@cairnkeep/cli 2.22.5 → 2.23.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.22.5",
+    "version": "2.23.1",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",
@@ -41,7 +41,7 @@
         "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
         "yaml": "2.9.1",
-        "zod": "^4.6.5"
+        "zod": "^4.6.7"
     },
     "scripts": {
         "build:server": "npm --prefix mcp-memory-server ci --include=dev --global=false --dry-run=false && npm --prefix mcp-memory-server run build --global=false --dry-run=false",

package/scripts/test-dependency-security.mjs

@@ -0,0 +1,40 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const root = fileURLToPath(new URL("../", import.meta.url));
+const policy = join(root, "scripts/verify-dependency-security.mjs");
+const paths = ["package.json", "package-lock.json", "mcp-memory-server/package.json", "mcp-memory-server/package-lock.json"];
+const baseline = Object.fromEntries(paths.map(path => [path, JSON.parse(readFileSync(join(root, path), "utf8"))]));
+const scratch = mkdtempSync(join(tmpdir(), "cairn-dependency-policy-"));
+function check(label, mutate, expected) {
+  const values = structuredClone(baseline);
+  mutate(values);
+  for (const path of paths) {
+    const target = join(scratch, path);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, JSON.stringify(values[path]));
+  }
+  const result = spawnSync(process.execPath, [policy], { cwd: scratch, encoding: "utf8", timeout: 10000 });
+  assert.ifError(result.error);
+  assert.equal(result.status, expected ? 1 : 0, `${label}: ${result.stderr}`);
+  if (expected) assert.match(result.stderr, expected, label);
+}
+try {
+  check("valid dependency graph", () => {}, null);
+  check("root manifest/lock mismatch", x => { x["package.json"].dependencies.zod = "^4.0.0"; }, /manifest and lock root Zod ranges differ/);
+  check("server manifest/lock mismatch", x => { x["mcp-memory-server/package-lock.json"].packages[""].dependencies.zod = "^4.0.0"; }, /manifest and lock root Zod ranges differ/);
+  check("matched server range differs from packaged CLI", x => {
+    x["mcp-memory-server/package.json"].dependencies.zod = "^4.0.0";
+    x["mcp-memory-server/package-lock.json"].packages[""].dependencies.zod = "^4.0.0";
+  }, /root and server Zod ranges differ/);
+  check("different resolved schema version", x => { x["mcp-memory-server/package-lock.json"].packages["node_modules/zod"].version = "4.0.0"; }, /root and server resolved Zod versions differ/);
+  check("missing direct schema", x => { delete x["package-lock.json"].packages["node_modules/zod"]; }, /direct Zod: version must be a string/);
+  check("existing SDK advisory check retained", x => { x["package-lock.json"].packages["node_modules/@modelcontextprotocol/sdk"].version = "1.0.0"; }, /resolved @modelcontextprotocol\/sdk: requires/);
+  console.log("PASS: dependency policy positive control, schema parity mutations and SDK advisory rejection");
+} finally {
+  rmSync(scratch, { recursive: true, force: true });
+}

package/scripts/test-dependency-security.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+node "$ROOT/scripts/test-dependency-security.mjs"

package/scripts/test-memory-retrieval-docs.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$ROOT"
+for path in docs/memory-retrieval.md docs/benchmarks/memory-retrieval-v1.json docs/learning/video-scripts/V04-memory-retrieval-supplement.md; do
+  [[ -f "$path" ]]
+done
+for path in docs/README.md docs/operating.md docs/storage.md docs/agents.md docs/learning/lessons/L04-memory-fundamentals.md; do
+  grep -qF 'memory-retrieval.md' "$path"
+done
+for path in claude/commands/recall.md opencode/command/recall.md; do
+  grep -qF 'do not automatically widen' "$path"
+  grep -qF 'strategy: "hybrid"' "$path"
+done
+grep -qF 'same admission' docs/memory-retrieval.md
+grep -qF 'HTTP 502' docs/memory-retrieval.md
+grep -qF 'ranking-not-confidence' docs/memory-retrieval.md
+grep -qF 'Status: available since Cairnkeep 2.23.0' docs/memory-retrieval.md
+echo 'PASS: hybrid retrieval, Markdown parity, provider limitations and learning/recording references'

package/scripts/test-release-sbom.sh

@@ -14,6 +14,8 @@ fail() {
 
 node - "$ROOT/package.json" "$ROOT/package-lock.json" "$CANDIDATE_WORKFLOW" "$PUBLISH_WORKFLOW" <<'NODE'
 const fs = require("node:fs");
+const assert = require("node:assert/strict");
+const { parse } = require("yaml");
 
 const manifest = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
 const lock = JSON.parse(fs.readFileSync(process.argv[3], "utf8"));
@@ -36,6 +38,36 @@ if (!candidateWorkflow.includes("release-candidate:")
   || !candidateWorkflow.includes("name: release-candidate-${{ steps.candidate.outputs.tree }}")) {
   throw new Error("CI must build and upload a tree-addressed release candidate after its required jobs");
 }
+function validateCandidateRetry(workflow) {
+  const job = workflow.jobs["release-candidate"];
+  assert.deepEqual(new Set(job.needs), new Set([
+    "memory-server", "native-windows", "repository", "shell-portability",
+    "server-boot", "container", "fresh-install-macos",
+  ]), "candidate retry must retain every platform/runtime gate");
+  assert.equal(job.if, undefined, "candidate retry must not bypass failed or pending gates");
+  const uploads = job.steps.filter(step => step.uses?.startsWith("actions/upload-artifact@"));
+  assert.equal(uploads.length, 1, "candidate retry must have one artifact publication");
+  assert.equal(uploads[0].with.name, "release-candidate-${{ steps.candidate.outputs.tree }}");
+  assert.equal(uploads[0].with.overwrite, true, "candidate upload must support same-run retries");
+  assert.equal(uploads[0].with["if-no-files-found"], "error");
+}
+const candidate = parse(candidateWorkflow);
+const positive = structuredClone(candidate);
+positive.jobs["release-candidate"].steps.find(step => step.uses?.startsWith("actions/upload-artifact@")).with.overwrite = true;
+validateCandidateRetry(positive);
+for (const overwrite of [undefined, false]) {
+  const invalid = structuredClone(positive);
+  invalid.jobs["release-candidate"].steps.find(step => step.uses?.startsWith("actions/upload-artifact@")).with.overwrite = overwrite;
+  assert.throws(() => validateCandidateRetry(invalid), /same-run retries/);
+}
+const missingGate = structuredClone(positive);
+missingGate.jobs["release-candidate"].needs = missingGate.jobs["release-candidate"].needs.filter(name => name !== "native-windows");
+assert.throws(() => validateCandidateRetry(missingGate), /every platform\/runtime gate/);
+const bypass = structuredClone(positive);
+bypass.jobs["release-candidate"].if = "always()";
+assert.throws(() => validateCandidateRetry(bypass), /must not bypass/);
+validateCandidateRetry(candidate);
+console.log("PASS: retry-safe candidate upload and four gate/replacement mutation controls");
 if (!publishWorkflow.includes("- name: Download the CI-verified release candidate")
   || !publishWorkflow.includes("jq -r '.conclusion'")
   || !publishWorkflow.includes("== success")

package/scripts/verify-dependency-security.mjs

@@ -130,8 +130,27 @@ function verifyPackageRoot({ label, directory }) {
   }
 }
 
+function verifySchemaDependencyParity() {
+  let expectedRange;
+  let expectedVersion;
+  for (const { label, directory } of PACKAGE_ROOTS) {
+    const manifest = readJson(`${directory}/package.json`);
+    const lock = readJson(`${directory}/package-lock.json`);
+    const range = manifest.dependencies?.zod;
+    assert.equal(typeof range, "string", `${label}: direct Zod range is missing`);
+    assert.equal(lock.packages?.[""].dependencies?.zod, range, `${label}: manifest and lock root Zod ranges differ`);
+    const version = lock.packages?.["node_modules/zod"]?.version;
+    parseVersion(version, `${label} direct Zod`);
+    expectedRange ??= range;
+    expectedVersion ??= version;
+    assert.equal(range, expectedRange, "root and server Zod ranges differ");
+    assert.equal(version, expectedVersion, "root and server resolved Zod versions differ");
+  }
+}
+
 try {
   PACKAGE_ROOTS.forEach(verifyPackageRoot);
+  verifySchemaDependencyParity();
   process.stdout.write("PASS: dependency manifests and lock graphs exclude known MCP transport advisories\n");
 } catch (error) {
   process.stderr.write(`FAIL: dependency security policy: ${error instanceof Error ? error.message : String(error)}\n`);

package/templates/playbook-agent-instructions.md.template

@@ -10,6 +10,11 @@ inventory, or search commands such as `pwd`, `ls`, `rg --files`, `find`,
 - If `memory_search` is available, derive one short query from the task and
   search `scope: project` once. Derive it from the user's task; do not inspect
   the repository first merely to formulate the query.
+- When the discovered schema supports hybrid search, use it for explicit
+  identifiers or mixed wording; request explanations when needed. Supply only
+  aliases already known from the task. Hybrid semantic-only matches require an
+  explicit model-specific positive similarity threshold; otherwise keep the
+  existing semantic strategy for paraphrases. Empty results are acceptable.
 - Treat returned memory as a locator, not authority. Read and verify the
   maintained repository sources it references before implementing a result.
 - If the tool is unavailable or no relevant result exists, continue with