@claude-flow/cli 3.7.0-alpha.11 → 3.7.0-alpha.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.7.0-alpha.11",
+  "version": "3.7.0-alpha.12",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -101,7 +101,8 @@
     "@claude-flow/shared": "^3.0.0-alpha.7",
     "@noble/ed25519": "^2.1.0",
     "@ruvector/rabitq-wasm": "^0.1.0",
-    "semver": "^7.6.0"
+    "semver": "^7.6.0",
+    "yaml": "^2.8.0"
   },
   "optionalDependencies": {
     "@claude-flow/aidefence": "^3.0.2",

package/scripts/deploy-ipfs-node.sh

@@ -1,153 +1,153 @@
-#!/bin/bash
-#
-# Deploy IPFS Node to Google Cloud
-# Provides free IPFS pinning for your users
-#
-# Usage:
-#   ./deploy-ipfs-node.sh [PROJECT_ID] [ZONE]
-#
-# Example:
-#   ./deploy-ipfs-node.sh my-project us-central1-a
-#
-
-set -e
-
-PROJECT_ID="${1:-$(gcloud config get-value project)}"
-ZONE="${2:-us-central1-a}"
-INSTANCE_NAME="ipfs-node"
-MACHINE_TYPE="e2-medium"  # $25/month, use e2-small for $8/month
-DISK_SIZE="100GB"
-
-echo "╔══════════════════════════════════════════════════════════════╗"
-echo "║  IPFS Node Deployment for Claude Flow                        ║"
-echo "╚══════════════════════════════════════════════════════════════╝"
-echo ""
-echo "Project: $PROJECT_ID"
-echo "Zone: $ZONE"
-echo "Machine: $MACHINE_TYPE"
-echo "Disk: $DISK_SIZE"
-echo ""
-
-# Create firewall rules
-echo "▶ Creating firewall rules..."
-gcloud compute firewall-rules create ipfs-swarm \
-  --project="$PROJECT_ID" \
-  --allow=tcp:4001,udp:4001 \
-  --target-tags=ipfs-node \
-  --description="IPFS swarm connections" \
-  2>/dev/null || echo "  (firewall rule already exists)"
-
-gcloud compute firewall-rules create ipfs-api \
-  --project="$PROJECT_ID" \
-  --allow=tcp:5001 \
-  --target-tags=ipfs-node \
-  --source-ranges="0.0.0.0/0" \
-  --description="IPFS API (consider restricting)" \
-  2>/dev/null || echo "  (firewall rule already exists)"
-
-gcloud compute firewall-rules create ipfs-gateway \
-  --project="$PROJECT_ID" \
-  --allow=tcp:8080 \
-  --target-tags=ipfs-node \
-  --description="IPFS Gateway" \
-  2>/dev/null || echo "  (firewall rule already exists)"
-
-# Create startup script
-STARTUP_SCRIPT='#!/bin/bash
-set -e
-
-# Install IPFS
-echo "Installing IPFS..."
-wget -q https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_linux-amd64.tar.gz
-tar xzf kubo_v0.24.0_linux-amd64.tar.gz
-cd kubo && sudo bash install.sh
-cd .. && rm -rf kubo kubo_v0.24.0_linux-amd64.tar.gz
-
-# Create ipfs user
-sudo useradd -m -s /bin/bash ipfs || true
-
-# Initialize IPFS
-sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs init --profile=server
-
-# Configure IPFS for server use
-sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config Addresses.API /ip4/0.0.0.0/tcp/5001
-sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config Addresses.Gateway /ip4/0.0.0.0/tcp/8080
-sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin "[\"*\"]"
-sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods "[\"PUT\", \"POST\", \"GET\"]"
-
-# Set storage limits (adjust as needed)
-sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config Datastore.StorageMax 80GB
-
-# Create systemd service
-cat > /etc/systemd/system/ipfs.service << EOF
-[Unit]
-Description=IPFS Daemon
-After=network.target
-
-[Service]
-Type=simple
-User=ipfs
-Environment=IPFS_PATH=/home/ipfs/.ipfs
-ExecStart=/usr/local/bin/ipfs daemon --migrate=true
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-# Start IPFS
-systemctl daemon-reload
-systemctl enable ipfs
-systemctl start ipfs
-
-echo "IPFS node started successfully!"
-'
-
-# Create instance
-echo "▶ Creating VM instance..."
-gcloud compute instances create "$INSTANCE_NAME" \
-  --project="$PROJECT_ID" \
-  --zone="$ZONE" \
-  --machine-type="$MACHINE_TYPE" \
-  --image-family=ubuntu-2204-lts \
-  --image-project=ubuntu-os-cloud \
-  --boot-disk-size="$DISK_SIZE" \
-  --boot-disk-type=pd-ssd \
-  --tags=ipfs-node \
-  --metadata=startup-script="$STARTUP_SCRIPT"
-
-# Get external IP
-echo ""
-echo "▶ Waiting for instance to start..."
-sleep 30
-
-EXTERNAL_IP=$(gcloud compute instances describe "$INSTANCE_NAME" \
-  --project="$PROJECT_ID" \
-  --zone="$ZONE" \
-  --format='get(networkInterfaces[0].accessConfigs[0].natIP)')
-
-echo ""
-echo "═══════════════════════════════════════════════════════════════"
-echo "                    DEPLOYMENT COMPLETE"
-echo "═══════════════════════════════════════════════════════════════"
-echo ""
-echo "  IPFS Node IP: $EXTERNAL_IP"
-echo ""
-echo "  Endpoints:"
-echo "    API:     http://$EXTERNAL_IP:5001"
-echo "    Gateway: http://$EXTERNAL_IP:8080"
-echo "    Swarm:   /ip4/$EXTERNAL_IP/tcp/4001"
-echo ""
-echo "  Test commands:"
-echo "    curl http://$EXTERNAL_IP:5001/api/v0/id"
-echo "    curl http://$EXTERNAL_IP:8080/ipfs/QmYwAPJzv5CZsnA625s3Xf2nemtYgPpHdWEz79ojWnPbdG/readme"
-echo ""
-echo "  Configure Claude Flow CLI:"
-echo "    export IPFS_API_URL=http://$EXTERNAL_IP:5001"
-echo ""
-echo "  SSH into node:"
-echo "    gcloud compute ssh $INSTANCE_NAME --zone=$ZONE"
-echo ""
-echo "  Monthly cost estimate: ~\$25-54 depending on usage"
-echo ""
+#!/bin/bash
+#
+# Deploy IPFS Node to Google Cloud
+# Provides free IPFS pinning for your users
+#
+# Usage:
+#   ./deploy-ipfs-node.sh [PROJECT_ID] [ZONE]
+#
+# Example:
+#   ./deploy-ipfs-node.sh my-project us-central1-a
+#
+
+set -e
+
+PROJECT_ID="${1:-$(gcloud config get-value project)}"
+ZONE="${2:-us-central1-a}"
+INSTANCE_NAME="ipfs-node"
+MACHINE_TYPE="e2-medium"  # $25/month, use e2-small for $8/month
+DISK_SIZE="100GB"
+
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║  IPFS Node Deployment for Claude Flow                        ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+echo "Project: $PROJECT_ID"
+echo "Zone: $ZONE"
+echo "Machine: $MACHINE_TYPE"
+echo "Disk: $DISK_SIZE"
+echo ""
+
+# Create firewall rules
+echo "▶ Creating firewall rules..."
+gcloud compute firewall-rules create ipfs-swarm \
+  --project="$PROJECT_ID" \
+  --allow=tcp:4001,udp:4001 \
+  --target-tags=ipfs-node \
+  --description="IPFS swarm connections" \
+  2>/dev/null || echo "  (firewall rule already exists)"
+
+gcloud compute firewall-rules create ipfs-api \
+  --project="$PROJECT_ID" \
+  --allow=tcp:5001 \
+  --target-tags=ipfs-node \
+  --source-ranges="0.0.0.0/0" \
+  --description="IPFS API (consider restricting)" \
+  2>/dev/null || echo "  (firewall rule already exists)"
+
+gcloud compute firewall-rules create ipfs-gateway \
+  --project="$PROJECT_ID" \
+  --allow=tcp:8080 \
+  --target-tags=ipfs-node \
+  --description="IPFS Gateway" \
+  2>/dev/null || echo "  (firewall rule already exists)"
+
+# Create startup script
+STARTUP_SCRIPT='#!/bin/bash
+set -e
+
+# Install IPFS
+echo "Installing IPFS..."
+wget -q https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_linux-amd64.tar.gz
+tar xzf kubo_v0.24.0_linux-amd64.tar.gz
+cd kubo && sudo bash install.sh
+cd .. && rm -rf kubo kubo_v0.24.0_linux-amd64.tar.gz
+
+# Create ipfs user
+sudo useradd -m -s /bin/bash ipfs || true
+
+# Initialize IPFS
+sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs init --profile=server
+
+# Configure IPFS for server use
+sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config Addresses.API /ip4/0.0.0.0/tcp/5001
+sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config Addresses.Gateway /ip4/0.0.0.0/tcp/8080
+sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin "[\"*\"]"
+sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods "[\"PUT\", \"POST\", \"GET\"]"
+
+# Set storage limits (adjust as needed)
+sudo -u ipfs IPFS_PATH=/home/ipfs/.ipfs ipfs config Datastore.StorageMax 80GB
+
+# Create systemd service
+cat > /etc/systemd/system/ipfs.service << EOF
+[Unit]
+Description=IPFS Daemon
+After=network.target
+
+[Service]
+Type=simple
+User=ipfs
+Environment=IPFS_PATH=/home/ipfs/.ipfs
+ExecStart=/usr/local/bin/ipfs daemon --migrate=true
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Start IPFS
+systemctl daemon-reload
+systemctl enable ipfs
+systemctl start ipfs
+
+echo "IPFS node started successfully!"
+'
+
+# Create instance
+echo "▶ Creating VM instance..."
+gcloud compute instances create "$INSTANCE_NAME" \
+  --project="$PROJECT_ID" \
+  --zone="$ZONE" \
+  --machine-type="$MACHINE_TYPE" \
+  --image-family=ubuntu-2204-lts \
+  --image-project=ubuntu-os-cloud \
+  --boot-disk-size="$DISK_SIZE" \
+  --boot-disk-type=pd-ssd \
+  --tags=ipfs-node \
+  --metadata=startup-script="$STARTUP_SCRIPT"
+
+# Get external IP
+echo ""
+echo "▶ Waiting for instance to start..."
+sleep 30
+
+EXTERNAL_IP=$(gcloud compute instances describe "$INSTANCE_NAME" \
+  --project="$PROJECT_ID" \
+  --zone="$ZONE" \
+  --format='get(networkInterfaces[0].accessConfigs[0].natIP)')
+
+echo ""
+echo "═══════════════════════════════════════════════════════════════"
+echo "                    DEPLOYMENT COMPLETE"
+echo "═══════════════════════════════════════════════════════════════"
+echo ""
+echo "  IPFS Node IP: $EXTERNAL_IP"
+echo ""
+echo "  Endpoints:"
+echo "    API:     http://$EXTERNAL_IP:5001"
+echo "    Gateway: http://$EXTERNAL_IP:8080"
+echo "    Swarm:   /ip4/$EXTERNAL_IP/tcp/4001"
+echo ""
+echo "  Test commands:"
+echo "    curl http://$EXTERNAL_IP:5001/api/v0/id"
+echo "    curl http://$EXTERNAL_IP:8080/ipfs/QmYwAPJzv5CZsnA625s3Xf2nemtYgPpHdWEz79ojWnPbdG/readme"
+echo ""
+echo "  Configure Claude Flow CLI:"
+echo "    export IPFS_API_URL=http://$EXTERNAL_IP:5001"
+echo ""
+echo "  SSH into node:"
+echo "    gcloud compute ssh $INSTANCE_NAME --zone=$ZONE"
+echo ""
+echo "  Monthly cost estimate: ~\$25-54 depending on usage"
+echo ""

package/scripts/postinstall.cjs

@@ -1,153 +1,153 @@
-#!/usr/bin/env node
-/**
- * @claude-flow/cli postinstall — agentdb compatibility patches.
- *
- * Two patches applied to the user's installed agentdb tree:
- *
- * 1. Sibling directory copy (#1721 fix): agentic-flow's runtime patch
- *    expects agentdb's controllers + utils + core + services + types
- *    at `dist/<name>/` (legacy v1.x layout). agentdb v3 ships at
- *    `dist/src/<name>/`. Copy each `dist/src/<name>/` subdir to
- *    `dist/<name>/` so the legacy import paths resolve. Skip dirs that
- *    already exist so this is idempotent.
- *
- * 2. Exports-field augmentation (ADR-095 G7): six controller files
- *    exist in agentdb's dist but are not declared in its package.json
- *    `exports` field — `AttestationLog`, `MutationGuard`,
- *    `GuardedVectorBackend`, `GNNService`, `RVFOptimizer`,
- *    `GraphAdapter`. Without these declared, Node's strict exports
- *    enforcement blocks subpath imports even when the file is on disk.
- *    We add the missing entries (only if the file actually exists)
- *    so consumers can reach them via `agentdb/controllers/...`.
- *
- * Both patches are best-effort — failure to apply does not break
- * install (try/catch wraps each phase). Re-running is safe.
- */
-
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-function findAgentdbBase() {
-  try {
-    const r = require.resolve('agentdb');
-    if (r.includes('dist/src')) return path.join(path.dirname(r), '..', '..');
-    if (r.includes('dist')) return path.join(path.dirname(r), '..');
-    return path.dirname(r);
-  } catch { return null; }
-}
-
-/**
- * Find every agentdb installation reachable in the install's node_modules
- * tree. Necessary because pnpm/npm hoisting can place multiple copies of
- * agentdb (different versions) at different levels. Only patching the
- * resolved one leaves consumer code that imports through a different
- * resolution path with stale exports.
- *
- * Strategy: walk up from the postinstall script's directory, collect any
- * `node_modules/agentdb` we find along the way + the .pnpm cached copies
- * directly under the same node_modules/.pnpm/ root.
- */
-function findAllAgentdbBases() {
-  const found = new Set();
-  let dir = __dirname;
-  for (let i = 0; i < 12; i++) {
-    const candidate = path.join(dir, 'node_modules', 'agentdb');
-    if (fs.existsSync(path.join(candidate, 'package.json'))) {
-      try { found.add(fs.realpathSync(candidate)); } catch { found.add(candidate); }
-    }
-    // Also check for .pnpm cache adjacent to this node_modules
-    const pnpmDir = path.join(dir, 'node_modules', '.pnpm');
-    if (fs.existsSync(pnpmDir)) {
-      try {
-        for (const e of fs.readdirSync(pnpmDir)) {
-          if (e.startsWith('agentdb@')) {
-            const adb = path.join(pnpmDir, e, 'node_modules', 'agentdb');
-            if (fs.existsSync(path.join(adb, 'package.json'))) {
-              try { found.add(fs.realpathSync(adb)); } catch { found.add(adb); }
-            }
-          }
-        }
-      } catch { /* ignore */ }
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return Array.from(found);
-}
-
-function copySiblings(base) {
-  const srcDist = path.join(base, 'dist', 'src');
-  if (!fs.existsSync(srcDist)) return;
-  for (const entry of fs.readdirSync(srcDist)) {
-    const src = path.join(srcDist, entry);
-    const target = path.join(base, 'dist', entry);
-    try {
-      if (fs.statSync(src).isDirectory() && !fs.existsSync(target)) {
-        fs.cpSync(src, target, { recursive: true });
-      }
-    } catch { /* best-effort */ }
-  }
-}
-
-function augmentExports(base) {
-  const pkgPath = path.join(base, 'package.json');
-  if (!fs.existsSync(pkgPath)) return;
-  let pkg;
-  try { pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')); }
-  catch { return; }
-  if (!pkg.exports || typeof pkg.exports !== 'object') return;
-
-  // Subpath → relative file path (only added if both: (a) file exists, (b) export not already declared)
-  const additions = {
-    './controllers/AttestationLog': './dist/src/security/AttestationLog.js',
-    './controllers/MutationGuard': './dist/src/security/MutationGuard.js',
-    './controllers/GuardedVectorBackend': './dist/src/backends/ruvector/GuardedVectorBackend.js',
-    // GNNService and RVFOptimizer live outside dist/src/controllers/ in
-    // current agentdb. Map to the actual paths so the export points at a
-    // real file. Future agentdb versions may move them — the file-exists
-    // guard below will skip cleanly if these paths drift.
-    './controllers/GNNService': './dist/src/services/GNNService.js',
-    './controllers/RVFOptimizer': './dist/src/optimizations/RVFOptimizer.js',
-    // GraphAdapter location varies; try the graph-node backend path. If
-    // missing, the file-exists guard skips it without error.
-    './controllers/GraphAdapter': './dist/src/backends/graph-node/GraphAdapter.js',
-    // Also expose the security index so consumers can import the security namespace.
-    './security/controllers': './dist/src/security/index.js',
-  };
-
-  let changed = false;
-  for (const [subpath, target] of Object.entries(additions)) {
-    if (pkg.exports[subpath]) continue;
-    const abs = path.join(base, target);
-    if (!fs.existsSync(abs)) continue;
-    pkg.exports[subpath] = target;
-    changed = true;
-  }
-
-  if (changed) {
-    try {
-      fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
-    } catch { /* best-effort */ }
-  }
-}
-
-function main() {
-  // Patch every reachable agentdb instance, not just the first resolution
-  // result. pnpm/npm hoisting can leave multiple agentdb copies in the
-  // install tree, and consumers may import through any of them.
-  const bases = findAllAgentdbBases();
-  if (bases.length === 0) {
-    // Fall back to the single-base path so we still attempt something
-    // when the directory walk didn't find anything (e.g. unusual installs).
-    const base = findAgentdbBase();
-    if (base) bases.push(base);
-  }
-  for (const base of bases) {
-    try { copySiblings(base); } catch { /* phase 1 best-effort */ }
-  }
-}
-
-main();
+#!/usr/bin/env node
+/**
+ * @claude-flow/cli postinstall — agentdb compatibility patches.
+ *
+ * Two patches applied to the user's installed agentdb tree:
+ *
+ * 1. Sibling directory copy (#1721 fix): agentic-flow's runtime patch
+ *    expects agentdb's controllers + utils + core + services + types
+ *    at `dist/<name>/` (legacy v1.x layout). agentdb v3 ships at
+ *    `dist/src/<name>/`. Copy each `dist/src/<name>/` subdir to
+ *    `dist/<name>/` so the legacy import paths resolve. Skip dirs that
+ *    already exist so this is idempotent.
+ *
+ * 2. Exports-field augmentation (ADR-095 G7): six controller files
+ *    exist in agentdb's dist but are not declared in its package.json
+ *    `exports` field — `AttestationLog`, `MutationGuard`,
+ *    `GuardedVectorBackend`, `GNNService`, `RVFOptimizer`,
+ *    `GraphAdapter`. Without these declared, Node's strict exports
+ *    enforcement blocks subpath imports even when the file is on disk.
+ *    We add the missing entries (only if the file actually exists)
+ *    so consumers can reach them via `agentdb/controllers/...`.
+ *
+ * Both patches are best-effort — failure to apply does not break
+ * install (try/catch wraps each phase). Re-running is safe.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function findAgentdbBase() {
+  try {
+    const r = require.resolve('agentdb');
+    if (r.includes('dist/src')) return path.join(path.dirname(r), '..', '..');
+    if (r.includes('dist')) return path.join(path.dirname(r), '..');
+    return path.dirname(r);
+  } catch { return null; }
+}
+
+/**
+ * Find every agentdb installation reachable in the install's node_modules
+ * tree. Necessary because pnpm/npm hoisting can place multiple copies of
+ * agentdb (different versions) at different levels. Only patching the
+ * resolved one leaves consumer code that imports through a different
+ * resolution path with stale exports.
+ *
+ * Strategy: walk up from the postinstall script's directory, collect any
+ * `node_modules/agentdb` we find along the way + the .pnpm cached copies
+ * directly under the same node_modules/.pnpm/ root.
+ */
+function findAllAgentdbBases() {
+  const found = new Set();
+  let dir = __dirname;
+  for (let i = 0; i < 12; i++) {
+    const candidate = path.join(dir, 'node_modules', 'agentdb');
+    if (fs.existsSync(path.join(candidate, 'package.json'))) {
+      try { found.add(fs.realpathSync(candidate)); } catch { found.add(candidate); }
+    }
+    // Also check for .pnpm cache adjacent to this node_modules
+    const pnpmDir = path.join(dir, 'node_modules', '.pnpm');
+    if (fs.existsSync(pnpmDir)) {
+      try {
+        for (const e of fs.readdirSync(pnpmDir)) {
+          if (e.startsWith('agentdb@')) {
+            const adb = path.join(pnpmDir, e, 'node_modules', 'agentdb');
+            if (fs.existsSync(path.join(adb, 'package.json'))) {
+              try { found.add(fs.realpathSync(adb)); } catch { found.add(adb); }
+            }
+          }
+        }
+      } catch { /* ignore */ }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return Array.from(found);
+}
+
+function copySiblings(base) {
+  const srcDist = path.join(base, 'dist', 'src');
+  if (!fs.existsSync(srcDist)) return;
+  for (const entry of fs.readdirSync(srcDist)) {
+    const src = path.join(srcDist, entry);
+    const target = path.join(base, 'dist', entry);
+    try {
+      if (fs.statSync(src).isDirectory() && !fs.existsSync(target)) {
+        fs.cpSync(src, target, { recursive: true });
+      }
+    } catch { /* best-effort */ }
+  }
+}
+
+function augmentExports(base) {
+  const pkgPath = path.join(base, 'package.json');
+  if (!fs.existsSync(pkgPath)) return;
+  let pkg;
+  try { pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')); }
+  catch { return; }
+  if (!pkg.exports || typeof pkg.exports !== 'object') return;
+
+  // Subpath → relative file path (only added if both: (a) file exists, (b) export not already declared)
+  const additions = {
+    './controllers/AttestationLog': './dist/src/security/AttestationLog.js',
+    './controllers/MutationGuard': './dist/src/security/MutationGuard.js',
+    './controllers/GuardedVectorBackend': './dist/src/backends/ruvector/GuardedVectorBackend.js',
+    // GNNService and RVFOptimizer live outside dist/src/controllers/ in
+    // current agentdb. Map to the actual paths so the export points at a
+    // real file. Future agentdb versions may move them — the file-exists
+    // guard below will skip cleanly if these paths drift.
+    './controllers/GNNService': './dist/src/services/GNNService.js',
+    './controllers/RVFOptimizer': './dist/src/optimizations/RVFOptimizer.js',
+    // GraphAdapter location varies; try the graph-node backend path. If
+    // missing, the file-exists guard skips it without error.
+    './controllers/GraphAdapter': './dist/src/backends/graph-node/GraphAdapter.js',
+    // Also expose the security index so consumers can import the security namespace.
+    './security/controllers': './dist/src/security/index.js',
+  };
+
+  let changed = false;
+  for (const [subpath, target] of Object.entries(additions)) {
+    if (pkg.exports[subpath]) continue;
+    const abs = path.join(base, target);
+    if (!fs.existsSync(abs)) continue;
+    pkg.exports[subpath] = target;
+    changed = true;
+  }
+
+  if (changed) {
+    try {
+      fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+    } catch { /* best-effort */ }
+  }
+}
+
+function main() {
+  // Patch every reachable agentdb instance, not just the first resolution
+  // result. pnpm/npm hoisting can leave multiple agentdb copies in the
+  // install tree, and consumers may import through any of them.
+  const bases = findAllAgentdbBases();
+  if (bases.length === 0) {
+    // Fall back to the single-base path so we still attempt something
+    // when the directory walk didn't find anything (e.g. unusual installs).
+    const base = findAgentdbBase();
+    if (base) bases.push(base);
+  }
+  for (const base of bases) {
+    try { copySiblings(base); } catch { /* phase 1 best-effort */ }
+  }
+}
+
+main();