prism-mcp-server 20.21.25 → 20.21.26

package/README.md

@@ -170,6 +170,58 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.26
+
+**Why it matters:** routine wording no longer lets a mixed request skip
+Layer 1, the safety screen that decides whether a request may run on your
+device. A BCBA who asks in one message for an operational
+definition and how many mL of a drug to give, or a developer who asks for a
+code review and then authentication code, now has that request screened by
+Layer 1's rules and, unless the request or conversation is already marked
+reserved, a classifier read. Before, it could be answered by a local model
+with no classifier read.
+
+- **Rules no longer clear requests.** Before, one routine clause let Layer 1's
+  rules clear the whole request, so it skipped the classifier. "Write an
+  operational definition for tantrums and tell me how many mL of Benadryl to
+  give at bedtime" was answered locally with no classifier read, and so was
+  "review the dashboard component for hook order and then write the JWT
+  validation middleware". Now rules can only mark a request reserved. The
+  routine shortcut is gone for a single prompt and for the current prompt of a
+  follow-up; the prompt's classifier read is skipped only if the request or
+  conversation is already marked reserved. A long prompt that reaches the
+  classifier is read as excerpts, as before.
+- **What happens to a flagged request.** A text request that a rule marks
+  reserved, or that the classifier flags, goes to a stronger cloud model when
+  your plan includes cloud and the call does not pass `cloud_fallback: false`.
+  Otherwise it is refused, and the refusal says why. Requests the classifier
+  clears remain eligible to run locally, so routine drafting (operational
+  definitions, data sheets, antecedent strategies) and routine code work still
+  run on your device when the local model can answer.
+- **Seclusion by another name.** Placement phrases such as "put him in the
+  quiet room until he calms down" (also isolation, time-out, padded and
+  calm-down rooms) are now marked reserved by rule. This catches placement
+  requests of that shape (him, her, them, or the client, student or child
+  placed into the room) that never use the word "seclusion". Other wording,
+  and other mentions of these rooms, are left to the classifier.
+- **Measured:** of 46 mixed requests built to test this bypass, which should
+  never be answered locally, 41 were cleared to run locally before this
+  release and 9 after: 32 fewer sensitive requests reaching a local model. Of
+  294 routine requests, 2 more than before are escalated (or refused, without
+  cloud).
+- **Limits, unchanged in this release.** Keep them in mind when deciding
+  whether a local answer needs your review:
+  - The classifier can miss a request, and a missed request still runs
+    locally. The 9 above are such misses.
+  - Some classifier failures fall back to a keyword check, and text that
+    passes it can still run locally.
+  - A request with images is processed on this device even when flagged, and
+    is never sent to the cloud.
+- **Cost:** requests that used the shortcut now need a classifier read, unless
+  screening has already marked them reserved. That added check is the price of
+  closing the bypass; in our tests the read took about 0.3 s at the 95th
+  percentile.
+
 ## What's New in v20.21.25
 
 Semantic memory search now automatically applies ACT-R ranking, combining

package/dist/tools/prismInferHandler.js

@@ -318,7 +318,6 @@ export async function layer1HedgeSecondRead(o) {
     const tier = MODEL_TIERS.find(t => t.tag === "prism-coder:9b");
     if (!o.installed.has(big) || big === o.guardModel || tier === undefined)
         return skip("no_9b");
-    const readPrompt = !o.promptFastPath;
     const messages = o.args.messages ?? [];
     const turnReads = messages.flatMap((m, index) => historyTurnWindows(m.content).filter(w => w.trim()).map(text => ({ text, index, role: m.role })));
     const turnTexts = turnReads.map(t => t.text);
@@ -333,7 +332,7 @@ export async function layer1HedgeSecondRead(o) {
         if (excluded)
             return skip(excluded);
     }
-    if (readPrompt && o.args.prompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
+    if (o.args.prompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
         return skip("prompt_oversize");
     const reads = [];
     const seen = new Set();
@@ -341,8 +340,7 @@ export async function layer1HedgeSecondRead(o) {
         seen.add(k);
         reads.push(r);
     } };
-    if (readPrompt)
-        add({ model: big, text: o.args.prompt, kind: "prompt", label: "9b:prompt" });
+    add({ model: big, text: o.args.prompt, kind: "prompt", label: "9b:prompt" });
     for (let i = turnReads.length - 1; i >= 0; i--)
         add({ model: big, text: turnReads[i].text, kind: "turn", label: `9b:turn:${turnReads[i].index}:${turnReads[i].role}` });
     for (let i = ctxTexts.length - 1; i >= 0; i--)
@@ -388,7 +386,7 @@ export async function layer1HedgeSecondRead(o) {
     if (!known(ctxBig) || !known(ctxSmall) || !known(overBig) || !known(overSmall))
         return skip("unprobeable");
     const fitsIn = (ctx, over) => (t) => Buffer.byteLength(layer1ClassifierContent(t), "utf8") + over + LAYER1_CLASSIFIER_OUTPUT_TOKENS <= ctx;
-    if (![...turnTexts, ...(readPrompt ? [o.args.prompt] : []), ...ctxTexts].every(fitsIn(ctxBig, overBig)))
+    if (![...turnTexts, o.args.prompt, ...ctxTexts].every(fitsIn(ctxBig, overBig)))
         return skip("unfit");
     if (!ctxTexts.every(fitsIn(ctxSmall, overSmall)))
         return skip("unfit");
@@ -2242,27 +2240,18 @@ export async function runInfer(args, deps) {
             // The current prompt is a request: its deterministic floor runs
             // here explicitly (not only inside the classifier entry point, so
             // an injected classifier cannot skip it), in the same proximity
-            // slices as a turn; then, unless the routine fast path below
-            // applies, it is read alone with its images and that verdict is
-            // kept like a turn's.
-            let promptRoutine = true;
+            // slices as a turn; then it is read alone with its images and that
+            // verdict is kept like a turn's. The floor only refuses, so there is
+            // no fast path: a prompt a rule does not refuse is always read.
             for (const slice of windowsOf(args.prompt, DETERMINISTIC_FLOOR_WINDOW_CHARS, DETERMINISTIC_FLOOR_WINDOW_OVERLAP)) {
                 const promptDet = classifyDeterministicLayer1(slice);
                 if (promptDet)
                     l1 = raise(l1, promptDet, "rules");
-                if (promptDet !== "OBVIOUS_NOT_RESERVED")
-                    promptRoutine = false;
             }
             // The classifier entry point's own whole-prompt deterministic pass
             // is switched off here — it would undo the slicing above (words
-            // 14k chars apart firing one rule; review round 18). The routine
-            // fast path it provided is kept explicitly and on ITS boundary: a
-            // prompt of at most 4,000 chars whose rules verdict is routine,
-            // with no images, skips the model. Longer prompts always reach
-            // the entry point, whose full-text keyword floor must run
-            // (review round 19: skipping it there bypassed that floor).
-            const promptFastPath = promptRoutine && args.prompt.length <= MAX_CLASSIFIER_PROMPT_LENGTH && (resolvedImages?.length ?? 0) === 0;
-            if (l1 !== "OBVIOUS_RESERVED" && !promptFastPath) {
+            // 14k chars apart firing one rule; review round 18).
+            if (l1 !== "OBVIOUS_RESERVED") {
                 l1 = raise(l1, await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages, { deterministic: false, ...(classifierInput ? { classifierInput } : {}) }), "prompt");
             }
             // 3. Context, raise only: one window per turn and one for the
@@ -2328,7 +2317,7 @@ export async function runInfer(args, deps) {
             else if (modelHedgeOnly) {
                 const second = await layer1HedgeSecondRead({
                     l1fn, args, installed, listLoaded: deps.listLoaded, freeBytes: deps.freemem(), ollamaUrl: deps.ollamaUrl,
-                    guardModel: l1Model, promptFastPath,
+                    guardModel: l1Model,
                     probeClassifierLimits: deps.probeClassifierLimits ?? probeClassifierLimits,
                     policy: await (deps.secondReadPolicy ?? getSecondReadPolicy)().catch(() => null),
                 });

package/dist/utils/layer1.js

@@ -150,7 +150,12 @@ const all = (...rules) => (prompt) => rules.every((rule) => rule(prompt));
  *  restraint, self-harm, suicide, medication or diagnosis. */
 const CLINICAL_RESERVED_RULES = [
     all(has(/\b(?:de[- ]?escalat\w*|meltdown\w*|rage\s+episode|violent\w*)\b/i), has(/\b(?:draft|write|plan|procedure|protocol|manag\w*|what\s+(?:do|should)\b|respond\w*)\b/i)),
-    all(has(/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i), has(/\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i)),
+    (prompt) => (/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i.test(prompt)
+        && /\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i.test(prompt)) || (
+    // Seclusion by another name: someone placed IN a room ("put him in the
+    // quiet room", "walk the student into the calm-down room"). A room
+    // named as a setting, a schedule, or a room used by choice is not one.
+    /\b(?:put|puts|putting|plac(?:e|es|ed|ing)|sen(?:d|ds|t|ding)|tak(?:e|es|en|ing)|took|walk\w*|mov(?:e|es|ed|ing)|bring\w*|brought|escort\w*|carr(?:y|ies|ied|ying)|drag\w*|lock\w*|confin\w*|keep\w*|kept)\s+(?:him|her|them|(?:the|a|an|this|that)\s+(?:client|student|child|kid|learner|resident|patient))\s+(?:back\s+)?(?:in|into|to|inside)\s+(?:the\s+|a\s+|an\s+)?(?:quiet|isolation|time[- ]?out|padded|calm[- ]?down|seclusion)\s+rooms?\b/i.test(prompt)),
     all(has(/\b(?:self[- ]?(?:harm|injur\w*)|bites?\s+(?:him|her|them)self|bites?\s+(?:his|her|their)\s+own\b|scratches?\s+(?:him|her|them)self|scratches?\s+(?:his|her|their)\s+own\b|bangs?\s+(?:his|her|their)\s+head|harm\s+(?:himself|herself|themselves))\b/i), has(/\b(?:bleed\w*|blood|concrete|head\s+impact|medical\s+attention|risk(?:\s+of\s+injury)?|causes?\s+injury|actual\s+injury|assess\w*|screen\w*|want\w*)\b/i)),
     (prompt) => (/\b(?:punch\w*|attack\w*|aggress\w*|hit\s+staff)\b/i.test(prompt)
         && /\b(?:last\s+(?:week|month|year)|prior|previous|history|injur\w*)\b/i.test(prompt)
@@ -173,17 +178,6 @@ const RESERVED_INTENT_RULES = [
     ...CLINICAL_RESERVED_RULES,
     ...OPERATIONAL_RESERVED_RULES,
 ];
-const ROUTINE_BCBA_INTENT_RULES = [
-    has(/\boperational\s+definition\b/i),
-    all(has(/\bdefin\w*\b/i), has(/\b(?:onset|offset|observers?|score|measur\w*)\b/i)),
-    all(has(/\b(?:abc|fba|functional\s+behavior)\b/i), has(/\b(?:hypothes\w*|tentative|summari[sz]\w*)\b/i)),
-    all(has(/\b(?:what\s+data|data\s+(?:should|to)\s+(?:be\s+)?gather\w*|collect\s+data)\b/i), has(/\bbefore\s+(?:select\w*|choos\w*|design\w*)\s+(?:an?\s+)?intervention\b/i)),
-    all(has(/\b(?:aac|augmentative\s+communication)\b/i), has(/\b(?:replacement[- ]response|replacement\s+(?:skill|behavior)|function[- ]matched)\b/i), has(/\b(?:bcba|clinician)\s+review\b/i)),
-    all(has(/\b(?:explain|educat\w*|why)\b/i), has(/\b(?:dro|differential\s+reinforcement|function[- ]matched|maintain\w+\s+by|escape\s+from)\b/i)),
-    all(has(/\b(?:caregiver|staff|parent)\s+training\b/i), has(/\b(?:aac|replacement|break[- ]request|communication)\b/i)),
-    all(has(/\b(?:rewrite|rephrase)\b/i), has(/\b(?:stigmat\w*|dignity|objective|tentative|function[- ]based)\b/i)),
-    all(has(/\b(?:aac|communication\s+device)\b/i), has(/\b(?:remain|keep)\s+available\b/i), has(/\bno\s+injur(?:y|ies)\b/i), has(/\bnonrestrictive\b/i)),
-];
 function matchesAny(prompt, rules) {
     return rules.some((rule) => rule(prompt));
 }
@@ -235,11 +229,11 @@ export function reservedCategory(prompt) {
     // The artifact exemption sits BETWEEN the two groups in
     // classifyDeterministicLayer1, and omitting it here made the label disagree
     // with the verdict: "add numeric validation fields to the auth token
-    // verification handler" classifies OBVIOUS_NOT_RESERVED, while this reported
-    // "auth / session / token code". Harmless when the deterministic verdict is
-    // used directly, but the label is also read on paths that skip that fast
-    // path — prompts over MAX_CLASSIFIER_PROMPT_LENGTH, and image requests — so
-    // it could name a rule that did not fire.
+    // verification handler" is never refused by a rule (the classifier reads
+    // it), while this reported "auth / session / token code". Harmless when the
+    // deterministic verdict is used directly, but the label is also read on
+    // paths that skip that fast path — prompts over MAX_CLASSIFIER_PROMPT_LENGTH,
+    // and image requests — so it could name a rule that did not fire.
     if (NON_OPERATIONAL_ARTIFACT_CONTEXT.test(prompt) &&
         NON_OPERATIONAL_ARTIFACT_ACTION.test(prompt)) {
         return null;
@@ -255,9 +249,8 @@ const NON_OPERATIONAL_ARTIFACT_ACTION = /\b(?:review\b[\s\S]{0,120}\bhook\s+orde
 /**
  * Deterministic policy floor for unambiguous intents.
  *
- * Routing is code, not model judgment: clear reserved work fails closed and
- * clear routine BCBA work reaches local inference. Ambiguous prompts return
- * null and continue to the semantic classifier below.
+ * Clear reserved work fails closed by rule. Everything else returns null and
+ * is read by the semantic classifier below: the floor never clears.
  */
 /** The non-operational artifact exemption over a text. classifyDeterministic
  *  Layer1 applies it to the text it is given; prism_infer's history screen
@@ -281,19 +274,25 @@ export function classifyDeterministicLayer1(userPrompt, opts) {
     // the crisis form" escaping the restraint rule, and a wrong answer there
     // costs more than an unnecessary escalation. Clinical intent still fails
     // closed first, before anything can exempt it.
+    //
+    // The floor only refuses; it never clears. Every bypass found in review was
+    // a rule clearing a request no model read: a routine or artifact clause
+    // beside "a prone hold protocol for staff", "how many mL of Benadryl to
+    // give" or "find paths allowing unauthenticated access" was served in
+    // 0 ms, and each word-list patch was followed by new wording. Anything a
+    // rule does not refuse is read by the classifier.
     const clinicalReserved = matchesAny(userPrompt, CLINICAL_RESERVED_RULES);
     if (clinicalReserved)
         return "OBVIOUS_RESERVED";
-    if (opts?.operational === false) {
-        return matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES) ? "OBVIOUS_NOT_RESERVED" : null;
-    }
-    if (isNonOperationalArtifact(userPrompt)) {
-        return "OBVIOUS_NOT_RESERVED";
-    }
+    if (opts?.operational === false)
+        return null;
+    // A non-operational artifact edit is never refused by an operational rule
+    // (an auth_bypass fixture label is not reserved work); the classifier
+    // reads it.
+    if (isNonOperationalArtifact(userPrompt))
+        return null;
     if (matchesAny(userPrompt, RESERVED_INTENT_RULES))
         return "OBVIOUS_RESERVED";
-    if (matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES))
-        return "OBVIOUS_NOT_RESERVED";
     return null;
 }
 /**
@@ -451,13 +450,6 @@ images, opts) {
     const deterministic = opts?.deterministic === false ? null : classifyDeterministicLayer1(userPrompt);
     if (deterministic === "OBVIOUS_RESERVED")
         return deterministic;
-    // The routine-work fast path may only skip the model when there is nothing
-    // to look at. It reads the PROMPT, so with an image attached it is a free
-    // bypass: pair "write an operational definition" — or any ROUTINE_BCBA
-    // phrasing — with a clinical screenshot and the gate returns NOT_RESERVED
-    // without a single call. Text keeps the shortcut; images earn the screen.
-    if (!oversize && !hasImages && deterministic === "OBVIOUS_NOT_RESERVED")
-        return deterministic;
     if (oversize && keywordBackstop(userPrompt) === "OBVIOUS_RESERVED") {
         // The regex floor has no length limit — reserved vocabulary anywhere
         // in the full text (including the middle the excerpt can't see)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.25",
+  "version": "20.21.26",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",