@andespindola/brainlink 1.9.0 → 1.10.0

package/README.md

@@ -564,6 +564,7 @@ Available tools:
 - `brainlink_vault_status` / `brainlink_vault_init` / `brainlink_vault_commit` / `brainlink_vault_history` / `brainlink_vault_pull` / `brainlink_vault_restore`: version the vault's canonical Markdown with git (the derived index is git-ignored). Pull and restore reindex changed files automatically so the vault stays immediately searchable.
 - `brainlink_vault_export` / `brainlink_vault_import`: write and read a portable `.blvault` snapshot (gzip envelope of the Markdown with per-file SHA-256). Encrypted with AES-256-GCM when a `passphrase` (or `BRAINLINK_VAULT_KEY`) is available, otherwise plaintext gzip; import auto-detects and decrypts. Import verifies checksums, preserves divergent local files as `*.conflict-<ts>.md`, and reindexes.
 - `brainlink_vault_export_bundle` / `brainlink_vault_bundle_list` / `brainlink_vault_import_bundle`: export **every known vault** (the config vault plus `allowedVaults`) into a single portable `.blbundle`, inspect the vaults inside a bundle, and import them back — all vaults to their recorded paths, or a single one via `only` (optionally into `targetVault`). Same encryption (via `passphrase`/`BRAINLINK_VAULT_KEY`), checksum verification and conflict preservation as the single-vault snapshot.
+- `brainlink_vault_transfer_export` / `brainlink_vault_transfer_import`: move a vault **between two Brainlinks over MCP** without a file on disk. An agent connected to both servers calls `transfer_export` on the source (returns the vault as an encrypted, base64 payload) and `transfer_import` on the target (applies the payload and reindexes). A shared `passphrase` (min 8 chars) is mandatory since the payload travels through the agent's context. Same checksum verification and `*.conflict-<ts>.md` preservation as snapshot import.
 - `brainlink_vault_merge_agents`: losslessly merge one agent namespace into another within the same vault (e.g. `claude-code` → `shared`). Identical notes are skipped, colliding slugs with different content are kept under a `-from-<agent>` name, everything else is moved, and merged notes are aggregated into domain `<context> Hub` notes. Source notes are kept unless `deleteSource` is set; `dryRun` previews the plan.
 - `brainlink_graph`: read indexed graph nodes and weighted links.
 - `brainlink_graph_contexts`: list the visual graph contexts used by the local server.

package/dist/application/vault-snapshot.js

@@ -49,16 +49,30 @@ export const buildSnapshotEnvelope = async (vaultPath) => {
         files: entries.map((entry) => entry.file)
     };
 };
-export const exportVaultSnapshot = async (vaultPath, outputFile, options = {}) => {
+// Build the in-memory snapshot artifact (gzip envelope, optionally encrypted).
+// Shared by the file-based export and the MCP payload transfer so both formats
+// are byte-identical. `requireEncryption` refuses to emit plaintext (used by the
+// transfer path, where the payload travels through an agent's context).
+export const packVaultSnapshot = async (vaultPath, options = {}) => {
     const envelope = await buildSnapshotEnvelope(vaultPath);
     const gzipped = gzipSync(Buffer.from(JSON.stringify(envelope), 'utf8'), { level: 9 });
     const key = options.encrypt !== false ? resolveSnapshotKey(options.passphrase) : null;
-    if (options.encrypt !== false && !key) {
+    if (options.requireEncryption && !key) {
+        throw new Error('A passphrase (or BRAINLINK_VAULT_KEY) is required to produce an encrypted snapshot.');
+    }
+    const payload = key ? encryptVaultContent(key, gzipped) : gzipped;
+    return { payload, fileCount: envelope.files.length, encrypted: Boolean(key) };
+};
+// Import a snapshot straight from an in-memory payload (no file on disk). Used by
+// the MCP vault-transfer import so a snapshot can move between Brainlinks.
+export const applyVaultSnapshotPayload = async (payload, vaultPath, options = {}) => applySnapshotEnvelope(parseEnvelope(payload, options.passphrase), vaultPath, options);
+export const exportVaultSnapshot = async (vaultPath, outputFile, options = {}) => {
+    const artifact = await packVaultSnapshot(vaultPath, options);
+    if (options.encrypt !== false && !artifact.encrypted) {
         process.stderr.write('brainlink: snapshot exported unencrypted — pass --passphrase (or set BRAINLINK_VAULT_KEY) to encrypt a portable snapshot.\n');
     }
-    const packed = key ? encryptVaultContent(key, gzipped) : gzipped;
-    await writeFile(outputFile, packed, { mode: 0o600 });
-    return { file: outputFile, fileCount: envelope.files.length, bytes: packed.byteLength, encrypted: Boolean(key) };
+    await writeFile(outputFile, artifact.payload, { mode: 0o600 });
+    return { file: outputFile, fileCount: artifact.fileCount, bytes: artifact.payload.byteLength, encrypted: artifact.encrypted };
 };
 const parseEnvelope = (raw, passphrase) => {
     let gzipped = raw;

package/dist/mcp/server.js

@@ -1,5 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { addNoteInputSchema, addFileInputSchema, addFileTool, addImageInputSchema, addImageTool, addNoteTool, addNotesInputSchema, addNotesTool, deleteNoteInputSchema, deleteNoteTool, deleteNotesInputSchema, deleteNotesTool, volatileAddInputSchema, volatileAddTool, volatileClearInputSchema, volatileClearTool, dedupeInputSchema, dedupeResolveInputSchema, dedupeResolveTool, dedupeTool, brokenLinksInputSchema, brokenLinksTool, bootstrapInputSchema, bootstrapTool, canonicalizeContextLinksInputSchema, canonicalizeContextLinksTool, contextInputSchema, contextPacksInputSchema, contextPacksTool, contextTool, doctorActionsInputSchema, doctorActionsTool, graphContextsInputSchema, graphContextsTool, graphInputSchema, graphTool, getImageInputSchema, getImageTool, explainInputSchema, explainTool, indexInputSchema, indexTool, inboxAddInputSchema, inboxAddTool, inboxListInputSchema, inboxListTool, inboxProcessInputSchema, inboxProcessTool, orphansInputSchema, orphansTool, policyInputSchema, policyTool, projectInitInputSchema, projectInitTool, recommendationsInputSchema, recommendationsTool, rememberInputSchema, rememberTool, repairLinksInputSchema, repairLinksTool, searchInputSchema, searchTool, similarNotesInputSchema, similarNotesTool, sessionCloseInputSchema, sessionCloseTool, statsInputSchema, statsTool, suggestLinksInputSchema, suggestLinksTool, syncInputSchema, syncTool, validateInputSchema, validateTool, vaultBundleListInputSchema, vaultBundleListTool, vaultCommitInputSchema, vaultCommitTool, vaultExportBundleInputSchema, vaultExportBundleTool, vaultExportInputSchema, vaultExportTool, vaultHistoryInputSchema, vaultHistoryTool, vaultImportBundleInputSchema, vaultImportBundleTool, vaultImportInputSchema, vaultImportTool, vaultInitInputSchema, vaultInitTool, vaultMergeAgentsInputSchema, vaultMergeAgentsTool, vaultProvisionInputSchema, vaultProvisionTool, vaultPullInputSchema, vaultPullTool, vaultRestoreInputSchema, vaultRestoreTool, vaultStatusInputSchema, vaultStatusTool, versionInputSchema, versionTool } from './tools.js';
+import { addNoteInputSchema, addFileInputSchema, addFileTool, addImageInputSchema, addImageTool, addNoteTool, addNotesInputSchema, addNotesTool, deleteNoteInputSchema, deleteNoteTool, deleteNotesInputSchema, deleteNotesTool, volatileAddInputSchema, volatileAddTool, volatileClearInputSchema, volatileClearTool, dedupeInputSchema, dedupeResolveInputSchema, dedupeResolveTool, dedupeTool, brokenLinksInputSchema, brokenLinksTool, bootstrapInputSchema, bootstrapTool, canonicalizeContextLinksInputSchema, canonicalizeContextLinksTool, contextInputSchema, contextPacksInputSchema, contextPacksTool, contextTool, doctorActionsInputSchema, doctorActionsTool, graphContextsInputSchema, graphContextsTool, graphInputSchema, graphTool, getImageInputSchema, getImageTool, explainInputSchema, explainTool, indexInputSchema, indexTool, inboxAddInputSchema, inboxAddTool, inboxListInputSchema, inboxListTool, inboxProcessInputSchema, inboxProcessTool, orphansInputSchema, orphansTool, policyInputSchema, policyTool, projectInitInputSchema, projectInitTool, recommendationsInputSchema, recommendationsTool, rememberInputSchema, rememberTool, repairLinksInputSchema, repairLinksTool, searchInputSchema, searchTool, similarNotesInputSchema, similarNotesTool, sessionCloseInputSchema, sessionCloseTool, statsInputSchema, statsTool, suggestLinksInputSchema, suggestLinksTool, syncInputSchema, syncTool, validateInputSchema, validateTool, vaultBundleListInputSchema, vaultBundleListTool, vaultCommitInputSchema, vaultCommitTool, vaultExportBundleInputSchema, vaultExportBundleTool, vaultExportInputSchema, vaultExportTool, vaultHistoryInputSchema, vaultHistoryTool, vaultImportBundleInputSchema, vaultImportBundleTool, vaultImportInputSchema, vaultImportTool, vaultInitInputSchema, vaultInitTool, vaultMergeAgentsInputSchema, vaultMergeAgentsTool, vaultProvisionInputSchema, vaultProvisionTool, vaultPullInputSchema, vaultPullTool, vaultRestoreInputSchema, vaultRestoreTool, vaultStatusInputSchema, vaultStatusTool, vaultTransferExportInputSchema, vaultTransferExportTool, vaultTransferImportInputSchema, vaultTransferImportTool, versionInputSchema, versionTool } from './tools.js';
 import { getRuntimeVersion } from './runtime.js';
 import { brainlinkServerInstructions } from './server-instructions.js';
 import { guardToolHandler } from './tool-guard.js';
@@ -231,6 +231,16 @@ export const createBrainlinkMcpServer = () => {
         description: 'Import a .blbundle: restore every vault to its recorded path, or a single one via "only" (optionally into "targetVault"). Checksums are verified; divergent local files are preserved as *.conflict-<ts>.md.',
         inputSchema: vaultImportBundleInputSchema
     }, vaultImportBundleTool);
+    server.registerTool('brainlink_vault_transfer_export', {
+        title: 'Export Vault for MCP Transfer',
+        description: 'Export this vault as an encrypted, base64 transfer payload (no file on disk) so an agent connected to two Brainlinks can move it. Requires a shared passphrase; import the payload on the target with brainlink_vault_transfer_import and the same passphrase.',
+        inputSchema: vaultTransferExportInputSchema
+    }, vaultTransferExportTool);
+    server.registerTool('brainlink_vault_transfer_import', {
+        title: 'Import Vault from MCP Transfer',
+        description: 'Import a base64 transfer payload produced by brainlink_vault_transfer_export on another Brainlink, using the same passphrase. Checksums are verified; divergent local files are preserved as *.conflict-<ts>.md, then the vault is reindexed.',
+        inputSchema: vaultTransferImportInputSchema
+    }, vaultTransferImportTool);
     server.registerTool('brainlink_graph', {
         title: 'Read Brainlink Graph',
         description: 'Read indexed graph nodes and wiki-link edges. Edges include weight and priority fields so agents can rank importance and priority.',

package/dist/mcp/tools/vault-tools.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { commitVault, initVaultGit, pullVault, pushVault, restoreVault, vaultGitStatus, vaultHistory } from '../../application/vault-git.js';
 import { provisionVaultRepo } from '../../application/provision-vault.js';
-import { exportVaultSnapshot, importVaultSnapshot } from '../../application/vault-snapshot.js';
+import { applyVaultSnapshotPayload, exportVaultSnapshot, importVaultSnapshot, packVaultSnapshot } from '../../application/vault-snapshot.js';
 import { exportVaultsBundle, importVaultsBundle, listBundleVaults } from '../../application/vault-bundle.js';
 import { mergeAgentNamespace } from '../../application/merge-agent-namespace.js';
 import { getKnownVaults, loadBrainlinkConfig } from '../../infrastructure/config.js';
@@ -68,6 +68,26 @@ export const vaultImportBundleInputSchema = {
     passphrase: z.string().min(1).optional().describe('Passphrase to decrypt an encrypted bundle.'),
     skipIndex: z.boolean().optional().default(false).describe('Skip the automatic reindex after importing Markdown.')
 };
+// MCP-to-MCP vault transfer (agent-mediated): the agent, connected to both
+// Brainlinks, exports an encrypted payload from the source and imports it into
+// the target. The payload travels through the agent's context, so encryption
+// with a shared passphrase is mandatory on both ends.
+export const vaultTransferExportInputSchema = {
+    ...vaultInput,
+    passphrase: z
+        .string()
+        .min(8)
+        .describe('Shared passphrase (min 8 chars) used to encrypt the transfer payload. The receiving Brainlink must import with the same passphrase.')
+};
+export const vaultTransferImportInputSchema = {
+    ...vaultInput,
+    payloadBase64: z
+        .string()
+        .min(1)
+        .describe('Base64 transfer payload produced by brainlink_vault_transfer_export on the source Brainlink.'),
+    passphrase: z.string().min(8).describe('The same passphrase used on the source Brainlink to export the payload.'),
+    skipIndex: z.boolean().optional().default(false).describe('Skip the automatic reindex after importing Markdown.')
+};
 export const vaultProvisionInputSchema = {
     ...vaultInput,
     name: z.string().min(1).optional().describe('Repository name to create. Defaults to brainlink-vault.'),
@@ -236,6 +256,43 @@ export const vaultImportBundleTool = async (input) => {
         return jsonResult({ ok: false, bundleFile: input.bundleFile, error: error instanceof Error ? error.message : String(error) });
     }
 };
+export const vaultTransferExportTool = async (input) => {
+    const context = await resolveExecutionContext(input);
+    try {
+        const artifact = await packVaultSnapshot(context.vault, { passphrase: input.passphrase, requireEncryption: true });
+        return jsonResult({
+            vault: context.vault,
+            ok: true,
+            encrypted: artifact.encrypted,
+            fileCount: artifact.fileCount,
+            bytes: artifact.payload.byteLength,
+            payloadBase64: artifact.payload.toString('base64')
+        });
+    }
+    catch (error) {
+        return failure(context.vault, error);
+    }
+};
+export const vaultTransferImportTool = async (input) => {
+    const context = await resolveExecutionContext(input);
+    try {
+        const payload = Buffer.from(input.payloadBase64, 'base64');
+        const result = await applyVaultSnapshotPayload(payload, context.vault, {
+            skipIndex: input.skipIndex === true,
+            passphrase: input.passphrase
+        });
+        return jsonResult({
+            vault: context.vault,
+            ok: true,
+            imported: result.imported,
+            conflicted: result.conflicted,
+            reindexed: result.index != null
+        });
+    }
+    catch (error) {
+        return failure(context.vault, error);
+    }
+};
 export const vaultMergeAgentsTool = async (input) => {
     const context = await resolveExecutionContext(input);
     try {

package/dist/mcp/tools.js

@@ -1,4 +1,4 @@
 export { brokenLinksInputSchema, brokenLinksTool, contextInputSchema, contextPacksInputSchema, contextPacksTool, contextTool, doctorActionsInputSchema, doctorActionsTool, explainInputSchema, explainTool, graphContextsInputSchema, graphContextsTool, graphInputSchema, graphTool, getImageInputSchema, getImageTool, orphansInputSchema, orphansTool, recommendationsInputSchema, recommendationsTool, searchInputSchema, searchTool, similarNotesInputSchema, similarNotesTool, statsInputSchema, statsTool, suggestLinksInputSchema, suggestLinksTool, validateInputSchema, validateTool, versionInputSchema, versionTool } from './tools/read-tools.js';
 export { addFileInputSchema, addFileTool, addImageInputSchema, addImageTool, addNoteInputSchema, addNoteTool, addNotesInputSchema, addNotesTool, deleteNoteInputSchema, deleteNoteTool, deleteNotesInputSchema, deleteNotesTool, inboxAddInputSchema, inboxAddTool, inboxListInputSchema, inboxListTool, inboxProcessInputSchema, inboxProcessTool, rememberInputSchema, rememberTool, volatileAddInputSchema, volatileAddTool, volatileClearInputSchema, volatileClearTool } from './tools/write-tools.js';
 export { bootstrapInputSchema, bootstrapTool, canonicalizeContextLinksInputSchema, canonicalizeContextLinksTool, dedupeInputSchema, dedupeResolveInputSchema, dedupeResolveTool, dedupeTool, indexInputSchema, indexTool, policyInputSchema, policyTool, projectInitInputSchema, projectInitTool, repairLinksInputSchema, repairLinksTool, sessionCloseInputSchema, sessionCloseTool, syncInputSchema, syncTool } from './tools/maintenance-tools.js';
-export { vaultBundleListInputSchema, vaultBundleListTool, vaultCommitInputSchema, vaultCommitTool, vaultExportBundleInputSchema, vaultExportBundleTool, vaultExportInputSchema, vaultExportTool, vaultHistoryInputSchema, vaultHistoryTool, vaultImportBundleInputSchema, vaultImportBundleTool, vaultImportInputSchema, vaultImportTool, vaultInitInputSchema, vaultInitTool, vaultMergeAgentsInputSchema, vaultMergeAgentsTool, vaultProvisionInputSchema, vaultProvisionTool, vaultPullInputSchema, vaultPullTool, vaultRestoreInputSchema, vaultRestoreTool, vaultStatusInputSchema, vaultStatusTool } from './tools/vault-tools.js';
+export { vaultBundleListInputSchema, vaultBundleListTool, vaultCommitInputSchema, vaultCommitTool, vaultExportBundleInputSchema, vaultExportBundleTool, vaultExportInputSchema, vaultExportTool, vaultHistoryInputSchema, vaultHistoryTool, vaultImportBundleInputSchema, vaultImportBundleTool, vaultImportInputSchema, vaultImportTool, vaultInitInputSchema, vaultInitTool, vaultMergeAgentsInputSchema, vaultMergeAgentsTool, vaultProvisionInputSchema, vaultProvisionTool, vaultPullInputSchema, vaultPullTool, vaultRestoreInputSchema, vaultRestoreTool, vaultStatusInputSchema, vaultStatusTool, vaultTransferExportInputSchema, vaultTransferExportTool, vaultTransferImportInputSchema, vaultTransferImportTool } from './tools/vault-tools.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andespindola/brainlink",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Local-first knowledge memory for agents with Markdown, backlinks, indexing and context retrieval.",
   "type": "module",
   "license": "MIT",