@claude-flow/cli 3.56.9 → 3.57.0

package/dist/src/mcp-tools/agentdb-tools.js

@@ -80,6 +80,21 @@ async function bridgeUnavailableResult() {
         hint: 'Check Node version + try `ruflo memory init` to initialize manually.',
     };
 }
+// #4135 / #4161: graph reads (agentdb_graph-query, agentdb_graph-pathfinder) open the
+// graph_edges database; under encryption at rest that file is an RFE1 blob they cannot
+// open. A recorded edge is then unreadable even though the write reports success, so the
+// write says so instead of letting a caller assume it can read the edge back.
+async function unreadableEdgeWarning() {
+    try {
+        const { isBridgeDbEncryptedAtRest } = await getGraphEdgeWriter();
+        if (!isBridgeDbEncryptedAtRest())
+            return undefined;
+        return 'Edge recorded, but graph reads (agentdb_graph-query, agentdb_graph-pathfinder) cannot open the graph_edges database because it is encrypted at rest (RFE1), so this edge cannot be read back yet. Your data is intact (#2889, #4135).';
+    }
+    catch {
+        return undefined;
+    }
+}
 let memInitMod = null;
 async function getMemInit() {
     if (!memInitMod)
@@ -554,7 +569,9 @@ export const agentdbCausalEdge = {
                         // Also record in AgentDB bridge for compatibility
                         const bridge = await getBridge();
                         await bridge.bridgeRecordCausalEdge({ sourceId, targetId, relation, weight: typeof params.weight === 'number' ? validateScore(params.weight, 0.5) : undefined }).catch(() => { });
-                        return { ...graphResult, _graphNodeBackend: true, ...(legacyWarning && { warning: legacyWarning }) };
+                        const unreadable = await unreadableEdgeWarning();
+                        const warning = [legacyWarning, unreadable].filter(Boolean).join(' ');
+                        return { ...graphResult, _graphNodeBackend: true, ...(unreadable && { readable: false }), ...(warning && { warning }) };
                     }
                 }
             }
@@ -567,7 +584,9 @@ export const agentdbCausalEdge = {
                 weight: typeof params.weight === 'number' ? validateScore(params.weight, 0.5) : undefined,
             });
             const baseResult = result ?? { success: false, error: 'AgentDB bridge not available. Use memory_store/memory_search instead.' };
-            return legacyWarning ? { ...baseResult, warning: legacyWarning } : baseResult;
+            const unreadable = baseResult.success === false ? undefined : await unreadableEdgeWarning();
+            const warning = [legacyWarning, unreadable].filter(Boolean).join(' ');
+            return warning ? { ...baseResult, ...(unreadable && { readable: false }), warning } : baseResult;
         }
         catch (error) {
             return { success: false, error: sanitizeError(error) };
@@ -1157,6 +1176,10 @@ export const agentdbGraphQuery = {
                 catch (error) {
                     return { success: false, error: `Retained SQL graph query failed: ${sanitizeError(error)}`, mode, nodeId };
                 }
+                // #4135: name the real reason when the retained store is encrypted at rest.
+                const encryptedAtRest = await getGraphEdgeWriter().then((w) => w.isBridgeDbEncryptedAtRest()).catch(() => false);
+                if (encryptedAtRest)
+                    return { success: false, ...(await bridgeUnavailableResult()), mode, nodeId };
                 return { success: false, error: 'Retained SQL graph_edges backend is unavailable for k-hop query', mode, nodeId };
             }
             // ── semantic mode ────────────────────────────────────────────────────────

package/dist/src/mcp-tools/aidefence-known-misses.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Known-miss registry for aidefence_learn (#4147).
+ *
+ * The detector's learned patterns are written by `learnFromDetection`, but
+ * they are only created from threats the detector already found, and
+ * `detect()` never reads them back. A threat the detector MISSED (a false
+ * negative, the case feedback matters most for) therefore had nowhere to go.
+ *
+ * This registry stores a SHA-256 of the whitespace/case-normalised input so a
+ * reported miss is flagged next time the identical text is scanned. It is an
+ * exact-match list, not generalisation: the raw text is never stored.
+ */
+export interface KnownMiss {
+    hash: string;
+    threatType: string;
+    reportedAt: string;
+}
+export declare function hashInput(input: string): string;
+/** Returns true when the miss was newly recorded, false when it was already known. */
+export declare function recordKnownMiss(input: string, threatType: string, cwd?: string): boolean;
+export declare function findKnownMiss(input: string, cwd?: string): KnownMiss | undefined;
+//# sourceMappingURL=aidefence-known-misses.d.ts.map

package/dist/src/mcp-tools/aidefence-known-misses.js

@@ -0,0 +1,57 @@
+/**
+ * Known-miss registry for aidefence_learn (#4147).
+ *
+ * The detector's learned patterns are written by `learnFromDetection`, but
+ * they are only created from threats the detector already found, and
+ * `detect()` never reads them back. A threat the detector MISSED (a false
+ * negative, the case feedback matters most for) therefore had nowhere to go.
+ *
+ * This registry stores a SHA-256 of the whitespace/case-normalised input so a
+ * reported miss is flagged next time the identical text is scanned. It is an
+ * exact-match list, not generalisation: the raw text is never stored.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const MAX_ENTRIES = 500;
+function storePath(cwd) {
+    return join(cwd, '.claude-flow', 'aidefence-known-misses.json');
+}
+export function hashInput(input) {
+    const normalised = input.normalize('NFKC').toLowerCase().replace(/\s+/g, ' ').trim();
+    return createHash('sha256').update(normalised).digest('hex');
+}
+function load(cwd) {
+    try {
+        const p = storePath(cwd);
+        if (!existsSync(p))
+            return [];
+        const parsed = JSON.parse(readFileSync(p, 'utf8'));
+        return Array.isArray(parsed) ? parsed.filter((e) => e && typeof e.hash === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Returns true when the miss was newly recorded, false when it was already known. */
+export function recordKnownMiss(input, threatType, cwd = process.cwd()) {
+    const hash = hashInput(input);
+    const entries = load(cwd);
+    if (entries.some((e) => e.hash === hash))
+        return false;
+    entries.push({ hash, threatType, reportedAt: new Date().toISOString() });
+    const dir = join(cwd, '.claude-flow');
+    mkdirSync(dir, { recursive: true });
+    const tmp = `${storePath(cwd)}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(entries.slice(-MAX_ENTRIES), null, 2), { mode: 0o600 });
+    renameSync(tmp, storePath(cwd));
+    return true;
+}
+export function findKnownMiss(input, cwd = process.cwd()) {
+    const entries = load(cwd);
+    if (entries.length === 0)
+        return undefined;
+    const hash = hashInput(input);
+    return entries.find((e) => e.hash === hash);
+}
+//# sourceMappingURL=aidefence-known-misses.js.map

package/dist/src/mcp-tools/analyze-tools.js

@@ -3,14 +3,14 @@
  * Provides diff analysis and classification via MCP protocol
  */
 import { validateGitRef, validatePath } from './validate-input.js';
-import { analyzeDiff, assessFileRisk, assessOverallRisk, classifyDiff, suggestReviewers, getGitDiffNumstat, } from '../ruvector/diff-classifier.js';
+import { analyzeDiff, assessFileRisk, assessOverallRisk, suggestReviewers, getGitDiffNumstat, } from '../ruvector/diff-classifier.js';
 /**
  * Diff Analysis Tool
  * Analyzes git diffs for change risk assessment and classification
  */
 export const analyzeDiffTool = {
     name: 'analyze_diff',
-    description: 'Analyze git diff for change risk assessment and classification Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically analyze git diff paths, changed lines, and one-commit subjects for risk and classification. Use when preparing a review that needs a quick evidence-based summary; inspect the diff for final judgment.',
     category: 'analyze',
     tags: ['diff', 'risk', 'classification', 'git'],
     inputSchema: {
@@ -85,7 +85,7 @@ export const analyzeDiffTool = {
  */
 export const diffRiskTool = {
     name: 'analyze_diff-risk',
-    description: 'Quick risk assessment for git diff Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically assess git diff risk from changed file paths, sizes, and status. Use when triaging which files merit closer human review; this is not a security guarantee.',
     category: 'analyze',
     tags: ['diff', 'risk', 'git'],
     inputSchema: {
@@ -130,7 +130,7 @@ export const diffRiskTool = {
  */
 export const diffClassifyTool = {
     name: 'analyze_diff-classify',
-    description: 'Classify git diff change type Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically classify a git diff from changed lines, file paths, and a single-commit subject when available. Use when you need a coarse change category; inspect the diff to confirm.',
     category: 'analyze',
     tags: ['diff', 'classification', 'git'],
     inputSchema: {
@@ -151,12 +151,11 @@ export const diffClassifyTool = {
         }
         const ref = params.ref || 'HEAD';
         try {
-            const files = getGitDiffNumstat(ref);
-            const classification = classifyDiff(files);
+            const result = await analyzeDiff({ ref });
             return {
                 ref,
-                classification,
-                files: files.length,
+                classification: result.classification,
+                files: result.files.length,
             };
         }
         catch (error) {
@@ -174,7 +173,7 @@ export const diffClassifyTool = {
  */
 export const diffReviewersTool = {
     name: 'analyze_diff-reviewers',
-    description: 'Suggest reviewers for git diff changes Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Suggest reviewer roles from git diff paths and risk; does not identify people or read CODEOWNERS. Use when triaging expertise for a change, then consult CODEOWNERS to assign people.',
     category: 'analyze',
     tags: ['diff', 'reviewers', 'git'],
     inputSchema: {
@@ -225,7 +224,7 @@ export const diffReviewersTool = {
  */
 export const fileRiskTool = {
     name: 'analyze_file-risk',
-    description: 'Assess risk for a specific file change Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically assess risk for a file path and optional change metadata. Use when triaging a changed file for focused review; inspect the source for final judgment.',
     category: 'analyze',
     tags: ['file', 'risk'],
     inputSchema: {
@@ -280,7 +279,7 @@ export const fileRiskTool = {
  */
 export const diffStatsTool = {
     name: 'analyze_diff-stats',
-    description: 'Get quick statistics for git diff Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Count changed files, additions, and deletions in a git diff. Use when you need a quick size summary before inspecting the full patch.',
     category: 'analyze',
     tags: ['diff', 'stats', 'git'],
     inputSchema: {

package/dist/src/mcp-tools/autopilot-tools.js

@@ -8,7 +8,7 @@
  * @module @claude-flow/cli/mcp-tools/autopilot
  */
 import { validateText } from './validate-input.js';
-import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, validateNumber, validateConfiguredTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
+import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, getLearningLoadError, validateNumber, validateConfiguredTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
 function ok(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
 }
@@ -175,7 +175,7 @@ const autopilotLearn = {
             ]);
             return ok({ metrics, patterns });
         }
-        return ok({ available: false, reason: 'AgentDB/AutopilotLearning not initialized', patterns: [] });
+        return ok({ available: false, reason: getLearningLoadError() ?? 'AgentDB/AutopilotLearning not initialized', patterns: [] });
     },
 };
 const autopilotHistory = {

package/dist/src/mcp-tools/browser-intent-tools.js

@@ -85,9 +85,13 @@
  * @module @claude-flow/cli/mcp-tools/browser-intent
  */
 import { createRequire } from 'node:module';
-import { createServer } from 'node:http';
 import { readFileSync, existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+// Lazy, CommonJS-style load of node:http: an ESM `import … from 'node:http'`
+// materialises every export of the builtin, which trips http's lazy undici
+// getters (~2.5 MB heap / ~6 MB RSS) at MCP startup even when no server is
+// ever started. require() of the builtin does not touch those getters.
+const loadHttp = () => createRequire(import.meta.url)('node:http');
 import { validateText, validateIdentifier } from './validate-input.js';
 import { execBrowserCommand } from './browser-tools.js';
 import { storeEntry } from '../memory/memory-initializer.js';
@@ -175,7 +179,7 @@ export function resolvePageAgentLLMConfig(env = process.env) {
 export const PLACEHOLDER_API_KEY = 'ruflo-proxied-key';
 export function startLocalLLMProxy(real) {
     return new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
+        const server = loadHttp().createServer((req, res) => {
             const target = `${real.baseURL.replace(/\/+$/, '')}${req.url ?? ''}`;
             const chunks = [];
             req.on('data', (c) => chunks.push(c));

package/dist/src/mcp-tools/embeddings-tools.js

@@ -93,16 +93,28 @@ function toPoincare(euclidean, curvature) {
     const factor = Math.tanh(sqrtC * norm / 2) / (sqrtC * norm + 1e-15);
     return euclidean.map(x => x * factor);
 }
-// Poincaré distance
+// #4159: a point is usable only strictly inside the ball of radius 1/sqrt(c).
+function insidePoincareBall(p, curvature) {
+    const c = Math.abs(curvature);
+    return c * p.reduce((sum, x) => sum + x * x, 0) < 1;
+}
+// Poincaré distance, d_c(a,b) = acosh(1 + 2c|a-b|^2 / ((1-c|a|^2)(1-c|b|^2))) / sqrt(c).
+// Returns NaN for a point on or outside the ball (the formula is undefined there);
+// callers must check Number.isFinite before reporting it.
 function poincareDistance(a, b, curvature) {
     const c = Math.abs(curvature);
+    if (a.length !== b.length || !insidePoincareBall(a, curvature) || !insidePoincareBall(b, curvature)) {
+        return NaN;
+    }
     const diffSq = a.reduce((sum, _, i) => sum + (a[i] - b[i]) ** 2, 0);
     const normASq = a.reduce((sum, x) => sum + x * x, 0);
     const normBSq = b.reduce((sum, x) => sum + x * x, 0);
-    const denom = (1 - normASq) * (1 - normBSq);
-    const delta = 2 * diffSq / (denom + 1e-15);
+    const denom = (1 - c * normASq) * (1 - c * normBSq);
+    const delta = (2 * c * diffSq) / denom;
     return (1 / Math.sqrt(c)) * Math.acosh(1 + delta);
 }
+const HYPERBOLIC_RADIUS_NOTE = 'convert is an exponential map at the origin: it preserves the input norm ordering, so unit-norm text embeddings all land at the same radius. ' +
+    'It does not encode hierarchy; depth/tree structure has to come from the hierarchy itself (for example depth chosen as the radius, or embeddings trained on the tree edges).';
 // Cosine similarity
 function cosineSimilarity(a, b) {
     const dot = a.reduce((sum, _, i) => sum + a[i] * b[i], 0);
@@ -339,6 +351,9 @@ export const embeddingsTools = [
                     const poinc1 = toPoincare(emb1, config.hyperbolic.curvature);
                     const poinc2 = toPoincare(emb2, config.hyperbolic.curvature);
                     distance = poincareDistance(poinc1, poinc2, config.hyperbolic.curvature);
+                    if (!Number.isFinite(distance)) {
+                        return { success: false, error: 'Hyperbolic distance is undefined for these inputs (a converted point reached the ball boundary).' };
+                    }
                     similarity = 1 / (1 + distance);
                     break;
                 case 'euclidean':
@@ -739,6 +754,7 @@ export const embeddingsTools = [
                         poincare,
                         curvature,
                         poincareNorm: Math.sqrt(poincare.reduce((sum, x) => sum + x * x, 0)),
+                        note: HYPERBOLIC_RADIUS_NOTE,
                     };
                 case 'distance':
                     const emb1 = input.embedding1;
@@ -747,6 +763,13 @@ export const embeddingsTools = [
                         return { success: false, error: 'embedding1 and embedding2 required for distance action' };
                     }
                     const dist = poincareDistance(emb1, emb2, curvature);
+                    if (!Number.isFinite(dist)) {
+                        return {
+                            success: false,
+                            error: 'Poincaré distance needs two points of equal length strictly inside the ball (|x| < 1/sqrt(c)); got a point on or outside it, or mismatched lengths. Run convert on Euclidean vectors first.',
+                            curvature,
+                        };
+                    }
                     return {
                         success: true,
                         action: 'distance',
@@ -780,11 +803,10 @@ export const embeddingsTools = [
                             epsilon: config.hyperbolic.epsilon,
                             maxNorm: config.hyperbolic.maxNorm,
                         },
+                        note: HYPERBOLIC_RADIUS_NOTE,
                         benefits: [
-                            'Better hierarchical data representation',
-                            'Exponential capacity in low dimensions',
-                            'Preserves tree-like structures',
-                            'Natural for taxonomy embeddings',
+                            'Exponential capacity in low dimensions when the points are placed by hierarchy (for example by depth)',
+                            'Natural geometry for taxonomy embeddings that are trained or constructed for it',
                         ],
                     };
             }

package/dist/src/mcp-tools/hooks-tools.js

@@ -3253,6 +3253,8 @@ export const hooksTrajectoryEnd = {
                         learned: result.learned,
                         patternKey: result.patternKey,
                         confidence: result.confidence,
+                        reinforcedNeighbour: result.reinforcedNeighbour,
+                        routingGate: result.routingGate,
                     };
                 }
                 catch {
@@ -3416,6 +3418,8 @@ export const hooksTrajectoryEnd = {
                 sonaUpdate: sonaResult.learned,
                 sonaPatternKey: sonaResult.patternKey || undefined,
                 sonaConfidence: sonaResult.confidence || undefined,
+                sonaReinforcedNeighbour: sonaResult.reinforcedNeighbour || undefined,
+                sonaRoutingGate: sonaResult.routingGate,
                 ewcConsolidation: ewcResult.consolidated,
                 ewcPenalty: ewcResult.penalty || undefined,
                 patternsExtracted,

package/dist/src/mcp-tools/memory-tools.d.ts

@@ -9,7 +9,7 @@
  *
  * @module v3/cli/mcp-tools/memory-tools
  */
-import type { MCPTool } from './types.js';
+import { type MCPTool } from './types.js';
 export declare const DANGEROUS_KEY_PATTERN: RegExp;
 /**
  * #3570: the one key rule for every memory write path (MCP store, CLI store,

package/dist/src/mcp-tools/memory-tools.js

@@ -11,9 +11,12 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
-import { join, resolve } from 'path';
+import { basename, dirname, join, resolve } from 'path';
+import { execFileSync } from 'node:child_process';
 import { createHash } from 'crypto';
+import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
+import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
 // #1604: Align with memory-initializer.ts — single source of truth is .swarm/memory.db
 const MEMORY_DIR = '.swarm';
 const LEGACY_MEMORY_FILE = 'store.json';
@@ -145,7 +148,24 @@ function resolveProjectMemoryDir(claudeProjectsDir, projectPathOverride) {
         sources.push(projectPathOverride);
     }
     else {
-        sources.push(process.cwd());
+        const project = getProjectCwd();
+        sources.push(project);
+        // Claude Code shares auto-memory across linked Git worktrees under the
+        // main checkout's project slug. Preserve the direct-path match first,
+        // then try the common Git directory's parent. Explicit overrides above
+        // remain authoritative, and non-Git projects need no Git dependency.
+        try {
+            const commonDir = execFileSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
+                cwd: project,
+                encoding: 'utf-8',
+                timeout: 1000,
+                windowsHide: true,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+            if (basename(commonDir) === '.git')
+                sources.push(dirname(resolve(project, commonDir)));
+        }
+        catch { /* Git unavailable or not a repository: use the project path */ }
     }
     for (const source of sources) {
         // Candidate 1: legacy POSIX hash — what shipped before #1883
@@ -231,6 +251,19 @@ async function getMemoryFunctions() {
         checkMemoryInitialization,
     };
 }
+/**
+ * Path of the CLI's own store (.swarm/memory.db or CLAUDE_FLOW_DB_PATH), or
+ * undefined when the memory module cannot say (#4148). Never throws.
+ */
+async function resolveCliStorePath() {
+    try {
+        const mod = await import('../memory/memory-initializer.js');
+        return typeof mod.resolveDbPath === 'function' ? mod.resolveDbPath() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * #2922: every `backend:` field in this file's tool responses used to be the
  * hardcoded literal `'sql.js + HNSW'` regardless of which search path was
@@ -538,7 +571,7 @@ export const memoryTools = [
                 query: { type: 'string', description: 'Search query (semantic similarity)' },
                 namespace: { type: 'string', description: 'Namespace to search (default: all namespaces — omit to search across every namespace)' },
                 limit: { type: 'number', description: 'Maximum results (default: 10)' },
-                threshold: { type: 'number', description: 'Minimum raw retrieval relevance 0-1 for candidate admission, applied per query before SmartRetrieval ranking; not a floor on rankingScore (default: 0.3)' },
+                threshold: { type: 'number', description: 'Minimum raw retrieval relevance 0-1 for candidate admission, applied per query before SmartRetrieval ranking; not a floor on rankingScore (default: 0.2; calibrated for the bundled embedding model, pass 0 to see every match)' },
                 smart: { type: 'boolean', description: 'Enable SmartRetrieval — query expansion, RRF fusion, recency boost, MMR diversity; preserves raw similarity and adds rankingScore (default: false)' },
                 provenance_filter: {
                     type: 'array',
@@ -567,7 +600,8 @@ export const memoryTools = [
             // in the search layer actually fires.
             const namespace = input.namespace;
             const limit = input.limit ?? 10;
-            const threshold = input.threshold ?? 0.3;
+            const threshold = input.threshold ?? DEFAULT_SEARCH_THRESHOLD;
+            const thresholdWasDefault = input.threshold === undefined || input.threshold === null;
             validateMemoryInput(undefined, undefined, query, namespace);
             const startTime = performance.now();
             try {
@@ -638,10 +672,14 @@ export const memoryTools = [
                                 provenanceType: r.provenanceType,
                             };
                         });
+                        const smartNearMisses = results.length === 0 && thresholdWasDefault
+                            ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                            : undefined;
                         return {
                             query,
                             results,
                             total: results.length,
+                            ...(smartNearMisses ?? {}),
                             searchTime: `${duration.toFixed(2)}ms`,
                             backend: 'SmartRetrieval (RRF + MMR + Recency)',
                             stats: smartResult.stats,
@@ -685,10 +723,14 @@ export const memoryTools = [
                         provenanceType: r.provenanceType,
                     };
                 });
+                const nearMissInfo = results.length === 0 && thresholdWasDefault
+                    ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                    : undefined;
                 return {
                     query,
                     results,
                     total: results.length,
+                    ...(nearMissInfo ?? {}),
                     searchTime: `${duration.toFixed(2)}ms`,
                     backend: 'HNSW + sql.js',
                     ...(smartFallbackReason ? { smartFallback: smartFallbackReason } : {}),
@@ -1043,6 +1085,7 @@ export const memoryTools = [
             }
             let imported = 0;
             let skipped = 0;
+            const importErrors = [];
             // #1791.8 — Claude Code's `~/.claude/projects/` accumulates historical
             // project_id directories (truncated forms, sandbox cwds, renamed
             // workspaces) that all contain copies of the same memory files. The
@@ -1082,7 +1125,7 @@ export const memoryTools = [
                         // #1884 — sanitize key so memory_delete can later remove it. Without
                         // this, dangerous chars from frontmatter `name` strand the key.
                         const key = sanitizeMemoryKey(`claude:${memFile.project}:${name}`);
-                        const stored = await storeEntry({ key, value: body, namespace: ns, generateEmbeddingFlag: true });
+                        const stored = await storeEntry({ key, value: body, namespace: ns, generateEmbeddingFlag: true, upsert: true });
                         if (!stored.success)
                             throw new Error(stored.error || `Failed to store ${key}`);
                         imported++;
@@ -1097,15 +1140,19 @@ export const memoryTools = [
                             // #1884 — sanitize so any dangerous chars in the heading don't
                             // produce keys memory_delete will reject.
                             const key = sanitizeMemoryKey(`claude:${memFile.project}:${name}:${sectionTitle.slice(0, 50)}`);
-                            const stored = await storeEntry({ key, value: sectionBody, namespace: ns, generateEmbeddingFlag: true });
+                            const stored = await storeEntry({ key, value: sectionBody, namespace: ns, generateEmbeddingFlag: true, upsert: true });
                             if (!stored.success)
                                 throw new Error(stored.error || `Failed to store ${key}`);
                             imported++;
                         }
                     }
                 }
-                catch {
+                catch (err) {
                     skipped++;
+                    // Say why a file was skipped instead of returning a bare failure (#4197).
+                    if (importErrors.length < 5) {
+                        importErrors.push(`${memFile.path}: ${err instanceof Error ? err.message : String(err)}`);
+                    }
                 }
             }
             // AUDIT #3: report the embedding backend truthfully — a hash-fallback
@@ -1124,6 +1171,7 @@ export const memoryTools = [
                 skipped,
                 duplicatesSkipped,
                 excludedByPattern,
+                ...(importErrors.length > 0 ? { errors: importErrors } : {}),
                 files: memoryFiles.length,
                 projects: projects.size,
                 namespace: ns,
@@ -1497,25 +1545,50 @@ export const memoryTools = [
                 if (!v.valid)
                     throw new Error(v.error);
             }
-            // #2073: pass includeContent so the value field carries the actual
-            // entry body. Without this, `value` is always null because listEntries
-            // strips content by default (callers pay for the JSON parse only when
-            // they need it).
-            // A successful export must cover the whole reported store. Read all
-            // pages before touching an existing snapshot, including on read failure.
-            const entries = [];
-            let total;
-            do {
-                const page = await listEntries({ limit: 10000, offset: entries.length, namespace, includeContent: true });
-                if (!page.success)
-                    return { error: page.error || 'Could not read memory for export' };
-                total ??= page.total;
-                if (page.entries.length === 0 && entries.length < total) {
-                    return { error: `Incomplete memory export: read ${entries.length} of ${total} entries` };
+            const readStore = async (dbPath) => {
+                const out = [];
+                let total;
+                do {
+                    const page = await listEntries({ limit: 10000, offset: out.length, namespace, includeContent: true, ...(dbPath ? { dbPath } : {}) });
+                    if (!page.success)
+                        return { error: page.error || 'Could not read memory for export' };
+                    total ??= page.total;
+                    if (page.entries.length === 0 && out.length < total) {
+                        return { error: `Incomplete memory export: read ${out.length} of ${total} entries` };
+                    }
+                    out.push(...page.entries);
+                } while (out.length < total);
+                return { entries: out };
+            };
+            const primary = await readStore();
+            if ('error' in primary)
+                return { error: primary.error };
+            // #4148: the default reader is the AgentDB bridge, but the CLI's own store
+            // (.swarm/memory.db, possibly encrypted) can hold rows the bridge never
+            // sees, so an export silently covered one store and reported success. Read
+            // the CLI store too and merge, newest copy of a (namespace, key) winning.
+            const warnings = [];
+            const stores = [{ store: 'default', entries: primary.entries.length }];
+            const merged = new Map();
+            const keep = (e) => {
+                const id = `${e.namespace}\u0000${e.key}`;
+                const have = merged.get(id);
+                if (!have || String(e.updatedAt) > String(have.updatedAt))
+                    merged.set(id, e);
+            };
+            primary.entries.forEach(keep);
+            const cliStore = await resolveCliStorePath();
+            if (cliStore && existsSync(cliStore)) {
+                const secondary = await readStore(cliStore);
+                if ('error' in secondary) {
+                    warnings.push(`Could not read the CLI store ${cliStore} (${secondary.error}); the export covers the AgentDB store only.`);
                 }
-                entries.push(...page.entries);
-            } while (entries.length < total);
-            const all = { entries };
+                else {
+                    stores.push({ store: cliStore, entries: secondary.entries.length });
+                    secondary.entries.forEach(keep);
+                }
+            }
+            const all = { entries: [...merged.values()] };
             const payload = {
                 schema: 'ruflo-memory-export/v1',
                 exportedAt: new Date().toISOString(),
@@ -1542,6 +1615,8 @@ export const memoryTools = [
                 outputPath,
                 format: input.format || 'json',
                 exported: { entries: all.entries.length, vectors: vectorsWithEmb, patterns: 0 },
+                stores,
+                ...(warnings.length ? { warnings } : {}),
                 fileSize: `${Buffer.byteLength(JSON.stringify(payload))}B`,
                 note: input.format === 'csv' ? 'CSV not implemented yet — wrote JSON' : undefined,
             };

package/dist/src/mcp-tools/metaharness-tools.js

@@ -399,7 +399,7 @@ export const metaharnessTools = [
     },
     // ───────────────────────────────────────────────────────────────────────
     // ADR-153 — @metaharness/darwin integration (3 tools).
-    // Backed by the separate `@metaharness/darwin@~0.10.2` npm package, NOT
+    // Backed by the separate `@metaharness/darwin@~0.12.0` npm package, NOT
     // the umbrella `metaharness`. Plugin scripts shell out via _darwin.mjs.
     // Same {success, data, degraded, exitCode} contract.
     // ───────────────────────────────────────────────────────────────────────