@theronap/agnoclast-mcp 0.9.180 → 0.9.182

package/lib/arrivals_notice.mjs

@@ -56,6 +56,10 @@ import { fetchCortex, resolveBase, resolveTokenSource } from './diagnose.mjs'
  * to — but this is a hook that prints unprompted, and a notice that dumps content trains its reader
  * to skip it. Exported for the tests.
  */
+// Enough to hold a session's own recent output in full; small enough that the notice is READ rather
+// than spilled to a file, which is what happened at 49 KB.
+const MAX_YOURS = 25
+
 export function formatNotice(signals) {
   const lines = []
   const offers = signals?.settling?.offers ?? []
@@ -66,32 +70,34 @@ export function formatNotice(signals) {
     lines.push(`⚡ ${delta} new arrival${delta === 1 ? '' : 's'} in the pile since this session was last told.`)
   }
   if (offers.length) {
-    lines.push(`⚡ ${total} arrival${total === 1 ? '' : 's'} asking THIS session to decide:`)
-    // ⚠ EVERY OFFER, GROUPED BY CASCADE STAGE — changed 2026-09-25 from the first SIX.
+    // ⭐ LEAD WITH WHAT IS PROVABLY THIS SESSION'S, AND ONLY LIST THAT (2026-09-25).
     //
-    // Six of a deterministically-ordered twelve showed the SAME handful every turn while the rest of
-    // the pile stayed unreachable, and a session cannot claim what it is never shown. via_reason is
-    // still carried through verbatim rather than flattened — a reader who learns the stated reason is
-    // unreliable stops reading it — but it is printed ONCE PER GROUP instead of on every row, which
-    // is what makes listing all of them fit at all.
-    const STAGES = [
-      ['matched', 'matches your work'],
-      ['orphan', 'nothing matched them anywhere'],
-      ['declined', 'every other matching session declined them'],
-    ]
-    for (const [key, why] of STAGES) {
-      const group = offers.filter((o) => o.via_reason === key)
-      if (!group.length) continue
-      lines.push(`   ${why} (${group.length}):`)
-      // The title is what makes a row judgeable; an id names a unit without saying what it is.
-      for (const o of group) {
-        const name = o.title ? `  ${o.title}` : ''
-        lines.push(`     ${o.intakeItemId}${name}  · ${o.source} · ${o.hoursAgo}h`)
+    // Measured on the session that built this, as the one receiving it: 6 bare ids — filed nothing; 205
+    // titled rows — filed nothing; 350 rows at 49 KB — the harness spilled it to a file and showed a 2 KB
+    // preview, so it was not even read. Filed immediately: the one record it had looked at and could see
+    // was its own. What moves an agent is certainty, a short list, and the reason stated. So the rows
+    // shown are the ones whose files THIS SESSION CHANGED (`worked`), each with the file that proves it,
+    // framed as the step before the answer; every other tier is one line of counts.
+    const yours = offers.filter((o) => o.via_reason === 'matched' && (o.worked ?? []).length)
+    const rest = offers.filter((o) => !yours.includes(o))
+    if (yours.length) {
+      const n = yours.length
+      lines.push(`⚡ ${n} arrival${n === 1 ? '' : 's'} came from work THIS SESSION did — you changed the files ${n === 1 ? 'it touches' : 'they touch'}. File ${n === 1 ? 'it' : 'them'} before anything else:`)
+      for (const o of yours.slice(0, MAX_YOURS)) {
+        const files = o.worked.slice(0, 2).map((f) => f.split('/').pop()).join(', ')
+        lines.push(`     ${o.intakeItemId}  ${o.title ?? '(unreadable)'}  · ${o.source} · ${o.hoursAgo}h — you changed ${files}`)
       }
+      if (n > MAX_YOURS) lines.push(`     … and ${n - MAX_YOURS} more that are yours`)
+      lines.push('   `intake_look <id>` shows where one would go · `intake_materialize` files it · `not_mine` if one is not yours.')
     }
-    // Only when the pile genuinely exceeds the server's scan window; `total` is counted before it.
-    if (total > offers.length) lines.push(`   … and ${total - offers.length} beyond the scan window`)
-    lines.push('   (Claim + route them, or say they are not yours — they stay unclaimed until someone decides.)')
+    const counts = { matched: 0, orphan: 0, declined: 0 }
+    for (const o of rest) counts[o.via_reason] = (counts[o.via_reason] ?? 0) + 1
+    const parts = []
+    if (counts.matched) parts.push(`${counts.matched} loosely matching your work`)
+    if (counts.orphan) parts.push(`${counts.orphan} matching no session`)
+    if (counts.declined) parts.push(`${counts.declined} declined by other sessions`)
+    if (total > offers.length) parts.push(`${total - offers.length} beyond the scan window`)
+    if (parts.length) lines.push(`⚡ Also settling: ${parts.join(' · ')} — not listed here; \`intake_changes\` shows them.`)
   }
   return lines.join('\n')
 }

package/lib/server.mjs

@@ -16,6 +16,7 @@ import { renderCaptureStatus } from './capture_status.mjs'
 import { renderTriage } from './red_link_triage.mjs'
 import { runCodeGraphQuery } from './code_graph_cli.mjs'
 import { repoFullNameFrom, workingFilesFrom } from './capture.mjs'
+import { findTranscript, createWorkedFilesTracker } from './working_files.mjs'
 import { spawnObligationWorker } from './obligations_worker.mjs'
 import { renderObligations } from './obligations_render.mjs'
 
@@ -185,6 +186,25 @@ export async function runServer(version) {
   // server labels actor_source from this and watches for `mcp` + no session. Tying the two together
   // would make that pair impossible and blind the detector. See actorSourceFrom in auth_cloud.ts.
   setClientVersion(version)
+  // ADR-0066 §7 — the files this session WORKED ON, read from its own transcript.
+  //
+  // Keyed on CLAUDE_CODE_SESSION_ID, never SESSION_KEY: SESSION_KEY falls back to a random uuid on
+  // hosts that do not set the env var, and no transcript is named after a random uuid. Created LAZILY
+  // because a brand-new session's transcript may not exist yet when this server starts; each
+  // heartbeat retries until it appears, then the tracker reads only what was appended since.
+  let workedFiles = null
+  function currentWorkedFiles() {
+    try {
+      if (!workedFiles) {
+        const t = findTranscript(process.env.CLAUDE_CODE_SESSION_ID)
+        if (!t) return []
+        workedFiles = createWorkedFilesTracker(t)
+      }
+      return workedFiles.poll(40)
+    } catch {
+      return []   // attention data is never worth disturbing a session for
+    }
+  }
   async function pingSession() {
     try {
       await fetchCortex(`${BASE}/api/session-ping`, {
@@ -208,6 +228,11 @@ export async function runServer(version) {
           // of 217 arrivals "matched" on a live session — a pile with no bounded action in it.
           // Best-effort and bounded in workingFilesFrom; a non-repo cwd yields [] and is omitted.
           files: workingFilesFrom(process.cwd()).slice(0, 40),
+          // workedFiles (2026-09-25): the files the session actually touched, from its transcript,
+          // already qualified as file:<owner/name>:<path>. `files` above reads git in the LAUNCH
+          // directory, and every desktop-launched session launches from home — measured, all five
+          // of Theron's live sessions — so it registered nothing. This is the one that works.
+          workedFiles: currentWorkedFiles(),
         }),
       })
     } catch { /* best-effort heartbeat — never disrupt the session */ }

package/lib/working_files.mjs

@@ -0,0 +1,249 @@
+// ADR-0066 §7 — the FILES a session is working on, read from WHERE IT WORKED, not where it launched.
+//
+// 🔴 THIS IS THE SECOND TIME THIS EXACT MISTAKE HAS SHIPPED. 0.9.180 read git from the MCP server's
+// process.cwd(). Measured the same day: all five of Theron's live sessions report cwd =
+// /Users/theronpeterson — the desktop app launches every session from home, which is not a repo — so
+// the feature registered NOTHING for any of them. capture.mjs documents the identical failure from
+// 2026-08-03 ("still zero carried an identifier … because Claude Code sessions launch from wherever
+// the terminal happened to be") and already fixed it the right way: read the transcript, because the
+// transcript records the files the session actually read and wrote. This reuses that primitive.
+//
+// ⚠ INCREMENTAL, BECAUSE THE TRANSCRIPT IS LARGE AND THIS RUNS EVERY MINUTE. A long session's
+// transcript measured 37.7 MB. The tracker remembers its byte offset and reads only what was
+// appended since the last heartbeat; the first read starts from the tail, since recent work is what
+// "working on" means.
+//
+// ⚠ CHANGED FILES ONLY — reading one is not working on it (2026-09-25, same day as the above). The
+// first cut recorded every file the session READ as well, and a session investigating a bug reads
+// dozens. Those holds then surface OTHER sessions' work as "yours, you worked on this file", which is
+// certainty the signal does not have — and a nudge that claims certainty it lacks is how an agent
+// learns to stop reading them. The existing rule for pages already draws this line: a deliberate
+// open counts, a grep hit does not. For files, the floor is a change.
+//
+// ⚠ ATTENTION DATA, NOT A CLEARANCE STAMP. capture.mjs uses the same paths to stamp REPOS onto records
+// behind a MIN_FILES_FOR_STAMP security threshold, because a stamp grants other people read access.
+// Nothing here grants anything: these identifiers only make this person's OWN sessions candidates for
+// this person's OWN arrivals. So it takes every file touched rather than thresholding — and it
+// deliberately does not modify touchedPaths, whose extraction is part of that security surface.
+import { readdirSync, existsSync, statSync, openSync, readSync, closeSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { touchedPaths, repoFullNameFrom } from './capture.mjs'
+
+const FIRST_READ_TAIL = 2 * 1024 * 1024   // on first poll, only the recent end of a long transcript
+const MAX_READ_PER_POLL = 4 * 1024 * 1024
+const MAX_DIR_PROBES_PER_POLL = 25        // each probe is a git subprocess; bound the heartbeat's cost
+const MAX_KEPT = 200
+
+// touchedPaths only recognises Bash paths under /Users, /home, /opt, /srv, /var — right for its
+// security job, but git worktrees commonly live under /private/tmp or /tmp, and work there would be
+// invisible. Widened HERE, for attention only, rather than in the shared extractor.
+const EXTRA_BASH_PATHS = /\/(?:private|tmp)\/[^\s"'`;|&)<>]+/g
+
+/** Paths one transcript line touched. Exported for the tests. */
+export function pathsInLine(line) {
+  const out = touchedPaths(line)
+  let d
+  try { d = JSON.parse(line) } catch { return out }
+  for (const b of d?.message?.content ?? []) {
+    if (b?.type === 'tool_use' && typeof b.input?.command === 'string') {
+      for (const m of b.input.command.match(EXTRA_BASH_PATHS) ?? []) out.push(m)
+    }
+  }
+  return out
+}
+
+const EDIT_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
+const ABS_PATH = /\/(?:Users|home|opt|srv|var|private|tmp)\/[^\s"'`;|&)<>]+/g
+// A command that writes through a script: every absolute path it names is a candidate target.
+// Over-inclusive for a script that reads one file and writes another, which is the safe side here —
+// the alternative is missing the edit, and the edit is the whole signal.
+const SCRIPTED_WRITE = /open\([^)]*['"][wa]b?\+?['"]|writeFileSync|writeFile\(|write_text\(|Bun\.write\(|sed\s+(?:-\S+\s+)*-i\b|\bperl\s+-\S*i/
+const REDIRECT_TARGET = /(?:^|[^<0-9&>])>>?\s*(['"]?)(\/[^\s'"`;|&)<>]+)\1/g
+const TEE_TARGET = /\btee\s+(?:-a\s+)?(['"]?)(\/[^\s'"`;|&)<>]+)\1/g
+const COPY_MOVE = /\b(?:cp|mv|install)\b[^;|&\n]*/g
+
+// `W=/private/tmp/wt; cat > "$W/web/app.ts"` names its target only through the variable, and that is
+// how a great deal of real editing is written. Resolve simple absolute assignments in the same command.
+function expandVarsFrom(shell, text) {
+  const vars = {}
+  for (const m of shell.matchAll(/(?:^|[\s;&(])([A-Za-z_][A-Za-z0-9_]*)=(['"]?)(\/[^\s'"`;|&)<>]*)\2/g)) vars[m[1]] = m[3]
+  return text.replace(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g, (all, name) => (name in vars ? vars[name] : all))
+}
+
+// Split a Bash command into the shell text and its heredoc bodies, remembering which command line fed
+// each body. The distinction is the difference between content and code: the body of
+// `cat > f <<EOF` is the file being written, and any path-looking text in it (a code comment giving an
+// example command, say) is not a write; the body of `python3 - <<PY` IS the script doing the writing.
+// Measured: scanning bodies indiscriminately reported `web/app.ts` — an example inside a comment.
+const INTERPRETER = /\b(?:python3?|node|bun|bash|sh|zsh|ruby|perl)\b/
+const SHELL_INTERPRETER = /\b(?:bash|sh|zsh)\b/
+function splitHeredocs(cmd) {
+  const lines = cmd.split('\n')
+  const shell = []
+  const bodies = []
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    shell.push(line)
+    const m = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/)
+    if (!m) continue
+    const end = lines.findIndex((l, j) => j > i && l.trim() === m[2])
+    const stop = end < 0 ? lines.length : end
+    bodies.push({ owner: line, body: lines.slice(i + 1, stop).join('\n'), quoted: Boolean(m[1]) })
+    if (end >= 0) shell.push(lines[end])
+    i = stop
+  }
+  return { shell: shell.join('\n'), bodies }
+}
+
+function writesIn(text, out) {
+  if (SCRIPTED_WRITE.test(text)) out.push(...(text.match(ABS_PATH) ?? []))
+  for (const m of text.matchAll(REDIRECT_TARGET)) out.push(m[2])
+  for (const m of text.matchAll(TEE_TARGET)) out.push(m[2])
+  for (const seg of text.match(COPY_MOVE) ?? []) {
+    const paths = seg.match(ABS_PATH) ?? []
+    if (paths.length >= 2) out.push(paths[paths.length - 1])
+  }
+}
+
+/**
+ * Paths one transcript line CHANGED. Exported for the tests.
+ *
+ * The edit tools name their target exactly. Bash is heuristic by necessity: a redirect or `tee`
+ * target, every path in a `sed -i` or a scripted write, and the destination of `cp`/`mv`/`install`.
+ * A plain `cat`, `grep` or `sed -n` of a path is a read and is not counted.
+ */
+export function editedPathsInLine(line) {
+  const out = []
+  let d
+  try { d = JSON.parse(line) } catch { return out }
+  for (const b of d?.message?.content ?? []) {
+    if (b?.type !== 'tool_use') continue
+    const inp = b.input ?? {}
+    if (EDIT_TOOLS.has(b.name)) {
+      for (const k of ['file_path', 'notebook_path']) {
+        if (typeof inp[k] === 'string' && inp[k].startsWith('/')) out.push(inp[k])
+      }
+      continue
+    }
+    if (typeof inp.command !== 'string') continue
+    const { shell, bodies } = splitHeredocs(inp.command)
+    // Variables are resolved from the SHELL text only: an assignment inside a file's content is not
+    // an assignment the shell ever made.
+    const expand = (t) => expandVarsFrom(shell, t)
+    writesIn(expand(shell), out)
+    for (const { owner, body, quoted } of bodies) {
+      // Shell semantics, exactly: a QUOTED delimiter (<<'PY') hands the body over literally, so a `$W`
+      // inside it is text, not a path. Expanding it anyway turned an example in a code comment into a
+      // "changed" file that does not exist.
+      const text = quoted ? body : expand(body)
+      if (SHELL_INTERPRETER.test(owner)) writesIn(text, out)               // a shell script: full rules
+      else if (INTERPRETER.test(owner)) {                                   // python/node/…: its writes
+        if (SCRIPTED_WRITE.test(text)) out.push(...(text.match(ABS_PATH) ?? []))  // shell syntax is data
+      }
+      // else: content being written by cat/tee — its target is already on the owner line
+    }
+  }
+  return [...new Set(out)]
+}
+
+/**
+ * Find this session's transcript by its id alone. Scanning for `<id>.jsonl` avoids depending on how
+ * Claude Code slugs the launch directory into a folder name — the id is unique, the slug rule is not
+ * ours to rely on.
+ */
+export function findTranscript(sessionId, projectsDir = join(homedir(), '.claude', 'projects')) {
+  if (!sessionId) return null
+  try {
+    for (const d of readdirSync(projectsDir)) {
+      const p = join(projectsDir, d, `${sessionId}.jsonl`)
+      if (existsSync(p)) return p
+    }
+  } catch { /* no projects dir: a non-Claude-Code host */ }
+  return null
+}
+
+function gitRoot(dir) {
+  try {
+    return execFileSync('git', ['-C', dir, 'rev-parse', '--show-toplevel'], {
+      encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim() || null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Tracks the files a session touches, reading its transcript incrementally.
+ * `poll()` returns fully-qualified identifiers, most recent first: `file:<owner/name>:<repo-relative>`.
+ */
+export function createWorkedFilesTracker(transcriptPath, opts = {}) {
+  const resolveRoot = opts.gitRoot ?? gitRoot
+  const resolveRepo = opts.repoFullNameFrom ?? repoFullNameFrom
+  let offset = -1
+  let carry = ''
+  const repoOfDir = new Map()   // dir -> { root, repo } | null
+  const recent = new Map()      // identifier -> true, insertion order = recency
+
+  function locate(p) {
+    const dir = dirname(p)
+    if (repoOfDir.has(dir)) return repoOfDir.get(dir)
+    return undefined
+  }
+
+  function poll(limit = 40) {
+    if (!transcriptPath) return []
+    let size
+    try { size = statSync(transcriptPath).size } catch { return [...recent.keys()].reverse().slice(0, limit) }
+    if (offset < 0 || size < offset) {       // first read, or the file was rewritten
+      offset = Math.max(0, size - FIRST_READ_TAIL)
+      carry = ''
+    }
+    if (size > offset) {
+      const len = Math.min(size - offset, MAX_READ_PER_POLL)
+      const buf = Buffer.alloc(len)
+      let fd
+      try {
+        fd = openSync(transcriptPath, 'r')
+        readSync(fd, buf, 0, len, offset)
+      } catch { return [...recent.keys()].reverse().slice(0, limit) } finally { if (fd !== undefined) closeSync(fd) }
+      offset += len
+      const text = carry + buf.toString('utf8')
+      const nl = text.lastIndexOf('\n')
+      carry = nl >= 0 ? text.slice(nl + 1) : text
+      const lines = nl >= 0 ? text.slice(0, nl).split('\n') : []
+
+      const touched = []
+      for (const line of lines) if (line) touched.push(...editedPathsInLine(line))
+
+      let probes = 0
+      for (const p of touched) {
+        if (p.includes('/.git/') || p.endsWith('/')) continue
+        // A directory is never an edit, and one without a trailing slash would pass the server's shape
+        // check and re-introduce exactly the breadth file-level holds exist to remove. Measured: `cd` into
+        // `web` and `packages/cortex-mcp` in a writing command reported both as changed "files".
+        try { if (statSync(p).isDirectory()) continue } catch { /* gone or never existed: judged below */ }
+        const dir = dirname(p)
+        if (!repoOfDir.has(dir)) {
+          if (probes >= MAX_DIR_PROBES_PER_POLL) continue
+          probes++
+          const root = existsSync(dir) ? resolveRoot(dir) : null
+          const repo = root ? resolveRepo(root) : null
+          repoOfDir.set(dir, root && repo ? { root, repo } : null)
+        }
+        const hit = locate(p)
+        if (!hit || !p.startsWith(hit.root + '/')) continue
+        const rel = p.slice(hit.root.length + 1)
+        if (!rel) continue
+        const id = `file:${hit.repo}:${rel}`
+        recent.delete(id)
+        recent.set(id, true)
+        if (recent.size > MAX_KEPT) recent.delete(recent.keys().next().value)
+      }
+    }
+    return [...recent.keys()].reverse().slice(0, limit)
+  }
+
+  return { poll }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/agnoclast-mcp",
-  "version": "0.9.180",
+  "version": "0.9.182",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {