@memnexus-ai/cli 1.7.233 → 1.7.235

package/dist/lib/commit-context/privacy-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU7C"}
+{"version":3,"file":"privacy-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmEH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU7C"}

package/dist/lib/commit-context/privacy-filter.js

@@ -22,6 +22,43 @@ const SECRET_PATTERNS = [
     /ghp_[a-zA-Z0-9]{36}/g,
     // GitHub OAuth / user / service tokens
     /gh[ous]_[a-zA-Z0-9]{36}/g,
+    // MemNexus API keys. This codebase mints TWO shapes and both authenticate,
+    // because core-api/src/routes/internal-auth.routes.ts validates only the
+    // `cmk_live_` prefix plus exactly one dot:
+    //   1. Application path — core-api/src/repositories/apikey.repository.ts:69
+    //      `cmk_live_<16 hex>.<24 alphanumeric>`
+    //   2. Shell/seeding path — database/scripts/generate-api-key-hash.sh:64,
+    //      database/scripts/seed-system-data.sh:66, core-api/scripts/seed-system-data.sh:74
+    //      `cmk_live_${ENVIRONMENT}_<16 hex>.<secret>`, ENVIRONMENT in {dev,staging,prod}.
+    //      This is the shape that seeds production, so missing it is the worse miss.
+    // The optional `[a-z]+_` group covers the environment segment; `{8,}` would not,
+    // since dev/prod/staging are all shorter than 8 and `_` is not in `[a-zA-Z0-9]`.
+    //
+    // The keyId is matched as exactly 16 hex characters, case-insensitive. Both
+    // generators emit lowercase today, but the class accepts either case so that a
+    // generator swapped for one emitting uppercase (`toUpperCase()`, a different
+    // uuid implementation) does not silently drop coverage. The environment segment
+    // likewise accepts any case. This costs nothing: measured against the full
+    // fixture set, widening both classes breaks zero negatives.
+    //
+    // Anchoring the keyId to 16 hex is deliberate and is what keeps the pattern off
+    // prose. `[a-zA-Z0-9]{8,}` would additionally swallow the documented placeholder
+    // at api-gateway/.env.example:63 (`cmk_live_dev_placeholder....`) and dotted
+    // identifiers such as `cmk_live_handler.processRequest_helper`.
+    //
+    // The 16-hex shape is a CONTRACT WITH THE GENERATORS, not a guess. It is pinned
+    // by an executable coupling test in core-api/tests/unit/utils/privacy-filter.test.ts
+    // that builds a keyId through the real generator expressions and asserts this
+    // filter redacts it. If a generator changes shape, that test fails loudly rather
+    // than this comment quietly becoming false.
+    //
+    // The dot-plus-body requirement matches a *token*, not a *mention*: prose naming
+    // the scheme ("keys look like cmk_live_<id>.<secret>") is left byte-identical,
+    // because `<` is outside the character classes.
+    //
+    // NOT covered: truncated fragments. A partial key with no dot, or a short body,
+    // passes through unredacted. See issue #5382.
+    /cmk_(?:live|test)_(?:[a-zA-Z]+_)?[0-9a-fA-F]{16}\.[a-zA-Z0-9_-]{8,}/g,
     // Bearer tokens
     /Bearer\s+[a-zA-Z0-9._-]{20,}/g,
     // Generic key=value secrets (password, secret, token, key followed by = or :)

package/dist/lib/commit-context/privacy-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy-filter.js","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAmCH,4BAUC;AA3CD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;GAGG;AACH,MAAM,eAAe,GAAa;IAChC,wDAAwD;IACxD,8BAA8B;IAE9B,8BAA8B;IAC9B,sBAAsB;IAEtB,gCAAgC;IAChC,sBAAsB;IAEtB,uCAAuC;IACvC,0BAA0B;IAE1B,gBAAgB;IAChB,+BAA+B;IAE/B,8EAA8E;IAC9E,iEAAiE;IACjE,8DAA8D;CAC/D,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,qCAAqC;QACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"privacy-filter.js","sourceRoot":"","sources":["../../../src/lib/commit-context/privacy-filter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAyEH,4BAUC;AAjFD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;GAGG;AACH,MAAM,eAAe,GAAa;IAChC,wDAAwD;IACxD,8BAA8B;IAE9B,8BAA8B;IAC9B,sBAAsB;IAEtB,gCAAgC;IAChC,sBAAsB;IAEtB,uCAAuC;IACvC,0BAA0B;IAE1B,2EAA2E;IAC3E,yEAAyE;IACzE,2CAA2C;IAC3C,4EAA4E;IAC5E,6CAA6C;IAC7C,0EAA0E;IAC1E,wFAAwF;IACxF,uFAAuF;IACvF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,4DAA4D;IAC5D,EAAE;IACF,gFAAgF;IAChF,iFAAiF;IACjF,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,gFAAgF;IAChF,qFAAqF;IACrF,8EAA8E;IAC9E,iFAAiF;IACjF,4CAA4C;IAC5C,EAAE;IACF,iFAAiF;IACjF,+EAA+E;IAC/E,gDAAgD;IAChD,EAAE;IACF,gFAAgF;IAChF,8CAA8C;IAC9C,sEAAsE;IAEtE,gBAAgB;IAChB,+BAA+B;IAE/B,8EAA8E;IAC9E,iEAAiE;IACjE,8DAA8D;CAC/D,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,qCAAqC;QACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/hooks/capture-precompact.sh

@@ -201,6 +201,263 @@ $(echo "$RECENT_RESULTS" | head -c 1500)"
 # Truncate total content to ~5000 chars
 CONTENT=$(echo "$CONTENT" | head -c 5000)
 
+# ── 6b. Resolve project scope (codeContext) ──────────────────────────────
+# Auto-captured memories carried no scope at all, so they leaked into every
+# team's scoped searches and polluted build_context (#5158, #4957). PR #3281
+# fixed that for the commit path only; this is the same resolution for the
+# capture hooks, using the same sources and the same precedence.
+#
+# Mirrors resolveCommitCodeContext() in cli/src/lib/commit-context/code-context.ts:
+#   1. MX_CODE_CONTEXT env var — operator-controlled, higher trust. It wins over
+#      the file (CWE-345): a checked-in file from an untrusted clone must not
+#      override the scope the operator set explicitly.
+#   2. <projectRoot>/.mx-code-context.json — repo-controlled, lower trust.
+#   3. Neither present or neither usable -> NO scope. The memory is created
+#      unlabeled, exactly as it was before this block existed. No default is
+#      invented: a guessed label is invisible to the scope that should see it
+#      and visible to one that should not, which is worse than no label.
+#
+# Every command in this block must end up returning 0. The EXIT/ERR trap set in
+# section 4 exits the hook, so a non-zero status here would discard the
+# pre-compaction context over a missing config file — a far worse regression
+# than the unlabeled memories this fixes. The absent-config path is the common
+# one today.
+CODE_CONTEXT_MAX_BYTES=65536
+
+# Walk up for the git project root, mirroring findProjectRoot() in
+# cli/src/lib/commit-context/local-cache.ts. `-e`, not `-d`: inside a git
+# worktree `.git` is a FILE, and the worktree root — not the main repo — is the
+# project root (the TS uses fs.existsSync, which makes no such distinction).
+find_project_root() { # <start-dir> -> project root on stdout, or nothing
+  local dir
+  dir=$(cd "$1" 2>/dev/null && pwd -P) || return 0
+  while [[ -n "$dir" && "$dir" != "/" ]]; do
+    if [[ -e "$dir/.git" ]]; then
+      printf '%s' "$dir"
+      return 0
+    fi
+    dir=$(dirname "$dir" 2>/dev/null) || return 0
+  done
+  return 0
+}
+
+# Keep only the six known keys whose values are non-empty strings, cap each,
+# and emit NOTHING when nothing usable remains — so an empty or scope-free
+# object is never passed as if it were a label. Malformed JSON makes jq exit
+# non-zero with no output, which lands in the same "no scope" branch.
+#
+# `-s` (slurp) is load-bearing, not a style choice. jq accepts a STREAM of JSON
+# documents: without `-s` the filter runs once per document and `jq -c` prints
+# one line each, so a config holding two concatenated or newline-separated
+# objects produced a MULTI-LINE string that was passed verbatim as one
+# --code-context argument. parseCodeContextFlag() (cli/src/commands/memories.ts)
+# JSON.parse()s it and process.exit(1)s before any network call. In THIS hook
+# that loss is unrecoverable: the transcript the capture would have summarized
+# is compacted away immediately afterwards. The `!= "{}"` guard below did not
+# catch it either: `{"zzz":1}{"team":"b"}` normalizes to the two lines
+# `{}` + `{"team":"b"}`, and that whole string is not `{}`. Slurping into an
+# array and taking the first element means exactly one line can ever be emitted.
+#
+# The cap is 100 CODEPOINTS, deliberately below the server's 200. The server's
+# CodeContextSchema uses Zod `.max(200)`, which counts UTF-16 code units, while
+# jq's `[0:N]` slices by codepoint. Every astral-plane character (emoji, CJK
+# extensions, mathematical alphanumerics) is 1 codepoint but 2 UTF-16 units, so
+# a `[0:200]` cap emitted values of up to 400 units — over the server maximum,
+# a 400 from the API, and the same silent capture loss. Since no codepoint
+# exceeds 2 UTF-16 units, 100 codepoints can never exceed 200 units. Scope
+# labels are short names (product/team/service); the extra truncation is
+# unreachable in practice, and truncating is recoverable where a rejected
+# request is not.
+normalize_code_context() { # JSON on stdin -> normalized JSON object, or nothing
+  local out
+  out=$(jq -s -c '
+    (.[0] // {}) as $raw
+    | if ($raw | type) == "object" then
+        reduce ("product","repo","service","component","team","role") as $k ({};
+          if ($raw[$k] | type) == "string" and ($raw[$k] | length) > 0
+          then .[$k] = ($raw[$k][0:100])
+          else . end)
+      else {} end
+  ' 2>/dev/null) || return 0
+  # The newline test is belt-and-braces: `-s` already guarantees one document,
+  # and jq -c escapes newlines inside string values. Nothing multi-line may ever
+  # reach --code-context again, whatever the filter above does.
+  if [[ -n "$out" && "$out" != "{}" && "$out" != "null" && "$out" != *$'\n'* ]]; then
+    printf '%s' "$out"
+  fi
+  return 0
+}
+
+CODE_CONTEXT_JSON=""
+
+# 1. Env var. Tested for presence only — the value is never echoed or logged.
+if [[ -n "${MX_CODE_CONTEXT:-}" ]]; then
+  CODE_CONTEXT_JSON=$(printf '%s' "$MX_CODE_CONTEXT" | normalize_code_context) || CODE_CONTEXT_JSON=""
+fi
+
+# 2. Repo file — consulted only when the env var yielded nothing usable.
+if [[ -z "$CODE_CONTEXT_JSON" ]]; then
+  # ORDER IS LOAD-BEARING: harness-provided project dir, then the worktree path,
+  # then the cwd. Each source is TRIED IN TURN, and the transcript's directory
+  # is not a source at all. Both properties are corrections to earlier forms and
+  # both are pinned by the suite; read this before rewriting the expression.
+  #
+  # WHY EACH SOURCE IS TRIED SEPARATELY. The earlier form collapsed all three
+  # into ONE call: `find_project_root "${CLAUDE_PROJECT_DIR:-${CLAUDE_WORKTREE_PATH:-$(pwd)}}"`.
+  # `:-` substitutes only when a variable is UNSET or EMPTY — never when it is
+  # set to something useless. So a CLAUDE_PROJECT_DIR that is set but resolves
+  # to no repository (a stale path, a deleted directory, a path outside any
+  # checkout) consumed the single attempt and the cwd was NEVER consulted.
+  # Measured: CLAUDE_PROJECT_DIR=/proc and =/nonexistent/zz each produced
+  # {"product":"home","team":"DOTFILES-WRONG-SCOPE"} from the $HOME config.
+  # The loop below consults the next source instead, which `:-` cannot express.
+  #
+  # WHAT IS ACTUALLY KNOWN ABOUT CLAUDE_PROJECT_DIR IN THE CUSTOMER CONTEXT.
+  # It is the documented hook variable, and it is the right first source when it
+  # is present. This repo does NOT evidence that it is set for hooks installed
+  # by `mx mcp install`: every other reference to it is fleet code, and it was
+  # measured UNSET in a live Claude Code tool process (a tool process is not a
+  # hook process, so that is not disproof — but it is not confirmation either).
+  # The expression below is therefore designed to be CORRECT WHEN IT IS ABSENT:
+  # an unset or empty value is skipped by the loop and the cwd carries the case.
+  # Do not restructure this so that a present CLAUDE_PROJECT_DIR is required.
+  # WHY THE TRANSCRIPT DIRECTORY IS NOT A SOURCE. It has no legitimate resolving
+  # power, and the reason is DEPTH-INDEPENDENT — do not restate it as a claim
+  # about the transcript's nesting. An earlier version of this comment argued
+  # from a flat ~/.claude/projects/<slug>/<id>.jsonl layout and enumerated the
+  # three directories a walk could reach. That premise is false here. Measured
+  # on this machine: transcripts sit at BOTH depth 2 and depth 4 under
+  # ~/.claude/projects — 310 at depth 2, 5621 deeper — so any argument of the
+  # form "the walk can only ever reach these three named directories" does not
+  # hold. The premise that does hold, and that does not depend on depth:
+  #
+  #     .git anywhere under ~/.claude, any depth: 0   (also no .hg, no .svn)
+  #
+  # An upward walk from any transcript directory traverses only directories
+  # inside ~/.claude, none of which carries a repository marker, so it cannot
+  # terminate inside that subtree at any depth. That leaves $HOME as its ONLY
+  # reachable non-empty outcome, which is precisely the defect this block exists
+  # to prevent: keeping dotfiles in git is common, so $HOME/.git exists on many
+  # machines, and with $HOME/.mx-code-context.json present every capture from
+  # every worktree on the machine was labelled from the home config. A
+  # confidently wrong label is worse than no label — invisible to the scope that
+  # should see it, visible to one that must not. Do not reintroduce it.
+  #
+  # CAVEAT, stated because this is a claim about a directory OUTSIDE this
+  # repository: it could stop being true, and nothing in this codebase would
+  # notice if a repository ever appeared under ~/.claude. Removing the leg does
+  # not depend on the caveat holding — the leg is simply gone — but any future
+  # argument to reinstate it must re-measure rather than cite this line.
+  #
+  # WHY $HOME IS REFUSED OUTRIGHT, AND WHY BOTH SIDES ARE CANONICALIZED. Belt
+  # and braces for the residual where the cwd itself is $HOME or a directory
+  # beneath it whose nearest .git is $HOME's. It also closes a consequence that
+  # is easy to miss: CC_ROOT is the basis of the symlink containment test below,
+  # so a CC_ROOT of $HOME silently widens "contained in the project" to
+  # "anywhere in the home directory", and $HOME/.mx-code-context.json symlinked
+  # to any other file under $HOME would resolve and be used. The cost is not
+  # supporting a user whose real project IS their home directory; that is the
+  # same confusion we want rejected.
+  #
+  # The comparison MUST canonicalize $HOME. CC_ROOT always arrives canonical —
+  # find_project_root builds it with `cd … && pwd -P` — while $HOME arrives
+  # verbatim from the environment, so a literal `==` against "$HOME" misses on
+  # every spelling that is not byte-identical. Four spellings were measured
+  # leaking the home label through a symlinked $HOME/.mx-code-context.json: a
+  # trailing slash ("/home/x/"), a "/." suffix ("/home/x/."), $HOME set to a
+  # SYMLINK to the real home, and a cwd reached through that same symlink.
+  # Symlinked home directories are routine — macOS firmlinks, NFS corporate
+  # homes, container images mapping /home/user onto another volume — so the
+  # trigger is a normal configuration and the miss is silent: the refusal does
+  # not fire, and the containment widening above returns with it. `cd … && pwd -P`
+  # is the same primitive find_project_root uses and handles all four in one step.
+  #
+  # HOME unset, or pointing at nothing, leaves _home_real empty and no refusal
+  # fires. That is unchanged from the previous `-n "${HOME:-}"` guard, not a
+  # regression. The `|| _home_real=""` is REQUIRED, not decorative: without it a
+  # failing `cd` leaves the assignment non-zero and last on its path, which fires
+  # the ERR trap and abandons the capture.
+  #
+  # ERR-TRAP SAFETY — verified, not assumed, because a regression here fires
+  # `trap 'exit 0' ERR` and silently abandons the capture. The loop body's only
+  # status-bearing statement is a `$(...)` assignment of find_project_root, which
+  # returns 0 on every path including the `cd` failure. The break is written as
+  # an `if` block for the same reason the $HOME refusal is. The earlier one-line
+  # form `[[ -n "$CC_ROOT" ]] && break` returns 1 whenever the loop CONTINUES —
+  # an earlier version of this comment claimed it returned 0, which was wrong. It
+  # was safe only POSITIONALLY: as a non-final command of an `&&` list it is
+  # exempt under the errexit rules, so nothing fired. That safety depends on
+  # where the statement sits and would evaporate the moment this loop became the
+  # last statement of a function: the function would return 1 and any `$(...)`
+  # call of it would fire the trap. The `if` form returns 0 and removes the
+  # positional dependence.
+  #
+  # The same reasoning is why the $HOME refusal is an `if` block ON PURPOSE: the
+  # one-line `[[ "$CC_ROOT" == "$_home_real" ]] && CC_ROOT=""` returns 1 when the
+  # test is false, and was measured firing the ERR trap when it landed last in an
+  # enclosing block. `pwd 2>/dev/null` keeps a deleted cwd from printing "error
+  # retrieving current directory" onto the hook's real stderr. This safety comes
+  # from find_project_root always returning 0, not from this hook omitting
+  # `set -E`, so it survives someone adding `set -E` later. Do not introduce a
+  # bare command on this path.
+  CC_ROOT=""
+  for _cand in "${CLAUDE_PROJECT_DIR:-}" "${CLAUDE_WORKTREE_PATH:-}" "$(pwd 2>/dev/null)"; do
+    [[ -n "$_cand" ]] || continue
+    CC_ROOT=$(find_project_root "$_cand")
+    if [[ -n "$CC_ROOT" ]]; then break; fi
+  done
+  _home_real=$(cd "${HOME:-/nonexistent}" 2>/dev/null && pwd -P) || _home_real=""
+  if [[ -n "$_home_real" && "$CC_ROOT" == "$_home_real" ]]; then
+    CC_ROOT=""
+  fi
+  CC_FILE="${CC_ROOT}/.mx-code-context.json"
+  if [[ -n "$CC_ROOT" ]]; then
+    # CWE-59. `-f`, `-r` and the read all follow symlinks, so a repo could check
+    # in `.mx-code-context.json` as a symlink to any file on the user's machine
+    # and the six allowlisted keys of it would be uploaded to the user's own
+    # MemNexus account. Resolve the path and require the result to stay inside
+    # the project root — the containment this same hook already applies to the
+    # transcript path earlier. Read through the RESOLVED path, so the link is
+    # not traversed a second time.
+    CC_REAL=$(realpath "$CC_FILE" 2>/dev/null || printf '')
+    if [[ -n "$CC_REAL" && "$CC_REAL" == "$CC_ROOT"/* && -f "$CC_REAL" && -r "$CC_REAL" ]]; then
+      # One open, bounded at the source (same 64KB bound as the TS resolver).
+      # The previous form size-checked with `wc -c` and then re-opened for jq:
+      # two opens on a path an untrusted repo controls, so a concurrent writer
+      # could present a small file to `wc` and a huge one to `jq` (TOCTOU) on a
+      # hot path. `head -c` bounds the read itself, which changes >64KB from
+      # "skipped" to "truncated, then rejected as invalid JSON" — the same
+      # observable outcome, no scope.
+      #
+      # `2>/dev/null` precedes the input redirect ON PURPOSE. Redirections apply
+      # left to right, so with `<"$CC_REAL" 2>/dev/null` a file that turned
+      # unreadable between the `-r` test and the open makes bash print the full
+      # path and "Permission denied" to the hook's REAL stderr, before the
+      # discard takes effect. Verified: reversing these two words reintroduces
+      # that leak. Do not reorder.
+      #
+      # The bytes are PIPED into jq, never routed through a variable. Bash
+      # strips NUL bytes out of command-substitution output and warns while
+      # doing it — from the parent shell reading the substitution, so the
+      # `2>/dev/null` above does not suppress that warning. Via a variable,
+      # `{"team":"a<NUL>b"}` printed a warning naming this script and line to
+      # the hook's real stderr, and then RESOLVED to team "ab": input the file
+      # does not contain, silently repaired before validation instead of
+      # rejected by it. Piping keeps the NUL inside jq, which rejects the
+      # document as malformed. Do not reintroduce an intermediate variable.
+      CODE_CONTEXT_JSON=$(head -c "$CODE_CONTEXT_MAX_BYTES" 2>/dev/null <"$CC_REAL" | normalize_code_context) || CODE_CONTEXT_JSON=""
+    fi
+  fi
+fi
+
+# Nothing resolved -> pass nothing at all, so the create command line is
+# byte-identical to the pre-scope version. The `[@]+` guard keeps an empty array
+# safe to expand under `set -u` on bash < 4.4.
+CODE_CONTEXT_ARGS=()
+if [[ -n "$CODE_CONTEXT_JSON" ]]; then
+  CODE_CONTEXT_ARGS=(--code-context "$CODE_CONTEXT_JSON")
+fi
+
 # ── 7. Save memory (with timeout — never block compaction) ───────────────
 TIMEOUT_CMD=""
 if command -v timeout >/dev/null 2>&1; then
@@ -219,6 +476,7 @@ $TIMEOUT_CMD mx memories create \
   --conversation-id "NEW" \
   --content "$CONTENT" \
   --topics "auto-captured,precompact" \
+  "${CODE_CONTEXT_ARGS[@]+"${CODE_CONTEXT_ARGS[@]}"}" \
   >/dev/null 2>&1 || CREATE_STATUS=$?
 
 if [[ "$CREATE_STATUS" -ne 0 ]]; then

package/hooks/capture-session-end.sh

@@ -237,6 +237,261 @@ fi
 # Truncate to ~5000 chars
 CONTENT=$(echo "$CONTENT" | head -c 5000)
 
+# ── 6b. Resolve project scope (codeContext) ──────────────────────────────
+# Auto-captured memories carried no scope at all, so they leaked into every
+# team's scoped searches and polluted build_context (#5158, #4957). PR #3281
+# fixed that for the commit path only; this is the same resolution for the
+# capture hooks, using the same sources and the same precedence.
+#
+# Mirrors resolveCommitCodeContext() in cli/src/lib/commit-context/code-context.ts:
+#   1. MX_CODE_CONTEXT env var — operator-controlled, higher trust. It wins over
+#      the file (CWE-345): a checked-in file from an untrusted clone must not
+#      override the scope the operator set explicitly.
+#   2. <projectRoot>/.mx-code-context.json — repo-controlled, lower trust.
+#   3. Neither present or neither usable -> NO scope. The memory is created
+#      unlabeled, exactly as it was before this block existed. No default is
+#      invented: a guessed label is invisible to the scope that should see it
+#      and visible to one that should not, which is worse than no label.
+#
+# Every command in this block must end up returning 0. The EXIT/ERR trap set in
+# section 5 exits the hook, so a non-zero status here would abandon the capture
+# over a missing config file — a far worse regression than the unlabeled
+# memories this fixes. The absent-config path is the common one today.
+CODE_CONTEXT_MAX_BYTES=65536
+
+# Walk up for the git project root, mirroring findProjectRoot() in
+# cli/src/lib/commit-context/local-cache.ts. `-e`, not `-d`: inside a git
+# worktree `.git` is a FILE, and the worktree root — not the main repo — is the
+# project root (the TS uses fs.existsSync, which makes no such distinction).
+find_project_root() { # <start-dir> -> project root on stdout, or nothing
+  local dir
+  dir=$(cd "$1" 2>/dev/null && pwd -P) || return 0
+  while [[ -n "$dir" && "$dir" != "/" ]]; do
+    if [[ -e "$dir/.git" ]]; then
+      printf '%s' "$dir"
+      return 0
+    fi
+    dir=$(dirname "$dir" 2>/dev/null) || return 0
+  done
+  return 0
+}
+
+# Keep only the six known keys whose values are non-empty strings, cap each,
+# and emit NOTHING when nothing usable remains — so an empty or scope-free
+# object is never passed as if it were a label. Malformed JSON makes jq exit
+# non-zero with no output, which lands in the same "no scope" branch.
+#
+# `-s` (slurp) is load-bearing, not a style choice. jq accepts a STREAM of JSON
+# documents: without `-s` the filter runs once per document and `jq -c` prints
+# one line each, so a config holding two concatenated or newline-separated
+# objects produced a MULTI-LINE string that was passed verbatim as one
+# --code-context argument. parseCodeContextFlag() (cli/src/commands/memories.ts)
+# JSON.parse()s it and process.exit(1)s before any network call — the capture is
+# lost silently, triggered by cloning a repo. The `!= "{}"` guard below did not
+# catch it either: `{"zzz":1}{"team":"b"}` normalizes to the two lines
+# `{}` + `{"team":"b"}`, and that whole string is not `{}`. Slurping into an
+# array and taking the first element means exactly one line can ever be emitted.
+#
+# The cap is 100 CODEPOINTS, deliberately below the server's 200. The server's
+# CodeContextSchema uses Zod `.max(200)`, which counts UTF-16 code units, while
+# jq's `[0:N]` slices by codepoint. Every astral-plane character (emoji, CJK
+# extensions, mathematical alphanumerics) is 1 codepoint but 2 UTF-16 units, so
+# a `[0:200]` cap emitted values of up to 400 units — over the server maximum,
+# a 400 from the API, and the same silent capture loss. Since no codepoint
+# exceeds 2 UTF-16 units, 100 codepoints can never exceed 200 units. Scope
+# labels are short names (product/team/service); the extra truncation is
+# unreachable in practice, and truncating is recoverable where a rejected
+# request is not.
+normalize_code_context() { # JSON on stdin -> normalized JSON object, or nothing
+  local out
+  out=$(jq -s -c '
+    (.[0] // {}) as $raw
+    | if ($raw | type) == "object" then
+        reduce ("product","repo","service","component","team","role") as $k ({};
+          if ($raw[$k] | type) == "string" and ($raw[$k] | length) > 0
+          then .[$k] = ($raw[$k][0:100])
+          else . end)
+      else {} end
+  ' 2>/dev/null) || return 0
+  # The newline test is belt-and-braces: `-s` already guarantees one document,
+  # and jq -c escapes newlines inside string values. Nothing multi-line may ever
+  # reach --code-context again, whatever the filter above does.
+  if [[ -n "$out" && "$out" != "{}" && "$out" != "null" && "$out" != *$'\n'* ]]; then
+    printf '%s' "$out"
+  fi
+  return 0
+}
+
+CODE_CONTEXT_JSON=""
+
+# 1. Env var. Tested for presence only — the value is never echoed or logged.
+if [[ -n "${MX_CODE_CONTEXT:-}" ]]; then
+  CODE_CONTEXT_JSON=$(printf '%s' "$MX_CODE_CONTEXT" | normalize_code_context) || CODE_CONTEXT_JSON=""
+fi
+
+# 2. Repo file — consulted only when the env var yielded nothing usable.
+if [[ -z "$CODE_CONTEXT_JSON" ]]; then
+  # ORDER IS LOAD-BEARING: harness-provided project dir, then the worktree path,
+  # then the cwd. Each source is TRIED IN TURN, and the transcript's directory
+  # is not a source at all. Both properties are corrections to earlier forms and
+  # both are pinned by the suite; read this before rewriting the expression.
+  #
+  # WHY EACH SOURCE IS TRIED SEPARATELY. The earlier form collapsed all three
+  # into ONE call: `find_project_root "${CLAUDE_PROJECT_DIR:-${CLAUDE_WORKTREE_PATH:-$(pwd)}}"`.
+  # `:-` substitutes only when a variable is UNSET or EMPTY — never when it is
+  # set to something useless. So a CLAUDE_PROJECT_DIR that is set but resolves
+  # to no repository (a stale path, a deleted directory, a path outside any
+  # checkout) consumed the single attempt and the cwd was NEVER consulted.
+  # Measured: CLAUDE_PROJECT_DIR=/proc and =/nonexistent/zz each produced
+  # {"product":"home","team":"DOTFILES-WRONG-SCOPE"} from the $HOME config.
+  # The loop below consults the next source instead, which `:-` cannot express.
+  #
+  # WHAT IS ACTUALLY KNOWN ABOUT CLAUDE_PROJECT_DIR IN THE CUSTOMER CONTEXT.
+  # It is the documented hook variable, and it is the right first source when it
+  # is present. This repo does NOT evidence that it is set for hooks installed
+  # by `mx mcp install`: every other reference to it is fleet code, and it was
+  # measured UNSET in a live Claude Code tool process (a tool process is not a
+  # hook process, so that is not disproof — but it is not confirmation either).
+  # The expression below is therefore designed to be CORRECT WHEN IT IS ABSENT:
+  # an unset or empty value is skipped by the loop and the cwd carries the case.
+  # Do not restructure this so that a present CLAUDE_PROJECT_DIR is required.
