@claude-flow/cli 3.32.26 → 3.32.30

package/dist/src/mcp-tools/memory-tools.js

@@ -264,6 +264,11 @@ export const memoryTools = [
                 },
                 ttl: { type: 'number', description: 'Time-to-live in seconds (optional)' },
                 upsert: { type: 'boolean', description: 'Update existing key instead of failing (default: true, matching CLI `memory store`; set false for strict-insert). #2775 parity.' },
+                provenance_type: {
+                    type: 'string',
+                    enum: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'],
+                    description: 'ADR-323: who/what produced this value, so shared-namespace retrieval can filter by trust level instead of conflating a user\'s stated claim with an agent\'s own output. Default: "unknown".',
+                },
             },
             required: ['key', 'value'],
         },
@@ -278,6 +283,9 @@ export const memoryTools = [
             const ttl = input.ttl;
             // #2775 parity with CLI: default true; only explicit `upsert: false` opts out.
             const upsert = input.upsert !== false;
+            // ADR-323: leave undefined when omitted so storeEntry's own default
+            // ('unknown') applies uniformly across the CLI, MCP tool, and other callers.
+            const provenanceType = input.provenance_type;
             if (!value) {
                 return {
                     success: false,
@@ -298,6 +306,7 @@ export const memoryTools = [
                     tags,
                     ttl,
                     upsert,
+                    provenanceType,
                 });
                 const duration = performance.now() - startTime;
                 return {
@@ -308,6 +317,7 @@ export const memoryTools = [
                     storedAt: new Date().toISOString(),
                     hasEmbedding: !!result.embedding,
                     embeddingDimensions: result.embedding?.dimensions || null,
+                    provenanceType: provenanceType || 'unknown',
                     backend: 'sql.js + HNSW',
                     storeTime: `${duration.toFixed(2)}ms`,
                     error: result.error,
@@ -394,6 +404,11 @@ export const memoryTools = [
                 limit: { type: 'number', description: 'Maximum results (default: 10)' },
                 threshold: { type: 'number', description: 'Minimum similarity threshold 0-1 (default: 0.3)' },
                 smart: { type: 'boolean', description: 'Enable SmartRetrieval pipeline — query expansion, RRF fusion, recency boost, MMR diversity (default: false)' },
+                provenance_filter: {
+                    type: 'array',
+                    items: { type: 'string', enum: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'] },
+                    description: 'ADR-323: restrict results to these provenance types (e.g. exclude user_claim when fact-checking). Omit for no filtering. Enforced for standard and SmartRetrieval searches.',
+                },
             },
             required: ['query'],
         },
@@ -401,6 +416,7 @@ export const memoryTools = [
             await ensureInitialized();
             const { searchEntries } = await getMemoryFunctions();
             const query = input.query;
+            const provenanceFilter = input.provenance_filter;
             // #2646 (3rd occurrence of #1123/#1131 shape): do NOT coerce an omitted
             // namespace to the literal string 'default' here. Both searchEntries()
             // and bridgeSearchEntries() already resolve an omitted/undefined
@@ -442,6 +458,7 @@ export const memoryTools = [
                                 namespace: req.namespace || namespace,
                                 limit: req.limit || limit * 3,
                                 threshold: req.threshold ?? threshold,
+                                provenanceFilter,
                             });
                             return {
                                 results: r.results.map(e => ({
@@ -450,6 +467,7 @@ export const memoryTools = [
                                     content: e.content,
                                     score: e.score,
                                     namespace: e.namespace,
+                                    provenanceType: e.provenanceType,
                                 })),
                             };
                         };
@@ -471,6 +489,7 @@ export const memoryTools = [
                                 namespace: r.namespace,
                                 value,
                                 similarity: r.score,
+                                provenanceType: r.provenanceType,
                             };
                         });
                         return {
@@ -490,12 +509,18 @@ export const memoryTools = [
                 // Original non-smart path (unchanged) — also reached when smart was
                 // requested but unavailable. We attach `smartFallback` to the
                 // response so callers can see the degradation explicitly.
+                // ADR-323: the same filter is also passed into every raw search used
+                // by SmartRetrieval above, so query expansion cannot widen trust scope.
                 const result = await searchEntries({
                     query,
                     namespace,
                     limit,
                     threshold,
+                    provenanceFilter,
                 });
+                if (!result.success) {
+                    return { query, results: [], total: 0, error: result.error };
+                }
                 const duration = performance.now() - startTime;
                 // Parse JSON values in results
                 const results = result.results.map(r => {
@@ -511,6 +536,7 @@ export const memoryTools = [
                         namespace: r.namespace,
                         value,
                         similarity: r.score,
+                        provenanceType: r.provenanceType,
                     };
                 });
                 return {

