account and the portal). A load
@@ -358,15 +427,19 @@ async function load(o, sha, parse) {
 }
 const secondRead = pinned(SECOND_READ_POLICY_SHA256, parseSecondReadPolicy);
 const answerCheck = pinned(ANSWER_CHECK_POLICY_SHA256, parseAnswerCheckPolicy);
+const classifierInput = pinned(CLASSIFIER_INPUT_POLICY_SHA256, parseClassifierInputPolicy);
 /** The pinned second-read policy, or null. */
 export const getSecondReadPolicy = (o = {}) => secondRead.get(o);
 /** The pinned answer-check policy, or null. */
 export const getAnswerCheckPolicy = (o = {}) => answerCheck.get(o);
-/** Drops both cached policies; the next conversation loads them again. Called
+/** The pinned classifier-input policy, or null. */
+export const getClassifierInputPolicy = (o = {}) => classifierInput.get(o);
+/** Drops every cached policy; the next request loads them again. Called
  *  when the account changes (dashboard sign-in and sign-out). */
 export function clearInferencePolicies() {
     secondRead.reset();
     answerCheck.reset();
+    classifierInput.reset();
 }
 /** Tests only. */
 export function _resetSecondReadPolicyForTest() {

package/dist/utils/layer1.js

@@ -66,6 +66,62 @@ Answer (one word):`;
 export function layer1ClassifierContent(input) {
     return LAYER1_PROMPT.replace("{prompt}", () => input);
 }
+/** Question marks in the scripts prism serves: a sentence with one is never left out. */
+const QUESTION_MARK = new RegExp("[?" + String.fromCharCode(0xff1f, 0xfe56, 0x061f, 0x037e, 0x00bf, 0x203d, 0x2047, 0x2048, 0x2049, 0x2e2e, 0x055e, 0x1367) + "]");
+function words(sentence) {
+    return sentence.toLowerCase().split(/[\s,;:()]+/).map((w) => w.replace(TOKEN_EDGE, "")).filter(Boolean);
+}
+const TOKEN_EDGE = /^[^\w`'#.+-]+|[^\w`'#+-]+$/g;
+function droppable(sentence, p) {
+    // A sentence with a question mark is never left out: it may be what the request asks.
+    if (QUESTION_MARK.test(sentence))
+        return false;
+    const hit = p.requireEach.map(() => false);
+    let prev = null;
+    for (const token of words(sentence)) {
+        const pattern = !!p.alsoMatch?.test(token);
+        if (p.dropWords.has(token)) {
+            const after = p.onlyAfter.get(token);
+            if (after && !(prev !== null && (after.has(prev) || !!p.onlyAfterPattern?.test(prev))))
+                return false;
+            p.requireEach.forEach((group, i) => { if (group.has(token))
+                hit[i] = true; });
+        }
+        else if (!pattern) {
+            return false;
+        }
+        prev = token;
+    }
+    return hit.length > 0 && hit.every(Boolean);
+}
+/**
+ * The classifier's copy of a request under a classifier-input policy. A
+ * sentence the policy allows is left out with one adjacent separator; every
+ * other character is kept, and text with nothing to leave out is returned as it is.
+ */
+export function classifierCopy(text, p) {
+    // Even indexes are sentences, odd indexes the separators between them.
+    const parts = text.split(/((?<=[.!?])[^\S\r\n]+|[\r\n]+)/);
+    const keep = parts.map(() => true);
+    let dropped = false;
+    for (let i = 0; i < parts.length; i += 2) {
+        if (!droppable(parts[i], p))
+            continue;
+        keep[i] = false;
+        dropped = true;
+        if (i > 0 && keep[i - 1])
+            keep[i - 1] = false;
+        else if (i + 1 < parts.length)
+            keep[i + 1] = false;
+    }
+    if (!dropped)
+        return text;
+    // The sentences that stay must still say what is asked; otherwise the classifier reads it all.
+    if (!parts.some((part, i) => i % 2 === 0 && keep[i] && words(part).some((w) => p.keptNeedsOneOf.has(w))))
+        return text;
+    const out = parts.filter((_, i) => keep[i]).join("");
+    return out.trim() ? out : text;
+}
 const VALID = new Set([
     "OBVIOUS_RESERVED",
     "OBVIOUS_NOT_RESERVED",
@@ -408,7 +464,8 @@ images, opts) {
         // short-circuits to reserved handling.
         return "OBVIOUS_RESERVED";
     }
-    const classifierInput = oversize ? buildOversizeExcerpt(userPrompt) : userPrompt;
+    const excerpt = oversize ? buildOversizeExcerpt(userPrompt) : userPrompt;
+    const classifierInput = opts?.classifierInput && !hasImages ? classifierCopy(excerpt, opts.classifierInput) : excerpt;
     // A SYSTEM baked into the classifier model's Modelfile must not sit in front
     // of LAYER1_PROMPT. prism-coder:4b bakes a tool-routing prompt; with it the
     // private eval gate failed 5/5 runs (two hard negatives refused every run),

