mnemos-capture 1.4.0 → 1.5.0

package/README.md

@@ -1,9 +1,9 @@
 <div align="center">
   <br>
-  <a href="https://mnemos-capture.vercel.app">
+  <a href="https://xkg.xmu.sh">
     <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="public/mnemos-hero-dark.gif">
-      <img src="public/mnemos-hero-light.gif" width="160" height="160" alt="xkg">
+      <source media="(prefers-color-scheme: dark)" srcset="public/xkg-hero-dark.gif">
+      <img src="public/xkg-hero-light.gif" width="160" height="160" alt="xkg">
     </picture>
   </a>
   <br>
@@ -53,7 +53,7 @@ You find useful stuff, you capture through the web app, then xkg connects it int
 xkg will continuously compound that knowledge over time — keeping AI workers' context up to date as human knowledge evolves.
 
 > [!IMPORTANT]
-> We are migrating from **mnemos** / **Xmu** to **xkg**. The app URL, this GitHub repo, and the npm package still say `mnemos-capture`. Sorry for the inconvenience.
+> We are migrating from **mnemos** / **Xmu** to **xkg**. The app now lives at [xkg.xmu.sh](https://xkg.xmu.sh) and the code at [xmu-labs/xkg](https://github.com/xmu-labs/xkg). Connectors set up with `mnemos-capture.vercel.app` keep working. The npm package still says `mnemos-capture`. Sorry for the inconvenience.
 
 ## Start here
 
@@ -61,7 +61,7 @@ You do not need a terminal to start.
 
 ### 1. Create your account
 
-Open **[mnemos-capture.vercel.app](https://mnemos-capture.vercel.app)** and sign in with GitHub.
+Open **[xkg.xmu.sh](https://xkg.xmu.sh)** and sign in with GitHub.
 
 xkg will:
 
@@ -91,7 +91,7 @@ xkg is LLM-agnostic. Any worker that speaks MCP can use the same knowledge.
 Two primitives:
 
 ```text
-https://mnemos-capture.vercel.app/api/mcp
+https://xkg.xmu.sh/api/mcp
 ```
 
 ```bash
@@ -104,7 +104,7 @@ The CLI binary is **`xkg`** (also `xmu` and `mnemos-capture`). `npx` still uses
 
 ### On the web
 
-Name the connector `xkg`, paste `https://mnemos-capture.vercel.app/api/mcp`, sign in with GitHub when asked.
+Name the connector `xkg`, paste `https://xkg.xmu.sh/api/mcp`, sign in with GitHub when asked.
 
 #### Claude
 
@@ -114,7 +114,7 @@ Name the connector `xkg`, paste `https://mnemos-capture.vercel.app/api/mcp`, sig
 
 1. Settings → Plugins → Browse plugins
 2. Name it xkg
-3. Paste `https://mnemos-capture.vercel.app/api/mcp`
+3. Paste `https://xkg.xmu.sh/api/mcp`
 4. Sign in with GitHub when asked
 
 #### Grok
@@ -192,7 +192,7 @@ claude mcp add xkg -- npx -y mnemos-capture@latest serve-mcp --key YOUR_API_KEY
 Or the URL, no API key:
 
 ```bash
-claude mcp add --transport http xkg https://mnemos-capture.vercel.app/api/mcp
+claude mcp add --transport http xkg https://xkg.xmu.sh/api/mcp
 ```
 
 Optional session hooks (MCP works without them):
@@ -233,7 +233,7 @@ If the tool can launch a local process, register the same `npx` command. If it h
 }
 ```
 
-No MCP support yet? Capture in the [xkg app](https://mnemos-capture.vercel.app) and connect later.
+No MCP support yet? Capture in the [xkg app](https://xkg.xmu.sh) and connect later.
 
 ## Workflow
 
@@ -249,7 +249,7 @@ No MCP support yet? Capture in the [xkg app](https://mnemos-capture.vercel.app)
    capture "The Mom Test: don't ask if your idea is good. Ask about the person's real behavior, current workflow, and past spending."
    ```
 
-2. **Brief** — At the start of a work session, ask your worker for a briefing. xkg looks at your project (branch, recent commits, `CLAUDE.md`, repo context) and ranks captures that could help now: **why** it matters, **what** applying it could achieve, **where** it could land. You decide what to apply.
+2. **Brief** — At the start of a work session, ask your worker for a briefing. xkg uses your project name, branch, and recent commit messages to rank captures that could help now: **why** it matters, **what** applying it could achieve, **where** it could land. Local agent instruction files are not read or uploaded by the CLI hooks. You decide what to apply.
 
 3. **Plan** — Select the captures you want and ask your worker to call `generate_plan`. Each plan is Markdown: codebase mapping, implementation steps with effort tiers (`simple`, `complex`, `architectural`), and a verification checklist.
 
@@ -428,12 +428,12 @@ Working on the code? See [CONTRIBUTING.md](CONTRIBUTING.md).
 If you use xkg in published work:
 
 ```bibtex
-@misc{2026mnemos,
+@misc{2026xkg,
   title        = {xkg: A Knowledge Graph for AI workers},
   author       = {Sofia Padron Valdez},
   year         = 2026,
   journal      = {GitHub repository},
   publisher    = {GitHub},
-  howpublished = {\url{https://github.com/Soph20/mnemos-capture}}
+  howpublished = {\url{https://github.com/xmu-labs/xkg}}
 }
 ```

package/dist/cli/hooks.js

@@ -2,14 +2,14 @@ import { homedir, tmpdir } from "os";
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { execSync } from "child_process";
-const HOSTED_URL = "https://mnemos-capture.vercel.app/api/mcp";
+const HOSTED_URL = "https://xkg.xmu.sh/api/mcp";
 const CLAUDE_SETTINGS_PATH = join(homedir(), ".claude", "settings.json");
 // Matches both legacy ("mnemos-capture inbox-check") and modern
 // ("mnemos-capture@latest inbox-check") hook command forms.
-function isMnemosHook(cmd) {
+function isXkgHook(cmd) {
     return cmd.includes("mnemos-capture") && cmd.includes("inbox-check");
 }
-function isMnemosPreToolHook(cmd) {
+function isXkgPreToolHook(cmd) {
     return cmd.includes("mnemos-capture") && cmd.includes("vault-check");
 }
 function readSettings() {
@@ -73,11 +73,11 @@ export function setupHooks(apiKey, opts = {}) {
     const settings = readSettings();
     const hooks = settings.hooks ?? {};
     const sessionStart = hooks.SessionStart ?? [];
-    // Inspect any existing mnemos hook so we can either skip, migrate, or replace
+    // Inspect any existing xkg hook so we can either skip, migrate, or replace
     let existingCmd = null;
     for (const group of sessionStart) {
         for (const h of group.hooks ?? []) {
-            if (typeof h.command === "string" && isMnemosHook(h.command)) {
+            if (typeof h.command === "string" && isXkgHook(h.command)) {
                 existingCmd = h.command;
                 break;
             }
@@ -97,11 +97,11 @@ export function setupHooks(apiKey, opts = {}) {
     const command = opts.briefing
         ? `npx -y mnemos-capture@latest inbox-check --key ${apiKey} --briefing`
         : `npx -y mnemos-capture@latest inbox-check --key ${apiKey}`;
-    // Remove any existing mnemos inbox-check hook (handles key rotation too)
+    // Remove any existing xkg inbox-check hook (handles key rotation too)
     const filtered = sessionStart
         .map((group) => ({
         ...group,
-        hooks: (group.hooks ?? []).filter((h) => !(typeof h.command === "string" && isMnemosHook(h.command))),
+        hooks: (group.hooks ?? []).filter((h) => !(typeof h.command === "string" && isXkgHook(h.command))),
     }))
         .filter((group) => (group.hooks ?? []).length > 0);
     filtered.push({ hooks: [{ type: "command", command }] });
@@ -128,7 +128,7 @@ export function setupPreToolHook(apiKey, opts = {}) {
     let existingCmd = null;
     for (const group of preToolCall) {
         for (const h of group.hooks ?? []) {
-            if (typeof h.command === "string" && isMnemosPreToolHook(h.command)) {
+            if (typeof h.command === "string" && isXkgPreToolHook(h.command)) {
                 existingCmd = h.command;
                 break;
             }
@@ -144,7 +144,7 @@ export function setupPreToolHook(apiKey, opts = {}) {
     const filtered = preToolCall
         .map((group) => ({
         ...group,
-        hooks: (group.hooks ?? []).filter((h) => !(typeof h.command === "string" && isMnemosPreToolHook(h.command))),
+        hooks: (group.hooks ?? []).filter((h) => !(typeof h.command === "string" && isXkgPreToolHook(h.command))),
     }))
         .filter((group) => (group.hooks ?? []).length > 0);
     filtered.push({ hooks: [{ type: "command", command }] });
@@ -187,14 +187,7 @@ function detectProjectContext() {
             parts.push(`Recent commits:\n${log}`);
     }
     catch { }
-    // CLAUDE.md — first 800 chars gives the model real project intent
-    try {
-        const root = run("git rev-parse --show-toplevel");
-        const claudeMd = readFileSync(join(root, "CLAUDE.md"), "utf-8").slice(0, 800).trim();
-        if (claudeMd)
-            parts.push(`Project instructions (CLAUDE.md excerpt):\n${claudeMd}`);
-    }
-    catch { }
+    // Local agent instructions may contain private maintainer notes; do not upload them.
     return parts.length > 0 ? parts.join("\n\n") : "current project";
 }
 export async function callMcp(apiKey, toolName, toolArgs, timeoutMs = 15000) {

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const HOSTED_URL = "https://mnemos-capture.vercel.app";
+const HOSTED_URL = "https://xkg.xmu.sh";
 async function main() {
     const args = process.argv.slice(2);
     const command = args[0];

package/dist/cli/kos.js

@@ -1,14 +1,14 @@
 /**
- * kos — mnemos' Knowledge Operations orchestrator.
+ * kos — xkg's Knowledge Operations orchestrator.
  *
  * Drives whatever AI assistant the user configured (`xkg config set agent ...`)
- * to implement a generated plan in an isolated git worktree. mnemos owns the
+ * to implement a generated plan in an isolated git worktree. xkg owns the
  * harness-independent parts: fetching the plan, the worktree, and reporting the
  * Verification Checklist. The assistant is a black box — model-agnostic by design.
  */
 import { tmpdir } from "os";
-import { join } from "path";
-import { writeFileSync, existsSync, appendFileSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { writeFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { execSync } from "child_process";
 import { callMcp } from "./hooks.js";
 import { readConfig } from "./config.js";
@@ -39,14 +39,53 @@ export function parseChecklist(planText) {
 /** Build a unique, sortable branch name for a kos run. */
 export function buildKosBranch(now = new Date()) {
     const stamp = now.toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, 19);
-    return `mnemos/kos-${stamp}`;
+    return `xkg/kos-${stamp}`;
 }
+/** Where kos drops the plan inside the worktree. Never committed — see excludePlanFiles. */
+export const PLAN_FILE = "XKG_PLAN.md";
+/** Plan filenames written by earlier releases; still excluded so an old worktree can't leak one. */
+const LEGACY_PLAN_FILES = ["MNEMOS_PLAN.md"];
 /** The instruction handed to the assistant. The plan file is the real contract. */
-export const KOS_PROMPT = "Implement the plan in MNEMOS_PLAN.md in this repository. " +
+export const KOS_PROMPT = `Implement the plan in ${PLAN_FILE} in this repository. ` +
     "Follow the Codebase Mapping table exactly — change only the files it lists. " +
     "For each step apply the thinking effort named in its Effort column " +
     "(low = quick/mechanical, medium = careful, high = deep reasoning). " +
-    "When finished, make sure every item in the Verification Checklist is satisfied.";
+    "When finished, make sure every item in the Verification Checklist is satisfied. " +
+    `${PLAN_FILE} is private: never commit, push, or copy it into another file.`;
+/**
+ * Return the exclude-file contents with every plan filename present, or null if
+ * nothing needs adding. Pure so the matching can be tested without a repo.
+ */
+export function withPlanExcludes(current) {
+    const lines = new Set(current.split(/\r?\n/).map((l) => l.trim()));
+    const missing = [PLAN_FILE, ...LEGACY_PLAN_FILES].filter((f) => !lines.has(f) && !lines.has(`/${f}`));
+    if (missing.length === 0)
+        return null;
+    const sep = current === "" || current.endsWith("\n") ? "" : "\n";
+    return `${current}${sep}${missing.join("\n")}\n`;
+}
+/**
+ * Keep plan files out of git for this repository and all its worktrees.
+ *
+ * Asks git for the exclude path instead of assuming `<root>/.git/info/exclude`:
+ * in a linked worktree or a submodule `.git` is a file, so the assumed path does
+ * not exist and the plan would be silently committed by the agent's `git add`.
+ * Throws rather than continuing unprotected — a plan can carry private context.
+ */
+export function excludePlanFiles(worktreePath) {
+    const excludePath = resolve(worktreePath, run("git rev-parse --git-path info/exclude", worktreePath));
+    mkdirSync(dirname(excludePath), { recursive: true });
+    const current = existsSync(excludePath) ? readFileSync(excludePath, "utf-8") : "";
+    const next = withPlanExcludes(current);
+    if (next !== null)
+        writeFileSync(excludePath, next);
+    try {
+        run(`git check-ignore -q ${PLAN_FILE}`, worktreePath);
+    }
+    catch {
+        throw new Error(`git would track ${PLAN_FILE} (exclude file: ${excludePath})`);
+    }
+}
 // ── Orchestrator ──
 function run(cmd, cwd) {
     return execSync(cmd, { cwd, stdio: ["pipe", "pipe", "pipe"] }).toString().trim();
@@ -86,19 +125,18 @@ export async function kos(apiKey, opts = {}) {
     const worktreePath = join(tmpdir(), branch.replace(/\//g, "-"));
     console.log(`Creating isolated worktree on branch ${branch}...`);
     run(`git worktree add -b ${branch} "${worktreePath}"`, repoRoot);
-    // 4. Drop the plan in and keep git from tracking it (local exclude, not committed)
-    writeFileSync(join(worktreePath, "MNEMOS_PLAN.md"), planText);
+    // 4. Keep git from tracking the plan (local exclude, not committed), then drop it in.
+    //    Exclude first: if that fails, the plan is never written where git can see it.
     try {
-        const excludePath = join(repoRoot, ".git", "info", "exclude");
-        if (existsSync(excludePath)) {
-            const current = readFileSync(excludePath, "utf-8");
-            if (!current.includes("MNEMOS_PLAN.md"))
-                appendFileSync(excludePath, "\nMNEMOS_PLAN.md\n");
-        }
+        excludePlanFiles(worktreePath);
     }
-    catch {
-        // best-effort
+    catch (err) {
+        console.error(`Could not keep ${PLAN_FILE} out of git, so kos stopped before writing it.`);
+        console.error(err instanceof Error ? err.message : String(err));
+        console.error(`The empty worktree is at ${worktreePath}.`);
+        process.exit(1);
     }
+    writeFileSync(join(worktreePath, PLAN_FILE), planText);
     // 5. Hand off to the user's assistant, running inside the worktree
     console.log(`Launching: ${cfg.agent}\n`);
     try {

package/dist/cli/mcp-server.js

@@ -1,6 +1,6 @@
 // MCP server that runs locally via stdio and proxies to the hosted API.
 // Used by Claude Code: claude mcp add xkg -- npx mnemos-capture serve-mcp --key <api-key>
-const DEFAULT_HOSTED_URL = "https://mnemos-capture.vercel.app/api/mcp";
+const DEFAULT_HOSTED_URL = "https://xkg.xmu.sh/api/mcp";
 /** Override for pointing the proxy at a local instance during development. */
 const HOSTED_URL = process.env.XKG_API_URL ?? process.env.XMU_API_URL ?? process.env.MNEMOS_API_URL ?? DEFAULT_HOSTED_URL;
 function sendMessage(msg) {
@@ -74,7 +74,7 @@ export async function serveMcp() {
     if (!apiKey) {
         process.stderr.write("\nxkg MCP server requires an API key.\n");
         process.stderr.write("Usage: npx -y mnemos-capture@latest serve-mcp --key <your-api-key>\n\n");
-        process.stderr.write("Get your API key at: https://mnemos-capture.vercel.app/onboard\n\n");
+        process.stderr.write("Get your API key at: https://xkg.xmu.sh/onboard\n\n");
         process.exit(1);
     }
     // Self-upgrade: if a newer version exists on npm, respawn via npx @latest.

package/dist/cli/version-check.js

@@ -1,8 +1,9 @@
-// Self-update enforcement: ensures users always run the latest mnemos-capture.
+// Self-update enforcement: ensures users always run the latest xkg CLI.
 //
 // Strategy: on serve-mcp startup, query npm for the latest published version.
 // If behind, respawn the process via `npx -y mnemos-capture@latest` and proxy
-// stdio. A MNEMOS_UPGRADED=1 env var prevents infinite recursion.
+// stdio. An XKG_UPGRADED=1 env var (MNEMOS_UPGRADED=1 from releases before
+// 1.4.1) prevents infinite recursion.
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
@@ -52,8 +53,9 @@ async function getLatestVersion() {
  * continue with normal startup.
  */
 export async function maybeSelfUpgrade() {
-    // Recursion guard: the child spawned below will inherit this env var.
-    if (process.env.MNEMOS_UPGRADED === "1")
+    // Recursion guard: the child spawned below will inherit this env var. Older
+    // releases set MNEMOS_UPGRADED, and may be the parent that spawned this one.
+    if (process.env.XKG_UPGRADED === "1" || process.env.MNEMOS_UPGRADED === "1")
         return false;
     const current = getCurrentVersion();
     const latest = await getLatestVersion();
@@ -62,7 +64,7 @@ export async function maybeSelfUpgrade() {
     process.stderr.write(`xkg: upgrading to v${latest} (was v${current})...\n`);
     const child = spawn("npx", ["-y", `mnemos-capture@${latest}`, ...process.argv.slice(2)], {
         stdio: "inherit",
-        env: { ...process.env, MNEMOS_UPGRADED: "1" },
+        env: { ...process.env, XKG_UPGRADED: "1" },
     });
     // Keep parent alive until the child exits, then exit with its code.
     await new Promise((resolve) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mnemos-capture",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "xkg — Turn what you discover into context your AI workers can use. Capture once, then brief, plan, and execute with any MCP-compatible tool.",
   "type": "module",
   "bin": {
@@ -38,16 +38,16 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Soph20/mnemos-capture.git"
+    "url": "https://github.com/xmu-labs/xkg.git"
   },
-  "homepage": "https://github.com/Soph20/mnemos-capture",
+  "homepage": "https://github.com/xmu-labs/xkg",
   "files": [
     "dist/cli/",
     "LICENSE",
     "README.md"
   ],
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.127.0",
+    "@anthropic-ai/sdk": "^0.133.0",
     "@vercel/postgres": "^0.10.0",
     "next": "^16.3.5",
     "react": "^19.3.0",