prism-mcp-server 20.21.5 → 20.21.6

package/dist/connect.js

@@ -591,7 +591,13 @@ function serializeClaudeStartupBlock(newline) {
     ].join(newline);
 }
 /** Install or refresh Claude Code's native, hook-free first-turn instruction. */
-export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit) {
+export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit, 
+/** Refresh an existing managed block and nothing else. With this set the
+ *  install branch is unreachable, so a caller that did not receive the
+ *  operator's consent (the unattended startup refresh) cannot create a
+ *  block — not through a marker that only appears in prose, and not through
+ *  a marker removed between a caller's check and this read. */
+refreshOnly = false) {
     const instructionPath = join(homeDir, ".claude", "CLAUDE.md");
     let writePath = instructionPath;
     let symlinkPath;
@@ -613,6 +619,11 @@ export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false
     const newline = currentText.includes("\r\n") ? "\r\n" : "\n";
     const startRanges = findExactLineRanges(currentText, CLAUDE_STARTUP_MANAGED_START);
     const endRanges = findExactLineRanges(currentText, CLAUDE_STARTUP_MANAGED_END);
+    // Not ours: no opening marker at all. Under refreshOnly that is the ordinary
+    // case (a host the operator never connected), not an ambiguity to shout about.
+    if (refreshOnly && startRanges.length === 0) {
+        return { path: instructionPath, status: "unmanaged" };
+    }
     if (startRanges.length !== endRanges.length || startRanges.length > 1) {
         throw new Error(`Claude instructions contain ambiguous Prism startup ownership markers: ${instructionPath}`);
     }
@@ -631,6 +642,8 @@ export function configureClaudeNativeStartup(homeDir = homedir(), dryRun = false
         action = "refresh";
     }
     else {
+        if (refreshOnly)
+            return { path: instructionPath, status: "unmanaged" };
         const separator = currentText.length === 0
             ? ""
             : currentText.endsWith("\n") || currentText.endsWith("\r")
@@ -688,7 +701,9 @@ function legacyGeminiStartupBlock(newline) {
     ].join(newline);
 }
 /** Install or refresh Gemini CLI's native, hook-free first-turn instruction. */
-export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit) {
+export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false, beforeCommit, 
+/** See configureClaudeNativeStartup. */
+refreshOnly = false) {
     const instructionPath = join(homeDir, ".gemini", "GEMINI.md");
     let writePath = instructionPath;
     let symlinkPath;
@@ -710,6 +725,11 @@ export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false
     const newline = currentText.includes("\r\n") ? "\r\n" : "\n";
     const startRanges = findExactLineRanges(currentText, GEMINI_STARTUP_MANAGED_START);
     const endRanges = findExactLineRanges(currentText, GEMINI_STARTUP_MANAGED_END);
+    // Not ours: no opening marker at all. Under refreshOnly that is the ordinary
+    // case (a host the operator never connected), not an ambiguity to shout about.
+    if (refreshOnly && startRanges.length === 0) {
+        return { path: instructionPath, status: "unmanaged" };
+    }
     if (startRanges.length !== endRanges.length || startRanges.length > 1) {
         throw new Error(`Gemini instructions contain ambiguous Prism startup ownership markers: ${instructionPath}`);
     }
@@ -728,6 +748,8 @@ export function configureGeminiNativeStartup(homeDir = homedir(), dryRun = false
         action = "refresh";
     }
     else {
+        if (refreshOnly)
+            return { path: instructionPath, status: "unmanaged" };
         const legacyBlock = legacyGeminiStartupBlock(newline);
         if (currentText.startsWith(legacyBlock)) {
             nextText = managedBlock + newline + currentText.slice(legacyBlock.length);
@@ -757,7 +779,9 @@ function serializeCodexStartupBlock(newline) {
     ].join(newline);
 }
 /** Install or refresh Codex's official global, hook-free first-turn instruction. */
-export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommit, env = homeDir === undefined ? process.env : {}) {
+export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommit, env = homeDir === undefined ? process.env : {}, 
+/** See configureClaudeNativeStartup. */
+refreshOnly = false) {
     const userHome = homeDir ?? homedir();
     const configuredCodexHome = env.CODEX_HOME?.trim();
     const codexHome = configuredCodexHome ? resolve(configuredCodexHome) : join(userHome, ".codex");
@@ -782,6 +806,11 @@ export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommi
     const newline = currentText.includes("\r\n") ? "\r\n" : "\n";
     const startRanges = findExactLineRanges(currentText, CODEX_STARTUP_MANAGED_START);
     const endRanges = findExactLineRanges(currentText, CODEX_STARTUP_MANAGED_END);
+    // Not ours: no opening marker at all. Under refreshOnly that is the ordinary
+    // case (a host the operator never connected), not an ambiguity to shout about.
+    if (refreshOnly && startRanges.length === 0) {
+        return { path: instructionPath, status: "unmanaged" };
+    }
     if (startRanges.length !== endRanges.length || startRanges.length > 1) {
         throw new Error(`Codex instructions contain ambiguous Prism startup ownership markers: ${instructionPath}`);
     }
@@ -800,6 +829,8 @@ export function configureCodexNativeStartup(homeDir, dryRun = false, beforeCommi
         action = "refresh";
     }
     else {
+        if (refreshOnly)
+            return { path: instructionPath, status: "unmanaged" };
         const separator = currentText.length === 0
             ? ""
             : currentText.endsWith("\n") || currentText.endsWith("\r")
@@ -844,7 +875,128 @@ function configureJsonAgentPolicy(configPath, label, mutate, dryRun, beforeCommi
     writeTextAtomically(writePath, `${JSON.stringify(config, null, 2)}\n`, originalText, beforeCommit, symlinkPath);
     return { path: configPath, status: action === "install" ? "installed" : "refreshed" };
 }
-/** Configure Claude Code's economy fallback model; policy text prevents routine fan-out. */
+/** Rewrite a managed startup block whose content differs from what THIS binary
+ *  writes, and nothing else. Not "older": there is no version ordering in the
+ *  block, so a pinned older install can rewrite what a newer one wrote.
+ *
+ *  The instruction files are the one delivery channel that does not travel with
+ *  the package: the MCP `initialize` instructions and every tool description
+ *  update the moment the server binary does, but a native instruction file keeps
+ *  whatever text `prism connect` last wrote. Released 20.21.0 changed that text —
+ *  it used to tell hosts to pass `cloud_fallback: false`, which made a paid
+ *  plan's escalation unreachable — and a machine that never re-runs connect keeps
+ *  telling its host the retracted thing. `prism update` deliberately never
+ *  touches host configuration, autoupdate runs `update`, and npm's ignore-scripts
+ *  blocks the postinstall refresh, so on an ordinary machine nothing heals it.
+ *
+ *  This is the narrow, safe subset of connect, and the narrowness is the point:
+ *
+ *  - MARKER-GATED. A file without the ownership marker is left byte-for-byte
+ *    alone. Connect is still the only thing that can FIRST install a block;
+ *    consent is never inferred from a server start.
+ *  - Startup blocks ONLY. It never touches MCP host registration — that is what
+ *    connect's "close target hosts before registration" warning is about, since
+ *    a live host rewrites its own config. These files DO have another writer —
+ *    Gemini CLI writes GEMINI.md on a remember request, Claude Code writes
+ *    CLAUDE.md on /init — so only the marker-delimited block is replaced,
+ *    marker lines included, and the file is re-checked immediately before
+ *    committing; a write landing inside that final window would still be
+ *    lost.
+ *  - Content-addressed, so it is a no-op once current: the block is compared
+ *    byte-for-byte and only a difference writes.
+ *
+ *  The host reads its instruction file when a session starts, so a refresh made
+ *  during this session lands on the NEXT one. That is the cost of healing
+ *  without asking, and it is one session. */
+export function refreshManagedStartupBlocks(options = {}) {
+    const homeDir = options.homeDir ?? homedir();
+    const env = options.env ?? process.env;
+    // The opt-out lives here, next to the writing, so it is one decision and a
+    // test can exercise it without starting a server.
+    if (env.PRISM_NO_STARTUP_REFRESH === "1")
+        return [];
+    const dryRun = !!options.dryRun;
+    const codexHome = env.CODEX_HOME?.trim() ? resolve(env.CODEX_HOME.trim()) : join(homeDir, ".codex");
+    const targets = [
+        { host: "claude-code", path: join(homeDir, ".claude", "CLAUDE.md"), configure: () => configureClaudeNativeStartup(homeDir, dryRun, undefined, true) },
+        { host: "gemini", path: join(homeDir, ".gemini", "GEMINI.md"), configure: () => configureGeminiNativeStartup(homeDir, dryRun, undefined, true) },
+        { host: "codex", path: join(codexHome, "AGENTS.md"), configure: () => configureCodexNativeStartup(homeDir, dryRun, undefined, env, true) },
+    ];
+    const results = [];
+    // Two hosts can resolve to ONE file — GEMINI.md symlinked to CLAUDE.md is a
+    // common single-file setup — and Claude and Gemini serialize the SAME
+    // ownership marker, so without this each start rewrote that file twice and
+    // never converged: two "refreshed" lines on every start, forever. Whoever
+    // gets there first owns it; the second reports it as already handled.
+    // Identity is the FILE, not the path: statSync follows symlinks, and dev:ino
+    // is shared by hard links too, which a path comparison misses entirely (an
+    // atomic replace would then break the link and hand both hosts a "refreshed"
+    // they should never have got). Resolved ONCE per target and reused, so the
+    // decision below is the one that was actually measured; a target retargeted
+    // after this point is the same inherent window as the compare-to-rename one
+    // documented on writeTextAtomically.
+    const identityOf = (path) => {
+        try {
+            const info = statSync(path);
+            return `${info.dev}:${info.ino}`;
+        }
+        catch {
+            return `path:${path}`; // absent or unreadable: the path itself is identity enough
+        }
+    };
+    const resolved = targets.map(target => ({ target, identity: identityOf(target.path) }));
+    const shared = new Map();
+    for (const { target, identity } of resolved) {
+        shared.set(identity, [...(shared.get(identity) ?? []), target.host]);
+    }
+    for (const { target, identity } of resolved) {
+        const sharing = shared.get(identity) ?? [target.host];
+        if (sharing.length > 1) {
+            // One file, two hosts. Claude and Gemini serialize the SAME ownership
+            // marker but DIFFERENT instructions (the tool is named differently for
+            // each), so there is no content that satisfies both: healing it would
+            // hand one host the other's block, and before this check each start
+            // rewrote the file once per host, forever. Whose block it should be is
+            // the operator's call, not a background process's.
+            results.push({
+                host: target.host,
+                path: target.path,
+                status: "failed",
+                detail: `shared with ${sharing.filter(h => h !== target.host).join(", ")} (one file cannot hold both blocks); run: prism connect`,
+            });
+            continue;
+        }
+        try {
+            // No independent pre-read. The configurator's own exact-line marker
+            // recognition decides, from ONE snapshot: a second, weaker check here
+            // (a substring scan) would call a file managed because the marker
+            // appears in its prose, and the window between two reads is a way to
+            // lose the marker after the check. With refreshOnly the install branch
+            // is unreachable either way.
+            const outcome = target.configure();
+            results.push({
+                host: target.host,
+                path: outcome.path,
+                // A dry run must not claim a write it did not make: would-refresh is
+                // carried through as itself. installed/would-install are unreachable
+                // under refreshOnly, so anything else is a completed refresh.
+                status: outcome.status === "unchanged" || outcome.status === "unmanaged" || outcome.status === "would-refresh"
+                    ? outcome.status
+                    : "refreshed",
+            });
+        }
+        catch (error) {
+            // A self-heal must never be the reason a server fails to start.
