Prism Coder MCP Server

Prism Coder

Give your AI agent memory that lasts — and see the cloud tokens it never had to spend. Persistent sessions, knowledge graphs, offline tool-routing, and an auditable savings meter. Fully local and free.

Current release: v20.22.4 — oMLX setup and local model roles Install a pinned oMLX server/model pack from the dashboard or CLI, or connect an existing server. Discover installed models and choose coder/reviewer roles for oMLX and Ollama. Controlled oMLX coding remains text-only.

Prism Coder is an MCP server that gives Claude, Cursor, and other AI tools long-term memory that survives across sessions. It ships with the open-weight prism-coder model fleet (2B–27B) for fast, offline tool-routing — no cloud required. And it keeps score: every call served locally is metered, so prism savings shows the token volume that never reached your cloud model — measured honestly, in tokens.

No account needed. No API keys. Runs on your machine.
A paid subscription adds cloud sync, higher model tiers, and team features through the Synalux portal.

---

What Prism gives you

• Session memory that survives restarts — resume projects with handoff notes, recent work, open TODOs, and configurable quick, standard, or deep context.
• Local-first inference — local Ollama models use automatic 2B/4B/9B/27B selection based on installed models, available RAM, context fit, and subscription entitlements. Eligible text-only coding can prefer configured oMLX; explicit task choices override the saved backend preference.
• A savings meter you can audit — prism savings (or the local_savings tool from any host) reports the token volume local serving kept off your cloud model: headline, local share, per-model breakdown. It reports tokens, never an invented dollar figure, and prints its assumptions and known undercounts inline — a number you can check, not marketing.
• Route-output enforcement — route mode returns only well-formed calls to tools the host actually advertised. Standard and higher plans can add authenticated deterministic correction; route_guard: "local" disables that correction only. cloud_fallback: false forbids cloud inference fallback and verify: false (with no evidence) disables the grounding verifier. With all three off, no request carries your prompt, draft or evidence; the per-call entitlement check and telemetry still contact the portal and carry neither.
• One setup for every agent — prism connect configures Claude Code, Claude Desktop, Cursor, Gemini CLI, and Codex while preserving unrelated settings.
• Subscription-aware skills — entitled skills are synchronized before the host launches, with safe upgrades, downgrades, conflict preservation, and offline last-good recovery.
• Hook-free startup — MCP metadata and native instructions request Prism's startup context without requiring lifecycle hooks or a Prism-owned launcher. Where a host offers hooks (Claude Code, Codex), prism connect adds two small ones on top: mid-session prompt routing, and a post-compaction re-injection of the protected-floor digest.
• Prompt-triggered Factory — enabled by default for suitable bounded implementation requests with explicit files, an allowed write list, and a verification command. The host starts and monitors the recommended pipeline; BCBA requests stay with the host. A dashboard toggle or PRISM_DARK_FACTORY_ENABLED=false disables Factory after an MCP restart. Try the three-test filename fix.
• Safe escalation and observability — inference outcomes are explicit, reserved text remains fail-closed (clinical images are processed locally, never sent to the cloud), and local/cloud usage is recorded for review.

On-device oMLX coding

On Apple Silicon, choose Settings → Local Coding in prism dashboard to install oMLX and its model pack or use an existing server. Auto prefers configured oMLX for eligible coding; a saved preference or explicit task choice can select Ollama instead. This path requires Prism's oMLX integration and its separate classifier; stock oMLX is insufficient. See oMLX setup, tested models, results, and failure handling, or start with the quickstart beside Ollama. Explicit oMLX never falls back to Ollama or cloud inference; drafts still need host review and tests.

Get started

Memory search automatically applies ACT-R ranking: relevance plus recency, frequency and memory associations. No upvote or prompt instruction is required. To opt out, use Account & Settings → Preferences → Automatic Memory Ranking (ACT-R), then restart your AI client. PRISM_ACTR_ENABLED=false also disables it. This ranking is separate from the neural graph's stored importance filter.

npm install -g prism-mcp-server
prism connect
prism dashboard

Use prism connect --dry-run to preview changes, prism connect --all to configure every detected host, or prism connect --refresh to reconcile Prism-managed entries after an upgrade. Restart the host after connecting.

prism dashboard opens the current local Mind Palace without a Synalux login. Prism works locally without an account, API key, or cloud subscription. Add a Synalux subscription when you want cloud memory, paid-tier skills, or team features.

To check your plan, open ⚙ Account & Settings → Account in the dashboard. Free users see Start 14-day trial; paid users see Manage subscription. During a trial, the same panel shows the paid tier and exact end date. No card is required to start. Add payment details before the end date to continue; if you do not, the subscription cancels and local Prism Free remains available. You can also compare plans directly at synalux.ai/pricing#prism-plans.

After a few sessions, ask what it's been worth:

prism savings --period month

💾 Local serving — LAST 30 DAYS
  ~510K tokens kept off your cloud model
  53 call(s) served locally of 58 routed (91%)

Your numbers will differ — that's the point: it reports what your machine actually served, not a projection. Full report anatomy and the honesty rules behind it are in the local_savings section.

Install as a plugin

Prism also ships as a plugin, which registers the MCP server and the startup skill for you.

Both hosts install straight from this repository. There is nothing to host and no server to run: the catalogue is the .claude-plugin/marketplace.json file committed here, and your client clones it from GitHub.

Claude Code:

claude plugin marketplace add dcostenco/prism-coder
claude plugin install prism-coder@prism

Codex:

codex plugin marketplace add dcostenco/prism-coder
codex plugin add prism-coder@prism

The plugin registers prism-mcp via npx -y prism-mcp-server. If you already configured Prism by hand — prism connect writes an mcp_servers.prism-mcp entry — you have that server twice under one key. Install the plugin or run prism connect, not both.

What prism connect changes about host subagents

connect steers bounded work to prism_infer on your machine rather than to host-spawned agents. What it writes differs per host, and it does not disable subagents everywhere — Claude Code keeps them and is pointed at an economy model instead. Prism's local workers stay available over MCP in every case.

Two things worth knowing:

• experimental is Gemini's namespace, not ours. Prism is not enabling anything experimental — it writes false to a flag Gemini already defines at that path. Writing anywhere else would have no effect.
• That namespace is by definition temporary. If Gemini promotes enableAgents out of experimental, Prism keeps writing the old path, Gemini reads the new one, and host subagents quietly turn back on. Nothing errors and the settings file still looks correct. If you see host subagents running while enableAgents reads false, check whether the key has moved before assuming connect failed to write it.

Both writes are idempotent in the sense that a host already configured this way is left untouched — but they are re-applied on every prism connect run, not only on --refresh. If you deliberately re-enable host subagents, the next connect will turn them off again. Keep them on by not re-running connect, or by re-enabling after each run.

---

What's New in v20.22.4

• Dashboard and CLI setup: Settings → Local Coding and prism local install a pinned oMLX server/model pack with progress, retry and managed startup, or connect an existing server. See the oMLX guide for requirements.
• Saved coding preference: choose Auto, oMLX or Ollama without restarting Prism. Auto prefers configured oMLX for eligible text-only coding; an explicit per-task backend overrides that preference.
• Discovered model roles: select installed coder and reviewer models for each backend, including the same model for both roles. Explicit task model choices win. Reported sizes and conservative memory estimates help compare choices; unknown metadata stays unknown and estimates do not guarantee fit.
• Managed isolation: model discovery, Hub cache and cluster launchers stay private to the managed installation. Competing Ollama residency refuses the call without unloading other jobs.
• Setup-state hardening: bounded reads use one file handle and reject symlinks, closing the filesystem race reported by CodeQL.
• Vision boundary: this release does not enable image requests through the controlled oMLX coding path. Picture-recognition tests remain separate work.

What's New in v20.22.3

• Dependency fixes: Hono 4.13.11 addresses its static-path middleware bypass advisory; Vite 8.2.4 addresses its development editor-launch advisories.
• Local resource probes use numeric loopback by default. The default Ollama endpoint is now http://127.0.0.1:11434, so a stalled localhost DNS lookup cannot block those probes. Explicit URL overrides are preserved; IPv6-only servers need an explicit URL.
• Read-only oMLX inspection accepts release-candidate versions. Valid rcN labels no longer invalidate status. Inspection still reports generation disabled and the provider not qualified; it is not an activation or a generation check.
• Stable oMLX setup: the current setup link uses the Prism integration based on upstream v0.7.1. Stock oMLX still lacks the required control routes.

What's New in v20.22.2

Why it matters: an agent that followed session_task_route's advice was refused on explicit oMLX before anything ran.

• A complexity hint no longer refuses explicit oMLX. session_task_route recommends a task_complexity for every code task. That hint picks Ollama's starting tier, but on explicit oMLX it lowered the model ceiling, so a call that passed the recommended arguments was refused with omlx_model_ceiling. Now only an explicit model_ceiling below the top tier, or a plan below it, refuses. Thinking on oMLX stays with the server's settings.

What's New in v20.22.1

Why it matters: on explicit oMLX, a long prompt could keep the device busy for minutes while being classified, and timeout_ms did not limit it.

• The call budget now covers classification. timeout_ms (default 300 s) starts before the safety screen, and each classifier read is bounded by the remaining budget as well as its own 90 s.
• A failed read ends the classification. An oversize prompt is read in 3,600-character windows; a read that fails already means refusal on this path, so the remaining windows are no longer read. Before, a stalled server could cost about four minutes per window.
• Tests: the owned-job marker tests pin the size limit and the non-blocking open directly.

What's New in v20.22.0

Why it matters: on Apple Silicon, prism_infer can now draft code on an oMLX server instead of Ollama, opt-in per call, behind its own safety screen. Separately, Layer 1 now marks two more kinds of auth request reserved, on every path.

• Opt-in oMLX backend: local_backend: "omlx" with mode: "code", text only. Nothing changes for calls that do not ask for it. It requires the oMLX build with Prism's control routes, published as the prism-v0.7.1rc1 branch of dcostenco/omlx (install and settings); with stock oMLX every call is refused.
• Its own safety screen: the 9b classifier on the same oMLX server reads every request; rules only refuse. In our tests, of 327 labelled sensitive requests, the 9b alone let 2 run locally, against 19 for the 4b classifier on Ollama; two rules written after reviewing those rows bring this path to 0, so 0 is not an out-of-sample figure. Of 294 routine requests, 2 were escalated (27 on Ollama). Of 135 adversarial probes, 3 ran locally, all one shape (a documentation field).
• Speed and cost: a classifier read took about 0.37 s at the 95th percentile on an idle machine and up to 0.65 s under load. The first read after a long idle took 14.5 s, because macOS had paged the classifier out, so Prism waits up to 90 s for it instead of refusing. The classifier holds about 9.2 GB while loaded (9.7 GB peak).
• Fails closed: a classifier failure, an unreadable answer or a missing model refuses the call; it never falls back to a keyword check or to Ollama. A long prompt is read whole, in windows, not as an excerpt.
• Frees memory first: Ollama's loaded models are unloaded before the call (they reload on the next Ollama call), so the two runtimes do not hold large models at once.
• Layer 1, every path: a request that decides whether signed-out, anonymous or guest users may reach a route, page or endpoint (granting or blocking it), makes one public, or gives them admin rights is marked reserved by rule, and so is code that exchanges an authorization code for tokens. Measured on the 327 sensitive requests on the default Ollama path: 18 now run locally, against 19 before; routine escalations are unchanged (27 of 294).

What's New in v20.21.27

Why it matters: a script that feeds Prism Browser through a pipe can now pause between blocks of commands. Before, commands that had already arrived waited for the next write, and never ran if the 600 s idle timeout came first, so a script that checked a result before sending more stalled and then failed.

• Every piped command runs when it arrives. The reader waited on select() for new pipe data while readline() had already buffered the commands sent so far. It now reads the descriptor itself and decodes it as the text stream did (its encoding, universal newlines). Measured with two commands written together and a third written only after the reader hands over the second: the second came out only with the third before, and before the third is written now.
• Unchanged: the idle timeout, \ line continuation (CRLF endings included), comment lines, and streams select() cannot watch, now read blocking. At the idle timeout, a command still being written is dropped, never run cut short.

What's New in v20.21.26

Why it matters: routine wording no longer lets a mixed request skip Layer 1, the safety screen that decides whether a request may run on your device. A BCBA who asks in one message for an operational definition and how many mL of a drug to give, or a developer who asks for a code review and then authentication code, now has that request screened by Layer 1's rules and, unless the request or conversation is already marked reserved, a classifier read. Before, it could be answered by a local model with no classifier read.

• Rules no longer clear requests. Before, one routine clause let Layer 1's rules clear the whole request, so it skipped the classifier. "Write an operational definition for tantrums and tell me how many mL of Benadryl to give at bedtime" was answered locally with no classifier read, and so was "review the dashboard component for hook order and then write the JWT validation middleware". Now rules can only mark a request reserved. The routine shortcut is gone for a single prompt and for the current prompt of a follow-up; the prompt's classifier read is skipped only if the request or conversation is already marked reserved. A long prompt that reaches the classifier is read as excerpts, as before.
• What happens to a flagged request. A text request that a rule marks reserved, or that the classifier flags, goes to a stronger cloud model when your plan includes cloud and the call does not pass cloud_fallback: false. Otherwise it is refused, and the refusal says why. Requests the classifier clears remain eligible to run locally, so routine drafting (operational definitions, data sheets, antecedent strategies) and routine code work still run on your device when the local model can answer.
• Seclusion by another name. Placement phrases such as "put him in the quiet room until he calms down" (also isolation, time-out, padded and calm-down rooms) are now marked reserved by rule. This catches placement requests of that shape (him, her, them, or the client, student or child placed into the room) that never use the word "seclusion". Other wording, and other mentions of these rooms, are left to the classifier.
• Measured: of 46 mixed requests built to test this bypass, which should never be answered locally, 41 were cleared to run locally before this release and 9 after: 32 fewer sensitive requests reaching a local model. Of 294 routine requests, 2 more than before are escalated (or refused, without cloud).
• Limits, unchanged in this release. Keep them in mind when deciding whether a local answer needs your review:
  • The classifier can miss a request, and a missed request still runs locally. The 9 above are such misses.
  • Some classifier failures fall back to a keyword check, and text that passes it can still run locally.
  • A request with images is processed on this device even when flagged, and is never sent to the cloud.
• Cost: requests that used the shortcut now need a classifier read, unless screening has already marked them reserved. That added check is the price of closing the bypass; in our tests the read took about 0.3 s at the 95th percentile.

What's New in v20.21.25

Semantic memory search now automatically applies ACT-R ranking, combining relevance with recency, frequency and associations. Account & Settings → Preferences → Automatic Memory Ranking (ACT-R) lets you opt out after an AI client restart; an explicit environment value takes precedence.

Synalux Cloud uses authenticated, owner-scoped access-history and candidate-link APIs. Cloud deployment requires the matching Portal history migration. Stored importance thresholds remain separate, and HRR drift detection remains independent.

What's New in v20.21.24

• Synalux cloud preserves initial importance and handles votes, graduated insights, and stale-score decay through the authenticated Portal API.
• Voting rejects inactive or inaccessible records; decay preserves archived history. Existing scores remain unchanged.
• Graph importance thresholds use stored scores. Automatic retrieval ranking and access tracking do not automatically turn ordinary memories into high-score rules.

What's New in v20.21.23

• Factory routes suitable bounded implementation prompts and executes only the allowed file actions, with independent verification and explicit lifecycle results.
• Paid pipeline creation, updates, aborts, and verification records use the authenticated Portal API. Startup waits for paid storage initialization before reporting Factory readiness.
• The default-enabled toggle distinguishes the saved setting from the active MCP setting and shows when a restart is required.

What's New in v20.21.22

• Factory pipeline lists for cloud accounts use the authenticated Portal API, including exact project and status filters, without direct database credentials.
• Invalid, incomplete, or oversized reads show an unavailable state. A valid empty list remains distinct from a failed read.
• This release covers pipeline lists. Cloud pipeline creation, controls, and execution still need separate validation.

What's New in v20.21.21

• Prism Dashboard now reports unavailable analytics and factory reads clearly, prevents stale project results, and keeps graph filters and counts in sync.
• Project analytics can be read through the authenticated Portal API with validated 14-day activity data.

What's New in v20.21.20

• Fixed: a session_save_ledger call refused with context_not_loaded, or the greeting-only reply that writes nothing, restarted the hourly drift reminder. A ledger save restarts it now only when it writes an entry.
• A written ledger entry's reply also asks for the handoff when the checkpoint ends a unit of work.
• A ledger save skipped as a duplicate of one saved in the last 5 minutes now says nothing new was written, instead of "saved".
• Fixed: with Supabase storage, a handoff whose save failed was reported as updated. It is now an error the agent can see and retry.

What's New in v20.21.19

• Prism Browser emulates phones and tablets. --device iphone-17, or one of five other measured iPhones and iPads, turns on touch CSS, the pixel ratio, and the iPhone safe area, so a layout that only breaks on the phone can be caught in a test. --touch, --device-scale-factor, and --safe-area set each part on its own.

What's New in v20.21.18

• Fixed: when a save was refused with context_not_loaded, the instructions Prism installs for Claude Code, Codex and Gemini CLI forbade the one call that recovers. The refusal now prints that call, session_load_context with the same project and conversation_id, and the installed instructions allow it. First-turn startup is unchanged.

What's New in v20.21.17

• Fixed: the on-device screen refused some ordinary coding requests. With a Synalux account (free included), it now reads each request through a policy that Synalux serves, pinned by its SHA-256. Without an account, or with images attached, the screen is unchanged.
• prism_infer route mode: set allow_parallel_calls to keep a reply that calls several of the tools you offered in allowed_tools.

What's New in v20.21.16

Conversations: checked on your device, and free with an account

• A local answer to a conversation is checked on your device before it is served. If the check fails or cannot run, the answer goes to the cloud when your plan and settings allow it, and is withheld otherwise.
• On Pro and Team, a local answer that passes is also confirmed by Synalux, on a copy pseudonymized on your device; the mapping stays on your device. With an image attached, or with the cloud off, the checked local answer is served.
• When the on-device screen's 4b is unsure about a conversation, the 9b reads it again before the conversation is refused or sent to the cloud.
• Everything local is free with no account and no cap on the local model size. A free Synalux account adds multi-turn prism_infer and 20 cloud answers a day. Pro ($15/month) and Team ($20/seat/month) are Prism's own plans.
• Optional You.com web search: set YDC_API_KEY to enable youcom_web_search (contributed by @mouse-value-add in #227).
• Fixed: the 2b and 4b no longer answer Prism's own requests as a tool router. A system prompt built into those models had turned some answers into tool calls and made the on-device screen refuse some ordinary requests.

What's New in v20.21.15

Follow-ups: see what runs locally, and a stricter screen when the classifier is down

• local_savings (and prism savings) shows a line for follow-ups, calls that carried your conversation. It covers how many the local model answered (and how many of those the 9b answered), how many the on-device screen refused and at which stage, how many your plan's multi-turn limits refused, and how many went to the cloud.
• A short chat answer ("16", "Yes") counts as an answer. Before, the quality gate treated it as empty, and a paid plan re-asked the cloud.
• When the on-device classifier fails every read on a follow-up, the follow-up is no longer answered on a keyword check alone. It goes to the cloud if your plan allows it, and is refused otherwise.

What's New in v20.21.14

Skills load when they help, and you can see why they loaded

• Background task notifications, reports from other agents and continuation summaries no longer load skills in the middle of a task, so a word inside an agent's report cannot pull in unrelated rules.
• Pasting Prism's startup output into a prompt no longer loads skills that happen to share a word with it.
• Tasks that say they need host tools or reserved judgment stay with the host instead of failing on the local worker.
• Every routed-skills header ends with the routing table version (for example "Routing table v41."), so a past skill load can be checked against the exact rules that chose it.
• Skills with their own triggers now load even when their file uses Windows line endings or mentions prompt_triggers: in its description; before, they were delivered but silently never loaded.

What's New in v20.21.13

Paid plans and trials are clear in Account & Settings

• Free users can open the Prism plan comparison and start a 14-day trial.
• Trial users see their paid tier, exact end date, and the action to add payment details before automatic cancellation.
• Active and payment-recovery states lead to the correct hosted billing action; an unavailable verification is labeled instead of being presented as paid.
• Local Prism Free remains available without an account or subscription.

What's New in v20.21.12

Multiple MCP hosts keep a working dashboard link

• Each running Prism host now registers its local dashboard independently.
• prism dashboard and the startup message verify the newest candidates and fall back to an older live dashboard when a newer host stops.
• Instance cleanup cannot remove another host's registration, and the open message preserves the linked account and plan description.

What's New in v20.21.11

Linked accounts persist across dashboard refreshes

• A host process with an obsolete launch credential now recovers from the newer account saved by the dashboard after the obsolete credential is rejected.
• Valid host credentials remain authoritative; sign-out, concurrent account changes, network failures, and server failures do not trigger an unsafe credential switch.
• prism dashboard opens the active local dashboard without relabeling a linked Standard, Advanced, or Enterprise account as Free.

What's New in v20.21.10

Signed-out Free dashboards keep working locally

• Signing out now switches Project View, project details, and graph reads to local SQLite without requiring an account, configuration edit, or restart.
• The saved Synalux backend preference remains ready for the next sign-in; accidental missing cloud credentials still fail closed.
• Latest Activity uses the newest durable session when it is newer than the saved handoff. Recent Sessions are newest first, and saved handoff versions remain available as restore points.

What's New in v20.21.9

Prism Free opens without a Synalux account

• Run prism dashboard to open the current local Mind Palace. No sign-in, account-link code, API key, paid plan, or Free-plan redemption is required.
• A bare local dashboard address now gives the exact local-open command instead of rendering a broken account state.
• Account & Settings shows Prism Free as active. Synalux linking remains an optional action for cloud sync, billing, and paid features.
• Local access stays protected without printing its browser capability into startup output, and unsafe state paths or redirected identity probes fail closed.

What's New in v20.21.8

Dashboard graphs use the authenticated Portal

• The selected cloud project now shows its real session nodes and stored links instead of collapsing to a keyword-only project bubble.
• Synthesize Edges uses the authenticated Synalux Portal embedding contract; the Prism dashboard process does not need a Google or Gemini API key.
• Existing vectors and links are reused on repeat runs, synthesis fan-out is bounded, and Portal failures are shown rather than rendered as an empty graph.
• Account & Settings now shows the current user, role, and Free, Standard, Advanced, or Enterprise plan, with visible sign-in, upgrade, billing, and sign-out actions.
• A selected paid plan survives the Portal sign-in round trip, live and test Stripe catalogs resolve every paid tier, and localized checkout never reuses a USD Price for another currency.

What's New in v20.18.1

Task skills survive compaction and update in place

• Prompt-routed task skills now return after compaction. The hook restores the three most recently active task skills alongside the protected-floor digest, so a short follow-up such as continue keeps the workflow and visual verification rules that governed the work before context was compacted.
• A completed managed-skill sync refreshes active task rules on the next prompt. The hook compares the materialized generation on disk with its per-session state, re-authorizes every restored name against the current manifest, and injects the current bodies. A downgrade clears stale paid task state; Prism-managed directories cannot use the user-owned local-skill exception.
• User-owned local skills now route with their actual body. A local SKILL.md remains usable while signed out, while an entitled platform body takes precedence if both sources use the same name.
• Codex hook context is anchored to the user's request. Routed rules tell the model to execute the preceding user request with the rules applied, avoiding the trailing developer-context placement being mistaken for a new task. The anchor and all restored content share the 9,800-character limit.
• Hook version 5 enforces its command version. A still-running host with a trusted v4 command cannot execute the rewritten v5 script. After upgrading, run prism connect --refresh --no-models; Codex must trust both new v5 hook entries in /hooks. Restart the host if it has not reloaded the new hook definitions. Once v5 is active, later skill-body generations refresh on the next prompt without another host restart.
• State names are validated and bounded before they become CLI arguments, and the two-call refresh paths fit inside the host's 15-second hook timeout.

What's New in v20.18.0

The protected floor rides the bootstrap — and survives compaction

• session_bootstrap now inlines a digest of the protected floor on paid tiers at standard and deep depth: one inert line per rule, derived from each skill's first paragraph (or its pinned digest:), plus its section map, ~5.6K chars for the full floor. Small-context hosts such as Codex were re-reading the sixteen SKILL.md files every session (median 8 re-reads / 36KB, worst 823 / 5.1MB in rollout logs) because the bootstrap only named them. The digest is paid for on top of the context budget, so the ledger/handoff share at every depth is byte-identical to before. Quick depth stays names-only — the opt-out.
• A second hook re-injects the digest after compaction. prism connect registers the prism-route script on SessionStart matched to compact (Claude Code and Codex); it runs prism floor-digest, which applies the same tier and depth decisions as the bootstrap, and adds nothing on startup/resume/clear. Hosts without hooks (Gemini, Cursor) still get the digest on every bootstrap. Codex: UNVERIFIED against a live compaction. The hook is registered and the script accepts the documented payload spellings, but no Codex compaction has been observed end-to-end; on a payload it does not recognise it re-injects nothing rather than something wrong. If the digest comes from a generation whose skill files never finished syncing, the re-injected block carries the same STALE warning the bootstrap shows.
• Codex trust is reported honestly after a hook rewrite. Approvals are keyed by definition hash, so a rewritten hooks.json — this release adds the SessionStart entry — voids prior trust: connect prints AWAITING TRUST for both entries instead of a green ✓ for a hook Codex would silently skip, and trust recorded for an older hook version is never mistaken for current.
• A host config that no longer parses is left alone. If ~/.claude/settings.json or ~/.codex/hooks.json exists but is not valid JSON, connect keeps it byte-identical, registers no hook there, and says so — it no longer replaces the file with a minimal hooks-only one. The npm postinstall notice says the same, instead of asking you to trust a Codex hook it never registered.
• Fixed: a symptom-routed skill whose closing frontmatter fence is its last line was inlined with its YAML (triggers included) as if it were the rule.
• Fixed: a digest line that crosses into a new section keeps that section's heading in front of it — whatever opened the section (an H2, a mid-document H1, an empty heading, a setext underline) — so "Delegate to" / "Do NOT delegate" rules cannot read with the wrong polarity once joined. A skill file on disk is used only when it digests: empty, cut off inside its frontmatter, or frontmatter-only files fall back to the stored copy instead of rendering YAML as the rule.
• Fixed: on Windows, a Codex hook approval is recognised even though Codex stores the path with escaped backslashes.
• The publish gate now refuses release notes that run ahead of the package version (CHANGELOG, README, translated READMEs) — reading the newest version on the heading line, so a v20.17.3 – v20.18.0 range counts as 20.18.0, and surviving a typographic apostrophe or a BOM.

What's New in v20.17.3

• A plugin install can no longer enable the prompt-routing hook. The package's maintenance paths (npm postinstall, server startup) now only refresh a hook that an explicit prism connect previously installed — a prism MCP registration in host config no longer counts as consent. First install of the hook happens through prism connect or not at all.
• The Claude Code plugin launcher is fully deterministic. It runs the exact pinned server version with npm lifecycle scripts disabled, and the plugin now documents its security posture in plugins/prism/README.md.

What's New in v20.17.2

• Pasted logs can no longer falsely activate skills. Symptom-triggered routing now strips fenced blocks and routable skill-name mentions (including inside compound identifiers like container/pod names) from the routing view of a prompt, so quoting an agent log or a skill list doesn't load skills the text merely mentions. Skills named by ordinary words keep routing normally.
• Symptom-routed skills now arrive whole. Startup budgets deliver the full rule text at every depth that fits; when a rule genuinely cannot fit, the display says exactly how much is missing and how to load the rest, instead of silently truncating.
• Routing can no longer be silently disabled by one bad skill. Corrupt or hostile trigger tables — wrong value shapes, patterns named after object prototype properties — are skipped per entry instead of taking down all prompt routing (or, in one case, the vault export) for the session.

What's New in v20.17.1

• Fixes a broken CLI in 20.17.0 — a command-name collision made every prism CLI invocation exit with a commander error at startup (the MCP server was unaffected). The handoff-sync command is prism handoff …; prism sync remains cross-backend data synchronization. If you installed 20.17.0, update.

What's New in v20.17.0

Cross-Machine Session Handoff — End-to-End Encrypted

• Resume a session on any of your machines. With prism handoff enable (paid, off by default), each session_save_handoff seals the handoff to all your account's device keys and relays the CIPHERTEXT; another machine pulls with sync_pull_handoff (or prism handoff pull <project>) and opens it locally.
• The relay stores ciphertext only — X25519 + AES-256-GCM sealed envelopes. No key that opens a handoff ever exists server-side. The channel is deliberately separate from savings sync, which carries counters only.
• TOFU device pinning surfaces a compromised relay: sealing to a key this machine has never seen warns loudly, keyed on the client-derived recipient id so a swapped key can't hide behind a familiar device name.
• prism handoff status|devices to inspect; revoke a lost machine from the portal.

What's New in v20.16.0

See What Local Serving Saves You — Meterable, Auditable, Team-Wide

Documentation truncated — see the full README on GitHub.