@echomem/mcp 1.4.44 → 1.4.45

package/dist/hud/hooks.js

@@ -2,7 +2,6 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { atomicWriteJsonObject, readJsonObjectFile } from "../config-files.js";
 export function installHooks(mode) {
     const written = [];
     if (mode === "codex" || mode === "both" || mode === "auto") {
@@ -34,16 +33,16 @@ export function installSourceSessionHooks(mode) {
     return written;
 }
 function installCodexHooks() {
-    const dir = profileDirectory("CODEX_HOME", ".codex");
+    const dir = path.join(os.homedir(), ".codex");
     const file = path.join(dir, "hooks.json");
     fs.mkdirSync(dir, { recursive: true });
     const hookCommand = `${JSON.stringify(process.execPath)} ${JSON.stringify(process.argv[1])} summary --client codex --json`;
     const content = readHooksFile(file);
     content.hooks = content.hooks || {};
-    content.hooks.PostToolUse = mergeHookGroup(content.hooks.PostToolUse, { matcher: "*", hooks: [codexCommandHook(hookCommand, 5)] });
-    content.hooks.PostCompact = mergeHookGroup(content.hooks.PostCompact, { hooks: [codexCommandHook(hookCommand, 5)] });
-    content.hooks.Stop = mergeHookGroup(content.hooks.Stop, { hooks: [codexCommandHook(hookCommand, 5)] });
-    atomicWriteJsonObject(file, content);
+    content.hooks.PostToolUse = mergeHookGroup(content.hooks.PostToolUse, { matcher: "*", hooks: [{ type: "command", command: hookCommand, timeout: 5 }] });
+    content.hooks.PostCompact = mergeHookGroup(content.hooks.PostCompact, { hooks: [{ type: "command", command: hookCommand, timeout: 5 }] });
+    content.hooks.Stop = mergeHookGroup(content.hooks.Stop, { hooks: [{ type: "command", command: hookCommand, timeout: 5 }] });
+    fs.writeFileSync(file, JSON.stringify(content, null, 2));
     return file;
 }
 function saveCheckpointCommand() {
@@ -55,19 +54,24 @@ function sourceSessionCommand() {
     return `${JSON.stringify(process.execPath)} ${JSON.stringify(lifecycleCli)} bind-source-session`;
 }
 function installCodexSourceSessionHook() {
-    const dir = profileDirectory("CODEX_HOME", ".codex");
+    const dir = path.join(os.homedir(), ".codex");
     const file = path.join(dir, "hooks.json");
     fs.mkdirSync(dir, { recursive: true });
     const content = readHooksFile(file);
     content.hooks = content.hooks || {};
     content.hooks.SessionStart = mergeSourceSessionGroup(content.hooks.SessionStart, {
-        hooks: [codexCommandHook(sourceSessionCommand(), 5, "Binding EchoMem to this conversation")],
+        hooks: [{
+                type: "command",
+                command: sourceSessionCommand(),
+                timeout: 5,
+                statusMessage: "Binding EchoMem to this conversation",
+            }],
     });
-    atomicWriteJsonObject(file, content);
+    fs.writeFileSync(file, JSON.stringify(content, null, 2));
     return file;
 }
 function installClaudeCodeSourceSessionHook() {
-    const dir = profileDirectory("CLAUDE_CONFIG_DIR", ".claude");
+    const dir = path.join(os.homedir(), ".claude");
     const file = path.join(dir, "settings.json");
     fs.mkdirSync(dir, { recursive: true });
     const content = readHooksFile(file);
@@ -80,23 +84,28 @@ function installClaudeCodeSourceSessionHook() {
                 statusMessage: "Binding EchoMem to this conversation",
             }],
     });
-    atomicWriteJsonObject(file, content);
+    fs.writeFileSync(file, JSON.stringify(content, null, 2));
     return file;
 }
 function installCodexSaveCheckpointHook() {
-    const dir = profileDirectory("CODEX_HOME", ".codex");
+    const dir = path.join(os.homedir(), ".codex");
     const file = path.join(dir, "hooks.json");
     fs.mkdirSync(dir, { recursive: true });
     const content = readHooksFile(file);
     content.hooks = content.hooks || {};
     content.hooks.Stop = mergeSaveCheckpointGroup(content.hooks.Stop, {
-        hooks: [codexCommandHook(saveCheckpointCommand(), 10, "Checking whether completed work should be remembered")],
+        hooks: [{
+                type: "command",
+                command: saveCheckpointCommand(),
+                timeout: 10,
+                statusMessage: "Checking whether completed work should be remembered",
+            }],
     });
-    atomicWriteJsonObject(file, content);
+    fs.writeFileSync(file, JSON.stringify(content, null, 2));
     return file;
 }
 function installClaudeCodeSaveCheckpointHook() {
-    const dir = profileDirectory("CLAUDE_CONFIG_DIR", ".claude");
+    const dir = path.join(os.homedir(), ".claude");
     const file = path.join(dir, "settings.json");
     fs.mkdirSync(dir, { recursive: true });
     const content = readHooksFile(file);
@@ -109,43 +118,22 @@ function installClaudeCodeSaveCheckpointHook() {
                 statusMessage: "Checking whether completed work should be remembered",
             }],
     });
-    atomicWriteJsonObject(file, content);
+    fs.writeFileSync(file, JSON.stringify(content, null, 2));
     return file;
 }
 function installClaudeCodeSnippet() {
-    const dir = path.join(profileDirectory("CLAUDE_CONFIG_DIR", ".claude"), "echo-ctx");
+    const dir = path.join(os.homedir(), ".claude", "echo-ctx");
     fs.mkdirSync(dir, { recursive: true });
     return dir;
 }
 function readHooksFile(file) {
-    return readJsonObjectFile(file, "agent hooks");
-}
-function profileDirectory(envKey, fallbackName) {
-    const home = os.homedir();
-    const configured = process.env[envKey]?.trim();
-    if (!configured)
-        return path.join(home, fallbackName);
-    if (configured === "~")
-        return home;
-    if (configured.startsWith("~/") || configured.startsWith("~\\")) {
-        return path.join(home, configured.slice(2));
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        return typeof parsed === "object" && parsed !== null ? parsed : {};
     }
-    if (!path.isAbsolute(configured)) {
-        throw new Error(`${envKey} must be an absolute path or start with ~/`);
+    catch {
+        return {};
     }
-    return path.normalize(configured);
-}
-function codexCommandHook(command, timeout, statusMessage) {
-    return {
-        type: "command",
-        command,
-        // Codex supports an explicit Windows override. Keeping it identical is intentional: the
-        // absolute node.exe and CLI paths are already quoted, and Codex can select this field without
-        // interpreting a POSIX-only fallback.
-        commandWindows: command,
-        timeout,
-        ...(statusMessage ? { statusMessage } : {}),
-    };
 }
 function mergeHookGroup(existing, group) {
     const groups = Array.isArray(existing) ? existing.filter((item) => !isEchoHudGroup(item)) : [];

package/dist/index.js

@@ -7,11 +7,12 @@ import { ZodError } from "zod";
 import { bindSourceSessionSchema, canonicalToolNames, completeGroupPublicationSchema, createGroupInviteSchema, createGroupSchema, deleteMemorySchema, flagPublicationAttentionSchema, getGroupSessionSharingSchema, getByContextSchema, groupContextSchema, joinGroupSchema, keywordsSchema, listFriendsSchema, listToolSpecs, othersSchema, publishBatchToGroupSchema, publishToGroupSchema, prepareGroupPublicationSchema, publicMemorySchema, recordMemoryCitationsSchema, requestGroupSessionSharingSchema, resolveCanonicalToolName, saveConversationSchema, searchMemoriesSchema, searchUsersSchema, sendFriendRequestSchema, timeRangeSchema, updateGroupProfileSchema, setGroupSessionSharingSchema, } from "./v1-contract.js";
 import { KeyStore } from "./keystore.js";
 import { EventLogger, hashText } from "./events.js";
+import { buildReportText } from "./report.js";
 import { contextHealthMarkdown, recomposeCapsuleMarkdown } from "./hud/api.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { fetchEncryptionConfig, decryptMemoryFields, verifyKeyB64, } from "./encryption.js";
-import { refreshInstalledMemoryGuidance, runCli } from "./setup.js";
+import { runCli } from "./setup.js";
 import { MCP_PACKAGE_VERSION, MCP_SERVER_INSTRUCTIONS, MEMORY_CITATION_INSTRUCTION, SAVED_MEMORY_RECEIPT_INSTRUCTION, } from "./package-metadata.js";
 import { clearBillingAlert, writeBillingAlert } from "./billing-alert.js";
 import { checkLatestUpdateStatus, formatUpdateNotice, formatUpdateStatusText, startBackgroundUpdateCheck, } from "./update-check.js";
@@ -612,6 +613,8 @@ function toolEventName(canonicalName, status) {
 class EchoMemApiClient {
     store;
     axios;
+    activeToken;
+    accountGeneration = 0;
     boundSourceSession = null;
     requestSourceSession = new AsyncLocalStorage();
     sourceSessionsByCanonicalKey = new Map();
@@ -622,6 +625,7 @@ class EchoMemApiClient {
     deleteConfirmations = new Map();
     constructor(store) {
         this.store = store;
+        this.activeToken = store.getToken();
         this.axios = axios.create({
             baseURL: ECHO_API_BASE_URL.replace(/\/$/, ""),
             headers: {
@@ -631,7 +635,7 @@ class EchoMemApiClient {
         // Read the token fresh on EVERY request (not baked in at construction) so a `login` that runs
         // after the editor already launched the bridge is picked up on the next call — no restart.
         this.axios.interceptors.request.use((config) => {
-            const token = this.store.getToken();
+            const token = this.synchronizeAccountContext();
             if (token)
                 config.headers.set("Authorization", `Bearer ${token}`);
             const sourceSession = this.getBoundSourceSession();
@@ -641,21 +645,46 @@ class EchoMemApiClient {
             return config;
         });
     }
+    /**
+     * Account-scoped state must move atomically with the credential file. The token is intentionally
+     * read fresh, but encryption, identity, source-session, and confirmation caches belong to the
+     * token that populated them and cannot survive an in-process account switch.
+     */
+    synchronizeAccountContext() {
+        const token = this.store.getToken();
+        if (token === this.activeToken)
+            return token;
+        this.activeToken = token;
+        this.accountGeneration += 1;
+        this.encConfigPromise = null;
+        this.whoamiCache = null;
+        this.boundSourceSession = null;
+        this.sourceSessionsByCanonicalKey.clear();
+        this.deleteConfirmations.clear();
+        return token;
+    }
+    /** Lets the MCP server invalidate its account-scoped tool-description caches too. */
+    refreshAccountContext() {
+        this.synchronizeAccountContext();
+        return this.accountGeneration;
+    }
     /** Whether a usable API token currently exists (read fresh from the keystore each call). */
     hasToken() {
-        return !!this.store.getToken();
+        return !!this.synchronizeAccountContext();
     }
     /** The per-process session id — the join key telemetry shares with grouped saves. */
     getSessionId() {
         return this.sessionId;
     }
     getBoundSourceSession() {
+        this.synchronizeAccountContext();
         return this.requestSourceSession.getStore() ?? this.boundSourceSession;
     }
     async withSourceSession(sourceSession, operation) {
         return sourceSession ? this.requestSourceSession.run(sourceSession, operation) : operation();
     }
     async bindSourceSession(verified, persistForBridge = true) {
+        this.synchronizeAccountContext();
         const cached = this.sourceSessionsByCanonicalKey.get(verified.canonicalKey);
         if (cached) {
             if (persistForBridge)
@@ -738,16 +767,23 @@ class EchoMemApiClient {
             return undefined;
         }
     }
-    /** Encryption config for the account, fetched once and cached. Failures are not cached. */
+    /** Encryption config for the current account, cached only for the lifetime of its token. */
     async getEncryptionConfig() {
+        const generation = this.refreshAccountContext();
         if (!this.encConfigPromise) {
-            this.encConfigPromise = fetchEncryptionConfig(this.axios).catch((error) => {
-                this.encConfigPromise = null; // allow retry next call
+            const request = fetchEncryptionConfig(this.axios).catch((error) => {
+                if (this.encConfigPromise === request)
+                    this.encConfigPromise = null; // allow retry next call
                 console.error(`[encryption] config fetch failed: ${describeError(error)} — refusing memory access`);
                 throw new EncryptionStatusUnavailableError("EchoMem could not verify the account encryption state");
             });
+            this.encConfigPromise = request;
         }
-        return this.encConfigPromise;
+        const request = this.encConfigPromise;
+        const config = await request;
+        if (this.refreshAccountContext() !== generation)
+            return this.getEncryptionConfig();
+        return config;
     }
     /**
      * Resolve the encryption state for a read/write. For encrypted accounts this REQUIRES a usable
@@ -755,13 +791,19 @@ class EchoMemApiClient {
      * handing the model ciphertext. For unencrypted accounts it returns `{ enabled: false }`.
      */
     async encState() {
+        const generation = this.refreshAccountContext();
         const cfg = await this.getEncryptionConfig();
+        if (this.refreshAccountContext() !== generation)
+            return this.encState();
         if (!cfg.enabled)
             return { enabled: false };
         const key = this.store.getKey();
         if (!key)
             throw new LockedError("EchoMem vault locked");
-        if (!(await verifyKeyB64(key, cfg))) {
+        const isValid = await verifyKeyB64(key, cfg);
+        if (this.refreshAccountContext() !== generation)
+            return this.encState();
+        if (!isValid) {
             // A file-backed stale key can be removed safely; environment-provided
             // keys remain under the caller's control and are ignored until corrected.
             if (!process.env.ECHO_ENCRYPTION_KEY)
@@ -778,16 +820,23 @@ class EchoMemApiClient {
         }
     }
     async whoami() {
+        const generation = this.refreshAccountContext();
         if (!this.whoamiCache) {
-            this.whoamiCache = this.axios
+            const request = this.axios
                 .get("/api/openclaw/v1/whoami", { timeout: 6000 })
                 .then((response) => response.data)
                 .catch((error) => {
-                this.whoamiCache = null; // don't pin a token-less failure; retry once a token exists
+                if (this.whoamiCache === request)
+                    this.whoamiCache = null;
                 throw error;
             });
+            this.whoamiCache = request;
         }
-        return this.whoamiCache;
+        const request = this.whoamiCache;
+        const identity = await request;
+        if (this.refreshAccountContext() !== generation)
+            return this.whoami();
+        return identity;
     }
     async fetchMemoryById(id, enc) {
         try {
@@ -1254,6 +1303,7 @@ function capWait(pending) {
 class EchoMemMCPServer {
     server;
     client;
+    accountGeneration = 0;
     mapCache = null;
     groupMapCache = null;
     events;
@@ -1326,8 +1376,19 @@ class EchoMemMCPServer {
             platform_source: hostPlatform,
         };
     }
+    refreshAccountContext() {
+        const generation = this.client.refreshAccountContext();
+        if (generation === this.accountGeneration)
+            return;
+        this.accountGeneration = generation;
+        this.mapCache = null;
+        this.groupMapCache = null;
+        this.mapInjected = false;
+        this.groupMapInjected = false;
+    }
     setupToolHandlers() {
         this.server.setRequestHandler(ListToolsRequestSchema, async () => {
+            this.refreshAccountContext();
             const clientVersion = this.server.getClientVersion();
             this.mcpClientName = clientVersion?.name ?? this.mcpClientName;
             this.mcpClientVersion = clientVersion?.version ?? this.mcpClientVersion;
@@ -1359,6 +1420,7 @@ class EchoMemMCPServer {
             return { tools: listToolSpecs({ map, groupMap, updateNotice }) };
         });
         this.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+            this.refreshAccountContext();
             const resolvedCanonicalName = resolveCanonicalToolName(request.params.name);
             const recallRoute = routePersonalRecallInvocation(resolvedCanonicalName, request.params.arguments);
             const canonicalName = recallRoute.canonicalName;
@@ -1410,6 +1472,10 @@ class EchoMemMCPServer {
                     if (recallRoute.error) {
                         throw new McpError(ErrorCode.InvalidParams, recallRoute.error);
                     }
+                    // The usage report is a local, $0 audit — works with no login (value before signup).
+                    if (canonicalName === canonicalToolNames.report) {
+                        return { content: [{ type: "text", text: await buildReportText(false) }] };
+                    }
                     if (canonicalName === canonicalToolNames.updateStatus) {
                         if (DESKTOP_MANAGED) {
                             return {
@@ -1605,7 +1671,8 @@ class EchoMemMCPServer {
                     rec.ok = rec.error_kind === "none";
                     rec.latency_ms = Date.now() - t0;
                     this.events.record(rec);
-                    if (canonicalName !== canonicalToolNames.updateStatus &&
+                    if (canonicalName !== canonicalToolNames.report &&
+                        canonicalName !== canonicalToolNames.updateStatus &&
                         canonicalName !== canonicalToolNames.contextHealth &&
                         canonicalName !== canonicalToolNames.recompose &&
                         canonicalName !== canonicalToolNames.save &&
@@ -2697,9 +2764,6 @@ async function main() {
         // inherited descriptor — can't leave the terminal hanging after setup/migrate completes.
         process.exit(process.exitCode ?? 0);
     }
-    // Existing standalone users may receive a new runtime without re-running setup. Refresh only
-    // EchoMem's marker-owned block so stale Desktop-era instructions disappear automatically.
-    refreshInstalledMemoryGuidance();
     const store = new KeyStore();
     // Serve mode is meant to be SPAWNED by the MCP client (editor), which drives us over a piped stdin.
     // A human who runs the bare server in a terminal instead gets a process that blocks forever on stdio

package/dist/local-data-paths.js

@@ -85,3 +85,41 @@ export function resolveClaudeProjectsDir(opts = {}) {
     const root = configuredRoot("CLAUDE_CONFIG_DIR", ".claude", opts);
     return resolveReadableDirectory(root ? path.join(root, "projects") : null);
 }
+/**
+ * Resolve Claude Desktop's local Cowork sandbox root.
+ *
+ * Cowork does not write into the normal `~/.claude/projects` profile. Claude Desktop creates an
+ * OS-specific support directory and stores each local-agent session below
+ * `local-agent-mode-sessions/<org>/<conversation>/local_<id>/`. The actual transcript is nested
+ * again under that sandbox's `.claude/projects` directory.
+ */
+export function resolveClaudeCoworkSessionsDir(opts = {}) {
+    const homeDir = normalizedHomeDir(opts.homeDir ?? os.homedir());
+    if (!homeDir)
+        return null;
+    const env = opts.env ?? process.env;
+    const configured = env.CLAUDE_DESKTOP_SUPPORT_DIR;
+    let supportRoot = null;
+    if (typeof configured === "string" && configured.trim()) {
+        supportRoot = expandCurrentUserHome(configured, homeDir);
+    }
+    else {
+        const platform = opts.platform ?? process.platform;
+        if (platform === "darwin") {
+            supportRoot = path.join(homeDir, "Library", "Application Support", "Claude");
+        }
+        else if (platform === "win32") {
+            const appData = typeof env.APPDATA === "string" && env.APPDATA.trim()
+                ? expandCurrentUserHome(env.APPDATA, homeDir)
+                : path.join(homeDir, "AppData", "Roaming");
+            supportRoot = appData ? path.join(appData, "Claude") : null;
+        }
+        else {
+            const configHome = typeof env.XDG_CONFIG_HOME === "string" && env.XDG_CONFIG_HOME.trim()
+                ? expandCurrentUserHome(env.XDG_CONFIG_HOME, homeDir)
+                : path.join(homeDir, ".config");
+            supportRoot = configHome ? path.join(configHome, "Claude") : null;
+        }
+    }
+    return resolveReadableDirectory(supportRoot ? path.join(supportRoot, "local-agent-mode-sessions") : null);
+}