+            results.push({
+                host: target.host,
+                path: target.path,
+                status: "failed",
+                detail: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return results;
+}
 export function configureClaudeAgentPolicy(homeDir = homedir(), dryRun = false, beforeCommit) {
     const configPath = join(homeDir, ".claude", "settings.json");
     return configureJsonAgentPolicy(configPath, "Claude agent settings", (config) => {

package/dist/server.js

@@ -1307,6 +1307,66 @@ export async function startServer() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error(`[Prism] MCP Server successfully started and listening on stdio...`);
+    // Heal a startup block whose content differs from what this binary writes.
+    // (Not "older": nothing orders versions, so a pinned older install can
+    // rewrite what a newer one wrote.) The instruction files are the
+    // one channel that does not travel with the package — `initialize`
+    // instructions and every tool description update with the binary, a native
+    // instruction file keeps whatever connect last wrote — and nothing on an
+    // ordinary machine re-runs connect: `prism update` never touches host
+    // configuration by design, autoupdate runs `update`, and the postinstall
+    // path covers only the prompt-routing hook and is routinely disabled by
+    // npm's ignore-scripts. 20.21.0 is the release that
+    // proved the cost: the old text told hosts to pass `cloud_fallback: false`,
+    // which made a paid plan's escalation unreachable.
+    //
+    // Refresh-only, so this can only ever rewrite a block the operator already
+    // consented to by running connect once: the install branch is unreachable
+    // from here, and a file without exactly one ordered marker pair is left
+    // byte-for-byte alone. Startup blocks only — never MCP registration, which
+    // is what connect's "close your hosts first" warning is about. These files
+    // do have another writer (Gemini CLI writes GEMINI.md on a remember
+    // request, Claude Code writes CLAUDE.md on /init), so the refresh replaces
+    // only its own marker-delimited block, marker lines included, and re-checks
+    // immediately before committing. After the transport is connected, so the handshake is never
+    // held behind disk I/O. PRISM_NO_STARTUP_REFRESH=1 opts out.
+    //
+    // DEFERRED, and unref'd, for two reasons. `connect.js` is a large module
+    // (the whole CLI surface, TOML parser included) and importing it is
+    // synchronous CPU work: awaited here it competes with the FIRST tool call,
+    // which on a cold host is the one that has to do a storage round trip. And
+    // an unref'd timer can never hold the process open. The block is read by the
+    // host at session start, so it was always landing on the next session — a
+    // couple of seconds changes nothing about when the fix arrives.
+    if (process.env.PRISM_NO_STARTUP_REFRESH !== "1") {
+        setTimeout(() => { void refreshStartupBlocksInBackground(); }, 2_000).unref();
+    }
+    await resumeServerStartup(server);
+}
+async function refreshStartupBlocksInBackground() {
+    try {
+        const { refreshManagedStartupBlocks } = await import("./connect.js");
+        for (const result of refreshManagedStartupBlocks()) {
+            if (result.status === "refreshed") {
+                // The host read this file when the session began, so the corrected
+                // text applies from the next one.
+                console.error(`[Prism] refreshed the ${result.host} startup block to match this version: ${result.path} (applies from your next session)`);
+            }
+            else if (result.status === "failed") {
+                console.error(`[Prism] could not refresh the ${result.host} startup block (${result.detail}); run: prism connect`);
+            }
+            else if (process.env.PRISM_DEBUG) {
+                console.error(`[Prism] startup block ${result.host}: ${result.status}${result.detail ? ` (${result.detail})` : ""}`);
+            }
+        }
+    }
+    catch (error) {
+        // Never the reason a server fails to start.
+        if (process.env.PRISM_DEBUG)
+            console.error(`[Prism] startup refresh skipped: ${error instanceof Error ? error.message : error}`);
+    }
+}
+async function resumeServerStartup(server) {
     // Start the authoritative tier-skill refresh only after the MCP transport is
     // connected. session_load_context awaits this same single-flight promise,
     // while the initialize handshake is never held behind portal I/O. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.5",
+  "version": "20.21.6",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine \u2014 including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",