@cairnkeep/cli 2.21.0 → 2.22.0

package/scripts/test-ci-sharding.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+node --input-type=module - "$ROOT" <<'NODE'
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const root = process.argv[2];
+const { buildShardPlan, smokeChecks } = await import(
+  pathToFileURL(join(root, "mcp-memory-server", "scripts", "run-smoke-suite.mjs")));
+const plan = buildShardPlan(3);
+const flattened = plan.flatMap(({ checks }) => checks.map(({ name }) => name));
+assert.equal(flattened.length, smokeChecks.length);
+assert.equal(new Set(flattened).size, smokeChecks.length);
+assert.deepEqual([...flattened].sort(), smokeChecks.map(({ name }) => name).sort());
+assert.ok(plan.every(({ checks }) => checks.length > 0));
+const weights = plan.map(({ weight }) => weight);
+assert.ok(Math.max(...weights) - Math.min(...weights) <= 5,
+  `native Windows shards are imbalanced: ${weights.join(", ")}`);
+
+const pkg = JSON.parse(readFileSync(join(root, "mcp-memory-server", "package.json"), "utf8"));
+assert.match(pkg.scripts["test:smoke"], /run-smoke-suite\.mjs/);
+const workflow = readFileSync(join(root, ".github", "workflows", "ci.yml"), "utf8");
+assert.match(workflow, /name: native-windows \(\$\{\{ matrix\.node \}\}\)/);
+for (const shard of ["1/3", "2/3", "3/3"]) assert.ok(workflow.includes(`shard: "${shard}"`));
+assert.match(workflow, /run-smoke-suite\.mjs --shard \$\{\{ matrix\.shard \}\}/);
+assert.doesNotMatch(workflow.match(/  native-windows:[\s\S]*?\n  repository:/)?.[0] ?? "",
+  /npm --prefix mcp-memory-server test/);
+console.log(`PASS: ${smokeChecks.length} memory-server contracts split once across balanced Windows shards (${weights.join(", ")})`);
+NODE

package/scripts/test-completion.sh

@@ -12,8 +12,8 @@ for shell in bash zsh fish; do
 done
 
 capability_ids='memory.write memory.search notes.distill wiki graph security.audit route.check context.explore'
-eval_commands='validate run ablate report prune delete'
-eval_flags='--task-set --adapter --output --repetitions --seed --json --yes --disable --experiment --older-than-days --dry-run'
+eval_commands='validate run ablate report prune delete protocol'
+eval_flags='--task-set --adapter --output --repetitions --seed --json --yes --disable --experiment --older-than-days --dry-run --trajectory --codex-jsonl --capture-authorized'
 skill_commands='harvest list show review propose evaluate apply rollback'
 for shell in bash zsh fish; do
   grep -q 'capabilities' "$tmp/$shell"
@@ -70,7 +70,7 @@ for shell in bash zsh fish; do
 done
 
 "$ROOT/bin/cairn" help >"$tmp/root-help"
-grep -qF 'cairn eval <validate|run|ablate|report|prune|delete>' "$tmp/root-help"
+grep -qF 'cairn eval <validate|run|ablate|report|prune|delete|protocol>' "$tmp/root-help"
 node "$ROOT/mcp-memory-server/dist/eval-cli.js" --help >"$tmp/eval-help"
 for command in $eval_commands; do
   grep -q "cairn eval $command" "$tmp/eval-help"
@@ -152,6 +152,10 @@ for shell in bash zsh fish; do
   fi
 done
 "$ROOT/bin/cairn" completion powershell >"$tmp/powershell"
+grep -qF "'protocol'" "$tmp/powershell"
+grep -qF "'--trajectory'" "$tmp/powershell"
+grep -qF "'--codex-jsonl'" "$tmp/powershell"
+grep -qF "'--capture-authorized'" "$tmp/powershell"
 if ! grep -qE "['\"]setup['\"]" "$tmp/powershell"; then
   completion_surface_complete=false
 fi

package/scripts/test-doctor.sh

@@ -92,13 +92,15 @@ const server = createServer((request, response) => {
   request.on("end", () => {
     let body = {};
     try { body = JSON.parse(Buffer.concat(chunks).toString("utf8")); } catch {}
-    const valid = request.url === "/v1/embeddings"
-      && request.headers.authorization === "Bearer test-key"
-      && body.model === "test-embedding";
-    response.writeHead(valid ? 200 : 404, { "Content-Type": "application/json" });
-    response.end(JSON.stringify(valid
+    const routeValid = request.url === "/v1/embeddings";
+    const keyValid = request.headers.authorization === "Bearer test-key";
+    const modelValid = body.model === "test-embedding";
+    const unauthorized = body.model === "unauthorized-model";
+    const status = routeValid && keyValid && modelValid ? 200 : unauthorized ? 403 : 404;
+    response.writeHead(status, { "Content-Type": "application/json" });
+    response.end(JSON.stringify(status === 200
       ? { data: [{ index: 0, embedding: [1, 0] }] }
-      : { error: "invalid request" }));
+      : { message: "private upstream detail must not leak", request_id: "private-request-id" }));
   });
 });
 server.listen(0, "127.0.0.1", () => {
@@ -122,17 +124,33 @@ EOF
   grep -q "\[PASS\] embedding endpoint accepted model test-embedding" "$tmp/out3" ||
     fail "expected a functional embedding PASS line"
 
-  proj4="$tmp/embedding-wrong-model"; mkdir -p "$proj4/.ai"
+  proj4="$tmp/embedding-unauthorized"; mkdir -p "$proj4/.ai"
   cat > "$proj4/.ai/.env" <<EOF
 CAIRN_MEMORY_EMBEDDING_URL=http://127.0.0.1:$port/v1
-CAIRN_MEMORY_EMBEDDING_MODEL=missing-model
+CAIRN_MEMORY_EMBEDDING_MODEL=unauthorized-model
 CAIRN_LLM_API_KEY=test-key
 EOF
   if ( cd "$proj4" && "$doctor" ) >"$tmp/out4" 2>&1; then
-    fail "doctor should reject a missing embedding model:\n$(cat "$tmp/out4")"
+    fail "doctor should reject an unauthorized embedding request:\n$(cat "$tmp/out4")"
+  fi
+  grep -q "\[FAIL\] embedding authorization rejected (HTTP 403) for model unauthorized-model" "$tmp/out4" ||
+    fail "expected a sanitized embedding authorization diagnostic"
+  ! grep -q "private upstream detail\|private-request-id" "$tmp/out4" ||
+    fail "embedding diagnostic leaked an upstream body or request id"
+
+  proj5="$tmp/embedding-missing-model"; mkdir -p "$proj5/.ai"
+  cat > "$proj5/.ai/.env" <<EOF
+CAIRN_MEMORY_EMBEDDING_URL=http://127.0.0.1:$port/v1
+CAIRN_MEMORY_EMBEDDING_MODEL=missing-model
+CAIRN_LLM_API_KEY=test-key
+EOF
+  if ( cd "$proj5" && "$doctor" ) >"$tmp/out5" 2>&1; then
+    fail "doctor should reject a missing embedding model:\n$(cat "$tmp/out5")"
   fi
-  grep -q "\[FAIL\] embedding request failed for model missing-model" "$tmp/out4" ||
-    fail "expected a functional embedding FAIL line"
+  grep -q "\[FAIL\] embedding endpoint or model not found (HTTP 404) for model missing-model" "$tmp/out5" ||
+    fail "expected a sanitized missing embedding model diagnostic"
+  ! grep -q "private upstream detail\|private-request-id" "$tmp/out5" ||
+    fail "missing-model diagnostic leaked an upstream body or request id"
 fi
 
 # 5. Artifact doctor passes a valid store, repairs only derived state, and

package/scripts/test-ecosystem-spikes.sh

@@ -6,6 +6,7 @@ ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 for script in \
   run-memfork-evaluation.mjs \
   run-clm-pi-evaluation.mjs \
+  verify-release-ledger.mjs \
   run-ollaya-decision-evaluation.mjs
 do
   node --check "$ROOT/scripts/spikes/$script"

package/scripts/test-package-install.sh

@@ -76,6 +76,21 @@ cmp -s "$tmp/source-eval-disabled.json" "$tmp/installed-eval-disabled.json" || \
   fail "source and installed disabled eval identity differ"
 [[ ! -e "$tmp/installed-unwritten-output" ]] || fail "installed disabled eval created output"
 
+CAIRN_EVAL=1 cairn eval protocol \
+  --trajectory "$installed_root/examples/eval/protocol-project-search.json" --json >"$tmp/protocol-pass.json"
+node -e 'const v=require(process.argv[1]);if(v.status!=="pass"||v.evidence_scope!=="local-trajectory-observation")process.exit(1)' "$tmp/protocol-pass.json" \
+  || fail "installed memory protocol positive control failed"
+set +e
+CAIRN_EVAL=1 cairn eval protocol \
+  --trajectory "$installed_root/examples/eval/protocol-narration.json" --json >"$tmp/protocol-fail.json"
+protocol_status=$?
+set -e
+[[ "$protocol_status" -eq 1 ]] || fail "installed memory protocol counted narration as evidence"
+CAIRN_EVAL=1 cairn eval protocol \
+  --codex-jsonl "$installed_root/examples/eval/protocol-codex.jsonl" --json >"$tmp/protocol-codex.json"
+node -e 'const v=require(process.argv[1]);if(v.status!=="pass"||v.harness!=="codex")process.exit(1)' "$tmp/protocol-codex.json" \
+  || fail "installed native Codex protocol control failed"
+
 for required in \
   schemas/capability-contract.schema.json \
   schemas/capability-callback.schema.json \
@@ -159,11 +174,16 @@ for required in \
   mcp-memory-server/dist/eval-report.js \
   mcp-memory-server/dist/eval-runner.js \
   mcp-memory-server/dist/eval-cli.js \
+  mcp-memory-server/dist/eval-protocol.js \
+  mcp-memory-server/dist/eval-codex.js \
   scripts/fake-eval-adapter.mjs \
   examples/eval/task-set.json \
   examples/eval/bundled-fake.json \
   examples/eval/adapter.json \
   examples/eval/ecosystem-decisions.json \
+  examples/eval/protocol-project-search.json \
+  examples/eval/protocol-narration.json \
+  examples/eval/protocol-codex.jsonl \
   examples/eval/README.md
 do
   [[ -f "$installed_root/$required" ]] || fail "npm tarball omitted $required"
@@ -183,13 +203,16 @@ for asset in \
   examples/eval/bundled-fake.json \
   examples/eval/adapter.json \
   examples/eval/ecosystem-decisions.json \
+  examples/eval/protocol-project-search.json \
+  examples/eval/protocol-narration.json \
+  examples/eval/protocol-codex.jsonl \
   examples/eval/README.md
 do
   [[ ! -x "$installed_root/$asset" ]] || \
     fail "installed public eval data asset is unexpectedly executable: $asset"
 done
 eval_assets=$(cd "$installed_root/examples/eval" && find . -type f -print | LC_ALL=C sort)
-[[ "$eval_assets" == $'./README.md\n./adapter.json\n./bundled-fake.json\n./ecosystem-decisions.json\n./task-set.json' ]] || \
+[[ "$eval_assets" == $'./README.md\n./adapter.json\n./bundled-fake.json\n./ecosystem-decisions.json\n./protocol-codex.jsonl\n./protocol-narration.json\n./protocol-project-search.json\n./task-set.json' ]] || \
   fail "installed eval examples contain an unexpected path"
 
 node - "$installed_root/examples/eval/adapter.json" <<'NODE'

package/scripts/windows-platform.mjs

@@ -736,7 +736,8 @@ export function powershellCompletion() {
   $pack = 'init','lock','validate','install','import-okf','validate-okf','export-okf','list','show','remove','enable','disable','update','skills','approve-skill','revoke-skill','doctor','--repair','--project','--project-id','--json'
   $proposals = 'create','list','show','apply','doctor','--session','--scope','--model','--category','--project','--json'
   $security = 'doctor','--project','--json'
-  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } else { $commands }
+  $evaluation = 'validate','run','ablate','report','prune','delete','protocol','--task-set','--adapter','--output','--repetitions','--seed','--yes','--json','--disable','--experiment','--older-than-days','--dry-run','--trajectory','--codex-jsonl','--capture-authorized'
+  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
     [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
   }