@sporhq/spor 0.4.0 → 0.4.2

package/.claude-plugin/plugin.json

@@ -2,6 +2,6 @@
   "name": "spor",
   "displayName": "Spor Context Compiler",
   "description": "Maintains a typed, versioned knowledge graph and compiles compact briefings from it: session-start injection, per-prompt relevance digests, capture at discovery, end-of-session distillation, decision queue.",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "author": { "name": "losthammer" }
 }

package/bin/spor.js

@@ -925,27 +925,39 @@ function claudePluginInfo() {
   return p ? { version: p.version, scope: p.scope, enabled: p.enabled, installPath: p.installPath } : null;
 }
 
-// Best-effort: is a claude.ai Spor MCP connector bound on this box? A connector
-// added in claude.ai surfaces in Claude Code as the mcp__…_Spor__* tools
-// (art-cc-spor-connector-dual-host), i.e. a SECOND live write surface alongside
-// the local file graph. Claude Code records connected claude.ai connectors in
-// ~/.claude.json's `claudeAiMcpEverConnected` array (entries like
-// "claude.ai Spor"); we key the detection on a Spor-named entry there (matching
-// the pre-rename "Substrate" name too — the connector predates the rename and
-// the array keeps historical entries). This is the only discoverable signal a
-// plain Claude Code box exposes: there is no per-session "currently active"
-// manifest. FAIL-OPEN by contract — any missing/unreadable/unparseable file
-// returns false so `spor status` never emits a false split-brain warning or
-// crashes. SPOR_FAKE_CLAUDE_JSON overrides the path for tests.
+// Best-effort: is a claude.ai Spor MCP connector CURRENTLY bound on this box? A
+// connector added in claude.ai surfaces in Claude Code as the mcp__…_Spor__*
+// tools (art-cc-spor-connector-dual-host), i.e. a SECOND live write surface
+// alongside the local file graph. We read the LIVE set from `claude mcp list`
+// (mirroring claudePluginInfo's spawn) and look for a Spor-named connector —
+// matching the pre-rename "Substrate" name too. We deliberately do NOT key on
+// ~/.claude.json's `claudeAiMcpEverConnected`: that array is a sticky historical
+// "ever connected" list that never clears when a connector is disabled or
+// removed, so it warned forever after the user unbound the connector
+// (issue-spor-status-split-brain-warning-false-positive). FAIL-OPEN by contract:
+// claude absent / nonzero exit / timeout / empty output all return false, so
+// `spor status` never emits a false split-brain warning or hangs. The health
+// status (Connected / Needs authentication / Failed) is ignored — any current
+// binding is a configured second write surface. SPOR_FAKE_MCP_LIST injects
+// canned `claude mcp list` output for tests.
 function sporConnectorBound() {
   try {
-    const p = process.env.SPOR_FAKE_CLAUDE_JSON || path.join(homeDir(), ".claude.json");
-    const j = JSON.parse(fs.readFileSync(p, "utf8"));
-    const ever = j && j.claudeAiMcpEverConnected;
-    if (!Array.isArray(ever)) return false;
-    return ever.some((name) => typeof name === "string" && /\bspor\b|\bsubstrate\b/i.test(name));
+    let text = process.env.SPOR_FAKE_MCP_LIST;
+    if (text == null) {
+      const cmd = claudeCmd();
+      if (cmd === "claude" && !hasCmd("claude")) return false;
+      const r = spawnSync(cmd, ["mcp", "list"], { encoding: "utf8", timeout: 8000 });
+      if (r.status !== 0 || !r.stdout) return false;
+      text = r.stdout;
+    }
+    // Each connector is a line like "claude.ai Spor: <url> - <status>". Match the
+    // NAME segment (before the first colon) only, so a "spor" in a URL or status
+    // can't trip it; \b keeps "Spotify"/"Supabase" from matching "spor".
+    return text
+      .split("\n")
+      .some((line) => /\bspor\b|\bsubstrate\b/i.test(line.split(":")[0] || ""));
   } catch {
-    return false; // no file, unreadable, or malformed => assume no connector
+    return false; // claude missing, spawn error, or unparseable => assume none
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sporhq/spor",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Spor — a shared memory substrate for teams and agents. Decisions, their reasons, and the traces they leave. Knowledge-graph context compiler: session-start briefings, per-prompt digests, capture at discovery, end-of-session distillation, decision queue.",
   "license": "Apache-2.0",
   "author": "Anthony Allen",

package/skills/brief/SKILL.md

@@ -37,14 +37,26 @@ Steps:
    **Local mode (personal graph) — `SPOR_SERVER` unset:** first resolve the
    plugin root — `${CLAUDE_PLUGIN_ROOT}` is empty in the Bash tool, so read
    the path the session-start hook cached
-   (issue-cc-skill-plugin-root-unsubstituted):
+   (issue-cc-skill-plugin-root-unsubstituted) — then resolve THIS repo's
+   project slug the same way a session does, so the compile is scoped to the
+   repo you're in instead of project-blind:
    ```bash
    SPOR_ROOT="$(cat "${SPOR_HOME:-$HOME/.spor}/cache/plugin-root" 2>/dev/null \
      || cat "$HOME/.substrate/cache/plugin-root" 2>/dev/null)"
    SPOR_ROOT="${SPOR_ROOT:-$CLAUDE_PLUGIN_ROOT}"
+   SLUG="$(node -e 'process.stdout.write(require("'"$SPOR_ROOT"'/scripts/engines/util.js").projectSlug(process.cwd()))' 2>/dev/null)"
    ```
-   - node id: `node "$SPOR_ROOT/lib/compile.js" --root <id> --skeleton`
-   - query: `node "$SPOR_ROOT/lib/compile.js" --query "<text>"`
+   - node id: `node "$SPOR_ROOT/lib/compile.js" --root <id> --skeleton ${SLUG:+--project "$SLUG"}`
+   - query: `node "$SPOR_ROOT/lib/compile.js" --query "<text>" ${SLUG:+--project "$SLUG"}`
+
+   **Always pass `--project "$SLUG"`.** Without it, `compile --root`/`--query`
+   run *project-blind* (`sessionProject == null`): the org-norm ride-along then
+   keeps every `always_on` norm and ignores `applies_to_repos`/`applies_to_tags`/
+   `applies_to_projects` scoping entirely — so an unscoped briefing shows norms a
+   real session in this repo would filter out (the `applies_to_*` selectors match
+   the SESSION repo, not the `--root` node's repo). `--project` makes the compile
+   match what session-start actually injects here.
+
    (The compiler defaults to the global graph at `$SPOR_HOME/nodes`, falling
    back to `~/.spor/nodes` — or a pre-existing `~/.substrate/nodes` when
    `~/.spor` is absent.)

package/skills/spor/SKILL.md

@@ -100,6 +100,10 @@ mode dispatches to the server (mirroring `/spor:brief`). Much of this is what
 the session hooks already inject for you automatically; pulling one on demand
 with `spor brief`, `spor compile`, or `/spor:brief` is the same briefing.
 Passing `--nodes <dir>` always targets that local checkout, even under a server.
+In local mode, add `--project <repo-slug>` to scope to a repo: without it
+`compile --root`/`--query` run *project-blind* and the `always_on` norm
+ride-along ignores `applies_to_*` scoping (every norm rides along) — pass it to
+match what a real session in that repo sees. `/spor:brief` does this for you.
 
 **In Cowork (Anthropic's chat workspace) and Claude Code with the connector**
 there is no shell and no ambient injection — reach the graph through the