@memnexus-ai/cli 1.7.234 → 1.7.236

package/hooks/capture-session-end.sh

@@ -237,6 +237,261 @@ fi
 # Truncate to ~5000 chars
 CONTENT=$(echo "$CONTENT" | head -c 5000)
 
+# ── 6b. Resolve project scope (codeContext) ──────────────────────────────
+# Auto-captured memories carried no scope at all, so they leaked into every
+# team's scoped searches and polluted build_context (#5158, #4957). PR #3281
+# fixed that for the commit path only; this is the same resolution for the
+# capture hooks, using the same sources and the same precedence.
+#
+# Mirrors resolveCommitCodeContext() in cli/src/lib/commit-context/code-context.ts:
+#   1. MX_CODE_CONTEXT env var — operator-controlled, higher trust. It wins over
+#      the file (CWE-345): a checked-in file from an untrusted clone must not
+#      override the scope the operator set explicitly.
+#   2. <projectRoot>/.mx-code-context.json — repo-controlled, lower trust.
+#   3. Neither present or neither usable -> NO scope. The memory is created
+#      unlabeled, exactly as it was before this block existed. No default is
+#      invented: a guessed label is invisible to the scope that should see it
+#      and visible to one that should not, which is worse than no label.
+#
+# Every command in this block must end up returning 0. The EXIT/ERR trap set in
+# section 5 exits the hook, so a non-zero status here would abandon the capture
+# over a missing config file — a far worse regression than the unlabeled
+# memories this fixes. The absent-config path is the common one today.
+CODE_CONTEXT_MAX_BYTES=65536
+
+# Walk up for the git project root, mirroring findProjectRoot() in
+# cli/src/lib/commit-context/local-cache.ts. `-e`, not `-d`: inside a git
+# worktree `.git` is a FILE, and the worktree root — not the main repo — is the
+# project root (the TS uses fs.existsSync, which makes no such distinction).
+find_project_root() { # <start-dir> -> project root on stdout, or nothing
+  local dir
+  dir=$(cd "$1" 2>/dev/null && pwd -P) || return 0
+  while [[ -n "$dir" && "$dir" != "/" ]]; do
+    if [[ -e "$dir/.git" ]]; then
+      printf '%s' "$dir"
+      return 0
+    fi
+    dir=$(dirname "$dir" 2>/dev/null) || return 0
+  done
+  return 0
+}
+
+# Keep only the six known keys whose values are non-empty strings, cap each,
+# and emit NOTHING when nothing usable remains — so an empty or scope-free
+# object is never passed as if it were a label. Malformed JSON makes jq exit
+# non-zero with no output, which lands in the same "no scope" branch.
+#
+# `-s` (slurp) is load-bearing, not a style choice. jq accepts a STREAM of JSON
+# documents: without `-s` the filter runs once per document and `jq -c` prints
+# one line each, so a config holding two concatenated or newline-separated
+# objects produced a MULTI-LINE string that was passed verbatim as one
+# --code-context argument. parseCodeContextFlag() (cli/src/commands/memories.ts)
+# JSON.parse()s it and process.exit(1)s before any network call — the capture is
+# lost silently, triggered by cloning a repo. The `!= "{}"` guard below did not
+# catch it either: `{"zzz":1}{"team":"b"}` normalizes to the two lines
+# `{}` + `{"team":"b"}`, and that whole string is not `{}`. Slurping into an
+# array and taking the first element means exactly one line can ever be emitted.
+#
+# The cap is 100 CODEPOINTS, deliberately below the server's 200. The server's
+# CodeContextSchema uses Zod `.max(200)`, which counts UTF-16 code units, while
+# jq's `[0:N]` slices by codepoint. Every astral-plane character (emoji, CJK
+# extensions, mathematical alphanumerics) is 1 codepoint but 2 UTF-16 units, so
+# a `[0:200]` cap emitted values of up to 400 units — over the server maximum,
+# a 400 from the API, and the same silent capture loss. Since no codepoint
+# exceeds 2 UTF-16 units, 100 codepoints can never exceed 200 units. Scope
+# labels are short names (product/team/service); the extra truncation is
+# unreachable in practice, and truncating is recoverable where a rejected
+# request is not.
+normalize_code_context() { # JSON on stdin -> normalized JSON object, or nothing
+  local out
+  out=$(jq -s -c '
+    (.[0] // {}) as $raw
+    | if ($raw | type) == "object" then
+        reduce ("product","repo","service","component","team","role") as $k ({};
+          if ($raw[$k] | type) == "string" and ($raw[$k] | length) > 0
+          then .[$k] = ($raw[$k][0:100])
+          else . end)
+      else {} end
+  ' 2>/dev/null) || return 0
+  # The newline test is belt-and-braces: `-s` already guarantees one document,
+  # and jq -c escapes newlines inside string values. Nothing multi-line may ever
+  # reach --code-context again, whatever the filter above does.
+  if [[ -n "$out" && "$out" != "{}" && "$out" != "null" && "$out" != *$'\n'* ]]; then
+    printf '%s' "$out"
+  fi
+  return 0
+}
+
+CODE_CONTEXT_JSON=""
+
+# 1. Env var. Tested for presence only — the value is never echoed or logged.
+if [[ -n "${MX_CODE_CONTEXT:-}" ]]; then
+  CODE_CONTEXT_JSON=$(printf '%s' "$MX_CODE_CONTEXT" | normalize_code_context) || CODE_CONTEXT_JSON=""
+fi
+
+# 2. Repo file — consulted only when the env var yielded nothing usable.
+if [[ -z "$CODE_CONTEXT_JSON" ]]; then
+  # ORDER IS LOAD-BEARING: harness-provided project dir, then the worktree path,
+  # then the cwd. Each source is TRIED IN TURN, and the transcript's directory
+  # is not a source at all. Both properties are corrections to earlier forms and
+  # both are pinned by the suite; read this before rewriting the expression.
+  #
+  # WHY EACH SOURCE IS TRIED SEPARATELY. The earlier form collapsed all three
+  # into ONE call: `find_project_root "${CLAUDE_PROJECT_DIR:-${CLAUDE_WORKTREE_PATH:-$(pwd)}}"`.
+  # `:-` substitutes only when a variable is UNSET or EMPTY — never when it is
+  # set to something useless. So a CLAUDE_PROJECT_DIR that is set but resolves
+  # to no repository (a stale path, a deleted directory, a path outside any
+  # checkout) consumed the single attempt and the cwd was NEVER consulted.
+  # Measured: CLAUDE_PROJECT_DIR=/proc and =/nonexistent/zz each produced
+  # {"product":"home","team":"DOTFILES-WRONG-SCOPE"} from the $HOME config.
+  # The loop below consults the next source instead, which `:-` cannot express.
+  #
+  # WHAT IS ACTUALLY KNOWN ABOUT CLAUDE_PROJECT_DIR IN THE CUSTOMER CONTEXT.
+  # It is the documented hook variable, and it is the right first source when it
+  # is present. This repo does NOT evidence that it is set for hooks installed
+  # by `mx mcp install`: every other reference to it is fleet code, and it was
+  # measured UNSET in a live Claude Code tool process (a tool process is not a
+  # hook process, so that is not disproof — but it is not confirmation either).
+  # The expression below is therefore designed to be CORRECT WHEN IT IS ABSENT:
+  # an unset or empty value is skipped by the loop and the cwd carries the case.
+  # Do not restructure this so that a present CLAUDE_PROJECT_DIR is required.
+  # WHY THE TRANSCRIPT DIRECTORY IS NOT A SOURCE. It has no legitimate resolving
+  # power, and the reason is DEPTH-INDEPENDENT — do not restate it as a claim
+  # about the transcript's nesting. An earlier version of this comment argued
+  # from a flat ~/.claude/projects/<slug>/<id>.jsonl layout and enumerated the
+  # three directories a walk could reach. That premise is false here. Measured
+  # on this machine: transcripts sit at BOTH depth 2 and depth 4 under
+  # ~/.claude/projects — 310 at depth 2, 5621 deeper — so any argument of the
+  # form "the walk can only ever reach these three named directories" does not
+  # hold. The premise that does hold, and that does not depend on depth:
+  #
+  #     .git anywhere under ~/.claude, any depth: 0   (also no .hg, no .svn)
+  #
+  # An upward walk from any transcript directory traverses only directories
+  # inside ~/.claude, none of which carries a repository marker, so it cannot
+  # terminate inside that subtree at any depth. That leaves $HOME as its ONLY
+  # reachable non-empty outcome, which is precisely the defect this block exists
+  # to prevent: keeping dotfiles in git is common, so $HOME/.git exists on many
+  # machines, and with $HOME/.mx-code-context.json present every capture from
+  # every worktree on the machine was labelled from the home config. A
+  # confidently wrong label is worse than no label — invisible to the scope that
+  # should see it, visible to one that must not. Do not reintroduce it.
+  #
+  # CAVEAT, stated because this is a claim about a directory OUTSIDE this
+  # repository: it could stop being true, and nothing in this codebase would
+  # notice if a repository ever appeared under ~/.claude. Removing the leg does
+  # not depend on the caveat holding — the leg is simply gone — but any future
+  # argument to reinstate it must re-measure rather than cite this line.
+  #
+  # WHY $HOME IS REFUSED OUTRIGHT, AND WHY BOTH SIDES ARE CANONICALIZED. Belt
+  # and braces for the residual where the cwd itself is $HOME or a directory
+  # beneath it whose nearest .git is $HOME's. It also closes a consequence that
+  # is easy to miss: CC_ROOT is the basis of the symlink containment test below,
+  # so a CC_ROOT of $HOME silently widens "contained in the project" to
+  # "anywhere in the home directory", and $HOME/.mx-code-context.json symlinked
+  # to any other file under $HOME would resolve and be used. The cost is not
+  # supporting a user whose real project IS their home directory; that is the
+  # same confusion we want rejected.
+  #
+  # The comparison MUST canonicalize $HOME. CC_ROOT always arrives canonical —
+  # find_project_root builds it with `cd … && pwd -P` — while $HOME arrives
+  # verbatim from the environment, so a literal `==` against "$HOME" misses on
+  # every spelling that is not byte-identical. Four spellings were measured
+  # leaking the home label through a symlinked $HOME/.mx-code-context.json: a
+  # trailing slash ("/home/x/"), a "/." suffix ("/home/x/."), $HOME set to a
+  # SYMLINK to the real home, and a cwd reached through that same symlink.
+  # Symlinked home directories are routine — macOS firmlinks, NFS corporate
+  # homes, container images mapping /home/user onto another volume — so the
+  # trigger is a normal configuration and the miss is silent: the refusal does
+  # not fire, and the containment widening above returns with it. `cd … && pwd -P`
+  # is the same primitive find_project_root uses and handles all four in one step.
+  #
+  # HOME unset, or pointing at nothing, leaves _home_real empty and no refusal
+  # fires. That is unchanged from the previous `-n "${HOME:-}"` guard, not a
+  # regression. The `|| _home_real=""` is REQUIRED, not decorative: without it a
+  # failing `cd` leaves the assignment non-zero and last on its path, which fires
+  # the ERR trap and abandons the capture.
+  #
+  # ERR-TRAP SAFETY — verified, not assumed, because a regression here fires
+  # `trap 'exit 0' ERR` and silently abandons the capture. The loop body's only
+  # status-bearing statement is a `$(...)` assignment of find_project_root, which
+  # returns 0 on every path including the `cd` failure. The break is written as
+  # an `if` block for the same reason the $HOME refusal is. The earlier one-line
+  # form `[[ -n "$CC_ROOT" ]] && break` returns 1 whenever the loop CONTINUES —
+  # an earlier version of this comment claimed it returned 0, which was wrong. It
+  # was safe only POSITIONALLY: as a non-final command of an `&&` list it is
+  # exempt under the errexit rules, so nothing fired. That safety depends on
+  # where the statement sits and would evaporate the moment this loop became the
+  # last statement of a function: the function would return 1 and any `$(...)`
+  # call of it would fire the trap. The `if` form returns 0 and removes the
+  # positional dependence.
+  #
+  # The same reasoning is why the $HOME refusal is an `if` block ON PURPOSE: the
+  # one-line `[[ "$CC_ROOT" == "$_home_real" ]] && CC_ROOT=""` returns 1 when the
+  # test is false, and was measured firing the ERR trap when it landed last in an
+  # enclosing block. `pwd 2>/dev/null` keeps a deleted cwd from printing "error
+  # retrieving current directory" onto the hook's real stderr. This safety comes
+  # from find_project_root always returning 0, not from this hook omitting
+  # `set -E`, so it survives someone adding `set -E` later. Do not introduce a
+  # bare command on this path.
+  CC_ROOT=""
+  for _cand in "${CLAUDE_PROJECT_DIR:-}" "${CLAUDE_WORKTREE_PATH:-}" "$(pwd 2>/dev/null)"; do
+    [[ -n "$_cand" ]] || continue
+    CC_ROOT=$(find_project_root "$_cand")
+    if [[ -n "$CC_ROOT" ]]; then break; fi
+  done
+  _home_real=$(cd "${HOME:-/nonexistent}" 2>/dev/null && pwd -P) || _home_real=""
+  if [[ -n "$_home_real" && "$CC_ROOT" == "$_home_real" ]]; then
+    CC_ROOT=""
+  fi
+  CC_FILE="${CC_ROOT}/.mx-code-context.json"
+  if [[ -n "$CC_ROOT" ]]; then
+    # CWE-59. `-f`, `-r` and the read all follow symlinks, so a repo could check
+    # in `.mx-code-context.json` as a symlink to any file on the user's machine
+    # and the six allowlisted keys of it would be uploaded to the user's own
+    # MemNexus account. Resolve the path and require the result to stay inside
+    # the project root — the containment this same hook already applies to the
+    # transcript path in section 2. Read through the RESOLVED path, so the link
+    # is not traversed a second time.
+    CC_REAL=$(realpath "$CC_FILE" 2>/dev/null || printf '')
+    if [[ -n "$CC_REAL" && "$CC_REAL" == "$CC_ROOT"/* && -f "$CC_REAL" && -r "$CC_REAL" ]]; then
+      # One open, bounded at the source (same 64KB bound as the TS resolver).
+      # The previous form size-checked with `wc -c` and then re-opened for jq:
+      # two opens on a path an untrusted repo controls, so a concurrent writer
+      # could present a small file to `wc` and a huge one to `jq` (TOCTOU) on a
+      # hot per-turn path. `head -c` bounds the read itself, which changes >64KB
+      # from "skipped" to "truncated, then rejected as invalid JSON" — the same
+      # observable outcome, no scope.
+      #
+      # `2>/dev/null` precedes the input redirect ON PURPOSE. Redirections apply
+      # left to right, so with `<"$CC_REAL" 2>/dev/null` a file that turned
+      # unreadable between the `-r` test and the open makes bash print the full
+      # path and "Permission denied" to the hook's REAL stderr, before the
+      # discard takes effect. Verified: reversing these two words reintroduces
+      # that leak. Do not reorder.
+      #
+      # The bytes are PIPED into jq, never routed through a variable. Bash
+      # strips NUL bytes out of command-substitution output and warns while
+      # doing it — from the parent shell reading the substitution, so the
+      # `2>/dev/null` above does not suppress that warning. Via a variable,
+      # `{"team":"a<NUL>b"}` printed a warning naming this script and line to
+      # the hook's real stderr, and then RESOLVED to team "ab": input the file
+      # does not contain, silently repaired before validation instead of
+      # rejected by it. Piping keeps the NUL inside jq, which rejects the
+      # document as malformed. Do not reintroduce an intermediate variable.
+      CODE_CONTEXT_JSON=$(head -c "$CODE_CONTEXT_MAX_BYTES" 2>/dev/null <"$CC_REAL" | normalize_code_context) || CODE_CONTEXT_JSON=""
+    fi
+  fi
+fi
+
+# Nothing resolved -> pass nothing at all, so the create command line is
+# byte-identical to the pre-scope version. The `[@]+` guard keeps an empty array
+# safe to expand under `set -u` on bash < 4.4.
+CODE_CONTEXT_ARGS=()
+if [[ -n "$CODE_CONTEXT_JSON" ]]; then
+  CODE_CONTEXT_ARGS=(--code-context "$CODE_CONTEXT_JSON")
+fi
+
 # ── 7. Save memory (with timeout — never block session exit) ─────────────
 TIMEOUT_CMD=""
 if command -v timeout >/dev/null 2>&1; then
@@ -254,6 +509,7 @@ $TIMEOUT_CMD mx memories create \
   --conversation-id "NEW" \
   --content "$CONTENT" \
   --topics "auto-captured,session-summary" \
+  "${CODE_CONTEXT_ARGS[@]+"${CODE_CONTEXT_ARGS[@]}"}" \
   >/dev/null 2>&1 || CREATE_STATUS=$?
 
 # ── 8. Update debounce state (bounded retry) ─────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/cli",
-  "version": "1.7.234",
+  "version": "1.7.236",
   "description": "Command-line interface for MemNexus Core API",
   "main": "dist/index.js",
   "bin": {
@@ -23,6 +23,7 @@
     "dist/",
     "bin/",
     "hooks/",
+    "!hooks/*.test.sh",
     "README.md",
     "CHANGELOG.md",
     "USAGE.md"
@@ -34,7 +35,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@memnexus-ai/typescript-sdk": "^1.75.3",
+    "@memnexus-ai/typescript-sdk": "^1.77.4",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "axios": "^1.13.6",
     "chalk": "^5.3.0",