@gamaze/hicortex 0.3.13 → 0.3.15

package/dist/init.js

@@ -116,23 +116,45 @@ function registerCcMcp(serverUrl) {
         console.log(`  ✓ Registered MCP server via claude CLI`);
     }
     catch (err) {
-        // Fallback: write directly to settings.json if claude CLI not available
+        // Fallback: write directly to ~/.claude.json (where CC reads MCP servers)
         const msg = err instanceof Error ? err.message : String(err);
-        console.log(`  ⚠ claude CLI registration failed (${msg}), writing settings.json directly`);
-        let settings = {};
+        console.log(`  ⚠ claude CLI registration failed (${msg}), writing ~/.claude.json directly`);
+        const claudeJsonPath = (0, node_path_1.join)((0, node_os_1.homedir)(), ".claude.json");
+        let config = {};
         try {
-            settings = JSON.parse((0, node_fs_1.readFileSync)(CC_SETTINGS, "utf-8"));
+            config = JSON.parse((0, node_fs_1.readFileSync)(claudeJsonPath, "utf-8"));
         }
         catch { /* create new */ }
-        if (!settings.mcpServers)
-            settings.mcpServers = {};
-        settings.mcpServers.hicortex = {
+        if (!config.mcpServers)
+            config.mcpServers = {};
+        config.mcpServers.hicortex = {
             type: "sse",
             url: `${serverUrl}/sse`,
         };
+        (0, node_fs_1.writeFileSync)(claudeJsonPath, JSON.stringify(config, null, 2));
+        console.log(`  ✓ Registered MCP server in ${claudeJsonPath}`);
+    }
+    // Add MCP tool permissions to settings.json so users don't get prompted
+    allowHicortexTools();
+}
+function allowHicortexTools() {
+    let settings = {};
+    try {
+        settings = JSON.parse((0, node_fs_1.readFileSync)(CC_SETTINGS, "utf-8"));
+    }
+    catch { /* create new */ }
+    if (!settings.permissions)
+        settings.permissions = {};
+    const perms = settings.permissions;
+    if (!perms.allow)
+        perms.allow = [];
+    const allow = perms.allow;
+    const rule = "mcp__hicortex__*";
+    if (!allow.includes(rule)) {
+        allow.push(rule);
         (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(CC_SETTINGS), { recursive: true });
         (0, node_fs_1.writeFileSync)(CC_SETTINGS, JSON.stringify(settings, null, 2));
-        console.log(`  ✓ Registered MCP server in ${CC_SETTINGS}`);
+        console.log(`  ✓ Added Hicortex tool permissions to ${CC_SETTINGS}`);
     }
 }
 function installCcCommands() {
@@ -587,6 +609,8 @@ async function runInit() {
     if (!d.ccMcpRegistered) {
         registerCcMcp(serverUrl);
     }
+    // Ensure tool permissions are set (also needed for users upgrading from older versions)
+    allowHicortexTools();
     // Install CC commands
     installCcCommands();
     // Inject CLAUDE.md (only if server has a DB we can read)

package/dist/llm.d.ts

@@ -85,6 +85,7 @@ export declare class LlmClient {
     completeDistill(prompt: string, maxTokens?: number): Promise<string>;
     /**
      * Complete with overridden baseUrl/apiKey/provider (used for reflect tier with separate endpoint).
+     * Creates a temporary LlmClient to avoid mutating shared config under concurrent calls.
      */
     private completeWithOverride;
     private complete;

package/dist/llm.js

@@ -199,34 +199,6 @@ function readOcProviderBaseUrl(config, provider) {
         return providerConfig.baseUrl;
     return undefined;
 }
-/**
- * Read provider base URL from per-agent models.json files.
- * Scans all agent dirs for a matching provider entry.
- */
-function readAgentModelsBaseUrl(provider) {
-    try {
-        const { readdirSync } = require("node:fs");
-        const agentsDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".openclaw", "agents");
-        const agents = readdirSync(agentsDir);
-        for (const agentId of agents) {
-            try {
-                const modelsPath = (0, node_path_1.join)(agentsDir, agentId, "agent", "models.json");
-                const raw = (0, node_fs_1.readFileSync)(modelsPath, "utf-8");
-                const models = JSON.parse(raw);
-                const providerConfig = models?.providers?.[provider];
-                if (providerConfig?.baseUrl)
-                    return providerConfig.baseUrl;
-            }
-            catch {
-                // Skip agents without models.json
-            }
-        }
-    }
-    catch {
-        // No agents dir
-    }
-    return undefined;
-}
 /**
  * Read API key from OC's per-agent auth-profiles.json.
  * Scans all agent dirs for a matching provider profile.
@@ -337,9 +309,6 @@ const PROVIDER_BASE_URLS = {
 function getDefaultUrlForProvider(provider) {
     return PROVIDER_BASE_URLS[provider.toLowerCase()] ?? "https://api.openai.com/v1";
 }
-function getEnvKeyForZai() {
-    return process.env.ZAI_API_KEY ?? process.env.LLM_API_KEY;
-}
 /**
  * Find the claude CLI binary. Returns the full path or null.
  */
@@ -438,24 +407,16 @@ class LlmClient {
     }
     /**
      * Complete with overridden baseUrl/apiKey/provider (used for reflect tier with separate endpoint).
+     * Creates a temporary LlmClient to avoid mutating shared config under concurrent calls.
      */
     async completeWithOverride(baseUrl, apiKey, provider, model, prompt, maxTokens, timeoutMs) {
-        if (this.isRateLimited) {
-            throw new RateLimitError(this.rateLimitedUntil - Date.now());
-        }
-        // Temporarily swap config for this call
-        const saved = { baseUrl: this.config.baseUrl, apiKey: this.config.apiKey, provider: this.config.provider };
-        this.config.baseUrl = baseUrl;
-        this.config.apiKey = apiKey;
-        this.config.provider = provider;
-        try {
-            return await this.complete(model, prompt, maxTokens, timeoutMs);
-        }
-        finally {
-            this.config.baseUrl = saved.baseUrl;
-            this.config.apiKey = saved.apiKey;
-            this.config.provider = saved.provider;
-        }
+        const tempClient = new LlmClient({
+            ...this.config,
+            baseUrl,
+            apiKey,
+            provider,
+        });
+        return tempClient.complete(model, prompt, maxTokens, timeoutMs);
     }
     async complete(model, prompt, maxTokens, timeoutMs) {
         if (this.isRateLimited) {
@@ -530,7 +491,8 @@ class LlmClient {
      */
     async completeAnthropic(model, prompt, maxTokens, timeoutMs) {
         const baseUrl = this.config.baseUrl.replace(/\/$/, "");
-        const url = `${baseUrl}/v1/messages`;
+        const hasVersion = /\/v\d+\/?$/.test(baseUrl);
+        const url = hasVersion ? `${baseUrl}/messages` : `${baseUrl}/v1/messages`;
         const resp = await fetch(url, {
             method: "POST",
             headers: {

package/dist/mcp-server.js

@@ -178,7 +178,7 @@ async function startServer(options = {}) {
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     console.log(`[hicortex] Initializing database at ${dbPath}`);
     db = (0, db_js_1.initDb)(dbPath);
-    stateDir = dbPath.replace(/\/hicortex\.db$/, "");
+    stateDir = require("node:path").dirname(dbPath);
     // LLM config: check config.json first, then env vars, then claude CLI
     const savedConfig = readConfigFile(stateDir);
     let llmConfig;
@@ -189,13 +189,18 @@ async function startServer(options = {}) {
         }
         else {
             console.warn("[hicortex] claude-cli configured but claude binary not found, falling back");
-            llmConfig = (0, llm_js_1.resolveLlmConfigForCC)();
+            llmConfig = (0, llm_js_1.resolveLlmConfigForCC)({
+                llmBaseUrl: savedConfig?.llmBaseUrl,
+                llmApiKey: savedConfig?.llmApiKey,
+                llmModel: savedConfig?.llmModel,
+                reflectModel: savedConfig?.reflectModel,
+            });
         }
     }
-    else if (savedConfig?.llmBackend === "ollama" && savedConfig?.llmBaseUrl) {
-        // Ollama: no API key needed, construct config directly
+    else if (savedConfig?.llmBackend === "ollama") {
+        // Ollama: no API key needed, default to localhost:11434
         llmConfig = {
-            baseUrl: savedConfig.llmBaseUrl,
+            baseUrl: savedConfig.llmBaseUrl ?? "http://localhost:11434",
             apiKey: "",
             model: savedConfig.llmModel ?? "qwen3.5:4b",
             reflectModel: savedConfig.reflectModel ?? savedConfig.llmModel ?? "qwen3.5:4b",
@@ -252,25 +257,7 @@ async function startServer(options = {}) {
     // Express app
     const app = (0, express_1.default)();
     app.use(express_1.default.json());
-    // Optional bearer token auth (skip for /health and localhost when no token)
-    if (authToken) {
-        console.log(`[hicortex] Bearer token auth enabled`);
-        app.use((req, res, next) => {
-            // Always allow health endpoint
-            if (req.path === "/health")
-                return next();
-            // Allow localhost without auth
-            const ip = req.ip ?? req.socket.remoteAddress ?? "";
-            if (ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1")
-                return next();
-            // Check bearer token
-            const auth = req.headers.authorization;
-            if (auth === `Bearer ${authToken}`)
-                return next();
-            res.status(401).json({ error: "Unauthorized" });
-        });
-    }
-    // CORS: allow Claude Desktop (https://claude.ai) and other browser-based MCP clients
+    // CORS: must be before auth so preflight OPTIONS requests get proper headers
     app.use((req, res, next) => {
         const origin = req.headers.origin;
         if (origin) {
@@ -278,6 +265,7 @@ async function startServer(options = {}) {
             res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
             res.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, Authorization");
             res.setHeader("Access-Control-Allow-Credentials", "true");
+            res.setHeader("Vary", "Origin");
         }
         if (req.method === "OPTIONS") {
             res.status(204).end();
@@ -285,6 +273,21 @@ async function startServer(options = {}) {
         }
         next();
     });
+    // Optional bearer token auth (skip for /health, OPTIONS, and localhost)
+    if (authToken) {
+        console.log(`[hicortex] Bearer token auth enabled`);
+        app.use((req, res, next) => {
+            if (req.path === "/health")
+                return next();
+            const ip = req.ip ?? req.socket.remoteAddress ?? "";
+            if (ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1")
+                return next();
+            const auth = req.headers.authorization;
+            if (auth === `Bearer ${authToken}`)
+                return next();
+            res.status(401).json({ error: "Unauthorized" });
+        });
+    }
     // SSE transport management — each connection gets its own McpServer instance
     const transports = new Map();
     // Health endpoint
@@ -307,7 +310,14 @@ async function startServer(options = {}) {
         transport.onclose = () => {
             transports.delete(transport.sessionId);
         };
-        await mcpServer.connect(transport);
+        try {
+            await mcpServer.connect(transport);
+        }
+        catch (err) {
+            transports.delete(transport.sessionId);
+            if (!res.headersSent)
+                res.status(500).json({ error: "MCP connect failed" });
+        }
     });
     // Message endpoint — client POSTs MCP messages here
     app.post("/messages", async (req, res) => {
@@ -317,8 +327,14 @@ async function startServer(options = {}) {
             return;
         }
         const transport = transports.get(sessionId);
-        // Pass parsed body since express.json() already consumed the stream
-        await transport.handlePostMessage(req, res, req.body);
+        try {
+            // Pass parsed body since express.json() already consumed the stream
+            await transport.handlePostMessage(req, res, req.body);
+        }
+        catch (err) {
+            if (!res.headersSent)
+                res.status(500).json({ error: "Message handling failed" });
+        }
     });
     // Start listening
     const server = app.listen(port, host, () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaze/hicortex",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "Human-like memory for self-improving AI agents. Automatic capturing, nightly reflection, and cross-agent learning. Works with Claude Code and OpenClaw.",
   "main": "dist/index.js",
   "bin": {