package/dist/src/mcp-tools/metaharness-tools.js

@@ -52,6 +52,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { runFlywheelWorker } from '../services/harness-flywheel-runtime.js';
+import { evaluatePolicyRequest } from '../services/policy-runtime.js';
 import { listFlywheelReceipts, promoteFlywheelCandidate, readFlywheelTransactionState, verifyFlywheelLedger, } from '../services/flywheel-transaction.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
@@ -684,7 +685,7 @@ export const metaharnessTools = [
     },
     {
         name: 'metaharness_flywheel',
-        description: 'ADR-322 — evaluate candidates into immutable receipts, inspect the append-only promotion ledger, and explicitly promote one signed receipt with atomic compare-and-swap semantics. Evaluation never mutates the active champion. Promotion requires confirm=true and a local approved Ed25519 public-key PEM path; explicit trust is mandatory.',
+        description: 'ADR-322 — evaluate candidates into immutable receipts, inspect the append-only promotion ledger, and explicitly promote one signed receipt with atomic compare-and-swap semantics. Use when running governed flywheel evaluation or promotion; evaluation never mutates the active champion, and promotion requires confirm=true plus a locally approved Ed25519 public-key PEM path.',
         category: 'metaharness',
         inputSchema: {
             type: 'object',
@@ -697,6 +698,9 @@ export const metaharnessTools = [
                 privateKeyPath: { type: 'string', description: 'Local Ed25519 private-key PEM path for signing run receipts; must be paired with publicKeyPath' },
                 publicKeyPath: { type: 'string', description: 'Local Ed25519 public-key PEM path used to sign a run or approve a promotion' },
                 confirm: { type: 'boolean', description: 'Required for promote; never inferred', default: false },
+                maxConcurrency: { type: 'number', description: 'ADR-324 hard local candidate-evaluation concurrency cap (1-8)', default: 2 },
+                timeoutMs: { type: 'number', description: 'Abort concurrent evaluation after this wall-clock limit', default: 120000 },
+                approvalIds: { type: 'array', items: { type: 'string' }, description: 'Scoped ADR-324 approval IDs for privileged promotion' },
             },
             required: ['operation'],
         },
@@ -742,6 +746,8 @@ export const metaharnessTools = [
                     proposer: String(input.proposer ?? 'auto'),
                     receiptPrivateKeyPem: privateKeyPath ? readFileSync(privateKeyPath, 'utf8') : undefined,
                     receiptPublicKeyPem: publicKeyPath ? readFileSync(publicKeyPath, 'utf8') : undefined,
+                    maxConcurrency: Number(input.maxConcurrency ?? 2),
+                    evaluationTimeoutMs: Number(input.timeoutMs ?? 120_000),
                 });
                 return { success: data.ran, data, degraded: false, exitCode: data.ran ? 0 : 1 };
             }
@@ -749,6 +755,26 @@ export const metaharnessTools = [
                 if (!input.receiptId || !input.publicKeyPath) {
                     return { success: false, data: { reason: 'receiptId and publicKeyPath are required' }, degraded: false, exitCode: 2 };
                 }
+                const policy = await evaluatePolicyRequest({
+                    identity: { id: 'metaharness-mcp', type: 'agent', roles: ['optimizer'] },
+                    action: {
+                        type: 'metaharness.candidate.promote',
+                        resource: String(input.receiptId),
+                        environment: 'production',
+                        destructive: true,
+                    },
+                    context: {
+                        approvalIds: Array.isArray(input.approvalIds) ? input.approvalIds.map(String) : undefined,
+                    },
+                }, projectRoot);
+                if (policy.enforcedOutcome !== 'allowed') {
+                    return {
+                        success: false,
+                        data: { reason: `policy-${policy.enforcedOutcome}:${policy.reason}`, policyReceiptId: policy.receiptId },
+                        degraded: false,
+                        exitCode: 1,
+                    };
+                }
                 const publicKey = readFileSync(resolve(String(input.publicKeyPath)), 'utf8');
                 const data = await promoteFlywheelCandidate(projectRoot, String(input.receiptId), {
                     confirm: input.confirm === true,

