@lh8ppl/claude-memory-kit 0.4.0 → 0.4.1

package/src/settings-hooks.mjs

@@ -58,6 +58,7 @@ import {
 } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { stripBom } from './read-json.mjs';
+import { MCP_AUTO_APPROVE } from './kiro-constants.mjs';
 
 /**
  * Canonical npm-route hooks block. Shell form (no `args`), PATH-resolved
@@ -65,6 +66,20 @@ import { stripBom } from './read-json.mjs';
  * (modulo command form) plugin/hooks/hooks.json.
  */
 export const KIT_HOOKS_BLOCK = Object.freeze({
+  // PermissionRequest — the prompt-free auto-approver (Task 172, the v0.4.1
+  // cut-gate fix). Fires when Claude Code is about to show a permission dialog
+  // for one of the kit's OWN surfaces and answers "allow" so capture/recall stay
+  // seamless. Two matchers: the kit's MCP tools (`mcp__cmk__.*`) and the Skill
+  // tool (the "Use skill?" prompt). The handler (cmk-approve-permission)
+  // self-checks the tool name and approves ONLY kit tools/skills — the matcher
+  // is the first narrowing, the handler's check is the second (defence in depth).
+  // Needed because CC 2.1.x stopped honouring `permissions.allow` MCP rules +
+  // skill `allowed-tools` for these prompts (anthropics/claude-code#17499,
+  // #18837→#14956); the PermissionRequest hook is the documented, working path.
+  PermissionRequest: [
+    { matcher: 'mcp__cmk__.*', hooks: [{ type: 'command', command: 'cmk-approve-permission', timeout: 5 }] },
+    { matcher: 'Skill', hooks: [{ type: 'command', command: 'cmk-approve-permission', timeout: 5 }] },
+  ],
   // PreToolUse — the memory delete-guardrail (D-192). Blocks a destructive
   // shell command (rm / Remove-Item / git clean …) aimed at a memory path
   // BEFORE it runs. The only kit hook that can exit non-zero (2 = block).
@@ -86,6 +101,7 @@ export const KIT_HOOKS_BLOCK = Object.freeze({
  */
 export const KIT_COMMAND_TOKENS = Object.freeze([
   'cmk-version-check',
+  'cmk-approve-permission',
   'cmk-guard-memory',
   'cmk-inject-context',
   'cmk-capture-prompt',
@@ -212,7 +228,33 @@ export function writeKitHooks(settingsPath) {
   // Task 133: memory-search joins memory-write — every scaffolded skill needs
   // its own allow entry or the model's invocation trips a "Use skill?" prompt
   // (the Task-90 class; 75.1 scaffolded the skill but missed this).
-  const KIT_ALLOW = ['Bash(cmk:*)', 'Skill(memory-write)', 'Skill(memory-search)', 'mcp__cmk__*'];
+  // Task 169 (the v0.4.1 cut-gate find, 2026-06-26): Claude Code 2.1.x changed
+  // skill-permission matching — the bare `Skill(memory-write)` rule alone no
+  // longer suppressed the "Use skill?" prompt; when the user clicked "allow for
+  // this project", Claude Code wrote BOTH `Skill(memory-write)` AND
+  // `Skill(memory-write:*)` into settings.local.json. So the kit emits BOTH forms
+  // (bare for older CC, `:*` for 2.1.x+) — pending a docs re-verification of the
+  // current skill-permission syntax.
+  // Task 171 (v0.4.1 cut-gate ground-truth, 2026-06-26): the `mcp__cmk__*` server
+  // WILDCARD no longer suppresses the per-tool approval prompt on Claude Code
+  // 2.1.x — a DIRECT `mk_remember` call (the model using the MCP tool outside the
+  // skill's own `allowed-tools`) prompts "Do you want to proceed with
+  // mcp__cmk__mk_remember?", and CC writes the SPECIFIC tool name when allowed.
+  // (CC 2.1.x churned permission matching heavily — multiple changelog entries
+  // closed wildcard auto-approve holes, e.g. 2.1.145 "permission-prompt bypass".)
+  // The wildcard worked on older CC; it doesn't now. So allow-list each SPECIFIC
+  // cmk MCP tool (the canonical 11 in MCP_AUTO_APPROVE — shared with the Kiro
+  // pre-trust) AND keep `mcp__cmk__*` (harmless + future-proof). This is the same
+  // upstream-format-tracking the kit does for the Skill rule (D-209) and Kiro.
+  const KIT_ALLOW = [
+    'Bash(cmk:*)',
+    'Skill(memory-write)',
+    'Skill(memory-write:*)',
+    'Skill(memory-search)',
+    'Skill(memory-search:*)',
+    'mcp__cmk__*',
+    ...MCP_AUTO_APPROVE.map((tool) => `mcp__cmk__${tool}`),
+  ];
   if (!settings.permissions || typeof settings.permissions !== 'object') {
     settings.permissions = {};
   }
@@ -225,6 +267,21 @@ export function writeKitHooks(settingsPath) {
     }
   }
 
+  // Task 172: pre-approve the kit's OWN project-scoped `.mcp.json` server so its
+  // tools connect without the per-project "approve this MCP server?" prompt.
+  // `enabledMcpjsonServers` names specific servers to approve (NOT
+  // `enableAllProjectMcpServers`, which would blanket-approve EVERY server in
+  // `.mcp.json` — too broad for a kit shipped to others; we vouch only for our
+  // own server). This clears the SERVER-approval gate; the PermissionRequest
+  // hook above clears the per-TOOL gate. Idempotent + preserves any servers the
+  // user already approved.
+  if (!Array.isArray(settings.enabledMcpjsonServers)) {
+    settings.enabledMcpjsonServers = [];
+  }
+  if (!settings.enabledMcpjsonServers.includes('cmk')) {
+    settings.enabledMcpjsonServers.push('cmk');
+  }
+
   const after = JSON.stringify(settings);
   const changed = before !== after;
 

package/src/tier-paths.mjs

@@ -9,10 +9,50 @@
 //   resolveTierRoot({tier, projectRoot, userDir}) → absolute path
 //   resolveFactDir(tier, tierRoot) → absolute path to <memory|fragments>
 
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 
+// Canonicalize a path for comparison: resolve 8.3 short names (Windows
+// `TAMIR~1.BN-`) + symlinks to their real long form, so a short-name path and
+// its long-name twin compare equal. Falls back to `resolve(p)` if the path
+// doesn't exist (realpathSync throws on a missing path). Exported so the project
+// discovery in inject-context.mjs shares ONE implementation (Task 168 — the
+// home-boundary + canonicalize logic must not drift across the two walkers).
+export function canonicalPath(p) {
+  try {
+    return realpathSync.native ? realpathSync.native(p) : realpathSync(p);
+  } catch {
+    return resolve(p);
+  }
+}
+
+/**
+ * Walk up from `cwd` to the nearest ancestor that has one of the `markers`
+ * subdirs (a kit-installed project), STOPPING at the home directory — a stray
+ * `~/context/` (test debris, or a `cmk` run that scaffolded in home) must NOT be
+ * served as a project from an unrelated subdir (Task 168). Returns the discovered
+ * root, or `resolve(cwd)` if none found below home.
+ *
+ * @param {string} cwd            starting directory
+ * @param {string[]} markers      subdir names that mark a project root (e.g.
+ *                                ['context'] or ['context', 'context.local'])
+ */
+export function discoverRootUpward(cwd, markers = ['context']) {
+  const home = canonicalPath(homedir());
+  let dir = resolve(cwd);
+  // Defensive bound: walk no more than 64 ancestors.
+  for (let i = 0; i < 64; i++) {
+    const atHome = canonicalPath(dir) === home;
+    if (!atHome && markers.some((m) => existsSync(join(dir, m)))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break; // reached the filesystem root
+    if (atHome) break; // do not climb above $HOME into a stray ancestor context/
+    dir = parent;
+  }
+  return resolve(cwd); // last resort
+}
+
 export const VALID_TIERS = new Set(['U', 'P', 'L']);
 
 /**
@@ -47,18 +87,12 @@ export function resolveMcpProjectRoot({ env = process.env, cwd = process.cwd() }
   const fromClaude = env.CLAUDE_PROJECT_DIR;
   if (fromClaude && fromClaude.trim() !== '') return resolve(fromClaude);
 
-  // walk up from cwd to the nearest dir that has a context/ subdir (an installed
-  // kit project), stopping at the filesystem root.
-  let dir = resolve(cwd);
-  // eslint-disable-next-line no-constant-condition
-  while (true) {
-    if (existsSync(join(dir, 'context'))) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) break; // reached the root
-    dir = parent;
-  }
-
-  return resolve(cwd); // last resort
+  // Walk up to the nearest `context/`-bearing project, STOPPING at home (Task 168
+  // — a stray `~/context/` must not be served from an unrelated subdir; a real
+  // project's context/ lives below home, or via the explicit CLAUDE_PROJECT_DIR
+  // handled above). Shared with inject-context's discoverProjectRoot via the
+  // single discoverRootUpward implementation.
+  return discoverRootUpward(cwd, ['context']);
 }
 
 // Matches IDs produced by @lh8ppl/cmk-canonicalize.generateId(). Tier prefix +