@jlongo78/agent-spaces 0.9.8 → 0.9.10

package/.next/standalone/src/middleware.ts

@@ -1,6 +1,15 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { HAS_AUTH } from '@/lib/tier';
 
+function timingSafeEqualStr(a: string, b: string): boolean {
+  const aBytes = new TextEncoder().encode(a);
+  const bBytes = new TextEncoder().encode(b);
+  if (aBytes.length !== bBytes.length) return false;
+  let result = 0;
+  for (let i = 0; i < aBytes.length; i++) result |= aBytes[i] ^ bBytes[i];
+  return result === 0;
+}
+
 async function verifyToken(token: string, secretHex: string): Promise<{ sub: string; role: string } | null> {
   if (!token) return null;
   const parts = token.split('.');
@@ -20,7 +29,7 @@ async function verifyToken(token: string, secretHex: string): Promise<{ sub: str
   const expectedSig = btoa(String.fromCharCode(...new Uint8Array(sigBytes)))
     .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 
-  if (expectedSig !== sig) return null;
+  if (!timingSafeEqualStr(expectedSig, sig)) return null;
 
   try {
     const payloadStr = atob(payloadB64.replace(/-/g, '+').replace(/_/g, '/'));
@@ -58,9 +67,17 @@ export async function middleware(request: NextRequest) {
     return NextResponse.next();
   }
 
-  // Federation API routes authenticate via Bearer token
-  if (pathname.startsWith('/api/network/') && request.headers.get('authorization')?.startsWith('Bearer ')) {
-    return NextResponse.next();
+  // Federation API routes authenticate via Bearer token. Middleware can't validate
+  // the token against network.db in Edge runtime, so we only let through requests
+  // that carry a well-formed API-key bearer (shape: "spk_" + base36-ish). The route
+  // handler is still responsible for calling requireNetworkAuth() — this bypass is
+  // purely a shape check to reject arbitrary strings like "Bearer anything".
+  const authHeader = request.headers.get('authorization');
+  if (pathname.startsWith('/api/network/') && authHeader?.startsWith('Bearer ')) {
+    const bearer = authHeader.slice(7);
+    if (/^spk_[A-Za-z0-9_-]{8,}$/.test(bearer)) {
+      return NextResponse.next();
+    }
   }
 
   // Connection request/callback endpoints are unauthenticated (verified by token in body)
@@ -73,7 +90,8 @@ export async function middleware(request: NextRequest) {
 
   // Internal API requests from MCP servers / agent processes / VR client (local network)
   const internalToken = request.headers.get('x-spaces-internal') || request.nextUrl.searchParams.get('_internal');
-  if (internalToken === (process.env.SPACES_SESSION_SECRET || '').slice(0, 16) &&
+  const expectedInternalToken = (process.env.SPACES_SESSION_SECRET || '').slice(0, 16);
+  if (internalToken && expectedInternalToken && timingSafeEqualStr(internalToken, expectedInternalToken) &&
       (request.headers.get('host')?.startsWith('localhost') || request.headers.get('host')?.startsWith('127.0.0.1') || request.headers.get('host')?.startsWith('192.168.'))) {
     return NextResponse.next();
   }

package/.next/standalone/src/types/claude.ts

@@ -206,3 +206,42 @@ export interface AnalyticsOverview {
   dailyActivity: DailyActivity[];
   dailyModelTokens: DailyModelTokens[];
 }
+
+export interface WorkspaceTodo {
+  id: number;
+  workspaceId: number;
+  text: string;
+  completed: boolean;
+  sortOrder: number;
+  created: string;
+  completedAt: string | null;
+}
+
+// ─── Claude plan-usage (mirrors /usage in Claude Code) ───────
+
+export interface RateLimit {
+  utilization: number | null; // 0-100
+  resets_at: string | null;   // ISO 8601
+}
+
+export interface ExtraUsage {
+  is_enabled: boolean;
+  monthly_limit: number | null;
+  used_credits: number | null;
+  utilization: number | null;
+}
+
+export interface Utilization {
+  five_hour?: RateLimit | null;
+  seven_day?: RateLimit | null;
+  seven_day_oauth_apps?: RateLimit | null;
+  seven_day_opus?: RateLimit | null;
+  seven_day_sonnet?: RateLimit | null;
+  extra_usage?: ExtraUsage | null;
+}
+
+export type UsageResponse =
+  | { status: 'ok'; data: Utilization }
+  | { status: 'unauthenticated' }
+  | { status: 'expired' }
+  | { status: 'upstream_error' };

package/.next/standalone/tests/db/workspace-todos.test.ts

@@ -0,0 +1,156 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import Database from 'better-sqlite3';
+
+import { __testing } from '@/lib/db/schema';
+import {
+  getWorkspaceTodos,
+  addWorkspaceTodo,
+  updateWorkspaceTodo,
+  deleteWorkspaceTodo,
+} from '@/lib/db/queries';
+
+const TEST_USER = 'test-user'; // matches tests/setup.ts auth mock
+let db: Database.Database;
+let tempDir: string;
+
+beforeEach(() => {
+  tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'spaces-todos-test-'));
+  const dbPath = path.join(tempDir, 'test.db');
+  db = new Database(dbPath);
+  db.pragma('journal_mode = WAL');
+  db.pragma('foreign_keys = ON');
+
+  const ddl = [
+    `CREATE TABLE workspaces (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      name TEXT NOT NULL,
+      color TEXT DEFAULT '#6366f1',
+      created TEXT DEFAULT (datetime('now'))
+    )`,
+    `CREATE TABLE workspace_todos (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      workspace_id INTEGER NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      text TEXT NOT NULL,
+      completed INTEGER NOT NULL DEFAULT 0,
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      created TEXT NOT NULL DEFAULT (datetime('now')),
+      completed_at TEXT
+    )`,
+    `CREATE INDEX idx_workspace_todos_workspace ON workspace_todos(workspace_id)`,
+  ];
+  for (const stmt of ddl) {
+    db.prepare(stmt).run();
+  }
+
+  __testing.dbs.set(TEST_USER, db);
+
+  db.prepare("INSERT INTO workspaces (id, name) VALUES (1, 'Test WS')").run();
+});
+
+afterEach(() => {
+  try { db.close(); } catch {}
+  __testing.dbs.delete(TEST_USER);
+  fs.rmSync(tempDir, { recursive: true, force: true });
+});
+
+describe('workspace todos query helpers', () => {
+  it('adds a todo with incrementing sort_order among uncompleted rows', () => {
+    const a = addWorkspaceTodo(1, 'first');
+    const b = addWorkspaceTodo(1, 'second');
+    const c = addWorkspaceTodo(1, 'third');
+
+    expect(a.sortOrder).toBe(0);
+    expect(b.sortOrder).toBe(1);
+    expect(c.sortOrder).toBe(2);
+    expect(a.completed).toBe(false);
+    expect(a.text).toBe('first');
+  });
+
+  it('trims text and rejects empty', () => {
+    const t = addWorkspaceTodo(1, '  hello  ');
+    expect(t.text).toBe('hello');
+
+    expect(() => addWorkspaceTodo(1, '   ')).toThrow();
+    expect(() => addWorkspaceTodo(1, '')).toThrow();
+  });
+
+  it('toggles completed and sets/clears completed_at', () => {
+    const t = addWorkspaceTodo(1, 'toggle me');
+    expect(t.completedAt).toBeNull();
+
+    const done = updateWorkspaceTodo(1, t.id, { completed: true });
+    expect(done?.completed).toBe(true);
+    expect(done?.completedAt).not.toBeNull();
+
+    const undone = updateWorkspaceTodo(1, t.id, { completed: false });
+    expect(undone?.completed).toBe(false);
+    expect(undone?.completedAt).toBeNull();
+  });
+
+  it('updates text, trims, rejects empty', () => {
+    const t = addWorkspaceTodo(1, 'original');
+    const upd = updateWorkspaceTodo(1, t.id, { text: '  edited  ' });
+    expect(upd?.text).toBe('edited');
+
+    expect(() => updateWorkspaceTodo(1, t.id, { text: '   ' })).toThrow();
+  });
+
+  it('lists todos: uncompleted first by sort_order, completed last by completed_at desc', () => {
+    const a = addWorkspaceTodo(1, 'a');
+    const b = addWorkspaceTodo(1, 'b');
+    const c = addWorkspaceTodo(1, 'c');
+
+    updateWorkspaceTodo(1, b.id, { completed: true });
+    updateWorkspaceTodo(1, a.id, { completed: true });
+
+    const list = getWorkspaceTodos(1);
+    expect(list.map(t => t.text)).toEqual(['c', 'a', 'b']);
+  });
+
+  it('deletes a todo', () => {
+    const t = addWorkspaceTodo(1, 'doomed');
+    deleteWorkspaceTodo(1, t.id);
+    expect(getWorkspaceTodos(1)).toHaveLength(0);
+  });
+
+  it('cascades when the workspace is deleted', () => {
+    addWorkspaceTodo(1, 'x');
+    addWorkspaceTodo(1, 'y');
+    db.prepare('DELETE FROM workspaces WHERE id = 1').run();
+    const rows = db.prepare('SELECT COUNT(*) AS n FROM workspace_todos').get() as { n: number };
+    expect(rows.n).toBe(0);
+  });
+
+  it('scopes listing by workspace', () => {
+    db.prepare("INSERT INTO workspaces (id, name) VALUES (2, 'Other')").run();
+    addWorkspaceTodo(1, 'ws-1-a');
+    addWorkspaceTodo(2, 'ws-2-a');
+    addWorkspaceTodo(1, 'ws-1-b');
+
+    const ws1 = getWorkspaceTodos(1);
+    const ws2 = getWorkspaceTodos(2);
+    expect(ws1.map(t => t.text).sort()).toEqual(['ws-1-a', 'ws-1-b']);
+    expect(ws2.map(t => t.text)).toEqual(['ws-2-a']);
+  });
+
+  it('refuses to update or delete a todo from a different workspace', () => {
+    db.prepare("INSERT INTO workspaces (id, name) VALUES (2, 'Other')").run();
+    const t = addWorkspaceTodo(1, 'belongs to ws 1');
+
+    // Update with the wrong workspace id → returns null, leaves row untouched.
+    const update = updateWorkspaceTodo(2, t.id, { text: 'hijacked' });
+    expect(update).toBeNull();
+    expect(getWorkspaceTodos(1)[0].text).toBe('belongs to ws 1');
+
+    // Delete with the wrong workspace id → row survives.
+    deleteWorkspaceTodo(2, t.id);
+    expect(getWorkspaceTodos(1)).toHaveLength(1);
+
+    // Correct workspace → works.
+    deleteWorkspaceTodo(1, t.id);
+    expect(getWorkspaceTodos(1)).toHaveLength(0);
+  });
+});

