@theronap/agnoclast-mcp 0.9.96

package/lib/imessage_send.mjs

@@ -0,0 +1,88 @@
+// send_imessage — outbound iMessage via Messages.app. This is a personal automation, NOT org
+// intelligence: it writes nothing to Agnoclast. Three layers of safety (eng-review D3/D6/D10):
+//   D6  argv-safe: recipient + body are passed as osascript `on run argv` arguments, NEVER
+//       interpolated into the script source → no AppleScript injection, no quote/newline breakage.
+//   D3  draft-by-default: nothing sends unless the caller explicitly passes send:true.
+//   D10 recipient gating: an MCP send tool is reachable by any agent context (prompt-injection
+//       surface), so a boolean alone is not enough. Allowlisted recipients send on send:true;
+//       OFF-list recipients additionally require an out-of-band confirm secret the agent context
+//       doesn't have (CORTEX_IMESSAGE_SEND_CONFIRM), else the send is BLOCKED.
+import { spawn } from 'child_process'
+
+// AppleScript reads its inputs from argv — the message text is DATA, never code.
+const SEND_SCRIPT = `on run argv
+  set targetId to item 1 of argv
+  set targetMessage to item 2 of argv
+  tell application "Messages"
+    set targetService to 1st account whose service type = iMessage
+    set targetBuddy to participant targetId of targetService
+    send targetMessage to targetBuddy
+  end tell
+end run`
+
+export function phoneKey(raw) {
+  const d = String(raw).replace(/[^0-9]/g, '')
+  return d.length < 7 ? null : d.slice(-10)
+}
+function handleKey(h) {
+  return h.includes('@') ? h.trim().toLowerCase() : phoneKey(h)
+}
+export function loadSendAllowlist(raw = process.env.CORTEX_IMESSAGE_SEND_ALLOWLIST ?? '') {
+  const set = new Set()
+  for (const item of raw.split(',').map((s) => s.trim()).filter(Boolean)) {
+    set.add(item.includes('@') ? item.toLowerCase() : (phoneKey(item) ?? item))
+  }
+  return set
+}
+
+// Pure decision: what should happen, given inputs + config. Testable without Messages.app.
+//   → { action: 'draft' | 'send' | 'blocked', reason }
+export function decideSend({ recipient, message, send, confirm, allowlist, confirmSecret }) {
+  if (!recipient || !String(recipient).trim()) return { action: 'blocked', reason: 'no recipient' }
+  if (!message || !String(message).trim()) return { action: 'blocked', reason: 'empty message' }
+  if (!send) return { action: 'draft', reason: 'draft-by-default — re-call with send:true to actually send' }
+  const key = handleKey(String(recipient))
+  if (key && allowlist.has(key)) return { action: 'send', reason: 'allowlisted recipient' }
+  // off-list: require the out-of-band confirm secret
+  if (confirmSecret && confirm && confirm === confirmSecret) return { action: 'send', reason: 'off-list send authorized by confirm secret' }
+  return {
+    action: 'blocked',
+    reason: confirmSecret
+      ? 'recipient not allowlisted — pass the out-of-band confirm secret to send, or add them to CORTEX_IMESSAGE_SEND_ALLOWLIST'
+      : 'recipient not allowlisted — add them to CORTEX_IMESSAGE_SEND_ALLOWLIST (or set CORTEX_IMESSAGE_SEND_CONFIRM for an out-of-band override)',
+  }
+}
+
+export function sendViaOsascript(recipient, message) {
+  return new Promise((resolve) => {
+    let err = ''
+    let proc
+    try {
+      proc = spawn('osascript', ['-', String(recipient), String(message)], { stdio: ['pipe', 'ignore', 'pipe'] })
+    } catch (e) {
+      resolve({ ok: false, error: String(e) }); return
+    }
+    proc.stderr.on('data', (d) => { err += d })
+    proc.on('error', (e) => resolve({ ok: false, error: String(e) }))
+    proc.on('close', (code) => resolve({ ok: code === 0, error: err.trim() }))
+    proc.stdin.write(SEND_SCRIPT)
+    proc.stdin.end()
+  })
+}
+
+// Tool entry: decide, then act. Returns MCP content text.
+export async function runSendImessage({ recipient, message, send, confirm }) {
+  const decision = decideSend({
+    recipient, message, send, confirm,
+    allowlist: loadSendAllowlist(),
+    confirmSecret: process.env.CORTEX_IMESSAGE_SEND_CONFIRM ?? null,
+  })
+  if (decision.action === 'draft') {
+    return `📝 DRAFT (not sent) — to ${recipient}:\n${message}\n\n(${decision.reason})`
+  }
+  if (decision.action === 'blocked') {
+    return `🚫 Not sent: ${decision.reason}`
+  }
+  const r = await sendViaOsascript(recipient, message)
+  return r.ok ? `✅ Sent to ${recipient}.` : `❌ Send failed: ${r.error || 'Messages.app returned an error (is it signed in to iMessage? is Automation permission granted?)'}`
+}

package/lib/ingest_folder.mjs

@@ -0,0 +1,170 @@
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative, basename, extname } from 'node:path'
+import { fetchCortex, classify, resolveBase, resolveEnvToken } from './diagnose.mjs'
+
+// `cortex-mcp ingest-folder <path>` — walk a local markdown folder and upsert each file as an
+// AUTHORED record in Agnoclast (source='brain'), so a user's personal digest is built from THEIR
+// notes (Robin parity). Only an EXCERPT of each file leaves the machine (frontmatter + first
+// ~800 chars), never the full body. The server clamps privacy for source='brain' and treats
+// sessionId (the file's relative path) as the stable dedupe key, so re-running updates in place.
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+
+const MD_EXT = new Set(['.md', '.markdown'])
+// Directories that are never user notes — skip them and any dotfile dir.
+const SKIP_DIRS = new Set(['node_modules', '.git', '.obsidian', '.trash'])
+
+// Recursively collect markdown file paths under `root`. Uses withFileTypes so we can prune
+// skipped directories without stat-ing every entry.
+function walkMarkdown(root) {
+  const out = []
+  let entries
+  try {
+    entries = readdirSync(root, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const ent of entries) {
+    const full = join(root, ent.name)
+    if (ent.isDirectory()) {
+      if (SKIP_DIRS.has(ent.name) || ent.name.startsWith('.')) continue
+      out.push(...walkMarkdown(full))
+    } else if (ent.isFile() && MD_EXT.has(extname(ent.name).toLowerCase())) {
+      out.push(full)
+    }
+  }
+  return out
+}
+
+// Tiny hand-rolled YAML frontmatter parser. Only the leading `---\n…\n---` block; flat
+// `key: value` lines. Collects title/tags/project/people if present. No dependencies — this is
+// deliberately minimal (not a full YAML parser). Returns { frontmatter, frontLines, bodyStart }.
+function parseFrontmatter(content) {
+  if (!content.startsWith('---\n') && !content.startsWith('---\r\n')) {
+    return { frontmatter: {}, frontLines: [], bodyStart: 0 }
+  }
+  const lines = content.split('\n')
+  // lines[0] is the opening '---'; find the closing '---'.
+  let end = -1
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i].trim() === '---') { end = i; break }
+  }
+  if (end === -1) return { frontmatter: {}, frontLines: [], bodyStart: 0 }
+
+  const frontLines = lines.slice(1, end)
+  const frontmatter = {}
+  for (const raw of frontLines) {
+    const line = raw.replace(/\r$/, '')
+    const idx = line.indexOf(':')
+    if (idx === -1) continue
+    const key = line.slice(0, idx).trim()
+    let value = line.slice(idx + 1).trim()
+    if (!key) continue
+    // Strip wrapping quotes.
+    value = value.replace(/^["']|["']$/g, '')
+    // Inline list form: [a, b, c]
+    if (value.startsWith('[') && value.endsWith(']')) {
+      const items = value.slice(1, -1).split(',').map((s) => s.trim().replace(/^["']|["']$/g, '')).filter(Boolean)
+      frontmatter[key] = items
+    } else if (value === '') {
+      frontmatter[key] = ''
+    } else {
+      frontmatter[key] = value
+    }
+  }
+  // bodyStart = char offset just past the closing '---' line + its newline.
+  const consumed = lines.slice(0, end + 1).join('\n')
+  const bodyStart = consumed.length + 1
+  return { frontmatter, frontLines: frontLines.map((l) => l.replace(/\r$/, '')), bodyStart }
+}
+
+// title: frontmatter.title → first `# ` heading in body → filename without extension.
+function deriveTitle(frontmatter, body, filePath) {
+  if (typeof frontmatter.title === 'string' && frontmatter.title.trim()) return frontmatter.title.trim()
+  for (const line of body.split('\n')) {
+    const m = line.match(/^#\s+(.+?)\s*$/)
+    if (m) return m[1].trim()
+  }
+  return basename(filePath, extname(filePath))
+}
+
+// summary: first ~800 chars of the BODY (prose). Bounded so the raw full file never leaves the
+// machine. Frontmatter is NOT prepended — it rides structured in payload, and the title is derived
+// separately, so the summary reads as content (what the digest summarizes), not "key: value" noise.
+function deriveSummary(body) {
+  return body.trim().slice(0, 800)
+}
+
+export async function runIngestFolder(argv) {
+  const path = argv[0]
+  if (!path) {
+    process.stderr.write(
+      'usage: cortex-mcp ingest-folder <path>\n' +
+      '  Ingest a local markdown folder as your authored Agnoclast records.\n',
+    )
+    return
+  }
+
+  const token = resolveEnvToken().token
+  if (!token) {
+    process.stderr.write(
+      'cortex: CORTEX_TOKEN not set. Run setup first, or export CORTEX_TOKEN=<your-token>.\n',
+    )
+    return
+  }
+  const base = resolveBase(process.env.CORTEX_URL)
+
+  const files = walkMarkdown(path)
+  process.stdout.write(`Ingesting ${files.length} markdown files from ${path} …\n`)
+  if (files.length === 0) {
+    process.stdout.write('✓ ingested 0, updated 0, failed 0 (no markdown files found)\n')
+    return
+  }
+
+  let inserted = 0
+  let updated = 0
+  let failed = 0
+
+  for (const file of files) {
+    try {
+      const content = readFileSync(file, 'utf8')
+      const { frontmatter, bodyStart } = parseFrontmatter(content)
+      const body = content.slice(bodyStart)
+
+      const relpath = relative(path, file)
+      const title = deriveTitle(frontmatter, body, file)
+      const summary = deriveSummary(body)
+      const occurredAt = statSync(file).mtime.toISOString()
+
+      const res = await fetchCortex(`${base}/api/ingest`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          source: 'brain',
+          sessionId: relpath,
+          title,
+          summary,
+          privacy: 'scoped',
+          occurredAt,
+          payload: { path: relpath, frontmatter },
+        }),
+      })
+
+      if (res.ok) {
+        const j = await res.json().catch(() => ({}))
+        if (j.inserted === false) updated++
+        else inserted++
+      } else {
+        failed++
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        process.stderr.write(`cortex: ${relative(path, file)} failed — ${d.message}\n`)
+      }
+    } catch (e) {
+      failed++
+      process.stderr.write(`cortex: ${relative(path, file)} failed — ${e.message}\n`)
+    }
+    await sleep(60)
+  }
+
+  process.stdout.write(`✓ ingested ${inserted}, updated ${updated}, failed ${failed}\n`)
+}

package/lib/install.mjs

@@ -0,0 +1,163 @@
+// `cortex install` — the cross-editor hub installer (P0-b). One command that wires the Agnoclast MCP
+// server + client shim into EVERY detected editor via the adapter registry, then writes a capability
+// manifest so later pillars (session sync, skill sync, doc sync) know which channels each editor
+// supports. `setup <token>` stays as the single-editor path the console prints; `install` is the
+// multi-editor superset that drives the SAME adapter `wire()` functions.
+import { homedir } from 'node:os'
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { ADAPTERS, resolveEditors } from './editors/index.mjs'
+import { checkToken, resolveBase, readWiredToken, wiredDistTag } from './diagnose.mjs'
+
+const PKG = '@theronap/cortex-mcp'
+export const MANIFEST_PATH = join(homedir(), '.cortex', 'editors.json')
+
+/** Parse install argv: an optional positional <token> + `--editor auto|all|<id,...>` (also `--all`,
+ *  `--editor=<v>`, `-e <v>`). Unknown flags are ignored (fail-soft — never mistaken for the token). */
+export function parseInstallArgs(argv = []) {
+  let editor = 'auto'
+  let token
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+    if (a === '--editor' || a === '-e') { editor = argv[++i] ?? editor; continue }
+    if (a.startsWith('--editor=')) { editor = a.slice('--editor='.length); continue }
+    if (a === '--all') { editor = 'all'; continue }
+    if (a.startsWith('-')) continue // ignore unknown flags, don't treat as token
+    if (token === undefined) token = a
+  }
+  return { token, editor: editor || 'auto' }
+}
+
+/** Pure: build the capability manifest from resolved per-editor entries. Injectable `now`/`cortexMcp`
+ *  keep it deterministic for tests. Each entry = { adapter, detected, wired, wrote?, warnings? }. */
+export function buildManifest(entries, { now = new Date().toISOString(), cortexMcp = null } = {}) {
+  return {
+    schema: 1,
+    generatedAt: now,
+    cortexMcp,
+    editors: entries.map((e) => ({
+      id: e.adapter.id,
+      displayName: e.adapter.displayName,
+      detected: !!e.detected,
+      wired: !!e.wired,
+      capabilities: e.adapter.capabilities,
+      wrote: e.wrote ?? [],
+      warnings: e.warnings ?? [],
+    })),
+  }
+}
+
+/** Read the existing manifest ({} if absent/malformed — never throws). */
+export function readManifest({ path = MANIFEST_PATH } = {}) {
+  try {
+    if (!existsSync(path)) return {}
+    const raw = readFileSync(path, 'utf8').trim()
+    return raw ? JSON.parse(raw) : {}
+  } catch {
+    return {} // malformed manifest is not fatal — a fresh install rewrites it
+  }
+}
+
+export function writeManifest(manifest, { path = MANIFEST_PATH } = {}) {
+  const dir = dirname(path)
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
+  writeFileSync(path, JSON.stringify(manifest, null, 2))
+  return path
+}
+
+export async function runInstall(argv, version) {
+  const { token: argToken, editor } = parseInstallArgs(argv)
+  const token = argToken || readWiredToken()
+  // Preserve an intentional @latest (dogfood) pin across re-runs; fresh installs + existing @stable
+  // get @stable. See wiredDistTag — forcing @stable here silently demoted a dogfooder (2026-07-24).
+  const spec = wiredDistTag() === 'latest' ? `${PKG}@latest` : `${PKG}@stable`
+  const home = homedir()
+  const log = (m) => process.stdout.write(m + '\n')
+
+  if (!token) {
+    process.stderr.write(
+      'Usage: npx @theronap/cortex-mcp install [<CORTEX_TOKEN>] [--editor auto|all|<id,...>]\n\n' +
+      'No token was given and none is already wired.\n' +
+      'Get your token from the Agnoclast console → Connect your AI.\n',
+    )
+    process.exit(1)
+  }
+
+  let targets
+  try {
+    targets = resolveEditors(editor)
+  } catch (e) {
+    process.stderr.write(`\n✗ ${e.message}\n`)
+    process.exit(1)
+  }
+
+  log('')
+  log('Agnoclast install — wiring your AI editors…')
+  if (editor === 'auto' && targets.length === 0) {
+    log('  (no supported editors detected — pass --editor all to force, or install an editor first)')
+  }
+
+  // Carry forward prior manifest state for editors NOT targeted this run, so a single-editor
+  // `install --editor cursor` doesn't wipe the "wired" record of editors a previous run set up.
+  const priorById = new Map((readManifest().editors ?? []).map((e) => [e.id, e]))
+  const targetIds = new Set(targets.map((a) => a.id))
+
+  const entries = []
+  for (const adapter of ADAPTERS) {
+    const detected = safeDetect(adapter)
+    if (!targetIds.has(adapter.id)) {
+      const p = priorById.get(adapter.id)
+      entries.push({ adapter, detected, wired: p?.wired ?? false, wrote: p?.wrote ?? [], warnings: [] })
+      continue
+    }
+    log(`\n${adapter.displayName}:`)
+    let res = { wrote: [], skipped: [], warnings: [] }
+    try {
+      res = (await adapter.wire({ home, token, spec, log })) ?? res
+    } catch (e) {
+      // A single editor's failure must never abort the others (fail-soft, like setup's Codex block).
+      res.warnings = [...(res.warnings ?? []), `wire failed: ${e.message}`]
+      log(`  ⚠ ${adapter.displayName} wiring failed: ${e.message}`)
+    }
+    for (const w of res.warnings ?? []) log(`  ⚠ ${w}`)
+    entries.push({
+      adapter,
+      detected,
+      wired: (res.wrote ?? []).length > 0,
+      wrote: res.wrote ?? [],
+      warnings: res.warnings ?? [],
+    })
+  }
+
+  const mpath = writeManifest(buildManifest(entries, { cortexMcp: version ?? null }))
+  log(`\n  ✓ Capability manifest → ${mpath}`)
+
+  // Verify the token against the live API — writing config proves "files written", not "it works".
+  const base = resolveBase(process.env.CORTEX_URL)
+  log('')
+  log('Verifying your token against Agnoclast…')
+  try {
+    const health = await checkToken(token, base)
+    if (health.ok) {
+      const n = health.projectCount
+      log(`  ✓ Verified — your token works${typeof n === 'number' ? ` (you can see ${n} project${n === 1 ? '' : 's'})` : ''}.`)
+    } else {
+      log('  ⚠ Config written, but the live check did NOT pass:')
+      log(`     ${health.diagnosis?.message ?? 'unknown error'}`)
+      log('     The files are in place; fix the above, then re-check with `doctor`.')
+    }
+  } catch (e) {
+    log(`  ⚠ Could not reach Agnoclast to verify (${e.message}). Config is written; re-check with 'doctor'.`)
+  }
+
+  const wired = entries.filter((e) => targetIds.has(e.adapter.id) && e.wired).map((e) => e.adapter.displayName)
+  log('')
+  log(`⟳ Wired ${wired.length} editor(s): ${wired.join(', ') || '(none)'}`)
+  log('   Fully quit and reopen each editor to load the Agnoclast server.')
+  log(`   Console: ${base}`)
+  log('')
+}
+
+function safeDetect(adapter) {
+  try { return !!adapter.detect() } catch { return false }
+}

package/lib/login.mjs

@@ -0,0 +1,148 @@
+import os from 'node:os'
+import { spawn } from 'node:child_process'
+import { resolveBase, CANONICAL_BASE } from './diagnose.mjs'
+
+// `cortex-mcp login` — get a token without the human copy-pasting one out of the web console.
+//
+// WHY THIS EXISTS: the old path was log into the console, find /connect, copy a uuid, paste it into
+// a terminal. That copy-paste is the step that failed on the first non-technical onboarding
+// (2026-08-03), and it is the reason there could never be a real one-line install. Here the person
+// clicks Approve in a browser and types nothing.
+//
+// THE FLOW (server side: /api/device/{start,approve,exchange}):
+//   1. start    — we generate nothing; the server issues a device_code (our secret) + a short
+//                 user_code, and we open the pre-filled approval URL.
+//   2. approve  — happens in their browser, against their login. We never see their password and
+//                 never handle a JWT.
+//   3. exchange — we poll with the device_code; once a human has approved, the token is minted and
+//                 returned exactly once. Then we hand straight off to the normal `setup` wiring.
+//
+// Deliberately a DEVICE flow rather than a loopback redirect. Loopback needs a local port and an
+// open browser on the same machine, so it dies over SSH and on locked-down laptops. With the URL
+// pre-filled, the device flow costs the user the same single click and works everywhere.
+
+/** Open a URL in the user's default browser. Best-effort: never throws, never blocks the flow. */
+function openBrowser(url) {
+  const cmd =
+    process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open'
+  const args = process.platform === 'win32' ? ['/c', 'start', '""', url] : [url]
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true })
+    // If the browser cannot be launched we still printed the URL, so this is genuinely non-fatal.
+    child.on('error', () => {})
+    child.unref()
+    return true
+  } catch {
+    return false
+  }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+
+/** A label the person will recognise on the approval screen. Machine name, not a user name. */
+function deviceLabel() {
+  const host = os.hostname().replace(/\.local$/i, '')
+  return host || `${os.platform()} device`
+}
+
+export async function runLogin(argv = [], version = 'dev') {
+  const base = resolveBase(process.env.CORTEX_URL) || CANONICAL_BASE
+
+  // --label lets a person running several machines tell them apart later; account_tokens.label
+  // carries it, so it survives long after the grant row is swept.
+  const labelFlag = argv.indexOf('--label')
+  const label = labelFlag !== -1 && argv[labelFlag + 1] ? argv[labelFlag + 1] : deviceLabel()
+
+  let start
+  try {
+    const res = await fetch(`${base}/api/device/start`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ label }),
+    })
+    if (!res.ok) throw new Error(`server said ${res.status}`)
+    start = await res.json()
+  } catch (err) {
+    process.stderr.write(
+      `cortex: could not reach ${base} to start login (${err.message}).\n` +
+        `Check your connection, then try again.\n`,
+    )
+    process.exitCode = 1
+    return
+  }
+
+  const opened = openBrowser(start.verificationUriComplete)
+
+  process.stdout.write(
+    `\n  Confirm this code in your browser:  ${start.userCode}\n\n` +
+      (opened
+        ? `  A browser should have opened. If not, go to:\n    ${start.verificationUriComplete}\n\n`
+        : `  Open this in your browser:\n    ${start.verificationUriComplete}\n\n`) +
+      `  Waiting for you to approve it...\n`,
+  )
+
+  // Poll until approved or the grant expires. The server sets the pace (and says slow_down if we
+  // are early), so the cadence stays server-controlled rather than hardcoded here.
+  let interval = (start.interval ?? 2) * 1000
+  const deadline = Date.now() + (start.expiresIn ?? 600) * 1000
+  let token = null
+  let activeOrgId = null
+
+  while (Date.now() < deadline) {
+    await sleep(interval)
+    let res
+    try {
+      res = await fetch(`${base}/api/device/exchange`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ deviceCode: start.deviceCode }),
+      })
+    } catch {
+      continue // transient network blip: keep waiting rather than failing a login mid-approval
+    }
+
+    if (res.status === 429) {
+      interval = Math.min(interval * 2, 10_000) // back off, do not give up
+      continue
+    }
+    if (res.status === 410) {
+      process.stderr.write(`\ncortex: that took too long and the code expired. Run login again.\n`)
+      process.exitCode = 1
+      return
+    }
+    if (res.status === 409 || res.status === 404) {
+      const body = await res.json().catch(() => ({}))
+      process.stderr.write(`\ncortex: ${body.error ?? 'this login is no longer valid'}. Run login again.\n`)
+      process.exitCode = 1
+      return
+    }
+    if (!res.ok) continue
+
+    const body = await res.json().catch(() => ({}))
+    if (body.status === 'approved' && body.personalToken) {
+      token = body.personalToken
+      activeOrgId = body.activeOrgId ?? null
+      break
+    }
+    // 'pending' — the human has not clicked yet. Keep waiting quietly; a spinner that reprints
+    // every two seconds is noise on the one screen where the person is reading instructions.
+  }
+
+  if (!token) {
+    process.stderr.write(`\ncortex: nobody approved that login before it expired. Run login again.\n`)
+    process.exitCode = 1
+    return
+  }
+
+  process.stdout.write(`\n  Approved. Setting up...\n\n`)
+
+  // Hand the raw token straight to the existing installer. We never write it anywhere ourselves —
+  // runSetup owns every file that touches a credential, so there is exactly one code path that
+  // stores a token and one place to audit.
+  const { runSetup } = await import('./setup.mjs')
+  await runSetup([token], version)
+
+  if (activeOrgId) {
+    process.stdout.write(`  New pages will be saved in the space you picked.\n`)
+  }
+}

package/lib/managed.mjs

@@ -0,0 +1,49 @@
+// Identity for the entries we write onto a machine — hooks in settings.json, crontab lines.
+//
+// The problem this exists to solve: uninstall used to find our entries by matching the product
+// name (`CORTEX_RE = /cortex-mcp|.../`). That works only until the product is renamed, at which
+// point uninstall removes the OLD entries, reports success, and leaves the NEW ones wired —
+// firing on every session against a possibly revoked token. `67920bd` caught the same class of
+// bug from the other side (renamed skills left uninstall unable to find the skills on disk).
+// The installer had it too: its dedup filters matched `cortex-mcp.*capture`, so after a rename
+// a `repair` run would fail to recognize its own previous hooks and APPEND duplicates rather
+// than replace them.
+//
+// So identity stops depending on what the product is called. Every command we write carries an
+// inert marker flag that is stable across renames. Name matching stays as a LEGACY fallback only, because machines wired
+// before the marker existed can be found no other way — it can never be deleted, only demoted.
+
+/** Inert flag appended to every command we write. Never change this string: it is the only thing
+ *  that lets a future version recognize entries written by this one.
+ *
+ *  Why a FLAG and not a trailing `# comment`: a comment is only inert if the hook command is run
+ *  through a shell, and whether Claude Code does that is not something this package can verify.
+ *  An argv token is inert either way — with a shell it is an argument, without one it is still an
+ *  argument. The only requirement is that our own CLI ignore it, which holds because bin dispatches
+ *  on argv[2] and every subcommand parses `rest` with `.includes()` (verified 2026-08-19:
+ *  `uninstall --dry-run` and `uninstall --dry-run --agnoclast-managed` produce identical output).
+ *  Do not move it before the subcommand — it must land in `rest`, not in argv[2]. */
+export const MANAGED_MARKER = '--agnoclast-managed'
+
+/** Names we shipped under, for machines predating MANAGED_MARKER. Additive only — a name that
+ *  ever appeared in a written command must stay here forever. `capture-session-cloud` is an
+ *  early Stop-hook command that predates the npx form. */
+const LEGACY_NAME_RE = /cortex-mcp|agnoclast-mcp|capture-session-cloud|@theronap\/(cortex|agnoclast)/
+
+/** Stamp a command as ours. Appended, never substituted, so the command still runs unchanged. */
+export function markCommand(command) {
+  const c = String(command ?? '')
+  return c.includes(MANAGED_MARKER) ? c : `${c} ${MANAGED_MARKER}`
+}
+
+/** True if we wrote this command — by marker (rename-proof) or by legacy name (pre-marker seats). */
+export function isManagedCommand(command) {
+  const c = String(command ?? '')
+  return c.includes(MANAGED_MARKER) || LEGACY_NAME_RE.test(c)
+}
+
+/** True if this is one of ours AND runs the named subcommand. Used by the installer to replace
+ *  its own prior entry for a given hook rather than appending a duplicate beside it. */
+export function isManagedSubcommand(command, subcommand) {
+  return isManagedCommand(command) && new RegExp(`\\b${subcommand}\\b`).test(String(command ?? ''))
+}