@cairnkeep/cli 2.23.0 → 2.24.0

package/scripts/verify-dependency-security.mjs

@@ -7,9 +7,10 @@ const ROOT = resolve(process.cwd());
 const MINIMUM_SDK = [1, 32, 1];
 const MINIMUM_NODE_SERVER = [2, 0, 5];
 const TRANSITIVE_MINIMUMS = new Map([
-  ["fast-uri", [3, 1, 8]],
+  ["body-parser", [2, 4, 0]],
+  ["fast-uri", [3, 1, 9]],
   ["hono", [4, 13, 13]],
-  ["ip-address", [10, 7, 3]],
+  ["ip-address", [10, 7, 4]],
   ["proxy-addr", [2, 0, 8]],
 ]);
 const DIRECT_HONO_PACKAGES = new Set(["hono", "@hono/node-server"]);
@@ -130,8 +131,27 @@ function verifyPackageRoot({ label, directory }) {
   }
 }
 
+function verifySchemaDependencyParity() {
+  let expectedRange;
+  let expectedVersion;
+  for (const { label, directory } of PACKAGE_ROOTS) {
+    const manifest = readJson(`${directory}/package.json`);
+    const lock = readJson(`${directory}/package-lock.json`);
+    const range = manifest.dependencies?.zod;
+    assert.equal(typeof range, "string", `${label}: direct Zod range is missing`);
+    assert.equal(lock.packages?.[""].dependencies?.zod, range, `${label}: manifest and lock root Zod ranges differ`);
+    const version = lock.packages?.["node_modules/zod"]?.version;
+    parseVersion(version, `${label} direct Zod`);
+    expectedRange ??= range;
+    expectedVersion ??= version;
+    assert.equal(range, expectedRange, "root and server Zod ranges differ");
+    assert.equal(version, expectedVersion, "root and server resolved Zod versions differ");
+  }
+}
+
 try {
   PACKAGE_ROOTS.forEach(verifyPackageRoot);
+  verifySchemaDependencyParity();
   process.stdout.write("PASS: dependency manifests and lock graphs exclude known MCP transport advisories\n");
 } catch (error) {
   process.stderr.write(`FAIL: dependency security policy: ${error instanceof Error ? error.message : String(error)}\n`);

package/scripts/windows-platform.mjs

@@ -526,6 +526,14 @@ async function doctorWindows(root, args) {
       } catch { line("FAIL", `embedding endpoint request failed (${process.env.CAIRN_MEMORY_EMBEDDING_URL})`); }
     }
   } else line("SKIP", "embedding endpoint unset");
+  if (process.env.CAIRN_MEMORY_RERANK === "1") {
+    let status = 3;
+    try { status = await (await import("./probe-memory-reranker.mjs")).probeMemoryReranker(); } catch {}
+    line(status === 0 ? "PASS" : "FAIL", status === 0
+      ? "memory reranker accepted a synthetic ranking request"
+      : status === 2 ? "memory reranker configuration invalid — set URL/model and a timeout within 100–10000 ms"
+        : "memory reranker unavailable or returned invalid ranking data — search falls back to its existing order");
+  } else line("SKIP", "memory reranker unset/not 1");
   const provider = process.env.CAIRN_GIT_PROVIDER?.trim();
   if (!provider || provider === "none") line("SKIP", "git provider unset/none; collaboration commands are off");
   else if (["github", "gitlab", "codeberg", "forgejo"].includes(provider)) line("PASS", `git provider configured: ${provider}`);