shieldcortex 4.13.1 → 4.14.0

package/dist/context/derive-project-key.js

@@ -0,0 +1,150 @@
+/**
+ * TypeScript port of scripts/lib/project-key.mjs.
+ *
+ * Both the MCP-server side (this module) and the hook scripts must agree on
+ * how a cwd maps to a project key — otherwise writes and reads fall under
+ * different scopes and recall silently misses (issue #42).
+ *
+ * Resolution order:
+ *   1. SHIELDCORTEX_PROJECT_KEY env override
+ *   2. CLAUDE_MEMORY_PROJECT env override (legacy alias for SC env var)
+ *   3. ~/.shieldcortex/config.json projectKey
+ *   4. ~/.shieldcortex/config.json projectAliases[basename]
+ *   5. Git origin owner-repo (walk up from cwd)
+ *   6. Cwd basename (legacy behaviour), skipping noise directories
+ */
+import { existsSync, readFileSync, statSync } from 'fs';
+import { join, dirname } from 'path';
+import { homedir } from 'os';
+const SKIP_DIRECTORIES = [
+    'src', 'lib', 'dist', 'build', 'out',
+    'node_modules', '.git', '.next', '.cache',
+    'test', 'tests', '__tests__', 'spec',
+    'bin', 'scripts', 'config', 'public', 'static',
+];
+function resolveHome() {
+    return process.env.HOME || process.env.USERPROFILE || homedir();
+}
+function configPath() {
+    return join(resolveHome(), '.shieldcortex', 'config.json');
+}
+function loadConfig() {
+    try {
+        const p = configPath();
+        if (!existsSync(p))
+            return {};
+        return JSON.parse(readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+export function basenameFromCwd(path) {
+    if (!path)
+        return null;
+    const segments = path.split(/[/\\]/).filter(Boolean);
+    for (let i = segments.length - 1; i >= 0; i--) {
+        const segment = segments[i];
+        if (SKIP_DIRECTORIES.includes(segment.toLowerCase()))
+            continue;
+        if (segment.startsWith('.'))
+            continue;
+        return segment;
+    }
+    return null;
+}
+function findGitDir(startPath) {
+    let current = startPath;
+    const root = '/';
+    for (let i = 0; i < 40 && current && current !== root; i++) {
+        const candidate = join(current, '.git');
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return null;
+}
+function parseOriginUrl(url) {
+    if (!url)
+        return null;
+    const trimmed = url.trim();
+    const sshMatch = trimmed.match(/^[^@]+@[^:]+:([^/]+)\/(.+?)(?:\.git)?$/);
+    if (sshMatch)
+        return { owner: sshMatch[1], repo: sshMatch[2] };
+    const urlMatch = trimmed.match(/^[a-z]+:\/\/[^/]+\/(.+?)\/([^/]+?)(?:\.git)?$/i);
+    if (urlMatch)
+        return { owner: urlMatch[1], repo: urlMatch[2] };
+    return null;
+}
+function readOriginFromGitConfig(gitPath) {
+    try {
+        let realGitDir = gitPath;
+        const stats = statSync(gitPath);
+        if (stats.isFile()) {
+            const content = readFileSync(gitPath, 'utf-8');
+            if (content.startsWith('gitdir:')) {
+                realGitDir = content.slice('gitdir:'.length).trim();
+            }
+            else {
+                return null;
+            }
+        }
+        const cfgPath = join(realGitDir, 'config');
+        if (!existsSync(cfgPath))
+            return null;
+        const content = readFileSync(cfgPath, 'utf-8');
+        const section = content.match(/\[remote\s+"origin"\][^[]*/);
+        if (!section)
+            return null;
+        const urlMatch = section[0].match(/\burl\s*=\s*(.+)/);
+        if (!urlMatch)
+            return null;
+        return parseOriginUrl(urlMatch[1]);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Derive the project key for a given working directory. Mirrors
+ * scripts/lib/project-key.mjs::deriveProjectKey so MCP-server-side and
+ * hook-side keys agree.
+ */
+export function deriveProjectKey(cwd) {
+    if (process.env.SHIELDCORTEX_PROJECT_KEY) {
+        return process.env.SHIELDCORTEX_PROJECT_KEY;
+    }
+    if (process.env.CLAUDE_MEMORY_PROJECT) {
+        const v = process.env.CLAUDE_MEMORY_PROJECT.trim();
+        if (v)
+            return v;
+    }
+    const config = loadConfig();
+    const projectKey = config.projectKey;
+    if (typeof projectKey === 'string' && projectKey.trim()) {
+        return projectKey.trim();
+    }
+    const basename = basenameFromCwd(cwd);
+    const aliases = config.projectAliases;
+    if (aliases && typeof aliases === 'object' && basename) {
+        const alias = aliases[basename];
+        if (typeof alias === 'string' && alias.trim())
+            return alias.trim();
+    }
+    const gitDir = cwd ? findGitDir(cwd) : null;
+    if (gitDir) {
+        const origin = readOriginFromGitConfig(gitDir);
+        if (origin?.owner && origin?.repo) {
+            return `${origin.owner}-${origin.repo}`;
+        }
+    }
+    return basename;
+}
+export const __internal = {
+    parseOriginUrl,
+    basenameFromCwd,
+    readOriginFromGitConfig,
+};

