klypix-mcp 1.40.0 → 1.40.2

package/bin/klypix-install.mjs

@@ -220,7 +220,7 @@ const flatten = (code) => code
     .replace(/\.\.\/src\/klypix-(core|format)\.mjs/g, './klypix-$1.mjs')
     // brain-doctor + agent-rules (the server's lazy `import('../src/brain-doctor.mjs')`
     // for the brain_doctor tool) → flat sibling refs in the runtime layout.
-    .replace(/\.\.\/src\/(brain-doctor|agent-rules|mcp-presence|mcp-supervisor)\.mjs/g, './$1.mjs')
+    .replace(/\.\.\/src\/(brain-doctor|agent-rules|mcp-presence|mcp-supervisor|mcp-auto-update)\.mjs/g, './$1.mjs')
     .replace(/klypix-worker\.mjs/g, 'klypix-mcp-worker.mjs')
     .replace(/const PKG_VERSION = \(\(\) => \{[\s\S]*?\}\)\(\);/, `const PKG_VERSION = '${VERSION}'; // baked at install (flat layout has no package.json)`);
 

package/bin/klypix-worker.mjs

@@ -32,6 +32,7 @@ import {
 } from '../src/klypix-core.mjs';
 import { mcpServerEntry } from '../src/agent-rules.mjs';
 import { createMcpPresence, KLYPIX_MCP_INSTRUCTIONS } from '../src/mcp-presence.mjs';
+import { spawnAutoUpdateHelper } from '../src/mcp-auto-update.mjs';
 
 // Real package version for the MCP handshake (was hardcoded '1.0.0', which
 // misled every client/version diagnosis — it could never reflect the true release).
@@ -494,12 +495,18 @@ if (!canvasViewAsApp) {
 
 const transport = new StdioServerTransport();
 let runningHeartbeat = null;
+let autoUpdateStarter = null;
+let autoUpdatePoller = null;
 let runtimeStopped = false;
 const stopRuntimePresence = () => {
   if (runtimeStopped) return;
   runtimeStopped = true;
   if (runningHeartbeat) clearInterval(runningHeartbeat);
   runningHeartbeat = null;
+  if (autoUpdateStarter) clearTimeout(autoUpdateStarter);
+  if (autoUpdatePoller) clearInterval(autoUpdatePoller);
+  autoUpdateStarter = null;
+  autoUpdatePoller = null;
   recordRunningServer({ remove: true });
   mcpPresence.stop();
 };
@@ -508,6 +515,22 @@ server.server.oninitialized = () => {
   recordRunningServer();
   runningHeartbeat = setInterval(() => recordRunningServer(), 30_000);
   runningHeartbeat.unref?.();
+  // The worker mirrors the supervisor's host-neutral scheduler. This lets an
+  // older stable supervisor acquire the updater immediately after hot-swapping
+  // to a compatible new worker; no extra host reconnect is needed for the
+  // scheduler itself. Stamp + lock make the duplicate trigger effectively free.
+  const autoUpdateDir = path.dirname(
+    process.env.KLYPIX_MCP_RUNTIME_MANIFEST
+    || path.join(os.homedir(), '.claude', 'project-brain', '.mcp-runtime.json'),
+  );
+  const checkForCoreUpdate = () => spawnAutoUpdateHelper({
+    brainDir: autoUpdateDir,
+    currentVersion: PKG_VERSION,
+  });
+  autoUpdateStarter = setTimeout(checkForCoreUpdate, 2000);
+  autoUpdateStarter.unref?.();
+  autoUpdatePoller = setInterval(checkForCoreUpdate, 60 * 60 * 1000);
+  autoUpdatePoller.unref?.();
   log(`ready · vault=${VAULT} · presence=mcp`);
 };
 server.server.onclose = stopRuntimePresence;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klypix-mcp",
-  "version": "1.40.0",
+  "version": "1.40.2",
   "description": "Every project gets a brain — one open .klypix file your AI agents read, write, and argue from, over MCP. Works with Claude, Codex, Cursor, Cline, any model.",
   "type": "module",
   "license": "Apache-2.0",

package/src/mcp-auto-update.mjs

@@ -21,6 +21,7 @@ import path from 'path';
 import crypto from 'crypto';
 import https from 'https';
 import { spawn } from 'child_process';
+import { fileURLToPath } from 'url';
 
 export const AUTO_UPDATE_TTL_MS = 24 * 60 * 60 * 1000;
 export const AUTO_UPDATE_LOCK_STALE_MS = 30 * 60 * 1000;
@@ -106,6 +107,44 @@ export function inspectAutoUpdate(brainDir, { now = Date.now(), env = process.en
   };
 }
 
+/**
+ * Start the detached updater when this machine is due.
+ *
+ * Safe to call from both the stable supervisor and the replaceable worker:
+ * the shared stamp prevents unnecessary children and the helper lock collapses
+ * the remaining cross-process race.
+ */
+export function spawnAutoUpdateHelper({
+  brainDir = path.join(os.homedir(), '.claude', 'project-brain'),
+  currentVersion = null,
+  env = process.env,
+  spawnProcess = spawn,
+} = {}) {
+  if (!autoUpdateEnabled(env) || env.KLYPIX_MCP_AUTO_UPDATE_CHILD === '1') return null;
+  if (!inspectAutoUpdate(brainDir, { env }).due) return null;
+  try {
+    const helper = fileURLToPath(import.meta.url);
+    const child = spawnProcess(process.execPath, [helper, AUTO_UPDATE_WORKER_ARG], {
+      // Do not hold the managed directory as this detached process's cwd.
+      // This matters for ephemeral/test homes on Windows and is cleaner for
+      // uninstallers; the installer receives its exact target through env.
+      cwd: os.tmpdir(),
+      env: {
+        ...env,
+        KLYPIX_MCP_AUTO_UPDATE_DIR: path.resolve(brainDir),
+        KLYPIX_MCP_AUTO_UPDATE_CURRENT: String(currentVersion || ''),
+        KLYPIX_MCP_AUTO_UPDATE_CHILD: '1',
+      },
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+    child.on('error', () => { /* fail-open: the MCP transport remains healthy */ });
+    child.unref();
+    return child;
+  } catch { return null; }
+}
+
 function acquireLock(lockFile, now, staleMs = AUTO_UPDATE_LOCK_STALE_MS) {
   fs.mkdirSync(path.dirname(lockFile), { recursive: true });
   const token = `${process.pid}-${crypto.randomBytes(8).toString('hex')}`;
@@ -190,7 +229,25 @@ export function installExactRuntime(version, {
     };
     let child;
     try {
-      child = spawnProcess('npx', ['-y', `klypix-mcp@${version}`, 'install', '--runtime-only'], {
+      let command = 'npx';
+      let args = ['-y', `klypix-mcp@${version}`, 'install', '--runtime-only'];
+      if (process.platform === 'win32') {
+        // .cmd files require a shell on Windows, but Node 24 correctly warns
+        // that shell:true concatenates arguments. Invoke npm's JS entry with
+        // this exact Node binary instead: no quoting ambiguity, no shell, and
+        // the strict-semver gate above leaves no command-injection surface.
+        const npxCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npx-cli.js');
+        if (fs.existsSync(npxCli)) {
+          command = process.execPath;
+          args = [npxCli, ...args];
+        } else {
+          // Portable fallback for unusual Windows Node layouts. The only
+          // interpolated value is strict x.y.z semver.
+          command = process.env.ComSpec || 'cmd.exe';
+          args = ['/d', '/s', '/c', `npx -y klypix-mcp@${version} install --runtime-only`];
+        }
+      }
+      child = spawnProcess(command, args, {
         cwd: brainDir,
         env: {
           ...process.env,
@@ -198,7 +255,7 @@ export function installExactRuntime(version, {
           KLYPIX_MCP_AUTO_UPDATE_CHILD: '1',
         },
         stdio: 'ignore',
-        shell: process.platform === 'win32',
+        shell: false,
         windowsHide: true,
       });
     } catch (error) {

package/src/mcp-supervisor.mjs

@@ -21,11 +21,10 @@ import os from 'os';
 import path from 'path';
 import crypto from 'crypto';
 import { spawn } from 'child_process';
-import { fileURLToPath } from 'url';
 import {
-  AUTO_UPDATE_WORKER_ARG,
   autoUpdateEnabled,
   inspectAutoUpdate,
+  spawnAutoUpdateHelper,
 } from './mcp-auto-update.mjs';
 
 const INTERNAL_PREFIX = '__klypix_supervisor__';
@@ -705,29 +704,10 @@ class Supervisor {
 
   scheduleAutoUpdate() {
     if (this.closed || !this.autoUpdate || process.env.KLYPIX_MCP_AUTO_UPDATE_CHILD === '1') return;
-    const brainDir = path.dirname(this.runtimeManifest);
-    const status = inspectAutoUpdate(brainDir);
-    if (!status.due) return;
-    try {
-      const helper = fileURLToPath(new URL('./mcp-auto-update.mjs', import.meta.url));
-      const child = spawn(process.execPath, [helper, AUTO_UPDATE_WORKER_ARG], {
-        // Do not hold the managed directory as this detached process's cwd.
-        // This matters for ephemeral/test homes on Windows and is cleaner for
-        // uninstallers; the installer receives its exact target through env.
-        cwd: os.tmpdir(),
-        env: {
-          ...process.env,
-          KLYPIX_MCP_AUTO_UPDATE_DIR: brainDir,
-          KLYPIX_MCP_AUTO_UPDATE_CURRENT: String(this.active?.version || this.fallbackTarget.version || ''),
-          KLYPIX_MCP_AUTO_UPDATE_CHILD: '1',
-        },
-        detached: true,
-        stdio: 'ignore',
-        windowsHide: true,
-      });
-      child.on('error', () => { /* fail-open: the MCP transport remains healthy */ });
-      child.unref();
-    } catch { /* update discovery must never affect MCP */ }
+    spawnAutoUpdateHelper({
+      brainDir: path.dirname(this.runtimeManifest),
+      currentVersion: this.active?.version || this.fallbackTarget.version,
+    });
   }
 
   flushHostQueue() {