package/dist/utils/qualityGate.js

@@ -1,4 +1,14 @@
-import { parseRouteOutput } from "./routeContract.js";
+import { parseRouteCalls, parseRouteOutput } from "./routeContract.js";
+/** JSON with object keys sorted at every level: the same arguments in any order give one string. */
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(record[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
 /**
  * Signal 5 — Tool-call bleed: pipe-delimited format leaking into non-tool turns.
  * Matches <|tool_call|> and <|tool_call_end|> only — NOT angle-bracket <tool_call> variants
@@ -11,8 +21,9 @@ export const TOOL_CALL_BLEED_RE = /<\|tool_call\|>|<\|tool_call_end\|>/;
  * @param thinkOnly  True if the response was only <think> blocks with no answer
  * @param finishReason  Ollama's finish_reason if available (e.g. "length" = truncated)
  * @param mode  Inference mode — "route": empty only when blank; "chat": empty only with no letter or digit; "code"/unset: 4 chars or fewer
+ * @param options.allowParallelCalls  Route mode: a reply of several complete calls is valid
  */
-export function passesQualityGate(stripped, thinkOnly, finishReason, mode) {
+export function passesQualityGate(stripped, thinkOnly, finishReason, mode, options = {}) {
     // Signal 1: Think-only — model reasoned but produced no answer (check before empty)
     if (thinkOnly) {
         return { pass: false, reason: "think_only" };
@@ -37,6 +48,22 @@ export function passesQualityGate(stripped, thinkOnly, finishReason, mode) {
     if (finishReason === "length") {
         return { pass: false, reason: "hard_truncation" };
     }
+    // Several complete calls, when the caller asked for them (route mode). The
+    // envelopes repeat by design, so the prose loop checks below would fail any
+    // three calls; a loop here is the same call again and again.
+    if (mode === "route" && options.allowParallelCalls) {
+        const several = parseRouteCalls(stripped);
+        if (several.kind === "tool_calls") {
+            const seen = new Map();
+            for (const c of several.calls) {
+                const key = canonicalJson([c.name, c.args]);
+                seen.set(key, (seen.get(key) ?? 0) + 1);
+                if ((seen.get(key) ?? 0) >= 3)
+                    return { pass: false, reason: "loop_detected" };
+            }
+            return { pass: true };
+        }
+    }
     // Signal 5: Tool-call bleed. The pipe envelope is invalid in chat/code,
     // but it is the canonical trained output in route mode. Route mode parses
     // the whole envelope and fails only when the contract is malformed.

