auxilo-mcp 0.8.1 → 0.8.2

package/bin/auxilo-cli.js

@@ -26,13 +26,25 @@ const HOME = os.homedir();
 
 // ─── Prompt helpers ─────────────────────────────────────────────────────────
 
+// LW-17: ONE shared readline interface for the whole run. Creating a fresh
+// interface per question loses any input readline already buffered when the
+// previous interface closed — with piped/scripted stdin the answer to
+// question N+1 arrives with question N's buffer and the next prompt hangs
+// on EOF (the 0.8.1 consent step silently never completed).
+let sharedRl = null;
+function getRl() {
+  if (!sharedRl) {
+    sharedRl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  }
+  return sharedRl;
+}
+function closeRl() {
+  if (sharedRl) { sharedRl.close(); sharedRl = null; }
+}
+
 function ask(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve(answer.trim());
-    });
+    getRl().question(question, (answer) => resolve(answer.trim()));
   });
 }
 
@@ -415,11 +427,21 @@ async function main() {
   }
 }
 
-if (require.main === module) {
-  main().catch((err) => {
+/** Run the CLI: used by require.main below AND by mcp-server.js delegation
+ *  (LW-17: `npx auxilo-mcp setup` — the `auxilo` bin alias is unreachable via
+ *  npx until the `auxilo` npm package name is claimed). */
+function run() {
+  main().then(() => {
+    closeRl(); // an open readline interface keeps the process alive
+  }).catch((err) => {
+    closeRl();
     console.error(`auxilo: ${err.message}`);
     process.exit(1);
   });
 }
 
-module.exports = { parseFlags, resolveBaseUrl };
+if (require.main === module) {
+  run();
+}
+
+module.exports = { parseFlags, resolveBaseUrl, run };

package/lib/installer.js

@@ -246,8 +246,11 @@ async function deviceLogin(opts = {}) {
   });
   if (!res.ok) throw new Error(`Device code request failed (HTTP ${res.status})`);
   const device = await res.json();
-  const { user_code: userCode, verification_url: verificationUrl } = device;
+  // A-1: device_code is the secret polling credential; user_code is the human
+  // code shown on the verification page only.
+  const { user_code: userCode, device_code: deviceCode, verification_url: verificationUrl } = device;
   if (!userCode) throw new Error('Device code request failed: no user_code in response');
+  if (!deviceCode) throw new Error('Device code request failed: no device_code in response');
 
   // Server returns interval in seconds (default 5 per server.js /auth/device).
   const intervalMs = (device.interval || 5) * 1000;
@@ -259,7 +262,7 @@ async function deviceLogin(opts = {}) {
     await sleep(intervalMs);
     let status;
     try {
-      const poll = await fetchImpl(`${baseUrl}/auth/device/status?code=${encodeURIComponent(userCode)}`);
+      const poll = await fetchImpl(`${baseUrl}/auth/device/status?device_code=${encodeURIComponent(deviceCode)}`);
       status = await poll.json();
     } catch {
       continue; // transient network error during poll — keep polling
@@ -338,7 +341,10 @@ LOG="${auxiloDir}/extract.log"
 # P1-13 lesson: do NOT set AUXILO_EXTRACTING here — runner.js's own recursion
 # guard would trip and silently no-op every run. The runner sets it itself
 # for child processes.
-nohup /usr/bin/env node "$RUNNER" --transcript "$transcript_path" >> "$LOG" 2>&1 &
+# LW-17: stdout goes to /dev/null — runner.js log() already appends every
+# line to extract.log itself; redirecting stdout there too double-wrote each
+# line and the daily digest double-counted. stderr still captured for crashes.
+nohup /usr/bin/env node "$RUNNER" --transcript "$transcript_path" > /dev/null 2>> "$LOG" &
 
 exit 0
 `;
@@ -385,14 +391,27 @@ function installRunner(homeDir, opts = {}) {
 
 // ─── Claude Code hook registration (spec §LW-12 step 4) ─────────────────────
 
+/** True when an inner hook object is an Auxilo extraction command. */
+function isAuxiloCommandHook(h) {
+  return h && typeof h === 'object' && typeof h.command === 'string' &&
+    h.command.includes('auxilo-extract');
+}
+
 /**
  * Patch <home>/.claude/settings.json hooks.SessionEnd[] to contain exactly one
- * Auxilo entry: <home>/.auxilo/bin/auxilo-extract.sh.
+ * Auxilo entry: <home>/.auxilo/bin/auxilo-extract.sh, in Claude Code's
+ * STRUCTURED form ({ hooks: [{ type: 'command', command }] }).
+ *
+ * LW-17: 0.8.1 appended the command as a bare string — Claude Code silently
+ * ignores string entries, so the hook NEVER fired. It also only removed
+ * legacy entries that were strings, missing the pre-LW-12 structured entry
+ * (~/.claude/hooks/auxilo-extract.sh nested inside a matcher group).
  *
- * Idempotent. Replaces any legacy string entry referencing auxilo-extract.sh
- * (e.g. the pre-LW-12 ~/.claude/hooks/auxilo-extract.sh location). Non-Auxilo
- * entries — including non-string structured entries — are preserved untouched.
- * Malformed settings.json throws (B15) — never overwritten.
+ * Idempotent. Removes every Auxilo reference (bare strings, and command
+ * objects inside matcher groups — preserving any non-Auxilo commands sharing
+ * the group), then appends one canonical structured entry. Non-Auxilo entries
+ * are preserved untouched. Malformed settings.json throws (B15) — never
+ * overwritten.
  *
  * @returns {{ changed: boolean, hookCmd: string, removedLegacy: string[] }}
  */
@@ -406,21 +425,44 @@ function registerClaudeCodeHook(homeDir) {
   if (!Array.isArray(settings.hooks.SessionEnd)) settings.hooks.SessionEnd = [];
 
   const before = settings.hooks.SessionEnd;
-  const removedLegacy = before.filter(
-    (h) => typeof h === 'string' && h.includes('auxilo-extract') && h !== hookCmd
-  );
-  const kept = before.filter(
-    (h) => !(typeof h === 'string' && h.includes('auxilo-extract'))
-  );
-
-  const alreadyExact = before.includes(hookCmd) && removedLegacy.length === 0;
+  const removedLegacy = [];
+  const kept = [];
+
+  for (const entry of before) {
+    if (typeof entry === 'string' && entry.includes('auxilo-extract')) {
+      removedLegacy.push(entry); // includes 0.8.1's dead bare-string entry
+      continue;
+    }
+    if (entry && typeof entry === 'object' && Array.isArray(entry.hooks)) {
+      const auxilo = entry.hooks.filter(isAuxiloCommandHook);
+      if (auxilo.length > 0) {
+        removedLegacy.push(...auxilo.map((h) => h.command));
+        const rest = entry.hooks.filter((h) => !isAuxiloCommandHook(h));
+        if (rest.length > 0) kept.push({ ...entry, hooks: rest });
+        continue;
+      }
+    }
+    kept.push(entry);
+  }
+
+  const canonical = { hooks: [{ type: 'command', command: hookCmd }] };
+
+  // Idempotency: unchanged iff the only Auxilo reference found was already
+  // the canonical command in a structured single-command entry.
+  const alreadyExact =
+    removedLegacy.length === 1 && removedLegacy[0] === hookCmd &&
+    before.some((e) =>
+      e && typeof e === 'object' && Array.isArray(e.hooks) &&
+      e.hooks.length === 1 && isAuxiloCommandHook(e.hooks[0]) &&
+      e.hooks[0].command === hookCmd && e.hooks[0].type === 'command'
+    );
   if (alreadyExact) {
     return { changed: false, hookCmd, removedLegacy: [] };
   }
 
-  settings.hooks.SessionEnd = [...kept, hookCmd];
+  settings.hooks.SessionEnd = [...kept, canonical];
   writeJsonAtomic(settingsPath, settings);
-  return { changed: true, hookCmd, removedLegacy };
+  return { changed: true, hookCmd, removedLegacy: removedLegacy.filter((c) => c !== hookCmd) };
 }
 
 // ─── Consent (spec §LW-12 step 5; server.js POST /extract/consent) ──────────
@@ -541,8 +583,12 @@ async function getStatus(homeDir, opts = {}) {
     const settings = JSON.parse(
       fs.readFileSync(path.join(homeDir, '.claude', 'settings.json'), 'utf-8')
     );
+    // LW-17: only STRUCTURED entries count — Claude Code silently ignores
+    // bare-string entries (the 0.8.1 dead-hook bug), so reporting one as
+    // "registered" would mask exactly the failure this status exists to catch.
     hookRegistered = Array.isArray(settings.hooks && settings.hooks.SessionEnd) &&
-      settings.hooks.SessionEnd.some((h) => typeof h === 'string' && h.includes('auxilo-extract'));
+      settings.hooks.SessionEnd.some((h) =>
+        h && typeof h === 'object' && Array.isArray(h.hooks) && h.hooks.some(isAuxiloCommandHook));
   } catch { /* no settings */ }
 
   // 5. Last extraction + pending queue (ledger conventions from scripts/runner.js)

package/lib/sensitivity-filter.js

@@ -108,7 +108,13 @@ const PATTERNS = [
   // ── P2.1a new patterns (§7.6 — 10 additions) ─────────────────────────────
   {
     name: 'email_address',
-    regex: /[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,}/gi,
+    // Linearly-bounded form (D-1 ReDoS fix). The previous
+    // /[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,}/ backtracked O(n^2) on a long run
+    // of dash/digit chars with no valid TLD, pinning the single-process event
+    // loop for minutes. Each quantifier here is explicitly bounded and the
+    // domain labels do not overlap with the dot separators, so there is no
+    // catastrophic-backtracking path.
+    regex: /[a-z0-9._%+\-]{1,64}@[a-z0-9](?:[a-z0-9\-]{0,253}[a-z0-9])?(?:\.[a-z]{2,24})+/gi,
     description: 'Email address',
   },
   {

package/mcp-server.js

@@ -16,7 +16,9 @@ let credentials = {};
 try {
     credentials = JSON.parse(fs.readFileSync(CRED_PATH, 'utf8'));
 } catch { /* no credentials file — unauthenticated mode */ }
-const AUXILO_BASE = credentials.base_url || 'https://3000-725fa3fea775ba39db5a2e3703fa4557.life.conway.tech';
+// LW-17: default was a long-dead Conway sandbox URL — fresh installs without
+// credentials.json pointed every tool call at it.
+const AUXILO_BASE = credentials.base_url || 'https://auxilo.io';
 
 function baseHeaders(extra = {}) {
     const headers = { 'Content-Type': 'application/json', ...extra };
@@ -27,7 +29,7 @@ function baseHeaders(extra = {}) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.7.0' },
+  { name: 'auxilo', version: '0.8.2' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.
@@ -542,9 +544,18 @@ function text(obj) {
   return { content: [{ type: 'text', text: JSON.stringify(obj, null, 2) }] };
 }
 
-// ─── CLI: setup command (Change 4) ─────────────────────────────────────────────
-// LW-12: superseded by the turnkey installer — kept for backward compatibility.
-if (process.argv[2] === 'setup') {
+// ─── CLI delegation (LW-17) ────────────────────────────────────────────────────
+// `npx auxilo-mcp setup|status|review|disable` runs the full turnkey CLI.
+// npx resolves PACKAGE names, not bin aliases — the documented `npx auxilo
+// setup` 404s until the `auxilo` npm package name is claimed, so the package
+// bin must handle these commands itself.
+if (['setup', 'status', 'review', 'disable'].includes(process.argv[2])) {
+  require('./bin/auxilo-cli.js').run();
+  return; // module-level return in CommonJS stops the MCP server from starting
+}
+
+// ─── CLI: legacy setup (Change 4, pre-LW-12) — now handled by delegation above ──
+if (process.argv[2] === '__legacy_setup_unreachable__') {
   console.log('Note: `auxilo-mcp setup` is superseded by `npx auxilo setup` (interactive');
   console.log('install: MCP registration + login + background extraction). Continuing with');
   console.log('legacy MCP-registration-only setup...\n');
@@ -622,7 +633,9 @@ if (process.argv[2] === 'login') {
         process.exit(1);
       }
       const deviceData = await deviceResp.json();
-      const { user_code, verification_url } = deviceData;
+      // A-1: device_code is the secret polling credential; user_code is only the
+      // human code shown on the verification page.
+      const { user_code, device_code, verification_url } = deviceData;
 
       // 2. Display code and URL
       console.log(`\nYour device code: ${user_code}`);
@@ -639,7 +652,7 @@ if (process.argv[2] === 'login') {
       for (let i = 0; i < maxAttempts; i++) {
         await new Promise(resolve => setTimeout(resolve, 5000));
         try {
-          const statusResp = await fetch(`${AUXILO_BASE}/auth/device/status?code=${user_code}`);
+          const statusResp = await fetch(`${AUXILO_BASE}/auth/device/status?device_code=${encodeURIComponent(device_code)}`);
           const statusData = await statusResp.json();
 
           if (statusData.status === 'authorized') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "MCP server for Auxilo — Agent Capability Discovery & Knowledge Marketplace",
   "main": "mcp-server.js",
   "bin": {