changebook 0.4.6 → 0.4.8

package/README.md

@@ -2,10 +2,10 @@
 
 MCP (Model Context Protocol) server that lets coding agents — Claude Code,
 Codex, Cursor — query the **ChangeBook product memory** (the module map and the
-analyzed change history stored in Supabase) instead of re-reading the
-codebase, plus a CLI that feeds that memory from any terminal: sign in,
+analyzed change history from your ChangeBook account) instead of re-reading
+the codebase, plus a CLI that feeds that memory from any terminal: sign in,
 analyze uncommitted changes, sync the product map. All MCP tools are
-read-only, and Row Level Security scopes every query to the signed-in user.
+read-only, and every query is scoped to the signed-in user.
 
 ## Two ways to run it
 
@@ -96,11 +96,6 @@ env vars below override them for CI/headless setups.
 | `CHANGEBOOK_ACCESS_TOKEN` | — | Short-lived JWT; refreshed automatically when it expires. |
 | `CHANGEBOOK_PROJECT` | — | Scope every query to one project (matched by slug, then exact name — usually the workspace folder name). Unset = all projects. |
 | `CHANGEBOOK_WEB_URL` | `https://changebook.app` | Web app used by `login`/`open` and printed after `analyze`. |
-| `CHANGEBOOK_SUPABASE_URL` | production project | Override for other environments. |
-| `CHANGEBOOK_SUPABASE_ANON_KEY` | production public key | Override for other environments. |
-
-The embedded anon key is the same public key the web app ships — it grants
-nothing by itself; your session token plus RLS decide what you can read.
 
 ## `sync`: product map inside CLAUDE.md / AGENTS.md
 
@@ -119,7 +114,7 @@ touched. Re-run after analyzing changes (or wire it to a git hook).
 ## Security notes
 
 - MCP tools are read-only; only `analyze` writes (through the same audited
-  Edge Function as the extension, with the same quotas).
+  server endpoint as the extension, with the same quotas).
 - `login` uses a loopback-only handoff: the web app asks for an explicit
   Authorize click and redirects the tokens to `http://127.0.0.1:<port>` in
   the URL fragment — they never leave your machine, and a `state` nonce ties

package/dist/context.js

@@ -8,14 +8,22 @@
  * file that can go stale between commits: it is generated on the spot, per
  * session.
  *
- * FAIL-OPEN, ABSOLUTE. This runs on the critical path of opening a session.
- * Every failure mode — logged out, offline, no project, or merely slow — must
- * print NOTHING and exit 0. A broken or slow atlas can never block or delay a
- * user's session start. The whole body races a short timeout; on timeout or
- * any throw, we emit nothing.
+ * FAIL-OPEN, ABSOLUTE, in the sense that matters: this runs on the critical
+ * path of opening a session, so nothing here may ever block it, slow it, or
+ * exit non-zero. The whole body races a short timeout; on timeout or any
+ * throw, we emit nothing and exit 0.
+ *
+ * What is NO LONGER absolute is the silence. Failing quietly used to mean the
+ * agent opened a session with no atlas AND no idea why — and the commonest
+ * cause, a dead CLI session, is precisely when it most needs to know, because
+ * everything the atlas told it about recent work is stale. So the feed pulse
+ * (feed.ts) is emitted even when the brief itself cannot be built. Quiet
+ * failure and invisible failure are different things; only the first one was
+ * ever the goal.
  */
 import * as fs from "node:fs";
 import path from "node:path";
+import { feedWarningFor } from "./feed.js";
 import { fetchBriefSection } from "./sync.js";
 import { commitAliasesShort, derivaContraHead } from "./tools.js";
 /** Hard ceiling on the critical path: past this, emit nothing and move on. */
@@ -136,11 +144,35 @@ export function uninstallContextHook(dir) {
     fs.writeFileSync(file, JSON.stringify(settings, null, 2) + "\n");
     return "removed";
 }
+/**
+ * The pulse and the brief, composed. Separate from printContext so the WHOLE
+ * thing — including the pulse — stays inside the single timeout race: adding
+ * work outside it would erode the "never delays a session" guarantee.
+ *
+ * The two are gathered independently on purpose. Before this, a throw inside
+ * buildPayload took the whole payload down, and the most common cause of that
+ * throw is a dead session — which is exactly when the agent most needs to be
+ * told something. Now a broken brief still lets the pulse through.
+ */
+async function buildSessionContext(db, dir) {
+    // Local and offline: one small file plus a git rev-parse. It cannot fail
+    // because of the network or the session, which is the point.
+    const pulse = await feedWarningFor(dir, { audience: "agent" }).catch(() => "");
+    let brief = null;
+    try {
+        brief = await buildPayload(db, dir);
+    }
+    catch {
+        brief = null;
+    }
+    const parts = [pulse, brief].filter(Boolean);
+    return parts.length > 0 ? parts.join("\n\n") : null;
+}
 export async function printContext(db, dir) {
     try {
         const timeout = new Promise((resolve) => setTimeout(() => resolve(null), CONTEXT_TIMEOUT_MS));
         const additionalContext = await Promise.race([
-            buildPayload(db, dir),
+            buildSessionContext(db, dir),
             timeout,
         ]);
         if (!additionalContext)

package/dist/credentials.js

@@ -61,4 +61,75 @@ export function clearCredentials() {
         return false;
     }
 }
+const LOCK_FILE = path.join(DIR, "refresh.lock");
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Run `fn` while holding an exclusive, cross-process lock.
+ *
+ * Supabase rotates the refresh token on every use, and its reuse-detection
+ * revokes the WHOLE token family if a rotated token is ever replayed. The
+ * post-commit `analyze` runs detached in the background, so it can still be
+ * refreshing when the next commit's pre-commit `guard` (or another analyze)
+ * starts — two processes then spend the same stored refresh token and the
+ * account is logged out silently. A lockfile serializes the refresh across
+ * every process that shares the credentials file, so only one spends the token.
+ *
+ * Falls through and runs `fn` unlocked if the lock can't be taken within
+ * `timeoutMs` — a hung holder must never block a commit forever; that only
+ * degrades to the previous lock-less behavior. A stale lock left by a crashed
+ * holder (older than `staleMs`) is stolen.
+ */
+export async function withCredentialsLock(fn, opts = {}) {
+    const lockPath = opts.lockPath ?? LOCK_FILE;
+    const timeoutMs = opts.timeoutMs ?? 30_000;
+    const staleMs = opts.staleMs ?? 60_000;
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + timeoutMs;
+    let held = false;
+    for (;;) {
+        try {
+            const fd = fs.openSync(lockPath, "wx", 0o600);
+            fs.writeSync(fd, `${process.pid} ${new Date().toISOString()}\n`);
+            fs.closeSync(fd);
+            held = true;
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            // Held by another process. Steal it only if it is stale (crashed holder).
+            let stolen = false;
+            try {
+                if (Date.now() - fs.statSync(lockPath).mtimeMs > staleMs) {
+                    fs.rmSync(lockPath, { force: true });
+                    stolen = true;
+                }
+            }
+            catch {
+                // The lock vanished between open and stat: retry immediately.
+                stolen = true;
+            }
+            if (stolen)
+                continue;
+            if (Date.now() >= deadline)
+                break; // give up waiting; proceed unlocked
+            await sleep(50);
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        if (held) {
+            try {
+                fs.rmSync(lockPath, { force: true });
+            }
+            catch {
+                // Best-effort release; a leftover lock is stolen once it goes stale.
+            }
+        }
+    }
+}
 //# sourceMappingURL=credentials.js.map

package/dist/feed.js

@@ -0,0 +1,147 @@
+/**
+ * The atlas' feed pulse: did the automatic ingestion actually land?
+ *
+ * The post-commit hook runs detached and never blocks the commit (see hook.ts),
+ * which is the right call — but it means that when it fails (expired session,
+ * offline, out of credits) NOTHING surfaces. The atlas just stops learning, and
+ * the only symptom is data that looks slightly old, which is indistinguishable
+ * from "nothing has happened". A tool whose whole job is to notice silent
+ * decay must not decay silently itself.
+ *
+ * Real case that motivated this (2026-07-25): the stored session died, two
+ * commits in a row fed nothing, and the failure was only found by reading a log
+ * nobody had a reason to open — by which point the first failure's evidence had
+ * already been overwritten by the second.
+ *
+ * The contract is deliberately one-directional and cheap:
+ *   `analyze --commit` (the hook path) records the outcome here.
+ *   `guard` (pre-commit, FOREGROUND, a human is watching) reads it and says it
+ *   out loud at the next commit.
+ *
+ * Everything here is best-effort: a read-only .git, a corrupt file or a missing
+ * git must never turn into a failed commit. Losing the pulse is bad; breaking
+ * someone's commit to report it would be worse.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { gitPath } from "./git.js";
+const FEED_FILE = "changebook-feed.json";
+/** Where the post-commit hook keeps the full output; cited in the warning. */
+export const HOOK_LOG_FILE = "changebook-hook.log";
+const MAX_REASON_CHARS = 200;
+/**
+ * The first paragraph of an error, which is the part that says what went wrong.
+ * Several of our errors append a blank line and then the multi-line AUTH_HELP;
+ * collapsing all of that into one line produced a warning whose "Last error:"
+ * trailed off mid-sentence into the help text ("… Run: changebook login It
+ * opens https:"). The remedy line already tells the user what to do.
+ */
+function firstParagraph(reason) {
+    return reason.split(/\n\s*\n/)[0].replace(/\s+/g, " ").trim();
+}
+export async function feedStatusPath(dir) {
+    return gitPath(dir, FEED_FILE).catch(() => null);
+}
+export async function readFeedStatus(dir) {
+    try {
+        const file = await feedStatusPath(dir);
+        if (!file)
+            return null;
+        const data = JSON.parse(fs.readFileSync(file, "utf8"));
+        // A hand-edited or half-written file must not crash a commit: accept it
+        // only if the two fields the warning depends on are the right shape.
+        if (typeof data.ok !== "boolean" || typeof data.failures !== "number") {
+            return null;
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Record how the automatic feed went. Failures accumulate a streak so the
+ * warning can say "the last 4 commits" instead of only ever "the last one" —
+ * the difference between a blip you can ignore and a week of silence you can't.
+ */
+export async function recordFeed(dir, result, now = new Date()) {
+    try {
+        const file = await feedStatusPath(dir);
+        if (!file)
+            return;
+        const previous = await readFeedStatus(dir);
+        const at = now.toISOString();
+        const status = result.ok
+            ? { ok: true, at, failures: 0 }
+            : {
+                ok: false,
+                at,
+                failures: (previous?.ok === false ? previous.failures : 0) + 1,
+                since: previous?.ok === false ? (previous.since ?? at) : at,
+                reason: result.reason
+                    ? firstParagraph(result.reason).slice(0, MAX_REASON_CHARS)
+                    : undefined,
+            };
+        fs.writeFileSync(file, JSON.stringify(status));
+    }
+    catch {
+        // Best-effort: never let bookkeeping break a commit.
+    }
+}
+/** A session problem is the one failure the user can fix in one command. */
+function needsLogin(reason) {
+    return /session|refresh[_ ]token|logged out|no stored session|\b40[13]\b/i.test(reason ?? "");
+}
+function remedyFor(reason) {
+    return needsLogin(reason)
+        ? "changebook login"
+        : "changebook analyze --commit HEAD   (to see the error in full)";
+}
+/**
+ * The warning a human sees, as text. Built separately from printing it so it
+ * can be tested, same shape as guard.ts' findingsMessage. Empty string when
+ * there is nothing to say — a healthy feed must stay completely silent, or the
+ * warning becomes noise people learn to skip.
+ */
+export function feedWarning(status, opts = {}) {
+    const { logPath = `.git/${HOOK_LOG_FILE}`, audience = "human" } = opts;
+    if (!status || status.ok || status.failures < 1)
+        return "";
+    const commits = status.failures === 1
+        ? "The last commit was not analyzed"
+        : `The last ${status.failures} commits were not analyzed`;
+    const since = status.since ? ` (since ${status.since.slice(0, 16).replace("T", " ")} UTC)` : "";
+    if (audience === "agent") {
+        const lines = [
+            "⚠ ChangeBook: this project's atlas is NOT being fed.",
+            `${commits}${since}, so anything it tells you about recent work is out of date — say so before you rely on it.`,
+        ];
+        if (status.reason)
+            lines.push(`Last error: ${status.reason}`);
+        lines.push(needsLogin(status.reason)
+            ? "Tell the user to run `changebook login` in their terminal. It opens a browser to authorize, so you cannot complete it yourself."
+            : `Tell the user their atlas stopped updating; the full error is in ${logPath}.`);
+        return lines.join("\n");
+    }
+    const lines = [
+        "\n⚠ ChangeBook: your atlas has stopped being fed.",
+        `  ${commits}${since}, so what it tells you is going stale.`,
+    ];
+    if (status.reason)
+        lines.push(`  Last error: ${status.reason}`);
+    lines.push(`  Fix: ${remedyFor(status.reason)}`);
+    lines.push(`  Full output: ${logPath}\n`);
+    return lines.join("\n");
+}
+/** Convenience for callers that only want the text for a directory. */
+export async function feedWarningFor(dir, opts = {}) {
+    const status = await readFeedStatus(dir);
+    if (!status || status.ok)
+        return "";
+    const file = await feedStatusPath(dir);
+    const logPath = file
+        ? path.join(path.dirname(file), HOOK_LOG_FILE)
+        : `.git/${HOOK_LOG_FILE}`;
+    return feedWarning(status, { ...opts, logPath });
+}
+//# sourceMappingURL=feed.js.map

package/dist/git.js

@@ -5,8 +5,22 @@
  * compress differently across subcommands and break the server-side dedup.
  */
 import { execFile } from "node:child_process";
+import * as path from "node:path";
 import { promisify } from "node:util";
 export const execFileAsync = promisify(execFile);
+/**
+ * Absolute path to a file inside this repo's git dir (the guard's cache, the
+ * feed pulse, the hook log). `--git-path` rather than building
+ * `<git-dir>/<name>` by hand: it resolves a linked worktree's common dir, so
+ * every process that shares the repo agrees on where these files live.
+ */
+export async function gitPath(dir, name) {
+    const { stdout } = await execFileAsync("git", ["rev-parse", "--git-path", name], {
+        cwd: dir,
+        encoding: "utf8",
+    });
+    return path.resolve(dir, stdout.trim());
+}
 export const GIT_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 // Mirror of the extension's default changebook.maxDiffCharacters (the server
 // rejects anything above 60k anyway).

package/dist/guard.js

@@ -15,7 +15,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { execFileSync } from "node:child_process";
-import { execFileAsync } from "./git.js";
+import { execFileAsync, gitPath } from "./git.js";
+import { feedWarningFor } from "./feed.js";
 /** Exit code that asks the pre-commit hook to abort the commit. */
 export const EXIT_BLOCK = 3;
 // A commit should never feel slow because of us: whatever the network hasn't
@@ -200,10 +201,6 @@ export function contarEnRepo(dir, simbolo) {
         return code === 1 ? 0 : null;
     }
 }
-async function gitPath(dir, name) {
-    const { stdout } = await execFileAsync("git", ["rev-parse", "--git-path", name], { cwd: dir, encoding: "utf8" });
-    return path.resolve(dir, stdout.trim());
-}
 export async function stagedFiles(dir) {
     // -z: NUL-separated, and crucially git does NOT octal-quote non-ASCII paths
     // (default quotepath would emit "m\303\263dulo.ts", which never matches the
@@ -273,11 +270,29 @@ async function fetchSignals(db, dir, env) {
     }
     return { alerts, filesByModule, projectId, fromCache: false };
 }
-/** One-line last-run trace so "why didn't it warn?" is answerable. */
+// Un fallo intermitente no se diagnostica con la última foto: hace falta la
+// racha. Este log guardaba SOLO la última corrida, y el 2026-07-25 eso costó un
+// diagnóstico — la corrida que gastó la sesión ya había sido pisada por la
+// siguiente cuando fui a mirar. Acotado por tamaño, no por olvido.
+const GUARD_LOG_MAX_BYTES = 65_536;
+const GUARD_LOG_KEEP_BYTES = 32_768;
+/** Traza por corrida, en append acotado, para que "¿por qué no avisó?" tenga respuesta. */
 async function logRun(dir, message) {
     try {
         const file = await gitPath(dir, "changebook-guard.log");
-        fs.writeFileSync(file, `${new Date().toISOString()} ${message}\n`);
+        // Recortar ANTES de anexar: con appendFileSync no hay descriptor abierto de
+        // por medio, pero el orden mantiene el fichero por debajo del techo aunque
+        // esta corrida escriba una línea larga.
+        try {
+            if (fs.statSync(file).size > GUARD_LOG_MAX_BYTES) {
+                const keep = fs.readFileSync(file).subarray(-GUARD_LOG_KEEP_BYTES);
+                fs.writeFileSync(file, keep);
+            }
+        }
+        catch {
+            // El fichero aún no existe: nada que recortar.
+        }
+        fs.appendFileSync(file, `${new Date().toISOString()} ${message}\n`);
     }
     catch {
         // Best-effort only.
@@ -314,6 +329,14 @@ export async function runGuard(db, dir, env = process.env) {
     const mode = (env.CHANGEBOOK_GUARD ?? "").trim().toLowerCase();
     if (mode === "off")
         return 0;
+    // The atlas' feed pulse, FIRST and offline. This is the one warning that has
+    // to survive a dead session — a dead session is its most common cause, and
+    // every check below this point either needs credentials or the network. It
+    // reads one small file, so it cannot slow a commit down, and like everything
+    // else here it only informs: the exit code is untouched.
+    const pulse = await feedWarningFor(dir);
+    if (pulse)
+        console.error(pulse);
     if (!db.hasCredentials())
         return 0;
     let staged;

package/dist/hook.js

@@ -22,16 +22,34 @@ function cliEntry() {
 }
 const POST_COMMIT_MARKER = "# changebook post-commit hook";
 const PRE_COMMIT_MARKER = "# changebook pre-commit guard";
+// The hook log grows by one run per commit, so it needs a ceiling — but one
+// that keeps enough history to diagnose a streak of failures, which is the
+// whole reason it is worth keeping at all.
+const LOG_MAX_BYTES = 262_144;
+const LOG_TRIM_KEEP_BYTES = 131_072;
 /** Exported for tests: the contract between this script and guard.ts. */
 export function postCommitScript() {
     // Background subshell + `|| true`: a broken analyze (offline, out of
     // credits, logged out) must never make `git commit` fail or feel slow.
-    // The log keeps only the last run so it can't grow unbounded.
+    //
+    // The log APPENDS, with a UTC header per run. It used to keep only the last
+    // run to stay bounded, which cost us a real diagnosis on 2026-07-25: two
+    // commits failed in a row and the second overwrote the evidence of the first,
+    // so which process broke the session was no longer answerable. Bounded is
+    // still right, but by trimming — not by forgetting everything but the last
+    // line. The trim runs BEFORE the redirection opens on purpose: replacing the
+    // file while the append fd is already open would leave that fd pointing at
+    // the unlinked inode and silently throw the run's output away.
+    const trimmed = `${LOG_TRIM_KEEP_BYTES}`;
     return `#!/bin/sh
 ${POST_COMMIT_MARKER} — analyzes each commit into your ChangeBook atlas.
 # Runs in the background and never blocks the commit. Remove with:
 #   changebook hook uninstall
-( ${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} analyze --commit HEAD > "$(git rev-parse --git-dir)/changebook-hook.log" 2>&1 & ) || true
+LOG="$(git rev-parse --git-path changebook-hook.log)"
+if [ -f "$LOG" ] && [ "$(wc -c < "$LOG")" -gt ${LOG_MAX_BYTES} ]; then
+  tail -c ${trimmed} "$LOG" > "$LOG.tmp" 2>/dev/null && mv -f "$LOG.tmp" "$LOG"
+fi
+( { date -u +'=== %Y-%m-%dT%H:%M:%SZ'; ${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} analyze --commit HEAD; } >> "$LOG" 2>&1 & ) || true
 `;
 }
 /** Exported for tests: the contract between this script and guard.ts. */

package/dist/index.js

@@ -16,6 +16,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { analyze } from "./analyze.js";
 import { atlasWebUrl, openInBrowser } from "./browser.js";
 import { clearCredentials, credentialsPath } from "./credentials.js";
+import { recordFeed } from "./feed.js";
 import { runGuard } from "./guard.js";
 import { hookStatus, installHook, uninstallHook } from "./hook.js";
 import { importHistory } from "./import.js";
@@ -136,9 +137,36 @@ async function main() {
         }
         case "analyze": {
             const db = new Supabase();
-            requireCredentials(db);
             const options = parseAnalyzeArgs(process.argv.slice(3));
-            await analyze(db, options);
+            const dir = options.dir ?? process.cwd();
+            // --commit IS the post-commit hook's path: the automatic feed, running
+            // detached where nobody reads its output. Record whether it landed so the
+            // next pre-commit can say it out loud (feed.ts). A manual `changebook
+            // analyze` is someone watching the terminal — no pulse needed, and
+            // recording one would let a hand-run failure warn about the hook.
+            const feeding = Boolean(options.commit);
+            if (!db.hasCredentials()) {
+                // Not requireCredentials(): it exits, and being logged out is exactly
+                // the failure the pulse exists to surface.
+                if (feeding)
+                    await recordFeed(dir, { ok: false, reason: "No stored session." });
+                console.error(AUTH_HELP);
+                process.exit(1);
+            }
+            try {
+                await analyze(db, options);
+            }
+            catch (error) {
+                if (feeding) {
+                    await recordFeed(dir, {
+                        ok: false,
+                        reason: error instanceof Error ? error.message : String(error),
+                    });
+                }
+                throw error;
+            }
+            if (feeding)
+                await recordFeed(dir, { ok: true });
             // El mapa de CLAUDE.md/AGENTS.md se regeneraba solo en `init`/`sync`,
             // así que se congelaba el día que lo instalabas (estudio 2026-07-20: la
             // causa nº 1 de que el agente desconfíe del atlas). analyze es el camino
@@ -147,9 +175,7 @@ async function main() {
             // archivos ni resucita un bloque borrado. Best-effort: un sync caído no
             // puede tumbar un análisis ya cobrado y registrado.
             try {
-                await syncContextFiles(db, options.dir ?? process.cwd(), {
-                    refreshOnly: true,
-                });
+                await syncContextFiles(db, dir, { refreshOnly: true });
             }
             catch (error) {
                 console.error(`Map refresh failed (analysis itself succeeded): ${error instanceof Error ? error.message : String(error)}`);
@@ -167,7 +193,14 @@ async function main() {
             // repo must commit exactly as before — runGuard resolves every failure
             // to exit 0 itself. The explicit exit also drops any fetch still racing
             // the timeout, so the commit never waits on a dangling socket.
-            return process.exit(await runGuard(new Supabase(), arg ?? process.cwd()));
+            //
+            // allowRefresh: false — and it is that same exit that makes it necessary.
+            // A dropped fetch is harmless unless it happens to be the token refresh:
+            // Supabase rotates on receipt, so dying mid-flight burns the stored token
+            // without saving its replacement and logs the user out of everything.
+            // The guard is an optional warning with a 3.5s budget; it must never be
+            // able to cost a session. Expired access token → no warning this time.
+            return process.exit(await runGuard(new Supabase(process.env, { allowRefresh: false }), arg ?? process.cwd()));
         }
         case "hook": {
             const dir = process.argv[4] ?? process.cwd();

package/dist/supabase.js

@@ -5,7 +5,7 @@
  * every query to the signed-in user. Refreshes the access token with the
  * refresh token when needed (refresh does not require a captcha).
  */
-import { loadCredentials, saveCredentials } from './credentials.js';
+import { loadCredentials, saveCredentials, withCredentialsLock, } from './credentials.js';
 import { slugifyProject } from './guard.js';
 // Public defaults — the anon key is the same public key the web app ships.
 const DEFAULT_URL = 'https://oyosihxkecspjkiligga.supabase.co';
@@ -22,6 +22,29 @@ variable (and optionally CHANGEBOOK_ACCESS_TOKEN). To extract it manually, sign
 in at https://changebook.app, open the browser console and run:
 
   JSON.parse(localStorage.getItem(Object.keys(localStorage).find(k => k.endsWith("-auth-token")))).refresh_token`;
+/**
+ * Decide what to do at the start of a refresh, given the refresh token this
+ * process held before it took the lock and whatever is on disk now.
+ *
+ * If another process refreshed while we waited for the lock, the stored refresh
+ * token differs from ours AND comes with a fresh access token: adopt those and
+ * never spend our own. Replaying a rotated token trips Supabase's
+ * reuse-detection and revokes the whole family — the silent logout this guards
+ * against. Otherwise spend the freshest refresh token available.
+ */
+export function decideRefresh(priorRefreshToken, stored) {
+    if (stored?.refresh_token &&
+        stored.refresh_token !== priorRefreshToken &&
+        stored.access_token) {
+        return {
+            kind: 'adopt',
+            access_token: stored.access_token,
+            refresh_token: stored.refresh_token,
+        };
+    }
+    const token = stored?.refresh_token ?? priorRefreshToken;
+    return token ? { kind: 'spend', refresh_token: token } : { kind: 'none' };
+}
 export class SupabaseError extends Error {
     status;
     constructor(message, status) {
@@ -41,7 +64,21 @@ export class Supabase {
     // True when the tokens came from ~/.changebook/credentials.json: rotated
     // refresh tokens must be written back there or the stored one goes stale.
     persistRotation = false;
-    constructor(env = process.env) {
+    /**
+     * Whether this process is allowed to SPEND the rotating refresh token.
+     *
+     * False for callers that run under a hard deadline and end in process.exit()
+     * — today, the pre-commit guard. Supabase rotates the refresh token the
+     * moment it RECEIVES the request, not when we read the reply, so a process
+     * that is killed mid-refresh burns the stored token without ever persisting
+     * the new one. The next process replays a spent token, Supabase's reuse
+     * detection fires, and the whole session dies. That is a silent logout
+     * caused by an optional warning — a terrible trade (diagnosed 2026-07-25:
+     * the session died ~30 min after every login, always on a commit).
+     */
+    allowRefresh = true;
+    constructor(env = process.env, opts = {}) {
+        this.allowRefresh = opts.allowRefresh ?? true;
         this.url = (env.CHANGEBOOK_SUPABASE_URL ?? DEFAULT_URL).replace(/\/+$/, '');
         this.anonKey = env.CHANGEBOOK_SUPABASE_ANON_KEY ?? DEFAULT_ANON_KEY;
         this.accessToken = env.CHANGEBOOK_ACCESS_TOKEN?.trim() || undefined;
@@ -264,30 +301,41 @@ export class Supabase {
         });
         return this.refreshing;
     }
-    async doRefresh() {
-        // The credentials file is shared across processes (the MCP server, the
-        // post-commit hook, a second editor window). Any of them may have rotated
-        // the token since we loaded it, so pick up the freshest one on disk before
-        // spending ours — otherwise we replay a stale token and get logged out.
-        if (this.persistRotation) {
-            const stored = loadCredentials();
-            if (stored?.refresh_token)
-                this.refreshToken = stored.refresh_token;
+    doRefresh() {
+        // Refusing BEFORE the request is the whole point: once it leaves, the token
+        // is spent whether or not we survive to store the replacement. Callers that
+        // opt out get a plain 401 they can treat as "no atlas this time".
+        if (!this.allowRefresh) {
+            return Promise.reject(new SupabaseError("The stored session needs renewing and this process is not allowed to spend it (it runs under a deadline). Skipping.", 401));
         }
-        if (!this.refreshToken) {
+        // Env-var sessions aren't shared through the credentials file, so there is
+        // nothing to coordinate between processes: refresh in place.
+        if (!this.persistRotation)
+            return this.doRefreshInner();
+        // Disk-backed sessions (from `changebook login`) can be refreshed by
+        // several processes at once — the detached post-commit analyze, the
+        // pre-commit guard, a second editor window. Serialize under a cross-process
+        // lock so only one spends the rotating token; the others adopt its result
+        // instead of replaying a token Supabase has already rotated (which would
+        // trip reuse-detection and log the whole account out silently).
+        return withCredentialsLock(() => this.doRefreshInner());
+    }
+    async doRefreshInner() {
+        // Under the lock: re-read disk so a refresh another process just completed
+        // is picked up before we spend anything.
+        const stored = this.persistRotation ? loadCredentials() : null;
+        const plan = decideRefresh(this.refreshToken, stored);
+        if (plan.kind === 'none') {
             throw new SupabaseError(`Session expired. ${AUTH_HELP}`, 401);
         }
-        let res = await this.refreshOnce(this.refreshToken);
-        // If the refresh was rejected and the session came from disk, another
-        // process may have rotated the token in the tiny window since we read it;
-        // reload once and retry with the newest before giving up.
-        if (!res.ok && this.persistRotation) {
-            const stored = loadCredentials();
-            if (stored?.refresh_token && stored.refresh_token !== this.refreshToken) {
-                this.refreshToken = stored.refresh_token;
-                res = await this.refreshOnce(this.refreshToken);
-            }
+        if (plan.kind === 'adopt') {
+            // Another process refreshed while we waited: use its fresh tokens.
+            this.accessToken = plan.access_token;
+            this.refreshToken = plan.refresh_token;
+            return;
         }
+        this.refreshToken = plan.refresh_token;
+        const res = await this.refreshOnce(this.refreshToken);
         if (!res.ok) {
             const body = (await res.text()).slice(0, 300);
             throw new SupabaseError(`Could not refresh the ChangeBook session (${res.status}): ${body}\n\n${AUTH_HELP}`, res.status);

package/dist/sync.js

@@ -50,6 +50,27 @@ const SYNC_BUDGET_CHARS = 2_000;
 // shared analyses and a ≥60% rate before we call it a dependency.
 const MIN_PAIR_COUNT = 3;
 const MIN_PAIR_RATE = 0.6;
+/**
+ * Espejo de supabase/functions/mcp/scope.ts::summarizeHealth — el paquete npm
+ * es autocontenido. Paridad fijada en test/saludEnBrief.
+ */
+export function summarizeHealth(rows) {
+    let passed = 0;
+    const at_risk = [];
+    for (const r of rows) {
+        if (r.status === 'passed') {
+            passed += 1;
+        }
+        else if (r.status === 'at_risk') {
+            at_risk.push({
+                check: r.check_id,
+                evidence: (r.evidence ?? '').trim(),
+                since: r.updated_at ? r.updated_at.slice(0, 10) : null,
+            });
+        }
+    }
+    return { passed, at_risk };
+}
 // Same window/limit the web uses for the signals strip.
 const ALERT_WINDOW_DAYS = 14;
 const MAX_ALERTS = 3;
@@ -76,7 +97,7 @@ export async function fetchBriefSection(db, targetDir) {
     }
     const projectId = /project_id=eq\.([0-9a-f-]+)/.exec(projectFilter)?.[1] ?? null;
     const since = new Date(Date.now() - ALERT_WINDOW_DAYS * 24 * 3600 * 1000).toISOString();
-    const [moduleRows, changes, alerts, pendingTasks] = await Promise.all([
+    const [moduleRows, changes, alerts, pendingTasks, healthRows] = await Promise.all([
         db.rest('change_module?select=changelog_id,module,domain,risk,files,note,created_at&order=created_at.desc&limit=500' +
             projectFilter),
         db.rest(`changelog?select=business_impact,created_at&order=created_at.desc&limit=${MAX_CHANGES}` +
@@ -93,8 +114,14 @@ export async function fetchBriefSection(db, targetDir) {
                 .then((rows) => rows.filter((r) => r.status === 'pending'))
                 .catch(() => [])
             : Promise.resolve([]),
+        // Salud (project_checks): tabla diminuta (≤8 filas/proyecto), en paralelo.
+        db
+            .rest('project_checks?select=check_id,status,evidence,updated_at&order=updated_at.desc&limit=8' +
+            projectFilter)
+            .catch(() => []),
     ]);
-    const section = buildSection(moduleRows, changes, alerts, projectName, pendingTasks);
+    const health = summarizeHealth(healthRows);
+    const section = buildSection(moduleRows, changes, alerts, projectName, pendingTasks, health.at_risk);
     return { section, projectId, projectResolved };
 }
 export async function syncContextFiles(db, targetDir, opts = {}) {
@@ -119,7 +146,7 @@ export async function syncContextFiles(db, targetDir, opts = {}) {
     }
 }
 /** Exported for tests. */
-export function buildSection(rows, changes, alerts = [], projectName, pendingTasks = []) {
+export function buildSection(rows, changes, alerts = [], projectName, pendingTasks = [], atRiskHealth = []) {
     // Newest-first rows: the first occurrence of a module is its latest state.
     const seen = new Map();
     for (const row of rows) {
@@ -225,6 +252,11 @@ export function buildSection(rows, changes, alerts = [], projectName, pendingTas
         return `- **${m.module}** está marcado crítico${note ? ` — ${note}` : ''}`;
     });
     const changeLines = changes.map((c) => `- ${c.created_at.slice(0, 10)} — ${sanitizeCell((c.business_impact ?? '').slice(0, 140))}`);
+    // Salud en riesgo: los controles (auth, secretos, validación, límites…) que
+    // el análisis ya marcó rotos con evidencia. Alta prioridad de presupuesto —
+    // es seguridad. Solo los at_risk (lo accionable); el texto entero va a
+    // `atlas_project_brief`. Cap a 130 chars como las alertas.
+    const healthLines = atRiskHealth.map((h) => `- ⚠ **${h.check}**${h.since ? ` (desde ${h.since})` : ''} — ${sanitizeCell(h.evidence.slice(0, 130))}`);
     // Auto-remediación fase 2: la cola entra en cada sesión para que el agente
     // se OFREZCA a atacarla — proponer con plan y esperar el OK del humano,
     // nunca ejecutar por su cuenta. Títulos deduplicados (la cola real puede
@@ -261,6 +293,12 @@ export function buildSection(rows, changes, alerts = [], projectName, pendingTas
             title: '### Regresiones detectadas (resolver o verificar YA)',
             lines: alertLines,
         },
+        {
+            key: 'health',
+            priority: 1,
+            title: '### Salud en riesgo (verifica antes de tocar)',
+            lines: healthLines,
+        },
         {
             key: 'hotspots',
             priority: 4,

package/dist/tools.js

@@ -96,6 +96,31 @@ export function quotedInList(values) {
         .join(",");
 }
 export const FILES_CAP = 8;
+/**
+ * Reincidencia (espejo de supabase/functions/mcp/scope.ts::computeRecidivism —
+ * paridad en test/reincidenciaFileContext). Por módulo, nº de problemas de
+ * regresión DISTINTOS (count(distinct plain), all-time), solo los con
+ * antecedentes (>= 2). Plain distinto, no filas, para que el re-levantado no
+ * infle. No se refuta: cuenta historia, no vigencia.
+ */
+export function computeRecidivism(rows) {
+    const plainsByModule = new Map();
+    for (const r of rows) {
+        const m = (r.module ?? "").trim();
+        const p = (r.plain ?? "").trim();
+        if (!m || !p)
+            continue;
+        const set = plainsByModule.get(m) ?? new Set();
+        set.add(p);
+        plainsByModule.set(m, set);
+    }
+    const out = new Map();
+    for (const [m, set] of plainsByModule) {
+        if (set.size >= 2)
+            out.set(m, set.size);
+    }
+    return out;
+}
 export function filesUnionByChange(rows, cap = FILES_CAP) {
     const acc = new Map();
     for (const r of rows) {
@@ -631,7 +656,7 @@ Args:
   - files (required): 1-8 repo-relative paths.
   - project (recommended): the repo you are working in (folder name or slug). The atlas is per-project — always scope to your own project.
 
-Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_changed, last_note }], open_alerts, recent_commits: [{ commit, commit_aliases, date }], recent_commits_more, watched_values: [{ name, value, commit }] }] }`,
+Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_changed, last_note }], open_alerts, recidivism: [{ module, prior_regressions }], recent_commits: [{ commit, commit_aliases, date }], recent_commits_more, watched_values: [{ name, value, commit }] }] }`,
         inputSchema: {
             files: z.array(z.string().min(1).max(300)).min(1).max(8)
                 .describe("Repo-relative paths you are about to edit"),
@@ -710,7 +735,7 @@ Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_
             for (const f of perFile) {
                 commitsByFile.set(f.file, recentCommitsForFile(f.changelogIds, commitById));
             }
-            const [alerts, watched] = await Promise.all([
+            const [alerts, watched, recidivismRows] = await Promise.all([
                 moduleNames.length
                     ? db.rest(`regression_alerts?select=module,plain,evidence_symbol,evidence_expect&resolved_at=is.null&module=in.(${encodeURIComponent(quotedInList(moduleNames))})&order=created_at.desc&limit=10` +
                         pf)
@@ -723,6 +748,17 @@ Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_
                     .rest(`watched_values?select=file,name,value,commit_hash&file=in.(${encodeURIComponent(quotedInList(paths))})&order=name.asc&limit=40` +
                     pf)
                     .catch(() => []),
+                // Reincidencia (edit-time, espejo del hospedado): problemas de
+                // regresión de TODO el tiempo (sin filtro resolved) de los módulos
+                // tocados. Depende de moduleNames como las alertas → mismo Promise.all,
+                // sin ronda extra. Se cuenta distinct plain abajo (mismo criterio que
+                // el RPC del brief).
+                moduleNames.length
+                    ? db
+                        .rest(`regression_alerts?select=module,plain&module=in.(${encodeURIComponent(quotedInList(moduleNames))})&limit=500` +
+                        pf)
+                        .catch(() => [])
+                    : Promise.resolve([]),
             ]);
             const watchedByFile = new Map();
             for (const w of watched) {
@@ -747,6 +783,10 @@ Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_
                     continue;
                 alertsByModule.set(m, [...(alertsByModule.get(m) ?? []), a.plain]);
             }
+            // Reincidencia: nº de problemas de regresión DISTINTOS por módulo
+            // (count(distinct plain), all-time), solo los con antecedentes (>= 2).
+            // Fuente única compartida (computeRecidivism) — antes 3 copias.
+            const recidivismByModule = computeRecidivism(recidivismRows);
             // Ancla temporal: el último commit analizado del proyecto vs el HEAD
             // de este árbol (misma puerta de proyecto que la refutación).
             // Best-effort: el ancla jamás rompe la lectura que ancla.
@@ -778,8 +818,10 @@ Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_
                     lines.push("No atlas history for this file yet (new or never analyzed).");
                 }
                 for (const m of f.modules) {
+                    const previas = recidivismByModule.get(m.module);
                     lines.push(`- Module **${m.module}** — ${m.changes} change(s), last ${m.last_changed}` +
-                        (m.risk ? `, risk: ${m.risk}` : ""));
+                        (m.risk ? `, risk: ${m.risk}` : "") +
+                        (previas ? ` · ⚠ ${previas} prior regressions` : ""));
                     if (m.last_note) {
                         // Con fecha: una nota es una observación fechada, no estado.
                         lines.push(`  - Note from last analysis (${m.last_changed}): ${m.last_note}`);
@@ -816,6 +858,12 @@ Returns (structured): { files: [{ file, modules: [{ module, risk, changes, last_
                         module: m.module,
                         plain,
                     }))),
+                    recidivism: f.modules
+                        .map((m) => ({
+                        module: m.module,
+                        prior_regressions: recidivismByModule.get(m.module) ?? 0,
+                    }))
+                        .filter((x) => x.prior_regressions >= 2),
                     watched_values: (watchedByFile.get(f.file) ?? []).map((w) => ({
                         name: w.name,
                         value: w.value,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "changebook",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "mcpName": "io.github.raulbr90/changebook",
   "description": "ChangeBook for coding agents: MCP server (product memory for Claude Code/Codex) + CLI to sign in, analyze changes and sync the product map.",
   "type": "module",

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.raulbr90/changebook",
   "description": "Query your product's living memory: module map + analyzed change history. Read-only MCP tools.",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "websiteUrl": "https://changebook.dev",
   "remotes": [
     {
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "changebook",
-      "version": "0.4.6",
+      "version": "0.4.8",
       "transport": {
         "type": "stdio"
       }