@codexguild/mcp 1.6.1 → 1.8.0

package/README.md

@@ -10,6 +10,7 @@ skills and MCP servers, knowledge base) and adds what has to run on your machine
 | `codexguild_scan_skills` | Audits the skills installed for every supported harness (`~/.claude/skills`, `~/.claude/plugins`, `~/.codex/skills`, `~/.agents/skills`, `~/.hermes/skills`, `~/.cursor/skills`, `~/.gemini/skills`, … and the project's own `.claude/`, `.agents/`, `.github/` skills) **offline**, with the same scanner CodexGuild runs server-side (pipe-to-shell, secret exfiltration, prompt injection, hidden unicode, config tampering…). Nothing is uploaded. |
 | `codexguild_sync` | Detects your stack with the **exact installed versions from your lockfiles** (package-lock, pnpm-lock, yarn.lock, bun.lock, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock; go.mod), the Node/Python runtime (.nvmrc, .tool-versions, engines) and your installed skills, keys it to the current repository (each project keeps its own sync window), then asks CodexGuild what changed and which installed versions have known vulnerabilities. |
 | `codexguild_scan_code` | Finds APIs that are **deprecated or removed in the versions you run** in your own code — file, line and the replacement (e.g. `app.mount` in hono 4.13 → `mount()` from `hono/mount`). Only package names and versions are sent; the code is searched locally. Runs automatically after `codexguild_sync`. |
+| `codexguild_note_save` / `codexguild_notes` | Fill in the repository from its **git remote** (credentials in the URL are dropped first), so your agent's notes — lessons it saved after correcting its own mistakes — follow the repository across machines and harnesses. `codexguild_sync` sends it too, so every session starts with them. |
 | `codexguild_upgrade_plan` | Fills in the installed version from your lockfile: ask for a package and get the releases up to the target, possibly breaking ones, removed APIs with replacements and the steps in order. |
 | `codexguild_advise` | Detects the instruction files in your project (`CLAUDE.md`, `AGENTS.md`, …) before proposing setup changes. Proposals always need your approval. |
 | `codexguild_scan_workflows` | Reviews the project's GitHub Actions workflows that run coding agents: untrusted triggers with secrets, issue/PR text in prompts or shell scripts, `pull_request_target` with fork code, unrestricted agent tools, permissions, unpinned agent actions. Runs locally. |

package/dist/codexguild-mcp.js

@@ -760,7 +760,9 @@ function formatLocalScan({ roots, reports }, verbose = false) {
 }
 
 // src/stack-detect.ts
+import { execFile } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
+import { promisify } from "node:util";
 import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { basename, dirname, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
 
@@ -1058,6 +1060,29 @@ async function detectStack(reader, base = "") {
     ranges: sent.filter((d) => !d.runtime).length - exact
   };
 }
+function normalizeRepoKey(raw) {
+  let s = (raw ?? "").trim();
+  if (!s) return null;
+  if (s.startsWith("local:")) return s.slice(0, 200).toLowerCase();
+  const scp = s.match(/^[\w.-]+@([\w.-]+):(?!\/)(.+)$/);
+  if (scp) s = `${scp[1]}/${scp[2]}`;
+  else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) {
+    try {
+      const u = new URL(s);
+      s = `${u.hostname}${u.pathname}`;
+    } catch {
+      return null;
+    }
+  } else if (/^[\w.-]+\/[\w.-]+$/.test(s)) s = `github.com/${s}`;
+  else if (!/^[\w.-]+\.[a-z]{2,}\/[\w.-]+\/[\w.\/-]+$/i.test(s)) {
+    const local = s.replace(/[^\w.#-]+/g, "-").replace(/^-+|-+$/g, "");
+    return local ? `local:${local.slice(0, 120).toLowerCase()}` : null;
+  }
+  const key = s.toLowerCase().replace(/\.git$/, "").replace(/\/+$/, "").replace(/^www\./, "");
+  const parts = key.split("/").filter(Boolean);
+  if (parts.length < 3 || parts.some((p) => !/^[\w.-]+$/.test(p) || p === "..")) return null;
+  return parts.join("/").slice(0, 200);
+}
 
 // src/stack-detect.ts
 async function read(path) {
@@ -1087,6 +1112,17 @@ async function projectKey(cwd) {
   const root = await projectRoot(cwd);
   return `${basename(root).slice(0, 100)}#${createHash2("sha256").update(root).digest("hex").slice(0, 8)}`;
 }
+async function repoKey(cwd) {
+  const root = await projectRoot(cwd);
+  const git = async (...args2) => (await promisify(execFile)("git", ["-C", root, ...args2], { timeout: 3e3 })).stdout.trim();
+  try {
+    const url = await git("config", "--get", "remote.origin.url").catch(() => "") || await git("remote", "get-url", (await git("remote")).split("\n")[0] || "origin");
+    const key = normalizeRepoKey(url);
+    if (key && !key.startsWith("local:")) return key;
+  } catch {
+  }
+  return `local:${(await projectKey(cwd)).toLowerCase()}`;
+}
 function fsReader(root) {
   const abs = (p) => p ? join2(root, ...p.split("/")) : root;
   return {
@@ -1460,6 +1496,7 @@ async function scanCode(root, deps) {
   }
   return { hits, files: files.length };
 }
+var KEY_REJECTED = "CODEXGUILD_API_KEY was rejected (revoked or deleted). Create a new agent key at https://codexguild.com/dashboard/agents, set it as CODEXGUILD_API_KEY and restart the MCP client.";
 async function applicableDeprecations(api, key, deps) {
   const packages = deps.filter((d) => d.version && !d.runtime).slice(0, 300).map((d) => ({ name: d.name, version: d.version, ...d.ecosystem ? { ecosystem: d.ecosystem } : {} }));
   if (!packages.length || !key) return [];
@@ -1469,6 +1506,7 @@ async function applicableDeprecations(api, key, deps) {
     body: JSON.stringify({ packages }),
     signal: AbortSignal.timeout(15e3)
   });
+  if (res.status === 401 || res.status === 403) throw new Error(KEY_REJECTED);
   if (!res.ok) throw new Error(`deprecation check failed (${res.status})`);
   return (await res.json()).items;
 }
@@ -1499,7 +1537,7 @@ function formatCodeScan(hits, files, checked) {
 // src/index.ts
 var API = (process.env.CODEXGUILD_API_URL || "https://api.codexguild.com/v1").replace(/\/$/, "");
 var KEY = process.env.CODEXGUILD_API_KEY ?? "";
-var VERSION = "1.6.1";
+var VERSION = "1.8.0";
 if (process.argv[2] === "guard") process.exit(await runGuard({ api: API, key: KEY }));
 var INSTRUCTION_FILES = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", "AGENTS.override.md", ".hermes.md", "HERMES.md", "GEMINI.md", ".cursorrules"];
 async function existingInstructionFiles(cwd) {
@@ -1507,14 +1545,21 @@ async function existingInstructionFiles(cwd) {
   return present.filter((f) => f !== null);
 }
 var remote = null;
+var keyRejected = false;
 function remoteClient() {
   if (!KEY) return Promise.reject(new Error("CODEXGUILD_API_KEY is not set \u2014 create an agent key in the CodexGuild dashboard."));
+  if (keyRejected) return Promise.reject(new Error(KEY_REJECTED));
   remote ??= (async () => {
     const client = new Client({ name: "codexguild-local", version: VERSION });
     await client.connect(new StreamableHTTPClientTransport(new URL(`${API}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${KEY}` } } }));
     return client;
   })().catch((e) => {
     remote = null;
+    const code = e.code;
+    if (code === 401 || code === 403) {
+      keyRejected = true;
+      throw new Error(KEY_REJECTED);
+    }
     throw e;
   });
   return remote;
@@ -1535,7 +1580,10 @@ var ENHANCED = {
   codexguild_sync: "Runs locally first: the stack (package.json, requirements.txt, go.mod, \u2026) and installed skill NAMES are detected automatically \u2014 only names/versions are sent, never file contents; you only need force/since.",
   codexguild_advise: "Runs locally first: stack, installed skills and the instruction files present in the project are detected automatically; you only need harness.",
   codexguild_debug: "Runs locally first: the project's package versions are read from its lockfiles and sent with the error \u2014 you only need error (and stack).",
-  codexguild_upgrade_plan: "Runs locally first: `from` (and the ecosystem) is read from the lockfile when you only give `package`."
+  codexguild_upgrade_plan: "Runs locally first: `from` (and the ecosystem) is read from the lockfile when you only give `package`.",
+  codexguild_note_save: "Runs locally first: `repo` is read from the git remote of the current repository \u2014 you only need text and kind.",
+  codexguild_notes: "Runs locally first: `repo` is read from the git remote of the current repository.",
+  codexguild_fix_submit: "Runs locally first: `packages` (names and versions after your changes) is read from the project's manifests and lockfiles \u2014 you only need task_id and summary. Run the package manager first so the lockfile is current."
 };
 function enhance(t) {
   const note = ENHANCED[t.name];
@@ -1548,7 +1596,9 @@ ${note}`,
       ...t.inputSchema,
       properties: { ...t.inputSchema.properties, cwd: { type: "string", description: "Project directory (defaults to the current directory)" } },
       // Filled from the lockfile here, so the agent need not pass it.
-      ...t.name === "codexguild_upgrade_plan" && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "from") } : {}
+      ...t.name === "codexguild_upgrade_plan" && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "from") } : {},
+      ...t.name === "codexguild_fix_submit" && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "packages") } : {},
+      ...(t.name === "codexguild_note_save" || t.name === "codexguild_notes") && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "repo") } : {}
     }
   };
 }
@@ -1559,11 +1609,17 @@ async function detected(name, cwd, explicit = {}) {
     const d = deps2.find((x) => !x.runtime && x.name === pkg && x.version);
     return { args: d ? { from: d.version, ...d.ecosystem ? { ecosystem: d.ecosystem } : {} } : {} };
   }
+  if (name === "codexguild_fix_submit") {
+    const { deps: deps2, lockfiles: lockfiles2 } = await detectStack2(cwd);
+    const packages = deps2.slice(0, 300).map((d) => ({ name: d.name, ...d.version ? { version: d.version } : {}, ...d.ecosystem ? { ecosystem: d.ecosystem } : {}, ...d.runtime ? { runtime: true } : {} }));
+    return { args: { packages }, summary: `CodexGuild: submitted ${packages.length} dependencies from ${lockfiles2.length ? lockfiles2.join(", ") : "manifests (no lockfile \u2014 versions are ranges)"}.` };
+  }
+  if (name === "codexguild_note_save" || name === "codexguild_notes") return { args: { repo: await repoKey(cwd) } };
   if (name === "codexguild_debug") {
     const { deps: deps2 } = await detectStack2(cwd);
     return { args: { packages: deps2.slice(0, 300).map((d) => ({ name: d.name, ...d.version ? { version: d.version } : {}, ...d.ecosystem ? { ecosystem: d.ecosystem } : {} })) } };
   }
-  const [{ deps, manifests, lockfiles, exact, ranges }, local, project] = await Promise.all([detectStack2(cwd), scanLocalSkills(), projectKey(cwd)]);
+  const [{ deps, manifests, lockfiles, exact, ranges }, local, project, repo] = await Promise.all([detectStack2(cwd), scanLocalSkills(), projectKey(cwd), repoKey(cwd)]);
   const installedSkills = await installedSkillNames(local.reports.map((r) => r.dir));
   if (name === "codexguild_advise") {
     return { args: { stack: deps, installedSkills, existingInstructionFiles: await existingInstructionFiles(cwd), project } };
@@ -1576,7 +1632,7 @@ async function detected(name, cwd, explicit = {}) {
     ...flagged.slice(0, 10).map((x) => `  - FLAGGED ${x.dir}: ${x.result.findings[0]?.title ?? ""}`),
     ...flagged.length ? ["  Run codexguild_scan_skills for details and ask the user before using flagged skills."] : []
   ].join("\n");
-  return { args: { stack: deps, installedSkills, project }, summary };
+  return { args: { stack: deps, installedSkills, project, repo }, summary };
 }
 var LINT_TOOL = {
   name: "codexguild_lint_instructions",
@@ -1655,13 +1711,13 @@ async function remoteTools() {
     try {
       return (await (await remoteClient()).listTools()).tools;
     } catch (e) {
-      if (!KEY || attempt >= RETRY_MS.length) throw e;
+      if (!KEY || keyRejected || attempt >= RETRY_MS.length) throw e;
       await new Promise((r) => setTimeout(r, RETRY_MS[attempt]));
     }
   }
 }
 function scheduleReconnect() {
-  if (reconnectTimer || !KEY) return;
+  if (reconnectTimer || !KEY || keyRejected) return;
   reconnectTimer = setInterval(async () => {
     try {
       await (await remoteClient()).listTools();
@@ -1678,7 +1734,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
   try {
     return { tools: [...LOCAL_TOOLS, ...(await remoteTools()).map(enhance)] };
   } catch (e) {
-    console.error(`CodexGuild: remote tools unavailable (${e instanceof Error ? e.message : String(e)}) \u2014 serving local tools only; retrying in the background.`);
+    const retry = KEY && !keyRejected ? "; retrying in the background" : "";
+    console.error(`CodexGuild: remote tools unavailable (${e instanceof Error ? e.message : String(e)}) \u2014 serving local tools only${retry}.`);
     scheduleReconnect();
     return { tools: LOCAL_TOOLS };
   }
@@ -1711,7 +1768,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
     }
     const r = await (await remoteClient()).callTool({ name, arguments: args2 });
     const codeNote = name === "codexguild_sync" && !r.isError ? await codeScanLocal(cwd).catch(() => null) : null;
-    const extra = [...summary ? [{ type: "text", text: summary }] : []];
+    const extra = [...summary && !r.isError ? [{ type: "text", text: summary }] : []];
     const tail = codeNote && !codeNote.startsWith("Code check:") ? [{ type: "text", text: codeNote }] : [];
     return extra.length || tail.length ? { ...r, content: [...extra, ...r.content ?? [], ...tail] } : r;
   } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codexguild/mcp",
-  "version": "1.6.1",
+  "version": "1.8.0",
   "description": "CodexGuild MCP server (stdio) \u2014 boosts your coding agent: remote CodexGuild tools plus local stack detection from lockfiles, deprecated APIs found in your own code, and offline security audits of skills, instructions and agent workflows",
   "keywords": [
     "mcp",