@mnemonik/shared 7.97.1 → 7.98.0

package/src/contextBudget.ts

@@ -37,10 +37,10 @@ export interface BudgetedContextFit {
 }
 
 const JOINER = '\n\n';
-const NOT_REACHED_PREFIX = '… not reached: ';
+const NOT_REACHED_PREFIX = '... not reached: ';
 
 function truncatedMemoryMarker(memoryId: string): string {
-  return `… [truncated; memory_get ${memoryId} for the rest]`;
+  return `... [truncated; memory_get ${memoryId} for the rest]`;
 }
 
 function itemMemoryIds(item: ContextBudgetItem): readonly string[] {

package/src/gitEditDetector.ts

@@ -2,7 +2,7 @@
  * Shell-write classification via filesystem observation, not command parsing.
  *
  * Permissive/auto-approve modes steer agents toward the shell for file work on
- * every host, and a shell payload carries a command string, not a file path —
+ * every host, and a shell payload carries a command string, not a file path -
  * so post-shell events reached the server with no edit to report and the
  * session's filesEdited/ideEditCount stayed empty, silencing every edit-gated
  * signal (checkpoint pressure above all). Parsing the command text for written
@@ -14,7 +14,7 @@
  * at session start, and after each shell call diff the current set against the
  * snapshot. Paths that are newly dirty were written between the two
  * observations. The caller reports those paths, then adds only confirmed paths
- * to the snapshot. Only additions count — a commit or stash SHRINKS the set,
+ * to the snapshot. Only additions count - a commit or stash SHRINKS the set,
  * and saving work is not new work. Edit tool writes are unioned into the
  * snapshot by each host's edit handler so they are never re-credited to the
  * next shell call.
@@ -22,7 +22,7 @@
  * Host-agnostic by construction: the caller owns session identity and passes
  * the absolute path of its own private snapshot file. An empty `snapshotFile`
  * is the caller's "no usable session identity" signal and every entry point
- * no-ops on it — a synthesized or fallback id must never own a snapshot.
+ * no-ops on it - a synthesized or fallback id must never own a snapshot.
  * Because the diff rolls the snapshot forward, it is idempotent: a host with
  * no post-shell event may call it from several carrier events and each new
  * write is still reported exactly once.
@@ -33,7 +33,7 @@
  * - Any working-tree change between two observations is credited to the shell
  *   call, including background processes. For "does this session have unsaved
  *   work" that is the right signal.
- * - Only the repo containing cwd is observed. Not a git repo → report nothing
+ * - Only the repo containing cwd is observed. Not a git repo -> report nothing
  *   rather than guess.
  */
 
@@ -94,7 +94,7 @@ export function listGitDirtyPaths(cwd: string): { root: string; paths: string[]
     const entry = tokens[i];
     if (!entry || entry.length < 4) continue;
     // "XY <path>"; a rename/copy entry is followed by the ORIGINAL path as its
-    // own NUL token — consume it so it is never misread as a status entry.
+    // own NUL token - consume it so it is never misread as a status entry.
     const statusCode = entry.slice(0, 2);
     paths.push(join(root, entry.slice(3)));
     if (statusCode.startsWith('R') || statusCode.startsWith('C')) i++;
@@ -139,7 +139,7 @@ export function captureGitDirtyBaseline(snapshotFile: string, cwd: string): void
  * After a shell call: paths newly dirty since the last observation, capped.
  * Leaves additions pending until the caller confirms them with
  * addPathsToGitDirtySnapshot. Without a usable baseline it establishes one and
- * reports nothing — degrading toward silence, never toward a false edit.
+ * reports nothing - degrading toward silence, never toward a false edit.
  */
 export function diffGitDirtySnapshot(snapshotFile: string, cwd: string): string[] {
   if (!snapshotFile) return [];
@@ -162,7 +162,7 @@ export function diffGitDirtySnapshot(snapshotFile: string, cwd: string): string[
 
 /**
  * After an edit tool: fold tool-reported edits into the snapshot so the next
- * shell diff does not re-credit them. Only when a baseline exists — seeding a
+ * shell diff does not re-credit them. Only when a baseline exists - seeding a
  * partial snapshot would make later diffs report pre-existing dirt.
  */
 export function addPathsToGitDirtySnapshot(snapshotFile: string, paths: string[]): void {

package/src/hookRuntime.ts

@@ -1,48 +1,32 @@
-import { readFile } from 'node:fs/promises';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { protectWindowsDirectory, type Execute } from './runtimeSigners.js';
 import { stderr } from 'node:process';
+import { resolveProjectIdentity, type ProjectIdentityResolution } from './repositoryRoot.js';
 
 export interface ProjectIdentity {
-  projectId?: string;
+  projectId: string;
   projectName?: string;
   projectRoot: string;
 }
 
-const identityCache = new Map<string, ProjectIdentity | null>();
-
 export async function findProjectIdentity(
   startCwd: string,
-  opts: { maxDepth?: number } = {}
+  options: { allowNestedInherit?: boolean; maxDepth?: number } = {}
 ): Promise<ProjectIdentity | null> {
   if (!startCwd) return null;
-  const cached = identityCache.get(startCwd);
-  if (cached !== undefined) return cached;
+  const result = await findProjectIdentityDetailed(startCwd, options);
+  if (result.kind !== 'ok') return null;
+  return {
+    projectId: result.identity.projectId,
+    projectName: result.identity.projectName,
+    projectRoot: result.root,
+  };
+}
 
-  let directory = isAbsolute(startCwd) ? startCwd : resolve(startCwd);
-  const maxDepth = opts.maxDepth ?? 10;
-  for (let depth = 0; depth <= maxDepth; depth += 1) {
-    try {
-      const parsed = JSON.parse(
-        await readFile(join(directory, '.mnemonik.json'), 'utf8')
-      ) as Record<string, unknown>;
-      if (typeof parsed.projectId === 'string' && parsed.projectId.length > 0) {
-        const identity: ProjectIdentity = {
-          projectId: parsed.projectId,
-          projectName: typeof parsed.projectName === 'string' ? parsed.projectName : undefined,
-          projectRoot: directory,
-        };
-        identityCache.set(startCwd, identity);
-        return identity;
-      }
-    } catch {
-      // Missing, unreadable, or malformed: keep walking upward.
-    }
-    const parent = dirname(directory);
-    if (parent === directory) break;
-    directory = parent;
-  }
-  identityCache.set(startCwd, null);
-  return null;
+export async function findProjectIdentityDetailed(
+  startCwd: string,
+  options: { allowNestedInherit?: boolean; maxDepth?: number } = {}
+): Promise<ProjectIdentityResolution> {
+  return resolveProjectIdentity(startCwd, options);
 }
 
 let mismatchEmitted = false;
@@ -52,7 +36,7 @@ export async function parseHookResponse<T>(response: Response): Promise<T> {
   const result = body as { ok?: boolean; reason?: string };
   if (!mismatchEmitted && result?.ok === false && result.reason === 'identity_mismatch') {
     stderr.write(
-      'mnemonik-hook: project identity mismatch — .mnemonik.json points to one project, ' +
+      'mnemonik-hook: project identity mismatch - .mnemonik.json points to one project, ' +
         'but this directory is registered to a different one on the server. ' +
         'Fix .mnemonik.json (delete it and let session_bootstrap rewrite it) or cd to the correct project root.\n'
     );
@@ -60,3 +44,147 @@ export async function parseHookResponse<T>(response: Response): Promise<T> {
   }
   return body;
 }
+
+/** Native host correlation only; never accept checkpoint/model fields here. */
+export function validHookSessionId(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    /^[a-zA-Z0-9@._+:-]{1,255}$/.test(value) &&
+    !['cursor-unknown-session', 'codex-unknown-session'].includes(value)
+  );
+}
+
+export interface HookBindingInput {
+  host: 'claude_code' | 'cursor' | 'grok';
+  hostSessionId: string;
+  cwd: string;
+  server: string;
+  stateFile: string;
+}
+
+/** Bounded JSON transport; never log credentials, request/response bodies or URLs. */
+export async function postHookBoundJson(server: string, path: string, token: string, body: object) {
+  const response = await fetch(`${server.replace(/\/$/, '')}${path}`, {
+    method: 'POST',
+    headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(2_000),
+  });
+  return { status: response.status, body: (await response.json()) as unknown };
+}
+
+/** Shared context/cache logic. Credentials remain owned by each host package's
+ * adapter callback so shared acquires no runtime credential dependency. */
+export async function bindHookContext(
+  input: HookBindingInput,
+  familyId: string,
+  hmac: (root: string) => Promise<{ version: 1; hmac: string }>,
+  post: (body: object) => Promise<number | string>,
+  options: { platform?: NodeJS.Platform; run?: Execute } = {}
+): Promise<void> {
+  const { execFile } = await import('node:child_process');
+  const { constants } = await import('node:fs');
+  const { lstat, mkdir, open, realpath } = await import('node:fs/promises');
+  const { dirname } = await import('node:path');
+  // Lazy: legacy durable runtimes may not carry the fingerprint module.
+  const { selectRemote } = await import('./repositoryFingerprint.js');
+  const identity = await findProjectIdentityDetailed(await realpath(input.cwd));
+  if (identity.kind === 'git_unavailable') throw new Error('context unavailable');
+  const root = await realpath(identity.root);
+  const binding = await hmac(root);
+  const gitEnv: NodeJS.ProcessEnv = { LC_ALL: 'C' };
+  for (const key of ['PATH', 'HOME', 'LANG', 'SYSTEMROOT', 'TEMP', 'TMP', 'USERPROFILE'])
+    if (process.env[key] !== undefined) gitEnv[key] = process.env[key];
+  const git = (args: string[]): Promise<string[]> =>
+    new Promise((resolve) => {
+      execFile(
+        'git',
+        args,
+        { cwd: root, env: gitEnv, timeout: 2_000, encoding: 'utf8' },
+        (error, stdout) => resolve(error ? [] : stdout.trim().split(/\r?\n/).filter(Boolean))
+      );
+    });
+  const remotes = identity.repository.kind === 'git' ? await git(['remote']) : [];
+  const selection = selectRemote(
+    await Promise.all(
+      remotes.map(async (name) => ({
+        name,
+        fetchUrls: await git(['remote', 'get-url', '--all', name]),
+        pushUrls: await git(['remote', 'get-url', '--push', '--all', name]),
+      }))
+    )
+  );
+  const body = {
+    host: input.host,
+    hostSessionId: input.hostSessionId,
+    deviceRootContext: {
+      algorithmVersion: binding.version,
+      hash: Buffer.from(binding.hmac, 'base64url').toString('hex'),
+    },
+    repositoryFingerprint:
+      selection.status === 'fingerprint'
+        ? {
+            algorithmVersion: selection.fingerprint.algorithmVersion,
+            hash: selection.fingerprint.hash,
+          }
+        : null,
+    // Automatic hooks never select a non-git root for the user.
+    rootKind: identity.repository.kind === 'git' ? 'git' : 'ineligible',
+    identityState:
+      identity.kind === 'ok' ? 'valid' : identity.kind === 'absent' ? 'absent' : 'invalid',
+    ...(identity.kind === 'ok' ? { projectId: identity.identity.projectId } : {}),
+  };
+  const key = JSON.stringify([input.server, familyId, body]);
+  const directory = dirname(input.stateFile);
+  for (const path of [dirname(directory), directory]) {
+    const created = await mkdir(path, { recursive: true, mode: 0o700 });
+    const stat = await lstat(path);
+    if (
+      !stat.isDirectory() ||
+      stat.isSymbolicLink() ||
+      ((options.platform ?? process.platform) !== 'win32' &&
+        ((process.getuid && stat.uid !== process.getuid()) || stat.mode & 0o077))
+    )
+      throw new Error('cache unavailable');
+    if ((options.platform ?? process.platform) === 'win32') {
+      await protectWindowsDirectory(path, created !== undefined, options.run, directory);
+    }
+  }
+  const file = await open(
+    input.stateFile,
+    constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW,
+    0o600
+  );
+  try {
+    let cache:
+      { key: string; expiresAt: number; retryKey?: string; canonicalRoot?: string } | undefined;
+    try {
+      cache = JSON.parse(await file.readFile('utf8'));
+    } catch {
+      /* First event. */
+    }
+    const now = Date.now();
+    if (cache && cache.expiresAt > now && (cache.key === key || cache.retryKey === key)) return;
+    const status = await post(body);
+    if (status === 200) cache = { key, expiresAt: Date.now() + 120_000, canonicalRoot: root };
+    else {
+      stderr.write(`mnemonik-hook: bound-context post failed (${status})\n`);
+      if (status !== 409) return;
+      // A changed root/identity cannot replace a live server binding. Retry at
+      // its original expiry; without a local receipt, wait one conservative TTL.
+      cache = {
+        key: cache?.key ?? '',
+        expiresAt: cache && cache.expiresAt > now ? cache.expiresAt : now + 120_000,
+        retryKey: key,
+      };
+    }
+    await file.truncate(0);
+    await file.write(JSON.stringify(cache), 0, 'utf8');
+  } finally {
+    await file.close();
+  }
+}
+
+export * from './runtimeReader.js';
+export * from './runtimeSigners.js';
+export * from './projectSetupHandoff.js';

package/src/hookTimeouts.ts

@@ -6,11 +6,11 @@
  * `@mnemonik/codex-hooks`, `@mnemonik/cursor-hooks`). Before the
  * 2026-05-16 audit Finding #7 cross-cutting cleanup, each package
  * declared its own copy of these constants and a near-identical
- * `withTimeout` helper — coordinating a budget change required three
+ * `withTimeout` helper - coordinating a budget change required three
  * synchronised edits with no enforcement that the values matched.
  *
  * Surface is intentionally minimal: small constants + a single helper
- * function. No fetch wrappers here — request shaping stays per-package
+ * function. No fetch wrappers here - request shaping stays per-package
  * because each host expresses its hook payloads differently.
  */
 
@@ -20,8 +20,8 @@
  * The bootstrap digest is delivered over `injections`, so it rides this 2s
  * budget. That is intentional and sufficient: on a warm cache
  * (HooksDispatcher.buildBootstrapDigestPayload) delivery is a Redis GET plus
- * render; on a cold cache the delivery path awaits buildColdFloorDigest — a
- * parallel Promise.all of cheap DB reads raced under a 1500ms sub-budget —
+ * render; on a cold cache the delivery path awaits buildColdFloorDigest - a
+ * parallel Promise.all of cheap DB reads raced under a 1500ms sub-budget -
  * and may return an enriched floor digest. The static `session_bootstrap`
  * directive is the fallback only when the floor is entirely empty (or the
  * floor fetch times out). A full synthesis build is fired in the background
@@ -40,7 +40,7 @@ export const POST_TOOL_TIMEOUT_MS = 1500;
 
 /**
  * beforeMCPExecution gate budget. This is the ONLY synchronous, user-facing
- * gate — the user waits on it before every MCP tool call — so it fails open
+ * gate - the user waits on it before every MCP tool call - so it fails open
  * faster than the background critical fetch (FETCH_TIMEOUT_MS = 2000). A
  * precheck slower than 1s is not worth blocking the tool call for; on a
  * degraded server we drop the gate rather than stall the user.
@@ -50,7 +50,7 @@ export const MCP_PRECHECK_TIMEOUT_MS = 1000;
 /**
  * Spawn an `AbortController` tied to a timeout. Returns the signal plus a
  * `cleanup` function the caller MUST invoke (in `finally`) to clear the
- * timer when the request finishes naturally — otherwise the timer leaks
+ * timer when the request finishes naturally - otherwise the timer leaks
  * for the timeout duration.
  *
  * Identical signature to the inlined `withTimeout` that each hook package