package/bin/cortex-hook.js

@@ -2,11 +2,16 @@
 'use strict';
 const http = require('http');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 
-const LOG_FILE = path.join(process.cwd(), 'cortex-hook-debug.log');
+const LOG_DIR = path.join(os.homedir(), '.spaces', 'logs');
+const LOG_FILE = path.join(LOG_DIR, 'cortex-hook-debug.log');
 function log(msg) {
-  try { fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] " + msg + "\n"); } catch(e) {}
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+    fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] " + msg + "\n");
+  } catch(e) {}
 }
 
 function readSpacesEnv() {
@@ -49,7 +54,7 @@ async function main() {
 
   const query = encodeURIComponent(prompt);
   const url = "http://localhost:" + port + "/api/cortex/context/?q=" + query + "&limit=5" + (wsId ? "&workspace_id=" + wsId : "");
-  log('Querying: ' + url + ' (event: ' + eventName + ')');
+  log('Querying cortex (prompt length: ' + prompt.length + ', event: ' + eventName + ')');
 
   try {
     const body = await new Promise((resolve, reject) => {

package/bin/cortex-learn-hook.js

@@ -2,11 +2,16 @@
 'use strict';
 const http = require('http');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 
-const LOG_FILE = path.join(process.cwd(), 'cortex-hook-debug.log');
+const LOG_DIR = path.join(os.homedir(), '.spaces', 'logs');
+const LOG_FILE = path.join(LOG_DIR, 'cortex-hook-debug.log');
 function log(msg) {
-  try { fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] [LEARN] " + msg + "\n"); } catch(e) {}
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+    fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] [LEARN] " + msg + "\n");
+  } catch(e) {}
 }
 
 function readSpacesEnv() {

package/bin/scrub-standalone.js

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+'use strict';
+// Remove runtime-generated files from .next/standalone/ before publishing to npm.
+// Historical incident: cortex-hook-debug.log containing user prompts (and npm tokens)
+// leaked into versions 0.9.6-0.9.9 because the hook wrote to process.cwd() which
+// at runtime was .next/standalone/. Hooks now log to ~/.spaces/logs/, but this
+// belt-and-suspenders scrub runs on every publish to catch any other accidents.
+
+const fs = require('fs');
+const path = require('path');
+
+const STANDALONE = path.join(process.cwd(), '.next', 'standalone');
+
+const DENY_FILES = [
+  'cortex-hook-debug.log',
+];
+
+const DENY_DIRS = [
+  '.spaces',
+  '.claude',
+  '.codex',
+  '.gemini',
+  '.pi',
+  'logs',
+];
+
+const DENY_PATTERNS = [
+  /\.log$/i,
+  /^\.env(\..+)?$/i,
+  /^\.npmrc$/i,
+];
+
+function walk(dir, cb) {
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch { return; }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (DENY_DIRS.includes(e.name)) {
+        fs.rmSync(full, { recursive: true, force: true });
+        console.log('[scrub] removed dir: ' + path.relative(STANDALONE, full));
+        continue;
+      }
+      walk(full, cb);
+    } else if (e.isFile()) {
+      cb(full, e.name);
+    }
+  }
+}
+
+if (!fs.existsSync(STANDALONE)) {
+  console.log('[scrub] no .next/standalone to scrub');
+  process.exit(0);
+}
+
+walk(STANDALONE, (full, name) => {
+  if (DENY_FILES.includes(name) || DENY_PATTERNS.some(p => p.test(name))) {
+    fs.rmSync(full, { force: true });
+    console.log('[scrub] removed file: ' + path.relative(STANDALONE, full));
+  }
+});
+
+// Final scan: refuse to publish if any obvious secrets remain in text files
+const SECRET_PATTERNS = [
+  /npm_[A-Za-z0-9]{30,}/,
+  /sk-ant-[A-Za-z0-9_-]{20,}/,
+  /ghp_[A-Za-z0-9]{30,}/,
+];
+let leaked = false;
+walk(STANDALONE, (full, name) => {
+  if (!/\.(js|json|md|txt|log|ts|tsx|mjs|cjs)$/i.test(name)) return;
+  let content;
+  try { content = fs.readFileSync(full, 'utf-8'); } catch { return; }
+  for (const p of SECRET_PATTERNS) {
+    const m = content.match(p);
+    if (m) {
+      console.error('[scrub] SECRET DETECTED in ' + path.relative(STANDALONE, full) + ': ' + m[0].slice(0, 12) + '...');
+      leaked = true;
+    }
+  }
+});
+
+if (leaked) {
+  console.error('[scrub] aborting publish — secrets found in build output');
+  process.exit(1);
+}
+
+console.log('[scrub] done — standalone clean');

package/bin/terminal-server.js

@@ -1334,8 +1334,11 @@ function handleConnection(wss, ws, req) {
   const rawAgentSession = url.searchParams.get('agentSession') || '';
   const agentSession = (rawAgentSession === 'new' || SESSION_ID_RE.test(rawAgentSession)) ? rawAgentSession : '';
   const rawCustomCommand = url.searchParams.get('customCommand') || '';
-  // Sanitize: reject shell metacharacters that enable injection (;, |, &, $, `, etc.)
-  const customCommand = /[;&|`$(){}]/.test(rawCustomCommand) ? '' : rawCustomCommand;
+  // Sanitize via allowlist. Any character outside [A-Za-z0-9 . _ - /] is rejected.
+  // Earlier blocklist (/[;&|`$(){}]/) missed newlines, redirects (<,>), and
+  // backslashes — a payload like "legit\nmalicious" would inject a second command
+  // when the PTY wrote it with a trailing \r.
+  const customCommand = /^[A-Za-z0-9._\-/ ]+$/.test(rawCustomCommand) ? rawCustomCommand : '';
   const cols = parseInt(url.searchParams.get('cols') || '120', 10);
   const rows = parseInt(url.searchParams.get('rows') || '30', 10);
 
@@ -1554,8 +1557,25 @@ function handleConnection(wss, ws, req) {
   // Detect bash-on-Windows so cd commands use bash syntax, not cmd.exe `cd /d`
   const isBashOnWindows = isWindows && shell && (shell.endsWith('bash.exe') || shell.endsWith('bash'));
 
-  const env = { ...process.env };
-  delete env.CLAUDECODE;
+  // Build a minimal env for the user-facing PTY — never inherit the server's
+  // secrets (SPACES_SESSION_SECRET, GH_PAT, NPM_TOKEN, ANTHROPIC_API_KEY, etc).
+  // Only forward identity/shell/locale/terminal basics from the server env.
+  const PTY_ENV_ALLOW = [
+    'HOME', 'USER', 'LOGNAME', 'SHELL', 'PATH', 'PWD', 'OLDPWD', 'HOSTNAME',
+    'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'LC_COLLATE', 'LC_TIME',
+    'LC_NUMERIC', 'LC_MONETARY', 'TZ',
+    'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'XDG_RUNTIME_DIR',
+    'XDG_STATE_HOME',
+    'TERM', 'TERM_PROGRAM', 'TERM_PROGRAM_VERSION', 'COLORTERM', 'COLUMNS', 'LINES',
+    'NODE_ENV', 'NVM_DIR', 'NVM_BIN',
+    // Windows basics
+    'SYSTEMROOT', 'WINDIR', 'APPDATA', 'LOCALAPPDATA', 'USERPROFILE', 'COMSPEC',
+    'PATHEXT', 'PROGRAMFILES', 'PROGRAMFILES(X86)', 'PROGRAMDATA',
+  ];
+  const env = {};
+  for (const k of PTY_ENV_ALLOW) {
+    if (process.env[k] !== undefined) env[k] = process.env[k];
+  }
   // Enable prompt suggestions in spawned Claude Code sessions
   env.CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION = 'true';
   // Tell Claude Code where git-bash is so it doesn't fail the bash detection
@@ -2208,19 +2228,30 @@ async function handleProxyConnection(clientWs, nodeId, opts) {
     return;
   }
 
-  // Get the remote WebSocket URL via the terminal token endpoint
-  // Only skip TLS verification if explicitly opted in (e.g., self-signed certs)
+  // Get the remote WebSocket URL via the terminal token endpoint.
+  // If the user opted into skipping TLS verification (for self-signed federation
+  // certs), scope it to JUST this request via an undici Agent rather than the
+  // process-global NODE_TLS_REJECT_UNAUTHORIZED env var, which would disable
+  // cert verification for every outbound TLS connection in the process and
+  // race with concurrent requests.
   const skipTls = process.env.SPACES_SKIP_TLS_VERIFY === '1';
-  const prevTls = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (skipTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  let fetchOptions = {
+    method: 'POST',
+    headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
+    signal: AbortSignal.timeout(10000),
+  };
+  if (skipTls) {
+    try {
+      const { Agent } = require('undici');
+      fetchOptions.dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+    } catch (e) {
+      console.warn('[Proxy] undici unavailable for per-request TLS opt-out; refusing to fall back to global flag');
+    }
+  }
   let remoteWsUrl;
   try {
     const tokenUrl = `${node.url}/api/network/terminal/token/`;
-    const res = await fetch(tokenUrl, {
-      method: 'POST',
-      headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
+    const res = await fetch(tokenUrl, fetchOptions);
 
     if (!res.ok) {
       let detail = '';
@@ -2236,9 +2267,6 @@ async function handleProxyConnection(clientWs, nodeId, opts) {
     clientWs.send(JSON.stringify({ type: 'error', data: `Cannot reach remote node: ${err.message}` }));
     clientWs.close();
     return;
-  } finally {
-    if (prevTls === undefined) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTls;
   }
 
   // Connect to remote terminal server using the API key directly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jlongo78/agent-spaces",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "description": "Agent workspace manager for Claude, Codex, Gemini, and more",
   "bin": {
     "spaces": "./bin/spaces.js"
@@ -32,7 +32,7 @@
     "dev": "node bin/spaces-dev.js",
     "build": "cross-env STANDALONE=1 next build && node -e \"const fs=require('fs');fs.cpSync('.next/static','.next/standalone/.next/static',{recursive:true});fs.cpSync('public','.next/standalone/public',{recursive:true})\" && node bin/fix-standalone-externals.js",
     "postinstall": "node bin/spaces-postinstall.js || true",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "npm run build && node bin/scrub-standalone.js",
     "setup": "node bin/spaces-setup.js",
     "setup-admin": "node bin/setup-admin.js",
     "server:build": "next build",

package/.next/standalone/.claude/settings.local.json

@@ -1,68 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npm view:*)",
-      "Bash(npm publish:*)",
-      "Bash(where spaces:*)",
-      "Bash(node:*)",
-      "Bash(npm run:*)",
-      "Bash(curl:*)",
-      "Bash(powershell:*)",
-      "Bash(spaces service:*)",
-      "Bash(git:*)",
-      "Bash(npm whoami:*)",
-      "Read(//c/Users/johns/.spaces/packages/pro/**)",
-      "Bash(npx tsc)",
-      "Bash(node -e \"console.log\\(require\\('./package.json'\\).version\\)\")",
-      "Bash(find /d/projects/spaces/src -type f \\\\\\( -name \"*.tsx\" -o -name \"*.ts\" \\\\\\) -exec grep -l \"template\\\\|Template\" {} \\\\;)",
-      "Bash(npx next:*)"
-    ]
-  },
-  "hooks": {
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"D:\\projects\\spaces\\bin\\cortex-hook.js\"",
-            "timeout": 15
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"D:\\projects\\spaces\\bin\\cortex-learn-hook.js\"",
-            "timeout": 10
-          }
-        ]
-      }
-    ],
-    "SessionStart": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"C:\\Users\\johns\\.spaces\\packages\\teams\\bin\\spaces-hook.js\" a64f4c8c-f9de-4f51-98ed-b100ebcc7638",
-            "timeout": 10000
-          }
-        ]
-      }
-    ]
-  },
-  "mcpServers": {
-    "cortex": {
-      "command": "node",
-      "args": [
-        "D:\\projects\\spaces\\bin\\cortex-mcp.js"
-      ],
-      "env": {
-        "SPACES_URL": "http://localhost:3457",
-        "SPACES_INTERNAL_TOKEN": "5a6d378a74905803"
-      }
-    }
-  }
-}

package/.next/standalone/.claude/spaces-env.json

@@ -1 +0,0 @@
-{"workspaceId":"2","port":3457}