package/dist/utils/routeContract.js

@@ -273,11 +273,76 @@ export function routeServesProse(output) {
     const last = ends.reduce((a, b) => (b.at > a.at ? b : a));
     return t.slice(last.at + last.e.length).trim() !== ""; // text after the envelope
 }
-export function applyLocalRouteContract(draft, allowedTools = DEFAULT_PRISM_ROUTE_TOOLS) {
+const OPENERS = [PIPE_START, ANGLE_START];
+const MAX_PARALLEL_CALLS = 64;
+/**
+ * A reply of complete tool-call envelopes one after another, with only
+ * whitespace between them. Every envelope must be closed and hold a valid
+ * call; any text, an unclosed envelope or a bad body makes the whole reply
+ * malformed. A single envelope is left to parseRouteOutput.
+ */
+export function parseRouteCalls(output) {
+    if (output.length > MAX_ROUTE_OUTPUT_CHARS)
+        return { kind: "malformed" };
+    const calls = [];
+    let rest = output.trim();
+    while (rest.length > 0) {
+        const opener = OPENERS.find(o => rest.startsWith(o));
+        if (!opener || calls.length >= MAX_PARALLEL_CALLS)
+            return { kind: "malformed" };
+        let end = -1;
+        let endToken = "";
+        for (const token of END_TOKENS) {
+            const at = rest.indexOf(token, opener.length);
+            if (at >= 0 && (end < 0 || at < end)) {
+                end = at;
+                endToken = token;
+            }
+        }
+        if (end < 0)
+            return { kind: "malformed" };
+        const body = rest.slice(opener.length, end).trim();
+        if (OPENERS.some(o => body.includes(o)))
+            return { kind: "malformed" };
+        const parsed = parseToolJson(body);
+        if (parsed.kind !== "tool_call")
+            return { kind: "malformed" };
+        calls.push({ name: parsed.name, args: parsed.args });
+        rest = rest.slice(end + endToken.length).trim();
+    }
+    return calls.length > 1 ? { kind: "tool_calls", calls } : { kind: "malformed" };
+}
+export function applyLocalRouteContract(draft, allowedTools = DEFAULT_PRISM_ROUTE_TOOLS, options = {}) {
     const parsed = parseRouteOutput(draft);
     if (parsed.kind === "plain_text") {
         return { output: draft, action: "plain_text", source: "local" };
     }
+    if (parsed.kind === "malformed" && options.allowParallel) {
+        const several = parseRouteCalls(draft);
+        if (several.kind === "tool_calls") {
+            if (several.calls.some(c => c.name === "NO_TOOL")) {
+                return { output: "NO_TOOL", action: "suppressed", source: "local", reason: "malformed_tool_call" };
+            }
+            const unadvertised = several.calls.find(c => !allowedTools.has(c.name));
+            if (unadvertised) {
+                return {
+                    output: "NO_TOOL",
+                    action: "suppressed",
+                    source: "local",
+                    original_tool: unadvertised.name,
+                    reason: "unadvertised_tool",
+                };
+            }
+            return {
+                output: draft,
+                action: "preserved",
+                source: "local",
+                original_tool: several.calls[0].name,
+                final_tool: several.calls[0].name,
+                calls: several.calls.map(c => c.name),
+            };
+        }
+    }
     if (parsed.kind === "malformed") {
         return {
             output: "NO_TOOL",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.16",
+  "version": "20.21.18",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
@@ -22,7 +22,7 @@
     "prebuild": "npm run clean",
     "build": "tsc && npm run chmod-bins",
     "chmod-bins": "node -e \"['dist/cli.js','dist/server.js','dist/utils/universalImporter.js'].forEach(f => { try { require('fs').chmodSync(f, 0o755); } catch (e) { console.warn('chmod skipped', f, e.message); } })\"",
-    "prepublishOnly": "node scripts/check-no-private-content.mjs && node scripts/check-publish-clean.mjs && npm run build",
+    "prepublishOnly": "node scripts/check-no-private-content.mjs && node scripts/private-identifier-scan.mjs && node scripts/check-publish-clean.mjs && npm run build",
     "lint:dashboard": "node scripts/lint-dashboard-es5.cjs",
     "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "start": "node dist/server.js",
@@ -79,7 +79,7 @@
   "overrides": {
     "@hono/node-server": "^2.0.5",
     "body-parser": "^2.3.0",
-    "fast-uri": "^3.1.6",
+    "fast-uri": "^3.1.8",
     "hono": "^4.13.5",
     "ip-address": "^10.2.0",
     "protobufjs": "^7.6.5",