package/dist/src/mcp-tools/policy-tools.d.ts

@@ -0,0 +1,3 @@
+import type { MCPTool } from './types.js';
+export declare const policyTools: MCPTool[];
+//# sourceMappingURL=policy-tools.d.ts.map

package/dist/src/mcp-tools/policy-tools.js

@@ -0,0 +1,121 @@
+import { evaluatePolicyRequest, issuePolicyApproval, loadPolicyState, revokePolicyApproval, setPolicyBudget, setPolicyMode, upsertPolicyRule, verifyPolicyLedger, } from '../services/policy-runtime.js';
+function requireAuthenticatedAdministrator(context) {
+    if (context?.principalType !== 'user' || typeof context.principalId !== 'string') {
+        throw new Error('policy administration requires an authenticated user context');
+    }
+}
+export const policyTools = [
+    {
+        name: 'policy_evaluate',
+        description: 'Evaluate an agent action against ADR-324 policy and persist a tamper-evident decision receipt. Use when a consequential tool, deployment, network, spend, or promotion action needs authorization.',
+        category: 'security',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                request: { type: 'object', description: 'Policy request containing identity, action, and optional evidence/envelope context' },
+            },
+            required: ['request'],
+        },
+        handler: async (input, context) => evaluatePolicyRequest(input.request, typeof context?.projectRoot === 'string' ? context.projectRoot : process.cwd()),
+    },
+    {
+        name: 'policy_status',
+        description: 'Inspect policy mode, migration state, rules, budgets, approvals, and ledger integrity. Use when diagnosing whether an installation is in compatibility, observation, or enforcement mode.',
+        category: 'security',
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+        handler: async (_input, context) => {
+            const root = typeof context?.projectRoot === 'string' ? context.projectRoot : process.cwd();
+            const state = loadPolicyState(root);
+            return {
+                version: state.version,
+                mode: state.mode,
+                migratedFrom: state.migratedFrom,
+                counts: {
+                    rules: state.rules.length,
+                    budgets: state.budgets.length,
+                    approvals: state.approvals.length,
+                    receipts: state.receipts.length,
+                },
+                ledger: await verifyPolicyLedger(root),
+            };
+        },
+    },
+    {
+        name: 'policy_rule_upsert',
+        description: 'Create or update a versioned agentic policy rule. Use when defining explicit allow, deny, or human-approval requirements; existing installations remain unchanged until rules and enforcement mode are configured.',
+        category: 'security',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                rule: { type: 'object' },
+                mode: { type: 'string', enum: ['legacy', 'observe', 'enforce'] },
+            },
+            required: ['rule'],
+        },
+        handler: async (input, context) => {
+            requireAuthenticatedAdministrator(context);
+            const root = typeof context?.projectRoot === 'string' ? context.projectRoot : process.cwd();
+            await upsertPolicyRule(input.rule, root);
+            if (input.mode)
+                await setPolicyMode(input.mode, root);
+            return { success: true, ruleId: input.rule.id, mode: loadPolicyState(root).mode };
+        },
+    },
+    {
+        name: 'policy_budget_set',
+        description: 'Create or update an atomic USD/token ceiling for a principal, action, and resource window. Use when constraining agent spend; budget checks and decision receipts commit under the same policy-state lock.',
+        category: 'security',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                budget: { type: 'object' },
+            },
+            required: ['budget'],
+        },
+        handler: async (input, context) => {
+            requireAuthenticatedAdministrator(context);
+            const budget = input.budget;
+            await setPolicyBudget(budget, typeof context?.projectRoot === 'string' ? context.projectRoot : process.cwd());
+            return { success: true, budgetId: budget.id };
+        },
+    },
+    {
+        name: 'policy_approve',
+        description: 'Issue a scoped, expiring, limited-use human approval. Use when policy_evaluate returns approval_required; self-approval is rejected.',
+        category: 'security',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                approval: { type: 'object' },
+            },
+            required: ['approval'],
+        },
+        handler: async (input, context) => {
+            requireAuthenticatedAdministrator(context);
+            const requested = input.approval;
+            return issuePolicyApproval({ ...requested, issuedBy: context.principalId }, typeof context.projectRoot === 'string' ? context.projectRoot : process.cwd(), (issuer) => issuer === context.principalId);
+        },
+    },
+    {
+        name: 'policy_revoke',
+        description: 'Revoke an outstanding policy approval immediately. Use when responding to an incident or when a previously approved action is no longer authorized.',
+        category: 'security',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                approvalId: { type: 'string' },
+            },
+            required: ['approvalId'],
+        },
+        handler: async (input, context) => {
+            requireAuthenticatedAdministrator(context);
+            return {
+                success: await revokePolicyApproval(String(input.approvalId), typeof context.projectRoot === 'string' ? context.projectRoot : process.cwd()),
+            };
+        },
+    },
+];
+//# sourceMappingURL=policy-tools.js.map

package/dist/src/memory/memory-bridge.d.ts

@@ -30,6 +30,8 @@ export declare function bridgeStoreEntry(options: {
     ttl?: number;
     dbPath?: string;
     upsert?: boolean;
+    /** ADR-323: defaults to 'unknown' when omitted. */
+    provenanceType?: string;
 }): Promise<{
     success: boolean;
     id: string;
@@ -54,6 +56,8 @@ export declare function bridgeSearchEntries(options: {
     limit?: number;
     threshold?: number;
     dbPath?: string;
+    /** ADR-323: restrict results to these provenance types. */
+    provenanceFilter?: string[];
 }): Promise<{
     success: boolean;
     results: {
@@ -63,6 +67,10 @@ export declare function bridgeSearchEntries(options: {
         score: number;
         namespace: string;
         provenance?: string;
+        /** ADR-323 — NOT the same as `provenance` above (that's the
+         *  ExplainableRecall score breakdown). This is the entry's
+         *  user_claim/agent_output/... provenance type. */
+        provenanceType?: string;
     }[];
     searchTime: number;
     searchMethod?: string;
@@ -78,6 +86,8 @@ export declare function bridgeListEntries(options: {
     dbPath?: string;
     /** #2073: When true, include the entry's full `content` string in each result. */
     includeContent?: boolean;
+    /** ADR-323: restrict rows to these provenance types. */
+    provenanceFilter?: string[];
 }): Promise<{
     success: boolean;
     entries: {
@@ -91,6 +101,7 @@ export declare function bridgeListEntries(options: {
         hasEmbedding: boolean;
         /** #2073: Present when `includeContent: true` was requested. */
         content?: string;
+        provenanceType?: string;
     }[];
     total: number;
     error?: string;

package/dist/src/memory/memory-bridge.js

@@ -23,6 +23,23 @@ import { createRequire } from 'node:module';
 let registryPromise = null;
 let registryInstance = null;
 let bridgeAvailable = null;
+/**
+ * ADR-323: reuse memory-initializer's provenance-type allowlist rather than
+ * duplicating it (drift risk). Lazy CJS require for the same circular-ESM-
+ * dependency reason as getDbPath() below.
+ */
+function isValidProvenanceType(value) {
+    try {
+        const cjsRequire = createRequire(import.meta.url);
+        const mod = cjsRequire('./memory-initializer.js');
+        if (typeof mod.isValidProvenanceType === 'function') {
+            return mod.isValidProvenanceType(value);
+        }
+    }
+    catch { /* memory-initializer not resolvable in this build */ }
+    // Fallback allowlist — keep in sync with memory-initializer.ts's PROVENANCE_TYPES.
+    return typeof value === 'string' && ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'].includes(value);
+}
 /**
  * Resolve database path with path traversal protection.
  * Only allows paths within or below the project's working directory,
@@ -648,6 +665,16 @@ async function rescueAgentdbEmbedder(agentdb) {
  * Returns null to signal fallback to sql.js.
  */
 export async function bridgeStoreEntry(options) {
+    // ADR-323 — validated once in storeEntry() before this is reached on that
+    // path, but bridgeStoreEntry() also has direct internal callers, so check
+    // again here rather than trust every call site.
+    if (options.provenanceType !== undefined && !isValidProvenanceType(options.provenanceType)) {
+        return {
+            success: false,
+            id: '',
+            error: `Invalid provenance type "${options.provenanceType}"`,
+        };
+    }
     const registry = await getRegistry(options.dbPath);
     if (!registry)
         return null;
@@ -656,6 +683,17 @@ export async function bridgeStoreEntry(options) {
         return null;
     try {
         const { key, value, namespace = 'default', tags = [], ttl } = options;
+        let provenanceType = options.provenanceType ?? 'unknown';
+        // An omitted type on an upsert means "update the value", not "erase the
+        // existing trust label". New rows still receive the backward-compatible
+        // unknown default.
+        if (options.upsert && options.provenanceType === undefined) {
+            try {
+                const existing = ctx.db.prepare('SELECT provenance_type FROM memory_entries WHERE namespace = ? AND key = ? LIMIT 1').get(namespace, key);
+                provenanceType = existing?.provenance_type || 'unknown';
+            }
+            catch { /* legacy schema or new row — keep unknown */ }
+        }
         const id = generateId('entry');
         const now = Date.now();
         // #2245 — record the activity so signalsProcessed stops being a dead
@@ -713,13 +751,13 @@ export async function bridgeStoreEntry(options) {
             ? `INSERT OR REPLACE INTO memory_entries (
           id, key, namespace, content, type,
           embedding, embedding_dimensions, embedding_model,
-          tags, metadata, created_at, updated_at, expires_at, status
-        ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, 'active')`
+          tags, metadata, provenance_type, created_at, updated_at, expires_at, status
+        ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active')`
             : `INSERT INTO memory_entries (
           id, key, namespace, content, type,
           embedding, embedding_dimensions, embedding_model,
-          tags, metadata, created_at, updated_at, expires_at, status
-        ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, 'active')
+          tags, metadata, provenance_type, created_at, updated_at, expires_at, status
+        ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active')
         ON CONFLICT(namespace, key) DO UPDATE SET
           id                    = excluded.id,
           content               = excluded.content,
@@ -728,6 +766,7 @@ export async function bridgeStoreEntry(options) {
           embedding_model       = excluded.embedding_model,
           tags                  = excluded.tags,
           metadata              = excluded.metadata,
+          provenance_type       = excluded.provenance_type,
           created_at            = excluded.created_at,
           updated_at            = excluded.updated_at,
           expires_at            = excluded.expires_at,
@@ -745,7 +784,7 @@ export async function bridgeStoreEntry(options) {
         }
         catch { /* vector_indexes may not exist on legacy DBs — fall through */ }
         const stmt = ctx.db.prepare(insertSql);
-        const runResult = stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, '{}', now, now, ttl ? now + (ttl * 1000) : null);
+        const runResult = stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, '{}', provenanceType, now, now, ttl ? now + (ttl * 1000) : null);
         // #2775: strict insert against an ACTIVE existing row → changes === 0
         // (the ON CONFLICT WHERE clause above suppressed the update). Surface
         // this as a typed data-level error rather than a bridge failure —
@@ -828,6 +867,11 @@ export async function bridgeStoreEntry(options) {
  * Combines cosine similarity (semantic) with BM25 (lexical) via reciprocal rank fusion.
  */
 export async function bridgeSearchEntries(options) {
+    if (options.provenanceFilter?.length) {
+        const invalid = options.provenanceFilter.filter(p => !isValidProvenanceType(p));
+        if (invalid.length > 0)
+            return null; // caller (searchEntries) demotes to sql.js, which returns a typed error
+    }
     const registry = await getRegistry(options.dbPath);
     if (!registry)
         return null;
@@ -835,7 +879,7 @@ export async function bridgeSearchEntries(options) {
     if (!ctx)
         return null;
     try {
-        const { query: queryStr, namespace, limit = 10, threshold = 0.3 } = options;
+        const { query: queryStr, namespace, limit = 10, threshold = 0.3, provenanceFilter } = options;
         const effectiveNamespace = namespace || 'all';
         const startTime = Date.now();
         // Generate query embedding
@@ -851,18 +895,27 @@ export async function bridgeSearchEntries(options) {
             // Fall back to keyword search
         }
         // better-sqlite3: .prepare().all() returns array of objects
-        const nsFilter = effectiveNamespace !== 'all'
-            ? `AND namespace = ?`
-            : '';
+        // ADR-323: compose namespace + provenance filters into one WHERE clause.
+        const filters = [];
+        const filterParams = [];
+        if (effectiveNamespace !== 'all') {
+            filters.push('namespace = ?');
+            filterParams.push(effectiveNamespace);
+        }
+        if (provenanceFilter?.length) {
+            filters.push(`provenance_type IN (${provenanceFilter.map(() => '?').join(',')})`);
+            filterParams.push(...provenanceFilter);
+        }
+        const whereExtra = filters.length > 0 ? `AND ${filters.join(' AND ')}` : '';
         let rows;
         try {
             const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding
+        SELECT id, key, namespace, content, embedding, provenance_type
         FROM memory_entries
-        WHERE status = 'active' ${nsFilter}
+        WHERE status = 'active' ${whereExtra}
         LIMIT 1000
       `);
-            rows = effectiveNamespace !== 'all' ? stmt.all(effectiveNamespace) : stmt.all();
+            rows = filterParams.length > 0 ? stmt.all(...filterParams) : stmt.all();
         }
         catch {
             return null;
@@ -930,6 +983,7 @@ export async function bridgeSearchEntries(options) {
                     score,
                     namespace: row.namespace || 'default',
                     provenance,
+                    provenanceType: row.provenance_type || 'unknown',
                 });
             }
         }
@@ -956,9 +1010,20 @@ export async function bridgeListEntries(options) {
     if (!ctx)
         return null;
     try {
-        const { namespace, limit = 20, offset = 0 } = options;
-        const nsFilter = namespace ? `AND namespace = ?` : '';
-        const nsParams = namespace ? [namespace] : [];
+        const { namespace, limit = 20, offset = 0, provenanceFilter } = options;
+        if (provenanceFilter?.some(p => !isValidProvenanceType(p)))
+            return null;
+        const filters = [];
+        const filterParams = [];
+        if (namespace) {
+            filters.push('namespace = ?');
+            filterParams.push(namespace);
+        }
+        if (provenanceFilter?.length) {
+            filters.push(`provenance_type IN (${provenanceFilter.map(() => '?').join(',')})`);
+            filterParams.push(...provenanceFilter);
+        }
+        const extraFilter = filters.length > 0 ? `AND ${filters.join(' AND ')}` : '';
         // #2120 — `status IS NULL` accepted alongside `'active'`. Old
         // databases imported by the auto-memory bridge (before the status
         // column existed) end up with NULL status after schema migration if
@@ -971,8 +1036,8 @@ export async function bridgeListEntries(options) {
         // Count
         let total = 0;
         try {
-            const countStmt = ctx.db.prepare(`SELECT COUNT(*) as cnt FROM memory_entries WHERE ${statusFilter} ${nsFilter}`);
-            const countRow = countStmt.get(...nsParams);
+            const countStmt = ctx.db.prepare(`SELECT COUNT(*) as cnt FROM memory_entries WHERE ${statusFilter} ${extraFilter}`);
+            const countRow = countStmt.get(...filterParams);
             total = countRow?.cnt ?? 0;
         }
         catch {
@@ -982,13 +1047,13 @@ export async function bridgeListEntries(options) {
         const entries = [];
         try {
             const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at
+        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type
         FROM memory_entries
-        WHERE ${statusFilter} ${nsFilter}
+        WHERE ${statusFilter} ${extraFilter}
         ORDER BY updated_at DESC
         LIMIT ? OFFSET ?
       `);
-            const rows = stmt.all(...nsParams, limit, offset);
+            const rows = stmt.all(...filterParams, limit, offset);
             for (const row of rows) {
                 const entry = {
                     // #2073: don't truncate id when content is requested — callers
@@ -1001,6 +1066,7 @@ export async function bridgeListEntries(options) {
                     createdAt: row.created_at || new Date().toISOString(),
                     updatedAt: row.updated_at || new Date().toISOString(),
                     hasEmbedding: !!(row.embedding && String(row.embedding).length > 10),
+                    provenanceType: row.provenance_type || 'unknown',
                 };
                 if (options.includeContent) {
                     entry.content = row.content || '';
@@ -1410,12 +1476,25 @@ export async function bridgeAddToHNSW(id, embedding, entry, dbPath) {
     try {
         const now = Date.now();
         const embeddingJson = JSON.stringify(embedding);
+        // Do not use INSERT OR REPLACE here. storeEntry() has already written the
+        // authoritative row, including provenance/tags/metadata; REPLACE deleted
+        // that row and recreated it without provenance_type, silently resetting
+        // every typed CLI/MCP write to "unknown".
         ctx.db.prepare(`
-      INSERT OR REPLACE INTO memory_entries (
+      INSERT INTO memory_entries (
         id, key, namespace, content, type,
         embedding, embedding_dimensions, embedding_model,
         created_at, updated_at, status
       ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, 'Xenova/all-MiniLM-L6-v2', ?, ?, 'active')
+      ON CONFLICT(namespace, key) DO UPDATE SET
+        id                   = excluded.id,
+        content              = excluded.content,
+        type                 = excluded.type,
+        embedding            = excluded.embedding,
+        embedding_dimensions = excluded.embedding_dimensions,
+        embedding_model      = excluded.embedding_model,
+        updated_at           = excluded.updated_at,
+        status               = 'active'
     `).run(id, entry.key, entry.namespace, entry.content, embeddingJson, embedding.length, now, now);
         return true;
     }