@theronap/cortex-mcp 0.9.31 → 0.9.33

package/lib/capture.mjs

@@ -2,7 +2,7 @@ import { readFileSync } from 'fs'
 import { homedir } from 'os'
 import { resolve } from 'path'
 import { createHash } from 'crypto'
-import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
+import { fetchCortex, classify, resolveBase, readWiredToken } from './diagnose.mjs'
 import { extractSession } from './edge_extract.mjs'
 import { extractTyped } from './extract_typed.mjs'
 import { redactSecrets } from './redact.mjs'
@@ -86,8 +86,10 @@ export async function runCapture() {
   // would recurse (and re-ingest the summarizer's prompt as a phantom session). Bail immediately.
   if (process.env.CORTEX_SUMMARIZING) { process.stderr.write('cortex: summarizer subprocess, skipping\n'); return }
 
-  const token = process.env.CORTEX_TOKEN
-  if (!token) { process.stderr.write('cortex: CORTEX_TOKEN not set, skipping\n'); return }
+  // Env first (explicit override / legacy inlined hooks), else the token wired into this machine's
+  // MCP config — so hook commands carry no secret (token-hygiene, 2026-07-02).
+  const token = process.env.CORTEX_TOKEN || readWiredToken()
+  if (!token) { process.stderr.write('cortex: no CORTEX_TOKEN in env or wired config, skipping\n'); return }
   const base = resolveBase(process.env.CORTEX_URL)
 
   let hook = {}

package/lib/diagnose.mjs

@@ -9,9 +9,33 @@
 // 4xx/5xx means infrastructure handled the request, not Cortex auth — re-running setup or
 // regenerating the token will not help; it is usually transient and worth a retry.
 
+import { readFileSync } from 'fs'
+import { homedir } from 'os'
+import { join } from 'path'
+
 export const isUuid = (s) =>
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s ?? '')
 
+// Find the token already wired on this machine (Claude's ~/.claude.json first, then Codex's
+// config.toml). Lives HERE — the shared leaf module — so both setup/repair and the capture hook
+// use one resolver: hook commands carry NO inline token (token-hygiene, 2026-07-02 — an inlined
+// `CORTEX_TOKEN=…` in hooks.json shows the secret to anything that reads or greps the file, and
+// from there to captured transcripts); `capture` resolves the token itself from the same config
+// the MCP server already holds.
+export function readWiredToken() {
+  try {
+    const cfg = JSON.parse(readFileSync(join(homedir(), '.claude.json'), 'utf8'))
+    const t = cfg?.mcpServers?.cortex?.env?.CORTEX_TOKEN
+    if (t) return t
+  } catch { /* fall through */ }
+  try {
+    const toml = readFileSync(join(homedir(), '.codex', 'config.toml'), 'utf8')
+    const m = toml.match(/\[mcp_servers\.cortex\.env\][\s\S]*?CORTEX_TOKEN\s*=\s*"([^"]+)"/)
+    if (m) return m[1]
+  } catch { /* fall through */ }
+  return null
+}
+
 // The production alias — exempt from Vercel Deployment Protection.
 export const CANONICAL_BASE = 'https://cortex-console.vercel.app'
 

package/lib/redact.mjs

@@ -21,6 +21,14 @@ const PATTERNS = [
   [/xox[baprs]-[A-Za-z0-9-]{10,}/g, '[REDACTED:slack]'],
   [/eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, '[REDACTED:jwt]'],
   [/(Bearer\s+)[A-Za-z0-9._-]{20,}/g, '$1[REDACTED]'],
+  // Cortex's own login token wherever it appears in KEY=value / KEY: value form (hooks.json,
+  // config.toml, shell commands — the 2026-07-02 finding: a grep of hooks.json put the live token
+  // in a transcript and nothing below caught it). Specific pattern first for the accurate label.
+  [/(CORTEX_TOKEN["']?\s*[=:]\s*["']?)[0-9a-fA-F][0-9a-fA-F-]{30,}/g, '$1[REDACTED:cortex-token]'],
+  // Generic secret-shaped assignment: an UPPER_SNAKE name ending in TOKEN/SECRET/PASSWORD/
+  // API_KEY/APIKEY assigned a ≥16-char value. Conservative: the name-suffix + length floor keep
+  // ordinary prose, short placeholders, and bare UUIDs (record ids) intact.
+  [/([A-Z][A-Z0-9_]{2,}(?:TOKEN|SECRET|PASSWORD|API_KEY|APIKEY)["']?\s*[=:]\s*["']?)[A-Za-z0-9._/+-]{16,}/g, '$1[REDACTED:env]'],
   [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, '[REDACTED:private-key]'],
 ]
 

package/lib/redact.test.mjs

@@ -48,6 +48,39 @@ test('leaves ordinary prose and record UUIDs untouched', () => {
   expect(redactSecrets(prose)).toBe(prose)
 })
 
+// The 2026-07-02 finding: a grep of ~/.codex/hooks.json printed the live CORTEX_TOKEN (a bare
+// UUID — no pattern above catches those) into a transcript. The inline form is gone from hooks
+// (capture self-resolves now), but transcripts can still carry config lines from ANY tool read.
+test('redacts CORTEX_TOKEN in env-assignment and TOML/JSON forms', () => {
+  const uuid = 'ee0455d0-49bd-4141-984d-ece9311f9407'
+  const cases = [
+    `CORTEX_TOKEN=${uuid} npx -y @theronap/cortex-mcp@latest capture`,   // legacy hook command
+    `"CORTEX_TOKEN": "${uuid}"`,                                          // ~/.claude.json
+    `CORTEX_TOKEN = "${uuid}"`,                                           // config.toml
+  ]
+  for (const s of cases) {
+    const out = redactSecrets(s)
+    expect(out).toContain('[REDACTED:cortex-token]')
+    expect(out).not.toContain(uuid)
+  }
+})
+
+test('redacts generic secret-shaped env assignments', () => {
+  const out = redactSecrets('export SUPABASE_SERVICE_SECRET=abcDEF0123456789xyz && run')
+  expect(out).toBe('export SUPABASE_SERVICE_SECRET=[REDACTED:env] && run')
+  const out2 = redactSecrets('MY_API_KEY: "0123456789abcdef0123"')
+  expect(out2).toContain('[REDACTED:env]')
+})
+
+test('generic env pattern leaves short placeholders and prose intact', () => {
+  const cases = [
+    'set YOUR_TOKEN=xxx in the env',                    // short placeholder value
+    'the CORTEX_TOKEN is stored in ~/.claude.json',     // prose, no assignment value
+    'record 5203eacd-321b-43f7-bae2-4d6e7cae96ab',      // bare UUID, no key name
+  ]
+  for (const s of cases) expect(redactSecrets(s)).toBe(s)
+})
+
 test('handles empty / non-string input safely', () => {
   expect(redactSecrets('')).toBe('')
   expect(redactSecrets(null)).toBe(null)

package/lib/setup.mjs

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from 'fs'
 import { homedir } from 'os'
 import { join, dirname } from 'path'
-import { checkToken, resolveBase } from './diagnose.mjs'
+import { checkToken, resolveBase, readWiredToken } from './diagnose.mjs'
 import { installSkills } from './skills.mjs'
 
 // One-command employee onboarding. Wires both:
@@ -61,6 +61,28 @@ function ensureDir(path) {
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
 }
 
+// Merge the capture Stop hook into a Codex hooks.json object. Pure + idempotent: drops any prior
+// cortex capture entry (old token / old path / old pinned version) before appending the current one,
+// so re-running never duplicates and never leaves a stale version pinned behind a live one.
+// Mirrors the Claude Stop-hook merge in step 2 below, minus the SessionStart/PreCompact hooks Codex
+// doesn't support (confirmed: Codex's hook runtime only recognizes PreToolUse/PostToolUse/PreCompact/
+// UserPromptSubmit/Stop — no SessionStart, so status/skills-repair/snapshot-context stay Claude-only).
+export function mergeCodexHooks(existing, captureCmd) {
+  const h = existing && typeof existing === 'object' ? existing : {}
+  h.hooks = h.hooks && typeof h.hooks === 'object' ? h.hooks : {}
+  h.hooks.Stop = Array.isArray(h.hooks.Stop) ? h.hooks.Stop : []
+  for (const grp of h.hooks.Stop) {
+    if (Array.isArray(grp.hooks)) {
+      grp.hooks = grp.hooks.filter((c) => !/cortex-mcp.*capture|capture-session-cloud/.test(c.command ?? ''))
+    }
+  }
+  let grp = h.hooks.Stop.find((g) => (g.matcher ?? '') === '')
+  if (!grp) { grp = { matcher: '', hooks: [] }; h.hooks.Stop.push(grp) }
+  grp.hooks = grp.hooks ?? []
+  grp.hooks.push({ type: 'command', command: captureCmd })
+  return h
+}
+
 export async function runSetup(argv, version) {
   const token = argv[0]
   if (!token || token.startsWith('-')) {
@@ -110,7 +132,7 @@ export async function runSetup(argv, version) {
 
   // ── 1b. MCP server in Codex (~/.codex/config.toml), only if Codex is installed ──
   // Codex gets the same Cortex context tools as Claude Code. Non-fatal: a Codex hiccup must
-  // never block the primary Claude wiring. Capture/skills self-heal stay Claude-driven for now.
+  // never block the primary Claude wiring.
   const codexDir = join(home, '.codex')
   if (existsSync(codexDir)) {
     try {
@@ -122,6 +144,28 @@ export async function runSetup(argv, version) {
     } catch (e) {
       log(`  ⚠ Codex MCP wiring skipped: ${e.message} (Claude wiring unaffected)`)
     }
+
+    // ── 1c. Capture Stop hook in Codex (~/.codex/hooks.json) ──
+    // Without this, Codex sessions get context tools + skills but never capture — a silent gap
+    // (found 2026-07-02: a hand-set hook on Theron's machine was pinned to a stale 0.4.5, years
+    // behind `stable`, because nothing in setup/repair ever refreshed it). Same idempotent
+    // merge pattern as the Claude Stop hook below; non-fatal on failure.
+    try {
+      const codexHooks = join(codexDir, 'hooks.json')
+      let existingHooks
+      try { existingHooks = readJson(codexHooks) } catch { existingHooks = {} } // malformed → start fresh, don't block
+      const bak = backup(codexHooks)
+      // NO inline token (token-hygiene, 2026-07-02): `capture` resolves CORTEX_TOKEN itself via
+      // readWiredToken() from the config.toml this same setup run writes. An inlined secret in
+      // hooks.json shows up in every read/grep of the file — and from there in captured transcripts.
+      const captureCmd = `npx -y ${spec} capture`
+      ensureDir(codexHooks)
+      writeFileSync(codexHooks, JSON.stringify(mergeCodexHooks(existingHooks, captureCmd), null, 2))
+      log(`  ✓ Capture hook → ${codexHooks}${bak ? ' (backup saved)' : ''}`)
+      log('     Codex will ask you to re-approve this hook once (it hashes hooks.json for tamper-detection).')
+    } catch (e) {
+      log(`  ⚠ Codex capture hook skipped: ${e.message} (Claude wiring unaffected)`)
+    }
   }
 
   // ── 2. Capture Stop hook in ~/.claude/settings.json ──────────────────────
@@ -135,7 +179,9 @@ export async function runSetup(argv, version) {
     s.hooks = s.hooks ?? {}
     s.hooks.Stop = Array.isArray(s.hooks.Stop) ? s.hooks.Stop : []
 
-    const captureCmd = `CORTEX_TOKEN=${token} npx -y ${spec} capture`
+    // NO inline token — same hygiene as the Codex hook above; `capture` self-resolves from
+    // ~/.claude.json (which this setup run writes). The filter below drops the old inlined form.
+    const captureCmd = `npx -y ${spec} capture`
     // Remove any prior cortex capture hook (idempotent: drop old token / old path forms).
     for (const grp of s.hooks.Stop) {
       if (Array.isArray(grp.hooks)) {
@@ -235,21 +281,9 @@ export async function runSetup(argv, version) {
   log('')
 }
 
-// Find the token already wired on this machine, so `repair` can re-run setup without re-pasting it.
-// Checks Claude's config first, then Codex's config.toml.
-export function readWiredToken() {
-  try {
-    const cfg = readJson(join(homedir(), '.claude.json'))
-    const t = cfg?.mcpServers?.cortex?.env?.CORTEX_TOKEN
-    if (t) return t
-  } catch { /* fall through */ }
-  try {
-    const toml = readFileSync(join(homedir(), '.codex', 'config.toml'), 'utf8')
-    const m = toml.match(/\[mcp_servers\.cortex\.env\][\s\S]*?CORTEX_TOKEN\s*=\s*"([^"]+)"/)
-    if (m) return m[1]
-  } catch { /* fall through */ }
-  return null
-}
+// readWiredToken moved to diagnose.mjs (the shared leaf module) so `capture` can use the same
+// resolver — hook commands no longer inline the token. Re-exported for compatibility.
+export { readWiredToken }
 
 // `repair`: re-run the FULL setup at THIS version using the already-wired token. The one-command fix
 // for a machine set up with an older version (e.g. when skills were installed to the old nested path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.31",
+  "version": "0.9.33",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {