prism-mcp-server 20.22.2 → 20.22.3

package/README.md

@@ -70,9 +70,9 @@ It reads `OMLX_API_KEY` or the local `~/.omlx/settings.json` key, and model/cont
 settings from `~/.omlx/model_settings.json`; `OMLX_MODEL` and a loopback-only
 `OMLX_BASE_URL` can select local configuration. Redirects are refused.
 
-**Requires** an oMLX build with Prism's control routes: the
-[`prism-v0.7.1rc1` branch of dcostenco/omlx](https://github.com/dcostenco/omlx/tree/prism-v0.7.1rc1), upstream oMLX
-0.7.1rc1 plus those routes ([install and settings](https://github.com/dcostenco/omlx/blob/prism-v0.7.1rc1/PRISM.md)). With stock
+**Requires** the [stable Prism integration of oMLX](https://github.com/dcostenco/omlx),
+based on upstream `v0.7.1` with Prism's control routes
+([install and settings](https://github.com/dcostenco/omlx/blob/main/PRISM.md)). With stock
 oMLX every call is refused. Generation runs as an owned
 job through those routes, so a timeout or cancel is reported only once the
 server confirms the request stopped. An unconfirmed stop refuses later calls
@@ -235,6 +235,21 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.22.3
+
+- **Dependency fixes:** Hono 4.13.11 addresses its static-path middleware
+  bypass advisory; Vite 8.2.4 addresses its development editor-launch advisories.
+- **Local resource probes use numeric loopback by default.** The default
+  Ollama endpoint is now `http://127.0.0.1:11434`, so a stalled `localhost`
+  DNS lookup cannot block those probes. Explicit URL overrides are preserved;
+  IPv6-only servers need an explicit URL.
+- **Read-only oMLX inspection accepts release-candidate versions.** Valid
+  `rcN` labels no longer invalidate status. Inspection still reports
+  generation disabled and the provider not qualified; it is not an activation
+  or a generation check.
+- **Stable oMLX setup:** the current setup link uses the Prism integration
+  based on upstream `v0.7.1`. Stock oMLX still lacks the required control routes.
+
 ## What's New in v20.22.2
 
 **Why it matters:** an agent that followed `session_task_route`'s advice was

package/dist/config.js

@@ -345,15 +345,16 @@ export const PRISM_TURBOQUANT_TIEBREAKER_EPSILON = Number.isFinite(rawTiebreaker
 //
 // Set PRISM_LOCAL_LLM_ENABLED=true to activate.
 // Set PRISM_LOCAL_LLM_MODEL to override the model tag.
-// Set PRISM_LOCAL_LLM_URL to override the Ollama endpoint (default: localhost:11434).
+// Set PRISM_LOCAL_LLM_URL to override the Ollama endpoint (default: 127.0.0.1:11434).
 // Set PRISM_LOCAL_LLM_TIMEOUT_MS to override per-call timeout (default: 60000, max: 300000).
 // Set PRISM_STRICT_LOCAL_MODE=true to block cloud fallback when local LLM is enabled (HIPAA).
 /** Master switch — enables the local prism-coder LLM for background tasks. */
 export const PRISM_LOCAL_LLM_ENABLED = process.env.PRISM_LOCAL_LLM_ENABLED === "true"; // Opt-in, default false
 /** Ollama model tag to use for local LLM calls. */
 export const PRISM_LOCAL_LLM_MODEL = (process.env.PRISM_LOCAL_LLM_MODEL || "prism-coder:9b").trim();
-/** Ollama base URL. Override for remote Ollama instances. */
-export const PRISM_LOCAL_LLM_URL = (process.env.PRISM_LOCAL_LLM_URL || "http://localhost:11434").trim();
+/** Numeric loopback avoids queuing local health probes behind getaddrinfo work.
+ * Explicit overrides still support custom hostnames and IPv6-only listeners. */
+export const PRISM_LOCAL_LLM_URL = (process.env.PRISM_LOCAL_LLM_URL || "http://127.0.0.1:11434").trim();
 /** Per-call timeout in ms. Prevents stalled background tasks. Capped at 300s. */
 export const PRISM_LOCAL_LLM_TIMEOUT_MS = (() => {
     const raw = parseInt(process.env.PRISM_LOCAL_LLM_TIMEOUT_MS || "60000", 10);

package/dist/utils/omlxProvider.js

@@ -438,7 +438,7 @@ export async function inspectOmlx(options = {}) {
     if (new Set(advertised).size !== advertised.length)
         throw new OmlxError("omlx_inspection_models_invalid");
     if (typeof raw.version !== "string" || raw.version.length > 32 || raw.version.includes(apiKey)
-        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:[.+-][A-Za-z0-9.-]+)?$/.test(raw.version)
+        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:rc[0-9]+)?(?:[.+-][A-Za-z0-9.-]+)?$/.test(raw.version)
         || typeof raw.uptime_seconds !== "number" || !Number.isFinite(raw.uptime_seconds) || raw.uptime_seconds < 0
         || !STATUS_COUNTS.every(key => Number.isSafeInteger(raw[key]) && raw[key] >= 0)
         || ![raw.model_memory_used, raw.model_memory_max].every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.22.2",
+  "version": "20.22.3",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
@@ -80,7 +80,8 @@
     "@hono/node-server": "^2.0.5",
     "body-parser": "^2.3.0",
     "fast-uri": "^3.1.8",
-    "hono": "^4.13.5",
+    "hono": "4.13.11",
+    "vite": "8.2.4",
     "ip-address": "^10.2.0",
     "protobufjs": "^7.6.5",
     "sharp": "^0.35.5",