prism-mcp-server 20.21.25 → 20.21.27

package/README.md

@@ -170,6 +170,78 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.27
+
+**Why it matters:** a script that feeds Prism Browser through a pipe can
+now pause between blocks of commands. Before, commands that had already
+arrived waited for the next write, and never ran if the 600 s idle timeout
+came first, so a script that checked a result before sending more stalled
+and then failed.
+
+- **Every piped command runs when it arrives.** The reader waited on
+  `select()` for new pipe data while `readline()` had already buffered the
+  commands sent so far. It now reads the descriptor itself and decodes it as
+  the text stream did (its encoding, universal newlines). Measured with two
+  commands written together and a third written only after the reader hands
+  over the second: the second came out only with the third before, and
+  before the third is written now.
+- **Unchanged:** the idle timeout, `\` line continuation (CRLF endings
+  included), comment lines, and streams `select()` cannot watch, now read
+  blocking. At the idle timeout, a command still being written is dropped,
+  never run cut short.
+
+## What's New in v20.21.26
+
+**Why it matters:** routine wording no longer lets a mixed request skip
+Layer 1, the safety screen that decides whether a request may run on your
+device. A BCBA who asks in one message for an operational
+definition and how many mL of a drug to give, or a developer who asks for a
+code review and then authentication code, now has that request screened by
+Layer 1's rules and, unless the request or conversation is already marked
+reserved, a classifier read. Before, it could be answered by a local model
+with no classifier read.
+
+- **Rules no longer clear requests.** Before, one routine clause let Layer 1's
+  rules clear the whole request, so it skipped the classifier. "Write an
+  operational definition for tantrums and tell me how many mL of Benadryl to
+  give at bedtime" was answered locally with no classifier read, and so was
+  "review the dashboard component for hook order and then write the JWT
+  validation middleware". Now rules can only mark a request reserved. The
+  routine shortcut is gone for a single prompt and for the current prompt of a
+  follow-up; the prompt's classifier read is skipped only if the request or
+  conversation is already marked reserved. A long prompt that reaches the
+  classifier is read as excerpts, as before.
+- **What happens to a flagged request.** A text request that a rule marks
+  reserved, or that the classifier flags, goes to a stronger cloud model when
+  your plan includes cloud and the call does not pass `cloud_fallback: false`.
+  Otherwise it is refused, and the refusal says why. Requests the classifier
+  clears remain eligible to run locally, so routine drafting (operational
+  definitions, data sheets, antecedent strategies) and routine code work still
+  run on your device when the local model can answer.
+- **Seclusion by another name.** Placement phrases such as "put him in the
+  quiet room until he calms down" (also isolation, time-out, padded and
+  calm-down rooms) are now marked reserved by rule. This catches placement
+  requests of that shape (him, her, them, or the client, student or child
+  placed into the room) that never use the word "seclusion". Other wording,
+  and other mentions of these rooms, are left to the classifier.
+- **Measured:** of 46 mixed requests built to test this bypass, which should
+  never be answered locally, 41 were cleared to run locally before this
+  release and 9 after: 32 fewer sensitive requests reaching a local model. Of
+  294 routine requests, 2 more than before are escalated (or refused, without
+  cloud).
+- **Limits, unchanged in this release.** Keep them in mind when deciding
+  whether a local answer needs your review:
+  - The classifier can miss a request, and a missed request still runs
+    locally. The 9 above are such misses.
+  - Some classifier failures fall back to a keyword check, and text that
+    passes it can still run locally.
+  - A request with images is processed on this device even when flagged, and
+    is never sent to the cloud.
+- **Cost:** requests that used the shortcut now need a classifier read, unless
+  screening has already marked them reserved. That added check is the price of
+  closing the bypass; in our tests the read took about 0.3 s at the 95th
+  percentile.
+
 ## What's New in v20.21.25
 
 Semantic memory search now automatically applies ACT-R ranking, combining

package/dist/tools/prismInferHandler.js

@@ -318,7 +318,6 @@ export async function layer1HedgeSecondRead(o) {
     const tier = MODEL_TIERS.find(t => t.tag === "prism-coder:9b");
     if (!o.installed.has(big) || big === o.guardModel || tier === undefined)
         return skip("no_9b");
-    const readPrompt = !o.promptFastPath;
     const messages = o.args.messages ?? [];
     const turnReads = messages.flatMap((m, index) => historyTurnWindows(m.content).filter(w => w.trim()).map(text => ({ text, index, role: m.role })));
     const turnTexts = turnReads.map(t => t.text);
@@ -333,7 +332,7 @@ export async function layer1HedgeSecondRead(o) {
         if (excluded)
             return skip(excluded);
     }
-    if (readPrompt && o.args.prompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
+    if (o.args.prompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
         return skip("prompt_oversize");
     const reads = [];
     const seen = new Set();
@@ -341,8 +340,7 @@ export async function layer1HedgeSecondRead(o) {
         seen.add(k);
         reads.push(r);
     } };
-    if (readPrompt)
-        add({ model: big, text: o.args.prompt, kind: "prompt", label: "9b:prompt" });
+    add({ model: big, text: o.args.prompt, kind: "prompt", label: "9b:prompt" });
     for (let i = turnReads.length - 1; i >= 0; i--)
         add({ model: big, text: turnReads[i].text, kind: "turn", label: `9b:turn:${turnReads[i].index}:${turnReads[i].role}` });
     for (let i = ctxTexts.length - 1; i >= 0; i--)
@@ -388,7 +386,7 @@ export async function layer1HedgeSecondRead(o) {
     if (!known(ctxBig) || !known(ctxSmall) || !known(overBig) || !known(overSmall))
         return skip("unprobeable");
     const fitsIn = (ctx, over) => (t) => Buffer.byteLength(layer1ClassifierContent(t), "utf8") + over + LAYER1_CLASSIFIER_OUTPUT_TOKENS <= ctx;
-    if (![...turnTexts, ...(readPrompt ? [o.args.prompt] : []), ...ctxTexts].every(fitsIn(ctxBig, overBig)))
+    if (![...turnTexts, o.args.prompt, ...ctxTexts].every(fitsIn(ctxBig, overBig)))
         return skip("unfit");
     if (!ctxTexts.every(fitsIn(ctxSmall, overSmall)))
         return skip("unfit");
@@ -2242,27 +2240,18 @@ export async function runInfer(args, deps) {
             // The current prompt is a request: its deterministic floor runs
             // here explicitly (not only inside the classifier entry point, so
             // an injected classifier cannot skip it), in the same proximity
-            // slices as a turn; then, unless the routine fast path below
-            // applies, it is read alone with its images and that verdict is
-            // kept like a turn's.
-            let promptRoutine = true;
+            // slices as a turn; then it is read alone with its images and that
+            // verdict is kept like a turn's. The floor only refuses, so there is
+            // no fast path: a prompt a rule does not refuse is always read.
             for (const slice of windowsOf(args.prompt, DETERMINISTIC_FLOOR_WINDOW_CHARS, DETERMINISTIC_FLOOR_WINDOW_OVERLAP)) {
                 const promptDet = classifyDeterministicLayer1(slice);
                 if (promptDet)
                     l1 = raise(l1, promptDet, "rules");
-                if (promptDet !== "OBVIOUS_NOT_RESERVED")
-                    promptRoutine = false;
             }
             // The classifier entry point's own whole-prompt deterministic pass
             // is switched off here — it would undo the slicing above (words
-            // 14k chars apart firing one rule; review round 18). The routine
-            // fast path it provided is kept explicitly and on ITS boundary: a
-            // prompt of at most 4,000 chars whose rules verdict is routine,
-            // with no images, skips the model. Longer prompts always reach
-            // the entry point, whose full-text keyword floor must run
-            // (review round 19: skipping it there bypassed that floor).
-            const promptFastPath = promptRoutine && args.prompt.length <= MAX_CLASSIFIER_PROMPT_LENGTH && (resolvedImages?.length ?? 0) === 0;
-            if (l1 !== "OBVIOUS_RESERVED" && !promptFastPath) {
+            // 14k chars apart firing one rule; review round 18).
+            if (l1 !== "OBVIOUS_RESERVED") {
                 l1 = raise(l1, await l1fn(args.prompt, deps.ollamaUrl, l1Model, undefined, resolvedImages, { deterministic: false, ...(classifierInput ? { classifierInput } : {}) }), "prompt");
             }
             // 3. Context, raise only: one window per turn and one for the
@@ -2328,7 +2317,7 @@ export async function runInfer(args, deps) {
             else if (modelHedgeOnly) {
                 const second = await layer1HedgeSecondRead({
                     l1fn, args, installed, listLoaded: deps.listLoaded, freeBytes: deps.freemem(), ollamaUrl: deps.ollamaUrl,
-                    guardModel: l1Model, promptFastPath,
+                    guardModel: l1Model,
                     probeClassifierLimits: deps.probeClassifierLimits ?? probeClassifierLimits,
                     policy: await (deps.secondReadPolicy ?? getSecondReadPolicy)().catch(() => null),
                 });

package/dist/utils/layer1.js

@@ -150,7 +150,12 @@ const all = (...rules) => (prompt) => rules.every((rule) => rule(prompt));
  *  restraint, self-harm, suicide, medication or diagnosis. */
 const CLINICAL_RESERVED_RULES = [
     all(has(/\b(?:de[- ]?escalat\w*|meltdown\w*|rage\s+episode|violent\w*)\b/i), has(/\b(?:draft|write|plan|procedure|protocol|manag\w*|what\s+(?:do|should)\b|respond\w*)\b/i)),
-    all(has(/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i), has(/\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i)),
+    (prompt) => (/\b(?:physical\s+intervention|containment|hold\s+procedure|restrain\w*|seclu\w*|physical\s+management)\b/i.test(prompt)
+        && /\b(?:draft|write|document|procedure|protocol|use|implement|instruct\w*)\b/i.test(prompt)) || (
+    // Seclusion by another name: someone placed IN a room ("put him in the
+    // quiet room", "walk the student into the calm-down room"). A room
+    // named as a setting, a schedule, or a room used by choice is not one.
+    /\b(?:put|puts|putting|plac(?:e|es|ed|ing)|sen(?:d|ds|t|ding)|tak(?:e|es|en|ing)|took|walk\w*|mov(?:e|es|ed|ing)|bring\w*|brought|escort\w*|carr(?:y|ies|ied|ying)|drag\w*|lock\w*|confin\w*|keep\w*|kept)\s+(?:him|her|them|(?:the|a|an|this|that)\s+(?:client|student|child|kid|learner|resident|patient))\s+(?:back\s+)?(?:in|into|to|inside)\s+(?:the\s+|a\s+|an\s+)?(?:quiet|isolation|time[- ]?out|padded|calm[- ]?down|seclusion)\s+rooms?\b/i.test(prompt)),
     all(has(/\b(?:self[- ]?(?:harm|injur\w*)|bites?\s+(?:him|her|them)self|bites?\s+(?:his|her|their)\s+own\b|scratches?\s+(?:him|her|them)self|scratches?\s+(?:his|her|their)\s+own\b|bangs?\s+(?:his|her|their)\s+head|harm\s+(?:himself|herself|themselves))\b/i), has(/\b(?:bleed\w*|blood|concrete|head\s+impact|medical\s+attention|risk(?:\s+of\s+injury)?|causes?\s+injury|actual\s+injury|assess\w*|screen\w*|want\w*)\b/i)),
     (prompt) => (/\b(?:punch\w*|attack\w*|aggress\w*|hit\s+staff)\b/i.test(prompt)
         && /\b(?:last\s+(?:week|month|year)|prior|previous|history|injur\w*)\b/i.test(prompt)
@@ -173,17 +178,6 @@ const RESERVED_INTENT_RULES = [
     ...CLINICAL_RESERVED_RULES,
     ...OPERATIONAL_RESERVED_RULES,
 ];
-const ROUTINE_BCBA_INTENT_RULES = [
-    has(/\boperational\s+definition\b/i),
-    all(has(/\bdefin\w*\b/i), has(/\b(?:onset|offset|observers?|score|measur\w*)\b/i)),
-    all(has(/\b(?:abc|fba|functional\s+behavior)\b/i), has(/\b(?:hypothes\w*|tentative|summari[sz]\w*)\b/i)),
-    all(has(/\b(?:what\s+data|data\s+(?:should|to)\s+(?:be\s+)?gather\w*|collect\s+data)\b/i), has(/\bbefore\s+(?:select\w*|choos\w*|design\w*)\s+(?:an?\s+)?intervention\b/i)),
-    all(has(/\b(?:aac|augmentative\s+communication)\b/i), has(/\b(?:replacement[- ]response|replacement\s+(?:skill|behavior)|function[- ]matched)\b/i), has(/\b(?:bcba|clinician)\s+review\b/i)),
-    all(has(/\b(?:explain|educat\w*|why)\b/i), has(/\b(?:dro|differential\s+reinforcement|function[- ]matched|maintain\w+\s+by|escape\s+from)\b/i)),
-    all(has(/\b(?:caregiver|staff|parent)\s+training\b/i), has(/\b(?:aac|replacement|break[- ]request|communication)\b/i)),
-    all(has(/\b(?:rewrite|rephrase)\b/i), has(/\b(?:stigmat\w*|dignity|objective|tentative|function[- ]based)\b/i)),
-    all(has(/\b(?:aac|communication\s+device)\b/i), has(/\b(?:remain|keep)\s+available\b/i), has(/\bno\s+injur(?:y|ies)\b/i), has(/\bnonrestrictive\b/i)),
-];
 function matchesAny(prompt, rules) {
     return rules.some((rule) => rule(prompt));
 }
@@ -235,11 +229,11 @@ export function reservedCategory(prompt) {
     // The artifact exemption sits BETWEEN the two groups in
     // classifyDeterministicLayer1, and omitting it here made the label disagree
     // with the verdict: "add numeric validation fields to the auth token
-    // verification handler" classifies OBVIOUS_NOT_RESERVED, while this reported
-    // "auth / session / token code". Harmless when the deterministic verdict is
-    // used directly, but the label is also read on paths that skip that fast
-    // path — prompts over MAX_CLASSIFIER_PROMPT_LENGTH, and image requests — so
-    // it could name a rule that did not fire.
+    // verification handler" is never refused by a rule (the classifier reads
+    // it), while this reported "auth / session / token code". Harmless when the
+    // deterministic verdict is used directly, but the label is also read on
+    // paths that skip that fast path — prompts over MAX_CLASSIFIER_PROMPT_LENGTH,
+    // and image requests — so it could name a rule that did not fire.
     if (NON_OPERATIONAL_ARTIFACT_CONTEXT.test(prompt) &&
         NON_OPERATIONAL_ARTIFACT_ACTION.test(prompt)) {
         return null;
@@ -255,9 +249,8 @@ const NON_OPERATIONAL_ARTIFACT_ACTION = /\b(?:review\b[\s\S]{0,120}\bhook\s+orde
 /**
  * Deterministic policy floor for unambiguous intents.
  *
- * Routing is code, not model judgment: clear reserved work fails closed and
- * clear routine BCBA work reaches local inference. Ambiguous prompts return
- * null and continue to the semantic classifier below.
+ * Clear reserved work fails closed by rule. Everything else returns null and
+ * is read by the semantic classifier below: the floor never clears.
  */
 /** The non-operational artifact exemption over a text. classifyDeterministic
  *  Layer1 applies it to the text it is given; prism_infer's history screen
@@ -281,19 +274,25 @@ export function classifyDeterministicLayer1(userPrompt, opts) {
     // the crisis form" escaping the restraint rule, and a wrong answer there
     // costs more than an unnecessary escalation. Clinical intent still fails
     // closed first, before anything can exempt it.
+    //
+    // The floor only refuses; it never clears. Every bypass found in review was
+    // a rule clearing a request no model read: a routine or artifact clause
+    // beside "a prone hold protocol for staff", "how many mL of Benadryl to
+    // give" or "find paths allowing unauthenticated access" was served in
+    // 0 ms, and each word-list patch was followed by new wording. Anything a
+    // rule does not refuse is read by the classifier.
     const clinicalReserved = matchesAny(userPrompt, CLINICAL_RESERVED_RULES);
     if (clinicalReserved)
         return "OBVIOUS_RESERVED";
-    if (opts?.operational === false) {
-        return matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES) ? "OBVIOUS_NOT_RESERVED" : null;
-    }
-    if (isNonOperationalArtifact(userPrompt)) {
-        return "OBVIOUS_NOT_RESERVED";
-    }
+    if (opts?.operational === false)
+        return null;
+    // A non-operational artifact edit is never refused by an operational rule
+    // (an auth_bypass fixture label is not reserved work); the classifier
+    // reads it.
+    if (isNonOperationalArtifact(userPrompt))
+        return null;
     if (matchesAny(userPrompt, RESERVED_INTENT_RULES))
         return "OBVIOUS_RESERVED";
-    if (matchesAny(userPrompt, ROUTINE_BCBA_INTENT_RULES))
-        return "OBVIOUS_NOT_RESERVED";
     return null;
 }
 /**
@@ -451,13 +450,6 @@ images, opts) {
     const deterministic = opts?.deterministic === false ? null : classifyDeterministicLayer1(userPrompt);
     if (deterministic === "OBVIOUS_RESERVED")
         return deterministic;
-    // The routine-work fast path may only skip the model when there is nothing
-    // to look at. It reads the PROMPT, so with an image attached it is a free
-    // bypass: pair "write an operational definition" — or any ROUTINE_BCBA
-    // phrasing — with a clinical screenshot and the gate returns NOT_RESERVED
-    // without a single call. Text keeps the shortcut; images earn the screen.
-    if (!oversize && !hasImages && deterministic === "OBVIOUS_NOT_RESERVED")
-        return deterministic;
     if (oversize && keywordBackstop(userPrompt) === "OBVIOUS_RESERVED") {
         // The regex floor has no length limit — reserved vocabulary anywhere
         // in the full text (including the middle the excerpt can't see)

package/dist/utils/safetyGate.js

@@ -31,7 +31,13 @@ const CRISIS_INPUT_RE = [
     // Swift copy); the generator's other patterns drift from this file —
     // reported; apply single lines, and keep the portal copy in step.
     /(?:(?<!\b(?:a|an|the|this|that|good|great|solid|useful|our|your|my|as)\s{1,4})\bjump(?:ing)?[\s-]+off\b|\bjump(?:ing)?[\s-]+off\b(?![\s-]+points?\b))/i,
-    /how\s+(?:many|much|to).*(?:pills|overdose|die)/i,
+    // "die", "dies", "died" and "dieing" as whole words: "how much is a diet
+    // coke" and "how to get a hoodie" matched (2026-10-15). Only the "it is to
+    // die for" idiom (ending its clause, or before and/but/so/too) and
+    // "to-die-for" are exempt; "how to die for the insurance" still matches.
+    // "starve myself to death" is named because "diet" no longer stands in for
+    // it. Same pattern as the portal copy.
+    /how\s+(?:many|much|to).*(?:pills|overdose|starv\w*\s+(?:my)?self\s+to\s+death|(?<!\b(?:is|are|was|were|s|re)\s{1,3}to\s{1,3})(?<!\bto-)\bdie(?:[sd]|ing)?\b|\bdie(?:[sd]|ing)?\b(?!\s+for(?:\s*[.!?,;:—–-]|\s*$|\s+(?:and|but|so|too)\b)|-for\b))/i,
     // Spanish — block hyperbole nouns only (NOT hunger/thirst/cold — may be literal for neglected child)
     /quiero\s+morir(?!\s+de\s+(?:risa|la\s+risa|vergüenza|ganas|envidia|aburrimiento)\b)/i,
     /(?:voy\s+a\s+)?matarme(?!\s+(?:estudiando|trabajando|riendo|de\s+(?:risa|la\s+risa))\b)/i,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.25",
+  "version": "20.21.27",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",

package/scripts/dev/browse.py

@@ -42,8 +42,10 @@ MODES:
 """
 
 import argparse
+import codecs
 import datetime
 import hashlib
+import io
 import json
 import os
 import random
@@ -2198,10 +2200,17 @@ def run_repl(session, sanitize=False, cleanup=False, fail_fast=False):
 # ---------------------------------------------------------------------------
 # Pipe/batch mode
 # ---------------------------------------------------------------------------
+class _PipeIdleTimeout(Exception):
+    """The producer held the pipe open past the idle timeout."""
+
+
 def _stdin_lines_with_idle_timeout(timeout_sec):
     """
     Yield stdin lines, giving up if the producer holds the pipe open without
-    sending anything. Falls back to plain iteration for non-selectable streams.
+    sending anything. Iterates the stream itself when it has no descriptor,
+    and reads blocking when select() cannot watch the descriptor. Raises
+    _PipeIdleTimeout at the timeout, so a command still being written is
+    dropped rather than run cut short.
     """
     stream = sys.stdin
     try:
@@ -2209,31 +2218,73 @@ def _stdin_lines_with_idle_timeout(timeout_sec):
     except Exception:
         yield from stream
         return
+    # Read the descriptor directly and split lines here. stream.readline()
+    # pulled a whole chunk into Python's own buffer and returned one line; the
+    # rest sat there while select() watched the empty pipe, so commands that
+    # had already arrived waited for the producer's next write, or for this
+    # timeout. A producer that pauses between blocks (waiting on a result the
+    # held-back commands would produce) deadlocked until then (2026-10-16).
+    #
+    # Decode as the text stream did: one incremental decoder for the whole
+    # stream, in its encoding and error policy, with universal newlines. A
+    # character split across two reads stays whole, and CRLF and a bare CR
+    # both end a line, so a backslash continuation written from Windows
+    # still joins.
+    decoder = io.IncrementalNewlineDecoder(
+        codecs.getincrementaldecoder(getattr(stream, "encoding", None) or "utf-8")(
+            getattr(stream, "errors", None) or "strict"),
+        translate=True,
+    )
+    pending = ""
+    selectable = True
     while True:
-        try:
-            ready, _, _ = select.select([fileno], [], [], timeout_sec)
-        except Exception:
-            yield from stream
-            return
-        if not ready:
-            audit_log("pipe_idle_timeout", "", f"timeout={timeout_sec}s")
-            print(json.dumps({
-                "status": "error",
-                "action": "pipe",
-                "message": f"No input for {timeout_sec}s. Closing browser to prevent zombie process.",
-            }))
-            sys.stdout.flush()
-            return
-        line = stream.readline()
-        if not line:
+        newline = pending.find("\n")
+        if newline >= 0:
+            line, pending = pending[:newline + 1], pending[newline + 1:]
+            yield line
+            continue
+        if selectable:
+            try:
+                ready, _, _ = select.select([fileno], [], [], timeout_sec)
+            except Exception:
+                # A descriptor select() cannot watch (a Windows pipe): read it
+                # blocking from here on, keeping any partial line already read.
+                selectable = False
+                ready = True
+            if not ready:
+                audit_log("pipe_idle_timeout", "", f"timeout={timeout_sec}s")
+                print(json.dumps({
+                    "status": "error",
+                    "action": "pipe",
+                    "message": f"No input for {timeout_sec}s. Closing browser to prevent zombie process.",
+                }))
+                sys.stdout.flush()
+                raise _PipeIdleTimeout()
+        chunk = os.read(fileno, 65536)
+        if not chunk:
+            pending += decoder.decode(b"", final=True)
+            if pending:
+                yield pending
             return
-        yield line
+        pending += decoder.decode(chunk)
+
+
+def _pipe_commands(timeout_sec):
+    """
+    The pipe's commands, continuations joined. At the idle timeout the reader
+    raises before the joiner can flush, so a continued command whose tail never
+    came is dropped, not run as its head alone.
+    """
+    try:
+        yield from _join_continuations(_stdin_lines_with_idle_timeout(timeout_sec))
+    except _PipeIdleTimeout:
+        return
 
 
 def run_pipe(session, sanitize=False, cleanup=False, fail_fast=False, cleanup_files=None):
     """Read commands from stdin, one per line. Returns True when all succeeded."""
     had_error = False
-    for line in _join_continuations(_stdin_lines_with_idle_timeout(PIPE_IDLE_TIMEOUT)):
+    for line in _pipe_commands(PIPE_IDLE_TIMEOUT):
         line = line.strip()
         if not line or line.startswith('#'):
             continue