@theronap/cortex-mcp 0.4.4 → 0.4.6

package/bin/cortex-mcp.mjs

@@ -16,7 +16,7 @@
  * Get your token from the Cortex console → Connect your AI.
  */
 
-const VERSION = '0.4.3'
+const VERSION = '0.4.6'
 const cmd = process.argv[2]
 const rest = process.argv.slice(3)
 
@@ -35,6 +35,7 @@ if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
     `Subcommands:\n` +
     `  setup <token>   wire MCP server + capture hook into ~/.claude config\n` +
     `  doctor          live health check — confirm your token works (no restart needed)\n` +
+    `  status          one-line connected/not-connected check (used by the SessionStart hook)\n` +
     `  capture         Stop-hook capturer (invoked by Claude Code)\n` +
     `  (no args)       run the MCP server (used by your Claude config)\n\n` +
     `Get your token from the Cortex console → Connect your AI.\n`,
@@ -59,6 +60,12 @@ if (cmd === 'setup') {
   process.exitCode = await runDoctor()
   const { closeFetch } = await import('../lib/diagnose.mjs')
   await closeFetch()
+} else if (cmd === 'status') {
+  // One-line SessionStart health signal (wired by setup). Always exit 0.
+  const { runStatus } = await import('../lib/doctor.mjs')
+  await runStatus()
+  const { closeFetch } = await import('../lib/diagnose.mjs')
+  await closeFetch()
 } else if (cmd === 'capture') {
   const { runCapture } = await import('../lib/capture.mjs')
   await runCapture()

package/lib/capture.mjs

@@ -1,6 +1,21 @@
 import { readFileSync } from 'fs'
+import { homedir } from 'os'
+import { resolve } from 'path'
 import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
 
+// Project name from the hook cwd — cross-platform. Windows hooks send backslash paths,
+// and splitting on '/' alone turned the WHOLE path into one garbage project slug
+// ("c-users-webst-onedrive-…", three-machine dry-run finding 2026-06-09). A session run
+// from the home directory itself is 'general', not a project named after the user.
+export function projectFrom(cwd) {
+  if (!cwd) return 'general'
+  try {
+    if (resolve(String(cwd)) === homedir()) return 'general'
+  } catch { /* unresolvable path — fall through to basename */ }
+  const base = String(cwd).split(/[\\/]+/).filter((s) => s && !/^[A-Za-z]:$/.test(s)).pop()
+  return base ?? 'general'
+}
+
 // Claude Code Stop hook → POSTs a session digest to Cortex cloud, which
 // summarizes server-side and upserts ONE record per session. Node-native
 // (no bun, no repo clone). Always exits 0 — capture must never break a session.
@@ -10,23 +25,42 @@ function readStdin() {
 }
 
 // Claude transcripts are JSONL; pull human-readable text from the tail so the
-// server has real content to summarize (not raw tool JSON).
+// server has real content to summarize (not raw tool JSON). ALSO scan the FULL
+// file for lifecycle-verb lines (§4b status recall — a "we're pausing X" said at
+// minute 5 of a 2-hour session must reach the server's status prefilter even
+// though only the tail ships) and append the flagged spans.
+const LIFECYCLE_RE = /\b(paus\w*|resum\w*|shipp?\w*|kill\w*|cancel\w*|on hold|sunset\w*)\b/i
+
 function transcriptTail(path) {
   let raw = ''
   try { raw = readFileSync(path, 'utf8') } catch { return '' }
-  const lines = raw.split('\n').filter(Boolean).slice(-60)
-  const texts = []
-  for (const line of lines) {
+  const jsonLines = raw.split('\n').filter(Boolean)
+  const textOf = (line) => {
     try {
       const obj = JSON.parse(line)
       const content = obj?.message?.content ?? obj?.content
-      if (typeof content === 'string') texts.push(content)
-      else if (Array.isArray(content)) {
-        for (const c of content) if (c?.type === 'text' && c.text) texts.push(c.text)
-      }
+      if (typeof content === 'string') return [content]
+      if (Array.isArray(content)) return content.filter((c) => c?.type === 'text' && c.text).map((c) => c.text)
     } catch { /* skip non-JSON */ }
+    return []
+  }
+
+  const texts = jsonLines.slice(-60).flatMap(textOf)
+  const tail = texts.join('\n').slice(-6000)
+
+  // Full-session status-candidate spans (last 12 matching lines, capped).
+  const flagged = []
+  for (const line of jsonLines) {
+    for (const t of textOf(line)) {
+      for (const tl of t.split('\n')) {
+        if (LIFECYCLE_RE.test(tl)) flagged.push(tl.trim().slice(0, 200))
+      }
+    }
   }
-  return texts.join('\n').slice(-6000)
+  const spans = flagged.slice(-12).join('\n').slice(0, 1200)
+  return spans && !tail.includes(spans)
+    ? `${tail}\n\n[status-candidate lines from the full session]\n${spans}`
+    : tail
 }
 
 export async function runCapture() {
@@ -36,7 +70,7 @@ export async function runCapture() {
 
   let hook = {}
   try { hook = JSON.parse(readStdin()) } catch { /* no/invalid stdin */ }
-  const repo = hook.cwd?.split('/').filter(Boolean).pop() ?? 'general'
+  const repo = projectFrom(hook.cwd)
   const transcript = hook.transcript_path ? transcriptTail(hook.transcript_path) : ''
 
   if (!transcript && !hook.session_id) { process.stderr.write('cortex: empty session, skipping\n'); return }
@@ -65,7 +99,7 @@ export async function runCapture() {
     const j = await res.json().catch(() => ({}))
     process.stderr.write(`cortex: ${j.inserted ? 'captured' : 'updated'} "${j.title ?? repo}" → ${repo}\n`)
   } else {
-    const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason'))
+    const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
     process.stderr.write(`cortex: ingest failed — ${d.message}\n`)
   }
 }

package/lib/diagnose.mjs

@@ -6,10 +6,8 @@
 // to tell the truth about WHAT failed.
 //
 // KEY SIGNAL: the Cortex app ALWAYS returns JSON ({ error: ... }). So a NON-JSON body on a
-// 4xx/5xx means something else handled the request, not Cortex auth — re-running setup or
-// regenerating the token will not help. Two cases: (1) an egress allowlist block
-// (x-deny-reason: host_not_allowed) — NOT retriable, the host must be added to the allowlist;
-// (2) a transient infrastructure hiccup — retriable.
+// 4xx/5xx means infrastructure handled the request, not Cortex auth — re-running setup or
+// regenerating the token will not help; it is usually transient and worth a retry.
 
 export const isUuid = (s) =>
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s ?? '')
@@ -41,11 +39,10 @@ export function resolveBase(rawUrl) {
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 
 // A non-OK response → an actionable diagnosis: { kind, retriable, message }.
-//   kind: 'auth'   → token bad/revoked/wrong-deployment (NOT retriable)
-//         'egress' → blocked by network egress allowlist (NOT retriable, not a Cortex/Vercel issue)
-//         'infra'  → blocked by infrastructure, non-JSON body (retriable, usually transient)
-//         'app'    → a real Cortex API error with a JSON message (retriable only if 5xx)
-export function classify(status, contentType, bodyText, requestId, denyReason) {
+//   kind: 'auth'  → token bad/revoked/wrong-deployment (NOT retriable)
+//         'infra' → blocked by infrastructure, non-JSON body (retriable, usually transient)
+//         'app'   → a real Cortex API error with a JSON message (retriable only if 5xx)
+export function classify(status, contentType, bodyText, requestId) {
   const isJson = (contentType ?? '').includes('application/json')
   let appError = null
   if (isJson) { try { appError = JSON.parse(bodyText)?.error ?? null } catch { /* not json after all */ } }
@@ -59,15 +56,6 @@ export function classify(status, contentType, bodyText, requestId, denyReason) {
         `the Cortex console → Connect your AI, then re-run setup.${rid}`,
     }
   }
-  if (denyReason === 'host_not_allowed' || /host (not in allowlist|not allowed)/i.test(bodyText ?? '')) {
-    return {
-      kind: 'egress', retriable: false,
-      message: `Blocked by your network's egress allowlist (HTTP ${status}: ${denyReason ?? 'host_not_allowed'}). ` +
-        `The request never left this environment — this is NOT a Cortex, token, or Vercel issue. ` +
-        `Add ${CANONICAL_BASE} to your environment's outbound allowlist, or run from a machine with open egress. ` +
-        `Re-running setup or regenerating the token will not help.${rid}`,
-    }
-  }
   if (!isJson) {
     return {
       kind: 'infra', retriable: true,
@@ -91,11 +79,10 @@ export async function fetchCortex(url, opts = {}, { retries = 2, baseDelayMs = 4
     try {
       const res = await fetch(url, opts)
       const ct = res.headers.get('content-type') ?? ''
-      const denyReason = res.headers.get('x-deny-reason') ?? ''
       const transient =
         res.status === 429 ||
         res.status >= 500 ||
-        (res.status === 403 && !ct.includes('application/json') && !denyReason) // egress block is not transient
+        (res.status === 403 && !ct.includes('application/json')) // infra block, not app authz
       if (transient && attempt < retries) {
         await sleep(baseDelayMs * 2 ** attempt)
         continue
@@ -135,7 +122,7 @@ export async function checkToken(token, base) {
   const contentType = res.headers.get('content-type')
   const body = await res.text()
   if (!res.ok) {
-    return { ok: false, status: res.status, requestId, diagnosis: classify(res.status, contentType, body, requestId, res.headers.get('x-deny-reason')) }
+    return { ok: false, status: res.status, requestId, diagnosis: classify(res.status, contentType, body, requestId) }
   }
   let projectCount
   try {

package/lib/doctor.mjs

@@ -24,6 +24,32 @@ function resolveToken() {
   return { token: null, source: null }
 }
 
+// `status` — the one-line SessionStart variant of doctor: a visible "is Cortex capturing?"
+// signal inside Claude Code itself (three-machine dry-run finding 2026-06-09: with no
+// indicator, a user can't tell whether their sessions are flowing to the org).
+// Always returns 0 — a status line must never break a session start.
+export async function runStatus() {
+  const base = resolveBase(process.env.CORTEX_URL)
+  const out = (m) => process.stdout.write(m + '\n')
+  const { token } = resolveToken()
+  if (!token) {
+    out('Cortex: NOT connected — no token found. Run: npx -y @theronap/cortex-mcp setup <token>')
+    return 0
+  }
+  try {
+    const r = await checkToken(token, base)
+    if (r.ok) {
+      const n = typeof r.projectCount === 'number' ? ` · ${r.projectCount} project${r.projectCount === 1 ? '' : 's'} visible` : ''
+      out(`Cortex: connected — sessions on this machine are captured to your org${n}.`)
+    } else {
+      out(`Cortex: NOT connected — ${r.diagnosis?.message ?? 'check failed'}. Run: npx -y @theronap/cortex-mcp doctor`)
+    }
+  } catch (e) {
+    out(`Cortex: status check failed (${e?.message ?? String(e)}) — run doctor.`)
+  }
+  return 0
+}
+
 export async function runDoctor() {
   const base = resolveBase(process.env.CORTEX_URL)
   const out = (m) => process.stdout.write(m + '\n')

package/lib/server.mjs

@@ -25,7 +25,7 @@ export async function runServer(version) {
     const res = await fetchCortex(`${BASE}/api/mcp-context`, { headers: { Authorization: `Bearer ${TOKEN}` } })
     if (!res.ok) {
       const body = await res.text()
-      throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason')).message)
+      throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
     }
     const { context } = await res.json()
     cache = { text: context, ts: now }
@@ -92,7 +92,7 @@ export async function runServer(version) {
         return { content: [{ type: 'text', text: `Could not assemble story: ${e.message}` }] }
       }
       if (!res.ok) {
-        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason'))
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
         return { content: [{ type: 'text', text: `Could not assemble story: ${d.message}` }] }
       }
       const { answer, sourceCount, sources } = await res.json()
@@ -102,6 +102,34 @@ export async function runServer(version) {
     },
   )
 
+  server.registerTool(
+    'who_knows',
+    {
+      title: 'Who knows about X',
+      description: 'Ranked teammates who have visibly worked on a topic, with evidence — derived only from records you are permitted to see.',
+      inputSchema: { topic: z.string().describe('the topic/system/skill, e.g. "the embedding pipeline" or "stripe webhooks"') },
+    },
+    async ({ topic }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/who-knows?q=${encodeURIComponent(topic)}`, {
+          headers: { Authorization: `Bearer ${TOKEN}` },
+        })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not look up experts: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not look up experts: ${d.message}` }] }
+      }
+      const { experts } = await res.json()
+      if (!experts?.length) return { content: [{ type: 'text', text: `No one visible to you has recorded work about "${topic}".` }] }
+      const lines = experts.map((e, i) =>
+        `${i + 1}. ${e.name} — ${e.count} visible record${e.count === 1 ? '' : 's'}\n   e.g. ${e.evidence.join(' · ')}`)
+      return { content: [{ type: 'text', text: `People with visible work on "${topic}":\n${lines.join('\n')}` }] }
+    },
+  )
+
   server.registerTool(
     'set_record_privacy',
     {
@@ -124,7 +152,7 @@ export async function runServer(version) {
         return { content: [{ type: 'text', text: `Could not set privacy: ${e.message}` }] }
       }
       if (!res.ok) {
-        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason'))
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
         return { content: [{ type: 'text', text: `Could not set privacy: ${d.message}` }] }
       }
       const out = await res.json()

package/lib/setup.mjs

@@ -100,9 +100,24 @@ export async function runSetup(argv, version) {
     grp.hooks = grp.hooks ?? []
     grp.hooks.push({ type: 'command', command: captureCmd })
 
+    // Connected-status SessionStart hook: one line inside Claude Code itself saying whether
+    // this machine's sessions are flowing to the org (dry-run finding: silence is unreadable).
+    // `status` reads the token from ~/.claude.json, so the command carries no secret.
+    s.hooks.SessionStart = Array.isArray(s.hooks.SessionStart) ? s.hooks.SessionStart : []
+    const statusCmd = `npx -y ${spec} status`
+    for (const sg of s.hooks.SessionStart) {
+      if (Array.isArray(sg.hooks)) {
+        sg.hooks = sg.hooks.filter((h) => !/cortex-mcp(@[^ ]*)? status/.test(h.command ?? ''))
+      }
+    }
+    let sgrp = s.hooks.SessionStart.find((g) => (g.matcher ?? '') === '')
+    if (!sgrp) { sgrp = { matcher: '', hooks: [] }; s.hooks.SessionStart.push(sgrp) }
+    sgrp.hooks = sgrp.hooks ?? []
+    sgrp.hooks.push({ type: 'command', command: statusCmd })
+
     ensureDir(settingsJson)
     writeFileSync(settingsJson, JSON.stringify(s, null, 2))
-    log(`  ✓ Capture hook → ${settingsJson}${bak ? ' (backup saved)' : ''}`)
+    log(`  ✓ Capture hook + status line → ${settingsJson}${bak ? ' (backup saved)' : ''}`)
   } catch (e) {
     process.stderr.write(`  ✗ failed to update ${settingsJson}: ${e.message}\n`)
     process.exit(1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {