@theronap/cortex-mcp 0.9.73 → 0.9.74

package/lib/skills.mjs

@@ -160,16 +160,37 @@ export function installSkills(opts = {}) {
   return summary
 }
 
-// Decide what to install from a served org-skill list: drop invalid names and bundled collisions
-// (bundled wins — core skills are inalterable). Pure, so it's unit-testable without a network.
+// Decide what to install from a served org-skill list: drop invalid names, bundled collisions
+// (bundled wins — core skills are inalterable) and cross-brain collisions. Pure, so it's
+// unit-testable without a network.
 export function planOrgInstall(served, bundledNames) {
   const bundled = new Set(bundledNames)
   const install = []
   const skipped = []
+
+  // /api/skills now fans out across EVERY brain the caller belongs to (ADR-0022 acrossMyBrains), so
+  // for the first time two brains can serve the SAME skill name. Installing both would write one
+  // file twice and silently leave whichever landed last — an executable body from a brain the user
+  // never chose. There is no principled winner, so a cross-brain collision installs NEITHER and says
+  // so, matching how a bundled collision already resolves: when in doubt, do not install.
+  const byName = new Map()
+  for (const s of served ?? []) {
+    const n = (s?.name ?? '').trim()
+    if (!byName.has(n)) byName.set(n, [])
+    byName.get(n).push(s)
+  }
+
   for (const s of served ?? []) {
     const name = (s?.name ?? '').trim()
     if (!NAME_RE.test(name) || typeof s?.body_md !== 'string' || !s.body_md.trim()) { skipped.push({ name: name || '(unnamed)', why: 'invalid' }); continue }
     if (bundled.has(name)) { skipped.push({ name, why: 'collides with a bundled core skill' }); continue }
+    const dupes = byName.get(name) ?? []
+    if (dupes.length > 1) {
+      // Name the brains so the owner knows which to rename. `brain` is the tag acrossMyBrains adds.
+      const brains = [...new Set(dupes.map((d) => d?.brain).filter(Boolean))]
+      skipped.push({ name, why: `published by ${dupes.length} brains (${brains.join(', ') || 'unknown'}) — rename one; installing neither` })
+      continue
+    }
     install.push({ name, source: s.body_md })
   }
   return { install, skipped }
@@ -201,6 +222,13 @@ export async function syncOrgSkills(opts = {}) {
     if (res.ok) {
       served = (await res.json())?.skills ?? []
       summary.source = 'server'
+    } else {
+      // ⚠ DO NOT MAKE THIS SILENT AGAIN. `if (res.ok)` alone is how a 100% failure hid for weeks:
+      // /api/skills answered 409 to every multi-brain caller, this fell through to the cache below,
+      // and the only log line ('unreachable and no cache') does NOT print when a cache exists. So
+      // org skills silently stopped updating and nothing anywhere said so. Fail-soft is right —
+      // SessionStart must not break — but fail-soft is not fail-quiet.
+      log(`  · org skills: server said ${res.status} — using last-good cache. Run \`doctor\` if this persists.`)
     }
   } catch { /* fall through to cache */ }
   if (!served && Array.isArray(cache?.skills)) { served = cache.skills; summary.source = 'cache' }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.73",
+  "version": "0.9.74",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {