@theronap/cortex-mcp 0.9.32 → 0.9.33

package/lib/capture.mjs

@@ -2,7 +2,7 @@ import { readFileSync } from 'fs'
 import { homedir } from 'os'
 import { resolve } from 'path'
 import { createHash } from 'crypto'
-import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
+import { fetchCortex, classify, resolveBase, readWiredToken } from './diagnose.mjs'
 import { extractSession } from './edge_extract.mjs'
 import { extractTyped } from './extract_typed.mjs'
 import { redactSecrets } from './redact.mjs'
@@ -86,8 +86,10 @@ export async function runCapture() {
   // would recurse (and re-ingest the summarizer's prompt as a phantom session). Bail immediately.
   if (process.env.CORTEX_SUMMARIZING) { process.stderr.write('cortex: summarizer subprocess, skipping\n'); return }
 
-  const token = process.env.CORTEX_TOKEN
-  if (!token) { process.stderr.write('cortex: CORTEX_TOKEN not set, skipping\n'); return }
+  // Env first (explicit override / legacy inlined hooks), else the token wired into this machine's
+  // MCP config — so hook commands carry no secret (token-hygiene, 2026-07-02).
+  const token = process.env.CORTEX_TOKEN || readWiredToken()
+  if (!token) { process.stderr.write('cortex: no CORTEX_TOKEN in env or wired config, skipping\n'); return }
   const base = resolveBase(process.env.CORTEX_URL)
 
   let hook = {}

package/lib/diagnose.mjs

@@ -9,9 +9,33 @@
 // 4xx/5xx means infrastructure handled the request, not Cortex auth — re-running setup or
 // regenerating the token will not help; it is usually transient and worth a retry.
 
+import { readFileSync } from 'fs'
+import { homedir } from 'os'
+import { join } from 'path'
+
 export const isUuid = (s) =>
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s ?? '')
 
+// Find the token already wired on this machine (Claude's ~/.claude.json first, then Codex's
+// config.toml). Lives HERE — the shared leaf module — so both setup/repair and the capture hook
+// use one resolver: hook commands carry NO inline token (token-hygiene, 2026-07-02 — an inlined
+// `CORTEX_TOKEN=…` in hooks.json shows the secret to anything that reads or greps the file, and
+// from there to captured transcripts); `capture` resolves the token itself from the same config
+// the MCP server already holds.
+export function readWiredToken() {
+  try {
+    const cfg = JSON.parse(readFileSync(join(homedir(), '.claude.json'), 'utf8'))
+    const t = cfg?.mcpServers?.cortex?.env?.CORTEX_TOKEN
+    if (t) return t
+  } catch { /* fall through */ }
+  try {
+    const toml = readFileSync(join(homedir(), '.codex', 'config.toml'), 'utf8')
+    const m = toml.match(/\[mcp_servers\.cortex\.env\][\s\S]*?CORTEX_TOKEN\s*=\s*"([^"]+)"/)
+    if (m) return m[1]
+  } catch { /* fall through */ }
+  return null
+}
+
 // The production alias — exempt from Vercel Deployment Protection.
 export const CANONICAL_BASE = 'https://cortex-console.vercel.app'
 

package/lib/redact.mjs

@@ -21,6 +21,14 @@ const PATTERNS = [
   [/xox[baprs]-[A-Za-z0-9-]{10,}/g, '[REDACTED:slack]'],
   [/eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, '[REDACTED:jwt]'],
   [/(Bearer\s+)[A-Za-z0-9._-]{20,}/g, '$1[REDACTED]'],
+  // Cortex's own login token wherever it appears in KEY=value / KEY: value form (hooks.json,
+  // config.toml, shell commands — the 2026-07-02 finding: a grep of hooks.json put the live token
+  // in a transcript and nothing below caught it). Specific pattern first for the accurate label.
+  [/(CORTEX_TOKEN["']?\s*[=:]\s*["']?)[0-9a-fA-F][0-9a-fA-F-]{30,}/g, '$1[REDACTED:cortex-token]'],
+  // Generic secret-shaped assignment: an UPPER_SNAKE name ending in TOKEN/SECRET/PASSWORD/
+  // API_KEY/APIKEY assigned a ≥16-char value. Conservative: the name-suffix + length floor keep
+  // ordinary prose, short placeholders, and bare UUIDs (record ids) intact.
+  [/([A-Z][A-Z0-9_]{2,}(?:TOKEN|SECRET|PASSWORD|API_KEY|APIKEY)["']?\s*[=:]\s*["']?)[A-Za-z0-9._/+-]{16,}/g, '$1[REDACTED:env]'],
   [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, '[REDACTED:private-key]'],
 ]
 

package/lib/redact.test.mjs

@@ -48,6 +48,39 @@ test('leaves ordinary prose and record UUIDs untouched', () => {
   expect(redactSecrets(prose)).toBe(prose)
 })
 
+// The 2026-07-02 finding: a grep of ~/.codex/hooks.json printed the live CORTEX_TOKEN (a bare
+// UUID — no pattern above catches those) into a transcript. The inline form is gone from hooks
+// (capture self-resolves now), but transcripts can still carry config lines from ANY tool read.
+test('redacts CORTEX_TOKEN in env-assignment and TOML/JSON forms', () => {
+  const uuid = 'ee0455d0-49bd-4141-984d-ece9311f9407'
+  const cases = [
+    `CORTEX_TOKEN=${uuid} npx -y @theronap/cortex-mcp@latest capture`,   // legacy hook command
+    `"CORTEX_TOKEN": "${uuid}"`,                                          // ~/.claude.json
+    `CORTEX_TOKEN = "${uuid}"`,                                           // config.toml
+  ]
+  for (const s of cases) {
+    const out = redactSecrets(s)
+    expect(out).toContain('[REDACTED:cortex-token]')
+    expect(out).not.toContain(uuid)
+  }
+})
+
+test('redacts generic secret-shaped env assignments', () => {
+  const out = redactSecrets('export SUPABASE_SERVICE_SECRET=abcDEF0123456789xyz && run')
+  expect(out).toBe('export SUPABASE_SERVICE_SECRET=[REDACTED:env] && run')
+  const out2 = redactSecrets('MY_API_KEY: "0123456789abcdef0123"')
+  expect(out2).toContain('[REDACTED:env]')
+})
+
+test('generic env pattern leaves short placeholders and prose intact', () => {
+  const cases = [
+    'set YOUR_TOKEN=xxx in the env',                    // short placeholder value
+    'the CORTEX_TOKEN is stored in ~/.claude.json',     // prose, no assignment value
+    'record 5203eacd-321b-43f7-bae2-4d6e7cae96ab',      // bare UUID, no key name
+  ]
+  for (const s of cases) expect(redactSecrets(s)).toBe(s)
+})
+
 test('handles empty / non-string input safely', () => {
   expect(redactSecrets('')).toBe('')
   expect(redactSecrets(null)).toBe(null)

package/lib/setup.mjs

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from 'fs'
 import { homedir } from 'os'
 import { join, dirname } from 'path'
-import { checkToken, resolveBase } from './diagnose.mjs'
+import { checkToken, resolveBase, readWiredToken } from './diagnose.mjs'
 import { installSkills } from './skills.mjs'
 
 // One-command employee onboarding. Wires both:
@@ -155,7 +155,10 @@ export async function runSetup(argv, version) {
       let existingHooks
       try { existingHooks = readJson(codexHooks) } catch { existingHooks = {} } // malformed → start fresh, don't block
       const bak = backup(codexHooks)
-      const captureCmd = `CORTEX_TOKEN=${token} npx -y ${spec} capture`
+      // NO inline token (token-hygiene, 2026-07-02): `capture` resolves CORTEX_TOKEN itself via
+      // readWiredToken() from the config.toml this same setup run writes. An inlined secret in
+      // hooks.json shows up in every read/grep of the file — and from there in captured transcripts.
+      const captureCmd = `npx -y ${spec} capture`
       ensureDir(codexHooks)
       writeFileSync(codexHooks, JSON.stringify(mergeCodexHooks(existingHooks, captureCmd), null, 2))
       log(`  ✓ Capture hook → ${codexHooks}${bak ? ' (backup saved)' : ''}`)
@@ -176,7 +179,9 @@ export async function runSetup(argv, version) {
     s.hooks = s.hooks ?? {}
     s.hooks.Stop = Array.isArray(s.hooks.Stop) ? s.hooks.Stop : []
 
-    const captureCmd = `CORTEX_TOKEN=${token} npx -y ${spec} capture`
+    // NO inline token — same hygiene as the Codex hook above; `capture` self-resolves from
+    // ~/.claude.json (which this setup run writes). The filter below drops the old inlined form.
+    const captureCmd = `npx -y ${spec} capture`
     // Remove any prior cortex capture hook (idempotent: drop old token / old path forms).
     for (const grp of s.hooks.Stop) {
       if (Array.isArray(grp.hooks)) {
@@ -276,21 +281,9 @@ export async function runSetup(argv, version) {
   log('')
 }
 
-// Find the token already wired on this machine, so `repair` can re-run setup without re-pasting it.
-// Checks Claude's config first, then Codex's config.toml.
-export function readWiredToken() {
-  try {
-    const cfg = readJson(join(homedir(), '.claude.json'))
-    const t = cfg?.mcpServers?.cortex?.env?.CORTEX_TOKEN
-    if (t) return t
-  } catch { /* fall through */ }
-  try {
-    const toml = readFileSync(join(homedir(), '.codex', 'config.toml'), 'utf8')
-    const m = toml.match(/\[mcp_servers\.cortex\.env\][\s\S]*?CORTEX_TOKEN\s*=\s*"([^"]+)"/)
-    if (m) return m[1]
-  } catch { /* fall through */ }
-  return null
-}
+// readWiredToken moved to diagnose.mjs (the shared leaf module) so `capture` can use the same
+// resolver — hook commands no longer inline the token. Re-exported for compatibility.
+export { readWiredToken }
 
 // `repair`: re-run the FULL setup at THIS version using the already-wired token. The one-command fix
 // for a machine set up with an older version (e.g. when skills were installed to the old nested path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.32",
+  "version": "0.9.33",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {