@theronap/cortex-mcp 0.9.51 → 0.9.53

package/lib/diagnose.mjs

@@ -36,6 +36,26 @@ export function readWiredToken() {
   return null
 }
 
+// Pure: pull the cortex-mcp dist-tag / version out of a wired command line. Exported for tests.
+// Returns 'latest' | 'stable' | a version string (e.g. '0.9.4') | null (no cortex-mcp spec present).
+export function parseDistTag(line) {
+  const m = String(line || '').match(/@theronap\/cortex-mcp@(latest|stable|[0-9][^\s"']*)/)
+  return m ? m[1] : null
+}
+
+// Read the dist-tag / version this machine is currently wired to (from the ~/.claude.json cortex MCP
+// command), so a re-run of setup/repair can PRESERVE an intentional channel instead of forcing @stable
+// every time — that silently knocks a dogfooder on @latest back to the pilot channel (bit Theron
+// 2026-07-24). Returns 'latest' | 'stable' | a version string | null (nothing wired yet).
+export function wiredDistTag() {
+  try {
+    const cfg = JSON.parse(readFileSync(join(homedir(), '.claude.json'), 'utf8'))
+    const c = cfg?.mcpServers?.cortex
+    return parseDistTag([c?.command, ...(c?.args ?? [])].filter(Boolean).join(' '))
+  } catch { /* fall through */ }
+  return null
+}
+
 // The production alias — exempt from Vercel Deployment Protection.
 export const CANONICAL_BASE = 'https://cortex-console.vercel.app'
 

package/lib/install.mjs

@@ -7,7 +7,7 @@ import { homedir } from 'node:os'
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import { ADAPTERS, resolveEditors } from './editors/index.mjs'
-import { checkToken, resolveBase, readWiredToken } from './diagnose.mjs'
+import { checkToken, resolveBase, readWiredToken, wiredDistTag } from './diagnose.mjs'
 
 const PKG = '@theronap/cortex-mcp'
 export const MANIFEST_PATH = join(homedir(), '.cortex', 'editors.json')
@@ -68,7 +68,9 @@ export function writeManifest(manifest, { path = MANIFEST_PATH } = {}) {
 export async function runInstall(argv, version) {
   const { token: argToken, editor } = parseInstallArgs(argv)
   const token = argToken || readWiredToken()
-  const spec = `${PKG}@stable`
+  // Preserve an intentional @latest (dogfood) pin across re-runs; fresh installs + existing @stable
+  // get @stable. See wiredDistTag — forcing @stable here silently demoted a dogfooder (2026-07-24).
+  const spec = wiredDistTag() === 'latest' ? `${PKG}@latest` : `${PKG}@stable`
   const home = homedir()
   const log = (m) => process.stdout.write(m + '\n')
 

