@theronap/cortex-mcp 0.4.2 → 0.4.3

package/bin/cortex-mcp.mjs

@@ -16,7 +16,7 @@
  * Get your token from the Cortex console → Connect your AI.
  */
 
-const VERSION = '0.4.2'
+const VERSION = '0.4.3'
 const cmd = process.argv[2]
 const rest = process.argv.slice(3)
 
@@ -51,7 +51,7 @@ if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
 // commands don't fall through into the server.
 if (cmd === 'setup') {
   const { runSetup } = await import('../lib/setup.mjs')
-  await runSetup(rest)
+  await runSetup(rest, VERSION)
   const { closeFetch } = await import('../lib/diagnose.mjs')
   await closeFetch()
 } else if (cmd === 'doctor') {

package/lib/capture.mjs

@@ -1,5 +1,5 @@
 import { readFileSync } from 'fs'
-import { fetchCortex, classify } from './diagnose.mjs'
+import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
 
 // Claude Code Stop hook → POSTs a session digest to Cortex cloud, which
 // summarizes server-side and upserts ONE record per session. Node-native
@@ -32,7 +32,7 @@ function transcriptTail(path) {
 export async function runCapture() {
   const token = process.env.CORTEX_TOKEN
   if (!token) { process.stderr.write('cortex: CORTEX_TOKEN not set, skipping\n'); return }
-  const base = (process.env.CORTEX_URL ?? 'https://cortex-console.vercel.app').replace(/\/$/, '')
+  const base = resolveBase(process.env.CORTEX_URL)
 
   let hook = {}
   try { hook = JSON.parse(readStdin()) } catch { /* no/invalid stdin */ }

package/lib/diagnose.mjs

@@ -12,6 +12,30 @@
 export const isUuid = (s) =>
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s ?? '')
 
+// The production alias — exempt from Vercel Deployment Protection.
+export const CANONICAL_BASE = 'https://cortex-console.vercel.app'
+
+// Resolve the API base from CORTEX_URL. A Vercel *deployment* URL
+// (cortex-console-<hash>-<team>.vercel.app, or any non-canonical *.vercel.app) is guarded by
+// Deployment Protection and returns an HTML auth page to programmatic clients — which looks
+// exactly like an "infra block" (403/401, non-JSON). The production alias is exempt. So if
+// CORTEX_URL points at a deployment URL, we fall back to the alias (and warn on stderr). A real
+// custom domain (not *.vercel.app) is respected as-is. This makes the client robust to a stale
+// CORTEX_URL pointing at a protected preview/deployment — the root cause of the Windows 403.
+export function resolveBase(rawUrl) {
+  const raw = (rawUrl ?? '').trim()
+  if (!raw) return CANONICAL_BASE
+  let host
+  try { host = new URL(raw).host } catch { return CANONICAL_BASE }
+  if (host.endsWith('.vercel.app') && host !== 'cortex-console.vercel.app') {
+    process.stderr.write(
+      `cortex: CORTEX_URL (${raw}) is a protected Vercel deployment URL; using ${CANONICAL_BASE} instead.\n`,
+    )
+    return CANONICAL_BASE
+  }
+  return raw.replace(/\/$/, '')
+}
+
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 
 // A non-OK response → an actionable diagnosis: { kind, retriable, message }.

package/lib/doctor.mjs

@@ -1,7 +1,7 @@
 import { readFileSync, existsSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
-import { checkToken } from './diagnose.mjs'
+import { checkToken, resolveBase } from './diagnose.mjs'
 
 // `npx @theronap/cortex-mcp doctor` — a live, one-command health check.
 //
@@ -25,7 +25,7 @@ function resolveToken() {
 }
 
 export async function runDoctor() {
-  const base = (process.env.CORTEX_URL ?? 'https://cortex-console.vercel.app').replace(/\/$/, '')
+  const base = resolveBase(process.env.CORTEX_URL)
   const out = (m) => process.stdout.write(m + '\n')
 
   out('')

package/lib/server.mjs

@@ -1,14 +1,14 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { z } from 'zod'
-import { fetchCortex, classify } from './diagnose.mjs'
+import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
 
 // The Cortex MCP server (stdio). Serves the signed-in employee's scoped org
 // context to their AI assistant. CORTEX_TOKEN identifies the user + org.
 
 export async function runServer(version) {
   const TOKEN = process.env.CORTEX_TOKEN
-  const BASE = (process.env.CORTEX_URL ?? 'https://cortex-console.vercel.app').replace(/\/$/, '')
+  const BASE = resolveBase(process.env.CORTEX_URL)
 
   if (!TOKEN) {
     process.stderr.write('cortex-mcp: CORTEX_TOKEN is required. Get yours from the Cortex console → Connect your AI.\n')

package/lib/setup.mjs

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from 'fs'
 import { homedir } from 'os'
 import { join, dirname } from 'path'
-import { checkToken } from './diagnose.mjs'
+import { checkToken, resolveBase } from './diagnose.mjs'
 
 // One-command employee onboarding. Wires both:
 //   1. ~/.claude.json        → the cortex MCP server (context-serving)
@@ -32,7 +32,7 @@ function ensureDir(path) {
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
 }
 
-export async function runSetup(argv) {
+export async function runSetup(argv, version) {
   const token = argv[0]
   if (!token || token.startsWith('-')) {
     process.stderr.write(
@@ -41,7 +41,10 @@ export async function runSetup(argv) {
     )
     process.exit(1)
   }
-  const base = process.env.CORTEX_URL ?? 'https://cortex-console.vercel.app'
+  // Pin the wired commands to the installed version so the config can't later run a stale
+  // cached build (npx may reuse a cached older version for an unpinned spec).
+  const spec = version ? `${PKG}@${version}` : PKG
+  const base = resolveBase(process.env.CORTEX_URL)
   const home = homedir()
   const claudeJson = join(home, '.claude.json')
   const settingsJson = join(home, '.claude', 'settings.json')
@@ -62,7 +65,7 @@ export async function runSetup(argv) {
     cfg.mcpServers.cortex = {
       type: 'stdio',
       command: 'npx',
-      args: ['-y', PKG],
+      args: ['-y', spec],
       env: { CORTEX_TOKEN: token },
     }
     ensureDir(claudeJson)
@@ -84,7 +87,7 @@ export async function runSetup(argv) {
     s.hooks = s.hooks ?? {}
     s.hooks.Stop = Array.isArray(s.hooks.Stop) ? s.hooks.Stop : []
 
-    const captureCmd = `CORTEX_TOKEN=${token} npx -y ${PKG} capture`
+    const captureCmd = `CORTEX_TOKEN=${token} npx -y ${spec} capture`
     // Remove any prior cortex capture hook (idempotent: drop old token / old path forms).
     for (const grp of s.hooks.Stop) {
       if (Array.isArray(grp.hooks)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {