@gamaze/hicortex 0.17.6 → 0.18.1

package/dist/viz.js

@@ -26,19 +26,20 @@
  *    construction. Public like the /viz shell (static public code, no data).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VIZ_VENDOR_FILES = void 0;
+exports.contextUiHandler = exports.readContextHtml = exports.resolveContextHtmlPath = exports.VIZ_VENDOR_FILES = void 0;
 exports.createAuthMiddleware = createAuthMiddleware;
 exports.resolveVizHtmlPath = resolveVizHtmlPath;
 exports.readVizHtml = readVizHtml;
 exports.vizHandler = vizHandler;
-exports.resolveContextHtmlPath = resolveContextHtmlPath;
-exports.readContextHtml = readContextHtml;
-exports.contextUiHandler = contextUiHandler;
+exports.resolveIdentityHtmlPath = resolveIdentityHtmlPath;
+exports.readIdentityHtml = readIdentityHtml;
+exports.identityUiHandler = identityUiHandler;
 exports.resolveDashboardHtmlPath = resolveDashboardHtmlPath;
 exports.readDashboardHtml = readDashboardHtml;
 exports.dashboardHandler = dashboardHandler;
 exports.resolveVizVendorPath = resolveVizVendorPath;
 exports.vizVendorHandler = vizVendorHandler;
+const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 // ---------------------------------------------------------------------------
@@ -58,14 +59,42 @@ exports.VIZ_VENDOR_FILES = new Set([
 // ---------------------------------------------------------------------------
 // Auth middleware
 // ---------------------------------------------------------------------------
+/**
+ * Constant-time bearer comparison (#254). Compares the FULL `Authorization`
+ * header (not just the token portion) against the expected `Bearer <token>`
+ * form. This couples the scheme + token into one fixed-length secret, so a
+ * caller cannot learn anything about the token by varying the scheme prefix.
+ *
+ * `crypto.timingSafeEqual` THROWS RangeError on mismatched buffer lengths, so
+ * the length check MUST gate the call. The short-circuit on `a.length !==
+ * b.length` leaks only the header LENGTH — which is already visible on the
+ * wire (HTTP header sizes are not secret); the secret token bytes are never
+ * compared byte-by-byte through a timing side channel.
+ */
+function safeBearerMatch(headerValue, expectedToken) {
+    if (!headerValue)
+        return false;
+    const a = Buffer.from(headerValue);
+    const b = Buffer.from(`Bearer ${expectedToken}`);
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
+}
 /**
  * Bearer token auth — ALWAYS installed, fail-closed. /health, the /viz page
  * shell, and localhost bypass (OPTIONS is short-circuited by the CORS
  * middleware before this runs). With no token configured, remote requests are
  * REJECTED (not open): the default bind is 0.0.0.0, so "no token = no auth"
  * would expose the whole memory store to the network.
+ *
+ * `authTokenPrevious` (optional, #254) is the prior token kept around during
+ * rotation. Both tokens are accepted; this gives a zero-downtime rotation
+ * window — in-flight clients configured with the old token keep working until
+ * they pick up the new one. BOTH comparisons are constant-time and both are
+ * always evaluated (no short-circuit), so a caller cannot learn WHICH token
+ * matched from the response timing. Absent/empty `authTokenPrevious` behaves
+ * exactly as the single-token middleware always has.
  */
-function createAuthMiddleware(authToken) {
+function createAuthMiddleware(authToken, authTokenPrevious) {
+    const previous = authTokenPrevious && authTokenPrevious.length > 0 ? authTokenPrevious : undefined;
     return (req, res, next) => {
         if (req.path === "/health")
             return next();
@@ -76,13 +105,15 @@ function createAuthMiddleware(authToken) {
         // normal Authorization header on its data fetches.
         if (req.method === "GET" && req.path === "/viz")
             return next();
-        // The /context/ui page SHELL is public for the same reason as /viz: a
+        // The /identity/ui page SHELL is public for the same reason as /viz: a
         // self-contained static editor page, no data and no secrets (it ships
-        // verbatim in the npm tarball). The standing-context DATA it edits comes
-        // from GET/PUT /context, which stay bearer-only (localhost bypass) like
+        // verbatim in the npm tarball). The standing-identity DATA it edits comes
+        // from GET/PUT /identity, which stay bearer-only (localhost bypass) like
         // every other data route; the page collects the token client-side and
-        // sends it as a normal Authorization header on its /context fetches.
-        if (req.method === "GET" && req.path === "/context/ui")
+        // sends it as a normal Authorization header on its /identity fetches.
+        // #264 backcompat: the legacy /context/ui URL is also exempted (the alias
+        // route serves the same shell).
+        if (req.method === "GET" && (req.path === "/identity/ui" || req.path === "/context/ui"))
             return next();
         // The /dashboard page SHELL is public for the same reason as /viz and
         // /context/ui: a self-contained view-only analytics page, no data and no
@@ -113,10 +144,20 @@ function createAuthMiddleware(authToken) {
         const ip = req.ip ?? req.socket.remoteAddress ?? "";
         if (ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1")
             return next();
-        if (authToken && req.headers.authorization === `Bearer ${authToken}`)
+        // Constant-time bearer check (#254). When authTokenPrevious is set, BOTH
+        // tokens are compared every request (no short-circuit) so timing cannot
+        // reveal which one matched. The OR of the two booleans is the accept
+        // signal — evaluated after both comparisons complete.
+        const header = req.headers.authorization;
+        const matchesCurrent = authToken ? safeBearerMatch(header, authToken) : false;
+        const matchesPrevious = previous ? safeBearerMatch(header, previous) : false;
+        if (matchesCurrent || matchesPrevious)
             return next();
         res.status(401).json({
-            error: authToken
+            // Gate on (authToken || previous): in the mixed-config edge case
+            // (authToken unset, authTokenPrevious set) the middleware still accepts
+            // the previous token — so "No auth token configured" would mislead.
+            error: (authToken || previous)
                 ? "Unauthorized"
                 : "No auth token configured on this server — run `npx @gamaze/hicortex init` on the server, then connect with its token.",
         });
@@ -154,54 +195,69 @@ function vizHandler() {
             res.type("html").send(readVizHtml());
         }
         catch (err) {
-            res.status(503).json({ error: err instanceof Error ? err.message : String(err) });
+            // /viz is a PUBLIC, UNAUTHENTICATED route — the catch must NOT echo the
+            // filesystem path of the failed readFileSync to an anonymous remote
+            // caller (#253). Log full detail server-side, return a generic body.
+            const detail = err instanceof Error ? (err.stack ?? `${err.name}: ${err.message}`) : String(err);
+            console.error(`[hicortex] /viz: ${detail}`);
+            res.status(503).json({ error: "Asset unavailable" });
         }
     };
 }
 // ---------------------------------------------------------------------------
-// Context layer editor page (/context/ui, 0.12 — spec 2026-07-12 §5)
+// Identity layer editor page (/identity/ui, 0.12 — spec 2026-07-12 §5; renamed
+// from /context/ui in 0.18 #264)
 // ---------------------------------------------------------------------------
 /**
- * Resolve the on-disk path of the context-layer editor page. Throws (fail
+ * Resolve the on-disk path of the identity-layer editor page. Throws (fail
  * explicitly) when the asset is missing — same contract as resolveVizHtmlPath.
  * assets/ sits next to both dist/ (dist/viz.js → ../assets/) and src/
  * (src/viz.ts → ../assets/ under tsx), so one sibling candidate covers both.
  */
-function resolveContextHtmlPath() {
-    const candidates = [(0, node_path_1.join)(__dirname, "..", "assets", "context.html")];
+function resolveIdentityHtmlPath() {
+    const candidates = [(0, node_path_1.join)(__dirname, "..", "assets", "identity.html")];
     for (const candidate of candidates) {
         if ((0, node_fs_1.existsSync)(candidate))
             return candidate;
     }
-    throw new Error(`context.html asset not found — looked in: ${candidates.join(", ")}. ` +
+    throw new Error(`identity.html asset not found — looked in: ${candidates.join(", ")}. ` +
         `The package install is incomplete (assets/ missing).`);
 }
-/** Read the context editor page. Read at request time so a reinstall is live. */
-function readContextHtml() {
-    return (0, node_fs_1.readFileSync)(resolveContextHtmlPath(), "utf-8");
+/** Read the identity editor page. Read at request time so a reinstall is live. */
+function readIdentityHtml() {
+    return (0, node_fs_1.readFileSync)(resolveIdentityHtmlPath(), "utf-8");
 }
 /**
- * Express handler for GET /context/ui — the PRIMARY edit surface for the
- * standing context layer. 503 with the usual {error} shape when the asset
- * cannot be read, exactly like vizHandler.
+ * Express handler for GET /identity/ui — the PRIMARY edit surface for the
+ * standing identity layer. 503 with the usual {error} shape when the asset
+ * cannot be read, exactly like vizHandler. Also serves the legacy
+ * /context/ui URL (#264 backcompat).
  */
-function contextUiHandler() {
+function identityUiHandler() {
     return (_req, res) => {
         try {
-            res.type("html").send(readContextHtml());
+            res.type("html").send(readIdentityHtml());
         }
         catch (err) {
-            res.status(503).json({ error: err instanceof Error ? err.message : String(err) });
+            // /identity/ui is a PUBLIC, UNAUTHENTICATED route (#253) — same
+            // sanitisation as vizHandler: log detail server-side only.
+            const detail = err instanceof Error ? (err.stack ?? `${err.name}: ${err.message}`) : String(err);
+            console.error(`[hicortex] /identity/ui: ${detail}`);
+            res.status(503).json({ error: "Asset unavailable" });
         }
     };
 }
+/** Backcompat aliases (#264). */
+exports.resolveContextHtmlPath = resolveIdentityHtmlPath;
+exports.readContextHtml = readIdentityHtml;
+exports.contextUiHandler = identityUiHandler;
 // ---------------------------------------------------------------------------
 // Dashboard page (/dashboard, #224 — view-only memory analytics)
 // ---------------------------------------------------------------------------
 /**
  * Resolve the on-disk path of the dashboard page. Throws (fail explicitly)
  * when the asset is missing — same contract as resolveVizHtmlPath and
- * resolveContextHtmlPath. assets/ sits next to both dist/ and src/ (the
+ * resolveIdentityHtmlPath. assets/ sits next to both dist/ and src/ (the
  * sibling layout the other resolvers rely on).
  */
 function resolveDashboardHtmlPath() {
@@ -220,7 +276,7 @@ function readDashboardHtml() {
 /**
  * Express handler for GET /dashboard — the view-only analytics page (#224).
  * 503 with the usual {error} shape when the asset cannot be read, exactly like
- * vizHandler and contextUiHandler. The page SHELL is public (exempted in
+ * vizHandler and identityUiHandler. The page SHELL is public (exempted in
  * createAuthMiddleware); all data comes from GET /dashboard/data (bearer-only).
  */
 function dashboardHandler() {
@@ -229,7 +285,11 @@ function dashboardHandler() {
             res.type("html").send(readDashboardHtml());
         }
         catch (err) {
-            res.status(503).json({ error: err instanceof Error ? err.message : String(err) });
+            // /dashboard is a PUBLIC, UNAUTHENTICATED route (#253) — same
+            // sanitisation as vizHandler: log detail server-side only.
+            const detail = err instanceof Error ? (err.stack ?? `${err.name}: ${err.message}`) : String(err);
+            console.error(`[hicortex] /dashboard: ${detail}`);
+            res.status(503).json({ error: "Asset unavailable" });
         }
     };
 }
@@ -268,9 +328,14 @@ function vizVendorHandler() {
             res.send(body);
         }
         catch (err) {
+            // /viz/vendor/* is a PUBLIC, UNAUTHENTICATED route (#253) — same
+            // sanitisation as the other public asset routes: log detail server-side
+            // only, return a generic body. The allowlisted filename is fine to echo
+            // (it came from the fixed VIZ_VENDOR_FILES table, not the filesystem).
+            const detail = err instanceof Error ? (err.stack ?? `${err.name}: ${err.message}`) : String(err);
+            console.error(`[hicortex] /viz/vendor/${file}: ${detail}`);
             res.status(503).json({
-                error: `Vendor asset ${file} is missing — the package install is incomplete ` +
-                    `(assets/vendor/ missing): ${err instanceof Error ? err.message : String(err)}`,
+                error: `Vendor asset ${file} unavailable — the package install is incomplete (assets/vendor/ missing)`,
             });
         }
     };

package/hermes-plugin/hicortex/README.md

@@ -22,12 +22,14 @@ That's the whole surface. No `sync_turn`, no compaction/session-end capture —
 
 ### Pushed recall index (0.7.0, server ≥ 0.14)
 
-Instead of injecting full memory content every turn, `prefetch` sends the user's message to the server's `POST /recall-index` and injects the returned **index block** verbatim — one line per memory (id, title, date), capped and relevance-gated server-side. The agent fetches full content with `hicortex_get(id)` only when a line is actually relevant; that fetch is what strengthens the memory (exposure ≠ use). All tuning knobs (`recallMaxItems`, `recallMinSimilarity`, `recallReshowTurns`, `recallMinPromptChars`, …) live in the **server** config — the plugin carries none. Dedup is turn-based and server-side per session; the plugin resets it at `initialize` (the Hermes `MemoryProvider` interface exposes no compaction signal, so a mid-session context rebuild cannot trigger a reset — the server's turn-based re-show window covers that gap). Against a pre-0.14 server (404) the plugin falls back to the 0.6.x `GET /search` full-content prefetch, fail-soft, re-probing the endpoint every 10 minutes so a later server upgrade is picked up without a gateway restart. The recall calls carry the profile's configured `default_project` (and `mission_domains`) and use a short dedicated timeout (1.5 s) so a slow server can never stall a turn. (`privacy_filter` is deprecated since 0.7.2 — the server ignores privacy; see [Configuration](#configuration).)
+Instead of injecting full memory content every turn, `prefetch` sends the user's message to the server's `POST /recall-index` and injects the returned **index block** verbatim — one line per memory (id, title, date), capped and relevance-gated server-side. The agent fetches full content with `hicortex_get(id)` only when a line is actually relevant; that fetch is what strengthens the memory (exposure ≠ use). All tuning knobs (`recallMaxItems`, `recallMinSimilarity`, `recallReshowTurns`, `recallMinPromptChars`, …) live in the **server** config — the plugin carries none. Dedup is turn-based and server-side per session; the plugin resets it at `initialize` (the Hermes `MemoryProvider` interface exposes no compaction signal, so a mid-session context rebuild cannot trigger a reset — the server's turn-based re-show window covers that gap). Against a pre-0.14 server (404) the plugin falls back to the 0.6.x `GET /search` full-content prefetch, fail-soft, re-probing the endpoint every 10 minutes so a later server upgrade is picked up without a gateway restart. The recall calls carry the profile's configured `default_project` (and `mission_domains`) and use a short dedicated timeout (1.5 s) so a slow server can never stall a turn. (`privacy_filter` is deprecated since 0.7.2 — the server ignores privacy; see [Configuration](#configure-activate).)
 
 ### Per-agent standing context (0.13)
 
 `system_prompt_block()` also injects the hand-edited **standing context layer** (`## Context`, above the lessons block) — "who you are + how to work", distinct from episodic memory. The server resolves it **per agent**: this profile's own sections override the global set (`override`), or it can be `global` or `off`. See the main repo's `/context` layer docs.
 
+> **Note (#264 rename):** the server-side layer was renamed Context → Identity in 0.18. The `/context` endpoint remains as an alias so this plugin keeps working unchanged; the heading is still rendered as `## Context` here and will switch to `## Identity` in a follow-up plugin release. No action needed.
+
 The plugin sends its **profile name** as `?agent=`, resolved in this order:
 
 1. `agent_name` in the plugin config (explicit override);
@@ -79,7 +81,7 @@ Run it once per profile if you use Hermes profiles. Hermes allows **one** extern
 Config fields (`hicortex_url`, `default_project`, `recall_limit`, `privacy_filter`, `agent_name`) can also be written to `$HERMES_HOME/plugins/hicortex/config.json` directly. `agent_name` pins the per-agent context id for this profile (leave blank to auto-derive — see [Per-agent standing context](#per-agent-standing-context-013)). The auth token is a **secret** — set it via env, not the JSON file:
 
 ```bash
-export HICORTEX_AUTH_TOKEN=hctx-default-token   # or your custom token
+export HICORTEX_AUTH_TOKEN=hctx-<your-token>   # or your custom token
 ```
 
