@theronap/cortex-mcp 0.9.13 → 0.9.15

package/bin/cortex-mcp.mjs

@@ -96,6 +96,12 @@ if (cmd === 'setup') {
   await runResolve()
   const { closeFetch } = await import('../lib/diagnose.mjs')
   await closeFetch()
+} else if (cmd === 'relationships') {
+  // Tier-3 relationship inference: judge server-flagged nodes' prose-implied relationships via `claude -p`.
+  const { runRelationships } = await import('../lib/relationships.mjs')
+  await runRelationships()
+  const { closeFetch } = await import('../lib/diagnose.mjs')
+  await closeFetch()
 } else if (cmd === 'ingest-folder') {
   const { runIngestFolder } = await import('../lib/ingest_folder.mjs')
   await runIngestFolder(rest)

package/lib/capture.mjs

@@ -5,6 +5,7 @@ import { createHash } from 'crypto'
 import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
 import { extractSession } from './edge_extract.mjs'
 import { extractTyped } from './extract_typed.mjs'
+import { redactSecrets } from './redact.mjs'
 
 // Fetch the node-type registry (global + this org's custom types) — the catalog the typed extractor
 // produces against. Best-effort: null on any failure (typed extraction is then skipped, never blocks capture).
@@ -92,7 +93,11 @@ export async function runCapture() {
   let hook = {}
   try { hook = JSON.parse(readStdin()) } catch { /* no/invalid stdin */ }
   const repo = projectFrom(hook.cwd)
-  const transcript = hook.transcript_path ? transcriptTail(hook.transcript_path) : ''
+  // Redact credential-shaped strings BEFORE anything leaves the machine — this `transcript`
+  // feeds local edge/typed extraction AND the fallback POST to the org. A secret in a
+  // transcript (pasted key, a tool that read a config file, a token inlined in a hook cmd)
+  // must never be transmitted or stored. See redact.mjs.
+  const transcript = hook.transcript_path ? redactSecrets(transcriptTail(hook.transcript_path)) : ''
 
   if (!transcript && !hook.session_id) { process.stderr.write('cortex: empty session, skipping\n'); return }
 

package/lib/edge_extract.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'child_process'
 // both session people AND the entity catalogue down; extracting here keeps the engine on `claude -p`
 // (the standing preference) and removes that dependency. Node-native (no bun) to match capture.mjs.
 //
-// edgeSafeEnv() strips EVERY ANTHROPIC_* var + CLAUDE_CODE_OAUTH_TOKEN before spawning, so the call
+// edgeSafeEnv() strips EVERY ANTHROPIC_* var (but KEEPS CLAUDE_CODE_OAUTH_TOKEN — the headless
 // runs on the file-based subscription login and a stray ANTHROPIC_BASE_URL (e.g. a keytunnel proxy)
 // can't reroute "free, local" inference through a billed proxy or ship raw text off-machine. The
 // spawn also sets CORTEX_SUMMARIZING=1 so the headless session's own Stop hook no-ops (runCapture
@@ -21,7 +21,12 @@ export function edgeSafeEnv(base = process.env, extra = {}) {
   const env = {}
   for (const [k, v] of Object.entries(base)) {
     if (v === undefined) continue
-    if (k.startsWith('ANTHROPIC_') || k === 'CLAUDE_CODE_OAUTH_TOKEN') continue
+    // Strip billed/proxy routing only (ANTHROPIC_API_KEY metered, ANTHROPIC_BASE_URL keytunnel,
+    // ANTHROPIC_AUTH_TOKEN/CUSTOM_HEADERS proxy) so edge inference runs on the SUBSCRIPTION, never a
+    // metered/proxy path. KEEP CLAUDE_CODE_OAUTH_TOKEN — it IS the headless subscription credential
+    // (from `claude setup-token`); stripping it leaves `claude --print` with no usable auth → 401.
+    // (The earlier "subscription is file-based" assumption was wrong on macOS — headless needs this token.)
+    if (k.startsWith('ANTHROPIC_')) continue
     env[k] = v
   }
   return { ...env, ...extra }

package/lib/redact.mjs

@@ -0,0 +1,32 @@
+// redact.mjs — strip high-confidence credential patterns from text BEFORE it leaves
+// the machine (capture POSTs a transcript tail to the org). A leaked secret in a
+// transcript — a user pastes an API key, a tool reads a config file holding one, or
+// (the 2026-06-22 finding) a login token sits inlined in a hook command — must never
+// be transmitted or stored. Conservative by design: targets known secret SHAPES so it
+// won't mangle ordinary prose or record/UUID ids. Mirrored server-side in
+// web/lib/engine/redact.ts — keep the two pattern lists in sync.
+
+// [pattern, replacement]. Order matters: most specific Anthropic forms first so a
+// login token reads as [REDACTED:anthropic-oauth], not the generic key bucket.
+const PATTERNS = [
+  [/sk-ant-oat\d{2}-[A-Za-z0-9_-]{20,}/g, '[REDACTED:anthropic-oauth]'],
+  [/sk-ant-api\d{2}-[A-Za-z0-9_-]{20,}/g, '[REDACTED:anthropic-key]'],
+  [/sk-ant-[A-Za-z0-9_-]{20,}/g, '[REDACTED:anthropic]'],
+  [/sk-proj-[A-Za-z0-9_-]{20,}/g, '[REDACTED:openai]'],
+  [/sk-[A-Za-z0-9]{32,}/g, '[REDACTED:openai]'],
+  [/gh[pousr]_[A-Za-z0-9]{36,}/g, '[REDACTED:github]'],
+  [/github_pat_[A-Za-z0-9_]{22,}/g, '[REDACTED:github-pat]'],
+  [/AKIA[0-9A-Z]{16}/g, '[REDACTED:aws-akid]'],
+  [/AIza[0-9A-Za-z_-]{35}/g, '[REDACTED:google]'],
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, '[REDACTED:slack]'],
+  [/eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, '[REDACTED:jwt]'],
+  [/(Bearer\s+)[A-Za-z0-9._-]{20,}/g, '$1[REDACTED]'],
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, '[REDACTED:private-key]'],
+]
+
+export function redactSecrets(text) {
+  if (!text || typeof text !== 'string') return text
+  let out = text
+  for (const [re, repl] of PATTERNS) out = out.replace(re, repl)
+  return out
+}

package/lib/redact.test.mjs

@@ -0,0 +1,55 @@
+import { test, expect } from 'bun:test'
+import { redactSecrets } from './redact.mjs'
+
+// The 2026-06-22 finding: a Claude Code login token (sk-ant-oat01-…) was sitting inlined
+// in a Stop-hook command and could ride a transcript tail to the org. Capture must never
+// transmit a credential. These assert known secret shapes are stripped — and that ordinary
+// prose / record UUIDs are left intact (no false positives that would mangle real content).
+
+test('redacts an Anthropic OAuth (Claude Code login) token', () => {
+  const s = 'CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-oyo53qZ8m_WSrYZU8rrpWrxmgtbO1T8hSOhhpicMqeZ4Ixtwzbj0qwb in the hook'
+  const out = redactSecrets(s)
+  expect(out).not.toContain('sk-ant-oat01-oyo53qZ8m')
+  expect(out).toContain('[REDACTED:anthropic-oauth]')
+})
+
+test('redacts a range of credential shapes', () => {
+  const cases = [
+    ['sk-ant-api03-' + 'a'.repeat(40), 'anthropic-key'],
+    ['sk-proj-' + 'b'.repeat(40), 'openai'],
+    ['sk-' + 'c'.repeat(40), 'openai'],
+    ['ghp_' + 'd'.repeat(36), 'github'],
+    ['github_pat_' + 'e'.repeat(30), 'github-pat'],
+    ['AKIA' + 'ABCDEFGHIJKLMNOP', 'aws-akid'],
+    ['AIza' + 'f'.repeat(35), 'google'],
+    ['xoxb-' + '1234567890-abcdef', 'slack'],
+    ['eyJ' + 'a'.repeat(20) + '.' + 'b'.repeat(20) + '.' + 'c'.repeat(20), 'jwt'],
+  ]
+  for (const [secret, tag] of cases) {
+    const out = redactSecrets(`token: ${secret} end`)
+    expect(out).toContain(`[REDACTED:${tag}]`)
+    expect(out).not.toContain(secret)
+  }
+})
+
+test('redacts a Bearer token but keeps the scheme', () => {
+  const out = redactSecrets('Authorization: Bearer abcdef0123456789ABCDEFxyz')
+  expect(out).toBe('Authorization: Bearer [REDACTED]')
+})
+
+test('redacts a PEM private key block', () => {
+  const out = redactSecrets('-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n-----END RSA PRIVATE KEY-----')
+  expect(out).toContain('[REDACTED:private-key]')
+  expect(out).not.toContain('MIIE')
+})
+
+test('leaves ordinary prose and record UUIDs untouched', () => {
+  const prose = 'Fixed the ingest latency; record 5203eacd-321b-43f7-bae2-4d6e7cae96ab landed in ~0.3s.'
+  expect(redactSecrets(prose)).toBe(prose)
+})
+
+test('handles empty / non-string input safely', () => {
+  expect(redactSecrets('')).toBe('')
+  expect(redactSecrets(null)).toBe(null)
+  expect(redactSecrets(undefined)).toBe(undefined)
+})

package/lib/relationships.mjs

@@ -0,0 +1,133 @@
+import { spawnSync } from 'child_process'
+import { fetchCortex, resolveBase, classify } from './diagnose.mjs'
+import { edgeSafeEnv } from './edge_extract.mjs'
+
+// `cortex-mcp relationships` — the JUDGE half of Tier-3 relationship inference (relationship layer slice 3,
+// sibling of `resolve`). The server FLAGS nodes worth judging (GET /api/relationship-candidates) with their
+// accessible evidence + already-known connections; this command reads that evidence LOCALLY via `claude -p`
+// (the engine preference — the server never calls the metered API) and infers prose-implied relationships,
+// then pushes them back (POST /api/relationship-apply) where high/medium-confidence ones become [[links]] on
+// the node's page. Conservative by construction: structural/known links are excluded from the prompt, only
+// relationships actually stated in the evidence are returned, and low confidence is dropped server-side.
+
+// Relationship taxonomy (spec §2) — the judge must pick from this enum (business only; no romantic/family).
+const REL_TYPES = [
+  'reports_to', 'manages', 'member_of', 'employed_by', 'works_on', 'works_with', 'owns', 'depends_on',
+  'produces', 'customer_of', 'vendor_to', 'partner_of', 'invested_in', 'governs', 'about', 'cites', 'supersedes',
+]
+
+export async function runRelationships() {
+  // recursion guard (we spawn `claude --print`; if its Stop hook fires capture, that no-ops on this flag)
+  if (process.env.CORTEX_SUMMARIZING) { process.stderr.write('cortex: summarizer subprocess, skipping\n'); return }
+  const token = process.env.CORTEX_TOKEN
+  if (!token) { process.stderr.write('cortex: CORTEX_TOKEN not set, skipping\n'); return }
+  const base = resolveBase(process.env.CORTEX_URL)
+
+  // 1. pull the flagged candidate nodes (each with evidence + known connections)
+  let candidates = []
+  try {
+    const res = await fetchCortex(`${base}/api/relationship-candidates`, { headers: { Authorization: `Bearer ${token}` } })
+    if (!res.ok) {
+      const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+      process.stderr.write(`cortex: relationship-candidates failed — ${d.message}\n`); return
+    }
+    const j = await res.json().catch(() => ({}))
+    candidates = Array.isArray(j.candidates) ? j.candidates : []
+  } catch (e) { process.stderr.write(`cortex: relationships fetch failed — ${e.message}\n`); return }
+
+  if (!candidates.length) { process.stderr.write('cortex: no nodes to judge for relationships\n'); return }
+  process.stderr.write(`cortex: inferring relationships for ${candidates.length} node(s) locally…\n`)
+
+  // 2. judge locally on the subscription — ONE call per node (evidence is per-node, bounded)
+  const relationships = []
+  let judged = 0
+  for (const c of candidates) {
+    const inferred = judgeNode(c)
+    if (inferred === null) { process.stderr.write('cortex: judge unavailable (is `claude` on PATH?) — skipping\n'); break }
+    judged++
+    for (const r of inferred) relationships.push(r)
+  }
+  if (!judged) return
+  if (!relationships.length) { process.stderr.write(`cortex: judged ${judged} node(s), no new relationships inferred\n`); return }
+
+  // 3. apply the judged relationships
+  try {
+    const res = await fetchCortex(`${base}/api/relationship-apply`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ relationships }),
+    })
+    if (res.ok) {
+      const j = await res.json().catch(() => ({}))
+      process.stderr.write(`cortex: relationships — wrote ${j.relationships ?? 0} across ${j.subjects ?? 0} node(s), skipped ${j.skipped ?? 0}\n`)
+    } else {
+      const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+      process.stderr.write(`cortex: relationship-apply failed — ${d.message}\n`)
+    }
+  } catch (e) { process.stderr.write(`cortex: relationship-apply failed — ${e.message}\n`) }
+}
+
+// ONE `claude --print` call infers a node's prose-implied relationships from its evidence. Returns
+// InferredRelationship[] (subjectId/subjectName carried from the candidate), or null if the CLI is
+// unavailable. Conservative: already-known connections are listed as "do NOT re-assert"; only relationships
+// the evidence actually states are returned; the model self-scores confidence and the server drops < 0.5.
+function judgeNode(c) {
+  if (!c || typeof c.nodeId !== 'string' || typeof c.nodeName !== 'string') return []
+  const evidence = (Array.isArray(c.evidence) ? c.evidence : [])
+    .slice(0, 30)
+    .map((e, i) => `[${i}] ${e?.title ?? ''}${e?.summary ? ` — ${String(e.summary).slice(0, 280)}` : ''}`)
+    .join('\n')
+  if (!evidence.trim()) return []
+  const known = (Array.isArray(c.knownConnections) ? c.knownConnections : []).filter(Boolean).join(', ') || '(none)'
+  const prompt =
+    `You are mapping business relationships for ONE person in an organization knowledge graph: "${c.nodeName}".\n` +
+    `Below is evidence (record titles + summaries) that mentions them. Identify relationships of "${c.nodeName}" ` +
+    `that are EXPLICITLY stated or strongly implied by THIS evidence — to other people, teams, projects, ` +
+    `systems, or organizations.\n\n` +
+    `Rules:\n` +
+    `- Use ONLY these relationship types: ${REL_TYPES.join(', ')}.\n` +
+    `- Be CONSERVATIVE: only assert a relationship the evidence actually supports. When unsure, omit it.\n` +
+    `- Do NOT re-assert these already-known connections: ${known}.\n` +
+    `- "target" is the OTHER endpoint's name exactly as written. Never invent names, numbers, or titles.\n` +
+    `- Business relationships only (no romantic/family).\n` +
+    `Return ONLY a minified JSON array — one object per relationship: ` +
+    `{"rel_type":"<one of the enum>","target":"<name>","confidence":<0..1>,"evidence":"<short quote>"}.\n` +
+    `If the evidence supports no clear relationship, return [].\n\n` +
+    `EVIDENCE:\n${evidence}`
+  try {
+    const r = spawnSync(
+      'claude',
+      ['--print', '--model', process.env.CORTEX_SUMMARY_MODEL ?? 'claude-haiku-4-5', prompt],
+      { env: edgeSafeEnv(process.env, { CORTEX_SUMMARIZING: '1' }), encoding: 'utf8', timeout: 120_000, maxBuffer: 4 * 1024 * 1024 },
+    )
+    if (r.status !== 0 || !r.stdout) return null
+    return parseInferred(r.stdout, c)
+  } catch {
+    return null
+  }
+}
+
+function parseInferred(out, c) {
+  const start = out.indexOf('[')
+  const end = out.lastIndexOf(']')
+  if (start < 0 || end <= start) return []
+  let arr
+  try { arr = JSON.parse(out.slice(start, end + 1)) } catch { return [] }
+  if (!Array.isArray(arr)) return []
+  const valid = new Set(REL_TYPES)
+  const out2 = []
+  for (const d of arr) {
+    const relType = typeof d?.rel_type === 'string' ? d.rel_type.trim() : ''
+    const target = typeof d?.target === 'string' ? d.target.trim() : ''
+    if (!valid.has(relType) || !target) continue
+    out2.push({
+      subjectId: c.nodeId,
+      subjectName: c.nodeName,
+      relType,
+      target,
+      confidence: Number(d.confidence) || 0,
+      evidence: typeof d.evidence === 'string' ? d.evidence.slice(0, 240) : undefined,
+    })
+  }
+  return out2
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {