prism-mcp-server 20.21.21 → 20.21.23

package/dist/utils/llm/adapters/anthropic.js

@@ -61,20 +61,28 @@ export class AnthropicAdapter {
         debugLog("[AnthropicAdapter] Initialized");
     }
     // ─── Text Generation ─────────────────────────────────────────────────────
-    async generateText(prompt, systemInstruction) {
-        const model = getSettingSync("anthropic_model", getDefaultModel());
+    async generateText(prompt, systemInstruction, options) {
+        const model = options?.model || getSettingSync("anthropic_model", getDefaultModel());
         debugLog(`[AnthropicAdapter] generateText — model=${model}`);
         // Anthropic's Messages API uses system as a top-level field (not a message role).
         // This maps cleanly to LLMProvider's systemInstruction parameter.
         const response = await this.client.messages.create({
             model,
-            max_tokens: getMaxTokens(),
+            max_tokens: options?.maxOutputTokens || getMaxTokens(),
             ...(systemInstruction ? { system: systemInstruction } : {}),
             messages: [{ role: "user", content: prompt }],
+            ...(options?.json ? {
+                tools: [{ name: "emit_json", description: "Return the requested JSON object.", input_schema: { type: "object", additionalProperties: true } }],
+                tool_choice: { type: "tool", name: "emit_json" },
+            } : {}),
         });
         // Extract text from the first ContentBlock.
         // Anthropic returns an array of content blocks; we only use text blocks.
         const block = response.content[0];
+        if (options?.json && block?.type === "tool_use")
+            return JSON.stringify(block.input);
+        if (options?.json)
+            throw new Error("[AnthropicAdapter] Structured response missing emit_json tool use");
         if (!block || block.type !== "text") {
             throw new Error(`[AnthropicAdapter] Unexpected response content type: ${block?.type ?? "empty"}`);
         }

package/dist/utils/llm/adapters/gemini.js

@@ -62,14 +62,15 @@ export class GeminiAdapter {
         this.ai = new GoogleGenerativeAI(GOOGLE_API_KEY);
     }
     // ─── Text Generation ─────────────────────────────────────────────────────
-    async generateText(prompt, systemInstruction) {
+    async generateText(prompt, systemInstruction, options) {
         // getGenerativeModel() is lightweight — it just binds model name + options.
         // The HTTP call happens inside generateContent() below.
         const model = this.ai.getGenerativeModel({
-            model: TEXT_MODEL,
+            model: options?.model || TEXT_MODEL,
             // Only spread systemInstruction if provided — avoids sending an empty field
             // which could confuse some model versions.
             ...(systemInstruction ? { systemInstruction } : {}),
+            ...(options?.json || options?.maxOutputTokens ? { generationConfig: { ...(options?.json ? { responseMimeType: "application/json" } : {}), ...(options?.maxOutputTokens ? { maxOutputTokens: options.maxOutputTokens } : {}) } } : {}),
         });
         const result = await model.generateContent(prompt);
         // result.response.text() extracts the first candidate's text content.

package/dist/utils/llm/adapters/openai.js

@@ -84,10 +84,10 @@ export class OpenAIAdapter {
         debugLog(`[OpenAIAdapter] Initialized — baseURL=${baseURL}, keyless=${!apiKey}`);
     }
     // ─── Text Generation ─────────────────────────────────────────────────────
-    async generateText(prompt, systemInstruction) {
+    async generateText(prompt, systemInstruction, options) {
         // Read model at call time (not constructor) so the user can hot-swap
         // the model setting without restarting the server.
-        const model = getSettingSync("openai_model", "gpt-4o-mini");
+        const model = options?.model || getSettingSync("openai_model", "gpt-4o-mini");
         // Build message array: optional system message first, then user prompt.
         // This maps cleanly to Gemini's systemInstruction + user prompt pattern.
         const messages = [];
@@ -96,7 +96,7 @@ export class OpenAIAdapter {
         }
         messages.push({ role: "user", content: prompt });
         debugLog(`[OpenAIAdapter] generateText — model=${model}, messages=${messages.length}`);
-        const response = await this.client.chat.completions.create({ model, messages });
+        const response = await this.client.chat.completions.create({ model, messages, ...(options?.json ? { response_format: { type: "json_object" } } : {}), ...(options?.maxOutputTokens ? { max_tokens: options.maxOutputTokens } : {}) });
         // choices[0] is always the primary completion. ?? "" returns empty string
         // on null content (e.g. if the model returned a function call instead).
         return response.choices[0]?.message?.content ?? "";

package/dist/utils/llm/adapters/traced.js

@@ -115,7 +115,7 @@ export class TracingLLMProvider {
         // will correctly evaluate to false.
     }
     // ── generateText ──────────────────────────────────────────────────────────
-    async generateText(prompt, systemInstruction) {
+    async generateText(prompt, systemInstruction, options) {
         /**
          * Span: llm.generate_text
          *
@@ -130,7 +130,7 @@ export class TracingLLMProvider {
         });
         return context.with(trace.setSpan(context.active(), span), async () => {
             try {
-                const result = await this.inner.generateText(prompt, systemInstruction);
+                const result = options ? await this.inner.generateText(prompt, systemInstruction, options) : await this.inner.generateText(prompt, systemInstruction);
                 span.setStatus({ code: SpanStatusCode.OK });
                 return result;
             }

package/dist/verification/runner.js

@@ -54,7 +54,14 @@ function isPrivateIpv4(hostname) {
     return PRIVATE_IPV4_CIDRS.some(([start, end]) => value >= start && value <= end);
 }
 function isDisallowedIpv6(hostname) {
-    const normalized = hostname.toLowerCase();
+    const normalized = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    // URL normalizes dotted IPv4-mapped addresses into two hexadecimal groups.
+    const mapped = normalized.match(/^::ffff:([a-f0-9]{1,4}):([a-f0-9]{1,4})$/);
+    if (mapped) {
+        const high = parseInt(mapped[1], 16);
+        const low = parseInt(mapped[2], 16);
+        return isPrivateIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+    }
     return (normalized === "::1" ||
         normalized.startsWith("fc") || // fc00::/7
         normalized.startsWith("fd") || // fc00::/7
@@ -227,7 +234,9 @@ export class VerificationRunner {
             const parsed = JSON.parse(jsonContent);
             const suite = TestSuiteSchema.parse(parsed);
             if (harness) {
-                VerificationRunner.verifyRubricHash(suite.tests, harness);
+                // The frozen hash covers the submitted JSON, including its key order.
+                // Schema parsing may reorder keys or supply defaults for execution.
+                VerificationRunner.verifyRubricHash(parsed.tests, harness);
             }
             const { preparedById, orderedIds, precomputed } = prepareAssertions(suite.tests, filterLayers, minSeverity, config);
             const outcomes = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.21",
+  "version": "20.21.23",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",