 Env overrides: `HICORTEX_URL`, `HICORTEX_AUTH_TOKEN`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gamaze/hicortex",
-  "version": "0.17.6",
-  "description": "Self-learning memory for AI agents — experience captured automatically, distilled into lessons overnight, shared across your whole fleet. Works with Hermes, OpenClaw, Claude Code, and Pi.",
+  "version": "0.18.1",
+  "description": "Persistent agent identity for AI agents — a hand-edited identity layer, nightly-distilled experience, and lessons injected every session, shared across your whole fleet. Works with Hermes, OpenClaw, Claude Code, and Pi.",
   "main": "dist/index.js",
   "bin": {
     "hicortex": "dist/cli.js"

package/dist/context-cli.d.ts

@@ -1,69 +0,0 @@
-/**
- * context-cli — `hicortex context show|edit`, the secondary/headless edit
- * surface for the standing context layer (spec 2026-07-12 §6). The Web UI
- * (`/context/ui`) is primary; this exists for boxes without a browser.
- *
- *   hicortex context show [name]   GET /context → print all sections, or one
- *   hicortex context edit <name>   GET section → $EDITOR → PUT if changed
- *
- * URL/token resolution mirrors lessons-context.ts:44-49 (client mode →
- * config.serverUrl; server mode → http://127.0.0.1:<port>; token from
- * config.authToken) — explicitly NOT the hardcoded 127.0.0.1:8787 of
- * status.ts. Fails soft with a clear message + non-zero exit on any server
- * error, distinguishing a down server from an HTTP error (esp. 404 = server
- * too old / wrong endpoint), like the OC plugin's describeGetFailure.
- */
-/** Thrown for any expected, user-facing failure. cli.ts prints .message + exits 1. */
-export declare class ContextCliError extends Error {
-}
-export interface ContextServerTarget {
-    baseUrl: string;
-    authToken?: string;
-}
-/**
- * Resolve the server URL + token from a parsed config object. Pure + exported
- * so it is unit-testable without a live config. Follows lessons-context.ts.
- */
-export declare function resolveContextTarget(config: Record<string, unknown>): ContextServerTarget;
-/** Read ~/.hicortex/config.json (or $HICORTEX_HOME/config.json). Missing → {}. */
-export declare function loadConfig(): Record<string, unknown>;
-/** The Save decision: PUT only when the edited content differs. Pure + tested. */
-export declare function sectionChanged(before: string, after: string): boolean;
-export interface ContextGetResponse {
-    sections: Record<string, string>;
-    updated_at: string | null;
-    clients: string[];
-    /** Present only for an agent-scoped read (0.13). */
-    agent?: string;
-    mode?: string;
-}
-/** GET /context. Throws ContextCliError with a clear message on any failure. */
-export declare function getContext(target: ContextServerTarget, agent?: string): Promise<ContextGetResponse>;
-/** PUT one section. Throws ContextCliError with a clear message on any failure. */
-export declare function putSection(target: ContextServerTarget, name: string, content: string, agent?: string): Promise<void>;
-/** Readable rendering of every section + the resolved clients line (show, no name). */
-export declare function formatAllSections(data: ContextGetResponse): string;
-/** Raw markdown for one section (show <name>), or null if it does not exist. */
-export declare function formatOneSection(data: ContextGetResponse, name: string): string | null;
-/**
- * Default editor spawn: opens `file` in the first available editor, blocking
- * until it exits. Returns true if an editor ran, false if none was found.
- * Injectable so tests never actually spawn an editor.
- */
-export type EditorSpawn = (file: string) => boolean;
-/**
- * `edit <name>`: validate name (fast-fail; the server enforces too) → fetch
- * current content → $EDITOR on a temp file → PUT only if changed. Temp file is
- * always cleaned up. `spawn` is injectable for tests.
- */
-export declare function runEdit(name: string, spawn?: EditorSpawn, agent?: string): Promise<void>;
-/**
- * Split out a `--agent <id>` flag (anywhere in argv) from the positional args.
- * The flag omitted → the global scope.
- */
-export declare function extractAgentFlag(args: string[]): {
-    agent?: string;
-    rest: string[];
-};
-/** Dispatch for `hicortex context <sub>`. Throws ContextCliError on bad usage/failure. */
-export declare function runContextCommand(args: string[]): Promise<void>;

package/dist/lessons-context.d.ts

@@ -1,102 +0,0 @@
-/**
- * lessons-context — query-time context injection for the CC SessionStart hook.
- *
- * Replaces file-based injection (injectLessons / injectLessonsFromServer).
- * Reads ~/.hicortex/config.json to find the server URL, then fetches TWO
- * endpoints concurrently and prints a compact Markdown block to stdout so CC
- * picks it up as session context:
- *
- *   GET /context  → the standing context layer (user info + rules; 0.12).
- *                   Injected as a `## Context` block ONLY when this harness
- *                   ("cc") is in the server-resolved `clients` list (self-gate).
- *   GET /lessons  → episodic memory lessons + memory index, rendered as the
- *                   existing `## Hicortex Memory` block.
- *
- * The two fetches run in Promise.all, each with its OWN 3 s timeout and
- * INDEPENDENT fail-soft: a /context failure must never cost the lessons block,
- * and vice versa. Sequential fetches would double worst-case SessionStart
- * latency (~6 s) — see spec §7.
- *
- * Fail-soft by design: ANY failure (missing config, network error, non-2xx,
- * parse error) results in silent exit-0. A broken hook must never block a
- * CC session, and a broken /context fetch must never blank the whole output.
- */
-/**
- * The GET /context response shape, shared by the CC hook and the OC plugin so
- * their gating cannot drift. `agent`/`mode` are echoed by a 0.13 server whenever
- * `?agent=` was sent (in EVERY mode); a pre-0.13 server omits them.
- */
-export interface ContextResponse {
-    sections?: Record<string, string>;
-    updated_at?: string;
-    clients?: string[];
-    agent?: string;
-    mode?: string;
-}
-export interface ResolvedConfig {
-    serverUrl: string;
-    authToken: string | undefined;
-    home: string;
-    /** Per-agent context id sent as ?agent= (0.13); null → global (no param). */
-    agentName: string | null;
-    /** Max lessons to inject (config.lessonsLimit, default 10). */
-    lessonsLimit?: number;
-}
-/**
- * Read ~/.hicortex/config.json and resolve the server URL + auth token, or
- * null when there is no usable config (server not set up yet — fail soft).
- * Exported for reuse by the recall-hook CLI (#192) so the two CC hooks can
- * never resolve the server differently.
- */
-export declare function resolveConfig(): ResolvedConfig | null;
-/**
- * Title-case a section name for its heading: split on `-`/`_`, capitalize each
- * word ("user" → "User", "my_notes" → "My Notes").
- * Exported so the OC plugin (index.ts) renders the `## Context` block
- * identically to the CC hook rather than duplicating the logic.
- */
-export declare function titleCaseSection(name: string): string;
-/**
- * Stable section ordering: `user` first, then `rules` (the seeded primary
- * sections, spec §8), then every other section alphabetically. Server-side
- * enumeration order (readdirSync) is FS-dependent, so we sort here for a
- * deterministic injection block. Exported for reuse by the OC plugin.
- */
-export declare function orderSectionNames(names: string[]): string[];
-/**
- * Render the `## Context` block from a resolved section map, or null when there
- * is nothing to inject (no sections, or every section blank after trimming).
- * Pure — no gating, no I/O. Shared verbatim by the CC hook and the OC plugin so
- * both harnesses emit an identical block. Sections are ordered (user, rules,
- * then alphabetical) and rendered under title-cased `###` headings.
- */
-export declare function renderContextBlock(sections: Record<string, string>): string | null;
-/**
- * Gate a GET /context response and render the `## Context` block, or null when
- * nothing should be injected: `harness` not in the server-resolved `clients`,
- * an empty/blank section set, or — when `requireAgentEcho` — a response that
- * does not echo `agent`. The SINGLE gate used by both CC and OC so the two can
- * never drift (the Python Hermes plugin `provider.py::_context_block` mirrors
- * this logic — keep them in sync).
- *
- * `requireAgentEcho` is the old-server guard, and it is the CALLER's decision:
- *   - OC passes `agentId !== null` — when it actually sent an id, a 0.12 server
- *     that ignores `?agent=` (200 global, no echo) must NOT leak global context
- *     into every persona; on a bare fetch (no id) the guard is off (amendment
- *     A2).
- *   - CC passes `false` ALWAYS and deliberately (see the call site): a thin CC
- *     client auto-upgrades via npx BEFORE the server does, so during the upgrade
- *     window it talks to a 0.12 server that cannot hold ANY per-agent config —
- *     global IS the operator's intended state there, and a guard would instead
- *     blank ALL context for every CC session in that window.
- */
-export declare function gateAndRenderContext(data: ContextResponse, harness: string, opts: {
-    requireAgentEcho: boolean;
-}): string | null;
-/**
- * Fetch context + lessons concurrently and return the combined Markdown block,
- * or null when neither yields anything (nothing to inject; caller prints
- * nothing and exits 0). The `## Context` block is prepended before the existing
- * `## Hicortex Memory` block.
- */
-export declare function fetchLessonsContext(): Promise<string | null>;