@cairnkeep/cli 2.23.0 → 2.23.1

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.23.1] - 2026-10-22
+
+### Domain knowledge
+
+- Resolve local AnythingLLM defaults from the existing absolute project-path
+  mapping, with deepest-project matching and the sync script's discovery order.
+  Preserve explicit workspace overrides, legacy fallback, remote HTTP session
+  routing, OpenViking selection and synchronization approval requirements.
+- Bound mapping reads and reject unsafe files, invalid slugs and ambiguous
+  canonical project declarations. Add pure, real stdio, HTTP and synchronization
+  regression controls; update operating guidance and the recording supplement.
+
+### Maintenance
+
+- Allocate the remote-routing test provider's loopback port dynamically; retain
+  the formerly failing PID as a regression instead of hitting fetch's blocked
+  port 10080. Production routing and transport policy are unchanged.
+- Refresh pinned setup, artifact-upload and code-scanning actions; align the
+  packaged CLI and server on Zod 4.6.7 with dependency-parity mutation controls.
+- Update the isolated historical Python MCP integration experiment to 2.2.0;
+  this does not add Python or that experiment to the shipped Node runtime.
+
 ## [2.23.0] - 2026-10-21
 
 ### Memory retrieval

package/docs/domain-knowledge.md

@@ -29,7 +29,7 @@ work exactly the same without them.
 | `ANYTHINGLLM_API_KEY` | **Required** for the domain-knowledge tools. Unset → the tools error at call time (everything else works). |
 | `ANYTHINGLLM_BASE_URL` | AnythingLLM base URL. Default `http://localhost:3001`. |
 | `CAIRN_ANYTHINGLLM_SYNC_SCRIPT` | Optional path to a custom document-sync script. Unset -> `domain_knowledge_sync` uses the bundled deployment-neutral example. |
-| `CAIRN_ANYTHINGLLM_PROJECTS_FILE` | Optional config path for the bundled sync script. Default `${XDG_CONFIG_HOME:-~/.config}/cairnkeep/anythingllm-projects.json`. |
+| `CAIRN_ANYTHINGLLM_PROJECTS_FILE` | Optional config path for the bundled sync script, also used to pick the default workspace per repository. Default `${XDG_CONFIG_HOME:-~/.config}/cairnkeep/anythingllm-projects.json`. |
 | `CAIRN_ANYTHINGLLM_STATE_FILE` | Optional state path for the bundled sync script. Default `${XDG_STATE_HOME:-~/.local/state}/cairnkeep/anythingllm-sync.json`. |
 
 The query security follow-up validates HTTP(S) URLs and rejects embedded
@@ -54,9 +54,43 @@ first of `.agent/memory.json`, `.opencode/memory.json`, `.claude/memory.json`, o
 }
 ```
 
-`domain_knowledge_query` takes an explicit `workspace`, or falls back to the first
-configured workspace that is not `engineering-patterns` (the conventional shared
-workspace). With no workspace given and none configured, it errors.
+### Which workspace a call targets
+
+A local stdio tool call without an explicit `workspace` resolves one in this order:
+
+1. The project in `anythingllm-projects.json` whose absolute `path` contains the current
+   working directory. The deepest match wins, so a checkout nested inside
+   another project resolves to its own workspace.
+2. Otherwise the first entry in `anythingllm_workspaces` that is not
+   `engineering-patterns`, which is reserved for cross-project patterns and is
+   never chosen as a project default.
+
+Step 1 matters when one machine holds several checkouts that share a single
+global memory config. Without it every repository resolves to the same
+workspace, and a query made from a different repository reports "there is no
+relevant information" instead of revealing that it searched somewhere
+unrelated. Because the mapping is the same file the sync script uses, the
+workspace a repository reads from is the one it embeds into.
+
+If the mapping is absent, unreadable, or malformed, resolution falls back to
+step 2, so existing single-project setups are unaffected.
+
+Mapping discovery follows the bundled sync script exactly:
+`CAIRN_ANYTHINGLLM_PROJECTS_FILE`, then a legacy file beside the selected sync
+script, then `${XDG_CONFIG_HOME:-~/.config}/cairnkeep/anythingllm-projects.json`.
+A missing explicit override does not select another mapping implicitly. Custom
+sync implementations must honor the same mapping or configure an explicit
+workspace; Cairnkeep cannot infer their private lookup rules.
+
+Mapping reads are descriptor-bound UTF-8 JSON, limited to 1 MiB and 4,096
+entries. Symlinked, special, changing and oversized mapping files are not read
+as trusted content. Project paths must be absolute, without tilde expansion,
+matching the sync script. They are canonicalized; relative declarations,
+invalid workspace identifiers and the shared `engineering-patterns` slug are
+skipped. Conflicting slugs for the same deepest canonical project raise a
+controlled ambiguity error: specify `workspace` or correct the declarations.
+Explicit tool arguments always win. With no resolved default, the tool errors.
+This lookup selects a destination; it does not grant approval to synchronize.
 
 In local stdio mode, that config is read from the client project's working
 directory. In remote HTTP mode, the server cannot read files from the client
@@ -64,6 +98,10 @@ PC. Configure `ANYTHINGLLM_BASE_URL`, `ANYTHINGLLM_API_KEY`, and any sync script
 on the HTTP server host, then send the project workspaces in the
 `X-Cairn-AnythingLLM-Workspaces` session header. See
 [Memory storage and deployment](storage.md#per-project-remote-sessions).
+HTTP calls never consult the server checkout's project mapping to choose a
+client's default, including on the synchronization write path. The optional
+OpenViking provider also retains its configured workspace selection rather
+than consulting an AnythingLLM-specific mapping.
 
 The HTTP server performs queries and runs the sync script on its own host. A
 remote sync script must therefore obtain project documents from a server-side

package/docs/learning/CURRICULUM-MAP.md

@@ -1,7 +1,7 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.23.0
-**Last reviewed:** 2026-10-07
+**Baseline:** Cairnkeep 2.23.1
+**Last reviewed:** 2026-10-22
 
 This map prevents the course from drifting behind the product. It assigns each
 user-facing surface to a lesson and records whether the lesson is complete or
@@ -20,7 +20,7 @@ been rehearsed.
 | Wiki, alignment, and repository quality workflows | L05-L06 | L05-L06 | Brief |
 | Optional local code graph, graph inspection, and harness delegates | L18 | L18 | Brief; default off |
 | Storage placement, export/import, and authenticated remote memory | L07 | L07-L08 | Brief |
-| Document RAG | L00 | L09 | Brief; optional |
+| Document RAG | L00 | L09 | Brief; optional; [V09 routing supplement](video-scripts/V09-workspace-routing-supplement.md) covers local mappings and HTTP isolation |
 | token-miser exploration and routing | L00 | L10 | Brief; optional |
 | Rootless containers and persistent service operation | L01 | L11 | L01 Ready; L11 Brief |
 | Private managed distributions | L12 | L12 | Brief; optional |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.23.0
+**Baseline:** Cairnkeep 2.23.1
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.23.0
+**Tested with:** Cairnkeep 2.23.1
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.23.0
+**Tested with:** Cairnkeep 2.23.1
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.23.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.23.1
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.23.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.23.1 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.23.0
+   npm install --global @cairnkeep/cli@2.23.1
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.23.0
+**Tested with:** Cairnkeep 2.23.1
 
 ## Outcome
 

package/docs/learning/lessons/L09-domain-knowledge.md

@@ -13,6 +13,8 @@ without affecting core Cairnkeep memory.
 
 - Memory versus document RAG responsibilities.
 - Workspace selection and project configuration.
+- Explicit directory-to-workspace mapping for local stdio; HTTP session headers
+  remain authoritative for remote routing, not the server's current directory.
 - Query-only setup before document synchronization.
 - Incremental, full, and replacement synchronization boundaries.
 - Endpoint, credential, and document-selection safety.
@@ -24,12 +26,21 @@ Index a synthetic three-document corpus into a disposable workspace, ask a
 question requiring citations to two documents, update one document, resync, and
 verify the new answer. Then unset the integration and prove memory still works.
 
+Use two disposable checkouts sharing a global memory configuration. Declare
+their absolute paths and distinct slugs in `anythingllm-projects.json`; verify
+root and subdirectory queries report the expected workspace. Check an explicit
+workspace override and an undeclared-directory fallback. Keep synchronization
+synthetic and separately approved; a destination mapping is not write consent.
+See the [recording supplement](../video-scripts/V09-workspace-routing-supplement.md).
+
 ## Acceptance criteria
 
 - Only allowlisted synthetic documents are uploaded.
 - The learner can identify the selected workspace and endpoint without printing
   its credential.
 - Updated content replaces stale retrieval results.
+- The learner verifies the returned workspace before trusting an empty answer;
+  conflicting deepest declarations require an explicit destination or repair.
 - Disabling RAG leaves `/remember` and `/recall` healthy.
 
 ## Source material

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.23.0
+**Tested with:** Cairnkeep 2.23.1
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.23.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.23.0
+npm install --global @cairnkeep/cli@2.23.1
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.23.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.23.1; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.23.0 or use a disposable source checkout.
+- Install Cairnkeep 2.23.1 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.

package/docs/learning/video-scripts/V09-workspace-routing-supplement.md

@@ -0,0 +1,36 @@
+# V09 supplement — The right documents for the right repository
+
+Technical recording brief; no completed video or full Ready L09 lab is claimed.
+Use invented repository names and a loopback mock, never private mappings,
+provider keys, real documents or production synchronization.
+
+## Real terminal demonstration
+
+Leave a readable pause after each command:
+
+```sh
+npm --prefix mcp-memory-server run build
+npm --prefix mcp-memory-server run check:anythingllm-workspace
+npm --prefix mcp-memory-server run check:remote-context
+```
+
+Show two synthetic checkouts sharing one global configuration, then highlight
+the distinct workspace reported by each real stdio MCP query. Zoom into a
+subdirectory call and an explicit override. Explain that an empty answer from
+the wrong corpus is not evidence that the requested information does not exist.
+
+The mock synchronization prints arguments only; it uploads nothing. Contrast
+destination selection with write consent and show replacement being refused
+without confirmation. For HTTP, show the conflicting server-directory mapping
+fixture and the client header still winning. Do not run a live provider or
+silently activate RAG merely to record this supplement.
+
+## Boundaries and recovery
+
+Explain the lookup order: explicit mapping file, legacy mapping beside the
+selected sync script, then XDG. Missing or invalid mappings keep the legacy
+configured default; inspect the returned workspace. Ambiguous deepest entries
+require an explicit workspace or a corrected mapping. Mapping files are bounded
+and unsafe file types are rejected. Directory matching is routing, not an ACL
+or publisher-authenticity guarantee. Keep the full L09 lesson marked Brief until
+its separate live synthetic-corpus lab has been verified.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.23.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.23.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/anythingllm-workspace.js

@@ -0,0 +1,109 @@
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { readStableJson } from "./stable-file.js";
+/** Shared workspace that is never a project default; it holds cross-project patterns. */
+const SHARED_WORKSPACE = "engineering-patterns";
+const WORKSPACE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const MAX_MAPPING_BYTES = 1024 * 1024;
+const MAX_PROJECTS = 4096;
+function expandHome(value) {
+    if (value === "~")
+        return homedir();
+    if (value.startsWith("~/"))
+        return join(homedir(), value.slice(2));
+    return value;
+}
+/**
+ * Locate `anythingllm-projects.json`.
+ *
+ * Mirrors the precedence in `examples/anythingllm/sync_to_anythingllm.py` so the
+ * resolver and the sync script can never disagree about which mapping is live.
+ */
+export function anythingllmProjectsFile(env = process.env, legacyDir) {
+    const override = env.CAIRN_ANYTHINGLLM_PROJECTS_FILE;
+    if (override) {
+        const explicit = resolve(expandHome(override));
+        return existsSync(explicit) ? explicit : undefined;
+    }
+    if (legacyDir) {
+        const legacy = join(legacyDir, "anythingllm-projects.json");
+        if (existsSync(legacy))
+            return legacy;
+    }
+    const configHome = env.XDG_CONFIG_HOME
+        ? resolve(expandHome(env.XDG_CONFIG_HOME))
+        : join(homedir(), ".config");
+    const standard = join(configHome, "cairnkeep", "anythingllm-projects.json");
+    if (existsSync(standard))
+        return standard;
+    return undefined;
+}
+/**
+ * Workspace slug declared for the project containing `cwd`, if any.
+ *
+ * The deepest matching `path` wins so a checkout nested inside another project
+ * resolves to its own workspace rather than its parent's.
+ */
+export function workspaceForDirectory(cwd, env = process.env, legacyDir) {
+    const file = anythingllmProjectsFile(env, legacyDir);
+    if (!file)
+        return undefined;
+    let entries;
+    try {
+        const parsed = readStableJson(file, { label: "Workspace mapping", maxBytes: MAX_MAPPING_BYTES });
+        if (!Array.isArray(parsed?.projects) || parsed.projects.length > MAX_PROJECTS)
+            return undefined;
+        entries = parsed.projects;
+    }
+    catch {
+        // A malformed or unreadable mapping must not break workspace resolution;
+        // fall back to the configured list rather than failing the tool call.
+        return undefined;
+    }
+    let here;
+    try {
+        here = realpathSync.native(cwd);
+    }
+    catch {
+        return undefined;
+    }
+    let bestSlug;
+    let bestDepth = -1;
+    let ambiguous = false;
+    for (const entry of entries) {
+        const slug = typeof entry?.slug === "string" ? entry.slug : "";
+        const path = typeof entry?.path === "string" ? entry.path : "";
+        if (!WORKSPACE_PATTERN.test(slug) || slug === SHARED_WORKSPACE || !isAbsolute(path))
+            continue;
+        let root;
+        try {
+            root = realpathSync.native(path);
+        }
+        catch {
+            continue;
+        }
+        const rel = relative(root, here);
+        const contains = rel === "" || (rel !== ".." && !rel.startsWith("../") && !rel.startsWith("..\\") && !isAbsolute(rel));
+        if (contains && root.length > bestDepth) {
+            bestSlug = slug;
+            bestDepth = root.length;
+            ambiguous = false;
+        }
+        else if (contains && root.length === bestDepth && slug !== bestSlug) {
+            ambiguous = true;
+        }
+    }
+    if (ambiguous)
+        throw new Error("Ambiguous project workspace mapping; specify workspace explicitly.");
+    return bestSlug;
+}
+/**
+ * Default workspace for a tool call: the project containing `cwd` when it is
+ * declared, otherwise the previous behaviour so existing single-project setups
+ * keep working unchanged.
+ */
+export function defaultAnythingLLMWorkspace(config, cwd = process.cwd(), env = process.env, legacyDir) {
+    return (workspaceForDirectory(cwd, env, legacyDir) ??
+        config.anythingllm_workspaces?.find((workspace) => workspace !== SHARED_WORKSPACE));
+}

package/mcp-memory-server/dist/index.js

@@ -11,6 +11,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z } from "zod";
+import { defaultAnythingLLMWorkspace as resolveDefaultAnythingLLMWorkspace } from "./anythingllm-workspace.js";
 import { artifactIdSchema, artifactKindSchema, artifactMediaTypeSchema, artifactNodeRefSchema, artifactProvenanceSchema, artifactSessionRefSchema, compactionSummaryInputContentSchema, diffContentSchema, generatedFileInputContentSchema, isArtifactHttpEnabled, isArtifactStoreEnabled, testOutputContentSchema, } from "./artifact-schema.js";
 import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
 import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashText, } from "./embeddings.js";
@@ -360,8 +361,14 @@ async function readStdin() {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
-function defaultAnythingLLMWorkspace(config) {
-    return config.anythingllm_workspaces?.find((workspace) => workspace !== "engineering-patterns");
+function defaultAnythingLLMWorkspace(config, remote = false) {
+    // HTTP callers route by session metadata, never by the server's checkout.
+    if (remote || resolveDomainRetrievalProvider() !== "anythingllm") {
+        return config.anythingllm_workspaces?.find((workspace) => workspace !== "engineering-patterns");
+    }
+    // `anythingllm-projects.json` may also sit beside the bundled sync script,
+    // which is the legacy location the script still honours.
+    return resolveDefaultAnythingLLMWorkspace(config, process.cwd(), process.env, dirname(anythingllmSyncScript));
 }
 function entryText(entry) {
     const metadata = [entry.node_type, ...(entry.tags ?? [])].filter(Boolean).join("\n");
@@ -1452,7 +1459,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability, toolProf
             readOnlyHint: true,
         },
     }, async ({ workspace, query }) => {
-        const workspaceSlug = workspace ?? defaultAnythingLLMWorkspace(memoryConfig());
+        const workspaceSlug = workspace ?? defaultAnythingLLMWorkspace(memoryConfig(), context.remote);
         if (!workspaceSlug) {
             throw new Error("No AnythingLLM workspace provided and no project workspace found in memory config.");
         }
@@ -1480,7 +1487,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability, toolProf
         }
         const syncMode = mode ?? "incremental";
         const config = memoryConfig();
-        const workspaceSlug = workspace ?? defaultAnythingLLMWorkspace(config);
+        const workspaceSlug = workspace ?? defaultAnythingLLMWorkspace(config, context.remote);
         if (!workspaceSlug) {
             throw new Error("No AnythingLLM workspace provided and no project workspace found in memory config.");
         }

package/mcp-memory-server/package.json

@@ -19,7 +19,7 @@
         "study:memory-retrieval": "npm run build && node scripts/run-memory-retrieval-study.mjs --summary",
         "check:scope-guard": "node scripts/smoke-scope-guard.mjs",
         "check:http-guard": "node scripts/smoke-http-guard.mjs",
-        "check:remote-context": "node scripts/smoke-remote-context.mjs",
+        "check:remote-context": "node scripts/smoke-remote-context.mjs && node scripts/smoke-remote-context-ports.mjs",
         "check:explore-guard": "node scripts/smoke-explore-guard.mjs",
         "check:explore-cache": "node scripts/smoke-explore-cache.mjs",
         "check:explore-crossref": "node scripts/smoke-explore-crossref.mjs",
@@ -58,6 +58,7 @@
         "check:context-pack-v216-compat": "node scripts/smoke-context-pack-v216-compat.mjs",
         "check:context-usage": "node scripts/smoke-context-usage.mjs",
         "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs",
+        "check:anythingllm-workspace": "node scripts/smoke-anythingllm-workspace.mjs && node scripts/smoke-anythingllm-workspace-mcp.mjs",
         "check:retrieval-benchmark": "node scripts/smoke-retrieval-benchmark.mjs && node scripts/run-retrieval-benchmark.mjs --check",
         "benchmark:retrieval": "npm run build && node scripts/run-retrieval-benchmark.mjs",
         "check:work-evidence": "node scripts/smoke-work-evidence.mjs",
@@ -77,7 +78,7 @@
         "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
         "yaml": "2.9.1",
-        "zod": "^4.6.5"
+        "zod": "^4.6.7"
     },
     "devDependencies": {
         "@types/node": "^22.20.5",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.23.0",
+    "version": "2.23.1",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",
@@ -41,7 +41,7 @@
         "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
         "yaml": "2.9.1",
-        "zod": "^4.6.5"
+        "zod": "^4.6.7"
     },
     "scripts": {
         "build:server": "npm --prefix mcp-memory-server ci --include=dev --global=false --dry-run=false && npm --prefix mcp-memory-server run build --global=false --dry-run=false",

package/scripts/test-dependency-security.mjs

@@ -0,0 +1,40 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const root = fileURLToPath(new URL("../", import.meta.url));
+const policy = join(root, "scripts/verify-dependency-security.mjs");
+const paths = ["package.json", "package-lock.json", "mcp-memory-server/package.json", "mcp-memory-server/package-lock.json"];
+const baseline = Object.fromEntries(paths.map(path => [path, JSON.parse(readFileSync(join(root, path), "utf8"))]));
+const scratch = mkdtempSync(join(tmpdir(), "cairn-dependency-policy-"));
+function check(label, mutate, expected) {
+  const values = structuredClone(baseline);
+  mutate(values);
+  for (const path of paths) {
+    const target = join(scratch, path);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, JSON.stringify(values[path]));
+  }
+  const result = spawnSync(process.execPath, [policy], { cwd: scratch, encoding: "utf8", timeout: 10000 });
+  assert.ifError(result.error);
+  assert.equal(result.status, expected ? 1 : 0, `${label}: ${result.stderr}`);
+  if (expected) assert.match(result.stderr, expected, label);
+}
+try {
+  check("valid dependency graph", () => {}, null);
+  check("root manifest/lock mismatch", x => { x["package.json"].dependencies.zod = "^4.0.0"; }, /manifest and lock root Zod ranges differ/);
+  check("server manifest/lock mismatch", x => { x["mcp-memory-server/package-lock.json"].packages[""].dependencies.zod = "^4.0.0"; }, /manifest and lock root Zod ranges differ/);
+  check("matched server range differs from packaged CLI", x => {
+    x["mcp-memory-server/package.json"].dependencies.zod = "^4.0.0";
+    x["mcp-memory-server/package-lock.json"].packages[""].dependencies.zod = "^4.0.0";
+  }, /root and server Zod ranges differ/);
+  check("different resolved schema version", x => { x["mcp-memory-server/package-lock.json"].packages["node_modules/zod"].version = "4.0.0"; }, /root and server resolved Zod versions differ/);
+  check("missing direct schema", x => { delete x["package-lock.json"].packages["node_modules/zod"]; }, /direct Zod: version must be a string/);
+  check("existing SDK advisory check retained", x => { x["package-lock.json"].packages["node_modules/@modelcontextprotocol/sdk"].version = "1.0.0"; }, /resolved @modelcontextprotocol\/sdk: requires/);
+  console.log("PASS: dependency policy positive control, schema parity mutations and SDK advisory rejection");
+} finally {
+  rmSync(scratch, { recursive: true, force: true });
+}

package/scripts/test-dependency-security.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+node "$ROOT/scripts/test-dependency-security.mjs"

package/scripts/verify-dependency-security.mjs

@@ -130,8 +130,27 @@ function verifyPackageRoot({ label, directory }) {
   }
 }
 
+function verifySchemaDependencyParity() {
+  let expectedRange;
+  let expectedVersion;
+  for (const { label, directory } of PACKAGE_ROOTS) {
+    const manifest = readJson(`${directory}/package.json`);
+    const lock = readJson(`${directory}/package-lock.json`);
+    const range = manifest.dependencies?.zod;
+    assert.equal(typeof range, "string", `${label}: direct Zod range is missing`);
+    assert.equal(lock.packages?.[""].dependencies?.zod, range, `${label}: manifest and lock root Zod ranges differ`);
+    const version = lock.packages?.["node_modules/zod"]?.version;
+    parseVersion(version, `${label} direct Zod`);
+    expectedRange ??= range;
+    expectedVersion ??= version;
+    assert.equal(range, expectedRange, "root and server Zod ranges differ");
+    assert.equal(version, expectedVersion, "root and server resolved Zod versions differ");
+  }
+}
+
 try {
   PACKAGE_ROOTS.forEach(verifyPackageRoot);
+  verifySchemaDependencyParity();
   process.stdout.write("PASS: dependency manifests and lock graphs exclude known MCP transport advisories\n");
 } catch (error) {
   process.stderr.write(`FAIL: dependency security policy: ${error instanceof Error ? error.message : String(error)}\n`);