@theronap/agnoclast-mcp 0.9.183 → 0.9.185

package/lib/arrivals_notice.mjs

@@ -78,14 +78,20 @@ export function formatNotice(signals) {
     // was its own. What moves an agent is certainty, a short list, and the reason stated. So the rows
     // shown are the ones whose files THIS SESSION CHANGED (`worked`), each with the file that proves it,
     // framed as the step before the answer; every other tier is one line of counts.
-    const yours = offers.filter((o) => o.via_reason === 'matched' && (o.worked ?? []).length)
-    const rest = offers.filter((o) => !yours.includes(o))
+    //
+    // ⭐ AND "PROVABLY" MEANS AUTHORED (later the same day). The first cut called a unit yours when it
+    // touched a file this session changed; on the session that built it that listed 105, including other
+    // sessions' PRs, because every PR touches the same shared files. Now only an arrival carrying this
+    // session's own commit, PR or release (`authored`, computed by the server) is listed; file overlap
+    // alone is counted in the line below and named for what it is.
+    const yours = offers.filter((o) => (o.authored ?? []).length)
+    const sameFiles = offers.filter((o) => !yours.includes(o) && o.via_reason === 'matched' && (o.worked ?? []).length)
+    const rest = offers.filter((o) => !yours.includes(o) && !sameFiles.includes(o))
     if (yours.length) {
       const n = yours.length
-      lines.push(`⚡ ${n} arrival${n === 1 ? '' : 's'} came from work THIS SESSION did — you changed the files ${n === 1 ? 'it touches' : 'they touch'}. File ${n === 1 ? 'it' : 'them'} before anything else:`)
+      lines.push(`⚡ ${n} arrival${n === 1 ? ' is' : 's are'} THIS SESSION'S OWN WORK — ${n === 1 ? 'its' : 'their'} commit, PR or release is one you made. File ${n === 1 ? 'it' : 'them'} before anything else:`)
       for (const o of yours.slice(0, MAX_YOURS)) {
-        const files = o.worked.slice(0, 2).map((f) => f.split('/').pop()).join(', ')
-        lines.push(`     ${o.intakeItemId}  ${o.title ?? '(unreadable)'}  · ${o.source} · ${o.hoursAgo}h — you changed ${files}`)
+        lines.push(`     ${o.intakeItemId}  ${o.title ?? '(unreadable)'}  · ${o.source} · ${o.hoursAgo}h — ${o.authored[0]}`)
       }
       if (n > MAX_YOURS) lines.push(`     … and ${n - MAX_YOURS} more that are yours`)
       lines.push('   `intake_look <id>` shows where one would go · `intake_materialize` files it · `not_mine` if one is not yours.')
@@ -93,6 +99,7 @@ export function formatNotice(signals) {
     const counts = { matched: 0, orphan: 0, declined: 0 }
     for (const o of rest) counts[o.via_reason] = (counts[o.via_reason] ?? 0) + 1
     const parts = []
+    if (sameFiles.length) parts.push(`${sameFiles.length} touching files you changed but not your own commits or PRs`)
     if (counts.matched) parts.push(`${counts.matched} loosely matching your work`)
     if (counts.orphan) parts.push(`${counts.orphan} matching no session`)
     if (counts.declined) parts.push(`${counts.declined} declined by other sessions`)

package/lib/server.mjs

@@ -214,8 +214,10 @@ export async function runServer(version) {
   // because a brand-new session's transcript may not exist yet when this server starts; each
   // heartbeat retries until it appears, then the tracker reads only what was appended since.
   let workedFiles = null
+  let trackerArmed = false   // set a few seconds after startup; see _armTracker below
   function currentWorkedFiles() {
     try {
+      if (!trackerArmed) return []
       if (!workedFiles) {
         const t = findTranscript(process.env.CLAUDE_CODE_SESSION_ID)
         if (!t) return []
@@ -226,6 +228,10 @@ export async function runServer(version) {
       return []   // attention data is never worth disturbing a session for
     }
   }
+  // Reads what currentWorkedFiles' poll collected; never re-reads the transcript itself.
+  function currentAuthored() {
+    try { return workedFiles ? workedFiles.authored(100) : [] } catch { return [] }
+  }
   async function pingSession() {
     try {
       await fetchCortex(`${BASE}/api/session-ping`, {
@@ -254,6 +260,10 @@ export async function runServer(version) {
           // directory, and every desktop-launched session launches from home — measured, all five
           // of Theron's live sessions — so it registered nothing. This is the one that works.
           workedFiles: currentWorkedFiles(),
+          // authored (0.9.184): what the session PRODUCED — commits, PRs, releases — from the same
+          // transcript read, which the line above has just advanced. This is what makes an arrival
+          // YOURS; a shared changed file is not (see authoredInCall in working_files.mjs).
+          authored: currentAuthored(),
         }),
       })
     } catch { /* best-effort heartbeat — never disrupt the session */ }
@@ -261,6 +271,12 @@ export async function runServer(version) {
   void pingSession()
   const _hb = setInterval(() => void pingSession(), 60_000)
   if (typeof _hb.unref === 'function') _hb.unref()   // don't keep the process alive just for the heartbeat
+  // The transcript tracker's first poll is the expensive one — up to 64 MB of history for authorship,
+  // plus git probes — and it is synchronous. Run inside the startup heartbeat it competed with the MCP
+  // handshake, on a launch path already measured at 9–12 s under load against a 30 s connect timeout.
+  // So the startup heartbeat carries presence only, and this one, seconds later, carries the transcript.
+  const _armTracker = setTimeout(() => { trackerArmed = true; void pingSession() }, 8_000)
+  if (typeof _armTracker.unref === 'function') _armTracker.unref()
 
   // Cache context for 5 minutes so repeated tool calls don't re-fetch.
   // KEYED BY REPO since 2026-08-27: the context now carries a repo-scoped Gate 4 block, so the same

package/lib/working_files.mjs

@@ -29,9 +29,20 @@ import { readdirSync, existsSync, statSync, openSync, readSync, closeSync } from
 import { homedir } from 'node:os'
 import { join, dirname } from 'node:path'
 import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import { touchedPaths, repoFullNameFrom } from './capture.mjs'
 
 const FIRST_READ_TAIL = 2 * 1024 * 1024   // on first poll, only the recent end of a long transcript
+const AUTHORED_HISTORY = 64 * 1024 * 1024 // ...but authorship reads this far back (see scanAuthoredHistory)
+// Raw-line prefilters for the history scan, applied before JSON.parse. Loose on purpose: the strict,
+// command-position test runs on the parsed command.
+//
+// ⚠ NO `\b`. In the raw JSON line a newline is the two characters `\` `n`, so `cd x\ngh pr create` reads
+// `…ngh pr create` — `n` then `g`, no word boundary. The first version had `\bgh`, and every PR from a
+// session that writes one command per line (the one that made #1200) was invisible; this session writes
+// `&& gh …` and never noticed. A prefilter can only ever cost a parse, so it must never be the strict one.
+const AUTHORING_HINT = /gh pr |git |npm |pnpm |yarn /
+const TOOL_USE_ID = /"tool_use_id":"([^"]+)"/g
 const MAX_READ_PER_POLL = 4 * 1024 * 1024
 const MAX_DIR_PROBES_PER_POLL = 25        // each probe is a git subprocess; bound the heartbeat's cost
 const MAX_KEPT = 200
@@ -115,9 +126,14 @@ function writesIn(text, out) {
  * A plain `cat`, `grep` or `sed -n` of a path is a read and is not counted.
  */
 export function editedPathsInLine(line) {
-  const out = []
   let d
-  try { d = JSON.parse(line) } catch { return out }
+  try { d = JSON.parse(line) } catch { return [] }
+  return editedPathsIn(d)
+}
+
+// The parsed form, so the tracker parses each transcript line once for both of its readers.
+function editedPathsIn(d) {
+  const out = []
   for (const b of d?.message?.content ?? []) {
     if (b?.type !== 'tool_use') continue
     const inp = b.input ?? {}
@@ -148,6 +164,206 @@ export function editedPathsInLine(line) {
   return [...new Set(out)]
 }
 
+// ── WHAT THE SESSION PRODUCED — the authorship signal (2026-09-25) ──────────────────────────────────
+//
+// 🔴 CHANGING THE SAME FILE IS PROXIMITY, NOT AUTHORSHIP. `worked` above made an arrival "yours" when
+// it touched a file this session changed. Measured the day it shipped, on the session that built it:
+// the per-prompt block called 105 arrivals "work THIS SESSION did", including PR #1200 (Gmail agent
+// tools) and #1194/#1195 — none of them its own. They matched because server.mjs and CHANGELOG.md are
+// edited by nearly every session, so every PR touches them too.
+//
+// What makes an arrival this session's is that it carries something this session MADE: a commit it
+// created, a PR it opened or merged, a version it published. Those are recorded here, as keys:
+//   pr:<owner>/<repo>#<n>      subject:<16 hex>      commit:<sha>      release:<pkg>@<version>
+//
+// ⚠ READ FROM THE COMMAND *AND* ITS RESULT, PAIRED BY tool_use_id, because each half lies alone:
+//   - `a..b main -> origin/main` is printed by `git fetch` exactly as `git push` prints a push.
+//   - `https://github.com/o/r/pull/N` is printed by `gh pr view` exactly as `gh pr create` prints one.
+//   - `gh pr merge` prints almost nothing useful; the PR number is in its ARGUMENTS, including loops
+//     (`for n in 1087 1089; do gh pr merge $n …`), which is how several PRs were merged this week.
+//
+// ⚠ THE SUBJECT KEY EXISTS BECAUSE OUTPUT GETS CUT. Mined from a real transcript: most `git commit`
+// calls were piped through `| tail -3`, so the `[branch sha]` line never reached the transcript. The
+// message survives — the session wrote it in the command — and GitHub echoes it back as the push
+// title ("Committed: <subject>", with " (#N)" appended on a squash merge). Hashed so that session
+// rows hold no commit prose; the server computes the same hash from the arrival (settling_nudge.ts,
+// kept in step by a parity test that imports this function).
+const MIN_SUBJECT = 12
+
+/** Canonical subject key, or null for one too generic to prove anything. Exported for the parity test. */
+export function subjectKey(subject) {
+  if (typeof subject !== 'string') return null
+  const s = subject.split('\n')[0].replace(/\s+/g, ' ').trim().replace(/\s*\(#\d+\)$/, '')
+  // "Merge branch 'main' …" is written by git, not by the session, and is identical across sessions.
+  if (s.length < MIN_SUBJECT || /^merge\b/i.test(s)) return null
+  return `subject:${createHash('sha256').update(s).digest('hex').slice(0, 16)}`
+}
+
+// git's global options before the subcommand. A value is a SHELL WORD, quotes included: this session
+// commits as `git -c user.name='Theron Peterson' commit`, and `\S+` stopped at the space — measured,
+// 84 of 96 commit commands in one transcript yielded no subject until this was a word.
+// ⚠ ONE CHARACTER OR ONE QUOTED RUN PER STEP, never `[^\\s'"]+` inside the `+`: that nesting is
+// exponential on a failed match, and a first version of this line hung the tracker on a long command.
+const WORD = `(?:[^\\s'"]|'[^']*'|"[^"]*")+`
+const GIT_OPTS = `(?:\\s+(?:-[Cc]\\s+${WORD}|--no-pager|--git-dir=${WORD}|--work-tree=${WORD}))*`
+// 🔴 AT COMMAND POSITION ONLY — the program must be INVOKED, not mentioned. Measured building this: the
+// session's own transcript-mining scripts carried `gh pr create` inside a python heredoc and printed
+// week-old PR URLs, and the first cut recorded all of them as this session's PRs. The arrivals notice
+// learned the same lesson the same day: a parser reading the conversation it prints into cannot tell
+// the world from its own echo. So a command counts only at the start of a line or after `&&` `||` `;`
+// `|` `(` `$(` `{` or a `do`/`then`/`else`, optionally behind `timeout 540` and friends (how releases
+// are run here) — never inside a quoted string — and it is matched against the
+// shell text with heredoc BODIES removed (a commit message body is read separately, below).
+const AT_CMD = String.raw`(?:^|[;&|({\n]|\$\(|\b(?:do|then|else)\b)\s*(?:[A-Za-z_]\w*=\S*\s+)*(?:(?:time|command|nice|env|timeout\s+\S+)\s+)*`
+const GIT_COMMIT = new RegExp(`${AT_CMD}git${GIT_OPTS}\\s+commit\\b`)
+const GIT_PUSH = new RegExp(`${AT_CMD}git${GIT_OPTS}\\s+push\\b`)
+const GH_PR_CREATE = new RegExp(`${AT_CMD}gh\\s+pr\\s+create\\b`)
+const GH_PR_MERGE = new RegExp(`${AT_CMD}gh\\s+pr\\s+merge\\b`)
+const PUBLISH = new RegExp(`${AT_CMD}(?:npm|pnpm|yarn)(?:\\s+-{1,2}[\\w-]+)*\\s+(?:run\\s+release|publish)\\b`)
+const AUTHORING_RES = [GIT_COMMIT, GIT_PUSH, GH_PR_CREATE, GH_PR_MERGE, PUBLISH]
+/** Could this command author anything? Only such commands wait for their result. */
+function isAuthoring(command) {
+  const code = maskQuotes(splitHeredocs(command).shell)
+  return AUTHORING_RES.some((re) => re.test(code))
+}
+
+// Quoted text is DATA to the shell, so it is data here: `echo 'next: git push, then npm publish'` has a
+// `then` that is prose, and without this it read as the shell keyword that puts npm at command
+// position. Lengths are kept so indexes found in the masked text still point into the original.
+function maskQuotes(shell) {
+  return shell.replace(/'[^']*'|"(?:[^"\\]|\\.)*"/g, (q) => q[0] + ' '.repeat(Math.max(0, q.length - 2)) + q[q.length - 1])
+}
+
+const REPO = '[\\w.-]+\\/[\\w.-]+'
+const pr = (repo, n) => `pr:${repo.toLowerCase()}#${Number(n)}`
+
+const COMMIT_REFUSED = /nothing to commit|nothing added to commit|no changes added to commit|Aborting commit/i
+const MERGE_REFUSED = /is not mergeable|not in the correct state|merge conflict|required status check|GraphQL: |no pull requests found|already merged|is closed/i
+const URL_PRINTING_READ = new RegExp(`${AT_CMD}gh\\s+(?:pr\\s+(?:view|list|status|checks)|api|search|browse)\\b`)
+// gh pr merge's options that take a VALUE, so the value is never mistaken for the PR number.
+const MERGE_VALUE_FLAGS = new Set(['-R', '--repo', '-b', '--body', '-F', '--body-file', '-t', '--subject', '-A', '--author-email', '--match-head-commit'])
+
+/**
+ * The PRs each `gh pr merge` invocation names, flags in any order: `gh pr merge 1082 --squash`,
+ * `gh pr merge --squash --delete-branch 1082 -R o/r` (Codex review: the second shape was missed), or a
+ * PR URL. A `$n` from a loop is left to the loop handler.
+ */
+function mergeTargets(code) {
+  const out = []
+  for (const m of code.matchAll(new RegExp(`${AT_CMD}gh\\s+pr\\s+merge\\b([^;&|\\n]*)`, 'g'))) {
+    // A masked quote (`"   "`) is ONE shell word, so it must be one token: `-t "my title" 1082`.
+    const toks = m[1].replace(/"\s*"|'\s*'/g, 'Q').trim().split(/\s+/).filter(Boolean)
+    for (let i = 0; i < toks.length; i++) {
+      const t = toks[i]
+      if (t.startsWith('-')) { if (MERGE_VALUE_FLAGS.has(t)) i++; continue }
+      const url = t.match(new RegExp(`^https://github\\.com/(${REPO})/pull/(\\d+)`))
+      if (url) { out.push({ repo: url[1], n: url[2] }); break }
+      if (/^\d+$/.test(t)) { out.push({ repo: null, n: t }); break }
+      break   // the first positional is the PR; anything else (a branch name, `$n`) is not a number
+    }
+  }
+  return out
+}
+
+/** The text of a tool_result block, which arrives as a string or as a list of text parts. */
+function resultText(content) {
+  if (typeof content === 'string') return content
+  if (Array.isArray(content)) return content.map((c) => (typeof c?.text === 'string' ? c.text : '')).join('\n')
+  return ''
+}
+
+/**
+ * What one command produced, judged from the command and its output together. Exported for the tests.
+ *
+ * `ctx.repoFor(n, dirHint)` resolves the repo of a `gh pr merge <n>` that did not name one — from the
+ * PRs this session created, else the directory the command ran in. Returning null drops the number:
+ * a PR number without its repo would match that number in every repo this person has.
+ */
+export function authoredInCall(command, output, ctx = {}) {
+  if (typeof command !== 'string') return []
+  const out = new Set()
+  const text = resultText(output)
+  const { shell, bodies } = splitHeredocs(command)
+  // Detection runs on `code` (quotes masked); values — messages, flags, numbers — are read from `shell`.
+  const code = maskQuotes(shell)
+
+  // A commit git REFUSED made nothing, so its message proves nothing (Codex review, 2026-09-25). Empty
+  // output still counts: `-q` and `| tail` leave none, and that is the common case the subject key is for.
+  if (GIT_COMMIT.test(code) && !COMMIT_REFUSED.test(text)) {
+    // The message as the session wrote it: a heredoc fed to the commit line (`-F - <<'EOF'`, or
+    // `-m "$(cat <<'EOF'`), else an inline `-m "…"` / `--message "…"`.
+    for (const { owner, body } of bodies) {
+      if (!GIT_COMMIT.test(owner)) continue
+      const key = subjectKey(body.split('\n').find((l) => l.trim()) ?? '')
+      if (key) out.add(key)
+    }
+    const at = code.search(GIT_COMMIT)
+    const inline = shell.slice(at).match(/\s(?:-a?m\s*|--message(?:=|\s+))(["'])((?:\\.|(?!\1)[^\\])*)\1/)
+    if (inline && !inline[2].startsWith('$(')) {
+      const key = subjectKey(inline[2].replace(/\\(["'\\])/g, '$1'))
+      if (key) out.add(key)
+    }
+    for (const m of text.matchAll(/^\[[^\]\n]+\s([0-9a-f]{7,40})\]/gm)) out.add(`commit:${m[1]}`)
+  }
+
+  if (GIT_PUSH.test(code)) {
+    for (const m of text.matchAll(/^\s*[+ *!=-]?\s*[0-9a-f]{7,40}\.\.\.?([0-9a-f]{7,40})\s+(\S+)\s+->\s+(\S+)/gm)) {
+      const [, tip, src, dst] = m
+      // `main -> origin/main` is a FETCH line that shared the command (`git fetch && git push`). A push
+      // names the remote branch bare: `fix/x -> fix/x`, `HEAD -> fix/x`.
+      if (dst !== src && dst.endsWith(`/${src}`)) continue
+      out.add(`commit:${tip}`)
+    }
+  }
+
+  if (GH_PR_CREATE.test(code)) {
+    // gh prints the new PR's URL as its LAST line, so credit only as many trailing URLs as there were
+    // creates. Anything earlier in the output is some other command's text (a `cat`, a log) that
+    // happened to share the call.
+    const creates = [...code.matchAll(new RegExp(GH_PR_CREATE.source, 'g'))].length
+    // ...unless a read that ALSO prints PR URLs shared the call: `gh pr create … || gh pr view 1200`
+    // would otherwise credit #1200 when the create failed. Crediting nothing is the safe side — the PR's
+    // commits still carry this session's subject keys, and its merge its number.
+    const urls = URL_PRINTING_READ.test(code) ? []
+      : [...text.matchAll(new RegExp(`https://github\\.com/(${REPO})/pull/(\\d+)\\b`, 'g'))]
+    for (const m of urls.slice(-creates)) {
+      out.add(pr(m[1], m[2]))
+      ctx.onCreated?.(Number(m[2]), m[1])
+    }
+  }
+
+  // ⚠ "failed to run git" is NOT a refusal: gh prints it on SUCCESSFUL merges whenever `main` is checked
+  // out in another worktree — measured on #1082, which merged. Only gh's own refusals count as failure.
+  if (GH_PR_MERGE.test(code) && !MERGE_REFUSED.test(text)) {
+    const flag = shell.match(new RegExp(`\\s(?:-R|--repo)[\\s=]+(${REPO})`))?.[1] ?? null
+    const cds = [...shell.matchAll(/(?:\bcd\s+|\bgit\s+-C\s+)("[^"]+"|'[^']+'|[^\s;&|]+)/g)]
+    const dirHint = cds.length ? expandVarsFrom(shell, cds[cds.length - 1][1].replace(/^["']|["']$/g, '')) : null
+    const add = (repo, n) => {
+      const r = repo ?? flag ?? ctx.repoFor?.(Number(n), dirHint) ?? null
+      if (r) out.add(pr(r, n))
+    }
+    for (const t of mergeTargets(code)) add(t.repo, t.n)
+    for (const m of code.matchAll(/\bfor\s+(\w+)\s+in\s+([\d\s]+?)\s*;\s*do\b([\s\S]*?)\bdone\b/g)) {
+      if (!new RegExp(`\\bgh\\s+pr\\s+merge\\s+"?\\$\\{?${m[1]}\\}?\\b`).test(m[3])) continue
+      for (const n of m[2].trim().split(/\s+/)) add(null, n)
+    }
+    // gh's own confirmation, when the output survived — its SUCCESS phrasings only, since gh also names
+    // the PR in "Pull request o/r#12 is not mergeable": "✓ Squashed and merged pull request o/r#12 (…)",
+    // "✓ Pull request o/r#12 will be automatically merged via squash when all requirements are met".
+    for (const m of text.matchAll(new RegExp(`merged pull request (${REPO})?#(\\d+)`, 'gi'))) add(m[1] ?? null, m[2])
+    for (const m of text.matchAll(new RegExp(`pull request (${REPO})?#(\\d+) will be automatically merged`, 'gi'))) add(m[1] ?? null, m[2])
+  }
+
+  if (PUBLISH.test(code)) {
+    // npm's "+ name@1.2.3", and this repo's release script's per-name verification "OK  name@1.2.3".
+    // Success lines only: a publish refused with a 409 prints neither, and must not claim the version.
+    for (const m of text.matchAll(/^\s*(?:\+|OK)\s+((?:@[\w.-]+\/)?[\w.-]+)@(\d+\.\d+\.\d+(?:-[\w.]+)?)\s*$/gm)) {
+      out.add(`release:${m[1].toLowerCase()}@${m[2]}`)
+    }
+  }
+  return [...out]
+}
+
 /**
  * Find this session's transcript by its id alone. Scanning for `<id>.jsonl` avoids depending on how
  * Claude Code slugs the launch directory into a folder name — the id is unique, the slug rule is not
@@ -185,6 +401,65 @@ export function createWorkedFilesTracker(transcriptPath, opts = {}) {
   let carry = ''
   const repoOfDir = new Map()   // dir -> { root, repo } | null
   const recent = new Map()      // identifier -> true, insertion order = recency
+  const pending = new Map()     // tool_use id -> authoring command, until its result arrives
+  const authoredKeys = new Map() // authorship key -> true, insertion order = recency
+  const createdPrs = new Map()  // PR number -> repo, from this session's own `gh pr create`
+
+  const ctx = {
+    onCreated: (n, repo) => createdPrs.set(n, repo),
+    repoFor(n, dirHint) {
+      if (createdPrs.has(n)) return createdPrs.get(n)
+      if (!dirHint || !existsSync(dirHint)) return null
+      const root = resolveRoot(dirHint)
+      return root ? resolveRepo(root) : null
+    },
+  }
+
+  // A tool_use and its tool_result are separate transcript lines, often in separate polls, so the
+  // command waits here — only if it could author something, which keeps this to a handful of entries.
+  function collectAuthored(d) {
+    for (const b of d?.message?.content ?? []) {
+      if (b?.type === 'tool_use' && typeof b.input?.command === 'string' && isAuthoring(b.input.command)) {
+        pending.set(b.id, b.input.command)
+        if (pending.size > 200) pending.delete(pending.keys().next().value)
+      } else if (b?.type === 'tool_result' && pending.has(b.tool_use_id)) {
+        const cmd = pending.get(b.tool_use_id)
+        pending.delete(b.tool_use_id)
+        for (const k of authoredInCall(cmd, b.content, ctx)) {
+          authoredKeys.delete(k)
+          authoredKeys.set(k, true)
+          if (authoredKeys.size > MAX_KEPT) authoredKeys.delete(authoredKeys.keys().next().value)
+        }
+      }
+    }
+  }
+
+  // ⚠ AUTHORSHIP LOOKS FURTHER BACK THAN FILES DO. The files a session is working on are its recent
+  // ones, so their first read is the 2 MB tail. What it PRODUCED is different: a PR opened this morning
+  // still has arrivals settling tonight, and the tracker restarts with every MCP reconnect — which is
+  // after every release. Measured on a 42 MB transcript: its tail held none of the day's PRs. So the
+  // first poll also reads the history before the tail, for authorship only, with string filters ahead
+  // of any JSON.parse (measured ~150 ms for 42 MB; server.mjs keeps this off the startup path).
+  function scanAuthoredHistory(from, to) {
+    if (to <= from) return
+    let fd
+    try {
+      fd = openSync(transcriptPath, 'r')
+      const buf = Buffer.alloc(to - from)
+      readSync(fd, buf, 0, buf.length, from)
+      for (const line of buf.toString('utf8').split('\n')) {
+        const candidate = line.includes('"tool_use"') && AUTHORING_HINT.test(line)
+        const answer = !candidate && pending.size > 0 && line.includes('"tool_result"')
+          && [...line.matchAll(TOOL_USE_ID)].some((m) => pending.has(m[1]))
+        if (!candidate && !answer) continue
+        let d
+        try { d = JSON.parse(line) } catch { continue }   // the slice's first line is partial
+        collectAuthored(d)
+      }
+    } catch { /* attention data: a failed history read leaves the tail's reading intact */ } finally {
+      if (fd !== undefined) closeSync(fd)
+    }
+  }
 
   function locate(p) {
     const dir = dirname(p)
@@ -199,6 +474,7 @@ export function createWorkedFilesTracker(transcriptPath, opts = {}) {
     if (offset < 0 || size < offset) {       // first read, or the file was rewritten
       offset = Math.max(0, size - FIRST_READ_TAIL)
       carry = ''
+      scanAuthoredHistory(Math.max(0, size - AUTHORED_HISTORY), offset)
     }
     if (size > offset) {
       const len = Math.min(size - offset, MAX_READ_PER_POLL)
@@ -215,7 +491,13 @@ export function createWorkedFilesTracker(transcriptPath, opts = {}) {
       const lines = nl >= 0 ? text.slice(0, nl).split('\n') : []
 
       const touched = []
-      for (const line of lines) if (line) touched.push(...editedPathsInLine(line))
+      for (const line of lines) {
+        if (!line) continue
+        let d
+        try { d = JSON.parse(line) } catch { continue }
+        touched.push(...editedPathsIn(d))
+        collectAuthored(d)
+      }
 
       let probes = 0
       for (const p of touched) {
@@ -245,5 +527,10 @@ export function createWorkedFilesTracker(transcriptPath, opts = {}) {
     return [...recent.keys()].reverse().slice(0, limit)
   }
 
-  return { poll }
+  /** What this session produced, most recent first. Filled by poll(); reading it does not re-read the transcript. */
+  function authored(limit = 100) {
+    return [...authoredKeys.keys()].reverse().slice(0, limit)
+  }
+
+  return { poll, authored }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/agnoclast-mcp",
-  "version": "0.9.183",
+  "version": "0.9.185",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {