prism-mcp-server 20.21.21 → 20.21.23

package/README.md

@@ -48,6 +48,12 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
   Where a host offers hooks (Claude Code, Codex), `prism connect` adds two
   small ones on top: mid-session prompt routing, and a post-compaction
   re-injection of the protected-floor digest.
+- **Prompt-triggered Factory** — enabled by default for suitable bounded
+  implementation requests with explicit files, an allowed write list, and a
+  verification command. The host starts and monitors the recommended pipeline;
+  BCBA requests stay with the host. A dashboard toggle or
+  `PRISM_DARK_FACTORY_ENABLED=false` disables Factory after an MCP restart.
+  Try the [three-test filename fix](examples/factory-filename-fix/README.md).
 - **Safe escalation and observability** — inference outcomes are explicit,
   reserved text remains fail-closed (clinical images are processed locally,
   never sent to the cloud), and local/cloud usage is recorded for
@@ -158,6 +164,25 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.23
+
+- Factory routes suitable bounded implementation prompts and executes only the
+  allowed file actions, with independent verification and explicit lifecycle results.
+- Paid pipeline creation, updates, aborts, and verification records use the
+  authenticated Portal API. Startup waits for paid storage initialization before
+  reporting Factory readiness.
+- The default-enabled toggle distinguishes the saved setting from the active
+  MCP setting and shows when a restart is required.
+
+## What's New in v20.21.22
+
+- Factory pipeline lists for cloud accounts use the authenticated Portal API,
+  including exact project and status filters, without direct database credentials.
+- Invalid, incomplete, or oversized reads show an unavailable state. A valid empty
+  list remains distinct from a failed read.
+- This release covers pipeline lists. Cloud pipeline creation, controls, and
+  execution still need separate validation.
+
 ## What's New in v20.21.21
 
 - Prism Dashboard now reports unavailable analytics and factory reads clearly,

package/dist/config.js

@@ -315,9 +315,9 @@ export const PRISM_VERIFICATION_LAYERS = (process.env.PRISM_VERIFICATION_LAYERS
 export const PRISM_VERIFICATION_DEFAULT_SEVERITY = (process.env.PRISM_VERIFICATION_DEFAULT_SEVERITY || "warn");
 // ─── v7.3: Dark Factory Orchestration ─────────────────────────
 // Autonomous pipeline runner: PLAN → EXECUTE → VERIFY → iterate.
-// Opt-in because it executes LLM calls in the background.
-/** Master switch for the Dark Factory background runner. */
-export const PRISM_DARK_FACTORY_ENABLED = process.env.PRISM_DARK_FACTORY_ENABLED === "true"; // Opt-in
+// Enabled by default; the persisted preference or an explicit env override can disable it.
+/** Compatibility default; startup resolver applies env or persisted dashboard state. */
+export const PRISM_DARK_FACTORY_ENABLED = true; // Startup resolver applies env override or persisted dashboard setting.
 /** Poll interval for the runner loop (ms). Default: 30s. */
 export const PRISM_DARK_FACTORY_POLL_MS = parseInt(process.env.PRISM_DARK_FACTORY_POLL_MS || "30000", 10);
 /** Default max wall-clock time per pipeline (ms). Default: 15 minutes. */

package/dist/connect.js

@@ -4,6 +4,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 as w
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { FACTORY_HOST_POLICY_LINES } from "./darkfactory/hostPolicy.js";
 import { CONTEXT_RECOVERY_POLICY_LINES } from "./contextRecoveryPolicy.js";
 import { EVIDENCE_WORKFLOW_POLICY_LINES } from "./evidenceWorkflowPolicy.js";
 import { LOCAL_FIRST_POLICY_ID, LOCAL_FIRST_POLICY_LINES } from "./localFirstPolicy.js";
@@ -52,6 +53,8 @@ const CODEX_STARTUP_BODY = [
     "",
     ...CONTEXT_RECOVERY_POLICY_LINES,
     "",
+    ...FACTORY_HOST_POLICY_LINES,
+    "",
     ...LOCAL_FIRST_POLICY_LINES,
     "",
     ...EVIDENCE_WORKFLOW_POLICY_LINES,
@@ -588,6 +591,8 @@ function serializeClaudeStartupBlock(newline) {
         "",
         ...CONTEXT_RECOVERY_POLICY_LINES,
         "",
+        ...FACTORY_HOST_POLICY_LINES,
+        "",
         ...LOCAL_FIRST_POLICY_LINES,
         "",
         ...EVIDENCE_WORKFLOW_POLICY_LINES,
@@ -683,6 +688,8 @@ function serializeGeminiStartupBlock(newline) {
         "",
         ...CONTEXT_RECOVERY_POLICY_LINES,
         "",
+        ...FACTORY_HOST_POLICY_LINES,
+        "",
         ...LOCAL_FIRST_POLICY_LINES,
         "",
         ...EVIDENCE_WORKFLOW_POLICY_LINES,

package/dist/darkfactory/actionExecutor.js

@@ -0,0 +1,327 @@
+import { promises as fs, constants as fsConstants } from "node:fs";
+import { dirname, resolve, relative, isAbsolute } from "node:path";
+import { execFile, spawn } from "node:child_process";
+const MAX_OUTPUT = 16_000;
+const MAX_FILE = 512_000;
+const COMMAND_LIVENESS_POLL_MS = 100;
+const COMMAND_STATUS_POLL_MS = 1_000;
+const COMMAND_LIVENESS_TIMEOUT_MS = 5_000;
+const COMMAND_STOPPED = "Pipeline stopped during command execution";
+const COMMAND_LIVENESS_UNAVAILABLE = "Pipeline command liveness check timed out";
+const COMMAND_TIMED_OUT = "Pipeline command timed out";
+const COMMAND_OUTPUT_EXCEEDED = "Pipeline command output exceeded its limit";
+const WRITE_STAGE_PREFIX = '.prism-write-';
+const WRITE_STAGE_FILE = 'content';
+async function assertCommandLive(stillRunning) {
+    let timer;
+    try {
+        const live = await Promise.race([
+            stillRunning(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(COMMAND_LIVENESS_UNAVAILABLE)), COMMAND_LIVENESS_TIMEOUT_MS);
+            }),
+        ]);
+        if (!live)
+            throw new Error(COMMAND_STOPPED);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** Execute only while the caller retains authority; reap inherited descendants too. */
+async function runGuardedCommand(file, args, cwd, timeout, stillRunning, stillOwned = stillRunning) {
+    await assertCommandLive(stillRunning);
+    return new Promise((resolveCommand, rejectCommand) => {
+        let finished = false;
+        let checking = false;
+        let checkingStatus = false;
+        let stopReason;
+        let cleanup;
+        let stdout = '';
+        let stderr = '';
+        let outputBytes = 0;
+        const child = spawn(file, args, {
+            cwd, shell: false, detached: process.platform !== 'win32',
+            stdio: ['ignore', 'pipe', 'pipe'], env: { PATH: process.env.PATH },
+        });
+        child.once('error', error => { stopReason ??= error; });
+        child.once('close', (code, signal) => {
+            finished = true;
+            clearInterval(monitor);
+            clearInterval(statusMonitor);
+            clearTimeout(deadline);
+            void (async () => {
+                await terminateTree();
+                if (stopReason)
+                    throw stopReason;
+                if (code !== 0)
+                    throw Object.assign(new Error(`Command exited with ${signal || code}`), { stdout, stderr });
+                await assertCommandLive(stillRunning);
+                resolveCommand({ stdout, stderr });
+            })().catch(rejectCommand);
+        });
+        function terminateTree() {
+            if (cleanup)
+                return cleanup;
+            const pid = child.pid;
+            cleanup = !pid ? Promise.resolve() : new Promise((resolveCleanup, rejectCleanup) => {
+                if (process.platform === 'win32') {
+                    execFile('taskkill', ['/PID', String(pid), '/T', '/F'], { shell: false, timeout: COMMAND_LIVENESS_TIMEOUT_MS }, error => {
+                        if (error && child.exitCode === null && child.signalCode === null)
+                            rejectCleanup(error);
+                        else
+                            resolveCleanup();
+                    });
+                }
+                else {
+                    try {
+                        process.kill(-pid, 'SIGKILL');
+                        resolveCleanup();
+                    }
+                    catch (error) {
+                        if (error.code === 'ESRCH')
+                            resolveCleanup();
+                        else
+                            rejectCleanup(error);
+                    }
+                }
+            });
+            return cleanup;
+        }
+        function stop(error) {
+            stopReason ??= error;
+            void terminateTree().catch(cleanupError => { stopReason = new Error(`${error.message}; process cleanup failed: ${String(cleanupError)}`); });
+        }
+        const collect = (chunk, stream) => {
+            outputBytes += Buffer.byteLength(chunk);
+            if (outputBytes > MAX_OUTPUT * 2) {
+                stop(new Error(COMMAND_OUTPUT_EXCEEDED));
+                return;
+            }
+            if (stream === 'stdout')
+                stdout += chunk;
+            else
+                stderr += chunk;
+        };
+        child.stdout.setEncoding('utf8').on('data', chunk => collect(chunk, 'stdout'));
+        child.stderr.setEncoding('utf8').on('data', chunk => collect(chunk, 'stderr'));
+        // Reap inherited descendants on parent exit as well as on cancellation.
+        // Their output pipes must close before this command can settle.
+        child.once('exit', () => { void terminateTree().catch(error => { stopReason ??= error; }); });
+        const deadline = setTimeout(() => stop(new Error(COMMAND_TIMED_OUT)), timeout);
+        const monitor = setInterval(() => {
+            if (finished || checking)
+                return;
+            checking = true;
+            void assertCommandLive(stillOwned).catch(error => {
+                if (finished)
+                    return;
+                stop(error instanceof Error ? error : new Error(String(error)));
+            }).finally(() => { checking = false; });
+        }, COMMAND_LIVENESS_POLL_MS);
+        // Local leases can be checked frequently without turning a repository
+        // command into hundreds of authenticated Portal reads per minute.
+        const statusMonitor = setInterval(() => {
+            if (finished || checkingStatus || stillOwned === stillRunning)
+                return;
+            checkingStatus = true;
+            void assertCommandLive(stillRunning).catch(error => {
+                if (!finished)
+                    stop(error instanceof Error ? error : new Error(String(error)));
+            }).finally(() => { checkingStatus = false; });
+        }, COMMAND_STATUS_POLL_MS);
+        monitor.unref();
+        statusMonitor.unref();
+    });
+}
+function contained(root, target) {
+    const rel = relative(root, target);
+    return rel === "" || (rel !== ".." && !rel.startsWith(".." + "/") && !rel.startsWith(".." + "\\") && !isAbsolute(rel));
+}
+async function safePath(spec, targetPath, write) {
+    if (!spec.workingDirectory || !targetPath || isAbsolute(targetPath))
+        throw new Error("Action path must be relative to workingDirectory");
+    const root = await fs.realpath(spec.workingDirectory);
+    const candidate = resolve(root, targetPath);
+    const parent = await fs.realpath(dirname(candidate));
+    const target = resolve(parent, candidate.slice(candidate.lastIndexOf("/") + 1));
+    if (!contained(root, target))
+        throw new Error("Action path escapes workingDirectory");
+    try {
+        const final = await fs.realpath(target);
+        if (!contained(root, final))
+            throw new Error("Action path escapes workingDirectory");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (write && (!spec.allowedWritePaths || !spec.allowedWritePaths.some(p => resolve(root, p) === target))) {
+        throw new Error("Action path is outside allowedWritePaths");
+    }
+    return target;
+}
+async function commandArgs(command, spec) {
+    const parts = command.trim().split(/\s+/);
+    if (parts.length < 2 || parts.some(part => /[;&|`$<>]/.test(part)))
+        throw new Error("RUN_TEST command is not allowed");
+    const checkPath = async (value) => {
+        if (!value || value.startsWith('-') || isAbsolute(value) || value.split(/[\\/]/).includes('..'))
+            throw new Error("RUN_TEST path must stay within workingDirectory");
+        await safePath(spec, value, false);
+    };
+    if (parts[0] === "node" && parts[1] === "--test" && parts.length > 2) {
+        for (const value of parts.slice(2))
+            await checkPath(value);
+        return { file: "node", args: parts.slice(1) };
+    }
+    if (parts.length === 2 && parts[0] === "npm" && parts[1] === "test")
+        return { file: "npm", args: parts.slice(1) };
+    if (parts[0] === "pytest") {
+        for (const value of parts.slice(1))
+            await checkPath(value.split('::')[0]);
+        return { file: "pytest", args: parts.slice(1) };
+    }
+    if (parts[0] === "go" && parts[1] === "test" && parts.length > 2) {
+        for (const value of parts.slice(2)) {
+            if (!value.startsWith('./'))
+                throw new Error("RUN_TEST Go packages must be workspace relative");
+            await checkPath(value.endsWith('/...') ? value.slice(0, -4) || '.' : value);
+        }
+        return { file: "go", args: parts.slice(1) };
+    }
+    if (parts[0] === "cargo" && parts[1] === "test" && parts.slice(2).every(value => /^[A-Za-z0-9_]+$/.test(value)))
+        return { file: "cargo", args: parts.slice(1) };
+    throw new Error("RUN_TEST must use node --test, npm test, pytest, go test, or cargo test");
+}
+export async function executeActions(actions, spec, stillRunning, stillOwned = stillRunning) {
+    for (const action of actions) {
+        if (!action || !["READ_FILE", "WRITE_FILE", "PATCH_FILE", "RUN_TEST"].includes(action.type) || !action.targetPath)
+            throw new Error("Invalid action payload");
+        if (action.type === "WRITE_FILE" && typeof action.content !== "string")
+            throw new Error("WRITE_FILE content is required");
+        if (action.type === "PATCH_FILE" && typeof action.patch !== "string")
+            throw new Error("PATCH_FILE patch is required");
+        if (action.type === "RUN_TEST" && typeof action.command !== "string")
+            throw new Error("RUN_TEST command is required");
+    }
+    for (const action of actions) {
+        await safePath(spec, action.targetPath, action.type === "WRITE_FILE" || action.type === "PATCH_FILE");
+        if (action.type === "RUN_TEST") {
+            if (!spec.testCommand || action.command !== spec.testCommand)
+                throw new Error("RUN_TEST must exactly match spec.testCommand");
+            await commandArgs(action.command, spec);
+        }
+    }
+    const results = [];
+    for (const action of actions) {
+        if (!(await stillRunning()))
+            throw new Error("Pipeline stopped before action execution");
+        const write = action.type === "WRITE_FILE" || action.type === "PATCH_FILE";
+        const target = await safePath(spec, action.targetPath, write);
+        if (action.type === "READ_FILE") {
+            const content = await fs.readFile(target, "utf8");
+            results.push(`READ_FILE ${action.targetPath}: ${content.slice(0, MAX_OUTPUT)}`);
+        }
+        else if (action.type === "WRITE_FILE") {
+            if (typeof action.content !== "string" || action.content.length > MAX_FILE)
+                throw new Error("WRITE_FILE content is invalid or too large");
+            if (!(await stillRunning()))
+                throw new Error("Pipeline stopped before file mutation");
+            const flags = fsConstants.O_WRONLY | fsConstants.O_NOFOLLOW;
+            let handle;
+            try {
+                handle = await fs.open(target, flags);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                if (!(await stillRunning()))
+                    throw new Error("Pipeline stopped before file mutation");
+                // Stage on the same filesystem, then publish a complete inode without
+                // replacing an existing pathname. Cancellation never unlinks target.
+                const stageDir = await fs.mkdtemp(resolve(dirname(target), WRITE_STAGE_PREFIX));
+                const staged = resolve(stageDir, WRITE_STAGE_FILE);
+                try {
+                    const stagedHandle = await fs.open(staged, flags | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o600);
+                    try {
+                        if (!(await stillRunning()))
+                            throw new Error("Pipeline stopped before file mutation");
+                        await stagedHandle.writeFile(action.content, "utf8");
+                        if (!(await stillRunning()))
+                            throw new Error("Pipeline stopped before file mutation");
+                        await fs.link(staged, target);
+                    }
+                    finally {
+                        await stagedHandle.close();
+                    }
+                }
+                finally {
+                    await fs.unlink(staged).catch((cleanupError) => { if (cleanupError.code !== 'ENOENT')
+                        throw cleanupError; });
+                    await fs.rmdir(stageDir);
+                }
+                results.push(`WRITE_FILE ${action.targetPath}: ok`);
+                continue;
+            }
+            try {
+                if (!(await stillRunning()))
+                    throw new Error("Pipeline stopped before file mutation");
+                await handle.truncate(0);
+                await handle.writeFile(action.content, "utf8");
+            }
+            finally {
+                await handle.close();
+            }
+            results.push(`WRITE_FILE ${action.targetPath}: ok`);
+        }
+        else if (action.type === "PATCH_FILE") {
+            const header = action.patch.match(/^diff --git a\/([^\n]+) b\/([^\n]+)\n(?:index [^\n]+\n)?--- a\/([^\n]+)\n\+\+\+ b\/([^\n]+)\n/);
+            if (!header || header[1] !== action.targetPath || header[2] !== action.targetPath || header[3] !== action.targetPath || header[4] !== action.targetPath || action.patch.includes("rename from") || action.patch.includes("new file mode") || action.patch.includes("old mode") || (action.patch.match(/^diff --git /gm) || []).length !== 1)
+                throw new Error("PATCH_FILE must be a single-file content patch");
+            const patchFile = resolve(spec.workingDirectory, `.prism-patch-${process.pid}-${Date.now()}.diff`);
+            if (!(await stillRunning()))
+                throw new Error("Pipeline stopped before patch mutation");
+            await fs.writeFile(patchFile, action.patch, { mode: 0o600 });
+            try {
+                await runGuardedCommand("git", ["apply", "--check", "--whitespace=nowarn", patchFile], spec.workingDirectory, 30_000, stillRunning, stillOwned);
+                if (!(await stillRunning()))
+                    throw new Error("Pipeline stopped before patch mutation");
+                await runGuardedCommand("git", ["apply", "--whitespace=nowarn", patchFile], spec.workingDirectory, 30_000, stillRunning, stillOwned);
+            }
+            finally {
+                await fs.rm(patchFile, { force: true });
+            }
+            results.push(`PATCH_FILE ${action.targetPath}: ok`);
+        }
+        else if (action.type === "RUN_TEST") {
+            if (!spec.testCommand || action.command !== spec.testCommand)
+                throw new Error("RUN_TEST must exactly match spec.testCommand");
+            const parsed = await commandArgs(action.command, spec);
+            try {
+                const out = await runGuardedCommand(parsed.file, parsed.args, spec.workingDirectory, 120_000, stillRunning, stillOwned);
+                if (!(await stillRunning()))
+                    throw new Error("Pipeline stopped during test execution");
+                results.push(`RUN_TEST ${action.command}: passed\n${String(out.stdout).slice(0, MAX_OUTPUT)}`);
+            }
+            catch (error) {
+                throw new Error(`RUN_TEST failed: ${String(error?.stdout || error?.stderr || error).slice(0, MAX_OUTPUT)}`);
+            }
+        }
+    }
+    return results;
+}
+export async function readContextFiles(spec) {
+    if (!spec.contextFiles?.length)
+        return "";
+    if (spec.contextFiles.length > 20)
+        throw new Error("contextFiles exceeds limit");
+    const chunks = [];
+    for (const file of spec.contextFiles) {
+        const target = await safePath(spec, file, false);
+        const content = await fs.readFile(target, "utf8");
+        chunks.push(`=== ${file} ===\n${content.slice(0, 20_000)}`);
+    }
+    return chunks.join("\n");
+}

package/dist/darkfactory/backendReadiness.js

@@ -0,0 +1,12 @@
+import { getStorage, activeStorageBackend } from '../storage/index.js';
+/** Resolve the instance before reading its capability: prewarm may still be pending. */
+export async function factoryBackendReadiness() {
+    try {
+        const storage = await getStorage();
+        const paid = typeof storage.isFactoryReady === 'function';
+        return { storage_backend: paid ? 'synalux' : activeStorageBackend, factory_ready: paid ? storage.isFactoryReady() : true };
+    }
+    catch {
+        return { storage_backend: 'unavailable', factory_ready: false };
+    }
+}

package/dist/darkfactory/clawInvocation.js

@@ -2,6 +2,7 @@ import { getLLMProvider } from '../utils/llm/factory.js';
 import { OpenAIAdapter } from '../utils/llm/adapters/openai.js';
 import { SafetyController } from './safetyController.js';
 import { debugLog } from '../utils/logger.js';
+import { readContextFiles } from './actionExecutor.js';
 /**
  * JSON output schema instruction injected into EXECUTE step prompts.
  * Forces the LLM to respond with machine-parseable structured output
@@ -13,23 +14,25 @@ You MUST respond with ONLY a valid JSON object matching this schema:
 {
   "actions": [
     {
-      "type": "READ_FILE" | "WRITE_FILE" | "PATCH_FILE" | "RUN_TEST",
+      "type": "READ_FILE" | "WRITE_FILE" | "PATCH_FILE",
       "targetPath": "<relative path within the workspace>",
       "content": "<file content for WRITE_FILE>",
-      "patch": "<patch content for PATCH_FILE>",
-      "command": "<test command for RUN_TEST>"
+      "patch": "<patch content for PATCH_FILE>"
     }
   ],
   "notes": "<optional summary of what you did>"
 }
 
 RULES:
-- type MUST be one of: READ_FILE, WRITE_FILE, PATCH_FILE, RUN_TEST
+- type MUST be one of: READ_FILE, WRITE_FILE, PATCH_FILE
+- Submit only file actions here. The host runs the verification command independently in VERIFY.
 - targetPath MUST be a relative path within the workspace
 - Do NOT include any text outside the JSON object
 - Do NOT use markdown code fences
 - If you cannot complete the task, return: {"actions": [], "notes": "reason"}
 `.trim();
+// Thinking models consume this budget before emitting the structured response.
+const FACTORY_OUTPUT_TOKEN_BUDGET = 4096;
 const PLAN_CONTRACT_SCHEMA = `
 You MUST respond with ONLY a valid JSON object matching this schema:
 {
@@ -80,6 +83,13 @@ export async function invokeClawAgent(spec, state, timeoutMs = 120000 // 2 min d
         : getLLMProvider();
     // Scope injection via SafetyController — single source of truth
     const systemPrompt = SafetyController.generateBoundaryPrompt(spec, state);
+    let contextObservation = '';
+    try {
+        contextObservation = await readContextFiles(spec);
+    }
+    catch (error) {
+        return { success: false, resultText: `Context read failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
     // Inject the appropriate JSON schema according to the step
     let stepPrompt = `Based on the system instructions, execute the necessary task for the current step (${state.current_step}). Respond with your actions and observations.`;
     let isJsonMode = false;
@@ -94,7 +104,7 @@ export async function invokeClawAgent(spec, state, timeoutMs = 120000 // 2 min d
         isJsonMode = true;
     }
     else if (state.current_step === 'PLAN_CONTRACT') {
-        stepPrompt = `Based on the system instructions from the PLAN phase, formulate a strict, boolean-testable contract rubric.\n\n${PLAN_CONTRACT_SCHEMA}`;
+        stepPrompt = `Based on the system instructions from the PLAN phase, formulate a strict, boolean-testable contract rubric.\n\nActual PLAN output:\n${state.notes || '(no plan output)'}\n\n${PLAN_CONTRACT_SCHEMA}`;
         isJsonMode = true;
     }
     else if (state.current_step === 'EVALUATE') {
@@ -109,11 +119,13 @@ ${state.contract_payload ? JSON.stringify(state.contract_payload.criteria, null,
 ${EVALUATE_SCHEMA}`;
         isJsonMode = true;
     }
+    if (contextObservation)
+        stepPrompt += `\n\n=== ACTUAL CONTEXT FILES ===\n${contextObservation}`;
     debugLog(`[ClawInvocation] Launching agent on pipeline ${state.id} step=${state.current_step} iter=${state.iteration} with ${timeoutMs}ms limit.${isJsonMode ? ' (JSON mode)' : ''}`);
     try {
         // Timeout Promise to ensure the runner thread does not block indefinitely
         const timeboundExecution = Promise.race([
-            llm.generateText(stepPrompt, systemPrompt),
+            llm.generateText(stepPrompt, systemPrompt, { json: isJsonMode, model: spec.modelOverride, maxOutputTokens: FACTORY_OUTPUT_TOKEN_BUDGET }),
             new Promise((_, reject) => setTimeout(() => reject(new Error('LLM_EXECUTION_TIMEOUT')), timeoutMs))
         ]);
         const result = await timeboundExecution;

package/dist/darkfactory/enablement.js

@@ -0,0 +1,29 @@
+import { getSettingSync } from "../storage/configStorage.js";
+const SETTING_KEY = "PRISM_DARK_FACTORY_ENABLED";
+const DEFAULT_ENABLED = true;
+export const DARK_FACTORY_TOOL_NAMES = ["session_start_pipeline", "session_check_pipeline_status", "session_abort_pipeline"];
+export const DARK_FACTORY_SETTINGS_UNAVAILABLE = "Factory startup settings unavailable. Retry when the server is reachable.";
+let startupDecision;
+export function resolveDarkFactoryEnabled(env, saved) {
+    if (env === "true" || env === "false")
+        return env === "true";
+    return saved === "true" || saved === "false" ? saved === "true" : DEFAULT_ENABLED;
+}
+/** Freeze one enablement decision for tool registration, dispatch, and runner startup. */
+export function initializeDarkFactoryEnabled() {
+    const env = process.env.PRISM_DARK_FACTORY_ENABLED;
+    startupDecision = resolveDarkFactoryEnabled(env, getSettingSync(SETTING_KEY, String(DEFAULT_ENABLED)));
+    return startupDecision;
+}
+export function isDarkFactoryEnabled() {
+    return startupDecision ?? initializeDarkFactoryEnabled();
+}
+export function buildDarkFactoryEnablementState(saved, active, env) {
+    const envOverride = env === "true" || env === "false" ? env === "true" : null;
+    return { saved, active, envOverride, pendingRestart: envOverride === null && saved !== active };
+}
+export function darkFactoryEnablementState() {
+    const env = process.env.PRISM_DARK_FACTORY_ENABLED;
+    const saved = resolveDarkFactoryEnabled(undefined, getSettingSync(SETTING_KEY, String(DEFAULT_ENABLED)));
+    return buildDarkFactoryEnablementState(saved, isDarkFactoryEnabled(), env);
+}

package/dist/darkfactory/executionAuthority.js

@@ -0,0 +1,11 @@
+import { registerFactoryAuthority, isFactoryAuthorized, claimFactoryLease, DEFAULT_FACTORY_LEASE_MS, FACTORY_LEASE_RENEW_MS, } from "../storage/configStorage.js";
+export { DEFAULT_FACTORY_LEASE_MS, FACTORY_LEASE_RENEW_MS };
+export async function registerPipelineAuthority(pipeline) {
+    return registerFactoryAuthority(pipeline);
+}
+export async function isPipelineAuthorized(pipeline) {
+    return isFactoryAuthorized(pipeline);
+}
+export async function claimPipelineLease(pipeline) {
+    return claimFactoryLease(pipeline);
+}

package/dist/darkfactory/hostPolicy.js

@@ -0,0 +1,12 @@
+/** Shared native-host instruction: routing is read-only; the host owns execution. */
+export const FACTORY_HOST_POLICY_LINES = [
+    '## Prism Factory prompt routing',
+    'After the startup display, call session_route_prompt for a bounded implementation request on the',
+    'first task turn and when the task changes. Supply the verbatim prompt, current project, absolute',
+    'working_directory, concrete files, test_command and the source-only allowed_write_paths.',
+    'When prism_factory_route has target factory, automatically call recommended_tool with recommended_args',
+    'exactly once, report the pipeline ID, and monitor until a terminal status. Use that pipeline before',
+    'general local-worker delegation for the same request. Once a pipeline exists, monitor it instead of',
+    'starting a duplicate. Disabled Factory, host decisions and clinical/BCBA requests remain with the host.',
+    'The dashboard is optional. Do not change startup settings to force eligibility.',
+];

package/dist/darkfactory/promptRouting.js

@@ -0,0 +1,59 @@
+import path from 'node:path';
+const MAX_FILES = 2;
+const MAX_PROMPT_CHARS = 4096;
+const IMPLEMENTATION_REQUEST = /^(?:(?:please|can you|could you|i want you to|i need you to)\s+)*(?:fix|implement|add|update|create|write|repair)\b/i;
+const CLINICAL_REQUEST = /\b(?:bcba|bip|fba|aba|clinical|patient|client notes|behavio(?:u)?r (?:support|intervention|plan|assessment|analysis|reduction)|operational definition|fct|dra|dro|ncr|functional (?:analysis|assessment|communication training)|teaching procedure|reinforcement schedule|differential reinforcement|token economy|antecedent strateg(?:y|ies)|task analysis|preference assessment|sensory supports?|skill acquisition|prompting hierarchy|consequence (?:strateg(?:y|ies)|section)|crisis|restraint|seclusion|self[- ]injury|elopement|aggression)\b/i;
+const RESERVED_REQUEST = /\b(?:deploy|publish|push|commit|production|credentials?|secrets?|payments?|billing|authentication|authorization|security|migration|delete|drop|truncate|architecture|redesign|entire codebase|entire repo)\b/i;
+const CODE_FILES = /(?:^|[\s`"'(])([A-Za-z0-9_./-]+\.(?:cjs|mjs|js|ts|tsx|py|go|rs|swift|rb|java|kt|cs))\b/g;
+const CODE_EXTENSION = /\.(?:cjs|mjs|js|ts|tsx|py|go|rs|swift|rb|java|kt|cs)$/;
+const VERIFY_REQUEST = /\b(?:run|verify|test|check|validate)\b/i;
+const NODE_TEST_COMMAND = /\b(node\s+--test\s+[A-Za-z0-9_./-]+\.(?:cjs|mjs|js|ts))\b/;
+const MESSAGES = {
+    clinical: 'Clinical and non-coding BCBA requests stay with the clinical host/skill route; they do not start a coding pipeline.',
+    reserved: 'This request requires host judgment or external/destructive operations.',
+    ordinary: 'No bounded implementation request identified.',
+    files: 'Factory needs one or two concrete code files within the workspace.',
+    writes: 'Factory write paths must be a nonempty subset of the validated concrete code files.',
+    verify: 'Factory needs an explicit verification outcome.',
+    command: 'The host must supply the repository verification command before starting Factory.',
+    disabled: 'Factory is disabled for this MCP startup.',
+    context: 'The host must supply the project and absolute working_directory before starting Factory.',
+    paid: 'Paid Factory execution is unavailable until Portal pipeline and verification APIs and their schema are ready.',
+    candidate: 'Bounded implementation with concrete files and verification; the host should call the recommended pipeline tool automatically.',
+};
+/** Routing is read-only. Pipeline creation remains a separate, side-effecting MCP call. */
+export function routeFactoryPrompt(prompt, context) {
+    const host = (reason, candidate = false) => ({ target: 'host', candidate, reason, recommended_tool: null });
+    if (CLINICAL_REQUEST.test(prompt))
+        return host(MESSAGES.clinical);
+    if (RESERVED_REQUEST.test(prompt))
+        return host(MESSAGES.reserved);
+    if (!IMPLEMENTATION_REQUEST.test(prompt.trim()) || prompt.length > MAX_PROMPT_CHARS)
+        return host(MESSAGES.ordinary);
+    const files = [...new Set(context.files_involved ?? [...prompt.matchAll(CODE_FILES)].map(match => match[1]))];
+    if (files.length === 0 || files.length > MAX_FILES || files.some(file => !CODE_EXTENSION.test(file) || path.isAbsolute(file) || file.split(/[\\/]/).includes('..')))
+        return host(MESSAGES.files);
+    const writePaths = [...new Set(context.allowed_write_paths ?? files)];
+    if (!writePaths.length || writePaths.some(file => path.isAbsolute(file) || file.split(/[\\/]/).includes('..') || !files.includes(file)))
+        return host(MESSAGES.writes);
+    if (!context.test_command && !VERIFY_REQUEST.test(prompt))
+        return host(MESSAGES.verify);
+    if (!context.enabled)
+        return host(MESSAGES.disabled, true);
+    if (context.factory_ready === false || context.storage_backend === 'unavailable' || (context.storage_backend === 'synalux' && context.factory_ready !== true))
+        return host(MESSAGES.paid, true);
+    if (!context.project?.trim() || !context.working_directory || !path.isAbsolute(context.working_directory))
+        return host(MESSAGES.context, true);
+    const testCommand = context.test_command || NODE_TEST_COMMAND.exec(prompt)?.[1];
+    if (!testCommand)
+        return host(MESSAGES.command, true);
+    const objective = `${prompt}\nVerification command: ${testCommand}`;
+    return {
+        target: 'factory', candidate: true, reason: MESSAGES.candidate,
+        recommended_tool: 'session_start_pipeline',
+        recommended_args: { project: context.project.trim(), objective, working_directory: context.working_directory, context_files: files, max_iterations: 3, test_command: testCommand, allowed_write_paths: writePaths },
+    };
+}
+export function formatFactoryPromptRoute(route) {
+    return `<prism_factory_route>${JSON.stringify(route)}</prism_factory_route>`;
+}