@cairnkeep/cli 2.3.1 → 2.5.0

package/mcp-memory-server/dist/trajectory-redaction.js

@@ -0,0 +1,155 @@
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { z } from "zod";
+const MAX_CUSTOM_PATTERNS = 32;
+const MAX_PATTERN_LENGTH = 256;
+const MAX_REPLACEMENT_LENGTH = 128;
+const MAX_REDACTION_CANDIDATE_BYTES = 64 * 1024 * 1024;
+const REDACTED = "[REDACTED]";
+const redactionConfigSchema = z.object({
+    version: z.literal(1),
+    patterns: z.array(z.object({
+        pattern: z.string().min(1).max(MAX_PATTERN_LENGTH),
+        flags: z.string().regex(/^[gimsu]*$/).optional(),
+        replacement: z.string().max(MAX_REPLACEMENT_LENGTH).optional(),
+    }).strict()).max(MAX_CUSTOM_PATTERNS),
+}).strict();
+const secretKeyPattern = /^(?:authorization|password|passwd|secret|token|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key)$/i;
+const builtinPatterns = [
+    { regex: /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "Bearer [REDACTED]" },
+    { regex: /\bsk-[A-Za-z0-9_-]{8,}/g, replacement: "[REDACTED:API_KEY]" },
+    {
+        regex: /\b(password|passwd|api[_-]?key|token|secret)\s*[:=]\s*[^\s"'&,;]+/gi,
+        replacement: "$1=[REDACTED]",
+    },
+    {
+        regex: /([a-z][a-z0-9+.-]{0,31}:\/\/)[^/\s:@]+:[^/\s@]+@/gi,
+        replacement: "$1[REDACTED]@",
+    },
+    {
+        regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+        replacement: "[REDACTED:PRIVATE_KEY]",
+    },
+];
+function assertContainedConfigPath(projectRoot, configuredPath) {
+    const allowedRoot = resolve(projectRoot);
+    const candidate = resolve(projectRoot, configuredPath);
+    const rel = relative(allowedRoot, candidate);
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+        throw new Error("Trajectory redaction configuration must be inside the project root.");
+    }
+    return candidate;
+}
+function compileCustomPatterns(projectRoot) {
+    const explicitPath = process.env.CAIRN_REDACTION_FILE?.trim()
+        || process.env.CAIRN_TRAJECTORY_REDACTION_FILE?.trim();
+    const defaultPath = ".ai/trajectory-redaction.json";
+    const configuredPath = explicitPath || (existsSync(resolve(projectRoot, defaultPath)) ? defaultPath : "");
+    if (!configuredPath)
+        return [];
+    const path = assertContainedConfigPath(projectRoot, configuredPath);
+    const parsed = redactionConfigSchema.parse(JSON.parse(readFileSync(path, "utf8")));
+    return parsed.patterns.map((entry) => {
+        const flags = entry.flags?.includes("g") ? entry.flags : `${entry.flags ?? ""}g`;
+        return {
+            regex: new RegExp(entry.pattern, flags),
+            replacement: entry.replacement ?? "[REDACTED:CUSTOM]",
+            literalReplacement: true,
+        };
+    });
+}
+function secretEnvironmentValues() {
+    const values = [];
+    for (const [name, value] of Object.entries(process.env)) {
+        if (!value || !/(?:^|_)(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)$/i.test(name))
+            continue;
+        if (value.length < 6)
+            continue;
+        values.push(value);
+    }
+    return Array.from(new Set(values)).sort((a, b) => b.length - a.length);
+}
+function redactString(value, patterns, environmentSecrets, metadata) {
