prism-mcp-server 20.3.2 → 20.4.0

package/README.md

@@ -61,6 +61,35 @@ features.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.4.0
+
+### An Explicitly Named Cloud Backend Fails Loud
+
+Setting `PRISM_STORAGE=synalux` or `=supabase` with incomplete credentials used
+to downgrade silently to local SQLite. The switch was logged to stderr, which
+MCP hosts discard, so nothing surfaced it: sessions kept serving stale local
+context while the cloud held newer history, and `context_source` read `local`
+rather than any kind of warning. A session could run that way for weeks.
+
+Naming a backend outright is a strong statement of intent, so it now throws —
+naming the missing variables and the `PRISM_STORAGE=local` opt-out — instead of
+quietly splitting your session history. `auto` is unchanged: it keeps its
+documented `synalux > supabase > local` degradation, pinned by a test.
+
+**Upgrade note:** if you explicitly set `PRISM_STORAGE=synalux|supabase` and
+your credentials are incomplete, startup now fails with a named error instead
+of silently using local data. That error is the fix — set the missing variable,
+or choose `PRISM_STORAGE=local` deliberately. Default (`auto`) configs are
+unaffected.
+
+The throw is deliberately not treated as a recoverable startup fault: that path
+exists for transient errors (rate limits, 5xx, DNS), which may degrade behind a
+visible notice. A missing credential is a configuration fault and must not be
+papered over.
+
+Also: the skill block is now budgeted by default rather than only on request,
+so a large skill payload cannot crowd out briefing and history.
+
 ## What's New in v20.3.2
 
 ### Web Scholar: SSRF Hardening

package/dist/storage/index.js

@@ -92,13 +92,34 @@ export async function getStorage() {
         debugLog(`[Prism Storage] Auto-resolved: ${requested}`);
     }
     // ─── Validate explicit backend has credentials ────────────────
+    // An explicitly requested cloud backend with missing credentials must fail
+    // loud. Silently serving local SQLite splits session history: the caller
+    // keeps working against a stale local copy while believing it is on the
+    // cloud, and console.error goes to stderr, which MCP hosts discard. "auto"
+    // already refuses to fall back for this exact reason (see above); naming a
+    // backend outright is a stronger statement of intent, so it must not be
+    // weaker about protecting history.
+    //
+    // Observed in the field: a base URL present without its API key (a
+    // `prism connect` run from a shell that never exported the key strips it)
+    // downgraded every subsequent session to local storage for weeks. The local
+    // copy kept serving months-old context while the cloud held current history,
+    // and nothing in-band surfaced the downgrade.
+    //
+    // This throw is deliberately NOT matched by isRecoverableStartupStorageError
+    // (startupRecovery.ts): a missing credential is a configuration fault, not a
+    // transient one, so startup must not paper over it with last-good context.
     if (requested === "synalux" && !(await ensureSynaluxCredentials())) {
-        console.error("[Prism Storage] Synalux backend requested but PRISM_SYNALUX_BASE_URL/PRISM_SYNALUX_API_KEY are missing or invalid. Falling back to local storage.");
-        requested = "local";
+        throw new Error("[Prism Storage] PRISM_STORAGE=synalux but Synalux credentials are missing or invalid " +
+            "(need PRISM_SYNALUX_BASE_URL and PRISM_SYNALUX_API_KEY). " +
+            "Refusing to fall back to local storage because that silently splits session history. " +
+            "Set PRISM_STORAGE=local explicitly if local-only storage is intended.");
     }
     if (requested === "supabase" && !(await ensureSupabaseCredentials())) {
-        console.error("[Prism Storage] Supabase backend requested but SUPABASE_URL/SUPABASE_KEY are missing or invalid. Falling back to local storage.");
-        requested = "local";
+        throw new Error("[Prism Storage] PRISM_STORAGE=supabase but Supabase credentials are missing or invalid " +
+            "(need SUPABASE_URL and SUPABASE_KEY). " +
+            "Refusing to fall back to local storage because that silently splits session history. " +
+            "Set PRISM_STORAGE=local explicitly if local-only storage is intended.");
     }
     // ─── Initialize ───────────────────────────────────────────────
     activeStorageBackend = requested;

package/dist/tools/ledgerHandlers.js

@@ -1344,8 +1344,12 @@ export async function sessionLoadContextHandler(args, options = {}) {
     // exists to deliver. The protected floor may still exceed this tranche
     // (always inlined); the reserved 40% keeps history alive whenever the
     // caller's budget covers the floor at all.
-    const skillBudgetChars = maxTokens && maxTokens > 0 ? Math.floor(maxTokens * 3.5 * 0.6) : Number.POSITIVE_INFINITY;
-    const { assembleSkillBlock } = await import("../utils/skillBudget.js");
+    // Armed by DEFAULT, not only when the caller passes max_tokens — see
+    // resolveSkillBudgetChars for why an unbudgeted default cost the agent its
+    // entire response on 2026-08-01. `level` scales the tranche so `quick`
+    // actually means quick.
+    const { assembleSkillBlock, resolveSkillBudgetChars } = await import("../utils/skillBudget.js");
+    const skillBudgetChars = resolveSkillBudgetChars(maxTokens, level);
     const budgeted = assembleSkillBlock(skillEntries, skillBudgetChars);
     skillBlock = budgeted.block;
     loadedSkills.push(...budgeted.inlined);

package/dist/utils/skillBudget.js

@@ -27,6 +27,51 @@ function render(e) {
     const label = e.category === "role" ? "ROLE SKILL" : "SKILL";
     return `\n\n[📜 ${label}: ${e.name}]\n${e.content.trim()}`;
 }
+/**
+ * Skill tranche used when the caller sets no `max_tokens`.
+ *
+ * Sized against the ~25k-token host tool-result cap: at the 3.5 chars/token
+ * heuristic that is ~87k chars for the WHOLE response, so the skill block has
+ * to leave room for briefing, handoff, and history.
+ *
+ * These are ADDITIVE on top of the protected floor, not a total. Protected
+ * skills inline even when the budget is already blown (assembleSkillBlock), and
+ * the repo-measured v26 floor is ~39k chars on its own — so the ceiling here is
+ * roughly 87k - 39k - memory. `standard` matches the 8,400-char tranche the
+ * existing v26 shape test already treats as the standard budget (60% of 14k
+ * tokens); `deep` doubles it and still leaves headroom for deep history.
+ *
+ * `quick` is deliberately near-nothing — it is the setting a caller picks to
+ * minimize context, and before this it still inlined the full skill payload,
+ * because `level` gated only the memory portion, which is the small part.
+ *
+ * Every value is finite and > 0 on purpose: assembleSkillBlock treats ≤ 0 and
+ * non-finite as "unbudgeted", so a zero here would silently restore the very
+ * bug this table exists to fix.
+ */
+export const DEFAULT_SKILL_BUDGET_CHARS = {
+    quick: 2_000,
+    standard: 8_400,
+    deep: 16_000,
+};
+/**
+ * Resolve the skill-block budget for one call.
+ *
+ * 2026-08-01: this previously evaluated to POSITIVE_INFINITY whenever
+ * `max_tokens` was absent — which is the documented default and therefore the
+ * common call shape. Routing v25 (76 -> 95 skills, 19 moved to auto-load) then
+ * pushed the unbudgeted block to 91,578 chars, past the host cap, and the host
+ * diverted the ENTIRE response to a file: the agent received no context at all.
+ * The budget must be armed by default, not only when a caller opts in.
+ */
+export function resolveSkillBudgetChars(maxTokens, level) {
+    // 60% of the response allowance: skills must not saturate it, or the
+    // briefing and history this tool exists to deliver get truncated away.
+    if (typeof maxTokens === "number" && Number.isFinite(maxTokens) && maxTokens > 0) {
+        return Math.max(1, Math.floor(maxTokens * 3.5 * 0.6));
+    }
+    return DEFAULT_SKILL_BUDGET_CHARS[level] ?? DEFAULT_SKILL_BUDGET_CHARS.standard;
+}
 /**
  * Assemble the skill block within `budgetChars`. `budgetChars` ≤ 0 or
  * non-finite means unbudgeted (legacy behavior: inline everything).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.3.2",
+  "version": "20.4.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",