persnally 2.0.0 → 2.0.2

package/README.md

@@ -1,7 +1,5 @@
 # Persnally
 
-[![CI](https://github.com/sidpan2011/persnally/actions/workflows/ci.yml/badge.svg)](https://github.com/sidpan2011/persnally/actions/workflows/ci.yml)
-
 **So every AI finally knows you.**
 
 Persnally is a local-first personal context engine. It learns who you are from your AI activity — your Claude and ChatGPT history, your code — and serves that context to every AI tool you use, so they stop treating you like a stranger.
@@ -20,15 +18,24 @@ The fix isn't a better model. It's a layer underneath all of them that holds *yo
 
 ```bash
 npm install -g persnally
+persnally setup
+```
+
+One command builds your mirror: it finds Claude/ChatGPT exports in `~/Downloads`, reads your local Claude Code sessions and git repos, synthesizes an evidence-linked profile, connects your AI clients (Claude Desktop, Claude Code, Cursor), and opens the dashboard.
+
+For the richest result, export your data first ([claude.ai](https://claude.com) / [chatgpt.com](https://chatgpt.com) → Settings → Data export) and drop it in `~/Downloads` — then read a description of yourself that's sharper than your own bio, every sentence traceable to the conversations it came from.
+
+Prefer each step explicit?
+
+```bash
 persnallyd start                      # the local daemon
 persnallyd import claude ~/Downloads/<your-claude-export>
+persnallyd import claude-code         # your local Claude Code sessions
 persnallyd import git ~/Projects      # offline, no API needed
 persnallyd profile                    # synthesize who you are
 open http://127.0.0.1:4983            # see it, with evidence for every claim
 ```
 
-Export your data ([claude.ai](https://claude.com) / [chatgpt.com](https://chatgpt.com) → Settings → Data export), point Persnally at it, and read a description of yourself that's sharper than your own bio — every sentence traceable to the conversations it came from.
-
 ## How it works
 
 ```
@@ -50,7 +57,11 @@ Export your data ([claude.ai](https://claude.com) / [chatgpt.com](https://chatgp
 
 ## Make your AI tools use it
 
-Add the MCP server to any client (Claude Desktop, Cursor, Claude Code). It exposes four tools backed by the daemon:
+```bash
+persnallyd connect --all     # writes the MCP config for Claude Desktop, Claude Code, Cursor
+```
+
+Or add the MCP server to any client manually. It exposes four tools backed by the daemon:
 
 | Tool | What it does |
 |------|-------------|
@@ -74,10 +85,14 @@ Add the MCP server to any client (Claude Desktop, Cursor, Claude Code). It expos
 ## CLI
 
 ```
-persnallyd start | stop | status        # daemon lifecycle
+persnally setup                          # one command: import, synthesize, connect
+persnallyd start | stop | status         # daemon lifecycle
 persnallyd autostart [--remove]          # run at login (macOS)
-persnallyd import claude|chatgpt|git <path>
+persnallyd connect [client|--all]        # add to claude-code | claude-desktop | cursor
+persnallyd import claude|claude-code|chatgpt|git <path>
+persnallyd scope <client> <categories>   # limit what a client can read
 persnallyd profile                       # synthesize the profile
+persnallyd consolidate                   # reflect now: refresh decay, add behavior patterns
 persnallyd show [topics|events|profile]
 persnallyd forget <topic> | --all | --batch <id>
 persnallyd config set-key <sk-ant-…>     # key for the background daemon
@@ -85,7 +100,7 @@ persnallyd config set-key <sk-ant-…>     # key for the background daemon
 
 ## Status
 
-Early and moving fast — see [ROADMAP.md](./ROADMAP.md). Today: import from Claude/ChatGPT/git, a decay-weighted interest graph, an evidence-linked profile, a local dashboard, and the MCP layer that serves it all. Next: cross-tool context everywhere, then a behavior model that can answer *what would I do here?*
+Early and moving fast — see [ROADMAP.md](./ROADMAP.md). Today: import from Claude, ChatGPT, Claude Code, and git; a decay-weighted interest graph; an evidence-linked profile; a local dashboard; per-client permission scoping; nightly consolidation; and the MCP layer that serves it all. Next: cross-tool context everywhere, then a behavior model that can answer *what would I do here?*
 
 ## License
 

package/build/src/config.js

@@ -22,7 +22,9 @@ export function saveConfig(updates) {
     const file = configFile();
     mkdirSync(dirname(file), { recursive: true });
     const merged = { ...loadConfig(), ...updates };
-    writeFileSync(file, JSON.stringify(merged, null, 2) + "\n");
+    // mode on create closes the world-readable window before chmod; chmod also
+    // corrects perms on a pre-existing file. The config holds the API key.
+    writeFileSync(file, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
     chmodSync(file, 0o600);
 }
 /** Env wins over config; sets process.env so the Anthropic SDK picks it up. */

package/build/src/connect.js

@@ -37,9 +37,17 @@ export function connectClient(client) {
     const { file, installed } = configPathFor(client);
     if (!installed)
         return null;
-    const cfg = existsSync(file)
-        ? JSON.parse(readFileSync(file, "utf-8"))
-        : {};
+    let cfg = {};
+    if (existsSync(file)) {
+        try {
+            cfg = JSON.parse(readFileSync(file, "utf-8"));
+        }
+        catch {
+            // Never overwrite a config we couldn't parse — that would wipe the user's
+            // other MCP servers. Surface it instead.
+            throw new Error(`${file} is not valid JSON — fix it, then run \`persnallyd connect ${client}\` again`);
+        }
+    }
     const servers = (cfg.mcpServers ??= {});
     servers.persnally = { command: "node", args: [mcpServerPath()] };
     mkdirSync(dirname(file), { recursive: true });
@@ -47,5 +55,14 @@ export function connectClient(client) {
     return file;
 }
 export function connectAll() {
-    return CLIENTS.map((client) => ({ client, file: connectClient(client) }));
+    // One client with a malformed existing config must not abort onboarding for
+    // the others; connectClient throws rather than clobber a file it can't parse.
+    return CLIENTS.map((client) => {
+        try {
+            return { client, file: connectClient(client) };
+        }
+        catch {
+            return { client, file: null };
+        }
+    });
 }

package/build/src/lifecycle.js

@@ -79,6 +79,9 @@ export function autostartInstalled() {
 export function installAutostart(cliPath, port) {
     if (process.platform !== "darwin")
         throw new Error("autostart is macOS-only for now (launchd)");
+    // Paths carry the username/home dir; escape so an "&" or "<" in a path can't
+    // produce a malformed plist that silently breaks autostart.
+    const x = xmlEscape;
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -86,16 +89,16 @@ export function installAutostart(cliPath, port) {
   <key>Label</key><string>${PLIST_LABEL}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${process.execPath}</string>
-    <string>${cliPath}</string>
+    <string>${x(process.execPath)}</string>
+    <string>${x(cliPath)}</string>
     <string>serve</string>
     <string>--port</string>
-    <string>${port}</string>
+    <string>${x(String(port))}</string>
   </array>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${LOG_FILE}</string>
-  <key>StandardErrorPath</key><string>${LOG_FILE}</string>
+  <key>StandardOutPath</key><string>${x(LOG_FILE)}</string>
+  <key>StandardErrorPath</key><string>${x(LOG_FILE)}</string>
 </dict>
 </plist>
 `;
@@ -117,3 +120,6 @@ export function removeAutostart() {
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+function xmlEscape(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" }[c]));
+}

package/build/src/mcp/index.js

@@ -7,13 +7,16 @@
  * NLP engine: it fills persnally_track's structured schema from conversation
  * context, so signal extraction costs zero extra inference.
  */
+import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { DAEMON_HINT, DaemonUnreachable, daemonDelete, daemonGet, daemonPost } from "./daemon-client.js";
 import { migrateV1Graph } from "./migrate-v1.js";
 import { getClient, logEvent, setClient } from "./telemetry.js";
-const server = new McpServer({ name: "persnally", version: "2.0.0" });
+// Handshake version tracks package.json — same rule as the daemon's VERSION.
+const pkg = JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf-8"));
+const server = new McpServer({ name: "persnally", version: pkg.version });
 function text(s) {
     return { content: [{ type: "text", text: s }] };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "persnally",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "license": "FSL-1.1-MIT",
   "description": "The context engine for you — local-first, across every AI. So every AI finally knows you.",
   "type": "module",