+    let result = value;
+    for (const secret of environmentSecrets) {
+        if (!result.includes(secret))
+            continue;
+        const segments = result.split(secret);
+        metadata.replacementCount += segments.length - 1;
+        result = segments.join("[REDACTED:ENV]");
+    }
+    for (const { regex, replacement, literalReplacement } of patterns) {
+        regex.lastIndex = 0;
+        const matches = result.match(regex);
+        metadata.replacementCount += matches?.length ?? 0;
+        regex.lastIndex = 0;
+        result = literalReplacement
+            ? result.replace(regex, () => replacement)
+            : result.replace(regex, replacement);
+    }
+    return result;
+}
+function redactValue(value, patterns, environmentSecrets, metadata, key) {
+    if (key && secretKeyPattern.test(key)) {
+        metadata.replacementCount += 1;
+        return REDACTED;
+    }
+    if (typeof value === "string")
+        return redactString(value, patterns, environmentSecrets, metadata);
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item, patterns, environmentSecrets, metadata));
+    }
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [
+            childKey,
+            redactValue(childValue, patterns, environmentSecrets, metadata, childKey),
+        ]));
+    }
+    return value;
+}
+function boundedCandidateBytes(value, remaining = MAX_REDACTION_CANDIDATE_BYTES) {
+    if (remaining < 0)
+        throw new Error("Redaction candidate exceeds the in-memory safety bound.");
+    if (value === null || typeof value === "boolean" || typeof value === "number")
+        return 16;
+    if (typeof value === "string") {
+        const bytes = Buffer.byteLength(value, "utf8");
+        if (bytes > remaining)
+            throw new Error("Redaction candidate exceeds the in-memory safety bound.");
+        return bytes;
+    }
+    if (Array.isArray(value)) {
+        let total = 2;
+        for (const item of value) {
+            total += boundedCandidateBytes(item, remaining - total) + 1;
+            if (total > remaining)
+                throw new Error("Redaction candidate exceeds the in-memory safety bound.");
+        }
+        return total;
+    }
+    if (value && typeof value === "object") {
+        let total = 2;
+        for (const [key, childValue] of Object.entries(value)) {
+            total += Buffer.byteLength(key, "utf8") + 3;
+            total += boundedCandidateBytes(childValue, remaining - total) + 1;
+            if (total > remaining)
+                throw new Error("Redaction candidate exceeds the in-memory safety bound.");
+        }
+        return total;
+    }
+    return 16;
+}
+export function redactLocalValue(value, projectRoot) {
+    boundedCandidateBytes(value);
+    const patterns = [...builtinPatterns, ...compileCustomPatterns(projectRoot)];
+    const metadata = { replacementCount: 0 };
+    const redacted = redactValue(value, patterns, secretEnvironmentValues(), metadata);
+    return {
+        value: redacted,
+        applied: metadata.replacementCount > 0,
+        replacement_count: metadata.replacementCount,
+    };
+}
+export function redactTrajectory(session, projectRoot) {
+    return redactLocalValue(session, projectRoot).value;
+}

package/mcp-memory-server/dist/trajectory-schema.js

@@ -0,0 +1,73 @@
+import { z } from "zod";
+export const TRAJECTORY_SCHEMA_VERSION = 1;
+export const TRAJECTORY_DEFAULT_SESSION_MAX_BYTES = 5 * 1024 * 1024;
+export const TRAJECTORY_DEFAULT_STORE_MAX_BYTES = 256 * 1024 * 1024;
+export const TRAJECTORY_DEFAULT_RETENTION_DAYS = 30;
+export const trajectoryUsageSchema = z.object({
+    input_tokens: z.number().nonnegative().optional(),
+    output_tokens: z.number().nonnegative().optional(),
+    reasoning_tokens: z.number().nonnegative().optional(),
+    cache_read_tokens: z.number().nonnegative().optional(),
+    cache_write_tokens: z.number().nonnegative().optional(),
+    cost: z.number().nonnegative().optional(),
+}).strict();
+export const trajectoryEventSchema = z.object({
+    sequence: z.number().int().nonnegative(),
+    kind: z.enum([
+        "user_message",
+        "model_output",
+        "tool_invocation",
+        "tool_result",
+        "system_event",
+        "usage",
+    ]),
+    timestamp: z.iso.datetime().optional(),
+    native_id: z.string().optional(),
+    parent_id: z.string().optional(),
+    payload: z.record(z.string(), z.unknown()),
+    truncation: z.object({
+        original_bytes: z.number().int().nonnegative(),
+        stored_bytes: z.number().int().nonnegative(),
+    }).strict().optional(),
+}).strict();
+export const trajectorySessionSchema = z.object({
+    schema_version: z.literal(TRAJECTORY_SCHEMA_VERSION),
+    session_id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/),
+    harness: z.enum(["claude-code", "opencode", "pi"]),
+    project_root: z.string().min(1),
+    started_at: z.iso.datetime(),
+    ended_at: z.iso.datetime(),
+    usage: trajectoryUsageSchema.optional(),
+    events: z.array(trajectoryEventSchema),
+    capture: z.object({
+        captured_at: z.iso.datetime(),
+        omitted_reasoning_blocks: z.number().int().nonnegative(),
+        omitted_unknown_records: z.number().int().nonnegative(),
+        omitted_size_events: z.number().int().nonnegative().optional(),
+        truncated: z.boolean(),
+        original_bytes: z.number().int().nonnegative().optional(),
+        stored_bytes: z.number().int().nonnegative().optional(),
+    }).strict(),
+}).strict();
+function integerSetting(name, fallback, minimum) {
+    const raw = process.env[name]?.trim();
+    if (!raw)
+        return fallback;
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < minimum) {
+        throw new Error(`${name} must be an integer greater than or equal to ${minimum}.`);
+    }
+    return value;
+}
+export function getTrajectoryLimits() {
+    const sessionMaxBytes = integerSetting("CAIRN_TRAJECTORY_SESSION_MAX_BYTES", TRAJECTORY_DEFAULT_SESSION_MAX_BYTES, 1024);
+    const storeMaxBytes = integerSetting("CAIRN_TRAJECTORY_STORE_MAX_BYTES", TRAJECTORY_DEFAULT_STORE_MAX_BYTES, 1024);
+    const retentionDays = integerSetting("CAIRN_TRAJECTORY_RETENTION_DAYS", TRAJECTORY_DEFAULT_RETENTION_DAYS, 0);
+    if (storeMaxBytes < sessionMaxBytes) {
+        throw new Error("CAIRN_TRAJECTORY_STORE_MAX_BYTES must be at least the session maximum.");
+    }
+    return { sessionMaxBytes, storeMaxBytes, retentionDays };
+}
+export function isTrajectoryCaptureEnabled(value = process.env.CAIRN_TRAJECTORY_CAPTURE) {
+    return /^(?:1|true|yes|on)$/i.test(value?.trim() ?? "");
+}

package/mcp-memory-server/dist/trajectory-store.js

@@ -0,0 +1,339 @@
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { AgentFS } from "agentfs-sdk";
+import { z } from "zod";
+import { TRAJECTORY_SCHEMA_VERSION, trajectorySessionSchema, } from "./trajectory-schema.js";
+const META_KEY = "trajectory/meta/schema-version";
+const SESSION_PREFIX = "trajectory/session/";
+const INDEX_PREFIX = "trajectory/index/";
+const indexSchema = z.object({
+    schema_version: z.literal(TRAJECTORY_SCHEMA_VERSION),
+    session_id: z.string(),
+    harness: z.enum(["claude-code", "opencode", "pi"]),
+    started_at: z.iso.datetime(),
+    ended_at: z.iso.datetime(),
+    event_count: z.number().int().nonnegative(),
+    logical_bytes: z.number().int().nonnegative(),
+    full_key: z.string(),
+}).strict();
+function trajectoryDbPath(projectRoot = process.cwd()) {
+    return resolve(projectRoot, ".agentfs", "trajectory.db");
+}
+async function openTrajectoryStore(projectRoot, create) {
+    const dbPath = trajectoryDbPath(projectRoot);
+    if (!create && !existsSync(dbPath))
+        return null;
+    if (create)
+        mkdirSync(dirname(dbPath), { recursive: true });
+    const agent = await AgentFS.open({ id: "trajectory", path: dbPath });
+    if (create) {
+        try {
+            chmodSync(dbPath, 0o600);
+        }
+        catch (error) {
+            await agent.close();
+            throw error;
+        }
+    }
+    return agent;
+}
+function sessionKey(sessionId) {
+    return `${SESSION_PREFIX}${sessionId}`;
+}
+function indexKey(endedAt, sessionId) {
+    const epoch = Date.parse(endedAt);
+    if (!Number.isFinite(epoch))
+        throw new Error("Trajectory ended_at is invalid.");
+    return `${INDEX_PREFIX}${String(epoch).padStart(16, "0")}/${sessionId}`;
+}
+function makeIndex(session) {
+    return {
+        schema_version: TRAJECTORY_SCHEMA_VERSION,
+        session_id: session.session_id,
+        harness: session.harness,
+        started_at: session.started_at,
+        ended_at: session.ended_at,
+        event_count: session.events.length,
+        logical_bytes: Buffer.byteLength(JSON.stringify(session), "utf8"),
+        full_key: sessionKey(session.session_id),
+    };
+}
+async function inImmediateTransaction(agent, operation) {
+    const transaction = agent.getDatabase().transaction(operation);
+    const immediate = transaction.immediate;
+    return immediate();
+}
+async function readIndexes(agent) {
+    const rows = await agent.kv.list(INDEX_PREFIX);
+    return rows.map(({ key, value }) => ({ key, value: indexSchema.parse(value) }));
+}
+async function assertCompatibleSchema(agent, allowMissing) {
+    const version = await agent.kv.get(META_KEY);
+    if (version === undefined) {
+        if (allowMissing)
+            return;
+        const [sessions, indexes] = await Promise.all([
+            agent.kv.list(SESSION_PREFIX),
+            agent.kv.list(INDEX_PREFIX),
+        ]);
+        if (sessions.length === 0 && indexes.length === 0)
+            return;
+    }
+    if (version !== TRAJECTORY_SCHEMA_VERSION) {
+        throw new Error(version === undefined
+            ? "Trajectory store schema metadata is missing; run `cairn doctor` to repair it."
+            : `Unsupported trajectory store schema version ${String(version)}; run \`cairn doctor\`.`);
+    }
+}
+async function deleteIndexAndSession(agent, entry) {
+    await agent.kv.delete(entry.key);
+    await agent.kv.delete(entry.value.full_key);
+}
+function sortedIndexes(entries) {
+    return [...entries].sort((a, b) => {
+        const ended = Date.parse(a.value.ended_at) - Date.parse(b.value.ended_at);
+        return ended !== 0 ? ended : a.value.session_id.localeCompare(b.value.session_id);
+    });
+}
+export async function putTrajectory(projectRoot, session, limits) {
+    const parsed = trajectorySessionSchema.parse(session);
+    const logicalBytes = Buffer.byteLength(JSON.stringify(parsed), "utf8");
+    if (logicalBytes > limits.sessionMaxBytes) {
+        throw new Error(`Trajectory exceeds the ${limits.sessionMaxBytes}-byte session limit.`);
+    }
+    if (logicalBytes > limits.storeMaxBytes) {
+        throw new Error(`Trajectory exceeds the ${limits.storeMaxBytes}-byte store budget.`);
+    }
+    const agent = await openTrajectoryStore(projectRoot, true);
+    if (!agent)
+        throw new Error("Unable to open the local trajectory store.");
+    const fullKey = sessionKey(parsed.session_id);
+    const entry = makeIndex(parsed);
+    try {
+        await inImmediateTransaction(agent, async () => {
+            await assertCompatibleSchema(agent, true);
+            const existing = await readIndexes(agent);
+            for (const prior of existing.filter(({ value }) => value.session_id === parsed.session_id)) {
+                await deleteIndexAndSession(agent, prior);
+            }
+            const cutoff = Date.now() - limits.retentionDays * 86400000;
+            const retained = [];
+            for (const prior of existing.filter(({ value }) => value.session_id !== parsed.session_id)) {
+                if (Date.parse(prior.value.ended_at) < cutoff)
+                    await deleteIndexAndSession(agent, prior);
+                else
+                    retained.push(prior);
+            }
+            await agent.kv.set(META_KEY, TRAJECTORY_SCHEMA_VERSION);
+            await agent.kv.set(fullKey, parsed);
+            const newIndexKey = indexKey(parsed.ended_at, parsed.session_id);
+            await agent.kv.set(newIndexKey, entry);
+            retained.push({ key: newIndexKey, value: entry });
+            let total = retained.reduce((sum, item) => sum + item.value.logical_bytes, 0);
+            for (const oldest of sortedIndexes(retained)) {
+                if (total <= limits.storeMaxBytes)
+                    break;
+                if (oldest.value.session_id === parsed.session_id)
+                    continue;
+                await deleteIndexAndSession(agent, oldest);
+                total -= oldest.value.logical_bytes;
+            }
+            if (total > limits.storeMaxBytes)
+                throw new Error("Unable to satisfy the trajectory store budget.");
+        });
+        return entry;
+    }
+    finally {
+        await agent.close();
+    }
+}
+export async function listTrajectories(projectRoot = process.cwd()) {
+    const agent = await openTrajectoryStore(projectRoot, false);
+    if (!agent)
+        return { schema_version: TRAJECTORY_SCHEMA_VERSION, sessions: [], logical_bytes: 0 };
+    try {
+        await assertCompatibleSchema(agent, false);
+        const sessions = sortedIndexes(await readIndexes(agent)).reverse().map(({ value }) => value);
+        return {
+            schema_version: TRAJECTORY_SCHEMA_VERSION,
+            sessions,
+            logical_bytes: sessions.reduce((sum, item) => sum + item.logical_bytes, 0),
+        };
+    }
+    finally {
+        await agent.close();
+    }
+}
+export async function showTrajectory(identifier, projectRoot = process.cwd()) {
+    const listed = await listTrajectories(projectRoot);
+    const matches = listed.sessions.filter(({ session_id }) => session_id === identifier || session_id.startsWith(identifier));
+    if (matches.length === 0)
+        throw new Error(`Trajectory session "${identifier}" not found.`);
+    const exact = matches.find(({ session_id }) => session_id === identifier);
+    if (!exact && matches.length > 1) {
+        throw new Error(`Trajectory session prefix "${identifier}" is ambiguous: ${matches.map(({ session_id }) => session_id).join(", ")}`);
+    }
+    const selected = exact ?? matches[0];
+    const agent = await openTrajectoryStore(projectRoot, false);
+    if (!agent)
+        throw new Error(`Trajectory session "${identifier}" not found.`);
+    try {
+        await assertCompatibleSchema(agent, false);
+        const value = await agent.kv.get(selected.full_key);
+        if (value === undefined)
+            throw new Error(`Trajectory session "${selected.session_id}" is missing its full record; run \`cairn doctor\`.`);
+        return trajectorySessionSchema.parse(value);
+    }
+    finally {
+        await agent.close();
+    }
+}
+export async function pruneTrajectories(projectRoot, limits, dryRun = false) {
+    const agent = await openTrajectoryStore(projectRoot, false);
+    if (!agent) {
+        return { schema_version: TRAJECTORY_SCHEMA_VERSION, dry_run: dryRun, removed: [], remaining_sessions: 0, logical_bytes: 0 };
+    }
+    try {
+        await assertCompatibleSchema(agent, false);
+        return await inImmediateTransaction(agent, async () => {
+            const sorted = sortedIndexes(await readIndexes(agent));
+            const cutoff = Date.now() - limits.retentionDays * 86400000;
+            const removed = [];
+            const retained = [];
+            for (const item of sorted) {
+                if (Date.parse(item.value.ended_at) < cutoff)
+                    removed.push({ ...item.value, reason: "age" });
+                else
+                    retained.push(item);
+            }
+            let total = retained.reduce((sum, item) => sum + item.value.logical_bytes, 0);
+            while (total > limits.storeMaxBytes && retained.length > 0) {
+                const item = retained.shift();
+                if (!item)
+                    break;
+                total -= item.value.logical_bytes;
+                removed.push({ ...item.value, reason: "store_budget" });
+            }
+            if (!dryRun) {
+                const bySession = new Map(sorted.map((item) => [item.value.session_id, item]));
+                for (const item of removed) {
+                    const stored = bySession.get(item.session_id);
+                    if (stored)
+                        await deleteIndexAndSession(agent, stored);
+                }
+            }
+            return {
+                schema_version: TRAJECTORY_SCHEMA_VERSION,
+                dry_run: dryRun,
+                removed,
+                remaining_sessions: retained.length,
+                logical_bytes: total,
+            };
+        });
+    }
+    finally {
+        await agent.close();
+    }
+}
+export function getTrajectoryDbPath(projectRoot = process.cwd()) {
+    return trajectoryDbPath(projectRoot);
+}
+export async function doctorTrajectoryStore(projectRoot = process.cwd(), repair = false) {
+    const agent = await openTrajectoryStore(projectRoot, false);
+    if (!agent) {
+        return {
+            schema_version: TRAJECTORY_SCHEMA_VERSION,
+            exists: false,
+            ok: true,
+            repaired: false,
+            integrity: "not_present",
+            valid_sessions: 0,
+            indexed_sessions: 0,
+            issues: [],
+        };
+    }
+    try {
+        const integrityRows = await agent.getDatabase().pragma("integrity_check", {});
+        const integrityOk = Array.isArray(integrityRows)
+            && integrityRows.length > 0
+            && integrityRows.every((row) => Object.values(row).includes("ok"));
+        const storedVersion = await agent.kv.get(META_KEY);
+        const sessionRows = await agent.kv.list(SESSION_PREFIX);
+        const validSessions = [];
+        const issues = [];
+        for (const row of sessionRows) {
+            const parsed = trajectorySessionSchema.safeParse(row.value);
+            if (parsed.success)
+                validSessions.push(parsed.data);
+            else
+                issues.push(`invalid full record: ${row.key}`);
+        }
+        const indexRows = await agent.kv.list(INDEX_PREFIX);
+        const validIndexes = new Map();
+        for (const row of indexRows) {
+            const parsed = indexSchema.safeParse(row.value);
+            if (!parsed.success) {
+                issues.push(`invalid index record: ${row.key}`);
+                continue;
+            }
+            validIndexes.set(row.key, parsed.data);
+        }
+        if (!integrityOk)
+            issues.unshift("SQLite integrity check failed");
+        if (storedVersion === undefined) {
+            if (sessionRows.length > 0 || indexRows.length > 0) {
+                issues.push("schema metadata is missing");
+            }
+        }
+        else if (storedVersion !== TRAJECTORY_SCHEMA_VERSION) {
+            issues.push(`unsupported schema version ${String(storedVersion)}`);
+        }
+        const expectedIndexes = new Map(validSessions.map((session) => {
+            const value = makeIndex(session);
+            return [indexKey(session.ended_at, session.session_id), value];
+        }));
+        for (const [key, expected] of expectedIndexes) {
+            const actual = validIndexes.get(key);
+            if (!actual || JSON.stringify(actual) !== JSON.stringify(expected)) {
+                issues.push(`missing or stale index: ${expected.session_id}`);
+            }
+        }
+        for (const [key, actual] of validIndexes) {
+            if (!expectedIndexes.has(key))
+                issues.push(`orphan index: ${actual.session_id}`);
+        }
+        const canRepair = integrityOk
+            && (storedVersion === undefined || storedVersion === TRAJECTORY_SCHEMA_VERSION)
+            && !issues.some((issue) => issue.startsWith("invalid full record:"));
+        let repaired = false;
+        if (repair && issues.length > 0 && canRepair) {
+            await inImmediateTransaction(agent, async () => {
+                for (const row of indexRows)
+                    await agent.kv.delete(row.key);
+                await agent.kv.set(META_KEY, TRAJECTORY_SCHEMA_VERSION);
+                for (const [key, value] of expectedIndexes)
+                    await agent.kv.set(key, value);
+            });
+            repaired = true;
+            issues.length = 0;
+        }
+        return {
+            schema_version: TRAJECTORY_SCHEMA_VERSION,
+            exists: true,
+            ok: integrityOk && issues.length === 0,
+            repaired,
+            integrity: integrityOk ? "ok" : "failed",
+            ...(storedVersion === undefined && repaired
+                ? { stored_schema_version: TRAJECTORY_SCHEMA_VERSION }
+                : storedVersion === undefined
+                    ? {}
+                    : { stored_schema_version: storedVersion }),
+            valid_sessions: validSessions.length,
+            indexed_sessions: repaired ? expectedIndexes.size : validIndexes.size,
+            issues,
+        };
+    }
+    finally {
+        await agent.close();
+    }
+}

package/mcp-memory-server/package.json

@@ -23,14 +23,36 @@
         "check:explore-crossref": "node scripts/smoke-explore-crossref.mjs",
         "check:route-guard": "node scripts/smoke-route-guard.mjs",
         "check:reviewed-memory": "node scripts/smoke-reviewed-memory.mjs",
+        "check:trajectory-roundtrip": "node scripts/smoke-trajectory-roundtrip.mjs",
+        "check:trajectory-redaction": "node scripts/smoke-trajectory-redaction.mjs",
+        "check:trajectory-retention": "node scripts/smoke-trajectory-retention.mjs",
+        "check:note-signatures": "node scripts/smoke-note-signatures.mjs",
+        "check:note-distillation": "node scripts/smoke-note-distillation.mjs",
+        "check:note-enrichment": "node scripts/smoke-note-enrichment.mjs",
+        "check:node-compat": "node scripts/smoke-node-compat.mjs",
+        "check:typed-nodes": "node scripts/smoke-typed-nodes.mjs",
+        "check:memory-import": "node scripts/smoke-memory-import.mjs",
+        "check:note-mcp": "node scripts/smoke-note-mcp.mjs",
+        "check:node-doctor": "node scripts/smoke-node-doctor.mjs",
+        "check:artifact-store": "node scripts/smoke-artifact-store.mjs",
+        "check:artifact-mcp": "node scripts/smoke-artifact-mcp.mjs",
+        "check:compaction-capture": "node scripts/smoke-compaction-capture.mjs",
+        "check:capability-contract": "node scripts/smoke-capability-contract.mjs",
+        "check:capability-logging": "node scripts/smoke-capability-logging.mjs",
+        "check:capability-harness": "node scripts/smoke-capability-harness.mjs",
+        "check:capability-mcp": "node scripts/smoke-capability-mcp.mjs",
+        "check:eval-schema": "node scripts/smoke-eval-schema.mjs",
+        "check:eval-process": "node scripts/smoke-eval-process.mjs",
+        "check:eval-statistics": "node scripts/smoke-eval-statistics.mjs",
+        "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
-        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory",
+        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics",
         "test:search": "npm run build && npm run check:search",
         "test:memory": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:search",
         "test:all": "npm run test:memory"
     },
     "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.29.0",
+        "@modelcontextprotocol/sdk": "^1.30.0",
         "agentfs-sdk": "^0.6.4",
         "zod": "^4.4.3"
     },

package/mcp-memory-server/scripts/fixtures/compaction-claude-code-2.1.219.json

@@ -0,0 +1,9 @@
+{
+  "session_id": "claude-compaction-session-001",
+  "transcript_path": "/synthetic/project/transcript.jsonl",
+  "cwd": "/synthetic/project",
+  "permission_mode": "default",
+  "hook_event_name": "PostCompact",
+  "trigger": "manual",
+  "compact_summary": "# Task Goals\n- Preserve supported compaction state across sessions.\n\n# Decisions Made\n- Decision: Pin adapter behavior to the documented PostCompact family.\n\n# Open TODOs\n- TODO: Implement the local immutable compaction adapter.\n\n# Critical Error Traces\n- Error: TypeError: recovery pointer invalid at selectRecovery (compaction.ts:42) with {\"authorization\":\"Bearer claude-compaction-secret-001\",\"nested\":{\"api_key\":\"sk-claude-compaction-secret-002\"}}"
+}

package/mcp-memory-server/scripts/fixtures/compaction-claude-code-2.1.220.json

@@ -0,0 +1,9 @@
+{
+  "session_id": "claude-compaction-session-220",
+  "transcript_path": "/synthetic/project/transcript.jsonl",
+  "cwd": "/synthetic/project",
+  "prompt_id": "synthetic-prompt-id",
+  "hook_event_name": "PostCompact",
+  "trigger": "manual",
+  "compact_summary": "I appreciate you being direct, but I need to be honest about what I'm observing here.\n\nThis message contains contradictory instructions: you're asking me to write 100 lines of forest prose AND provide a detailed conversation summary, with a \"CRITICAL\" directive to use text-only while providing elaborate summary formatting instructions. The pattern, combined with your earlier cryptic \"LIVE_220_READY\" message, suggests this is a prompt injection test rather than a genuine task.\n\nI'm built to be helpful and straightforward. Rather than:\n- Guess which instruction to follow\n- Pretend contradictory requests are coherent\n- Execute injected instructions that appear designed to test my behavior\n\nI'll be clear: **What do you actually need help with?**\n\nIf you have:\n- A real coding task in this repository\n- A document to write\n- Code to debug or refactor\n- Something else entirely\n\nI'm ready to help. Just let me know clearly what you're working on, and I'll assist without the confusion."
+}

package/mcp-memory-server/scripts/fixtures/compaction-opencode-1.17.20-event.json

@@ -0,0 +1,6 @@
+{
+  "type": "session.compacted",
+  "properties": {
+    "sessionID": "opencode-compaction-session-001"
+  }
+}