prism-mcp-server 20.22.1 → 20.22.3

package/README.md

@@ -70,9 +70,9 @@ It reads `OMLX_API_KEY` or the local `~/.omlx/settings.json` key, and model/cont
 settings from `~/.omlx/model_settings.json`; `OMLX_MODEL` and a loopback-only
 `OMLX_BASE_URL` can select local configuration. Redirects are refused.
 
-**Requires** an oMLX build with Prism's control routes: the
-[`prism-v0.7.1rc1` branch of dcostenco/omlx](https://github.com/dcostenco/omlx/tree/prism-v0.7.1rc1), upstream oMLX
-0.7.1rc1 plus those routes ([install and settings](https://github.com/dcostenco/omlx/blob/prism-v0.7.1rc1/PRISM.md)). With stock
+**Requires** the [stable Prism integration of oMLX](https://github.com/dcostenco/omlx),
+based on upstream `v0.7.1` with Prism's control routes
+([install and settings](https://github.com/dcostenco/omlx/blob/main/PRISM.md)). With stock
 oMLX every call is refused. Generation runs as an owned
 job through those routes, so a timeout or cancel is reported only once the
 server confirms the request stopped. An unconfirmed stop refuses later calls
@@ -235,6 +235,33 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.22.3
+
+- **Dependency fixes:** Hono 4.13.11 addresses its static-path middleware
+  bypass advisory; Vite 8.2.4 addresses its development editor-launch advisories.
+- **Local resource probes use numeric loopback by default.** The default
+  Ollama endpoint is now `http://127.0.0.1:11434`, so a stalled `localhost`
+  DNS lookup cannot block those probes. Explicit URL overrides are preserved;
+  IPv6-only servers need an explicit URL.
+- **Read-only oMLX inspection accepts release-candidate versions.** Valid
+  `rcN` labels no longer invalidate status. Inspection still reports
+  generation disabled and the provider not qualified; it is not an activation
+  or a generation check.
+- **Stable oMLX setup:** the current setup link uses the Prism integration
+  based on upstream `v0.7.1`. Stock oMLX still lacks the required control routes.
+
+## What's New in v20.22.2
+
+**Why it matters:** an agent that followed `session_task_route`'s advice was
+refused on explicit oMLX before anything ran.
+
+- **A complexity hint no longer refuses explicit oMLX.** `session_task_route`
+  recommends a `task_complexity` for every code task. That hint picks Ollama's
+  starting tier, but on explicit oMLX it lowered the model ceiling, so a call
+  that passed the recommended arguments was refused with `omlx_model_ceiling`.
+  Now only an explicit `model_ceiling` below the top tier, or a plan below it,
+  refuses. Thinking on oMLX stays with the server's settings.
+
 ## What's New in v20.22.1
 
 **Why it matters:** on explicit oMLX, a long prompt could keep the device busy

package/dist/config.js

@@ -345,15 +345,16 @@ export const PRISM_TURBOQUANT_TIEBREAKER_EPSILON = Number.isFinite(rawTiebreaker
 //
 // Set PRISM_LOCAL_LLM_ENABLED=true to activate.
 // Set PRISM_LOCAL_LLM_MODEL to override the model tag.
-// Set PRISM_LOCAL_LLM_URL to override the Ollama endpoint (default: localhost:11434).
+// Set PRISM_LOCAL_LLM_URL to override the Ollama endpoint (default: 127.0.0.1:11434).
 // Set PRISM_LOCAL_LLM_TIMEOUT_MS to override per-call timeout (default: 60000, max: 300000).
 // Set PRISM_STRICT_LOCAL_MODE=true to block cloud fallback when local LLM is enabled (HIPAA).
 /** Master switch — enables the local prism-coder LLM for background tasks. */
 export const PRISM_LOCAL_LLM_ENABLED = process.env.PRISM_LOCAL_LLM_ENABLED === "true"; // Opt-in, default false
 /** Ollama model tag to use for local LLM calls. */
 export const PRISM_LOCAL_LLM_MODEL = (process.env.PRISM_LOCAL_LLM_MODEL || "prism-coder:9b").trim();
-/** Ollama base URL. Override for remote Ollama instances. */
-export const PRISM_LOCAL_LLM_URL = (process.env.PRISM_LOCAL_LLM_URL || "http://localhost:11434").trim();
+/** Numeric loopback avoids queuing local health probes behind getaddrinfo work.
+ * Explicit overrides still support custom hostnames and IPv6-only listeners. */
+export const PRISM_LOCAL_LLM_URL = (process.env.PRISM_LOCAL_LLM_URL || "http://127.0.0.1:11434").trim();
 /** Per-call timeout in ms. Prevents stalled background tasks. Capped at 300s. */
 export const PRISM_LOCAL_LLM_TIMEOUT_MS = (() => {
     const raw = parseInt(process.env.PRISM_LOCAL_LLM_TIMEOUT_MS || "60000", 10);

package/dist/tools/prismInferHandler.js

@@ -2206,12 +2206,14 @@ async function runInferAfterInputSafety(args, deps, t0, temperature) {
         // No trusted binding maps an oMLX model to a logical tier, and the
         // configured Flash model outweighs every Ollama tier. Below the top
         // ceiling, from the caller or the plan, refuse before any network,
-        // classification or residency change.
-        if (effectiveCeiling !== "27b") {
+        // classification or residency change. A task_complexity hint only picks
+        // Ollama's starting tier (session_task_route recommends one for every
+        // code task), so it is not a ceiling here; an explicit model_ceiling is.
+        if (clampCeiling(args.model_ceiling ?? "27b", ent.model_ceiling) !== "27b") {
             attempts.push({ tier: "omlx", reason: "omlx_model_ceiling" });
             if (wantReport)
                 return refusedResult("omlx_model_ceiling");
-            throw new Error("prism_infer: omlx_model_ceiling; explicit oMLX needs the top model ceiling");
+            throw new Error("prism_infer: omlx_model_ceiling; explicit oMLX needs the top model ceiling from model_ceiling and the plan");
         }
         if (!Number.isInteger(localMaxTokens) || localMaxTokens <= 0
             || !Number.isFinite(temperature) || temperature < 0

package/dist/utils/omlxProvider.js

@@ -438,7 +438,7 @@ export async function inspectOmlx(options = {}) {
     if (new Set(advertised).size !== advertised.length)
         throw new OmlxError("omlx_inspection_models_invalid");
     if (typeof raw.version !== "string" || raw.version.length > 32 || raw.version.includes(apiKey)
-        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:[.+-][A-Za-z0-9.-]+)?$/.test(raw.version)
+        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:rc[0-9]+)?(?:[.+-][A-Za-z0-9.-]+)?$/.test(raw.version)
         || typeof raw.uptime_seconds !== "number" || !Number.isFinite(raw.uptime_seconds) || raw.uptime_seconds < 0
         || !STATUS_COUNTS.every(key => Number.isSafeInteger(raw[key]) && raw[key] >= 0)
         || ![raw.model_memory_used, raw.model_memory_max].every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.22.1",
+  "version": "20.22.3",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
@@ -80,7 +80,8 @@
     "@hono/node-server": "^2.0.5",
     "body-parser": "^2.3.0",
     "fast-uri": "^3.1.8",
-    "hono": "^4.13.5",
+    "hono": "4.13.11",
+    "vite": "8.2.4",
     "ip-address": "^10.2.0",
     "protobufjs": "^7.6.5",
     "sharp": "^0.35.5",