+  # WHY THE TRANSCRIPT DIRECTORY IS NOT A SOURCE. It has no legitimate resolving
+  # power, and the reason is DEPTH-INDEPENDENT — do not restate it as a claim
+  # about the transcript's nesting. An earlier version of this comment argued
+  # from a flat ~/.claude/projects/<slug>/<id>.jsonl layout and enumerated the
+  # three directories a walk could reach. That premise is false here. Measured
+  # on this machine: transcripts sit at BOTH depth 2 and depth 4 under
+  # ~/.claude/projects — 310 at depth 2, 5621 deeper — so any argument of the
+  # form "the walk can only ever reach these three named directories" does not
+  # hold. The premise that does hold, and that does not depend on depth:
+  #
+  #     .git anywhere under ~/.claude, any depth: 0   (also no .hg, no .svn)
+  #
+  # An upward walk from any transcript directory traverses only directories
+  # inside ~/.claude, none of which carries a repository marker, so it cannot
+  # terminate inside that subtree at any depth. That leaves $HOME as its ONLY
+  # reachable non-empty outcome, which is precisely the defect this block exists
+  # to prevent: keeping dotfiles in git is common, so $HOME/.git exists on many
+  # machines, and with $HOME/.mx-code-context.json present every capture from
+  # every worktree on the machine was labelled from the home config. A
+  # confidently wrong label is worse than no label — invisible to the scope that
+  # should see it, visible to one that must not. Do not reintroduce it.
+  #
+  # CAVEAT, stated because this is a claim about a directory OUTSIDE this
+  # repository: it could stop being true, and nothing in this codebase would
+  # notice if a repository ever appeared under ~/.claude. Removing the leg does
+  # not depend on the caveat holding — the leg is simply gone — but any future
+  # argument to reinstate it must re-measure rather than cite this line.
+  #
+  # WHY $HOME IS REFUSED OUTRIGHT, AND WHY BOTH SIDES ARE CANONICALIZED. Belt
+  # and braces for the residual where the cwd itself is $HOME or a directory
+  # beneath it whose nearest .git is $HOME's. It also closes a consequence that
+  # is easy to miss: CC_ROOT is the basis of the symlink containment test below,
+  # so a CC_ROOT of $HOME silently widens "contained in the project" to
+  # "anywhere in the home directory", and $HOME/.mx-code-context.json symlinked
+  # to any other file under $HOME would resolve and be used. The cost is not
+  # supporting a user whose real project IS their home directory; that is the
+  # same confusion we want rejected.
+  #
+  # The comparison MUST canonicalize $HOME. CC_ROOT always arrives canonical —
+  # find_project_root builds it with `cd … && pwd -P` — while $HOME arrives
+  # verbatim from the environment, so a literal `==` against "$HOME" misses on
+  # every spelling that is not byte-identical. Four spellings were measured
+  # leaking the home label through a symlinked $HOME/.mx-code-context.json: a
+  # trailing slash ("/home/x/"), a "/." suffix ("/home/x/."), $HOME set to a
+  # SYMLINK to the real home, and a cwd reached through that same symlink.
+  # Symlinked home directories are routine — macOS firmlinks, NFS corporate
+  # homes, container images mapping /home/user onto another volume — so the
+  # trigger is a normal configuration and the miss is silent: the refusal does
+  # not fire, and the containment widening above returns with it. `cd … && pwd -P`
+  # is the same primitive find_project_root uses and handles all four in one step.
+  #
+  # HOME unset, or pointing at nothing, leaves _home_real empty and no refusal
+  # fires. That is unchanged from the previous `-n "${HOME:-}"` guard, not a
+  # regression. The `|| _home_real=""` is REQUIRED, not decorative: without it a
+  # failing `cd` leaves the assignment non-zero and last on its path, which fires
+  # the ERR trap and abandons the capture.
+  #
+  # ERR-TRAP SAFETY — verified, not assumed, because a regression here fires
+  # `trap 'exit 0' ERR` and silently abandons the capture. The loop body's only
+  # status-bearing statement is a `$(...)` assignment of find_project_root, which
+  # returns 0 on every path including the `cd` failure. The break is written as
+  # an `if` block for the same reason the $HOME refusal is. The earlier one-line
+  # form `[[ -n "$CC_ROOT" ]] && break` returns 1 whenever the loop CONTINUES —
+  # an earlier version of this comment claimed it returned 0, which was wrong. It
+  # was safe only POSITIONALLY: as a non-final command of an `&&` list it is
+  # exempt under the errexit rules, so nothing fired. That safety depends on
+  # where the statement sits and would evaporate the moment this loop became the
+  # last statement of a function: the function would return 1 and any `$(...)`
+  # call of it would fire the trap. The `if` form returns 0 and removes the
+  # positional dependence.
+  #
+  # The same reasoning is why the $HOME refusal is an `if` block ON PURPOSE: the
+  # one-line `[[ "$CC_ROOT" == "$_home_real" ]] && CC_ROOT=""` returns 1 when the
+  # test is false, and was measured firing the ERR trap when it landed last in an
+  # enclosing block. `pwd 2>/dev/null` keeps a deleted cwd from printing "error
+  # retrieving current directory" onto the hook's real stderr. This safety comes
+  # from find_project_root always returning 0, not from this hook omitting
+  # `set -E`, so it survives someone adding `set -E` later. Do not introduce a
+  # bare command on this path.
+  CC_ROOT=""
+  for _cand in "${CLAUDE_PROJECT_DIR:-}" "${CLAUDE_WORKTREE_PATH:-}" "$(pwd 2>/dev/null)"; do
+    [[ -n "$_cand" ]] || continue
+    CC_ROOT=$(find_project_root "$_cand")
+    if [[ -n "$CC_ROOT" ]]; then break; fi
+  done
+  _home_real=$(cd "${HOME:-/nonexistent}" 2>/dev/null && pwd -P) || _home_real=""
+  if [[ -n "$_home_real" && "$CC_ROOT" == "$_home_real" ]]; then
+    CC_ROOT=""
+  fi
+  CC_FILE="${CC_ROOT}/.mx-code-context.json"
+  if [[ -n "$CC_ROOT" ]]; then
+    # CWE-59. `-f`, `-r` and the read all follow symlinks, so a repo could check
+    # in `.mx-code-context.json` as a symlink to any file on the user's machine
+    # and the six allowlisted keys of it would be uploaded to the user's own
+    # MemNexus account. Resolve the path and require the result to stay inside
+    # the project root — the containment this same hook already applies to the
+    # transcript path in section 2. Read through the RESOLVED path, so the link
+    # is not traversed a second time.
+    CC_REAL=$(realpath "$CC_FILE" 2>/dev/null || printf '')
+    if [[ -n "$CC_REAL" && "$CC_REAL" == "$CC_ROOT"/* && -f "$CC_REAL" && -r "$CC_REAL" ]]; then
+      # One open, bounded at the source (same 64KB bound as the TS resolver).
+      # The previous form size-checked with `wc -c` and then re-opened for jq:
+      # two opens on a path an untrusted repo controls, so a concurrent writer
+      # could present a small file to `wc` and a huge one to `jq` (TOCTOU) on a
+      # hot per-turn path. `head -c` bounds the read itself, which changes >64KB
+      # from "skipped" to "truncated, then rejected as invalid JSON" — the same
+      # observable outcome, no scope.
+      #
+      # `2>/dev/null` precedes the input redirect ON PURPOSE. Redirections apply
+      # left to right, so with `<"$CC_REAL" 2>/dev/null` a file that turned
+      # unreadable between the `-r` test and the open makes bash print the full
+      # path and "Permission denied" to the hook's REAL stderr, before the
+      # discard takes effect. Verified: reversing these two words reintroduces
+      # that leak. Do not reorder.
+      #
+      # The bytes are PIPED into jq, never routed through a variable. Bash
+      # strips NUL bytes out of command-substitution output and warns while
+      # doing it — from the parent shell reading the substitution, so the
+      # `2>/dev/null` above does not suppress that warning. Via a variable,
+      # `{"team":"a<NUL>b"}` printed a warning naming this script and line to
+      # the hook's real stderr, and then RESOLVED to team "ab": input the file
+      # does not contain, silently repaired before validation instead of
+      # rejected by it. Piping keeps the NUL inside jq, which rejects the
+      # document as malformed. Do not reintroduce an intermediate variable.
+      CODE_CONTEXT_JSON=$(head -c "$CODE_CONTEXT_MAX_BYTES" 2>/dev/null <"$CC_REAL" | normalize_code_context) || CODE_CONTEXT_JSON=""
+    fi
+  fi
+fi
+
+# Nothing resolved -> pass nothing at all, so the create command line is
+# byte-identical to the pre-scope version. The `[@]+` guard keeps an empty array
+# safe to expand under `set -u` on bash < 4.4.
+CODE_CONTEXT_ARGS=()
+if [[ -n "$CODE_CONTEXT_JSON" ]]; then
+  CODE_CONTEXT_ARGS=(--code-context "$CODE_CONTEXT_JSON")
+fi
+
 # ── 7. Save memory (with timeout — never block session exit) ─────────────
 TIMEOUT_CMD=""
 if command -v timeout >/dev/null 2>&1; then
@@ -254,6 +509,7 @@ $TIMEOUT_CMD mx memories create \
   --conversation-id "NEW" \
   --content "$CONTENT" \
   --topics "auto-captured,session-summary" \
+  "${CODE_CONTEXT_ARGS[@]+"${CODE_CONTEXT_ARGS[@]}"}" \
   >/dev/null 2>&1 || CREATE_STATUS=$?
 
 # ── 8. Update debounce state (bounded retry) ─────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/cli",
-  "version": "1.7.233",
+  "version": "1.7.235",
   "description": "Command-line interface for MemNexus Core API",
   "main": "dist/index.js",
   "bin": {
@@ -23,6 +23,7 @@
     "dist/",
     "bin/",
     "hooks/",
+    "!hooks/*.test.sh",
     "README.md",
     "CHANGELOG.md",
     "USAGE.md"
@@ -34,7 +35,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@memnexus-ai/typescript-sdk": "^1.75.2",
+    "@memnexus-ai/typescript-sdk": "^1.75.6",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "axios": "^1.13.6",
     "chalk": "^5.3.0",

package/hooks/capture-hooks.test.sh

@@ -1,465 +0,0 @@
-#!/bin/bash
-# capture-hooks.test.sh — regression suite for the v4.04 error-honesty fixes in
-# the customer-shipped capture hooks (capture-session-end.sh,
-# capture-precompact.sh) and the dev-tools auto-save hook.
-#
-# Run with: bash cli/hooks/capture-hooks.test.sh
-# Exit: 0 = all pass, 1 = any fail.
-#
-# What is under test:
-#   * a FAILED `mx memories create` must leave the debounce watermark alone, so
-#     the segment is retried instead of being discarded forever
-#   * a SUCCESSFUL create must advance the watermark
-#   * the project-hash fallback chain must actually fall back (the old form
-#     piped into awk and therefore tested awk's exit status, never the hasher's)
-#   * with no hasher at all, the hook must skip rather than write a state file
-#     shared by every project
-#   * every hook still exits 0 in all of these cases (fail-open with Claude Code)
-set -u
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-SESSION_END_HOOK="$SCRIPT_DIR/capture-session-end.sh"
-PRECOMPACT_HOOK="$SCRIPT_DIR/capture-precompact.sh"
-AUTOSAVE_HOOK="$REPO_ROOT/dev-tools/claude-hooks/auto-save-memory.sh"
-
-PASS=0
-FAIL=0
-
-ok() {
-  PASS=$((PASS + 1))
-  echo "  PASS: $1"
-}
-
-nope() {
-  FAIL=$((FAIL + 1))
-  echo "  FAIL: $1"
-  [[ $# -gt 1 ]] && echo "        $2"
-}
-
-assert_eq() { # <expected> <actual> <label>
-  if [[ "$1" == "$2" ]]; then ok "$3"; else nope "$3" "expected [$1], got [$2]"; fi
-}
-
-assert_contains() { # <haystack> <needle> <label>
-  if [[ "$1" == *"$2"* ]]; then ok "$3"; else nope "$3" "missing [$2] in: $1"; fi
-}
-
-# ── Fixtures ────────────────────────────────────────────────────────────────
-
-# A stub `mx` whose exit status is controlled by MX_STUB_EXIT. Every call is
-# appended to MX_STUB_LOG so a test can assert that no create was even
-# attempted (the bounded-retry cap).
-make_stub_bin() { # <dir>
-  local bin="$1"
-  mkdir -p "$bin"
-  cat >"$bin/mx" <<'STUB'
-#!/bin/bash
-[[ -n "${MX_STUB_LOG:-}" ]] && echo "call" >>"$MX_STUB_LOG"
-exit "${MX_STUB_EXIT:-0}"
-STUB
-  chmod +x "$bin/mx"
-}
-
-# A transcript with enough lines (>100) and tool calls (>=5) to clear the
-# hooks' debounce and triviality gates.
-make_transcript() { # <path> <lines>
-  local path="$1" lines="${2:-150}" i
-  : >"$path"
-  for ((i = 0; i < lines; i++)); do
-    printf '%s\n' '{"type":"user","message":{"content":"do the thing"}}' >>"$path"
-    printf '%s\n' '{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{"file_path":"/tmp/x.ts"}},{"type":"text","text":"done"}]}}' >>"$path"
-  done
-}
-
-# Run capture-session-end.sh in an isolated HOME/state dir.
-# Echoes the watermark file's contents (empty when absent).
-run_session_end() { # <workdir> <path-override> ; uses MX_STUB_EXIT
-  local work="$1" path_override="$2"
-  local transcript="$work/transcript.jsonl"
-  ( cd "$work" && PATH="$path_override" HOME="$work/home" XDG_RUNTIME_DIR="$work/state" \
-      MX_STUB_LOG="$work/mx-calls.log" \
-      bash "$SESSION_END_HOOK" \
-      <<<"{\"transcript_path\":\"$transcript\",\"session_id\":\"s1\",\"stop_hook_active\":false}" \
-      2>"$work/stderr.txt" )
-  echo "$?" >"$work/exit.txt"
-}
-
-# Contents of the watermark file (empty when absent). The sibling ".fails"
-# counter is excluded — it lives next to the watermark and must not be mistaken
-# for it. Globs, not `ls`: an unmatched glob yields the literal pattern, which
-# the -f test filters out.
-state_file_contents() { # <workdir>
-  local f
-  for f in "$1"/state/.mx-session-capture-*; do
-    [[ -f "$f" ]] || continue
-    [[ "$f" == *.fails ]] && continue
-    cat "$f"
-    return 0
-  done
-  return 0
-}
-
-fail_count_contents() { # <workdir>
-  local f
-  for f in "$1"/state/.mx-session-capture-*.fails; do
-    [[ -f "$f" ]] || continue
-    cat "$f"
-    return 0
-  done
-  return 0
-}
-
-# Space-separated basenames of everything in the state dir — failure diagnostics
-# only. Dotfiles are matched explicitly because the state files are hidden.
-list_state_dir() { # <workdir>
-  local f out=""
-  for f in "$1"/state/* "$1"/state/.[!.]*; do
-    [[ -e "$f" ]] || continue
-    out+="$(basename "$f") "
-  done
-  printf '%s' "$out"
-}
-
-# Number of `mx` invocations recorded by the stub (0 when it was never called).
-count_mx_calls() { # <workdir>
-  local log="$1/mx-calls.log"
-  [[ -f "$log" ]] || { echo 0; return 0; }
-  wc -l <"$log" | tr -d ' '
-}
-
-REAL_PATH="$PATH"
-
-# Build a shadow PATH directory: every executable on the current PATH symlinked
-# in, MINUS the named tools. Used to simulate a machine without md5sum (or
-# without any hasher) while leaving the rest of the environment intact.
-make_shadow_path() { # <dir> <tool-to-omit>...
-  local dir="$1"; shift
-  local omit=" $* "
-  local d f name
-  mkdir -p "$dir"
-  local IFS=:
-  for d in $REAL_PATH; do
-    [[ -d "$d" ]] || continue
-    for f in "$d"/*; do
-      [[ -x "$f" && ! -d "$f" ]] || continue
-      name="$(basename "$f")"
-      [[ "$omit" == *" $name "* ]] && continue
-      [[ -e "$dir/$name" ]] && continue
-      ln -sf "$f" "$dir/$name"
-    done
-  done
-}
-
-
-echo "── capture-session-end.sh ──"
-
-# 1. Failed create → watermark unchanged.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-MX_STUB_EXIT=1 run_session_end "$work" "$work/bin:$REAL_PATH"
-assert_eq "0" "$(cat "$work/exit.txt")" "fail-open: hook exits 0 when create fails"
-assert_eq "" "$(state_file_contents "$work")" "failed create leaves the watermark unwritten"
-assert_contains "$(cat "$work/stderr.txt")" "mx memories create failed" \
-  "failed create writes one stderr diagnostic"
-rm -rf "$work"
-
-# 2. Successful create → watermark advances to the transcript's line count.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$REAL_PATH"
-assert_eq "0" "$(cat "$work/exit.txt")" "hook exits 0 on success"
-assert_eq "300" "$(state_file_contents "$work")" "successful create advances the watermark"
-rm -rf "$work"
-
-# 3. Retry semantics: a failed run followed by a successful one saves the same
-#    segment (the watermark only moves on the success).
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-MX_STUB_EXIT=1 run_session_end "$work" "$work/bin:$REAL_PATH"
-first="$(state_file_contents "$work")"
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$REAL_PATH"
-second="$(state_file_contents "$work")"
-assert_eq "" "$first" "first (failed) run: no watermark"
-assert_eq "300" "$second" "second (successful) run: watermark advances — segment was retried"
-rm -rf "$work"
-
-# 4. The default hasher is sha256sum (cksum was dropped from the chain: a
-#    32-bit CRC collision would make two projects share a state file).
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$REAL_PATH"
-expected_hash=$(printf '%s' "$work" | sha256sum | awk '{print $1}')
-if [[ -f "$work/state/.mx-session-capture-${expected_hash}" ]]; then
-  ok "state file is keyed by the sha256 of the project dir"
-else
-  nope "state file is keyed by the sha256 of the project dir" \
-    "state dir holds: $(list_state_dir "$work")"
-fi
-rm -rf "$work"
-
-# 4b. sha256sum absent → the md5sum fallback engages (the old awk-piped chain
-#     silently produced an EMPTY hash shared by every project).
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-make_shadow_path "$work/nosha" sha256sum
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$work/nosha"
-expected_hash=$(printf '%s' "$work" | md5sum | awk '{print $1}')
-if [[ -f "$work/state/.mx-session-capture-${expected_hash}" ]]; then
-  ok "sha256sum absent: md5sum fallback produces the project-specific state file"
-else
-  nope "sha256sum absent: md5sum fallback engages" \
-    "state dir holds: $(list_state_dir "$work")"
-fi
-rm -rf "$work"
-
-# 4c. cksum alone is NOT accepted (32-bit CRC — collisions are constructible).
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-make_shadow_path "$work/onlycksum" sha256sum md5sum shasum b2sum
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$work/onlycksum"
-assert_eq "" "$(ls -A "$work/state" 2>/dev/null)" "cksum-only machine: skips rather than using a 32-bit CRC"
-rm -rf "$work"
-
-# 5. No hasher at all → skip with a diagnostic, and never write a shared
-#    (hash-less) state file that would suppress every other project.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-make_shadow_path "$work/nohash" sha256sum md5sum shasum b2sum cksum
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$work/nohash"
-assert_eq "0" "$(cat "$work/exit.txt")" "no hasher: hook still exits 0"
-assert_eq "" "$(ls -A "$work/state" 2>/dev/null)" "no hasher: no shared state file is written"
-assert_contains "$(cat "$work/stderr.txt")" "no usable hash tool" \
-  "no hasher: stderr diagnostic explains the skip"
-rm -rf "$work"
-
-# ── Bounded retry (security review Must Fix) ────────────────────────────────
-# Leaving the watermark in place on failure removed the only bound on retry:
-# LINES_SINCE_SAVE stays >=100 forever, so every turn re-ran the whole
-# extraction and another non-idempotent create. The retry is now capped.
-
-# 6. Five consecutive retryable failures (exit 5): work stops after the cap.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-# Per-run observations, indexed by run number. Arrays rather than eval'd
-# variable names so the assignment is traceable (by shellcheck and by a reader).
-declare -a watermark_after=() calls_after=() stderr_after=()
-for run in 1 2 3 4 5; do
-  MX_STUB_EXIT=5 run_session_end "$work" "$work/bin:$REAL_PATH"
-  watermark_after[run]="$(state_file_contents "$work")"
-  calls_after[run]="$(count_mx_calls "$work")"
-  stderr_after[run]="$(cat "$work/stderr.txt")"
-done
-assert_eq "" "${watermark_after[1]}" "retryable failure 1/3: watermark not advanced"
-assert_eq "" "${watermark_after[2]}" "retryable failure 2/3: watermark not advanced"
-assert_eq "300" "${watermark_after[3]}" "retryable failure 3/3: watermark advanced (cap reached)"
-assert_contains "${stderr_after[2]}" "retry 2/3 next trigger" "retry counter is reported on stderr"
-assert_contains "${stderr_after[3]}" "giving up" "cap is announced on stderr"
-assert_eq "3" "${calls_after[3]}" "3 create attempts by the cap"
-assert_eq "3" "${calls_after[5]}" "runs 4 and 5 attempt no create at all"
-assert_eq "" "$(fail_count_contents "$work")" "fail counter is cleared once the segment is dropped"
-rm -rf "$work"
-
-# 7. Terminal statuses are never retried — the watermark advances immediately.
-#    2 = validation (the request is malformed), 3 = auth, 124 = timeout (the
-#    server may already have persisted the memory; a retry would duplicate it,
-#    and the create is non-idempotent).
-for terminal in 2 3 124; do
-  work=$(mktemp -d)
-  make_stub_bin "$work/bin"
-  make_transcript "$work/transcript.jsonl"
-  mkdir -p "$work/state" "$work/home"
-  MX_STUB_EXIT="$terminal" run_session_end "$work" "$work/bin:$REAL_PATH"
-  assert_eq "300" "$(state_file_contents "$work")" \
-    "terminal exit ${terminal}: watermark advances on the first failure"
-  assert_eq "" "$(fail_count_contents "$work")" "terminal exit ${terminal}: no fail counter written"
-  assert_contains "$(cat "$work/stderr.txt")" "not retryable" \
-    "terminal exit ${terminal}: stderr names it as not retryable"
-  assert_contains "$(cat "$work/stderr.txt")" "exit ${terminal}" \
-    "terminal exit ${terminal}: stderr names the exit code"
-  rm -rf "$work"
-done
-
-# 8. A success after two failures clears the counter, so the next failure
-#    streak starts from 1 rather than tripping the cap immediately.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-MX_STUB_EXIT=5 run_session_end "$work" "$work/bin:$REAL_PATH"
-MX_STUB_EXIT=5 run_session_end "$work" "$work/bin:$REAL_PATH"
-assert_eq "2" "$(fail_count_contents "$work")" "two failures: counter is at 2"
-MX_STUB_EXIT=0 run_session_end "$work" "$work/bin:$REAL_PATH"
-assert_eq "300" "$(state_file_contents "$work")" "success after 2 failures: watermark advances"
-assert_eq "" "$(fail_count_contents "$work")" "success after 2 failures: fail counter cleared"
-rm -rf "$work"
-
-# 8b. The counter is the only bound on the retry. If it cannot be persisted —
-#     the path exists but is not writable — the count silently resets to 0 every
-#     trigger and the cap never trips. Inability to bound must be terminal.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state" "$work/home"
-# Occupy the counter path with a DIRECTORY so the write can never succeed.
-project_hash=$(printf '%s' "$work" | sha256sum | awk '{print $1}')
-mkdir -p "$work/state/.mx-session-capture-${project_hash}.fails"
-MX_STUB_EXIT=5 run_session_end "$work" "$work/bin:$REAL_PATH"
-assert_eq "300" "$(state_file_contents "$work")" \
-  "unwritable counter: watermark advances on the FIRST failure"
-assert_contains "$(cat "$work/stderr.txt")" "cannot persist the retry counter" \
-  "unwritable counter: stderr names the reason"
-calls_after_run1=$(count_mx_calls "$work")
-MX_STUB_EXIT=5 run_session_end "$work" "$work/bin:$REAL_PATH"
-assert_eq "1" "$calls_after_run1" "unwritable counter: run 1 attempted exactly one create"
-assert_eq "1" "$(count_mx_calls "$work")" \
-  "unwritable counter: run 2 attempts no create"
-rm -rf "$work"
-
-echo "── capture-precompact.sh ──"
-
-# 6. Failed create → stderr diagnostic, still exit 0. (This hook has no
-#    watermark; none was invented.)
-work2=$(mktemp -d)
-make_stub_bin "$work2/bin"
-make_transcript "$work2/transcript.jsonl"
-mkdir -p "$work2/home"
-( cd "$work2" && PATH="$work2/bin:$REAL_PATH" HOME="$work2/home" MX_STUB_EXIT=1 \
-    bash "$PRECOMPACT_HOOK" \
-    <<<"{\"transcript_path\":\"$work2/transcript.jsonl\",\"session_id\":\"s1\",\"trigger\":\"auto\"}" \
-    2>"$work2/stderr.txt" >/dev/null )
-status2=$?
-assert_eq "0" "$status2" "precompact: exits 0 when create fails"
-assert_contains "$(cat "$work2/stderr.txt")" "mx memories create failed" \
-  "precompact: failed create writes a stderr diagnostic"
-rm -rf "$work2"
-
-echo "── dev-tools/claude-hooks/auto-save-memory.sh ──"
-
-run_autosave() { # <workdir> ; uses MX_STUB_EXIT
-  local work="$1"
-  ( cd "$work" && PATH="$work/bin:$REAL_PATH" MX_AUTOSAVE_STATE_FILE="$work/state-line" \
-      MX_STUB_LOG="$work/mx-calls.log" \
-      bash "$AUTOSAVE_HOOK" \
-      <<<"{\"transcript_path\":\"$work/transcript.jsonl\",\"stop_hook_active\":false}" \
-      2>"$work/stderr.txt" >/dev/null )
-  echo "$?" >"$work/exit.txt"
-}
-
-# 7. Failed create → the line-number watermark is not recorded, so the turn is
-#    retried instead of being skipped as "already saved".
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-MX_STUB_EXIT=1 run_autosave "$work"
-assert_eq "0" "$(cat "$work/exit.txt")" "auto-save: exits 0 when create fails"
-if [[ -f "$work/state-line" ]]; then
-  nope "auto-save: failed create leaves the watermark unwritten" \
-    "state-line holds: $(cat "$work/state-line")"
-else
-  ok "auto-save: failed create leaves the watermark unwritten"
-fi
-assert_contains "$(cat "$work/stderr.txt")" "mx memories create failed" \
-  "auto-save: failed create writes a stderr diagnostic"
-rm -rf "$work"
-
-# 8. Successful create → the watermark is recorded.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-MX_STUB_EXIT=0 run_autosave "$work"
-assert_eq "0" "$(cat "$work/exit.txt")" "auto-save: exits 0 on success"
-if [[ -s "$work/state-line" ]]; then
-  ok "auto-save: successful create records the watermark"
-else
-  nope "auto-save: successful create records the watermark" "state-line missing or empty"
-fi
-rm -rf "$work"
-
-# 9. auto-save: the same bounded retry. Five consecutive retryable failures
-#    stop after the cap; terminal statuses advance immediately.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-for run in 1 2 3 4 5; do
-  MX_STUB_EXIT=5 run_autosave "$work"
-done
-if [[ -s "$work/state-line" ]]; then
-  ok "auto-save: watermark advanced once the retry cap was reached"
-else
-  nope "auto-save: watermark advanced once the retry cap was reached" "state-line missing"
-fi
-assert_eq "3" "$(count_mx_calls "$work")" \
-  "auto-save: 3 create attempts across 5 runs (runs 4-5 attempt none)"
-if [[ -f "$work/state-line.fails" ]]; then
-  nope "auto-save: fail counter cleared after giving up" "counter still present"
-else
-  ok "auto-save: fail counter cleared after giving up"
-fi
-rm -rf "$work"
-
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-MX_STUB_EXIT=124 run_autosave "$work"
-if [[ -s "$work/state-line" ]]; then
-  ok "auto-save: timeout (124) is terminal — watermark advances, no duplicate-minting retry"
-else
-  nope "auto-save: timeout (124) is terminal" "state-line missing"
-fi
-assert_contains "$(cat "$work/stderr.txt")" "not retryable" \
-  "auto-save: timeout diagnostic names it as not retryable"
-rm -rf "$work"
-
-# 9b. auto-save: same unwritable-counter handling.
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/state-line.fails"
-MX_STUB_EXIT=5 run_autosave "$work"
-if [[ -s "$work/state-line" ]]; then
-  ok "auto-save: unwritable counter advances the watermark on the first failure"
-else
-  nope "auto-save: unwritable counter advances the watermark" "state-line missing"
-fi
-assert_contains "$(cat "$work/stderr.txt")" "cannot persist the retry counter" \
-  "auto-save: unwritable counter names the reason"
-MX_STUB_EXIT=5 run_autosave "$work"
-assert_eq "1" "$(count_mx_calls "$work")" \
-  "auto-save: unwritable counter — run 2 attempts no create"
-rm -rf "$work"
-
-# 10. precompact emits exactly one diagnostic per trigger (it has no watermark;
-#     one line per PreCompact event is inherent and bounded by the event).
-work=$(mktemp -d)
-make_stub_bin "$work/bin"
-make_transcript "$work/transcript.jsonl"
-mkdir -p "$work/home"
-( cd "$work" && PATH="$work/bin:$REAL_PATH" HOME="$work/home" MX_STUB_EXIT=5 \
-    bash "$PRECOMPACT_HOOK" \
-    <<<"{\"transcript_path\":\"$work/transcript.jsonl\",\"session_id\":\"s1\",\"trigger\":\"auto\"}" \
-    2>"$work/stderr.txt" >/dev/null )
-assert_eq "1" "$(grep -c 'mx memories create failed' "$work/stderr.txt")" \
-  "precompact: exactly one diagnostic per trigger"
-rm -rf "$work"
-
-echo ""
-echo "capture-hooks.test.sh: $PASS passed, $FAIL failed"
-[[ "$FAIL" -eq 0 ]] || exit 1
-exit 0