package/lib/server.mjs

@@ -6,6 +6,7 @@ import { homedir } from 'os'
 import { join } from 'path'
 import { createHash, randomUUID } from 'crypto'
 import { fetchCortex, classify, resolveBase, setSessionKey } from './diagnose.mjs'
+import { resolveSessionKey } from './session_key.mjs'
 import { runSendImessage } from './imessage_send.mjs'
 import { formatGrepHits } from './grep_cli.mjs'
 import { renderTriage } from './red_link_triage.mjs'
@@ -42,7 +43,18 @@ export async function runServer(version) {
   // Self active-sessions (ADR-0017): one MCP process = one AI session. A stable per-process key + the
   // working dir identify this session; we heartbeat /api/session-ping while alive so the user can see
   // all THEIR sessions via my_sessions. Self-only on the server; best-effort (never breaks serving).
-  const SESSION_KEY = randomUUID()
+  //
+  // PGL-21 fix: "one MCP process = one AI session" is an assumption, not a guarantee — the HOST
+  // (Claude Code) can restart this stdio process mid-conversation (reconnects, tool-loading events),
+  // and a fresh randomUUID() on every restart silently orphaned the PRIOR process's session-scoped
+  // write-pointer row (session_write_pointers): an explicit set_active_brain(scope:'session') would
+  // stop taking effect one restart later, falling back to the account pointer with no visible cause
+  // — reproduced live 2026-07-27. Claude Code sets CLAUDE_CODE_SESSION_ID for the lifetime of one
+  // logical conversation across any number of subprocess restarts, so prefer it as the session key;
+  // fall back to a fresh randomUUID() for any other MCP host that doesn't set it (unchanged behavior
+  // there — no host that never had continuity loses anything). Bonus: my_sessions / session_presence
+  // (also keyed on SESSION_KEY, ADR-0017) stop fragmenting one conversation into several "sessions" too.
+  const SESSION_KEY = resolveSessionKey(process.env, randomUUID)
   // ADR-0020 Stage 2: stamp this key on every outbound request (fetchCortex injects it) so writes
   // resolve THIS session's brain pointer. Must be set BEFORE the first fetchCortex call below —
   // otherwise the opening requests of a session would silently resolve by the account pointer.
@@ -498,7 +510,7 @@ export async function runServer(version) {
           const head = `[${t.tier}${day(t.updated_at) ? ` · authored ${day(t.updated_at)}` : ''}${t.validity && t.validity !== 'current' ? ` · ${t.validity}` : ''}${versionLine}]`
           return [head, t.summary, secs].filter(Boolean).join('\n')
         })
-        let footer = `— Follow any [[links]] above with read_page to go deeper.\n— If you hold fresher FIRST-HAND truth than this page — something you established THIS session (ran the command, made the change, hold the artifact) that a section here gets concretely wrong — re-author just those sections now with \`author\` (any node you are permitted to edit; concise; a material contradiction, not merely extra detail). Pass this page's \`version\` as base_version when you re-author — if the save comes back stale, the page changed under you: re-read, then re-author. Reading a stale page you can fix IS the trigger to fix it. Re-authoring is pre-authorized — do NOT ask the user before updating (edits are versioned + reversible via page_history/rollback_page); update, then briefly report it.`
+        let footer = `— Follow any [[links]] above with read_page to go deeper.\n— If you hold fresher FIRST-HAND truth than this page — something you established THIS session (ran the command, made the change, hold the artifact) that a section here gets concretely wrong — re-author just those sections now with \`author\` (any node you are permitted to edit; concise; a material contradiction, not merely extra detail). Pass this page's \`version\` as base_version when you re-author — if the save comes back stale, the page changed under you: re-read, then re-author. Reading a stale page you can fix IS the trigger to fix it. Re-authoring is pre-authorized — do NOT ask the user before updating (edits are versioned + reversible via page_history/rollback_page); update, then briefly report it.\n— Citing code? Use a SYMBOL and file (\`formConnections\` in \`web/app/api/ingest/route.ts\`), never a line number — line numbers drift with every commit above them. And cite only what you opened THIS session; re-emitting a reference you read on another page is how a stale claim gains a second source and starts looking corroborated.`
         // slice 4: when the page carries identifier stamps, the history projection is one flag away.
         const allBody = m.tiers.flatMap((t) => (t.sections ?? []).map((s) => s.body)).join('\n')
         const stamps = [...new Set((allBody.match(/\[\[repo:[a-z0-9][a-z0-9-]*\/[a-z0-9_.-]+\]\]/gi) ?? []).map((s) => s.toLowerCase()))]
@@ -808,6 +820,38 @@ export async function runServer(version) {
     },
   )
 
+  server.registerTool(
+    'my_day',
+    {
+      title: 'My daily log (chronological)',
+      description: "Your OWN activity for a day, composed chronologically from that day's records of every kind — sessions, meetings, comms, docs, notes. The \"what did I do today\" rollup: a derived view over records (nothing new is stored), self-scoped to you, each item tagged with its kind. Defaults to today in your local timezone. Pass `date` (YYYY-MM-DD) for another day, or `days` for a trailing window (e.g. days:7 for the week). Confidential records are segregated into their own block.",
+      inputSchema: {
+        date: z.string().optional().describe('the day to roll up, YYYY-MM-DD (default: today in your local timezone)'),
+        days: z.number().optional().describe('trailing window ending on `date` — e.g. 7 for the past week (default 1, max 31)'),
+      },
+    },
+    async ({ date, days }) => {
+      // Resolve the caller's local timezone + today client-side (the MCP server runs on the user's
+      // machine) so the day boundary matches their wall clock, not the server's UTC.
+      const tz = Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC'
+      const today = new Date().toLocaleDateString('en-CA', { timeZone: tz }) // en-CA → YYYY-MM-DD
+      const qs = new URLSearchParams({ date: date || today, tz })
+      if (days != null) qs.set('days', String(days))
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/records/daily?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not build daily log: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not build daily log: ${d.message}` }] }
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
   server.registerTool(
     'my_sessions',
     {

package/lib/session_key.mjs

@@ -0,0 +1,13 @@
+// PGL-21: derive the AI session's stable identity key. Pure — see session_key.test.mjs.
+//
+// Claude Code sets CLAUDE_CODE_SESSION_ID for the lifetime of one logical conversation, surviving
+// any number of MCP subprocess restarts (reconnects, tool-loading events) within it. Prefer it so a
+// session-scoped set_active_brain (ADR-0020 Stage 2) keeps pointing at the right brain across a
+// restart instead of silently falling back to the account pointer on a brand-new randomUUID() —
+// reproduced live 2026-07-27: an explicit set_active_brain(scope:'session') stopped taking effect
+// one restart later, with no visible cause, because the new process minted an unrelated session key
+// with no session_write_pointers row of its own. Any other MCP host that doesn't set the var gets
+// today's unchanged per-process-random behavior.
+export function resolveSessionKey(env, randomUUID) {
+  return env.CLAUDE_CODE_SESSION_ID || randomUUID()
+}

package/lib/setup.mjs

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from 'fs'
 import { homedir } from 'os'
 import { join, dirname } from 'path'
-import { checkToken, resolveBase, readWiredToken } from './diagnose.mjs'
+import { checkToken, resolveBase, readWiredToken, wiredDistTag } from './diagnose.mjs'
 import { installSkills } from './skills.mjs'
 // Pure config-merge functions live in the editor adapters; setup imports (and re-exports) THE SAME
 // functions the `cortex install` path uses, so both write byte-identical config.
@@ -48,12 +48,14 @@ export async function runSetup(argv, version) {
     )
     process.exit(1)
   }
-  // Wire the moving `stable` dist-tag — NOT a frozen version. A bare spec lets npx reuse a stale
-  // cached build; a frozen `@x.y.z` freezes the machine on that version forever (the 0.9.5→0.9.6
-  // freeze that stranded a pilot install). A tag is re-resolved by npx against the registry, so
-  // machines pick up promoted releases on next launch without re-running setup. Promote a
-  // validated build with:  npm dist-tag add @theronap/cortex-mcp@<version> stable
-  const spec = `${PKG}@stable`
+  // Wire a moving dist-tag — NOT a frozen version. A bare spec lets npx reuse a stale cached build; a
+  // frozen `@x.y.z` freezes the machine on that version forever (the 0.9.5→0.9.6 freeze that stranded a
+  // pilot install). A tag is re-resolved by npx against the registry, so machines pick up promoted
+  // releases on next launch without re-running setup. Promote a validated build with:
+  //   npm dist-tag add @theronap/cortex-mcp@<version> stable
+  // PRESERVE an intentional @latest (dogfood) pin across re-runs (repair/setup) — otherwise this
+  // silently knocks a dogfooder back to @stable. Fresh installs and existing @stable get @stable.
+  const spec = wiredDistTag() === 'latest' ? `${PKG}@latest` : `${PKG}@stable`
   const base = resolveBase(process.env.CORTEX_URL)
   const home = homedir()
   const claudeJson = join(home, '.claude.json')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.51",
+  "version": "0.9.53",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {

package/skills/log/SKILL.md

@@ -52,6 +52,28 @@ No arguments. Read the conversation context.
    docs are pending, follow the `cortex-author-docs` skill (author each into its page, then
    `docs-scan --mark`). Specs/plans written to disk this session must not die on disk — a spec IS
    a page. If no roots are registered or nothing is pending, skip silently.
+7. **Reconcile & verify (prove the sweep — don't trust it).** Step 5 relies on your in-the-moment
+   judgment of "what advanced"; this step closes the loop so nothing is silently missed and no stale
+   write slips through. Before printing the Output:
+   a. **Enumerate what you touched** — from the transcript, list the concrete entities this session
+      advanced: the project(s), notable files/artifacts, and the people you coordinated with. Derive
+      this checklist from what actually *happened*, not from what you remember authoring — the whole
+      point is to catch the node you forgot.
+   b. **Assert one outcome per entity** — every item gets exactly `authored [[Page]]` **or**
+      `skipped — <reason>` (e.g. "no material change", "not a node", "already current"). Nothing may be
+      left unaccounted for. If an entity that genuinely advanced has neither, `author` it now (Step 5).
+   c. **Verify the writes landed and are right** — for each page you claim you authored, `read_page` it
+      (or check `page_history`) and confirm both: (i) **the change applied** — an `author` that returned
+      "no change" when you *intended* an update means it did NOT land (stale `base_version`, wrong
+      brain/namespace, or nothing actually differed) — re-check rather than assume; and (ii) **the page
+      reflects THIS session's first-hand findings**, not a prior you copied forward. This is the
+      read-after-write half of the read-before-write rule — the guard against laundering stale priors
+      into the wiki. Fix a page you can edit; `set_page_validity` on one you can't. (Cross-brain note:
+      `read_page` can resolve a page in another brain that `author` won't write — if a "verify" read
+      looks right but your write reported no-op, run `my_brains` / check `authoring_context` before
+      trusting the read.)
+   Carry the tally into the Output. If any intended write did not land, say so — never report a clean
+   sweep you didn't confirm.
 
 ## Output
 
@@ -66,6 +88,7 @@ After calling `log_session`, show a short structured summary:
 **Coordinated with:** people involved
 **Logged:** ✅ persisted as the session's record (authoritative)  (or ⚠ log_session errored — run doctor)
 **Wiki authored:** [[Node A]], [[Node B]] — pages updated (or "— nothing advanced this session")
+**Reconciled:** N touched → M authored, K skipped (reason each); writes verified ✅ (or ⚠ <what didn't land>)
 ```
 
 ## Safety rules