package/dist/context/project-context.d.ts

@@ -2,22 +2,25 @@
  * Project Context Module
  * Automatically detects and manages the active project scope for memory operations.
  *
- * Detection priority:
- * 1. CLAUDE_MEMORY_PROJECT environment variable
- * 2. Extract from process.cwd() (working directory)
+ * Project key derivation is delegated to deriveProjectKey (mirroring
+ * scripts/lib/project-key.mjs) so reads and writes share one source of truth.
  *
  * The "*" sentinel means "global/all projects" (no filtering).
  */
 /** Sentinel value meaning "all projects" - no project filtering */
 export declare const GLOBAL_PROJECT_SENTINEL = "*";
 /**
- * Extract project name from a file path.
- * Skips common directory names that don't represent projects.
+ * Extract project name from a file path (basename only, with noise-dir skip).
+ * Retained for backwards compatibility with consumers that need just the
+ * basename component. New code should call deriveProjectKey instead.
  */
 export declare function extractProjectFromPath(path: string): string | null;
 /**
  * Initialize project context from environment or working directory.
  * Call this once at server startup.
+ *
+ * Uses the shared deriveProjectKey helper, so the resolved key is identical
+ * to whatever the .mjs hooks would resolve from the same cwd / env / config.
  */
 export declare function initProjectContext(): void;
 /**

package/dist/context/project-context.js

@@ -2,54 +2,38 @@
  * Project Context Module
  * Automatically detects and manages the active project scope for memory operations.
  *
- * Detection priority:
- * 1. CLAUDE_MEMORY_PROJECT environment variable
- * 2. Extract from process.cwd() (working directory)
+ * Project key derivation is delegated to deriveProjectKey (mirroring
+ * scripts/lib/project-key.mjs) so reads and writes share one source of truth.
  *
  * The "*" sentinel means "global/all projects" (no filtering).
  */
+import { deriveProjectKey, basenameFromCwd } from './derive-project-key.js';
 /** Sentinel value meaning "all projects" - no project filtering */
 export const GLOBAL_PROJECT_SENTINEL = '*';
 /** Currently active project (null = global/no filter) */
 let activeProject = null;
 /** How the project was detected */
 let projectDetectionSource = 'none';
-/** Directories to skip when extracting project name from path */
-const SKIP_DIRECTORIES = [
-    'src', 'lib', 'dist', 'build', 'out',
-    'node_modules', '.git', '.next', '.cache',
-    'test', 'tests', '__tests__', 'spec',
-    'bin', 'scripts', 'config', 'public', 'static',
-];
 /**
- * Extract project name from a file path.
- * Skips common directory names that don't represent projects.
+ * Extract project name from a file path (basename only, with noise-dir skip).
+ * Retained for backwards compatibility with consumers that need just the
+ * basename component. New code should call deriveProjectKey instead.
  */
 export function extractProjectFromPath(path) {
-    if (!path)
-        return null;
-    const segments = path.split(/[/\\]/).filter(Boolean);
-    if (segments.length === 0)
-        return null;
-    // Start from the end and find first non-skipped segment
-    for (let i = segments.length - 1; i >= 0; i--) {
-        const segment = segments[i];
-        if (!SKIP_DIRECTORIES.includes(segment.toLowerCase())) {
-            // Skip hidden directories (starting with .)
-            if (segment.startsWith('.'))
-                continue;
-            return segment;
-        }
-    }
-    return null;
+    return basenameFromCwd(path);
 }
 /**
  * Initialize project context from environment or working directory.
  * Call this once at server startup.
+ *
+ * Uses the shared deriveProjectKey helper, so the resolved key is identical
+ * to whatever the .mjs hooks would resolve from the same cwd / env / config.
  */
 export function initProjectContext() {
-    // Priority 1: Environment variable (explicit override)
-    const envProject = process.env.CLAUDE_MEMORY_PROJECT;
+    // Env overrides — match deriveProjectKey's order. We track these separately
+    // so projectDetectionSource keeps reporting 'env' when the user pinned the
+    // project explicitly (visible in get_project / dashboard).
+    const envProject = process.env.SHIELDCORTEX_PROJECT_KEY || process.env.CLAUDE_MEMORY_PROJECT;
     if (envProject) {
         const trimmed = envProject.trim();
         if (trimmed === GLOBAL_PROJECT_SENTINEL) {
@@ -62,9 +46,9 @@ export function initProjectContext() {
         }
         return;
     }
-    // Priority 2: Extract from current working directory
+    // Otherwise: config override → projectAliases → git origin → basename.
     const cwd = process.cwd();
-    const detected = extractProjectFromPath(cwd);
+    const detected = deriveProjectKey(cwd);
     if (detected) {
         activeProject = detected;
         projectDetectionSource = 'cwd';

package/dist/index.js

@@ -77,7 +77,7 @@ import { handleCodexCommand } from './setup/codex.js';
 import { createRequire } from 'module';
 import { execSync } from 'child_process';
 import { disposeModel, preloadModel } from './embeddings/index.js';
-import { stopDefaultWorker } from './worker/brain-worker.js';
+import { startDefaultWorker, stopDefaultWorker } from './worker/brain-worker.js';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 /**
@@ -172,6 +172,21 @@ async function startMcpServer(dbPath) {
     });
     // Connect via stdio transport
     await server.connect(transport);
+    // Start the brain worker in MCP-lite profile so STM→LTM consolidation runs
+    // even on hooks-only installs (no dashboard, no `service install`). Without
+    // this, MCP-only deployments accumulate STM forever and never promote (#45).
+    // The MCP profile uses a 15 min cadence and skips medium-tick + cloud-sync
+    // work to keep total background load bounded across many open windows.
+    // Disabled via SHIELDCORTEX_DISABLE_WORKER=1 for forensics / debugging.
+    if (process.env.SHIELDCORTEX_DISABLE_WORKER !== '1') {
+        try {
+            startDefaultWorker({ profile: 'mcp' });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error('[shieldcortex] Brain worker autostart failed (continuing without):', msg);
+        }
+    }
     // Preload embedding model in background so first tool call doesn't hang.
     // Fire-and-forget: failure is fine — searchMemories falls back to FTS-only.
     if (process.env.SHIELDCORTEX_SKIP_EMBEDDINGS !== '1') {

package/dist/setup/settings-hooks.d.ts

@@ -7,6 +7,12 @@
  * Keep this alongside CORTEX_HOOKS — drift between the two is what caused #23.
  */
 export declare const REQUIRED_HOOK_NAMES: readonly string[];
+/**
+ * Canonical timeout (seconds) for each ShieldCortex hook. Used by
+ * `shieldcortex doctor` to flag drift in hand-edited settings.json files —
+ * a too-tight UserPromptSubmit timeout silently dropped recall pre-#43.
+ */
+export declare const CANONICAL_HOOK_TIMEOUTS: Readonly<Record<string, number>>;
 export declare function setupHooks(options?: {
     stopHook?: boolean;
     sessionEnd?: boolean;

