@codexguild/mcp 1.7.0 → 1.8.0

package/README.md

@@ -10,6 +10,7 @@ skills and MCP servers, knowledge base) and adds what has to run on your machine
 | `codexguild_scan_skills` | Audits the skills installed for every supported harness (`~/.claude/skills`, `~/.claude/plugins`, `~/.codex/skills`, `~/.agents/skills`, `~/.hermes/skills`, `~/.cursor/skills`, `~/.gemini/skills`, … and the project's own `.claude/`, `.agents/`, `.github/` skills) **offline**, with the same scanner CodexGuild runs server-side (pipe-to-shell, secret exfiltration, prompt injection, hidden unicode, config tampering…). Nothing is uploaded. |
 | `codexguild_sync` | Detects your stack with the **exact installed versions from your lockfiles** (package-lock, pnpm-lock, yarn.lock, bun.lock, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock; go.mod), the Node/Python runtime (.nvmrc, .tool-versions, engines) and your installed skills, keys it to the current repository (each project keeps its own sync window), then asks CodexGuild what changed and which installed versions have known vulnerabilities. |
 | `codexguild_scan_code` | Finds APIs that are **deprecated or removed in the versions you run** in your own code — file, line and the replacement (e.g. `app.mount` in hono 4.13 → `mount()` from `hono/mount`). Only package names and versions are sent; the code is searched locally. Runs automatically after `codexguild_sync`. |
+| `codexguild_note_save` / `codexguild_notes` | Fill in the repository from its **git remote** (credentials in the URL are dropped first), so your agent's notes — lessons it saved after correcting its own mistakes — follow the repository across machines and harnesses. `codexguild_sync` sends it too, so every session starts with them. |
 | `codexguild_upgrade_plan` | Fills in the installed version from your lockfile: ask for a package and get the releases up to the target, possibly breaking ones, removed APIs with replacements and the steps in order. |
 | `codexguild_advise` | Detects the instruction files in your project (`CLAUDE.md`, `AGENTS.md`, …) before proposing setup changes. Proposals always need your approval. |
 | `codexguild_scan_workflows` | Reviews the project's GitHub Actions workflows that run coding agents: untrusted triggers with secrets, issue/PR text in prompts or shell scripts, `pull_request_target` with fork code, unrestricted agent tools, permissions, unpinned agent actions. Runs locally. |

package/dist/codexguild-mcp.js

@@ -760,7 +760,9 @@ function formatLocalScan({ roots, reports }, verbose = false) {
 }
 
 // src/stack-detect.ts
+import { execFile } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
+import { promisify } from "node:util";
 import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { basename, dirname, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
 
@@ -1058,6 +1060,29 @@ async function detectStack(reader, base = "") {
     ranges: sent.filter((d) => !d.runtime).length - exact
   };
 }
+function normalizeRepoKey(raw) {
+  let s = (raw ?? "").trim();
+  if (!s) return null;
+  if (s.startsWith("local:")) return s.slice(0, 200).toLowerCase();
+  const scp = s.match(/^[\w.-]+@([\w.-]+):(?!\/)(.+)$/);
+  if (scp) s = `${scp[1]}/${scp[2]}`;
+  else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) {
+    try {
+      const u = new URL(s);
+      s = `${u.hostname}${u.pathname}`;
+    } catch {
+      return null;
+    }
+  } else if (/^[\w.-]+\/[\w.-]+$/.test(s)) s = `github.com/${s}`;
+  else if (!/^[\w.-]+\.[a-z]{2,}\/[\w.-]+\/[\w.\/-]+$/i.test(s)) {
+    const local = s.replace(/[^\w.#-]+/g, "-").replace(/^-+|-+$/g, "");
+    return local ? `local:${local.slice(0, 120).toLowerCase()}` : null;
+  }
+  const key = s.toLowerCase().replace(/\.git$/, "").replace(/\/+$/, "").replace(/^www\./, "");
+  const parts = key.split("/").filter(Boolean);
+  if (parts.length < 3 || parts.some((p) => !/^[\w.-]+$/.test(p) || p === "..")) return null;
+  return parts.join("/").slice(0, 200);
+}
 
 // src/stack-detect.ts
 async function read(path) {
@@ -1087,6 +1112,17 @@ async function projectKey(cwd) {
   const root = await projectRoot(cwd);
   return `${basename(root).slice(0, 100)}#${createHash2("sha256").update(root).digest("hex").slice(0, 8)}`;
 }
+async function repoKey(cwd) {
+  const root = await projectRoot(cwd);
+  const git = async (...args2) => (await promisify(execFile)("git", ["-C", root, ...args2], { timeout: 3e3 })).stdout.trim();
+  try {
+    const url = await git("config", "--get", "remote.origin.url").catch(() => "") || await git("remote", "get-url", (await git("remote")).split("\n")[0] || "origin");
+    const key = normalizeRepoKey(url);
+    if (key && !key.startsWith("local:")) return key;
+  } catch {
+  }
+  return `local:${(await projectKey(cwd)).toLowerCase()}`;
+}
 function fsReader(root) {
   const abs = (p) => p ? join2(root, ...p.split("/")) : root;
   return {
@@ -1501,7 +1537,7 @@ function formatCodeScan(hits, files, checked) {
 // src/index.ts
 var API = (process.env.CODEXGUILD_API_URL || "https://api.codexguild.com/v1").replace(/\/$/, "");
 var KEY = process.env.CODEXGUILD_API_KEY ?? "";
-var VERSION = "1.7.0";
+var VERSION = "1.8.0";
 if (process.argv[2] === "guard") process.exit(await runGuard({ api: API, key: KEY }));
 var INSTRUCTION_FILES = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", "AGENTS.override.md", ".hermes.md", "HERMES.md", "GEMINI.md", ".cursorrules"];
 async function existingInstructionFiles(cwd) {
@@ -1545,6 +1581,8 @@ var ENHANCED = {
   codexguild_advise: "Runs locally first: stack, installed skills and the instruction files present in the project are detected automatically; you only need harness.",
   codexguild_debug: "Runs locally first: the project's package versions are read from its lockfiles and sent with the error \u2014 you only need error (and stack).",
   codexguild_upgrade_plan: "Runs locally first: `from` (and the ecosystem) is read from the lockfile when you only give `package`.",
+  codexguild_note_save: "Runs locally first: `repo` is read from the git remote of the current repository \u2014 you only need text and kind.",
+  codexguild_notes: "Runs locally first: `repo` is read from the git remote of the current repository.",
   codexguild_fix_submit: "Runs locally first: `packages` (names and versions after your changes) is read from the project's manifests and lockfiles \u2014 you only need task_id and summary. Run the package manager first so the lockfile is current."
 };
 function enhance(t) {
@@ -1559,7 +1597,8 @@ ${note}`,
       properties: { ...t.inputSchema.properties, cwd: { type: "string", description: "Project directory (defaults to the current directory)" } },
       // Filled from the lockfile here, so the agent need not pass it.
       ...t.name === "codexguild_upgrade_plan" && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "from") } : {},
-      ...t.name === "codexguild_fix_submit" && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "packages") } : {}
+      ...t.name === "codexguild_fix_submit" && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "packages") } : {},
+      ...(t.name === "codexguild_note_save" || t.name === "codexguild_notes") && Array.isArray(t.inputSchema.required) ? { required: t.inputSchema.required.filter((r) => r !== "repo") } : {}
     }
   };
 }
@@ -1575,11 +1614,12 @@ async function detected(name, cwd, explicit = {}) {
     const packages = deps2.slice(0, 300).map((d) => ({ name: d.name, ...d.version ? { version: d.version } : {}, ...d.ecosystem ? { ecosystem: d.ecosystem } : {}, ...d.runtime ? { runtime: true } : {} }));
     return { args: { packages }, summary: `CodexGuild: submitted ${packages.length} dependencies from ${lockfiles2.length ? lockfiles2.join(", ") : "manifests (no lockfile \u2014 versions are ranges)"}.` };
   }
+  if (name === "codexguild_note_save" || name === "codexguild_notes") return { args: { repo: await repoKey(cwd) } };
   if (name === "codexguild_debug") {
     const { deps: deps2 } = await detectStack2(cwd);
     return { args: { packages: deps2.slice(0, 300).map((d) => ({ name: d.name, ...d.version ? { version: d.version } : {}, ...d.ecosystem ? { ecosystem: d.ecosystem } : {} })) } };
   }
-  const [{ deps, manifests, lockfiles, exact, ranges }, local, project] = await Promise.all([detectStack2(cwd), scanLocalSkills(), projectKey(cwd)]);
+  const [{ deps, manifests, lockfiles, exact, ranges }, local, project, repo] = await Promise.all([detectStack2(cwd), scanLocalSkills(), projectKey(cwd), repoKey(cwd)]);
   const installedSkills = await installedSkillNames(local.reports.map((r) => r.dir));
   if (name === "codexguild_advise") {
     return { args: { stack: deps, installedSkills, existingInstructionFiles: await existingInstructionFiles(cwd), project } };
@@ -1592,7 +1632,7 @@ async function detected(name, cwd, explicit = {}) {
     ...flagged.slice(0, 10).map((x) => `  - FLAGGED ${x.dir}: ${x.result.findings[0]?.title ?? ""}`),
     ...flagged.length ? ["  Run codexguild_scan_skills for details and ask the user before using flagged skills."] : []
   ].join("\n");
-  return { args: { stack: deps, installedSkills, project }, summary };
+  return { args: { stack: deps, installedSkills, project, repo }, summary };
 }
 var LINT_TOOL = {
   name: "codexguild_lint_instructions",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codexguild/mcp",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "CodexGuild MCP server (stdio) \u2014 boosts your coding agent: remote CodexGuild tools plus local stack detection from lockfiles, deprecated APIs found in your own code, and offline security audits of skills, instructions and agent workflows",
   "keywords": [
     "mcp",