@theronap/agnoclast-mcp 0.9.181 → 0.9.183

package/lib/arrivals_notice.mjs

@@ -56,6 +56,10 @@ import { fetchCortex, resolveBase, resolveTokenSource } from './diagnose.mjs'
  * to — but this is a hook that prints unprompted, and a notice that dumps content trains its reader
  * to skip it. Exported for the tests.
  */
+// Enough to hold a session's own recent output in full; small enough that the notice is READ rather
+// than spilled to a file, which is what happened at 49 KB.
+const MAX_YOURS = 25
+
 export function formatNotice(signals) {
   const lines = []
   const offers = signals?.settling?.offers ?? []
@@ -66,32 +70,34 @@ export function formatNotice(signals) {
     lines.push(`⚡ ${delta} new arrival${delta === 1 ? '' : 's'} in the pile since this session was last told.`)
   }
   if (offers.length) {
-    lines.push(`⚡ ${total} arrival${total === 1 ? '' : 's'} asking THIS session to decide:`)
-    // ⚠ EVERY OFFER, GROUPED BY CASCADE STAGE — changed 2026-09-25 from the first SIX.
+    // ⭐ LEAD WITH WHAT IS PROVABLY THIS SESSION'S, AND ONLY LIST THAT (2026-09-25).
     //
-    // Six of a deterministically-ordered twelve showed the SAME handful every turn while the rest of
-    // the pile stayed unreachable, and a session cannot claim what it is never shown. via_reason is
-    // still carried through verbatim rather than flattened — a reader who learns the stated reason is
-    // unreliable stops reading it — but it is printed ONCE PER GROUP instead of on every row, which
-    // is what makes listing all of them fit at all.
-    const STAGES = [
-      ['matched', 'matches your work'],
-      ['orphan', 'nothing matched them anywhere'],
-      ['declined', 'every other matching session declined them'],
-    ]
-    for (const [key, why] of STAGES) {
-      const group = offers.filter((o) => o.via_reason === key)
-      if (!group.length) continue
-      lines.push(`   ${why} (${group.length}):`)
-      // The title is what makes a row judgeable; an id names a unit without saying what it is.
-      for (const o of group) {
-        const name = o.title ? `  ${o.title}` : ''
-        lines.push(`     ${o.intakeItemId}${name}  · ${o.source} · ${o.hoursAgo}h`)
+    // Measured on the session that built this, as the one receiving it: 6 bare ids — filed nothing; 205
+    // titled rows — filed nothing; 350 rows at 49 KB — the harness spilled it to a file and showed a 2 KB
+    // preview, so it was not even read. Filed immediately: the one record it had looked at and could see
+    // was its own. What moves an agent is certainty, a short list, and the reason stated. So the rows
+    // shown are the ones whose files THIS SESSION CHANGED (`worked`), each with the file that proves it,
+    // framed as the step before the answer; every other tier is one line of counts.
+    const yours = offers.filter((o) => o.via_reason === 'matched' && (o.worked ?? []).length)
+    const rest = offers.filter((o) => !yours.includes(o))
+    if (yours.length) {
+      const n = yours.length
+      lines.push(`⚡ ${n} arrival${n === 1 ? '' : 's'} came from work THIS SESSION did — you changed the files ${n === 1 ? 'it touches' : 'they touch'}. File ${n === 1 ? 'it' : 'them'} before anything else:`)
+      for (const o of yours.slice(0, MAX_YOURS)) {
+        const files = o.worked.slice(0, 2).map((f) => f.split('/').pop()).join(', ')
+        lines.push(`     ${o.intakeItemId}  ${o.title ?? '(unreadable)'}  · ${o.source} · ${o.hoursAgo}h — you changed ${files}`)
       }
+      if (n > MAX_YOURS) lines.push(`     … and ${n - MAX_YOURS} more that are yours`)
+      lines.push('   `intake_look <id>` shows where one would go · `intake_materialize` files it · `not_mine` if one is not yours.')
     }
-    // Only when the pile genuinely exceeds the server's scan window; `total` is counted before it.
-    if (total > offers.length) lines.push(`   … and ${total - offers.length} beyond the scan window`)
-    lines.push('   (Claim + route them, or say they are not yours — they stay unclaimed until someone decides.)')
+    const counts = { matched: 0, orphan: 0, declined: 0 }
+    for (const o of rest) counts[o.via_reason] = (counts[o.via_reason] ?? 0) + 1
+    const parts = []
+    if (counts.matched) parts.push(`${counts.matched} loosely matching your work`)
+    if (counts.orphan) parts.push(`${counts.orphan} matching no session`)
+    if (counts.declined) parts.push(`${counts.declined} declined by other sessions`)
+    if (total > offers.length) parts.push(`${total - offers.length} beyond the scan window`)
+    if (parts.length) lines.push(`⚡ Also settling: ${parts.join(' · ')} — not listed here; \`intake_changes\` shows them.`)
   }
   return lines.join('\n')
 }

package/lib/server.mjs

@@ -89,6 +89,27 @@ export function intakeMaterializePath(mode) {
 }
 
 /** ADR-0062 §5.2. Which page governs a materialized record, and who chose it — or '' for an older server. */
+// ADR-0051's refusal, rendered as INSTRUCTIONS — shared by route_record and intake_materialize so the two
+// verbs cannot drift apart (the server shares OTHER_HOMES_DETAIL for the same reason). The agent is one
+// call from succeeding, and the whole point of the gate is the question it asks; a bare
+// "other_homes_unchecked" reads as a malfunction and gets retried verbatim.
+function otherHomesRefusalText(opener) {
+  return [
+    opener,
+    '',
+    'What OTHER pages does this record belong on? A record is usually about more than the page an',
+    'identifier matched: the project it concerns, the person it is about, the decision it bears on.',
+    '',
+    '  know some already   → add them to documentIds and call again',
+    '  none come to mind   → go look first. grep or read for pages this could belong to;',
+    '                        you know the namespace better than any matcher does',
+    '  looked, found none  → call again with searchedForOtherHomes: true',
+    '',
+    'Parking is still a complete answer, and a wrong attachment is still worse than none. The gate',
+    'asks that you looked, not that you found something.',
+  ].join('\n')
+}
+
 export function renderGoverningLine(governing) {
   if (!governing || typeof governing !== 'object') return ''
   const name = governing.title || 'a page'
@@ -1117,7 +1138,8 @@ function renderNudge(payload) {
       description:
         'Atomically publish a claimed intake item into one brain — the disclosure moment (ADR-0062). Deterministic identifier homes in that brain are always attached; documentIds may add further pages. The record is born at the strictest of its source baseline, what the producer asked for, and every attached page; a source floor (iMessage, claude-code) pins it. ' +
         'Name the governing page with governingPage (one of documentIds, never a person page) — otherwise the ranking picks it. ' +
-        'Pass mode "preview" first when your choice differs from the claim\'s proposal: it returns the pages, the governing page and the tier this exact call would produce, and writes nothing. Never writes private intake into search/history before this call.',
+        'Pass mode "preview" first when your choice differs from the claim\'s proposal: it returns the pages, the governing page and the tier this exact call would produce, and writes nothing. Never writes private intake into search/history before this call. ' +
+        '⚠ ADR-0051: a unit does not finish until you looked for its OTHER homes. A call whose documentIds add nothing beyond the deterministic homes it gets anyway is REFUSED once — name the pages this unit is about (the design it implements, the project, the person), or go look, or say you looked with searchedForOtherHomes.',
       inputSchema: {
         intakeItemId: z.string().describe('intake item uuid'),
         orgId: z.string().describe('destination brain org uuid'),
@@ -1136,6 +1158,12 @@ function renderNudge(payload) {
         mode: z.enum(['preview', 'apply']).optional().describe(
           '"preview": report the pages, governing page and tier this call would produce, and write nothing. Default "apply".',
         ),
+        searchedForOtherHomes: z.boolean().optional().describe(
+          'ADR-0051. "I looked for other homes and there are genuinely none." Only consulted when documentIds add no page ' +
+          'beyond the deterministic homes. ⚠ DO NOT SEND THIS ON THE FIRST CALL AS A MATTER OF COURSE — it is the answer AFTER ' +
+          'looking, not a way past the question. Measured 2026-09-25: 30 records filed through this verb in one afternoon with no ' +
+          'judged page on any of them.',
+        ),
       },
     },
     async (args) => {
@@ -1158,10 +1186,20 @@ function renderNudge(payload) {
           },
           attachmentMeta: (args.documentIds ?? []).map(() => ({ origin: args.origin ?? 'llm' })),
           ...(args.governingPage ? { governingDocumentId: args.governingPage } : {}),
+          ...(args.searchedForOtherHomes ? { searchedForOtherHomes: true } : {}),
         }),
       })
       if (!res.ok) {
         const body = await res.text()
+        if (res.status === 409) {
+          let err = null
+          try { err = JSON.parse(body)?.error } catch { /* not JSON: fall through to the raw text */ }
+          if (err === 'other_homes_unchecked') {
+            return toolError(otherHomesRefusalText(
+              'Not filed yet — every page named is one this unit gets anyway, so this would publish it without adding anything of your judgment.',
+            ))
+          }
+        }
         if (preview && res.status === 404) {
           return toolError('This server cannot preview a materialization yet — nothing was written. Materialize without mode, or wait for the server to update.')
         }
@@ -4641,22 +4679,9 @@ function renderNudge(payload) {
       // agent is one call from succeeding and the whole point of the gate is the question it asks. A
       // bare "other_homes_unchecked" would read as a malfunction and get retried verbatim.
       if (!res.ok && out?.error === 'other_homes_unchecked') {
-        return toolError([
-          park
-            ? 'Not parked yet — before a record is filed as having no home, look for its other homes.'
-            : 'Not routed yet — every page you named is already attached, so this call would finish the record without adding anything.',
-          '',
-          'What OTHER pages does this record belong on? A record is usually about more than the page an',
-          'identifier matched: the project it concerns, the person it is about, the decision it bears on.',
-          '',
-          '  know some already   → add them to documentIds and call again',
-          '  none come to mind   → go look first. grep or read for pages this could belong to;',
-          '                        you know the namespace better than any matcher does',
-          '  looked, found none  → call again with searchedForOtherHomes: true',
-          '',
-          'Parking is still a complete answer, and a wrong attachment is still worse than none. The gate',
-          'asks that you looked, not that you found something.',
-        ].join('\n'))
+        return toolError(otherHomesRefusalText(park
+          ? 'Not parked yet — before a record is filed as having no home, look for its other homes.'
+          : 'Not routed yet — every page you named is already attached, so this call would finish the record without adding anything.'))
       }
       if (!res.ok) return toolError(`Could not route record: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
       if (park) return { content: [{ type: 'text', text: 'Parked. It stays visible and unrouted rather than badly attached.' }] }

package/lib/working_files.mjs

@@ -13,6 +13,13 @@
 // appended since the last heartbeat; the first read starts from the tail, since recent work is what
 // "working on" means.
 //
+// ⚠ CHANGED FILES ONLY — reading one is not working on it (2026-09-25, same day as the above). The
+// first cut recorded every file the session READ as well, and a session investigating a bug reads
+// dozens. Those holds then surface OTHER sessions' work as "yours, you worked on this file", which is
+// certainty the signal does not have — and a nudge that claims certainty it lacks is how an agent
+// learns to stop reading them. The existing rule for pages already draws this line: a deliberate
+// open counts, a grep hit does not. For files, the floor is a change.
+//
 // ⚠ ATTENTION DATA, NOT A CLEARANCE STAMP. capture.mjs uses the same paths to stamp REPOS onto records
 // behind a MIN_FILES_FOR_STAMP security threshold, because a stamp grants other people read access.
 // Nothing here grants anything: these identifiers only make this person's OWN sessions candidates for
@@ -47,6 +54,100 @@ export function pathsInLine(line) {
   return out
 }
 
+const EDIT_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
+const ABS_PATH = /\/(?:Users|home|opt|srv|var|private|tmp)\/[^\s"'`;|&)<>]+/g
+// A command that writes through a script: every absolute path it names is a candidate target.
+// Over-inclusive for a script that reads one file and writes another, which is the safe side here —
+// the alternative is missing the edit, and the edit is the whole signal.
+const SCRIPTED_WRITE = /open\([^)]*['"][wa]b?\+?['"]|writeFileSync|writeFile\(|write_text\(|Bun\.write\(|sed\s+(?:-\S+\s+)*-i\b|\bperl\s+-\S*i/
+const REDIRECT_TARGET = /(?:^|[^<0-9&>])>>?\s*(['"]?)(\/[^\s'"`;|&)<>]+)\1/g
+const TEE_TARGET = /\btee\s+(?:-a\s+)?(['"]?)(\/[^\s'"`;|&)<>]+)\1/g
+const COPY_MOVE = /\b(?:cp|mv|install)\b[^;|&\n]*/g
+
+// `W=/private/tmp/wt; cat > "$W/web/app.ts"` names its target only through the variable, and that is
+// how a great deal of real editing is written. Resolve simple absolute assignments in the same command.
+function expandVarsFrom(shell, text) {
+  const vars = {}
+  for (const m of shell.matchAll(/(?:^|[\s;&(])([A-Za-z_][A-Za-z0-9_]*)=(['"]?)(\/[^\s'"`;|&)<>]*)\2/g)) vars[m[1]] = m[3]
+  return text.replace(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g, (all, name) => (name in vars ? vars[name] : all))
+}
+
+// Split a Bash command into the shell text and its heredoc bodies, remembering which command line fed
+// each body. The distinction is the difference between content and code: the body of
+// `cat > f <<EOF` is the file being written, and any path-looking text in it (a code comment giving an
+// example command, say) is not a write; the body of `python3 - <<PY` IS the script doing the writing.
+// Measured: scanning bodies indiscriminately reported `web/app.ts` — an example inside a comment.
+const INTERPRETER = /\b(?:python3?|node|bun|bash|sh|zsh|ruby|perl)\b/
+const SHELL_INTERPRETER = /\b(?:bash|sh|zsh)\b/
+function splitHeredocs(cmd) {
+  const lines = cmd.split('\n')
+  const shell = []
+  const bodies = []
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    shell.push(line)
+    const m = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/)
+    if (!m) continue
+    const end = lines.findIndex((l, j) => j > i && l.trim() === m[2])
+    const stop = end < 0 ? lines.length : end
+    bodies.push({ owner: line, body: lines.slice(i + 1, stop).join('\n'), quoted: Boolean(m[1]) })
+    if (end >= 0) shell.push(lines[end])
+    i = stop
+  }
+  return { shell: shell.join('\n'), bodies }
+}
+
+function writesIn(text, out) {
+  if (SCRIPTED_WRITE.test(text)) out.push(...(text.match(ABS_PATH) ?? []))
+  for (const m of text.matchAll(REDIRECT_TARGET)) out.push(m[2])
+  for (const m of text.matchAll(TEE_TARGET)) out.push(m[2])
+  for (const seg of text.match(COPY_MOVE) ?? []) {
+    const paths = seg.match(ABS_PATH) ?? []
+    if (paths.length >= 2) out.push(paths[paths.length - 1])
+  }
+}
+
+/**
+ * Paths one transcript line CHANGED. Exported for the tests.
+ *
+ * The edit tools name their target exactly. Bash is heuristic by necessity: a redirect or `tee`
+ * target, every path in a `sed -i` or a scripted write, and the destination of `cp`/`mv`/`install`.
+ * A plain `cat`, `grep` or `sed -n` of a path is a read and is not counted.
+ */
+export function editedPathsInLine(line) {
+  const out = []
+  let d
+  try { d = JSON.parse(line) } catch { return out }
+  for (const b of d?.message?.content ?? []) {
+    if (b?.type !== 'tool_use') continue
+    const inp = b.input ?? {}
+    if (EDIT_TOOLS.has(b.name)) {
+      for (const k of ['file_path', 'notebook_path']) {
+        if (typeof inp[k] === 'string' && inp[k].startsWith('/')) out.push(inp[k])
+      }
+      continue
+    }
+    if (typeof inp.command !== 'string') continue
+    const { shell, bodies } = splitHeredocs(inp.command)
+    // Variables are resolved from the SHELL text only: an assignment inside a file's content is not
+    // an assignment the shell ever made.
+    const expand = (t) => expandVarsFrom(shell, t)
+    writesIn(expand(shell), out)
+    for (const { owner, body, quoted } of bodies) {
+      // Shell semantics, exactly: a QUOTED delimiter (<<'PY') hands the body over literally, so a `$W`
+      // inside it is text, not a path. Expanding it anyway turned an example in a code comment into a
+      // "changed" file that does not exist.
+      const text = quoted ? body : expand(body)
+      if (SHELL_INTERPRETER.test(owner)) writesIn(text, out)               // a shell script: full rules
+      else if (INTERPRETER.test(owner)) {                                   // python/node/…: its writes
+        if (SCRIPTED_WRITE.test(text)) out.push(...(text.match(ABS_PATH) ?? []))  // shell syntax is data
+      }
+      // else: content being written by cat/tee — its target is already on the owner line
+    }
+  }
+  return [...new Set(out)]
+}
+
 /**
  * Find this session's transcript by its id alone. Scanning for `<id>.jsonl` avoids depending on how
  * Claude Code slugs the launch directory into a folder name — the id is unique, the slug rule is not
@@ -114,11 +215,15 @@ export function createWorkedFilesTracker(transcriptPath, opts = {}) {
       const lines = nl >= 0 ? text.slice(0, nl).split('\n') : []
 
       const touched = []
-      for (const line of lines) if (line) touched.push(...pathsInLine(line))
+      for (const line of lines) if (line) touched.push(...editedPathsInLine(line))
 
       let probes = 0
       for (const p of touched) {
         if (p.includes('/.git/') || p.endsWith('/')) continue
+        // A directory is never an edit, and one without a trailing slash would pass the server's shape
+        // check and re-introduce exactly the breadth file-level holds exist to remove. Measured: `cd` into
+        // `web` and `packages/cortex-mcp` in a writing command reported both as changed "files".
+        try { if (statSync(p).isDirectory()) continue } catch { /* gone or never existed: judged below */ }
         const dir = dirname(p)
         if (!repoOfDir.has(dir)) {
           if (probes >= MAX_DIR_PROBES_PER_POLL) continue

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/agnoclast-mcp",
-  "version": "0.9.181",
+  "version": "0.9.183",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {