@cairnkeep/cli 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+All notable user-facing changes are documented here. This project follows
+[Semantic Versioning](https://semver.org/).
+
+## [1.1.1] - 2026-07-14
+
+### Fixed
+
+- Ship and resolve the default document-RAG sync helper from the npm package,
+  with user-owned XDG config/state paths and legacy-path compatibility.
+- Make repository CI install locked root dependencies before running checks.
+- Make the clean macOS bootstrap test create its target directory explicitly.
+
+### Changed
+
+- Add release-to-npm automation with provenance, tarball, and SBOM artifacts.
+- Document supported clients, platforms, storage placement, and optional data
+  flows more explicitly.
+- Add community contribution, support, and conduct templates.
+
+## [1.1.0] - 2026-07-13
+
+### Added
+
+- Add authenticated remote HTTP memory with stable per-project session routing.
+- Add explicit client routing headers for scopes and document-RAG workspaces.
+- Document local, remote, export, backup, and bearer-token deployment models.
+
+## [1.0.5] - 2026-07-13
+
+### Fixed
+
+- Make the npm tarball install self-contained and verify it on clean systems.
+- Preserve executable permissions and Bash 3.2 portability on macOS.
+- Add backup-first uninstall and SQLite-safe memory export/import guidance.
+
+[1.1.1]: https://github.com/cairnkeep/cairnkeep/compare/v1.1.0...v1.1.1
+[1.1.0]: https://github.com/cairnkeep/cairnkeep/compare/v1.0.5...v1.1.0
+[1.0.5]: https://github.com/cairnkeep/cairnkeep/compare/v1.0.4...v1.0.5

package/CONTRIBUTING.md

@@ -15,7 +15,9 @@ Contributions are welcome through GitHub issues and pull requests.
 
 ## Development setup
 
-The memory server requires Node.js 18 or newer. Node.js 20 is used in CI.
+The memory server requires Node.js 18 or newer. Node.js 22 or 24 is recommended
+for development; current CI uses Node.js 24 and retains a clean Node.js 18
+compatibility boot check.
 
 ```bash
 git clone https://github.com/cairnkeep/cairnkeep.git
@@ -47,3 +49,6 @@ endpoints. They are not part of the default offline test suite.
 
 By contributing, you agree that your contribution is licensed under the
 Apache License 2.0 found in [LICENSE](LICENSE).
+
+Release publishing is maintainer-only and documented in
+[docs/releasing.md](docs/releasing.md).

package/README.md

@@ -1,5 +1,9 @@
 # Cairnkeep
 
+[![CI](https://github.com/cairnkeep/cairnkeep/actions/workflows/ci.yml/badge.svg)](https://github.com/cairnkeep/cairnkeep/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/@cairnkeep/cli)](https://www.npmjs.com/package/@cairnkeep/cli)
+[![license](https://img.shields.io/npm/l/@cairnkeep/cli)](LICENSE)
+
 > A durable, harness-agnostic **memory + context layer** for coding agents.
 
 A *cairn* is a stack of stones left as a trail marker for whoever follows; a
@@ -20,6 +24,23 @@ a thin routing seam (`route_check`), both of which delegate to
 [token-miser](https://github.com/cairnkeep/token-miser), a public
 cairnkeep-org sibling project.
 
+## Compatibility
+
+Node.js 22 or 24 is recommended. Node.js 18 and 20 remain compatible for the
+1.x line but are end-of-life upstream; the minimum will move in the next major
+release.
+
+| Client or platform | Support level |
+|---|---|
+| Claude Code on Linux/macOS | Memory server plus commands, agents, hooks, and launchers |
+| OpenCode on Linux/macOS | Memory server plus commands, plugins, hooks, and launchers |
+| Codex CLI | Memory MCP server; no Cairnkeep operating-layer assets |
+| Other MCP clients | Memory and optional domain-knowledge MCP tools |
+| Native Windows | Not supported by the Bash-based installer; use WSL (not yet CI-verified) |
+
+Linux, macOS, Bash 3.2 portability, and a clean Node 18 compatibility install
+are exercised in CI.
+
 ## Components
 
 - **`mcp-memory-server/`** — an MCP server exposing durable, scoped memory
@@ -85,6 +106,19 @@ cd /path/to/project && cairn doctor
 ./.ai/start-claude.sh
 ```
 
+After setup, the basic workflow is intentionally small:
+
+```text
+> /remember Use transactional migrations for schema changes
+Stored as patterns/transactional-migrations.
+
+> /recall transactional migrations
+patterns/transactional-migrations: Use transactional migrations for schema changes
+```
+
+The exact command rendering depends on the client. Any MCP client can call
+`memory_write` and `memory_search` directly.
+
 Prefer working from a clone? Build the server with `cd mcp-memory-server && npm
 install && npm run build`, then use `scripts/sync-claude-assets.sh` and
 `bin/cairn` in place of the installed `cairn`.
@@ -139,8 +173,14 @@ search):
 | `CAIRN_EXPLORE_REPO_ROOT` | Default repo root for `context_explore` when no per-call `repo_root` is given |
 | `CAIRN_EXTRA_SETTINGS` | Optional settings/config file the launcher layers onto the harness (wrapper seam) |
 | `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` | Override path to the domain-knowledge sync script (when the integration lives outside the repo) |
+| `CAIRN_ANYTHINGLLM_PROJECTS_FILE` | Override path to the bundled sync script's project configuration |
+| `CAIRN_ANYTHINGLLM_STATE_FILE` | Override path to the bundled sync script's incremental state |
 
 Without an API key, search degrades gracefully to substring matching.
+There is no Cairnkeep telemetry. Optional extraction, embeddings, document RAG,
+remote memory, and delegated exploration can send content to endpoints you
+configure. Review [Privacy and data flow](docs/privacy-and-data-flow.md) before
+enabling them.
 
 ## More
 
@@ -148,7 +188,9 @@ Without an API key, search degrades gracefully to substring matching.
 - **Building a private overlay** (wrap cairnkeep for your org/provider) — [docs/building-an-overlay.md](docs/building-an-overlay.md)
 - **Full operating guide** — [docs/operating.md](docs/operating.md)
 - **Memory storage and deployment** — [docs/storage.md](docs/storage.md)
+- **Privacy and data flow** — [docs/privacy-and-data-flow.md](docs/privacy-and-data-flow.md)
 - **Git providers** — [docs/git-providers.md](docs/git-providers.md)
+- **Support** — [SUPPORT.md](SUPPORT.md)
 - **Contributing** — [CONTRIBUTING.md](CONTRIBUTING.md)
 - **Security policy** — [SECURITY.md](SECURITY.md)
 

package/docs/domain-knowledge.md

@@ -28,7 +28,9 @@ work exactly the same without them.
 |---|---|
 | `ANYTHINGLLM_API_KEY` | **Required** for the domain-knowledge tools. Unset → the tools error at call time (everything else works). |
 | `ANYTHINGLLM_BASE_URL` | AnythingLLM base URL. Default `http://localhost:3001`. |
-| `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` | Path to the document-sync script used by `domain_knowledge_sync`. The core does not bundle one — point this at your own (see below). Unset → `domain_knowledge_sync` uses the in-repo default path. |
+| `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` | Optional path to a custom document-sync script. Unset -> `domain_knowledge_sync` uses the bundled deployment-neutral example. |
+| `CAIRN_ANYTHINGLLM_PROJECTS_FILE` | Optional config path for the bundled sync script. Default `${XDG_CONFIG_HOME:-~/.config}/cairnkeep/anythingllm-projects.json`. |
+| `CAIRN_ANYTHINGLLM_STATE_FILE` | Optional state path for the bundled sync script. Default `${XDG_STATE_HOME:-~/.local/state}/cairnkeep/anythingllm-sync.json`. |
 
 The workspaces the tools target come from the project's **memory config** — the
 first of `.agent/memory.json`, `.opencode/memory.json`, `.claude/memory.json`, or
@@ -73,10 +75,10 @@ returns a grounded answer.
 
 ## Setup (sync / embedding)
 
-`domain_knowledge_sync` shells out to a document-upload/embed script. Because the
-scripts that talk to your AnythingLLM (and any include/exclude rules) are
-deployment-specific, they live in **your** wrapper, not the core — point cairnkeep
-at yours:
+`domain_knowledge_sync` shells out to a document-upload/embed script. Cairnkeep
+ships a deployment-neutral example that reads its project mapping from a config
+file. For deployment-specific authentication, checkout rules, or document
+selection, keep a customized script in your overlay and point Cairnkeep at it:
 
 ```bash
 CAIRN_ANYTHINGLLM_SYNC_SCRIPT=/abs/path/to/your/sync_to_anythingllm.py
@@ -86,11 +88,13 @@ The script receives the workspace slug and is expected to upload + embed the
 project's documents into that AnythingLLM workspace. See
 [building-an-overlay.md](building-an-overlay.md) for the wrapper pattern.
 
-A working, deployment-agnostic starting point lives in
-[`examples/anythingllm/`](../examples/anythingllm/): an incremental
-(sha256-tracked) multi-project sync script plus a config schema. Copy it, adapt
-`anythingllm-projects.json`, and point `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` at your
-copy.
+The bundled default lives in
+[`examples/anythingllm/`](../examples/anythingllm/): an incremental,
+SHA-256-tracked multi-project sync script plus a config schema. Put a customized
+copy of the example JSON at the default user config path, or set
+`CAIRN_ANYTHINGLLM_PROJECTS_FILE`. Existing custom scripts with configuration
+and state beside the script retain that legacy behavior. To customize the
+implementation itself, set `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` to the adapted copy.
 
 ## Not using RAG?
 

package/docs/operating.md

@@ -156,6 +156,8 @@ vendor or host.
 | `ANYTHINGLLM_API_KEY` | Required to enable the optional `domain_knowledge_*` RAG tools (unset → those tools error at call time; nothing else affected). See [domain-knowledge.md](domain-knowledge.md) |
 | `ANYTHINGLLM_BASE_URL` | AnythingLLM base URL for `domain_knowledge_*` (default `http://localhost:3001`) |
 | `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` | Override path to the `domain_knowledge_sync` document-sync script (unset → in-repo default) |
+| `CAIRN_ANYTHINGLLM_PROJECTS_FILE` | Override path to the bundled sync script's project configuration |
+| `CAIRN_ANYTHINGLLM_STATE_FILE` | Override path to the bundled sync script's incremental state |
 
 ### Domain knowledge (RAG via AnythingLLM, opt-in)
 

package/docs/privacy-and-data-flow.md

@@ -0,0 +1,49 @@
+# Privacy and data flow
+
+Cairnkeep has no telemetry, analytics collector, hosted control plane, or
+automatic remote-service discovery. A default local stdio installation stores
+memory in SQLite on the machine running the MCP server and makes no model or RAG
+request unless the corresponding endpoint and credential are configured.
+
+## Data flows
+
+| Feature | Data that can leave the server machine | Destination |
+|---|---|---|
+| Local substring search | None | Local SQLite only |
+| Embedding-ranked search | Stored memory values that are not cached, plus the search query | `CAIRN_MEMORY_EMBEDDING_URL` or `CAIRN_LLM_API_URL` |
+| `memory_extract` | The transcript supplied to the tool | `CAIRN_LLM_API_URL` |
+| `domain_knowledge_query` | Workspace slug and query | `ANYTHINGLLM_BASE_URL` |
+| `domain_knowledge_sync` | Files selected by the sync configuration | `ANYTHINGLLM_BASE_URL` |
+| `route_check` | A health request, with no memory or prompt content | `CAIRN_ROUTE_ENDPOINT` |
+| `context_explore` | Repository path and query are passed to the configured local executable | `CAIRN_EXPLORE_BINARY`; any further data flow is controlled by that tool |
+| Remote HTTP memory | MCP requests and responses, including memory content | The explicitly registered Cairnkeep HTTP server |
+
+Model endpoints may be local or remote. Cairnkeep cannot determine a provider's
+retention, training, or logging policy; verify it before sending confidential
+material. Disabling `CAIRN_LLM_API_KEY`, `ANYTHINGLLM_API_KEY`, remote HTTP
+registration, and delegated tools keeps the core memory workflow local.
+
+## Data at rest
+
+Memories are stored in SQLite databases. They are not encrypted by Cairnkeep at
+the application layer. Use operating-system disk encryption, restrictive file
+permissions, encrypted backups, and host access controls appropriate to the
+sensitivity of the material. SQLite `-wal` and `-shm` sidecars and exported
+archives can contain sensitive content too.
+
+Project-scoped and named/global database locations are documented in
+[Memory storage and deployment](storage.md). A remote client stores memory on
+the remote server host; changing a storage environment variable on the client
+does not relocate that server's databases.
+
+## Credentials and transport
+
+Keep API keys and bearer tokens out of repositories and command output. Load
+them from a secret manager or protected environment file. For remote HTTP mode,
+use TLS or an encrypted private network and keep the raw listener on loopback.
+One HTTP bearer token grants access to the entire server; Cairnkeep does not
+provide tenant isolation or per-scope authorization.
+
+Before sharing diagnostics, remove credentials, private endpoints, database
+files, memory values, local paths, and project names. Report vulnerabilities
+through the private channel in [SECURITY.md](../SECURITY.md).

package/docs/releasing.md

@@ -0,0 +1,33 @@
+# Releasing
+
+Publishing is driven by a GitHub Release. Maintainers do not publish the package
+from a workstation.
+
+## Release contract
+
+1. Update the root `package.json` version and `CHANGELOG.md` on a pull request.
+2. Run `npm ci`, `npm run check:public`, and
+   `npm --prefix mcp-memory-server test`.
+3. Merge only after every required CI check passes.
+4. Publish a GitHub Release whose tag is exactly `v<package.json version>`.
+5. The `Publish release` workflow checks out that immutable tag, repeats the
+   tests, and publishes `@cairnkeep/cli` with npm provenance.
+6. The workflow attaches the npm tarball, a CycloneDX SBOM, and SHA-256 checksums
+   to the GitHub Release.
+
+Stable versions must use a stable GitHub Release and publish to npm's `latest`
+tag. SemVer prerelease versions must use a GitHub prerelease and publish to
+`next`. A mismatch fails before publication.
+
+The workflow is safe to rerun: it skips `npm publish` when that exact version is
+already present, then regenerates and replaces the release artifacts.
+
+## Repository configuration
+
+The repository must provide an `NPM_TOKEN` Actions secret authorized to publish
+`@cairnkeep/cli`. Keep that credential out of local files and rotate it according
+to the npm account's security policy. The workflow grants only `contents: write`
+and `id-token: write`; the latter is required for npm provenance.
+
+Treat a published version as immutable. If a release is wrong, fix it in a new
+version rather than moving its tag or replacing the npm package.

package/docs/storage.md

@@ -129,8 +129,18 @@ claude mcp remove cairn-memory -s user 2>/dev/null || true
 claude mcp add --transport http -s user \
   cairn-memory "$CAIRN_MEMORY_REMOTE_URL" \
   --header "Authorization: Bearer $CAIRN_MEMORY_HTTP_TOKEN"
+
+codex mcp remove cairn-memory 2>/dev/null || true
+codex mcp add cairn-memory \
+  --url "$CAIRN_MEMORY_REMOTE_URL" \
+  --bearer-token-env-var CAIRN_MEMORY_HTTP_TOKEN
 ```
 
+Codex reads the bearer token from the named environment variable when it
+starts. Do not run `codex mcp login cairn-memory`: that command starts an OAuth
+flow, while Cairnkeep intentionally uses a static bearer token and advertises
+no OAuth authorization endpoint.
+
 OpenCode is configured separately in its per-user `opencode.json`. It supports
 environment references in remote MCP headers, so the token does not need to be
 written literally into the JSON:
@@ -161,3 +171,17 @@ expands `${VAR}` references in project `.mcp.json` URL and header values;
 OpenCode uses `{env:VAR}` references. A private overlay should generate and
 merge these files so secrets remain in the process environment rather than the
 repository.
+
+For Codex, put the routing configuration in the trusted project's private
+`.codex/config.toml` and exclude it from version control:
+
+```toml
+[mcp_servers.cairn-memory]
+url = "https://memory.example.com/mcp"
+bearer_token_env_var = "CAIRN_MEMORY_HTTP_TOKEN"
+
+[mcp_servers.cairn-memory.http_headers]
+"X-Cairn-Project" = "example-project"
+"X-Cairn-Scopes" = "identity,personal,project"
+"X-Cairn-AnythingLLM-Workspaces" = "engineering-patterns"
+```

package/examples/anythingllm/README.md

@@ -0,0 +1,66 @@
+# AnythingLLM sync — reference example
+
+The bundled reference implementation of the document-sync script that
+Cairnkeep's `domain_knowledge_sync` tool shells out to. It is a usable,
+deployment-neutral starting point; copy and adapt it when endpoint,
+authentication, or include/exclude rules are deployment-specific.
+
+See [`../../docs/domain-knowledge.md`](../../docs/domain-knowledge.md) for the
+full RAG picture.
+
+## What it does
+
+Incrementally syncs each configured project's docs into its own AnythingLLM
+workspace: creates the workspace, uploads changed files (tracked by sha256),
+embeds them, and removes docs that disappeared. Supports `--dry-run`, `--full`,
+`--replace`, `--rebuild-state`, `--list`, and `--project <slug>`.
+
+## Setup
+
+1. Requires Python 3 and `requests` (`pip install requests`).
+2. Copy the config to the default user config location and fill in your
+   projects:
+   ```bash
+   mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/cairnkeep"
+   cp anythingllm-projects.example.json \
+     "${XDG_CONFIG_HOME:-$HOME/.config}/cairnkeep/anythingllm-projects.json"
+   # edit: set each project's absolute path, slug, and include/exclude globs
+   ```
+3. Point at your AnythingLLM instance:
+   ```bash
+   export ANYTHINGLLM_BASE_URL=http://localhost:3001   # default
+   export ANYTHINGLLM_API_KEY=<your AnythingLLM API key>
+   ```
+4. First upload, then keep it in sync:
+   ```bash
+   python3 sync_to_anythingllm.py --full --project my-project
+   python3 sync_to_anythingllm.py                       # incremental, all projects
+   ```
+
+## Wiring into cairnkeep
+
+The installed server uses this script by default. To use an adapted copy, set:
+
+```bash
+CAIRN_ANYTHINGLLM_SYNC_SCRIPT=/abs/path/to/sync_to_anythingllm.py
+```
+
+Override the user-owned configuration or state locations when needed:
+
+```bash
+CAIRN_ANYTHINGLLM_PROJECTS_FILE=/abs/path/to/anythingllm-projects.json
+CAIRN_ANYTHINGLLM_STATE_FILE=/abs/path/to/anythingllm-sync.json
+```
+
+For backward compatibility, an existing `anythingllm-projects.json` beside a
+customized script and its `.anythingllm-sync.json` state are still used when the
+override variables are unset.
+
+## Files
+
+| File | Committed? | Notes |
+|---|---|---|
+| `sync_to_anythingllm.py` | yes | the script |
+| `anythingllm-projects.example.json` | yes | schema template |
+| `anythingllm-projects.json` | **no** | User-owned config; defaults under the XDG config directory |
+| `anythingllm-sync.json` | **no** | Machine-local SHA-256 state; defaults under the XDG state directory |

package/examples/anythingllm/anythingllm-projects.example.json

@@ -0,0 +1,30 @@
+{
+  "projects": [
+    {
+      "slug": "my-project",
+      "display_name": "My Project Documentation",
+      "path": "/abs/path/to/my-project",
+      "patterns": [
+        "README.md",
+        "docs/**/*.md"
+      ],
+      "exclude_patterns": [
+        "CHANGELOG.md",
+        "LICENSE.md"
+      ]
+    },
+    {
+      "slug": "another-project",
+      "display_name": "Another Project Docs",
+      "path": "/abs/path/to/another-project",
+      "patterns": [
+        "AGENTS.md",
+        "docs/**/*.md",
+        ".planning/wiki/**/*.md"
+      ],
+      "exclude_patterns": [
+        ".planning/wiki/tmp/**"
+      ]
+    }
+  ]
+}

package/examples/anythingllm/sync_to_anythingllm.py

@@ -0,0 +1,596 @@
+#!/usr/bin/env python3
+"""
+Multi-project incremental sync into AnythingLLM.
+
+Each project repo gets its own AnythingLLM workspace. Projects are configured
+in the file selected by CAIRN_ANYTHINGLLM_PROJECTS_FILE, the legacy file next to
+this script when present, or the XDG user config directory.
+
+This is the bundled reference implementation wired to Cairnkeep's
+`domain_knowledge_sync` tool. See ../../docs/domain-knowledge.md.
+
+Usage:
+    # Sync all configured projects (normal workflow after git pull):
+    python3 sync_to_anythingllm.py
+
+    # Only sync one project:
+    python3 sync_to_anythingllm.py --project my-project
+
+    # Preview without making changes:
+    python3 sync_to_anythingllm.py --dry-run
+
+    # First-time upload for a new project:
+    python3 sync_to_anythingllm.py --full --project my-project
+
+    # Replace stale embedded workspace docs, then upload current configured docs:
+    python3 sync_to_anythingllm.py --replace --project my-project
+
+    # Rebuild state from existing store (recovery, no re-upload):
+    python3 sync_to_anythingllm.py --rebuild-state --project my-project
+
+    # List all configured projects and file counts:
+    python3 sync_to_anythingllm.py --list
+
+Config:  ${XDG_CONFIG_HOME:-~/.config}/cairnkeep/anythingllm-projects.json
+State:   ${XDG_STATE_HOME:-~/.local/state}/cairnkeep/anythingllm-sync.json
+
+State file format:
+    {
+      "project-a": { "docs/foo.md": {"location": "custom-documents/foo-uuid.json", "sha256": "..."} },
+      "project-b": { ... },
+      ...
+    }
+"""
+
+import argparse
+import fnmatch
+import hashlib
+import json
+import os
+import sys
+import time
+from pathlib import Path
+
+import requests
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+BASE_URL = f"{os.environ.get('ANYTHINGLLM_BASE_URL', 'http://localhost:3001').rstrip('/')}/api/v1"
+API_KEY = os.environ.get("ANYTHINGLLM_API_KEY", "")
+
+SCRIPT_DIR = Path(__file__).parent
+LEGACY_CONFIG_FILE = SCRIPT_DIR / "anythingllm-projects.json"
+CONFIG_HOME = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"))
+STATE_HOME = Path(os.environ.get("XDG_STATE_HOME", Path.home() / ".local" / "state"))
+
+if os.environ.get("CAIRN_ANYTHINGLLM_PROJECTS_FILE"):
+    CONFIG_FILE = Path(os.environ["CAIRN_ANYTHINGLLM_PROJECTS_FILE"]).expanduser()
+elif LEGACY_CONFIG_FILE.exists():
+    CONFIG_FILE = LEGACY_CONFIG_FILE
+else:
+    CONFIG_FILE = CONFIG_HOME / "cairnkeep" / "anythingllm-projects.json"
+
+if os.environ.get("CAIRN_ANYTHINGLLM_STATE_FILE"):
+    STATE_FILE = Path(os.environ["CAIRN_ANYTHINGLLM_STATE_FILE"]).expanduser()
+elif CONFIG_FILE == LEGACY_CONFIG_FILE:
+    STATE_FILE = SCRIPT_DIR / ".anythingllm-sync.json"
+else:
+    STATE_FILE = STATE_HOME / "cairnkeep" / "anythingllm-sync.json"
+
+HEADERS = {"Authorization": f"Bearer {API_KEY}"}
+JSON_HEADERS = {**HEADERS, "Content-Type": "application/json"}
+
+EMBED_BATCH_SIZE = 5
+EMBED_TIMEOUT = 600  # seconds per embed batch
+
+WORKSPACE_SYSTEM_PROMPT = (
+    "You are an assistant for the {display_name} documentation. "
+    "Answer the user question using ONLY the context documents provided below. "
+    "Do not rely on prior knowledge or make assumptions beyond what is explicitly "
+    "stated in the documents.\n\n"
+    "Rules:\n"
+    "- If the answer is clearly present in the context, provide a precise and structured answer.\n"
+    "- If the context does not contain enough information to answer confidently, respond: "
+    '"This information is not available in the provided documentation."\n'
+    "- Never fabricate component names, port numbers, version numbers, or procedures "
+    "not in the context.\n"
+    "- Cite which document or section your answer comes from when possible."
+)
+
+
+def require_api_key() -> None:
+    if API_KEY:
+        return
+    print("Error: ANYTHINGLLM_API_KEY is not set.")
+    sys.exit(1)
+
+# ---------------------------------------------------------------------------
+# Config loading
+# ---------------------------------------------------------------------------
+
+def load_config() -> list[dict]:
+    if not CONFIG_FILE.exists():
+        print(f"Error: Config file not found: {CONFIG_FILE}")
+        sys.exit(1)
+    data = json.loads(CONFIG_FILE.read_text())
+    return data["projects"]
+
+
+# ---------------------------------------------------------------------------
+# State file helpers
+# ---------------------------------------------------------------------------
+
+def load_state() -> dict:
+    """
+    Load full state: {project_slug: {relative_path: {location, sha256}}}
+
+    Automatically migrates a legacy flat (single-project) state file into the
+    nested multi-project format, keyed under the "default" slug.
+    """
+    if not STATE_FILE.exists():
+        return {}
+    raw = json.loads(STATE_FILE.read_text())
+    if not raw:
+        return {}
+    # Detect old flat format: top-level values are {location, sha256} dicts
+    first_val = next(iter(raw.values()))
+    if isinstance(first_val, dict) and "location" in first_val:
+        print("[INFO] Migrating state file from flat to multi-project format...")
+        return {"default": raw}
+    return raw
+
+
+def save_state(state: dict) -> None:
+    STATE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    STATE_FILE.write_text(json.dumps(state, indent=2))
+
+
+def file_sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    h.update(path.read_bytes())
+    return h.hexdigest()
+
+
+# ---------------------------------------------------------------------------
+# File collection
+# ---------------------------------------------------------------------------
+
+def is_excluded(rel: str, excludes: list[str]) -> bool:
+    """Return True if the relative path matches any exclude pattern."""
+    name = os.path.basename(rel)
+    for exc in excludes:
+        if fnmatch.fnmatch(rel, exc):
+            return True
+        if fnmatch.fnmatch(name, exc):
+            return True
+    return False
+
+
+def collect_files(project: dict) -> dict[str, Path]:
+    """
+    Return {relative_path_str: absolute_Path} for all files matching the
+    project's include patterns minus any exclude patterns. Paths are relative
+    to the project root.
+    """
+    root = Path(project["path"])
+    patterns = project.get("patterns", ["docs/**/*.md"])
+    excludes = project.get("exclude_patterns", [])
+
+    result: dict[str, Path] = {}
+    for pattern in patterns:
+        for p in root.glob(pattern):
+            if not p.is_file():
+                continue
+            rel = str(p.relative_to(root))
+            if not is_excluded(rel, excludes):
+                result[rel] = p
+    return result
+
+
+# ---------------------------------------------------------------------------
+# AnythingLLM API helpers
+# ---------------------------------------------------------------------------
+
+def ensure_workspace(slug: str, display_name: str) -> str:
+    """
+    Create the workspace if it doesn't exist, then apply standard RAG settings.
+    Returns the actual workspace slug to use for all subsequent API calls,
+    or empty string on failure.
+
+    Uses the project slug as the workspace name so AnythingLLM generates
+    a matching slug (e.g. name='my-project' -> slug='my-project').
+    """
+    resp = requests.get(f"{BASE_URL}/workspaces", headers=HEADERS, timeout=10)
+    if resp.status_code == 200:
+        for ws in resp.json().get("workspaces", []):
+            if ws["slug"] == slug:
+                update_workspace_settings(slug, display_name)
+                return slug
+
+    # Create -- use slug as name so AnythingLLM generates the exact slug we want
+    resp = requests.post(
+        f"{BASE_URL}/workspace/new",
+        headers=JSON_HEADERS,
+        data=json.dumps({"name": slug}),
+        timeout=10,
+    )
+    if resp.status_code != 200:
+        print(f"  [WARN] Could not create workspace '{slug}': {resp.status_code} {resp.text[:200]}")
+        return ""
+
+    actual_slug = resp.json().get("workspace", {}).get("slug", slug)
+
+    update_workspace_settings(actual_slug, display_name)
+    print(f"  Created workspace: {actual_slug}")
+    return actual_slug
+
+
+def update_workspace_settings(slug: str, display_name: str) -> None:
+    """Apply standard RAG settings and project-specific system prompt."""
+    requests.post(
+        f"{BASE_URL}/workspace/{slug}/update",
+        headers=JSON_HEADERS,
+        data=json.dumps({
+            "openAiTemp": 0,
+            "topN": 6,
+            "similarityThreshold": 0.20,
+            "openAiPrompt": WORKSPACE_SYSTEM_PROMPT.format(display_name=display_name),
+            "queryRefusalResponse": f"This information is not available in the provided {display_name} documentation.",
+            "chatMode": "automatic",
+        }),
+        timeout=10,
+    )
+
+
+def upload_file(filepath: Path) -> str | None:
+    """Upload a single markdown file. Returns the location string or None."""
+    with open(filepath, "rb") as f:
+        resp = requests.post(
+            f"{BASE_URL}/document/upload",
+            headers=HEADERS,
+            files={"file": (filepath.name, f, "text/markdown")},
+            timeout=60,
+        )
+    if resp.status_code == 200:
+        docs = resp.json().get("documents", [])
+        if docs:
+            return docs[0].get("location")
+    print(f"  [WARN] Upload failed for {filepath.name}: {resp.status_code} {resp.text[:200]}")
+    return None
+
+
+def embed_locations(slug: str, locations: list[str]) -> bool:
+    """Embed document locations into a workspace in batches."""
+    for i in range(0, len(locations), EMBED_BATCH_SIZE):
+        batch = locations[i: i + EMBED_BATCH_SIZE]
+        resp = requests.post(
+            f"{BASE_URL}/workspace/{slug}/update-embeddings",
+            headers=JSON_HEADERS,
+            data=json.dumps({"adds": batch, "deletes": []}),
+            timeout=EMBED_TIMEOUT,
+        )
+        if resp.status_code != 200:
+            print(f"  [WARN] Embed failed: {resp.status_code} {resp.text[:200]}")
+            return False
+        time.sleep(1)
+    return True
+
+
+def unembed_locations(slug: str, locations: list[str]) -> bool:
+    """Remove document locations from a workspace (un-embed only, keeps store)."""
+    if not locations:
+        return True
+    resp = requests.post(
+        f"{BASE_URL}/workspace/{slug}/update-embeddings",
+        headers=JSON_HEADERS,
+        data=json.dumps({"adds": [], "deletes": locations}),
+        timeout=60,
+    )
+    return resp.status_code == 200
+
+
+def get_workspace_locations(slug: str) -> list[str]:
+    """Return document locations currently embedded in the workspace."""
+    resp = requests.get(f"{BASE_URL}/workspace/{slug}", headers=HEADERS, timeout=30)
+    if resp.status_code != 200:
+        print(f"  [WARN] Could not inspect workspace '{slug}': {resp.status_code} {resp.text[:200]}")
+        return []
+
+    data = resp.json()
+    workspaces = data.get("workspace", [])
+    workspace = workspaces[0] if workspaces else {}
+    return [
+        doc.get("docpath", "")
+        for doc in workspace.get("documents", [])
+        if doc.get("docpath")
+    ]
+
+
+def delete_from_store(locations: list[str]) -> bool:
+    """Permanently delete documents from the global document store."""
+    if not locations:
+        return True
+    resp = requests.delete(
+        f"{BASE_URL}/system/remove-documents",
+        headers=JSON_HEADERS,
+        data=json.dumps({"names": locations}),
+        timeout=60,
+    )
+    return resp.status_code == 200
+
+
+# ---------------------------------------------------------------------------
+# Diff logic
+# ---------------------------------------------------------------------------
+
+def compute_diff(
+    project_state: dict, files: dict[str, Path]
+) -> tuple[list[str], list[str], list[str]]:
+    """Return (added, modified, deleted) lists of relative path strings."""
+    added = [rel for rel in files if rel not in project_state]
+    deleted = [rel for rel in project_state if rel not in files]
+    modified = [
+        rel for rel, path in files.items()
+        if rel in project_state and file_sha256(path) != project_state[rel].get("sha256")
+    ]
+    return added, modified, deleted
+
+
+# ---------------------------------------------------------------------------
+# Per-project operations
+# ---------------------------------------------------------------------------
+
+def full_sync_project(project: dict, state: dict, dry_run: bool) -> None:
+    slug = project["slug"]
+    display_name = project.get("display_name", slug)
+    files = collect_files(project)
+
+    print(f"\n=== Full sync: {display_name} ({len(files)} files) ===")
+
+    if dry_run:
+        for rel in sorted(files):
+            print(f"  would upload: {rel}")
+        return
+
+    actual_slug = ensure_workspace(slug, display_name)
+    if not actual_slug:
+        return
+
+    project_state: dict = {}
+    locations: list[str] = []
+
+    print("  Uploading...")
+    for i, (rel, filepath) in enumerate(sorted(files.items()), 1):
+        print(f"  [{i}/{len(files)}] {rel}")
+        loc = upload_file(filepath)
+        if loc:
+            project_state[rel] = {"location": loc, "sha256": file_sha256(filepath)}
+            locations.append(loc)
+        time.sleep(0.1)
+
+    print(f"  Embedding {len(locations)} docs...")
+    ok = embed_locations(actual_slug, locations)
+    if not ok:
+        print("  [WARN] Some embed batches failed. State saved; retry with --full to re-embed.")
+
+    state[slug] = project_state
+    save_state(state)
+    print(f"  Done. {len(locations)} docs uploaded to workspace '{actual_slug}'")
+
+
+def replace_sync_project(project: dict, state: dict, dry_run: bool) -> None:
+    """Remove current workspace docs, then full-sync configured project docs."""
+    slug = project["slug"]
+    display_name = project.get("display_name", slug)
+    files = collect_files(project)
+
+    print(f"\n=== Replace sync: {display_name} ({len(files)} files) ===")
+
+    if dry_run:
+        print(f"  would remove embedded docs from workspace: {slug}")
+        for rel in sorted(files):
+            print(f"  would upload: {rel}")
+        return
+
+    actual_slug = ensure_workspace(slug, display_name)
+    if not actual_slug:
+        return
+
+    existing_locations = get_workspace_locations(actual_slug)
+    if existing_locations:
+        print(f"  Removing {len(existing_locations)} existing embedded doc(s)...")
+        unembed_locations(actual_slug, existing_locations)
+        delete_from_store(existing_locations)
+
+    state[slug] = {}
+    save_state(state)
+    full_sync_project(project, state, dry_run=False)
+
+
+def incremental_sync_project(project: dict, state: dict, dry_run: bool) -> None:
+    slug = project["slug"]
+    display_name = project.get("display_name", slug)
+    actual_slug = slug if dry_run else (ensure_workspace(slug, display_name) or slug)
+    project_state = state.get(slug, {})
+
+    if not project_state:
+        print(
+            f"\n[{display_name}] No sync state found. "
+            f"Run --full --project {slug} for initial upload."
+        )
+        return
+
+    files = collect_files(project)
+    added, modified, deleted = compute_diff(project_state, files)
+
+    if not added and not modified and not deleted:
+        print(f"[{display_name}] Up to date.")
+        return
+
+    print(f"\n=== [{display_name}] Changes: +{len(added)} ~{len(modified)} -{len(deleted)} ===")
+
+    if dry_run:
+        for rel in sorted(added):
+            print(f"  + {rel}")
+        for rel in sorted(modified):
+            print(f"  ~ {rel}")
+        for rel in sorted(deleted):
+            print(f"  - {rel}")
+        return
+
+    if deleted:
+        old_locs = [project_state[rel]["location"] for rel in deleted if "location" in project_state[rel]]
+        unembed_locations(actual_slug, old_locs)
+        delete_from_store(old_locs)
+        for rel in deleted:
+            del project_state[rel]
+            print(f"  [DEL] {rel}")
+        state[slug] = project_state
+        save_state(state)
+
+    if modified:
+        old_locs = [project_state[rel]["location"] for rel in modified if "location" in project_state[rel]]
+        unembed_locations(actual_slug, old_locs)
+        delete_from_store(old_locs)
+        new_locs: list[str] = []
+        for rel in modified:
+            filepath = files[rel]
+            print(f"  [MOD] {rel}")
+            loc = upload_file(filepath)
+            if loc:
+                project_state[rel] = {"location": loc, "sha256": file_sha256(filepath)}
+                new_locs.append(loc)
+            time.sleep(0.1)
+        if new_locs:
+            embed_locations(actual_slug, new_locs)
+        state[slug] = project_state
+        save_state(state)
+
+    if added:
+        new_locs = []
+        for rel in sorted(added):
+            filepath = files[rel]
+            print(f"  [ADD] {rel}")
+            loc = upload_file(filepath)
+            if loc:
+                project_state[rel] = {"location": loc, "sha256": file_sha256(filepath)}
+                new_locs.append(loc)
+            time.sleep(0.1)
+        if new_locs:
+            embed_locations(actual_slug, new_locs)
+        state[slug] = project_state
+        save_state(state)
+
+    print(f"  Done.")
+
+
+def rebuild_state_project(project: dict, state: dict) -> None:
+    """
+    Rebuild state by matching files against documents already in the store.
+    Useful for recovery when the state file is lost after docs are already uploaded.
+    Note: matches by filename (title); may be ambiguous if two projects share filenames.
+    """
+    slug = project["slug"]
+    display_name = project.get("display_name", slug)
+
+    resp = requests.get(f"{BASE_URL}/documents", headers=HEADERS, timeout=30)
+    resp.raise_for_status()
+
+    store_docs: dict[str, dict] = {}
+    for folder in resp.json().get("localFiles", {}).get("items", []):
+        folder_name = folder.get("name", "")
+        for item in folder.get("items", []):
+            title = item.get("title", "")
+            loc = f"{folder_name}/{item['name']}"
+            if title not in store_docs or item.get("published", "") > store_docs[title]["published"]:
+                store_docs[title] = {"location": loc, "published": item.get("published", "")}
+
+    files = collect_files(project)
+    project_state: dict = {}
+    matched = 0
+    unmatched: list[str] = []
+
+    for rel, filepath in files.items():
+        title = filepath.name
+        if title in store_docs:
+            project_state[rel] = {
+                "location": store_docs[title]["location"],
+                "sha256": file_sha256(filepath),
+            }
+            matched += 1
+        else:
+            unmatched.append(rel)
+
+    state[slug] = project_state
+    save_state(state)
+    print(f"[{display_name}] Rebuilt: {matched} matched, {len(unmatched)} unmatched")
+    if unmatched:
+        for u in unmatched:
+            print(f"  unmatched: {u}")
+
+
+# ---------------------------------------------------------------------------
+# Entry point
+# ---------------------------------------------------------------------------
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Multi-project AnythingLLM sync",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=(
+            "examples:\n"
+            "  sync all projects after git pull:\n"
+            "    python3 sync_to_anythingllm.py\n\n"
+            "  first-time upload for a new project:\n"
+            "    python3 sync_to_anythingllm.py --full --project my-project\n\n"
+            "  preview what would change:\n"
+            "    python3 sync_to_anythingllm.py --dry-run\n"
+        ),
+    )
+    parser.add_argument(
+        "--project", metavar="SLUG",
+        help="Only operate on this project (slug from anythingllm-projects.json).",
+    )
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument("--full", action="store_true", help="Full re-upload and re-embed")
+    group.add_argument("--replace", action="store_true", help="Remove currently embedded workspace docs, then full re-upload and re-embed")
+    group.add_argument("--rebuild-state", action="store_true", help="Rebuild state from existing store (no upload)")
+    group.add_argument("--list", action="store_true", help="List configured projects and file counts")
+    parser.add_argument("--dry-run", action="store_true", help="Show what would change without doing it")
+    args = parser.parse_args()
+
+    projects = load_config()
+    slug_map = {p["slug"]: p for p in projects}
+
+    if args.list:
+        print(f"{'SLUG':<25} {'FILES':>6}  PATH")
+        print("-" * 70)
+        for p in projects:
+            files = collect_files(p)
+            print(f"{p['slug']:<25} {len(files):>6}  {p['path']}")
+        return
+
+    require_api_key()
+
+    if args.project and args.project not in slug_map:
+        print(f"Error: Unknown project '{args.project}'. Known: {', '.join(slug_map)}")
+        sys.exit(1)
+
+    target_projects = [slug_map[args.project]] if args.project else projects
+    state = load_state()
+
+    for project in target_projects:
+        if args.rebuild_state:
+            rebuild_state_project(project, state)
+        elif args.replace:
+            replace_sync_project(project, state, dry_run=args.dry_run)
+        elif args.full:
+            full_sync_project(project, state, dry_run=args.dry_run)
+        else:
+            incremental_sync_project(project, state, dry_run=args.dry_run)
+
+
+if __name__ == "__main__":
+    main()

package/mcp-memory-server/dist/index.js

@@ -17,12 +17,11 @@ class ClientContextError extends Error {
 }
 const moduleDir = dirname(fileURLToPath(import.meta.url));
 const infraRoot = resolve(moduleDir, "..", "..");
-// Path to the domain-knowledge sync script. Defaults to a script bundled next to
-// this repo, but a wrapper can point CAIRN_ANYTHINGLLM_SYNC_SCRIPT at its own copy
-// (the integration scripts often live in the wrapper, not the core).
+// Path to the bundled deployment-neutral sync script. An overlay can replace it
+// with a deployment-specific implementation.
 const anythingllmSyncScript = process.env.CAIRN_ANYTHINGLLM_SYNC_SCRIPT
     ? resolve(expandHome(process.env.CAIRN_ANYTHINGLLM_SYNC_SCRIPT))
-    : join(infraRoot, "anythingllm", "sync_to_anythingllm.py");
+    : join(infraRoot, "examples", "anythingllm", "sync_to_anythingllm.py");
 const HISTORY_NAMESPACE = "__history__";
 const PROJECT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 const WORKSPACE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnkeep/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "A durable, harness-agnostic memory + context layer for coding agents (Claude Code, OpenCode).",
   "license": "Apache-2.0",
   "type": "module",
@@ -16,7 +16,9 @@
     "templates/",
     "claude/",
     "opencode/",
+    "examples/anythingllm/",
     "docs/",
+    "CHANGELOG.md",
     "CONTRIBUTING.md",
     "SECURITY.md",
     "mcp-memory-server/dist/",
@@ -36,8 +38,8 @@
     "fix:perms": "git ls-files -s | awk '$1==\"100755\"{print $4}' | xargs chmod 755",
     "prepack": "npm run build:server && npm run fix:perms",
     "test": "for test in scripts/test-*.sh; do \"$test\" || exit 1; done",
-    "check:public": "scripts/verify-no-private-references.sh && scripts/verify-docs-parity.sh && npm test",
-    "prepublishOnly": "npm run check:public && npm run build:server && npm --prefix mcp-memory-server test --global=false --dry-run=false"
+    "check:public": "scripts/verify-no-private-references.sh && scripts/verify-docs-parity.sh && npm run build:server && npm test",
+    "prepublishOnly": "npm run check:public && npm --prefix mcp-memory-server test --global=false --dry-run=false"
   },
   "repository": {
     "type": "git",

package/scripts/probe-memory-server.mjs

@@ -1,13 +1,21 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
 
-const serverPath = process.argv[2];
-if (!serverPath) {
-  console.error("usage: probe-memory-server.mjs PATH_TO_SERVER");
+const probeArgs = process.argv.slice(2);
+if (probeArgs.length === 0) {
+  console.error("usage: probe-memory-server.mjs PATH_TO_SERVER | --command COMMAND [ARGS...]");
   process.exit(2);
 }
 
-const child = spawn(process.execPath, [serverPath], {
+const commandMode = probeArgs[0] === "--command";
+const command = commandMode ? probeArgs[1] : process.execPath;
+const commandArgs = commandMode ? probeArgs.slice(2) : [probeArgs[0]];
+if (!command) {
+  console.error("probe-memory-server.mjs: --command requires a command");
+  process.exit(2);
+}
+
+const child = spawn(command, commandArgs, {
   env: process.env,
   stdio: ["pipe", "pipe", "pipe"],
 });
@@ -29,7 +37,11 @@ const response = new Promise((resolve, reject) => {
       if (!line.trim()) continue;
       try {
         const message = JSON.parse(line);
-        if (message.id === 1 && message.result?.serverInfo?.name === "cairn-memory") {
+        if (
+          message.id === 1 &&
+          message.result?.serverInfo?.name === "cairn-memory" &&
+          message.result?.capabilities?.tools
+        ) {
           resolve();
           return;
         }

package/scripts/smoke-mcp-boot.sh

@@ -5,35 +5,28 @@
 # transport works. This is the core product path, and nothing else tests it
 # after packaging/installation.
 #
-# Prefers `cairn memory-server` (a global install), else falls back to node on
-# the repo's dist build — so it works both post-install and from a clone.
+# Prefers `cairn memory-server` (a global install), else falls back to the
+# repository build. The Node probe owns the timeout so this works on macOS,
+# which does not ship GNU `timeout`.
 set -uo pipefail
 
 ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
 if command -v cairn >/dev/null 2>&1; then
-  server=(cairn memory-server)
+  probe=(node "$ROOT_DIR/scripts/probe-memory-server.mjs" --command cairn memory-server)
 elif [[ -f "$ROOT_DIR/mcp-memory-server/dist/index.js" ]]; then
-  server=(node "$ROOT_DIR/mcp-memory-server/dist/index.js")
+  probe=(node "$ROOT_DIR/scripts/probe-memory-server.mjs" "$ROOT_DIR/mcp-memory-server/dist/index.js")
 else
   echo "smoke-mcp-boot: FAIL (no cairn on PATH and no dist build to run)"
   exit 1
 fi
 
-req='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}'
-
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 
-# HOME points at a throwaway dir so the server's default store (~/.cairnkeep)
-# lands there; `head -1` closes stdin after the first reply, so the server sees
-# EOF and exits cleanly.
-out=$(printf '%s\n' "$req" | HOME="$tmp" timeout 15 "${server[@]}" 2>/dev/null | head -1)
-
-if grep -q '"result"' <<<"$out" && grep -q '"tools"' <<<"$out"; then
+if HOME="$tmp" "${probe[@]}"; then
   echo "smoke-mcp-boot: OK (server booted, initialize returned tools capability)"
   exit 0
 fi
 echo "smoke-mcp-boot: FAIL (no valid initialize response)"
-echo "  got: ${out:0:200}"
 exit 1

package/scripts/test-package-install.sh

@@ -29,4 +29,8 @@ bootstrap_output=$(cairn bootstrap "$tmp/project")
 
 (cd "$tmp/project" && cairn doctor) >/dev/null || fail "installed package failed cairn doctor"
 
+installed_root="$tmp/prefix/lib/node_modules/@cairnkeep/cli"
+[[ -f "$installed_root/examples/anythingllm/sync_to_anythingllm.py" ]] || \
+  fail "npm tarball omitted the default AnythingLLM sync script"
+
 echo "PASS: npm tarball installs a self-contained CLI and MCP server"

package/templates/env.example.template

@@ -27,3 +27,9 @@
 # Optional: comma-separated allowed Host headers for DNS-rebinding protection
 # (default: the bind host + localhost on the chosen port).
 # CAIRN_MEMORY_HTTP_ALLOWED_HOSTS=
+#
+# Optional document-RAG sync. API credentials and endpoint may be local or remote.
+# ANYTHINGLLM_BASE_URL=http://localhost:3001
+# ANYTHINGLLM_API_KEY=
+# CAIRN_ANYTHINGLLM_PROJECTS_FILE=~/.config/cairnkeep/anythingllm-projects.json
+# CAIRN_ANYTHINGLLM_STATE_FILE=~/.local/state/cairnkeep/anythingllm-sync.json