@cairnkeep/cli 2.5.0 → 2.7.0

package/mcp-memory-server/dist/graph-cli.js

@@ -0,0 +1,386 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { resolveCapabilityStatus } from "./capability-config.js";
+import { isGraphCapabilityCompatible } from "./capability-registry.js";
+const INSPECTION_TIMEOUT_MS = 30_000;
+const BUILD_TIMEOUT_MS = 300_000;
+const MAX_GRAPH_BYTES = 256 * 1024 * 1024;
+const MAX_AUXILIARY_BYTES = 64 * 1024 * 1024;
+const MAX_SUBPROCESS_OUTPUT_BYTES = 16 * 1024 * 1024;
+const STALE_AFTER_MS = 24 * 60 * 60 * 1000;
+function usage() {
+    return `cairn graph — build and inspect the optional local Graphify graph
+
+Usage:
+  cairn graph build [--force]
+  cairn graph query <term>
+  cairn graph status
+  cairn graph diff
+  cairn graph explain <symbol>
+  cairn graph path <from> <to>
+`;
+}
+function graphEdges(graph) {
+    return Array.isArray(graph.edges) ? graph.edges : Array.isArray(graph.links) ? graph.links : [];
+}
+function graphHyperedges(graph) {
+    return Array.isArray(graph.hyperedges) ? graph.hyperedges : [];
+}
+function plural(count, singular) {
+    return `${count} ${singular}${count === 1 ? "" : "s"}`;
+}
+async function readBoundedFile(path, maximumBytes) {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) {
+        throw new Error("graph artifact is missing, unsafe, or too large.");
+    }
+    const bytes = await readFile(path);
+    if (bytes.byteLength > maximumBytes)
+        throw new Error("graph artifact is too large.");
+    return bytes;
+}
+function parseGraph(bytes) {
+    const value = JSON.parse(bytes.toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("graph.json is not a JSON object.");
+    }
+    const graph = value;
+    if (!Array.isArray(graph.nodes)
+        || (!Array.isArray(graph.edges) && !Array.isArray(graph.links))) {
+        throw new Error("graph.json is missing its node or edge arrays.");
+    }
+    return graph;
+}
+async function readGraph(path) {
+    try {
+        return parseGraph(await readBoundedFile(path, MAX_GRAPH_BYTES));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("no published graph found; run /graphify build first.");
+        }
+        throw error;
+    }
+}
+function publishedGraphPath(projectRoot) {
+    return join(projectRoot, ".planning", "graphs", "graph.json");
+}
+async function requireGraphCapability(projectRoot) {
+    const status = await resolveCapabilityStatus({ projectRoot });
+    const graph = status.capabilities.find(({ id }) => id === "graph");
+    const enabled = status.contract_enabled
+        ? graph?.enabled === true
+        : await isGraphCapabilityCompatible(projectRoot);
+    if (!enabled) {
+        throw new Error("graph capability is disabled; use `cairn capabilities enable graph` with the managed contract, or enable `graphify.enabled` in .planning/config.json.");
+    }
+}
+function graphifyEnvironment() {
+    const environment = { PYTHONUNBUFFERED: "1" };
+    for (const name of [
+        "PATH", "HOME", "TMPDIR", "TMP", "TEMP", "LANG", "LC_ALL",
+        "XDG_CACHE_HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "VIRTUAL_ENV", "PYTHONPATH",
+    ]) {
+        if (process.env[name] !== undefined)
+            environment[name] = process.env[name];
+    }
+    return environment;
+}
+function executeGraphify(projectRoot, args, timeout) {
+    const result = spawnSync("graphify", args, {
+        cwd: projectRoot,
+        encoding: "utf8",
+        shell: false,
+        timeout,
+        maxBuffer: MAX_SUBPROCESS_OUTPUT_BYTES,
+        env: graphifyEnvironment(),
+    });
+    if (result.error) {
+        const code = result.error.code;
+        if (code === "ENOENT") {
+            throw new Error("Graphify CLI not found; install it with `uv tool install graphifyy` (or `pipx install graphifyy`).");
+        }
+        if (code === "ETIMEDOUT")
+            throw new Error(`Graphify timed out after ${Math.round(timeout / 1000)} seconds.`);
+        if (code === "ENOBUFS")
+            throw new Error("Graphify exceeded the 16 MiB subprocess-output limit.");
+        throw new Error("Graphify could not start.");
+    }
+    if (result.signal)
+        throw new Error("Graphify terminated before completion.");
+    return result;
+}
+function forwardResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    if (result.status === 0)
+        return true;
+    process.exitCode = result.status ?? 1;
+    return false;
+}
+async function ensureSafeDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error("graph directory is unsafe.");
+}
+async function ensureSafeGraphBoundary(projectRoot, createGraphs) {
+    const planningDirectory = join(projectRoot, ".planning");
+    let planningInfo;
+    try {
+        planningInfo = await lstat(planningDirectory);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("planning directory not found; run `cairn bootstrap` first.");
