[BUG] [v0.0.7] cortex update subsystem ignores CORTEX_HOME and writes update.json/update_cache.json under ~/.cortex

[DDDDDGCSM]

Project

cortex

Description

The update subsystem ignores CORTEX_HOME and uses HOME/.cortex for both persistent update files:

• update_cache.json from the upgrade check path
• update.json from the update config path

This creates split state. The CLI help explicitly documents CORTEX_HOME as the config directory override, but the update subsystem bypasses it and writes under ~/.cortex instead.

Error Message

No explicit error is shown. The bug is silent state being written to the wrong directory.

Debug Logs

HOME=/tmp/cortex-repro-home CORTEX_HOME=/tmp/cortex-repro-config /tmp/cortex-bin/Cortex upgrade --check --yes --channel stable

✓ You are already on the latest version (v0.0.7)

find /tmp/cortex-repro-home /tmp/cortex-repro-config -maxdepth 4 -type f -o -type d | sort
/tmp/cortex-repro-config
/tmp/cortex-repro-home
/tmp/cortex-repro-home/.cortex
/tmp/cortex-repro-home/.cortex/update_cache.json

System Information

macOS Darwin 25.x (Apple Silicon)
Cortex CLI v0.0.7
Rust toolchain: cargo 1.95.0 / rustc 1.95.0

Screenshots

Prepared evidence image showing both the runtime repro and the targeted update-config proof:

/tmp/cortex-cortexhome-bug-evidence-clean.png

Steps to Reproduce

1. Set HOME and CORTEX_HOME to different directories.
2. Run:
   HOME=/tmp/cortex-repro-home CORTEX_HOME=/tmp/cortex-repro-config cortex upgrade --check --yes --channel stable
3. Inspect both directories.
4. Observe that update_cache.json is created under HOME/.cortex/update_cache.json and nothing is written under CORTEX_HOME.
5. For the config-writing path, run the targeted proof:
   cargo test -p cortex-update --test update_config_home_override -- --test-threads=1 --nocapture
6. Observe the test passes only because UpdateManager::skip_version() writes update.json under HOME/.cortex/update.json and not under CORTEX_HOME/update.json.

Expected Behavior

All update subsystem state should respect the active Cortex home override. If CORTEX_HOME is set, both:

• update_cache.json
• update.json

should be stored under that override rather than hardcoded HOME/.cortex.

Actual Behavior

The update subsystem uses dirs::home_dir().join(".cortex") directly:

• UpdateConfig::load() / save() use HOME/.cortex/update.json
• VersionCache uses HOME/.cortex/update_cache.json

As a result, update-related state is split away from the configured Cortex home.

Additional Context

Relevant source paths:

• src/cortex-update/src/config.rs
  • UpdateConfig::load() uses dirs::home_dir().join(".cortex").join("update.json")
  • UpdateConfig::save() writes to dirs::home_dir().join(".cortex").join("update.json")
• src/cortex-update/src/version.rs
  • VersionCache uses dirs::home_dir().join(".cortex").join("update_cache.json")
• src/cortex-cli/src/upgrade_cmd.rs
  • UpgradeCli::run() creates config via UpdateConfig::load()
• src/cortex-update/src/manager.rs
  • check_update_forced() writes the cache
  • skip_version() / clear_skip() write update.json

This is adjacent to, but not the same as, #51572 ("Config command ignores custom Cortex home path"). That issue is about the config command handler. This report is specifically about the cortex-update subsystem using its own hardcoded HOME/.cortex paths.

[atlas-cortex]

❌ Validation Summary — Issue #53527

Code verification failed: The code confirms the bug exists: the update subsystem hardcodes ~/.cortex instead of respecting CORTEX_HOME. However, the bug report does not contain any valid screenshots. The provided screenshot URL is a local file path (/tmp/cortex-cortexhome-bug-evidence-clean.png) which is inaccessible. Since valid screenshots are mandatory, the bug must be rejected.

Confidence Score: 4/5

• This issue does not meet the minimum requirements for a valid bounty submission.

Validation Checks

Check	Status	Detail
Media Evidence	❌ Fail	No screenshot or video attached
Spam Detection	✅ Pass	Score: 0% — no spam signals
Duplicate Detection	✅ Pass	No significant overlap with existing issues
Code Verification	❌ Fail	Bug not found in source code (confidence: 100%) — screenshots invalid — The code confirms the bug exists: the update subsystem hardcodes ~/.cortex ins
LLM Evaluation	❌ Fail	Code verification failed: The code confirms the bug exists: the update subsystem hardcodes ~/.cortex instead of respec...

Action Items

• Ensure the bug report describes a real command/feature in Cortex
• Verify that the described behavior matches the actual code
• Provide screenshots showing actual CLI output, not source code

Validation Pipeline

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Issue #53527"] --> B{"Media Check"}
    B -->|"No media"| Z["❌ Invalid"]
    style Z fill:#ff6b6b,color:#fff

Loading

Raw Evidence

{
  "media": {
    "hasMedia": false,
    "accessible": false,
    "urls": [],
    "evidence": [
      "No media URLs found in issue body"
    ]
  },
  "spam": {
    "overallScore": 0,
    "details": "template=0.00 (0 recent issues compared); burst=0.00 (1 issues in 2h window); parity=0.00; overall=0.00 (threshold=0.7)"
  },
  "duplicate": {
    "isDuplicate": true,
    "originalIssue": 51593,
    "similarity": 0.6303443845251245,
    "topSimilar": [
      {
        "issueNumber": 51593,
        "title": "[BUG] [v0.0.7] Update config ignores CORTEX_HOME and writes to default ~/.cortex directory",
        "similarity": 0.6303443845251245
      },
      {
        "issueNumber": 51572,
        "title": "[BUG] [v0.0.7] Config command ignores custom Cortex home path",
        "similarity": 0.5709613946052171
      },
      {
        "issueNumber": 51537,
        "title": "[BUG] [v0.0.7] `cortex feedback` ignores CORTEX_HOME and always writes to ~/.cortex/feedback/",
        "similarity": 0.5696329789451862
      },
      {
        "issueNumber": 51514,
        "title": "[BUG] [v0.0.7] `cortex alias set` ignores CORTEX_HOME and always writes to ~/.cortex/aliases.toml",
        "similarity": 0.5666096263536375
      },
      {
        "issueNumber": 51382,
        "title": "[BUG] [v0.0.7] cortex lock ignores CORTEX_HOME and always reads/writes ~/.cortex/session_locks.json",
        "similarity": 0.5637681795815007
      }
    ]
  },
  "codeVerification": {
    "plausible": false,
    "confidence": 1,
    "reasoning": "The code confirms the bug exists: the update subsystem hardcodes `~/.cortex` instead of respecting `CORTEX_HOME`. However, the bug report does not contain any valid screenshots. The provided screenshot URL is a local file path (`/tmp/cortex-cortexhome-bug-evidence-clean.png`) which is inaccessible. Since valid screenshots are mandatory, the bug must be rejected.",
    "codeEvidence": "In `src/cortex-update/src/version.rs`, `VersionCache::cache_path()` uses `dirs::home_dir().map(|h| h.join(\".cortex\").join(\"update_cache.json\"))`. In `src/cortex-update/src/config.rs`, `UpdateConfig::load()` and `save()` use `dirs::home_dir().map(|h| h.join(\".cortex\").join(\"update.json\"))`. This confirms the code ignores `CORTEX_HOME` and hardcodes `~/.cortex`.",
    "screenshotValid": false,
    "screenshotReasoning": "The provided screenshot URL is a local file path (`/tmp/cortex-cortexhome-bug-evidence-clean.png`) and cannot be accessed. Therefore, there is no valid screenshot evidence."
  }
}

_{Validated by Atlas • 2026-05-12}

[DDDDDGCSM]

Adding the requested screenshot evidence here so the report has an inline visual repro artifact.

This screenshot combines:

• the runtime upgrade --check repro showing update_cache.json written under HOME/.cortex
• the targeted proof showing UpdateManager::skip_version() writes update.json under HOME/.cortex rather than CORTEX_HOME