prism-mcp-server 20.21.4 → 20.21.6

package/dist/connect.js

@@ -591,7 +591,13 @@ function serializeClaudeStartupBlock(newline) {
     ].join(newline);
 }
 /** Install or refresh Claude Code's native, hook-free first-turn instruction. */
-export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit) {
+export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit, 
+/** Refresh an existing managed block and nothing else. With this set the
+ *  install branch is unreachable, so a caller that did not receive the
+ *  operator's consent (the unattended startup refresh) cannot create a
+ *  block — not through a marker that only appears in prose, and not through
+ *  a marker removed between a caller's check and this read. */
+refreshOnly = false) {
     const instructionPath = join(homeDir, ".claude", "CLAUDE.md");
     let writePath = instructionPath;
     let symlinkPath;
@@ -613,6 +619,11 @@ export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false
     const newline = currentText.includes("\r\n") ? "\r\n" : "\n";
     const startRanges = findExactLineRanges(currentText, CLAUDE_STARTUP_MANAGED_START);
     const endRanges = findExactLineRanges(currentText, CLAUDE_STARTUP_MANAGED_END);
+    // Not ours: no opening marker at all. Under refreshOnly that is the ordinary
+    // case (a host the operator never connected), not an ambiguity to shout about.
+    if (refreshOnly && startRanges.length === 0) {
+        return { path: instructionPath, status: "unmanaged" };
+    }
     if (startRanges.length !== endRanges.length || startRanges.length > 1) {
         throw new Error(`Claude instructions contain ambiguous Prism startup ownership markers: ${instructionPath}`);
     }
@@ -631,6 +642,8 @@ export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false
         action = "refresh";
     }
     else {
+        if (refreshOnly)
+            return { path: instructionPath, status: "unmanaged" };
         const separator = currentText.length === 0
             ? ""
             : currentText.endsWith("\n") || currentText.endsWith("\r")
@@ -688,7 +701,9 @@ function legacyGeminiStartupBlock(newline) {
     ].join(newline);
 }
 /** Install or refresh Gemini CLI's native, hook-free first-turn instruction. */
-export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit) {
+export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit, 
+/** See configureClaudeNativeStartup. */
+refreshOnly = false) {
     const instructionPath = join(homeDir, ".gemini", "GEMINI.md");
     let writePath = instructionPath;
     let symlinkPath;
@@ -710,6 +725,11 @@ export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false
     const newline = currentText.includes("\r\n") ? "\r\n" : "\n";
     const startRanges = findExactLineRanges(currentText, GEMINI_STARTUP_MANAGED_START);
     const endRanges = findExactLineRanges(currentText, GEMINI_STARTUP_MANAGED_END);
+    // Not ours: no opening marker at all. Under refreshOnly that is the ordinary
+    // case (a host the operator never connected), not an ambiguity to shout about.
+    if (refreshOnly && startRanges.length === 0) {
+        return { path: instructionPath, status: "unmanaged" };
+    }
     if (startRanges.length !== endRanges.length || startRanges.length > 1) {
         throw new Error(`Gemini instructions contain ambiguous Prism startup ownership markers: ${instructionPath}`);
     }
@@ -728,6 +748,8 @@ export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false
         action = "refresh";
     }
     else {
+        if (refreshOnly)
+            return { path: instructionPath, status: "unmanaged" };
         const legacyBlock = legacyGeminiStartupBlock(newline);
         if (currentText.startsWith(legacyBlock)) {
             nextText = managedBlock + newline + currentText.slice(legacyBlock.length);
@@ -757,7 +779,9 @@ function serializeCodexStartupBlock(newline) {
     ].join(newline);
 }
 /** Install or refresh Codex's official global, hook-free first-turn instruction. */
-export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommit, env = homeDir === undefined ? process.env : {}) {
+export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommit, env = homeDir === undefined ? process.env : {}, 
+/** See configureClaudeNativeStartup. */
+refreshOnly = false) {
     const userHome = homeDir ?? homedir();
     const configuredCodexHome = env.CODEX_HOME?.trim();
     const codexHome = configuredCodexHome ? resolve(configuredCodexHome) : join(userHome, ".codex");
@@ -782,6 +806,11 @@ export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommi
     const newline = currentText.includes("\r\n") ? "\r\n" : "\n";
     const startRanges = findExactLineRanges(currentText, CODEX_STARTUP_MANAGED_START);
     const endRanges = findExactLineRanges(currentText, CODEX_STARTUP_MANAGED_END);
+    // Not ours: no opening marker at all. Under refreshOnly that is the ordinary
+    // case (a host the operator never connected), not an ambiguity to shout about.
+    if (refreshOnly && startRanges.length === 0) {
+        return { path: instructionPath, status: "unmanaged" };
+    }
     if (startRanges.length !== endRanges.length || startRanges.length > 1) {
         throw new Error(`Codex instructions contain ambiguous Prism startup ownership markers: ${instructionPath}`);
     }
@@ -800,6 +829,8 @@ export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommi
         action = "refresh";
     }
     else {
+        if (refreshOnly)
+            return { path: instructionPath, status: "unmanaged" };
         const separator = currentText.length === 0
             ? ""
             : currentText.endsWith("\n") || currentText.endsWith("\r")
@@ -844,7 +875,128 @@ function configureJsonAgentPolicy(configPath, label, mutate, dryRun, beforeCommi
     writeTextAtomically(writePath, `${JSON.stringify(config, null, 2)}\n`, originalText, beforeCommit, symlinkPath);
     return { path: configPath, status: action === "install" ? "installed" : "refreshed" };
 }
-/** Configure Claude Code's economy fallback model; policy text prevents routine fan-out. */
+/** Rewrite a managed startup block whose content differs from what THIS binary
+ *  writes, and nothing else. Not "older": there is no version ordering in the
+ *  block, so a pinned older install can rewrite what a newer one wrote.
+ *
+ *  The instruction files are the one delivery channel that does not travel with
+ *  the package: the MCP `initialize` instructions and every tool description
+ *  update the moment the server binary does, but a native instruction file keeps
+ *  whatever text `prism connect` last wrote. Released 20.21.0 changed that text —
+ *  it used to tell hosts to pass `cloud_fallback: false`, which made a paid
+ *  plan's escalation unreachable — and a machine that never re-runs connect keeps
+ *  telling its host the retracted thing. `prism update` deliberately never
+ *  touches host configuration, autoupdate runs `update`, and npm's ignore-scripts
+ *  blocks the postinstall refresh, so on an ordinary machine nothing heals it.
+ *
+ *  This is the narrow, safe subset of connect, and the narrowness is the point:
+ *
+ *  - MARKER-GATED. A file without the ownership marker is left byte-for-byte
+ *    alone. Connect is still the only thing that can FIRST install a block;
+ *    consent is never inferred from a server start.
+ *  - Startup blocks ONLY. It never touches MCP host registration — that is what
+ *    connect's "close target hosts before registration" warning is about, since
+ *    a live host rewrites its own config. These files DO have another writer —
+ *    Gemini CLI writes GEMINI.md on a remember request, Claude Code writes
+ *    CLAUDE.md on /init — so only the marker-delimited block is replaced,
+ *    marker lines included, and the file is re-checked immediately before
+ *    committing; a write landing inside that final window would still be
+ *    lost.
+ *  - Content-addressed, so it is a no-op once current: the block is compared
+ *    byte-for-byte and only a difference writes.
+ *
+ *  The host reads its instruction file when a session starts, so a refresh made
+ *  during this session lands on the NEXT one. That is the cost of healing
+ *  without asking, and it is one session. */
+export function refreshManagedStartupBlocks(options = {}) {
+    const homeDir = options.homeDir ?? homedir();
+    const env = options.env ?? process.env;
+    // The opt-out lives here, next to the writing, so it is one decision and a
+    // test can exercise it without starting a server.
+    if (env.PRISM_NO_STARTUP_REFRESH === "1")
+        return [];
+    const dryRun = !!options.dryRun;
+    const codexHome = env.CODEX_HOME?.trim() ? resolve(env.CODEX_HOME.trim()) : join(homeDir, ".codex");
+    const targets = [
+        { host: "claude-code", path: join(homeDir, ".claude", "CLAUDE.md"), configure: () => configureClaudeNativeStartup(homeDir, dryRun, undefined, true) },
+        { host: "gemini", path: join(homeDir, ".gemini", "GEMINI.md"), configure: () => configureGeminiNativeStartup(homeDir, dryRun, undefined, true) },
+        { host: "codex", path: join(codexHome, "AGENTS.md"), configure: () => configureCodexNativeStartup(homeDir, dryRun, undefined, env, true) },
+    ];
+    const results = [];
+    // Two hosts can resolve to ONE file — GEMINI.md symlinked to CLAUDE.md is a
+    // common single-file setup — and Claude and Gemini serialize the SAME
+    // ownership marker, so without this each start rewrote that file twice and
+    // never converged: two "refreshed" lines on every start, forever. Whoever
+    // gets there first owns it; the second reports it as already handled.
+    // Identity is the FILE, not the path: statSync follows symlinks, and dev:ino
+    // is shared by hard links too, which a path comparison misses entirely (an
+    // atomic replace would then break the link and hand both hosts a "refreshed"
+    // they should never have got). Resolved ONCE per target and reused, so the
+    // decision below is the one that was actually measured; a target retargeted
+    // after this point is the same inherent window as the compare-to-rename one
+    // documented on writeTextAtomically.
+    const identityOf = (path) => {
+        try {
+            const info = statSync(path);
+            return `${info.dev}:${info.ino}`;
+        }
+        catch {
+            return `path:${path}`; // absent or unreadable: the path itself is identity enough
+        }
+    };
+    const resolved = targets.map(target => ({ target, identity: identityOf(target.path) }));
+    const shared = new Map();
+    for (const { target, identity } of resolved) {
+        shared.set(identity, [...(shared.get(identity) ?? []), target.host]);
+    }
+    for (const { target, identity } of resolved) {
+        const sharing = shared.get(identity) ?? [target.host];
+        if (sharing.length > 1) {
+            // One file, two hosts. Claude and Gemini serialize the SAME ownership
+            // marker but DIFFERENT instructions (the tool is named differently for
+            // each), so there is no content that satisfies both: healing it would
+            // hand one host the other's block, and before this check each start
+            // rewrote the file once per host, forever. Whose block it should be is
+            // the operator's call, not a background process's.
+            results.push({
+                host: target.host,
+                path: target.path,
+                status: "failed",
+                detail: `shared with ${sharing.filter(h => h !== target.host).join(", ")} (one file cannot hold both blocks); run: prism connect`,
+            });
+            continue;
+        }
+        try {
+            // No independent pre-read. The configurator's own exact-line marker
+            // recognition decides, from ONE snapshot: a second, weaker check here
+            // (a substring scan) would call a file managed because the marker
+            // appears in its prose, and the window between two reads is a way to
+            // lose the marker after the check. With refreshOnly the install branch
+            // is unreachable either way.
+            const outcome = target.configure();
+            results.push({
+                host: target.host,
+                path: outcome.path,
+                // A dry run must not claim a write it did not make: would-refresh is
+                // carried through as itself. installed/would-install are unreachable
+                // under refreshOnly, so anything else is a completed refresh.
+                status: outcome.status === "unchanged" || outcome.status === "unmanaged" || outcome.status === "would-refresh"
+                    ? outcome.status
+                    : "refreshed",
+            });
+        }
+        catch (error) {
+            // A self-heal must never be the reason a server fails to start.
+            results.push({
+                host: target.host,
+                path: target.path,
+                status: "failed",
+                detail: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return results;
+}
 export function configureClaudeAgentPolicy(homeDir = homedir(), dryRun = false, beforeCommit) {
     const configPath = join(homeDir, ".claude", "settings.json");
     return configureJsonAgentPolicy(configPath, "Claude agent settings", (config) => {

package/dist/server.js

@@ -1307,6 +1307,66 @@ export async function startServer() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error(`[Prism] MCP Server successfully started and listening on stdio...`);
+    // Heal a startup block whose content differs from what this binary writes.
+    // (Not "older": nothing orders versions, so a pinned older install can
+    // rewrite what a newer one wrote.) The instruction files are the
+    // one channel that does not travel with the package — `initialize`
+    // instructions and every tool description update with the binary, a native
+    // instruction file keeps whatever connect last wrote — and nothing on an
+    // ordinary machine re-runs connect: `prism update` never touches host
+    // configuration by design, autoupdate runs `update`, and the postinstall
+    // path covers only the prompt-routing hook and is routinely disabled by
+    // npm's ignore-scripts. 20.21.0 is the release that
+    // proved the cost: the old text told hosts to pass `cloud_fallback: false`,
+    // which made a paid plan's escalation unreachable.
+    //
+    // Refresh-only, so this can only ever rewrite a block the operator already
+    // consented to by running connect once: the install branch is unreachable
+    // from here, and a file without exactly one ordered marker pair is left
+    // byte-for-byte alone. Startup blocks only — never MCP registration, which
+    // is what connect's "close your hosts first" warning is about. These files
+    // do have another writer (Gemini CLI writes GEMINI.md on a remember
+    // request, Claude Code writes CLAUDE.md on /init), so the refresh replaces
+    // only its own marker-delimited block, marker lines included, and re-checks
+    // immediately before committing. After the transport is connected, so the handshake is never
+    // held behind disk I/O. PRISM_NO_STARTUP_REFRESH=1 opts out.
+    //
+    // DEFERRED, and unref'd, for two reasons. `connect.js` is a large module
+    // (the whole CLI surface, TOML parser included) and importing it is
+    // synchronous CPU work: awaited here it competes with the FIRST tool call,
+    // which on a cold host is the one that has to do a storage round trip. And
+    // an unref'd timer can never hold the process open. The block is read by the
+    // host at session start, so it was always landing on the next session — a
+    // couple of seconds changes nothing about when the fix arrives.
+    if (process.env.PRISM_NO_STARTUP_REFRESH !== "1") {
+        setTimeout(() => { void refreshStartupBlocksInBackground(); }, 2_000).unref();
+    }
+    await resumeServerStartup(server);
+}
+async function refreshStartupBlocksInBackground() {
+    try {
+        const { refreshManagedStartupBlocks } = await import("./connect.js");
+        for (const result of refreshManagedStartupBlocks()) {
+            if (result.status === "refreshed") {
+                // The host read this file when the session began, so the corrected
+                // text applies from the next one.
+                console.error(`[Prism] refreshed the ${result.host} startup block to match this version: ${result.path} (applies from your next session)`);
+            }
+            else if (result.status === "failed") {
+                console.error(`[Prism] could not refresh the ${result.host} startup block (${result.detail}); run: prism connect`);
+            }
+            else if (process.env.PRISM_DEBUG) {
+                console.error(`[Prism] startup block ${result.host}: ${result.status}${result.detail ? ` (${result.detail})` : ""}`);
+            }
+        }
+    }
+    catch (error) {
+        // Never the reason a server fails to start.
+        if (process.env.PRISM_DEBUG)
+            console.error(`[Prism] startup refresh skipped: ${error instanceof Error ? error.message : error}`);
+    }
+}
+async function resumeServerStartup(server) {
     // Start the authoritative tier-skill refresh only after the MCP transport is
     // connected. session_load_context awaits this same single-flight promise,
     // while the initialize handshake is never held behind portal I/O. The

package/dist/utils/codingQualityPolicy.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 const IMPLEMENTATION_REQUEST_RE = /\b(?:implement|write|create|generate|complete|finish|fix)\b[\s\S]{0,160}\b(?:code|source|function|method|class|interface|struct|enum|implementation|algorithm|component|endpoint)\b/i;
 const STRICT_SOURCE_REQUEST_RE = /\b(?:return|output|respond with)\s+only\s+(?:the\s+)?(?:implementation\s+)?(?:source\s+)?code\b/i;
 const CODE_SHAPE_RE = /(?:^|\n)\s*(?:(?:export|public|private|protected|internal|open|pub|static|final|abstract|async)\s+)*(?:class|interface|struct|enum|function|def|func|fun|fn|type)\s+[A-Za-z_$][\w$]*|(?:^|\n)\s*(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=|(?:^|\n)\s*(?:[A-Za-z_$][\w$:<>,.?*[\]&]*\s+)+[A-Za-z_$][\w$]*\s*\([^;\n]*\)\s*(?:const\s*)?(?:noexcept\s*)?(?:\{|=>)|=>\s*[{(]/m;
+import { analyzeTypeScript } from "./typescriptDiagnostics.js";
 export const INCOMPLETE_IMPLEMENTATION_PATTERNS = [
     {
         reason: "code_placeholder",
@@ -46,6 +47,8 @@ const PYTHON_AST_SCRIPT = `import ast,sys; print('${PYTHON_READY_SENTINEL}', flu
     "tree=ast.parse(sys.stdin.read()); compile(tree, '<prism-coding-gate>', 'exec')";
 const PYTHON_COMMANDS = ["python3", "python"];
 const PYTHON_CHILDREN_KEYS_UNPACK_RE = /\bfor\s+[A-Za-z_]\w*\s*,\s*child(?:_node)?\s+in\s+(?:sorted\(\s*)?[A-Za-z_][\w.]*\.children\.keys\(\)\s*\)?\s*:/;
+/** Enough of a type-annotation or declaration signal to call a block TypeScript. */
+const TS_SIGNAL_RE = /:\s*(?:string|number|boolean|void|any|unknown|never|Promise<)\b|\binterface\s+[A-Z]|\bexport\s+(?:class|interface|type|abstract)\b|\b(?:private|public|protected|readonly)\s+\w+\s*[:=]|<[A-Z]\w*(?:\s*,\s*[A-Z]\w*)*>/;
 function extractUnfencedPythonCode(output) {
     const lines = output.trim().split(/\r?\n/);
     const start = lines.findIndex((line) => UNFENCED_PYTHON_START_RE.test(line));
@@ -75,9 +78,11 @@ function extractCode(output) {
     })).filter((block) => block.code.length > 0);
     if (blocks.length === 0) {
         const python = extractUnfencedPythonCode(output);
+        const bare = output.trim();
         return {
-            all: output.trim(),
+            all: bare,
             ...(python ? { python } : {}),
+            ...(!python && TS_SIGNAL_RE.test(bare) ? { typescript: bare } : {}),
             hasFences: false,
         };
     }
@@ -86,11 +91,18 @@ function extractCode(output) {
         block.language === "py" ||
         (!block.language && PYTHON_SIGNAL_RE.test(block.code))))
         .map((block) => block.code);
+    const tsBlocks = blocks
+        .filter((block) => (block.language === "typescript" ||
+        block.language === "ts" ||
+        block.language === "tsx" ||
+        (!block.language && TS_SIGNAL_RE.test(block.code))))
+        .map((block) => block.code);
     return {
         all: blocks.map((block) => block.code).join("\n\n"),
         ...(pythonBlocks.length > 0
             ? { python: pythonBlocks.join("\n\n") }
             : {}),
+        ...(tsBlocks.length > 0 ? { typescript: tsBlocks.join("\n\n") } : {}),
         hasFences: true,
     };
 }
@@ -460,9 +472,18 @@ export function passesCodingQualityGate(prompt, output) {
         if (pythonFailure)
             return { pass: false, reason: pythonFailure };
     }
+    // The regex floor runs first: it is the one finding with a deterministic
+    // repair, and it works even if the compiler cannot be loaded.
     const tsFailure = tsStaticContractFailure(code);
     if (tsFailure)
         return { pass: false, reason: tsFailure };
+    // Then the compiler, over TypeScript blocks only.
+    if (extracted.typescript) {
+        const findings = analyzeTypeScript(extracted.typescript, extracted.hasFences);
+        if (findings.length > 0) {
+            return { pass: false, reason: `ts_static_contract:${findings.join(",")}` };
+        }
+    }
     return { pass: true };
 }
 const CODING_REPAIR_SYSTEM_INSTRUCTION = "Repair the supplied implementation. Return one complete replacement implementation with no prose, " +
@@ -477,6 +498,11 @@ const CODING_REPAIR_GUIDANCE = {
     python_method_missing_receiver: "Instance methods must take self first; class methods must take cls first unless decorated staticmethod.",
     python_undefined_private_helper: "Define every directly called private self helper or replace the call with the correct defined helper.",
     constructor_attribute_missing_receiver: "In __init__, persist instance state as self.<attribute>; do not assign it to a discarded local variable.",
+    syntax_error: "The code does not parse. Balance every brace, bracket and parenthesis, and finish every statement.",
+    optional_chain_assignment: "Optional chaining cannot appear on the left of an assignment. Guard with an if, or assert the value is present, before assigning to the property.",
+    type_not_assignable: "Make the returned value match the declared return type, or widen the declaration to what the implementation actually produces.",
+    implicit_any_param: "Annotate every parameter; under strict mode an inferred any is an error.",
+    deferred_mutation_returned_sync: "A value mutated inside a then/catch/setTimeout callback is returned before that callback runs. Await the work, or return a Promise that resolves after it.",
     bare_generic: "Every generic needs its type argument: write Array<T>, Map<K, V>, Set<T>, Promise<T> — never a bare Array, Map, Set or Promise in a type position.",
     dict_keys_unpack: "When unpacking key and value, iterate dictionary .items(); .keys() yields one key per iteration.",
 };

package/dist/utils/typescriptDiagnostics.js

@@ -0,0 +1,248 @@
+/**
+ * Real type checking for generated TypeScript, plus one AST rule a type checker
+ * cannot express.
+ *
+ * The regex gate that shipped in 20.21.4 catches exactly one defect class
+ * (TS2314, a generic with no type argument). The very next sample defeated it:
+ * a doubly-linked-list splice written as `node.next?.prev = this.head`, which is
+ * TS2779 and does not compile. Extending the regex per error code is an arms
+ * race the compiler already wins.
+ *
+ * WHY THIS IS NOT JUST `tsc`. A generated snippet has no tsconfig, no resolved
+ * imports, and no way to declare whether it targets the DOM or Node. Checking a
+ * fragment therefore produces errors about the HARNESS rather than the code.
+ * Measured while building this: checking one LRU cache against the DOM lib made
+ * the snippet's own `Node` class collide with the DOM's, producing twelve
+ * phantom errors beside the two real ones. A gate that fails correct code gets
+ * switched off, so the design is an ALLOWLIST: a diagnostic is reported only if
+ * its code appears in ALLOWED_CODES. That, and nothing else, is what prevents a
+ * context failure from being reported as a defect.
+ *
+ * Two things that look load-bearing and are not — established by mutation, and
+ * recorded so nobody trusts them for safety:
+ *
+ *   IGNORED_CODES does NOT filter anything. It marks codes already triaged as
+ *   context failures, so the debug log can flag genuinely unclassified ones.
+ *   Emptying it changes no reported finding.
+ *
+ *   The narrow default library (`lib.es2022.d.ts`, no DOM) is defence in depth,
+ *   not protection. It was chosen after the DOM lib made a snippet's own `Node`
+ *   class collide with the DOM's and produce twelve extra diagnostics — but all
+ *   twelve were outside the allowlist, so none would have been reported anyway.
+ *   No constructed case makes the library choice change a reported finding. It
+ *   is kept because less noise and less work are both worth having.
+ */
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
+import { debugLog } from "./logger.js";
+/** Semantic diagnostics that indict the SNIPPET. Each observed on real output. */
+const ALLOWED_CODES = new Map([
+    [2314, "bare_generic"], // Map<string, Array>
+    [2779, "optional_chain_assignment"], // node.next?.prev = x
+    [2322, "type_not_assignable"], // Promise<PromiseSettledResult[]> as Promise<void>
+    [7006, "implicit_any_param"], // (listener) => ... under strict — CONDITIONAL, see below
+]);
+/**
+ * An implicit `any` only indicts the snippet once everything else resolved.
+ *
+ * `app.get("/", (req, res) => ...)` is correct Express, and `req` is implicitly
+ * any ONLY because a fragment cannot resolve `express`. Reporting that blames
+ * the harness. So TS7006 is suppressed whenever a module or name failed to
+ * resolve — found by attacking the allowlist rather than by review.
+ */
+const CONDITIONAL_ON_RESOLUTION = 7006;
+const RESOLUTION_FAILURE_CODES = new Set([2304, 2307, 2792, 2583]);
+/**
+ * Codes already triaged as context failures rather than defects.
+ *
+ * NOT a filter — the allowlist above is what decides what is reported. This
+ * exists so the debug log can distinguish "known to be noise" from "never seen
+ * before", which is how the allowlist gets extended from evidence.
+ *
+ * 2304/2583/2584 unresolved name, 2307 unresolved module, 2300 duplicate
+ * identifier, 2315/2554 a snippet type shadowed by a lib type (the `Node`
+ * collision), 6053 a lib file we did not serve, 2686/2695 UMD and expression
+ * complaints that only make sense inside a real project.
+ */
+const IGNORED_CODES = new Set([2300, 2304, 2307, 2315, 2554, 2583, 2584, 2686, 2695, 2792, 6053]);
+let tsModule;
+/** Loaded once, synchronously, so the quality gate stays synchronous. */
+function loadTypeScript() {
+    if (tsModule !== undefined)
+        return tsModule;
+    try {
+        tsModule = createRequire(import.meta.url)("typescript");
+    }
+    catch (e) {
+        // A declared dependency, so this means a broken install. The regex floor
+        // in codingQualityPolicy still runs; this enhancement simply does not.
+        debugLog(`[ts-diagnostics] typescript unavailable: ${e instanceof Error ? e.message : e}`);
+        tsModule = null;
+    }
+    return tsModule;
+}
+const libCache = new Map();
+function readLib(libDir, file) {
+    if (!libCache.has(file)) {
+        try {
+            libCache.set(file, readFileSync(join(libDir, file), "utf8"));
+        }
+        catch {
+            libCache.set(file, undefined);
+        }
+    }
+    return libCache.get(file);
+}
+/**
+ * Allowed findings only, de-duplicated, stable order. Empty when unavailable.
+ *
+ * `fenced` says the text was inside a ``` block, i.e. the model MEANT it as
+ * code. Only then is a parse failure attributable to the snippet. Unfenced
+ * output is ambiguous: "the function takes a value: string and returns a
+ * formatted result" is a sentence, and reporting it as a syntax error rejects a
+ * correct answer. Ambiguity favours the caller.
+ */
+export function typecheckSnippet(code, fenced = true) {
+    const ts = loadTypeScript();
+    if (!ts)
+        return [];
+    const libDir = dirname(createRequire(import.meta.url).resolve("typescript"));
+    const name = "snippet.ts";
+    const sourceOf = (file) => file === name ? code : readLib(libDir, file);
+    const host = {
+        getSourceFile: (file) => {
+            const text = sourceOf(file);
+            return text === undefined
+                ? undefined
+                : ts.createSourceFile(file, text, ts.ScriptTarget.ES2022, true);
+        },
+        getDefaultLibFileName: () => "lib.es2022.d.ts",
+        writeFile: () => { },
+        getCurrentDirectory: () => "/",
+        getCanonicalFileName: (file) => file,
+        useCaseSensitiveFileNames: () => true,
+        getNewLine: () => "\n",
+        fileExists: (file) => sourceOf(file) !== undefined,
+        readFile: sourceOf,
+    };
+    let syntactic;
+    let semantic;
+    try {
+        const program = ts.createProgram([name], {
+            strict: true,
+            target: ts.ScriptTarget.ES2022,
+            noEmit: true,
+            types: [],
+            skipLibCheck: true,
+        }, host);
+        syntactic = program.getSyntacticDiagnostics();
+        semantic = program.getSemanticDiagnostics();
+    }
+    catch (e) {
+        debugLog(`[ts-diagnostics] check failed: ${e instanceof Error ? e.message : e}`);
+        return [];
+    }
+    // A parse failure needs no allowlist. Nothing about a missing library or an
+    // unresolved import can make a brace go missing, so a syntactic diagnostic
+    // always indicts the snippet. And once the file does not parse, the semantic
+    // results describe a tree that was never valid, so they are not consulted.
+    if (syntactic.length > 0)
+        return fenced ? ["syntax_error"] : [];
+    const unresolved = semantic.some(d => RESOLUTION_FAILURE_CODES.has(d.code));
+    const found = new Set();
+    for (const d of semantic) {
+        if (d.code === CONDITIONAL_ON_RESOLUTION && unresolved)
+            continue;
+        const name_ = ALLOWED_CODES.get(d.code);
+        if (name_)
+            found.add(name_);
+        else if (!IGNORED_CODES.has(d.code)) {
+            // Neither indicted nor excused. Logged so the lists can be extended
+            // from evidence rather than guessed at; never reported as a finding,
+            // because an unclassified code is exactly the kind that turns out to
+            // be about the harness.
+            debugLog(`[ts-diagnostics] unclassified TS${d.code}`);
+        }
+    }
+    return [...found].sort();
+}
+const DEFERRED_METHOD = /^(then|catch|finally)$/;
+const DEFERRED_FN = /^(setTimeout|setInterval|setImmediate|queueMicrotask)$/;
+/**
+ * A value mutated inside a promise or timer callback and then returned
+ * synchronously by the enclosing function.
+ *
+ * Valid TypeScript, and wrong: the callback runs in a later microtask, so the
+ * returned value never includes it. From the first multi-turn benchmark, where
+ * `emit()` incremented its counter inside `result.then(() => count++)` and
+ * returned 1 for three listeners. No type checker expresses this, but the AST
+ * is already loaded, so the rule is nearly free.
+ */
+export function findDeferredMutationReturnedSync(code) {
+    const ts = loadTypeScript();
+    if (!ts)
+        return [];
+    const sf = ts.createSourceFile("snippet.ts", code, ts.ScriptTarget.ES2022, true);
+    const hits = new Set();
+    const insideDeferredCallback = (node) => {
+        for (let p = node.parent; p; p = p.parent) {
+            if (ts.isCallExpression(p)) {
+                const callee = p.expression;
+                if (ts.isPropertyAccessExpression(callee) && DEFERRED_METHOD.test(callee.name.text))
+                    return true;
+                if (ts.isIdentifier(callee) && DEFERRED_FN.test(callee.text))
+                    return true;
+            }
+            // Stop at the enclosing function: a mutation in a sibling function
+            // says nothing about this one's return value.
+            if (ts.isFunctionDeclaration(p) || ts.isMethodDeclaration(p))
+                return false;
+        }
+        return false;
+    };
+    const inspect = (fn) => {
+        const mutatedLate = new Set();
+        const returned = new Set();
+        const visit = (n) => {
+            const target = (ts.isPostfixUnaryExpression(n) || ts.isPrefixUnaryExpression(n)) && ts.isIdentifier(n.operand)
+                ? n.operand.text
+                : ts.isBinaryExpression(n) && ts.isIdentifier(n.left) && [
+                    ts.SyntaxKind.EqualsToken,
+                    ts.SyntaxKind.PlusEqualsToken,
+                    ts.SyntaxKind.MinusEqualsToken,
+                ].includes(n.operatorToken.kind)
+                    ? n.left.text
+                    : null;
+            if (target && insideDeferredCallback(n))
+                mutatedLate.add(target);
+            if (ts.isReturnStatement(n) && n.expression && ts.isIdentifier(n.expression)) {
+                returned.add(n.expression.text);
+            }
+            // Do not descend into a NESTED named function or method: it has its
+            // own scope and its own `count`, and `scan` visits it separately.
+            // Without this, `inner`'s deferred mutation was credited to `outer`,
+            // flagging correct code. Arrow functions and anonymous function
+            // expressions ARE entered, because that is what a callback is.
+            if (ts.isFunctionDeclaration(n) || ts.isMethodDeclaration(n))
+                return;
+            ts.forEachChild(n, visit);
+        };
+        ts.forEachChild(fn, visit);
+        for (const v of mutatedLate)
+            if (returned.has(v))
+                hits.add(v);
+        return;
+    };
+    const scan = (n) => {
+        if (ts.isMethodDeclaration(n) || ts.isFunctionDeclaration(n) || ts.isFunctionExpression(n))
+            inspect(n);
+        ts.forEachChild(n, scan);
+    };
+    ts.forEachChild(sf, scan);
+    return hits.size ? ["deferred_mutation_returned_sync"] : [];
+}
+/** Every TypeScript finding for a snippet, type errors and the AST rule. */
+export function analyzeTypeScript(code, fenced = true) {
+    return [...typecheckSnippet(code, fenced), ...findDeferredMutationReturnedSync(code)].sort();
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.4",
+  "version": "20.21.6",
   "mcpName": "io.github.dcostenco/prism-coder",
-  "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
+  "description": "Persistent session memory for AI coding agents that never leaves your machine \u2014 including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
   "type": "module",
   "main": "dist/server.js",
@@ -114,6 +114,7 @@
     "stream-json": "^3.6.0",
     "tldts": "^7.0.27",
     "turndown": "^7.2.2",
+    "typescript": "^5.9.3",
     "zod": "^4.3.6"
   }
 }