@theronap/cortex-mcp 0.9.56 → 0.9.57

package/lib/capture.mjs

@@ -1,5 +1,5 @@
 import { readFileSync } from 'fs'
-import { spawn } from 'child_process'
+import { spawn, execFileSync } from 'child_process'
 import { homedir } from 'os'
 import { resolve, dirname, join } from 'path'
 import { fileURLToPath } from 'url'
@@ -37,6 +37,45 @@ export function projectFrom(cwd) {
 
 // Claude Code Stop hook → POSTs a session digest to Cortex cloud, which
 // summarizes server-side and upserts ONE record per session. Node-native
+// SHR-01/T6 — parse a git remote URL into GitHub 'owner/name', or null.
+//
+// Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
+// git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
+// 'owner/name' on gitlab.com or a self-hosted forge would collide in the identifier namespace with an
+// unrelated GitHub repo of the same name — granting its members read access to each other's sessions.
+export function githubFullName(url) {
+  if (!url) return null
+  const m = String(url).trim()
+    .match(/^(?:git\+)?(?:https?:\/\/|ssh:\/\/|git:\/\/)?(?:[^@/]+@)?github\.com[:/]+([^/]+)\/(.+?)(?:\.git)?\/?$/i)
+  if (!m) return null
+  const owner = m[1].toLowerCase()
+  const name = m[2].toLowerCase()
+  if (!owner || !name || name.includes('/')) return null
+  return `${owner}/${name}`
+}
+
+// SHR-01/T6 — the repo this session is working in, as 'owner/name', or null.
+//
+// D2, FAIL CLOSED: anything that is not unambiguously a GitHub worktree — no repo, no origin remote,
+// a non-GitHub host, git not installed — returns null, and the session is then stamped with NO
+// identifier and stays private. There is deliberately no fallback: a brain-level or hostname-level
+// identifier would be held by every member of the org, so overlap would ALWAYS succeed. That is an
+// accidental org-wide grant, i.e. the default-tier flip that was explicitly declined.
+//
+// `git config --get` is local and does no network I/O. Bounded and swallowed regardless: capture must
+// never break a session, and a missing identifier is a private session, not a broken one.
+export function repoFullNameFrom(cwd) {
+  if (!cwd) return null
+  try {
+    const url = execFileSync('git', ['-C', String(cwd), 'config', '--get', 'remote.origin.url'], {
+      encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    return githubFullName(url)
+  } catch {
+    return null
+  }
+}
+
 // (no bun, no repo clone). Always exits 0 — capture must never break a session.
 
 function readStdin() {
@@ -159,6 +198,10 @@ async function captureWork(stdinRaw) {
   // summarizer (which has been the silent point of failure). Fall back to shipping the transcript
   // tail only if local extraction is unavailable (e.g. `claude` not on PATH) so we never drop a
   // session. The server re-validates people/entities — the edge is not trusted.
+  // SHR-01/T6: the repo identifier is what lets a PEER read this session (see 0096). Omitted entirely
+  // when the cwd is not a GitHub worktree — the record still lands, it just stays private (D2).
+  const repoFullName = repoFullNameFrom(hook.cwd)
+
   const common = {
     source: 'claude-code',
     project: repo,
@@ -166,6 +209,7 @@ async function captureWork(stdinRaw) {
     title: `Worked in ${repo}`,
     payload: { session_id: hook.session_id, cwd: hook.cwd },
     captureSource: 'hook', // T8: fallback writer — never clobbers a cortex-log ('skill') record
+    ...(repoFullName ? { repoFullName } : {}),
     ...(hydratedFrom.length ? { hydratedFrom } : {}),
   }
   const extracted = transcript ? extractSession(transcript) : null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.56",
+  "version": "0.9.57",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {