persnally 2.0.2 → 2.1.0

package/build/src/cli.js

@@ -8,7 +8,7 @@ import { existsSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { applyApiKey, configPath, loadConfig, saveConfig } from "./config.js";
-import { CLIENTS, connectAll, connectClient } from "./connect.js";
+import { CLIENTS, connectAll, connectClient, installClaudeCodeHook } from "./connect.js";
 import { runConsolidation } from "./consolidate.js";
 import { chooseExtractor } from "./llm.js";
 import { CATEGORIES, clearScope, loadScopes, setScope } from "./permissions.js";
@@ -19,6 +19,7 @@ import { extractClaudeEvents, parseClaudeExport } from "./importers/claude.js";
 import { DEFAULT_TRANSCRIPTS_DIR, extractClaudeCodeEvents, parseClaudeCodeTranscripts, } from "./importers/claude-code.js";
 import { gitEvents, scanRepos } from "./importers/git.js";
 import { autostartInstalled, installAutostart, LOG_FILE, removeAutostart, removePidFile, runningPid, startDetached, stopDaemon, writePidFile, } from "./lifecycle.js";
+import { newEvent } from "./events.js";
 import { renderProfile, synthesizeProfile } from "./profile.js";
 import { DEFAULT_DB_PATH, EventStore } from "./store.js";
 const USAGE = `persnallyd ${VERSION} — so every AI finally knows you
@@ -36,6 +37,7 @@ Usage:
   persnallyd profile                Synthesize your profile from the store
   persnallyd consolidate            Reflect now: refresh decay, add behavior patterns, re-synthesize
   persnallyd show [topics|events|profile]   Show topics (default), recent events, or the profile
+  persnallyd context [--full]       Emit profile + interests for AI injection (records a context read)
   persnallyd forget <topic>         Hard-delete a topic and everything derived from it
   persnallyd forget --all           Delete all data
   persnallyd forget --batch <id>    Undo one import batch
@@ -150,9 +152,19 @@ async function main() {
             }
             store.close();
             // 6. AI clients
-            for (const { client, file } of connectAll()) {
+            const connections = connectAll();
+            for (const { client, file } of connections) {
                 console.log(file ? `✓ Connected ${client}` : `· ${client} not installed — skipped`);
             }
+            if (connections.some((r) => r.client === "claude-code" && r.file)) {
+                try {
+                    installClaudeCodeHook();
+                    console.log("✓ Context hook installed (injects on every Claude Code session)");
+                }
+                catch (e) {
+                    console.error(`· Context hook skipped: ${e instanceof Error ? e.message : e}`);
+                }
+            }
             console.log(`\nDone${imported ? ` — ${imported} events imported` : ""}. Dashboard: http://127.0.0.1:${port}`);
             if (process.platform === "darwin" && process.stdout.isTTY) {
                 try {
@@ -197,6 +209,15 @@ async function main() {
             for (const { client, file } of results) {
                 console.log(file ? `Connected ${client} (${file})` : `${client} not installed — skipped`);
             }
+            // Claude Code also gets a SessionStart hook so every session injects context automatically.
+            if (results.some((r) => r.client === "claude-code" && r.file)) {
+                try {
+                    console.log(`Installed Claude Code context hook (${installClaudeCodeHook()})`);
+                }
+                catch (e) {
+                    console.error(`Context hook not installed: ${e instanceof Error ? e.message : e}`);
+                }
+            }
             return;
         }
         case "config": {
@@ -304,6 +325,50 @@ async function main() {
             store.close();
             return;
         }
+        case "context": {
+            // Serving path for the SessionStart hook: emit profile + interests for
+            // injection AND record the read, so hook injections count toward the
+            // context-reads metric exactly like the MCP persnally_context tool. `show`
+            // stays side-effect-free so manual inspection never inflates the metric.
+            const full = args.includes("--full");
+            const hook = args.includes("--hook");
+            const store = new EventStore();
+            const profile = store.getProfile();
+            const topics = store.topics(full ? 25 : 12);
+            if (!profile && !topics.length) {
+                store.close();
+                return;
+            }
+            const out = [];
+            let items = topics.length;
+            if (profile) {
+                out.push("# About the user", profile.headline, "");
+                const sections = full ? profile.sections : profile.sections.slice(0, 3);
+                items += sections.length;
+                for (const s of sections)
+                    out.push(`## ${s.title}`, s.body, "");
+            }
+            if (topics.length) {
+                out.push("# Current interests (decay-weighted)");
+                for (const t of topics) {
+                    out.push(`- ${t.topic} (${t.category}, ${t.dominant_intent}, weight ${t.weight.toFixed(2)})`);
+                }
+            }
+            // Recording must never break the injection itself (mirrors MCP recordRead).
+            try {
+                store.append([newEvent("context.read", "cli", { scope: full ? "full" : "brief", client_purpose: hook ? "session-start hook" : "cli context read", items }, { kind: "local", surface: "cli" })]);
+            }
+            catch (e) {
+                console.error("persnally: context.read not recorded:", e instanceof Error ? e.message : e);
+            }
+            store.close();
+            const rendered = out.join("\n");
+            // --hook emits the SessionStart envelope itself, so the installed hook needs no jq.
+            console.log(hook
+                ? JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: rendered } })
+                : rendered);
+            return;
+        }
         case "forget": {
             const store = new EventStore();
             if (args[0] === "--all") {
@@ -384,6 +449,11 @@ async function main() {
             };
             process.on("SIGTERM", shutdown);
             process.on("SIGINT", shutdown);
+            // An always-on daemon must not die silently on a stray error. Log a
+            // rejection and keep serving; on an uncaught exception the process state
+            // is undefined — log and exit so the supervisor (launchd) restarts clean.
+            process.on("unhandledRejection", (e) => console.error("unhandledRejection:", e));
+            process.on("uncaughtException", (e) => { console.error("uncaughtException:", e); process.exit(1); });
             console.error(`persnallyd v${VERSION} listening on 127.0.0.1:${port}`);
             console.error(`Dashboard: http://127.0.0.1:${port}`);
             return;

package/build/src/config.js

@@ -3,7 +3,7 @@
  * key, so the launchd-run daemon (no shell env) can synthesize. Unknown fields
  * are preserved (the file predates v2). Saved with owner-only permissions.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { DATA_DIR } from "./paths.js";
 // Resolved at call time so PERSNALLY_DIR overrides work in-process (tests), not just for subprocesses.
@@ -22,9 +22,13 @@ export function saveConfig(updates) {
     const file = configFile();
     mkdirSync(dirname(file), { recursive: true });
     const merged = { ...loadConfig(), ...updates };
-    // mode on create closes the world-readable window before chmod; chmod also
-    // corrects perms on a pre-existing file. The config holds the API key.
-    writeFileSync(file, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+    // Atomic write: a crash mid-write must never leave a truncated config —
+    // that would silently drop the API key and all scopes (loadConfig swallows
+    // parse errors). Write to a temp file, then rename (atomic on one fs).
+    // mode 0600 on create + chmod keeps the key owner-only through the swap.
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+    renameSync(tmp, file);
     chmodSync(file, 0o600);
 }
 /** Env wins over config; sets process.env so the Anthropic SDK picks it up. */

package/build/src/connect.d.ts

@@ -7,6 +7,13 @@ export type Client = (typeof CLIENTS)[number];
 export declare function mcpServerPath(): string;
 /** Returns the config file written, or null when the client isn't installed. */
 export declare function connectClient(client: Client): string | null;
+/**
+ * Installs (or upgrades) the Persnally SessionStart hook in Claude Code's user
+ * settings so every session injects the user's context. Merges into existing
+ * settings, leaves other tools' hooks untouched, and is idempotent: a prior
+ * Persnally entry (including the old `show topics` form) is replaced, not duplicated.
+ */
+export declare function installClaudeCodeHook(): string;
 export declare function connectAll(): {
     client: Client;
     file: string | null;

package/build/src/connect.js

@@ -2,10 +2,17 @@
  * Writes the Persnally MCP server into AI clients' configs.
  * Only touches clients that are actually installed; merges, never clobbers.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 export const CLIENTS = ["claude-code", "claude-desktop", "cursor"];
+/** Write JSON via temp file + rename: a crash mid-write can't corrupt the user's config. */
+function writeJsonAtomic(file, cfg) {
+    mkdirSync(dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(cfg, null, 2) + "\n");
+    renameSync(tmp, file);
+}
 function configPathFor(client) {
     const home = homedir();
     switch (client) {
@@ -50,8 +57,36 @@ export function connectClient(client) {
     }
     const servers = (cfg.mcpServers ??= {});
     servers.persnally = { command: "node", args: [mcpServerPath()] };
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(cfg, null, 2) + "\n");
+    writeJsonAtomic(file, cfg);
+    return file;
+}
+// The hook self-renders the SessionStart envelope (`context --hook`), so no jq dependency.
+const SESSION_START_COMMAND = "persnallyd context --hook 2>/dev/null";
+/**
+ * Installs (or upgrades) the Persnally SessionStart hook in Claude Code's user
+ * settings so every session injects the user's context. Merges into existing
+ * settings, leaves other tools' hooks untouched, and is idempotent: a prior
+ * Persnally entry (including the old `show topics` form) is replaced, not duplicated.
+ */
+export function installClaudeCodeHook() {
+    const file = join(homedir(), ".claude", "settings.json");
+    let cfg = {};
+    if (existsSync(file)) {
+        try {
+            cfg = JSON.parse(readFileSync(file, "utf-8"));
+        }
+        catch {
+            throw new Error(`${file} is not valid JSON — fix it, then run \`persnallyd connect claude-code\` again`);
+        }
+    }
+    const hooks = (cfg.hooks ??= {});
+    const existing = Array.isArray(hooks.SessionStart) ? hooks.SessionStart : [];
+    const others = existing.filter((g) => !g.hooks?.some((h) => /persnall/i.test(h.command ?? "")));
+    others.push({
+        hooks: [{ type: "command", command: SESSION_START_COMMAND, timeout: 10, statusMessage: "Loading your Persnally context…" }],
+    });
+    hooks.SessionStart = others;
+    writeJsonAtomic(file, cfg);
     return file;
 }
 export function connectAll() {

package/build/src/daemon.js

@@ -11,6 +11,8 @@ import { newEvent, validateEvent } from "./events.js";
 import { chooseExtractor } from "./llm.js";
 import { synthesizeProfile } from "./profile.js";
 export const DEFAULT_PORT = 4983;
+const MAX_BODY_BYTES = 25 * 1024 * 1024; // generous for import batches; bounds memory
+const MAX_QUERY_LIMIT = 10_000; // ceiling for public ?limit= params
 // Single source of truth for the user-visible version: package.json.
 const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf-8"));
 export const VERSION = pkg.version;
@@ -143,17 +145,33 @@ function dashboardHtml() {
     return cachedHtml;
 }
 function json(res, status, body) {
-    res.writeHead(status, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(body));
+    // Never throw from the responder — the request socket may already be gone
+    // (e.g. an oversized body we destroyed), and a throw here would be unhandled.
+    if (res.headersSent || res.writableEnded)
+        return;
+    try {
+        res.writeHead(status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(body));
+    }
+    catch { /* socket closed mid-response */ }
 }
 function num(url, key, fallback) {
     const v = Number(url.searchParams.get(key));
-    return Number.isFinite(v) && v > 0 ? v : fallback;
+    return Number.isFinite(v) && v > 0 ? Math.min(v, MAX_QUERY_LIMIT) : fallback;
 }
 function readBody(req) {
     return new Promise((resolve, reject) => {
         let data = "";
-        req.on("data", (chunk) => (data += chunk));
+        let size = 0;
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error("request body too large"));
+                req.destroy();
+                return;
+            }
+            data += chunk;
+        });
         req.on("end", () => {
             try {
                 resolve(JSON.parse(data));

package/build/src/decay.js

@@ -15,7 +15,10 @@ export function topicWeight(signals, now = Date.now()) {
     let sentiment = 0;
     const intents = new Map();
     for (const s of signals) {
-        const days = Math.max((now - Date.parse(s.ts)) / MS_PER_DAY, 0);
+        const parsed = Date.parse(s.ts);
+        if (!Number.isFinite(parsed))
+            continue; // an unparseable ts must not turn the sum into NaN
+        const days = Math.max((now - parsed) / MS_PER_DAY, 0);
         sum += s.weight * (DEPTH_SCORES[s.depth] ?? 0.3) * Math.exp(-LAMBDA * days);
         sentiment += SENTIMENT_VALUES[s.sentiment] ?? 0;
         intents.set(s.intent, (intents.get(s.intent) ?? 0) + 1);

package/build/src/events.d.ts

@@ -176,5 +176,9 @@ export declare function validateEvent(raw: unknown): PersnallyEvent;
 export declare function newEvent(type: EventType, source: string, payload: Record<string, unknown>, provenance: Provenance, occurredAt?: string): PersnallyEvent;
 /** UUIDv7: 48-bit ms timestamp + random — time-ordered ids that merge cleanly across devices. */
 export declare function uuidv7(): string;
+/** A valid ISO timestamp from an untrusted value (import dates), or now if it
+    can't be parsed — `new Date(junk).toISOString()` throws, which would crash
+    a whole import mid-batch after paying for earlier extractions. */
+export declare function safeIso(value: unknown): string;
 /** Topic normalization, carried over from v1's interest engine (proven merge rules). */
 export declare function normalizeTopic(topic: string): string;

package/build/src/events.js

@@ -120,6 +120,13 @@ export function uuidv7() {
     const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
+/** A valid ISO timestamp from an untrusted value (import dates), or now if it
+    can't be parsed — `new Date(junk).toISOString()` throws, which would crash
+    a whole import mid-batch after paying for earlier extractions. */
+export function safeIso(value) {
+    const d = new Date(value);
+    return Number.isFinite(d.getTime()) ? d.toISOString() : new Date().toISOString();
+}
 /** Topic normalization, carried over from v1's interest engine (proven merge rules). */
 export function normalizeTopic(topic) {
     let key = topic.toLowerCase().trim();

package/build/src/importers/chatgpt.js

@@ -5,6 +5,7 @@
  */
 import { readFileSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { safeIso } from "../events.js";
 import { anthropicExtract, DEFAULT_EXTRACT_MODEL } from "../llm.js";
 import { extractEvents } from "./extract.js";
 export function parseChatGPTExport(path) {
@@ -23,7 +24,7 @@ export function parseChatGPTExport(path) {
             uuid: String(c.conversation_id ?? c.id ?? ""),
             name: String(c.title ?? ""),
             summary: "",
-            created_at: c.create_time ? new Date(c.create_time * 1000).toISOString() : new Date().toISOString(),
+            created_at: safeIso(c.create_time ? c.create_time * 1000 : undefined),
             userMessages,
         };
     });

package/build/src/importers/extract.js

@@ -3,7 +3,7 @@
  * Parsers produce a ParsedExport; this turns it into provenance-linked events.
  */
 import { z } from "zod";
-import { newEvent, uuidv7, PAYLOAD_SCHEMAS } from "../events.js";
+import { newEvent, safeIso, uuidv7, PAYLOAD_SCHEMAS } from "../events.js";
 import { anthropicExtract, DEFAULT_EXTRACT_MODEL } from "../llm.js";
 const MAX_CONVO_CHARS = 30_000;
 const topicsExtraction = z.object({ topics: z.array(PAYLOAD_SCHEMAS["signal.topic"]) });
@@ -23,7 +23,7 @@ export async function extractEvents(parsed, opts, extract = anthropicExtract, mo
         });
         const { topics } = topicsExtraction.parse(result);
         for (const t of topics) {
-            events.push(newEvent("signal.topic", opts.source, t, { kind: "import", batch, file: opts.file, conversation_uuid: convo.uuid }, new Date(convo.created_at).toISOString()));
+            events.push(newEvent("signal.topic", opts.source, t, { kind: "import", batch, file: opts.file, conversation_uuid: convo.uuid }, safeIso(convo.created_at)));
         }
     }
     if (parsed.memoryText.trim() || parsed.projects.length) {

package/build/src/importers/git.js

@@ -4,7 +4,7 @@
  * Carries forward the v1 skill_analyzer's framework-detection approach.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, join } from "node:path";
 import { newEvent, uuidv7 } from "../events.js";
 const FRAMEWORKS = {
@@ -81,6 +81,10 @@ export function scanRepos(path, authorEmail) {
     const direct = summarizeRepo(path, authorEmail);
     if (direct)
         return [direct];
+    // Not a repo — must be a folder of repos. A file path here is user error,
+    // not a crash (readdirSync would throw ENOTDIR).
+    if (!existsSync(path) || !statSync(path).isDirectory())
+        return [];
     return readdirSync(path, { withFileTypes: true })
         .filter((d) => d.isDirectory())
         .map((d) => { try {

package/build/src/lifecycle.js

@@ -3,7 +3,7 @@
  * The pidfile is advisory: a stale one (dead pid) is detected and cleaned up.
  */
 import { execFileSync, spawn } from "node:child_process";
-import { existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { DATA_DIR } from "./paths.js";
@@ -49,6 +49,7 @@ export async function startDetached(cliPath, port) {
         stdio: ["ignore", log, log],
         env: process.env,
     });
+    closeSync(log); // the child dup'd it at spawn; don't leak the parent's copy
     child.unref();
     for (let i = 0; i < 30; i++) {
         await sleep(100);

package/build/src/mcp/migrate-v1.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, renameSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+import { safeIso } from "../events.js";
 import { daemonPost } from "./daemon-client.js";
 const GRAPH_FILE = join(homedir(), ".persnally", "interest-graph.json");
 const INTENTS = new Set(["learning", "building", "researching", "deciding", "discussing", "debugging"]);
@@ -21,6 +22,11 @@ export async function migrateV1Graph() {
         nodes = JSON.parse(readFileSync(GRAPH_FILE, "utf-8")).nodes ?? {};
     }
     catch {
+        // Corrupt v1 file — move it aside so we don't reparse it on every session.
+        try {
+            renameSync(GRAPH_FILE, GRAPH_FILE + ".v1-corrupt");
+        }
+        catch { /* leave it */ }
         return 0;
     }
     const entries = Object.values(nodes);
@@ -29,7 +35,7 @@ export async function migrateV1Graph() {
         const events = entries.map((n) => ({
             type: "signal.topic",
             source: "system",
-            ts: new Date(n.last_seen).toISOString(),
+            ts: safeIso(n.last_seen),
             payload: {
                 topic: n.topic,
                 weight: Math.min(Math.max(n.current_weight, 0.05), 1),

package/build/src/setup.js

@@ -9,11 +9,17 @@ import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { loadConfig, saveConfig } from "./config.js";
 function sniffKind(conversationsJson) {
+    // 64 KB: the discriminating key can sit past a large first record (esp. ChatGPT).
     const fd = openSync(conversationsJson, "r");
-    const buf = Buffer.alloc(4096);
-    const n = readSync(fd, buf, 0, buf.length, 0);
-    closeSync(fd);
-    const head = buf.toString("utf-8", 0, n);
+    let head;
+    try {
+        const buf = Buffer.alloc(65536);
+        const n = readSync(fd, buf, 0, buf.length, 0);
+        head = buf.toString("utf-8", 0, n);
+    }
+    finally {
+        closeSync(fd); // always close, even if readSync throws
+    }
     if (head.includes('"chat_messages"'))
         return "claude";
     if (head.includes('"mapping"'))

package/build/src/store.js

@@ -16,6 +16,10 @@ export class EventStore {
         mkdirSync(dirname(path), { recursive: true });
         this.db = new Database(path);
         this.db.pragma("journal_mode = WAL");
+        // The CLI and the daemon each open their own connection; a blocked writer
+        // waits instead of failing fast with SQLITE_BUSY (better-sqlite3 defaults
+        // to 5s — set explicitly with headroom for large rebuilds).
+        this.db.pragma("busy_timeout = 10000");
         this.migrate();
     }
     migrate() {
@@ -162,7 +166,9 @@ export class EventStore {
                 topic: a.topic,
                 category: [...a.categories.entries()].sort((x, y) => y[1] - x[1])[0][0],
                 signals: a.signals.length,
-                weight: w.weight,
+                // Guard the NOT NULL column: a non-finite weight would abort the whole
+                // rebuild transaction and wedge the topic view permanently.
+                weight: Number.isFinite(w.weight) ? w.weight : 0,
                 sentiment_balance: w.sentiment_balance,
                 dominant_intent: w.dominant_intent,
                 entities: [...a.entities].slice(0, 20),
@@ -217,7 +223,9 @@ export class EventStore {
         return result.changes;
     }
     forgetAll() {
-        this.db.exec("DELETE FROM events; DELETE FROM view_topics;");
+        // Clear the profile too — it's prose derived from now-deleted events.
+        // Leaving it would serve a profile after a full wipe ("deletable for real").
+        this.db.exec("DELETE FROM events; DELETE FROM view_topics; DELETE FROM view_profile;");
     }
     close() {
         this.db.close();

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "persnally",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "license": "FSL-1.1-MIT",
-  "description": "The context engine for you — local-first, across every AI. So every AI finally knows you.",
+  "description": "Your own context engine — local-first, across every AI. So every AI finally knows you.",
   "type": "module",
   "bin": {
     "persnally": "build/src/cli.js",