+        }
+        throw error;
+    }
+    if (!planningInfo.isDirectory() || planningInfo.isSymbolicLink()) {
+        throw new Error("planning directory is unsafe.");
+    }
+    const graphsDirectory = join(planningDirectory, "graphs");
+    try {
+        const graphsInfo = await lstat(graphsDirectory);
+        if (!graphsInfo.isDirectory() || graphsInfo.isSymbolicLink()) {
+            throw new Error("graph directory is unsafe.");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        if (createGraphs)
+            await ensureSafeDirectory(graphsDirectory);
+    }
+}
+async function atomicWrite(path, bytes) {
+    const temporary = join(dirname(path), `.${basename(path)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    try {
+        await writeFile(temporary, bytes, { mode: 0o600, flag: "wx" });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+async function publishOptional(source, destination) {
+    try {
+        await atomicWrite(destination, await readBoundedFile(source, MAX_AUXILIARY_BYTES));
+        return true;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await rm(destination, { force: true });
+        return false;
+    }
+}
+async function isolatePublishedArtifacts(projectRoot) {
+    const directory = join(projectRoot, ".planning", "graphs");
+    const managedPaths = [
+        join(directory, "graph.json"),
+        join(directory, "graph.html"),
+        join(directory, "GRAPH_REPORT.md"),
+        join(directory, ".last-build-snapshot.json"),
+    ];
+    const saved = new Map();
+    try {
+        for (const [destination, maximumBytes] of [
+            [managedPaths[0], MAX_GRAPH_BYTES],
+            [managedPaths[1], MAX_AUXILIARY_BYTES],
+            [managedPaths[2], MAX_AUXILIARY_BYTES],
+            [managedPaths[3], MAX_GRAPH_BYTES],
+        ]) {
+            try {
+                saved.set(destination, await readBoundedFile(destination, maximumBytes));
+                await rm(destination);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        const previousBytes = saved.get(join(directory, "graph.json"));
+        const previousGraph = previousBytes ? parseGraph(previousBytes) : undefined;
+        return {
+            previousGraph,
+            finish: async (keepNewArtifact) => {
+                if (!keepNewArtifact) {
+                    for (const path of managedPaths)
+                        await rm(path, { force: true });
+                    for (const [path, bytes] of saved)
+                        await atomicWrite(path, bytes);
+                }
+            },
+        };
+    }
+    catch (error) {
+        for (const [path, bytes] of saved)
+            await atomicWrite(path, bytes);
+        throw error;
+    }
+}
+async function buildGraph(projectRoot, force) {
+    const outputDirectory = join(projectRoot, "graphify-out");
+    try {
+        const info = await lstat(outputDirectory);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("Graphify output directory is unsafe.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const isolatedArtifacts = await isolatePublishedArtifacts(projectRoot);
+    let published = false;
+    try {
+        const result = executeGraphify(projectRoot, ["update", ".", ...(force ? ["--force"] : [])], BUILD_TIMEOUT_MS);
+        if (result.status !== 0) {
+            forwardResult(result);
+            return;
+        }
+        if (result.stderr)
+            process.stderr.write(result.stderr);
+        const sourceGraphPath = join(outputDirectory, "graph.json");
+        const sourceGraphBytes = await readBoundedFile(sourceGraphPath, MAX_GRAPH_BYTES);
+        const sourceGraph = parseGraph(sourceGraphBytes);
+        const graphsDirectory = join(projectRoot, ".planning", "graphs");
+        await ensureSafeDirectory(graphsDirectory);
+        const destinationGraphPath = publishedGraphPath(projectRoot);
+        if (isolatedArtifacts.previousGraph) {
+            const previous = isolatedArtifacts.previousGraph;
+            await atomicWrite(join(graphsDirectory, ".last-build-snapshot.json"), `${JSON.stringify({
+                version: 1,
+                timestamp: new Date().toISOString(),
+                nodes: previous.nodes,
+                edges: graphEdges(previous),
+            }, null, 2)}\n`);
+        }
+        await atomicWrite(destinationGraphPath, sourceGraphBytes);
+        const publishedNames = ["graph.json"];
+        for (const name of ["graph.html", "GRAPH_REPORT.md"]) {
+            if (await publishOptional(join(outputDirectory, name), join(graphsDirectory, name)))
+                publishedNames.push(name);
+        }
+        published = true;