package/dist/setup/settings-hooks.js

@@ -17,7 +17,11 @@ const CORTEX_HOOKS = {
     // agents when the session is already gone. PreCompact handles memory
     // extraction. The cortex-memory hook handles session-end for OpenClaw.
     UserPromptSubmit: {
-        hooks: [{ type: 'command', command: 'shieldcortex hook prompt-recall', timeout: 2 }],
+        // Cold-spawn floor for the recall hook is ~1.5 s (Node + better-sqlite3 +
+        // FTS query). The previous 2 s ceiling SIGKILLed the hook silently under
+        // any IO pressure, dropping recall context with no user-visible error
+        // (#43). 5 s leaves ~3 s headroom on a busy host.
+        hooks: [{ type: 'command', command: 'shieldcortex hook prompt-recall', timeout: 5 }],
     },
 };
 /**
@@ -26,6 +30,15 @@ const CORTEX_HOOKS = {
  * Keep this alongside CORTEX_HOOKS — drift between the two is what caused #23.
  */
 export const REQUIRED_HOOK_NAMES = Object.freeze(Object.keys(CORTEX_HOOKS));
+/**
+ * Canonical timeout (seconds) for each ShieldCortex hook. Used by
+ * `shieldcortex doctor` to flag drift in hand-edited settings.json files —
+ * a too-tight UserPromptSubmit timeout silently dropped recall pre-#43.
+ */
+export const CANONICAL_HOOK_TIMEOUTS = Object.freeze(Object.fromEntries(Object.entries(CORTEX_HOOKS).map(([name, entry]) => [
+    name,
+    entry.hooks?.[0]?.timeout ?? 0,
+])));
 const STOP_HOOK = {
     hooks: [{ type: 'command', command: 'shieldcortex hook stop', timeout: 10 }],
 };

package/dist/worker/brain-worker.d.ts

@@ -29,7 +29,10 @@ export declare class BrainWorker {
     /**
      * Create a new BrainWorker
      *
-     * @param config - Partial configuration to override defaults
+     * @param config - Partial configuration to override defaults. When `profile`
+     *                is 'mcp' and no explicit `lightTickIntervalMs` is provided,
+     *                the lite 15-minute cadence is applied so MCP-server-mode
+     *                workers don't run as often as dashboard-mode ones.
      */
     constructor(config?: Partial<WorkerConfig>);
     /**
@@ -87,13 +90,18 @@ export declare class BrainWorker {
     triggerMediumTick(): Promise<MediumTickResult>;
 }
 /**
- * Get or create the default worker instance
+ * Get or create the default worker instance.
+ * The first call wins — subsequent calls return the existing singleton even
+ * if a different config is passed. That's intentional: it prevents accidental
+ * re-instantiation from creating two competing timer sets within one process.
  */
-export declare function getDefaultWorker(): BrainWorker;
+export declare function getDefaultWorker(config?: Partial<WorkerConfig>): BrainWorker;
 /**
- * Start the default worker if not already running
+ * Start the default worker if not already running. Forwards config to the
+ * underlying constructor on first call (used by MCP-server mode to start
+ * with `profile: 'mcp'`).
  */
-export declare function startDefaultWorker(): BrainWorker;
+export declare function startDefaultWorker(config?: Partial<WorkerConfig>): BrainWorker;
 /**
  * Stop the default worker
  */

package/dist/worker/brain-worker.js

@@ -9,7 +9,7 @@
  *
  * This transforms the memory system from reactive to continuously organic.
  */
-import { DEFAULT_WORKER_CONFIG, } from './types.js';
+import { DEFAULT_WORKER_CONFIG, MCP_LIGHT_TICK_INTERVAL_MS, } from './types.js';
 import { getDatabase } from '../database/init.js';
 import { pruneActivationCache } from '../memory/activation.js';
 import { getMemoryStats } from '../memory/store.js';
@@ -22,6 +22,21 @@ import { processRetryQueue, purgeOldEntries } from '../cloud/sync-queue.js';
 import { sendHeartbeat } from '../cloud/sync.js';
 import { refreshCloudIronDome, applyCachedCloudPatterns } from '../cloud/iron-dome-sync.js';
 import { isFeatureEnabled } from '../license/gate.js';
+import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const WORKER_STATE_DIR = join(homedir(), '.shieldcortex', 'state');
+const WORKER_STATE_FILE = join(WORKER_STATE_DIR, 'worker.json');
+function persistWorkerState(profile, lastLightTick) {
+    try {
+        if (!existsSync(WORKER_STATE_DIR))
+            mkdirSync(WORKER_STATE_DIR, { recursive: true });
+        writeFileSync(WORKER_STATE_FILE, JSON.stringify({ pid: process.pid, profile, lastLightTick: lastLightTick.toISOString() }, null, 2), 'utf-8');
+    }
+    catch {
+        // Best-effort: doctor will warn if the file is stale or missing
+    }
+}
 /**
  * Brain Worker Class
  *
@@ -47,10 +62,17 @@ export class BrainWorker {
     /**
      * Create a new BrainWorker
      *
-     * @param config - Partial configuration to override defaults
+     * @param config - Partial configuration to override defaults. When `profile`
+     *                is 'mcp' and no explicit `lightTickIntervalMs` is provided,
+     *                the lite 15-minute cadence is applied so MCP-server-mode
+     *                workers don't run as often as dashboard-mode ones.
      */
     constructor(config = {}) {
-        this.config = { ...DEFAULT_WORKER_CONFIG, ...config };
+        const merged = { ...DEFAULT_WORKER_CONFIG, ...config };
+        if (merged.profile === 'mcp' && config.lightTickIntervalMs === undefined) {
+            merged.lightTickIntervalMs = MCP_LIGHT_TICK_INTERVAL_MS;
+        }
+        this.config = merged;
     }
     /**
      * Start the background worker
@@ -62,17 +84,26 @@ export class BrainWorker {
             return;
         }
         this.isRunning = true;
-        console.log('[BrainWorker] Starting background worker');
+        console.log(`[BrainWorker] Starting background worker (profile=${this.config.profile} pid=${process.pid})`);
         console.log(`[BrainWorker] Light tick interval: ${this.config.lightTickIntervalMs / 1000}s`);
-        console.log(`[BrainWorker] Medium tick interval: ${this.config.mediumTickIntervalMs / 1000}s`);
-        // Light tick every 5 minutes (by default)
+        if (this.config.profile === 'full') {
+            console.log(`[BrainWorker] Medium tick interval: ${this.config.mediumTickIntervalMs / 1000}s`);
+        }
+        else {
+            console.log('[BrainWorker] MCP profile — medium tick + cloud sync disabled');
+        }
+        // Light tick — every 5 min (full) or every 15 min (mcp)
         this.lightTimer = setInterval(() => this.lightTick(), this.config.lightTickIntervalMs);
         this.lightTimer.unref();
-        // Medium tick every 30 minutes (by default)
-        this.mediumTimer = setInterval(() => this.mediumTick(), this.config.mediumTickIntervalMs);
-        this.mediumTimer.unref();
-        // Apply cached cloud Iron Dome patterns immediately on start (requires Pro+)
-        if (isFeatureEnabled('custom_injection_patterns')) {
+        // Medium tick — full profile only. mcp-mode skips link discovery,
+        // contradiction scans, graph maintenance, and sync-queue purging — those
+        // are dashboard concerns and shouldn't multiply across N MCP windows.
+        if (this.config.profile === 'full') {
+            this.mediumTimer = setInterval(() => this.mediumTick(), this.config.mediumTickIntervalMs);
+            this.mediumTimer.unref();
+        }
+        // Apply cached cloud Iron Dome patterns immediately on start (Pro+, full only)
+        if (this.config.profile === 'full' && isFeatureEnabled('custom_injection_patterns')) {
             try {
                 applyCachedCloudPatterns();
             }
@@ -150,38 +181,42 @@ export class BrainWorker {
                     result: result.predictiveConsolidation,
                 });
             }
-            // 3. Process cloud sync retry queue
-            try {
-                const retryResult = await processRetryQueue();
-                if (retryResult.processed > 0) {
-                    console.log(`[BrainWorker] Sync retry queue: processed ${retryResult.processed} ` +
-                        `(${retryResult.succeeded} ok, ${retryResult.failed} retry, ${retryResult.permanentlyFailed} failed)`);
-                }
-            }
-            catch (retryError) {
-                console.error('[BrainWorker] Sync retry queue failed:', retryError);
-            }
-            // 4. Send cloud heartbeat (keeps device status "Online") — Team+ only
-            if (isFeatureEnabled('cloud_sync')) {
+            // 3-5: cloud sync (retry queue, heartbeat, Iron Dome) — full profile only.
+            // Skipped under MCP profile so we don't fan out N concurrent network calls
+            // from N open Claude Code windows.
+            if (this.config.profile === 'full') {
                 try {
-                    sendHeartbeat();
+                    const retryResult = await processRetryQueue();
+                    if (retryResult.processed > 0) {
+                        console.log(`[BrainWorker] Sync retry queue: processed ${retryResult.processed} ` +
+                            `(${retryResult.succeeded} ok, ${retryResult.failed} retry, ${retryResult.permanentlyFailed} failed)`);
+                    }
                 }
-                catch {
-                    // Truly silent — heartbeat is best-effort
+                catch (retryError) {
+                    console.error('[BrainWorker] Sync retry queue failed:', retryError);
                 }
-            }
-            // 5. Refresh Iron Dome cloud patterns + policy — Pro+ only
-            if (isFeatureEnabled('custom_injection_patterns')) {
-                try {
-                    await refreshCloudIronDome();
+                if (isFeatureEnabled('cloud_sync')) {
+                    try {
+                        sendHeartbeat();
+                    }
+                    catch {
+                        // Truly silent — heartbeat is best-effort
+                    }
                 }
-                catch {
-                    // Non-critical — cloud Iron Dome sync is best-effort
+                if (isFeatureEnabled('custom_injection_patterns')) {
+                    try {
+                        await refreshCloudIronDome();
+                    }
+                    catch {
+                        // Non-critical — cloud Iron Dome sync is best-effort
+                    }
                 }
             }
             // Update stats
             this.lastLightTick = result.timestamp;
             this.stats.lightTicks++;
+            // Persist worker freshness for `shieldcortex doctor` to detect stalls.
+            persistWorkerState(this.config.profile, result.timestamp);
             // Emit light tick event
             emitWorkerLightTick(result);
             // Log summary
@@ -314,19 +349,24 @@ export class BrainWorker {
 // Default singleton instance (optional - server can create its own)
 let defaultWorker = null;
 /**
- * Get or create the default worker instance
+ * Get or create the default worker instance.
+ * The first call wins — subsequent calls return the existing singleton even
+ * if a different config is passed. That's intentional: it prevents accidental
+ * re-instantiation from creating two competing timer sets within one process.
  */
-export function getDefaultWorker() {
+export function getDefaultWorker(config) {
     if (!defaultWorker) {
-        defaultWorker = new BrainWorker();
+        defaultWorker = new BrainWorker(config);
     }
     return defaultWorker;
 }
 /**
- * Start the default worker if not already running
+ * Start the default worker if not already running. Forwards config to the
+ * underlying constructor on first call (used by MCP-server mode to start
+ * with `profile: 'mcp'`).
  */
-export function startDefaultWorker() {
-    const worker = getDefaultWorker();
+export function startDefaultWorker(config) {
+    const worker = getDefaultWorker(config);
     if (!worker.isActive()) {
         worker.start();
     }

package/dist/worker/types.d.ts

@@ -7,6 +7,17 @@
  * for the background brain worker.
  */
 import { ConsolidationResult } from '../memory/types.js';
+/**
+ * Worker profile.
+ *   - 'full': dashboard / api / worker modes — runs medium tick, cloud sync,
+ *     link discovery, the works.
+ *   - 'mcp':  default MCP-server mode (one process per Claude Code window) —
+ *     keeps consolidation alive but skips heavy/networked work so we don't
+ *     multiply background load by the number of open windows. Without this,
+ *     hooks-only installs never run consolidation and STM never graduates
+ *     to LTM (#45).
+ */
+export type WorkerProfile = 'full' | 'mcp';
 /**
  * Configuration for the brain worker
  */
@@ -27,11 +38,19 @@ export interface WorkerConfig {
     contradictionScanLimit: number;
     /** High activity threshold - memories created in 30 min (default: 5) */
     highActivityThreshold: number;
+    /** Worker profile - 'full' (default) or 'mcp' (lite, see WorkerProfile docs) */
+    profile: WorkerProfile;
 }
 /**
  * Default worker configuration
  */
 export declare const DEFAULT_WORKER_CONFIG: WorkerConfig;
+/**
+ * MCP-profile interval override. 15 min vs full's 5 min — one MCP server runs
+ * per Claude Code window, so we want lower per-window cadence to keep total
+ * background work in check across many windows.
+ */
+export declare const MCP_LIGHT_TICK_INTERVAL_MS: number;
 /**
  * Result of a light tick operation
  */

package/dist/worker/types.js

@@ -18,4 +18,11 @@ export const DEFAULT_WORKER_CONFIG = {
     maxLinksPerCycle: 10,
     contradictionScanLimit: 50,
     highActivityThreshold: 5,
+    profile: 'full',
 };
+/**
+ * MCP-profile interval override. 15 min vs full's 5 min — one MCP server runs
+ * per Claude Code window, so we want lower per-window cadence to keep total
+ * background work in check across many windows.
+ */
+export const MCP_LIGHT_TICK_INTERVAL_MS = 15 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.13.1",
+  "version": "4.14.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/plugins/openclaw/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.13.1",
+  "version": "4.14.0",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,

package/scripts/lib/auto-memory-config.mjs

@@ -15,7 +15,14 @@ const DEFAULTS = Object.freeze({
   maxTranscriptBytes: 1024 * 1024,
   maxTranscriptLines: 5000,
   keepSlashCommandProse: true,
-  stopHookSamplingTurns: 10,
+  // Lowered 10 → 5 in v4.14.0. At 1-in-10 the realistic capture rate over
+  // typical sessions was ~7%, which left LTM near-empty (#44). Salience
+  // bypass below catches high-signal turns at any cadence.
+  stopHookSamplingTurns: 5,
+  // Bypass the modulo gate when the last assistant turn carries a fenced
+  // code block or hits multiple keyword categories — those turns are
+  // disproportionately what we want to remember.
+  stopHookSalienceBypass: true,
   stopHookWindowBytes: 256 * 1024,
   enableSessionEnd: false,
   enableStop: false,
@@ -39,6 +46,9 @@ export function getAutoMemoryConfig() {
       ? overrides.keepSlashCommandProse
       : DEFAULTS.keepSlashCommandProse,
     stopHookSamplingTurns: pickPositiveInt(overrides.stopHookSamplingTurns, DEFAULTS.stopHookSamplingTurns),
+    stopHookSalienceBypass: typeof overrides.stopHookSalienceBypass === 'boolean'
+      ? overrides.stopHookSalienceBypass
+      : DEFAULTS.stopHookSalienceBypass,
     stopHookWindowBytes: pickPositiveInt(overrides.stopHookWindowBytes, DEFAULTS.stopHookWindowBytes),
     enableSessionEnd: overrides.enableSessionEnd === true,
     enableStop: overrides.enableStop === true,