@gamaze/hicortex 0.3.12 → 0.3.14

package/dist/llm.d.ts

@@ -85,6 +85,7 @@ export declare class LlmClient {
     completeDistill(prompt: string, maxTokens?: number): Promise<string>;
     /**
      * Complete with overridden baseUrl/apiKey/provider (used for reflect tier with separate endpoint).
+     * Creates a temporary LlmClient to avoid mutating shared config under concurrent calls.
      */
     private completeWithOverride;
     private complete;

package/dist/llm.js

@@ -199,34 +199,6 @@ function readOcProviderBaseUrl(config, provider) {
         return providerConfig.baseUrl;
     return undefined;
 }
-/**
- * Read provider base URL from per-agent models.json files.
- * Scans all agent dirs for a matching provider entry.
- */
-function readAgentModelsBaseUrl(provider) {
-    try {
-        const { readdirSync } = require("node:fs");
-        const agentsDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".openclaw", "agents");
-        const agents = readdirSync(agentsDir);
-        for (const agentId of agents) {
-            try {
-                const modelsPath = (0, node_path_1.join)(agentsDir, agentId, "agent", "models.json");
-                const raw = (0, node_fs_1.readFileSync)(modelsPath, "utf-8");
-                const models = JSON.parse(raw);
-                const providerConfig = models?.providers?.[provider];
-                if (providerConfig?.baseUrl)
-                    return providerConfig.baseUrl;
-            }
-            catch {
-                // Skip agents without models.json
-            }
-        }
-    }
-    catch {
-        // No agents dir
-    }
-    return undefined;
-}
 /**
  * Read API key from OC's per-agent auth-profiles.json.
  * Scans all agent dirs for a matching provider profile.
@@ -337,9 +309,6 @@ const PROVIDER_BASE_URLS = {
 function getDefaultUrlForProvider(provider) {
     return PROVIDER_BASE_URLS[provider.toLowerCase()] ?? "https://api.openai.com/v1";
 }
-function getEnvKeyForZai() {
-    return process.env.ZAI_API_KEY ?? process.env.LLM_API_KEY;
-}
 /**
  * Find the claude CLI binary. Returns the full path or null.
  */
@@ -438,24 +407,16 @@ class LlmClient {
     }
     /**
      * Complete with overridden baseUrl/apiKey/provider (used for reflect tier with separate endpoint).
+     * Creates a temporary LlmClient to avoid mutating shared config under concurrent calls.
      */
     async completeWithOverride(baseUrl, apiKey, provider, model, prompt, maxTokens, timeoutMs) {
-        if (this.isRateLimited) {
-            throw new RateLimitError(this.rateLimitedUntil - Date.now());
-        }
-        // Temporarily swap config for this call
-        const saved = { baseUrl: this.config.baseUrl, apiKey: this.config.apiKey, provider: this.config.provider };
-        this.config.baseUrl = baseUrl;
-        this.config.apiKey = apiKey;
-        this.config.provider = provider;
-        try {
-            return await this.complete(model, prompt, maxTokens, timeoutMs);
-        }
-        finally {
-            this.config.baseUrl = saved.baseUrl;
-            this.config.apiKey = saved.apiKey;
-            this.config.provider = saved.provider;
-        }
+        const tempClient = new LlmClient({
+            ...this.config,
+            baseUrl,
+            apiKey,
+            provider,
+        });
+        return tempClient.complete(model, prompt, maxTokens, timeoutMs);
     }
     async complete(model, prompt, maxTokens, timeoutMs) {
         if (this.isRateLimited) {
@@ -530,7 +491,8 @@ class LlmClient {
      */
     async completeAnthropic(model, prompt, maxTokens, timeoutMs) {
         const baseUrl = this.config.baseUrl.replace(/\/$/, "");
-        const url = `${baseUrl}/v1/messages`;
+        const hasVersion = /\/v\d+\/?$/.test(baseUrl);
+        const url = hasVersion ? `${baseUrl}/messages` : `${baseUrl}/v1/messages`;
         const resp = await fetch(url, {
             method: "POST",
             headers: {

package/dist/mcp-server.js

@@ -178,7 +178,7 @@ async function startServer(options = {}) {
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     console.log(`[hicortex] Initializing database at ${dbPath}`);
     db = (0, db_js_1.initDb)(dbPath);
-    stateDir = dbPath.replace(/\/hicortex\.db$/, "");
+    stateDir = require("node:path").dirname(dbPath);
     // LLM config: check config.json first, then env vars, then claude CLI
     const savedConfig = readConfigFile(stateDir);
     let llmConfig;
@@ -189,9 +189,24 @@ async function startServer(options = {}) {
         }
         else {
             console.warn("[hicortex] claude-cli configured but claude binary not found, falling back");
-            llmConfig = (0, llm_js_1.resolveLlmConfigForCC)();
+            llmConfig = (0, llm_js_1.resolveLlmConfigForCC)({
+                llmBaseUrl: savedConfig?.llmBaseUrl,
+                llmApiKey: savedConfig?.llmApiKey,
+                llmModel: savedConfig?.llmModel,
+                reflectModel: savedConfig?.reflectModel,
+            });
         }
     }
+    else if (savedConfig?.llmBackend === "ollama") {
+        // Ollama: no API key needed, default to localhost:11434
+        llmConfig = {
+            baseUrl: savedConfig.llmBaseUrl ?? "http://localhost:11434",
+            apiKey: "",
+            model: savedConfig.llmModel ?? "qwen3.5:4b",
+            reflectModel: savedConfig.reflectModel ?? savedConfig.llmModel ?? "qwen3.5:4b",
+            provider: "ollama",
+        };
+    }
     else {
         llmConfig = (0, llm_js_1.resolveLlmConfigForCC)({
             llmBaseUrl: savedConfig?.llmBaseUrl,
@@ -242,25 +257,7 @@ async function startServer(options = {}) {
     // Express app
     const app = (0, express_1.default)();
     app.use(express_1.default.json());
-    // Optional bearer token auth (skip for /health and localhost when no token)
-    if (authToken) {
-        console.log(`[hicortex] Bearer token auth enabled`);
-        app.use((req, res, next) => {
-            // Always allow health endpoint
-            if (req.path === "/health")
-                return next();
-            // Allow localhost without auth
-            const ip = req.ip ?? req.socket.remoteAddress ?? "";
-            if (ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1")
-                return next();
-            // Check bearer token
-            const auth = req.headers.authorization;
-            if (auth === `Bearer ${authToken}`)
-                return next();
-            res.status(401).json({ error: "Unauthorized" });
-        });
-    }
-    // CORS: allow Claude Desktop (https://claude.ai) and other browser-based MCP clients
+    // CORS: must be before auth so preflight OPTIONS requests get proper headers
     app.use((req, res, next) => {
         const origin = req.headers.origin;
         if (origin) {
@@ -268,6 +265,7 @@ async function startServer(options = {}) {
             res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
             res.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, Authorization");
             res.setHeader("Access-Control-Allow-Credentials", "true");
+            res.setHeader("Vary", "Origin");
         }
         if (req.method === "OPTIONS") {
             res.status(204).end();
@@ -275,6 +273,21 @@ async function startServer(options = {}) {
         }
         next();
     });
+    // Optional bearer token auth (skip for /health, OPTIONS, and localhost)
+    if (authToken) {
+        console.log(`[hicortex] Bearer token auth enabled`);
+        app.use((req, res, next) => {
+            if (req.path === "/health")
+                return next();
+            const ip = req.ip ?? req.socket.remoteAddress ?? "";
+            if (ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1")
+                return next();
+            const auth = req.headers.authorization;
+            if (auth === `Bearer ${authToken}`)
+                return next();
+            res.status(401).json({ error: "Unauthorized" });
+        });
+    }
     // SSE transport management — each connection gets its own McpServer instance
     const transports = new Map();
     // Health endpoint
@@ -297,7 +310,14 @@ async function startServer(options = {}) {
         transport.onclose = () => {
             transports.delete(transport.sessionId);
         };
-        await mcpServer.connect(transport);
+        try {
+            await mcpServer.connect(transport);
+        }
+        catch (err) {
+            transports.delete(transport.sessionId);
+            if (!res.headersSent)
+                res.status(500).json({ error: "MCP connect failed" });
+        }
     });
     // Message endpoint — client POSTs MCP messages here
     app.post("/messages", async (req, res) => {
@@ -307,8 +327,14 @@ async function startServer(options = {}) {
             return;
         }
         const transport = transports.get(sessionId);
-        // Pass parsed body since express.json() already consumed the stream
-        await transport.handlePostMessage(req, res, req.body);
+        try {
+            // Pass parsed body since express.json() already consumed the stream
+            await transport.handlePostMessage(req, res, req.body);
+        }
+        catch (err) {
+            if (!res.headersSent)
+                res.status(500).json({ error: "Message handling failed" });
+        }
     });
     // Start listening
     const server = app.listen(port, host, () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaze/hicortex",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "Human-like memory for self-improving AI agents. Automatic capturing, nightly reflection, and cross-agent learning. Works with Claude Code and OpenClaw.",
   "main": "dist/index.js",
   "bin": {