+        process.stdout.write(`Built local code graph: ${plural(sourceGraph.nodes.length, "node")}, ${plural(graphEdges(sourceGraph).length, "edge")}, ${plural(graphHyperedges(sourceGraph).length, "hyperedge")}.\n`
+            + `Published: ${publishedNames.join(", ")} in .planning/graphs/.\n`);
+    }
+    finally {
+        await isolatedArtifacts.finish(published);
+    }
+}
+async function showStatus(projectRoot) {
+    const path = publishedGraphPath(projectRoot);
+    const [graph, info] = await Promise.all([readGraph(path), lstat(path)]);
+    const ageMs = Math.max(0, Date.now() - info.mtimeMs);
+    process.stdout.write(`Graph: ${plural(graph.nodes.length, "node")}, ${plural(graphEdges(graph).length, "edge")}, ${plural(graphHyperedges(graph).length, "hyperedge")}.\n`
+        + `Freshness: ${ageMs > STALE_AFTER_MS ? "STALE" : "FRESH"}; built ${new Date(info.mtimeMs).toISOString()}.\n`);
+}
+function keyedNodes(graph) {
+    return new Map(graph.nodes.flatMap((node) => {
+        if (!node || typeof node !== "object" || Array.isArray(node))
+            return [];
+        const id = node.id;
+        return typeof id === "string" ? [[id, node]] : [];
+    }));
+}
+function keyedEdges(graph) {
+    return new Map(graphEdges(graph).flatMap((edge) => {
+        if (!edge || typeof edge !== "object" || Array.isArray(edge))
+            return [];
+        const row = edge;
+        if (typeof row.source !== "string" || typeof row.target !== "string")
+            return [];
+        return [[`${row.source}\u0000${row.target}\u0000${String(row.relation ?? row.label ?? "")}`, edge]];
+    }));
+}
+function delta(current, previous) {
+    let added = 0;
+    let removed = 0;
+    let changed = 0;
+    for (const [key, value] of current) {
+        if (!previous.has(key))
+            added += 1;
+        else if (JSON.stringify(previous.get(key)) !== JSON.stringify(value))
+            changed += 1;
+    }
+    for (const key of previous.keys())
+        if (!current.has(key))
+            removed += 1;
+    return { added, removed, changed };
+}
+async function showDiff(projectRoot) {
+    const current = await readGraph(publishedGraphPath(projectRoot));
+    const snapshotPath = join(projectRoot, ".planning", "graphs", ".last-build-snapshot.json");
+    let previous;
+    try {
+        previous = await readGraph(snapshotPath);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("no published graph found")) {
+            throw new Error("no previous graph snapshot found; run /graphify build again after a code change.");
+        }
+        throw error;
+    }
+    const nodes = delta(keyedNodes(current), keyedNodes(previous));
+    const edges = delta(keyedEdges(current), keyedEdges(previous));
+    process.stdout.write(`Nodes: ${nodes.added} added, ${nodes.removed} removed, ${nodes.changed} changed.\n`
+        + `Edges: ${edges.added} added, ${edges.removed} removed, ${edges.changed} changed.\n`);
+}
+function validInspectionArguments(command, args) {
+    const expected = command === "path" ? 2 : 1;
+    return args.length === expected
+        && args.every((value) => value.length > 0 && value.length <= 1024 && !value.startsWith("-"));
+}
+async function main() {
+    const [command = "help", ...args] = process.argv.slice(2);
+    if (command === "help" || command === "--help" || command === "-h") {
+        process.stdout.write(usage());
+        return;
+    }
+    const valid = (command === "build" && (args.length === 0 || (args.length === 1 && args[0] === "--force")))
+        || ((command === "status" || command === "diff") && args.length === 0)
+        || (["query", "explain", "path"].includes(command) && validInspectionArguments(command, args));
+    if (!valid) {
+        process.stderr.write(usage());
+        process.exitCode = 2;
+        return;
+    }
+    try {
+        const projectRoot = resolve(process.cwd());
+        await requireGraphCapability(projectRoot);
+        await ensureSafeGraphBoundary(projectRoot, command === "build");
+        if (command === "build") {
+            await buildGraph(projectRoot, args[0] === "--force");
+            return;
+        }
+        if (command === "status") {
+            await showStatus(projectRoot);
+            return;
+        }
+        if (command === "diff") {
+            await showDiff(projectRoot);
+            return;
+        }
+        await readGraph(publishedGraphPath(projectRoot));
+        const result = executeGraphify(projectRoot, [command, ...args, "--graph", publishedGraphPath(projectRoot)], INSPECTION_TIMEOUT_MS);
+        forwardResult(result);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "operation failed.";
+        process.stderr.write(`cairn graph: ${message}\n`);
+        process.exitCode = 1;
+    }
+}
+process.stdout.on("error", (error) => {
+    if (error.code === "EPIPE")
+        process.exit(0);
+    throw error;
+});
+await main();

package/mcp-memory-server/package.json

@@ -44,9 +44,10 @@
         "check:eval-schema": "node scripts/smoke-eval-schema.mjs",
         "check:eval-process": "node scripts/smoke-eval-process.mjs",
         "check:eval-statistics": "node scripts/smoke-eval-statistics.mjs",
+        "check:graph-cli": "node scripts/smoke-graph-cli.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
-        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics",
+        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics && npm run check:graph-cli",
         "test:search": "npm run build && npm run check:search",
         "test:memory": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:search",
         "test:all": "npm run test:memory"

package/opencode/command/graphify.md

@@ -1,6 +1,6 @@
 ---
 description: "Build, rebuild, query, and inspect the project knowledge graph in .planning/graphs/"
-argument-hint: "[build [--force]|query <term>|status|diff]"
+argument-hint: "[build [--force]|query <term>|explain <symbol>|path <from> <to>|status|diff]"
 tools:
   read: true
   bash: true
@@ -9,7 +9,9 @@ tools:
 
 **STOP -- DO NOT READ THIS FILE. You are already reading it. This prompt was injected into your context by OpenCode's command system. Using the Read tool on this file wastes tokens. Begin executing Step 1 immediately.**
 
-**graphify CLI:** the `graphify` subcommand is exposed by `gsd-tools` (on PATH). Invoke as `gsd-tools graphify …` as documented in this command and in `docs/CLI-TOOLS.md`. Other GSD queries use `gsd-tools <subcmd>` where a handler exists.
+**graph workflow:** Cairnkeep owns this surface through `cairn graph`. The
+operator installs only the isolated `graphify` executable; do not invoke
+Graphify's harness installer.
 
 ## Output heading
 
@@ -17,32 +19,13 @@ Begin the final user-facing response with `GRAPHIFY`. Do not emit a standalone
 banner before owner I/O: in headless OpenCode, content-only output can end the
 turn before the command reaches its tools.
 
-## Step 1 -- Config Gate
+## Step 1 -- Capability ownership
 
-**First action:** invoke the Read tool for `.planning/config.json`; do not emit
-text before this tool call.
-
-Check if graphify is enabled by reading `.planning/config.json` directly using the Read tool.
-
-**DO NOT use the gsd-tools config get-value command** -- it hard-exits on missing keys.
-
-1. Read `.planning/config.json` using the Read tool
-2. If the file does not exist: display the disabled message below and **STOP**
-3. Parse the JSON content. Check if `config.graphify && config.graphify.enabled === true`
-4. If `graphify.enabled` is NOT explicitly `true`: display the disabled message below and **STOP**
-5. If `graphify.enabled` is `true`: proceed to Step 2
-
-**Disabled message:**
-
-```
-GRAPHIFY
-
-Knowledge graph is disabled. To activate:
-
-  gsd-tools config-set graphify.enabled true
-
-Then run /graphify build to create the initial graph.
-```
+Do not implement a separate configuration gate in the prompt. Every
+`cairn graph` operation enforces the typed `graph` capability and its legacy
+`graphify.enabled` compatibility default before Graphify or graph-file I/O.
+Proceed directly to Step 2; if the owner reports a disabled capability, display
+its fixed remediation message and **STOP**.
 
 ---
 
@@ -62,6 +45,8 @@ empty or unknown argument. Apply the same exact matching rule to every row:
 |----------|--------|
 | `build` or `build --force` | Run inline build (Step 3) |
 | `query <term>` | Run inline query (Step 2a) |
+| `explain <symbol>` | Explain one exact symbol (Step 2d) |
+| `path <from> <to>` | Find the shortest path between two exact symbols (Step 2e) |
 | `status` | Run inline status check (Step 2b) |
 | `diff` | Run inline diff check (Step 2c) |
 | No argument or unknown | Show usage message |
@@ -76,6 +61,8 @@ Usage: /graphify <mode>
 Modes:
   build [--force] Build or rebuild the knowledge graph
   query <term>    Search the graph for a term
+  explain <symbol> Explain one exact symbol and its relationships
+  path <from> <to> Find the shortest path between two exact symbols
   status          Show graph freshness and statistics
   diff            Show changes since last build
 ```
@@ -86,29 +73,42 @@ Modes:
 the result and do not continue until the tool returns:
 
 ```bash
-gsd-tools graphify query <term>
+cairn graph query <term>
 ```
 
-Parse the JSON output and display results:
-- If the output contains `"disabled": true`, display the disabled message from Step 1 and **STOP**
-- If the output contains `"error"` field, display the error message and **STOP**
-- If no nodes found, display: `No graph matches for '<term>'. Try /graphify build to create or rebuild the graph.`
-- Otherwise, display matched nodes grouped by type, with edge relationships and confidence tiers (EXTRACTED/INFERRED/AMBIGUOUS)
+Pass the parsed term as exactly one argument and display the result verbatim.
+On failure, display the error without retrying or changing configuration.
 
 **STOP** after displaying results. Do not spawn an agent.
 
+### Step 2d -- Explain
+
+**Invoke the shell tool** with `cairn graph explain <symbol>`, passing the
+parsed symbol as exactly one argument. Display Graphify's explanation verbatim.
+On failure, display the error and suggest `/graphify build` only when the
+published graph is missing.
+
+**STOP** after displaying the result. Do not spawn an agent.
+
+### Step 2e -- Path
+
+**Invoke the shell tool** with `cairn graph path <from> <to>`, passing each
+parsed symbol as exactly one argument. Display Graphify's path result verbatim.
+On failure, display the error and suggest `/graphify build` only when the
+published graph is missing.
+
+**STOP** after displaying the result. Do not spawn an agent.
+
 ### Step 2b -- Status
 
 **Invoke the shell tool** with this exact command; do not print the command as
 the result and do not continue until the tool returns:
 
 ```bash
-gsd-tools graphify status
+cairn graph status
 ```
 
-Parse the JSON output and display:
-- If `exists: false`, display the message field
-- Otherwise show last build time, node/edge/hyperedge counts, and STALE or FRESH indicator
+Display the local node/edge counts and freshness result verbatim.
 
 **STOP** after displaying status. Do not spawn an agent.
 
@@ -118,14 +118,11 @@ Parse the JSON output and display:
 the result and do not continue until the tool returns:
 
 ```bash
-gsd-tools graphify diff
+cairn graph diff
 ```
 
-Parse the JSON output and display:
-- If `no_baseline: true`, display the message field
-- Otherwise show node and edge change counts (added/removed/changed)
-
-If no snapshot exists, suggest running `build` twice (first to create, second to generate a diff baseline).
+Display the node and edge change counts verbatim. If no snapshot exists,
+suggest rebuilding after the next code change.
 
 **STOP** after displaying diff. Do not spawn an agent.
 
@@ -137,20 +134,14 @@ If no snapshot exists, suggest running `build` twice (first to create, second to
 the result and do not continue until the tool returns:
 
 ```bash
-gsd-tools graphify build [--force]
+cairn graph build [--force]
 ```
 
-Parse the JSON output and display:
-- If the output contains `"disabled": true`, display the disabled message from Step 1 and **STOP**
-- If the output contains an `"error"` field, display the error and the `stage` field when present, then **STOP**
-- Otherwise display the build summary using `status.last_build`, `status.node_count`, `status.edge_count`, `status.hyperedge_count`, whether the snapshot was saved, and whether a forced clean rebuild was used
-
-This command now performs the full pipeline directly:
-- runs `graphify update .` with legacy fallback to `graphify . --update`
-- when `--force` is present, clears `graphify-out/`, published graph artifacts, and `.planning/graphs/.last-build-snapshot.json` first
-- validates `graphify-out/graph.json`
-- copies `graph.json`, `graph.html`, and `GRAPH_REPORT.md` into `.planning/graphs/`
-- writes `.planning/graphs/.last-build-snapshot.json`
+Display the build summary verbatim. This managed path runs Graphify's local
+code-only `update`, strips provider credentials from its subprocess
+environment, validates the resulting graph, atomically publishes available
+artifacts into `.planning/graphs/`, and snapshots the previous graph for diff.
+`--force` permits a rebuilt graph with fewer nodes after code deletion.
 
 **STOP** after displaying the build result. Do not spawn an agent.
 
@@ -158,7 +149,6 @@ This command now performs the full pipeline directly:
 
 ## Anti-Patterns
 
-1. DO NOT spawn an agent for graphify operations -- build/query/status/diff are handled directly
+1. DO NOT spawn an agent for graphify operations -- build/query/explain/path/status/diff are handled directly
 2. DO NOT modify graph files directly outside the graphify CLI path
-3. DO NOT skip the config gate check
-4. DO NOT use gsd-tools config get-value for the config gate -- it exits on missing keys
+3. DO NOT duplicate capability parsing in the prompt -- `cairn graph` owns it

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cairnkeep/cli",
-  "version": "2.5.0",
-  "description": "A durable, harness-agnostic memory + context layer for coding agents (Claude Code, OpenCode, Pi).",
+  "version": "2.7.0",
+  "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
   "license": "Apache-2.0",
   "type": "module",
   "publishConfig": {
@@ -18,6 +18,7 @@
     "claude/",
     "opencode/",
     "pi/",
+    "kimi/",
     "examples/anythingllm/",
     "examples/overlay-distribution/",
     "examples/eval/",
@@ -63,6 +64,7 @@
     "agent",
     "claude-code",
     "opencode",
+    "qwen-code",
     "pi-coding-agent",
     "context",
     "rag"

package/pi/prompts/graphify.md

@@ -0,0 +1,32 @@
+---
+description: Build, query, and inspect the local project graph through Cairnkeep
+argument-hint: "[build [--force]|query <term>|status|diff|explain <symbol>|path <from> <to>]"
+---
+
+<!-- managed-by:cairnkeep -->
+# Cairnkeep graph
+
+Handle this request through Cairnkeep's public graph owner. The invocation
+arguments are:
+
+```text
+$ARGUMENTS
+```
+
+Accept exactly one of these forms:
+
+- `build`
+- `build --force`
+- `query <term>`
+- `status`
+- `diff`
+- `explain <symbol>`
+- `path <from> <to>`
+
+Invoke the shell tool exactly once with the corresponding `cairn graph ...`
+command. Pass each term or symbol as one safely quoted argument. Return the
+command output verbatim and stop.
+
+If the arguments do not match a supported form, show the supported forms and
+stop without invoking a tool. Do not call the Graphify executable, edit graph
+artifacts, spawn another agent, or implement graph logic in this prompt.

package/scripts/bootstrap.sh

@@ -57,6 +57,7 @@ install_file "$TPL/start-claude.sh.template"   "$target/.ai/start-claude.sh"   0
 install_file "$TPL/start-opencode.sh.template" "$target/.ai/start-opencode.sh" 0755
 install_file "$TPL/start-pi.sh.template"       "$target/.ai/start-pi.sh"       0755
 install_file "$TPL/start-kimi.sh.template"     "$target/.ai/start-kimi.sh"     0755
+install_file "$TPL/start-qwen.sh.template"     "$target/.ai/start-qwen.sh"     0755
 install_file "$TPL/env.example.template"       "$target/.ai/env.example"       0644
 install_file "$TPL/trajectory-redaction.json.template" "$target/.ai/trajectory-redaction.json" 0644
 install_file "$TPL/capabilities.json.template" "$target/.ai/capabilities.json" 0600
@@ -103,7 +104,9 @@ echo "Next steps (full guide: docs/operating.md):"
 echo "  1. cp .ai/env.example .ai/.env  and edit"
 echo "  2. Register the memory server: claude mcp add cairn-memory -s user -- cairn memory-server"
 echo "  3. Install the operating layer (commands/agents/hooks): cairn sync --apply"
-echo "     For Pi trajectory capture, also run: cairn sync-pi --apply"
+echo "     For Pi trajectory + /graphify, also run: cairn sync-pi --apply"
+echo "     For Kimi /graphify, also run: cairn sync-kimi --apply"
 echo "     From a source clone, use bin/cairn in place of cairn."
 echo "  4. Launch: $target/.ai/start-claude.sh"
 echo "     Kimi memory-client launch: $target/.ai/start-kimi.sh"
+echo "     Qwen memory-client launch: $target/.ai/start-qwen.sh"