@claude-flow/cli 3.71.4 → 3.72.1

package/dist/src/mcp-tools/fast-apply-tools.d.ts

@@ -0,0 +1,4 @@
+import { type MCPTool } from './types.js';
+export declare const hooksFastApply: MCPTool;
+export declare const fastApplyTools: MCPTool[];
+//# sourceMappingURL=fast-apply-tools.d.ts.map

package/dist/src/mcp-tools/fast-apply-tools.js

@@ -0,0 +1,85 @@
+/**
+ * hooks_fast-apply — merge a code snippet into a file or string with
+ * agent-booster (~ms, no LLM). The caller supplies the target code; for
+ * deterministic intents with no snippet use hooks_codemod instead.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { resolve, sep } from 'path';
+import { getProjectCwd } from './types.js';
+import { validatePath } from './validate-input.js';
+import { realpathNearest, isInsideRealRoot } from './realpath-containment.js';
+const MAX_INPUT_BYTES = 1_000_000;
+function langForPath(p) {
+    const ext = p.slice(p.lastIndexOf('.') + 1).toLowerCase();
+    const map = {
+        ts: 'typescript', tsx: 'typescript', mts: 'typescript', cts: 'typescript',
+        js: 'javascript', jsx: 'javascript', mjs: 'javascript', cjs: 'javascript',
+        py: 'python', rs: 'rust', go: 'go', java: 'java', c: 'c', cpp: 'cpp', h: 'c',
+    };
+    return map[ext];
+}
+export const hooksFastApply = {
+    name: 'hooks_fast-apply',
+    description: 'Merge an edit SNIPPET (the rewritten code, e.g. a whole new version of one function) into a file or raw code using agent-booster — a local fast-apply engine (~1-10 ms, no LLM, $0). `edit` must be code, not an instruction: "make add typed" fails, "function add(a: number, b: number): number { return a + b; }" works. Use when you already have the replacement code and the surrounding file is large, instead of re-sending the whole file. Deterministic intents (var-to-const, remove-console, add-logging) belong to hooks_codemod. Returns confidence + strategy; below minConfidence nothing is written.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            edit: { type: 'string', description: 'Target code snippet to merge (code, not an instruction)' },
+            file: { type: 'string', description: 'Existing file inside the project to patch in place' },
+            code: { type: 'string', description: 'Raw source to patch instead of a file (returns output, writes nothing)' },
+            language: { type: 'string', description: 'Language hint (inferred from the file extension when omitted)' },
+            minConfidence: { type: 'number', description: 'Minimum merge confidence 0-1 required to apply (default 0.5)' },
+            dryRun: { type: 'boolean', description: 'Report the merge result without writing the file' },
+        },
+        required: ['edit'],
+    },
+    handler: async (params) => {
+        const edit = params.edit;
+        if (typeof edit !== 'string' || edit.trim() === '')
+            return { success: false, error: 'edit (non-empty code snippet) is required' };
+        if (edit.length > MAX_INPUT_BYTES)
+            return { success: false, error: 'edit too large' };
+        const minConfidence = typeof params.minConfidence === 'number'
+            ? Math.min(Math.max(params.minConfidence, 0), 1) : 0.5;
+        const dryRun = params.dryRun === true;
+        const { fastApply } = await import('../ruvector/fast-apply.js');
+        if (typeof params.code === 'string') {
+            if (params.code.length > MAX_INPUT_BYTES)
+                return { success: false, error: 'code too large' };
+            const r = await fastApply({ code: params.code, edit, language: params.language, minConfidence });
+            return { ...r, mode: 'code', cost: 0 };
+        }
+        if (typeof params.file !== 'string')
+            return { success: false, error: 'Provide `file` or `code`.' };
+        const v = validatePath(params.file, 'file');
+        if (!v.valid)
+            return { success: false, error: v.error };
+        const cwd = getProjectCwd();
+        const abs = resolve(cwd, v.sanitized);
+        if (abs !== cwd && !abs.startsWith(cwd + sep))
+            return { success: false, error: `path escapes project root: ${params.file}` };
+        let realRoot;
+        try {
+            realRoot = realpathNearest(cwd);
+        }
+        catch (err) {
+            return { success: false, error: `cannot resolve project root: ${err.message}` };
+        }
+        if (!isInsideRealRoot(realRoot, abs))
+            return { success: false, error: `path escapes project root via symlink: ${params.file}` };
+        if (!existsSync(abs))
+            return { success: false, error: `file not found: ${params.file}` };
+        const before = readFileSync(abs, 'utf-8');
+        if (before.length > MAX_INPUT_BYTES)
+            return { success: false, error: 'file too large' };
+        const language = params.language ?? langForPath(abs);
+        const r = await fastApply({ code: before, edit, language, minConfidence });
+        const written = r.success && !dryRun;
+        if (written)
+            writeFileSync(abs, r.output, 'utf-8');
+        const { output, ...meta } = r;
+        return { ...meta, mode: dryRun ? 'dry-run' : 'file', file: params.file, written, ...(dryRun && { output }), cost: 0 };
+    },
+};
+export const fastApplyTools = [hooksFastApply];
+//# sourceMappingURL=fast-apply-tools.js.map

package/dist/src/mcp-tools/glob-exclusions.d.ts

@@ -0,0 +1,6 @@
+/** Bounded glob matching for caller-provided memory-import exclusions. */
+export declare const MAX_EXCLUDE_PATTERNS = 64;
+export declare const MAX_EXCLUDE_PATTERN_LENGTH = 1024;
+export declare const MAX_EXCLUDE_WILDCARDS = 32;
+export declare function compileExclusionPatterns(input: unknown): Array<(path: string) => boolean>;
+//# sourceMappingURL=glob-exclusions.d.ts.map

package/dist/src/mcp-tools/glob-exclusions.js

@@ -0,0 +1,81 @@
+/** Bounded glob matching for caller-provided memory-import exclusions. */
+export const MAX_EXCLUDE_PATTERNS = 64;
+export const MAX_EXCLUDE_PATTERN_LENGTH = 1024;
+export const MAX_EXCLUDE_WILDCARDS = 32;
+function tokenize(pattern) {
+    const tokens = [];
+    let wildcards = 0;
+    for (let i = 0; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (char === '*') {
+            let end = i + 1;
+            while (pattern[end] === '*')
+                end++;
+            tokens.push({ kind: end - i > 1 ? 'globstar' : 'star' });
+            // Preserve the trailing segment-star in odd runs, including its newline behavior.
+            if (end - i > 1 && (end - i) % 2 === 1) {
+                tokens.push({ kind: 'star' });
+                wildcards++;
+            }
+            i = end - 1;
+            wildcards++;
+        }
+        else if (char === '?') {
+            tokens.push({ kind: 'question' });
+            wildcards++;
+        }
+        else {
+            tokens.push({ kind: 'literal', value: char });
+        }
+    }
+    if (wildcards > MAX_EXCLUDE_WILDCARDS) {
+        throw new Error(`excludeFilePatterns entries may contain at most ${MAX_EXCLUDE_WILDCARDS} wildcard operators`);
+    }
+    return tokens;
+}
+function matches(tokens, path) {
+    // Each path character visits each token once; wildcard placement cannot cause backtracking.
+    let previous = new Uint8Array(tokens.length + 1);
+    let current = new Uint8Array(tokens.length + 1);
+    previous[0] = 1;
+    for (let j = 1; j <= tokens.length; j++) {
+        const token = tokens[j - 1];
+        if (token.kind === 'star' || token.kind === 'globstar')
+            previous[j] = previous[j - 1];
+    }
+    for (let i = 0; i < path.length; i++) {
+        current[0] = 0;
+        const char = path[i];
+        const inSegment = char !== '/' && char !== '\\';
+        for (let j = 1; j <= tokens.length; j++) {
+            const token = tokens[j - 1];
+            if (token.kind === 'star' || token.kind === 'globstar') {
+                const canConsume = token.kind === 'globstar'
+                    ? !'\n\r\u2028\u2029'.includes(char)
+                    : inSegment;
+                current[j] = current[j - 1] || (canConsume ? previous[j] : 0);
+            }
+            else {
+                const canConsume = token.kind === 'literal' ? token.value === char : inSegment;
+                current[j] = canConsume ? previous[j - 1] : 0;
+            }
+        }
+        [previous, current] = [current, previous];
+    }
+    return previous[tokens.length] === 1;
+}
+export function compileExclusionPatterns(input) {
+    if (input === undefined)
+        return [];
+    if (!Array.isArray(input) || input.length > MAX_EXCLUDE_PATTERNS) {
+        throw new Error(`excludeFilePatterns must be an array of at most ${MAX_EXCLUDE_PATTERNS} patterns`);
+    }
+    return Array.from(input, (pattern) => {
+        if (typeof pattern !== 'string' || pattern.length > MAX_EXCLUDE_PATTERN_LENGTH) {
+            throw new Error(`excludeFilePatterns entries must be strings of at most ${MAX_EXCLUDE_PATTERN_LENGTH} characters`);
+        }
+        const tokens = tokenize(pattern);
+        return (path) => matches(tokens, path);
+    });
+}
+//# sourceMappingURL=glob-exclusions.js.map

package/dist/src/mcp-tools/hive-mind-tools.js

@@ -8,6 +8,7 @@ import { join } from 'node:path';
 import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validateText } from './validate-input.js';
+import { readPreservedJsonStore } from './record-store.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const HIVE_DIR = 'hive-mind';
@@ -199,17 +200,10 @@ function ensureHiveDir() {
     catch { /* not ours / unsupported */ }
 }
 function loadHiveState() {
-    try {
-        const path = getHivePath();
-        if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
-        }
-    }
-    catch {
-        // Return default state on error
-    }
-    return {
+    // #4737: a parse error used to return a fresh hive, and the next save
+    // overwrote state.json (including its capability token). Only a missing
+    // file is empty; corrupt bytes are copied aside and the error is reported.
+    return readPreservedJsonStore(getHivePath(), 'hive-mind', () => ({
         initialized: false,
         topology: 'mesh',
         workers: [],
@@ -217,7 +211,7 @@ function loadHiveState() {
         sharedMemory: {},
         createdAt: new Date().toISOString(),
         updatedAt: new Date().toISOString(),
-    };
+    }));
 }
 function saveHiveState(state) {
     ensureHiveDir();
@@ -243,24 +237,50 @@ function saveHiveState(state) {
         throw err;
     }
 }
-// Import agent store helpers for spawn functionality
-import { existsSync as agentStoreExists, readFileSync as readAgentStore, writeFileSync as writeAgentStore, mkdirSync as mkdirAgentStore } from 'node:fs';
-function loadAgentStore() {
-    const storePath = join(getProjectCwd(), '.claude-flow', 'agents.json');
+function getHiveAgentPath() {
+    return join(getProjectCwd(), STORAGE_DIR, 'agents.json');
+}
+function loadAgentStore(storePath = getHiveAgentPath()) {
+    let text;
     try {
-        if (agentStoreExists(storePath)) {
-            return JSON.parse(readAgentStore(storePath, 'utf-8'));
-        }
+        text = readFileSync(storePath, 'utf-8');
     }
-    catch { /* ignore */ }
-    return { agents: {} };
-}
-function saveAgentStore(store) {
-    const storeDir = join(getProjectCwd(), '.claude-flow');
-    if (!agentStoreExists(storeDir)) {
-        mkdirAgentStore(storeDir, { recursive: true });
+    catch (error) {
+        // Only an absent file is empty: never replace corrupt/unreadable data.
+        if (error.code === 'ENOENT')
+            return { agents: {} };
+        throw error;
     }
-    writeAgentStore(join(storeDir, 'agents.json'), JSON.stringify(store, null, 2), 'utf-8');
+    const store = JSON.parse(text);
+    if (!store || typeof store !== 'object' || Array.isArray(store)
+        || !store.agents || typeof store.agents !== 'object'
+        || Object.values(store.agents).some(agent => !agent || typeof agent !== 'object' || Array.isArray(agent))) {
+        throw new Error(`Invalid agent store at ${storePath}; existing data was preserved`);
+    }
+    return store;
+}
+function saveAgentStore(store, storePath = getHiveAgentPath()) {
+    // A new hive store lives directly in STORAGE_DIR; join only writes stores
+    // that already contain its agent, so their parent directories already exist.
+    mkdirSync(join(getProjectCwd(), STORAGE_DIR), { recursive: true });
+    writeFileSync(storePath, JSON.stringify(store, null, 2), 'utf-8');
+}
+function findAgent(store, agentId) {
+    if (Array.isArray(store.agents))
+        return store.agents.find(agent => agent.agentId === agentId);
+    return Object.prototype.hasOwnProperty.call(store.agents, agentId) ? store.agents[agentId] : undefined;
+}
+const HIVE_ROLES = new Set(['worker', 'specialist', 'scout']);
+function capacityError(state, additionalWorkers) {
+    const maxAgents = state.maxAgents ?? 15;
+    if (state.workers.length + additionalWorkers <= maxAgents)
+        return null;
+    return {
+        success: false,
+        error: `Hive-mind capacity exceeded: ${state.workers.length}/${maxAgents} workers; cannot add ${additionalWorkers}. Leave the hive or initialize with a larger maxAgents.`,
+        totalWorkers: state.workers.length,
+        maxAgents,
+    };
 }
 export const hiveMindTools = [
     {
@@ -303,8 +323,19 @@ export const hiveMindTools = [
                 if (!v.valid)
                     return { success: false, error: v.error };
             }
-            const count = Math.min(Math.max(1, input.count || 1), 20); // Cap at 20
+            const requestedCount = input.count === undefined ? 1 : input.count;
+            if (typeof requestedCount !== 'number' || !Number.isInteger(requestedCount) || requestedCount < 1) {
+                return { success: false, error: 'count must be a positive integer' };
+            }
+            const count = Math.min(requestedCount, 20); // Preserve the per-call cap.
+            // Reject the entire batch before creating agents or mutating the roster.
+            const full = capacityError(state, count);
+            if (full)
+                return full;
             const role = input.role || 'worker';
+            if (!HIVE_ROLES.has(role)) {
+                return { success: false, error: `role must be one of: ${[...HIVE_ROLES].join(', ')}` };
+            }
             const agentType = input.agentType || 'worker';
             const prefix = input.prefix || 'hive-worker';
             const agentStore = loadAgentStore();
@@ -312,7 +343,7 @@ export const hiveMindTools = [
             for (let i = 0; i < count; i++) {
                 const agentId = `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
                 // Create agent record (like agent/spawn)
-                agentStore.agents[agentId] = {
+                const agent = {
                     agentId,
                     agentType,
                     status: 'idle',
@@ -322,6 +353,10 @@ export const hiveMindTools = [
                     createdAt: new Date().toISOString(),
                     domain: 'hive-mind',
                 };
+                if (Array.isArray(agentStore.agents))
+                    agentStore.agents.push(agent);
+                else
+                    agentStore.agents[agentId] = agent;
                 // Join to hive-mind (like hive-mind/join)
                 if (!state.workers.includes(agentId)) {
                     state.workers.push(agentId);
@@ -521,7 +556,7 @@ export const hiveMindTools = [
                     term: state.queen.term,
                 } : { id: 'N/A', status: 'offline', load: 0, tasksQueued: 0 },
                 workers: state.workers.map(w => {
-                    const agent = agentStore.agents[w];
+                    const agent = findAgent(agentStore, w);
                     return {
                         id: w,
                         type: agent?.agentType || 'worker',
@@ -601,14 +636,43 @@ export const hiveMindTools = [
             if (tokenError) {
                 return { success: false, agentId, error: tokenError };
             }
-            if (!state.workers.includes(agentId)) {
+            const alreadyJoined = state.workers.includes(agentId);
+            // Retrying a registered member does not consume another slot.
+            if (!alreadyJoined) {
+                const full = capacityError(state, 1);
+                if (full)
+                    return { ...full, agentId };
+            }
+            // Both registration paths are legitimate (#1916). Update each existing
+            // record in place, preserving metadata and map/array representation.
+            const paths = [
+                join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json'),
+                getHiveAgentPath(),
+            ];
+            const records = paths.flatMap(path => {
+                const store = loadAgentStore(path);
+                const agent = findAgent(store, agentId);
+                return agent ? [{ path, store, agent }] : [];
+            });
+            if (records.length === 0) {
+                return { success: false, agentId, error: 'Agent not found. Register it with agent_spawn or hive-mind_spawn first.' };
+            }
+            const role = input.role || 'worker';
+            if (!HIVE_ROLES.has(role)) {
+                return { success: false, agentId, error: `role must be one of: ${[...HIVE_ROLES].join(', ')}` };
+            }
+            for (const { path, store, agent } of records) {
+                agent.config = { ...agent.config, role, hiveRole: role };
+                saveAgentStore(store, path);
+            }
+            if (!alreadyJoined) {
                 state.workers.push(agentId);
                 saveHiveState(state);
             }
             return {
                 success: true,
                 agentId,
-                role: input.role || 'worker',
+                role,
                 totalWorkers: state.workers.length,
                 joinedAt: new Date().toISOString(),
             };
@@ -1073,9 +1137,14 @@ export const hiveMindTools = [
             }
             // Clear workers from agent store
             const agentStore = loadAgentStore();
-            for (const workerId of state.workers) {
-                if (agentStore.agents[workerId]) {
-                    delete agentStore.agents[workerId];
+            if (Array.isArray(agentStore.agents)) {
+                agentStore.agents = agentStore.agents.filter(agent => !state.workers.includes(agent.agentId));
+            }
+            else {
+                for (const workerId of state.workers) {
+                    if (Object.prototype.hasOwnProperty.call(agentStore.agents, workerId)) {
+                        delete agentStore.agents[workerId];
+                    }
                 }
             }
             saveAgentStore(agentStore);

package/dist/src/mcp-tools/hooks-tools.js

@@ -5,9 +5,10 @@ import { feedbackPatternsSchema, validateFeedbackPatterns } from '../memory/feed
  */
 import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync } from 'fs';
 import * as nodeFs from 'fs';
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'path';
+import { dirname, join, resolve, sep } from 'path';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validateText, validatePath } from './validate-input.js';
+import { realpathNearest, isInsideRealRoot } from './realpath-containment.js';
 import { commandRecordingDisabled, redactCommandForStorage } from '../services/command-recording.js';
 import { checkCommandLoop, recordCommandOutcome } from './tool-loop-guardrail.js';
 import { buildLearnedRoutingPatterns, } from '../services/learned-routing.js';
@@ -2288,7 +2289,8 @@ export const hooksTransfer = {
     },
     handler: async (params) => {
         const sourcePath = params.sourcePath;
-        const minConfidence = params.minConfidence || 0.7;
+        // #4728: an explicit 0 must not fall through to 0.7 (`0 || 0.7` is 0.7).
+        const minConfidence = params.minConfidence ?? 0.7;
         const filter = params.filter;
         {
             const v = validatePath(sourcePath, 'sourcePath');
@@ -3474,7 +3476,8 @@ export const hooksPatternStore = {
     handler: async (params) => {
         const pattern = params.pattern;
         const type = params.type || 'general';
-        const confidence = params.confidence || 0.8;
+        // #4728: an explicit 0 must not fall through to 0.8 (`0 || 0.8` is 0.8).
+        const confidence = params.confidence ?? 0.8;
         const metadata = params.metadata;
         const timestamp = new Date().toISOString();
         {
@@ -3559,7 +3562,8 @@ export const hooksPatternSearch = {
     handler: async (params) => {
         const query = params.query;
         const topK = params.topK || 5;
-        const minConfidence = params.minConfidence || 0.3;
+        // #4728: an explicit 0 must not fall through to 0.3 (`0 || 0.3` is 0.3).
+        const minConfidence = params.minConfidence ?? 0.3;
         const namespace = params.namespace || 'pattern';
         const strategy = params.strategy || 'semantic';
         {
@@ -4865,7 +4869,8 @@ export const hooksWorkerDetect = {
     handler: async (params) => {
         const prompt = params.prompt;
         const autoDispatch = params.autoDispatch;
-        const minConfidence = params.minConfidence || 0.5;
+        // #4728: an explicit 0 must not fall through to 0.5 (`0 || 0.5` is 0.5).
+        const minConfidence = params.minConfidence ?? 0.5;
         {
             const v = validateText(prompt, 'prompt');
             if (!v.valid)
@@ -4968,7 +4973,10 @@ export const hooksModelRoute = {
                 implementation: 'fallback',
             };
         }
-        const result = await router.route(task);
+        const result = await router.route(task, undefined, {
+            preferCost: typeof params.preferCost === 'boolean' ? params.preferCost : undefined,
+            preferSpeed: typeof params.preferSpeed === 'boolean' ? params.preferSpeed : undefined,
+        });
         return {
             model: result.model,
             confidence: result.confidence,
@@ -5119,38 +5127,6 @@ function codemodLangForExt(abs) {
         return 'javascript';
     return 'typescript';
 }
-// Canonicalize a path that may not exist yet: realpath the nearest existing
-// ancestor and re-attach the missing tail, so a symlinked parent still
-// resolves to its real location (mirrors @claude-flow/security's
-// canonicalizeSync, which is not exported).
-function realpathNearest(p) {
-    try {
-        return nodeFs.realpathSync(p);
-    }
-    catch (err) {
-        if (err?.code !== 'ENOENT')
-            throw err;
-    }
-    const parent = dirname(p);
-    if (parent === p)
-        return p;
-    return join(realpathNearest(parent), basename(p));
-}
-// CWE-59 (#4346): containment must compare real paths on BOTH sides — a
-// symlink inside the project pointing outside it must not pass, and a
-// symlinked project root (e.g. macOS /var -> /private/var) must not make
-// every path fail. Fails closed if canonicalization throws (ELOOP, EACCES).
-function isInsideRealRoot(realRoot, abs) {
-    let real;
-    try {
-        real = realpathNearest(abs);
-    }
-    catch {
-        return false;
-    }
-    const rel = relative(realRoot, real);
-    return rel === '' || (rel !== '..' && !rel.startsWith('..' + sep) && !isAbsolute(rel));
-}
 // Deterministic codemod execution — the real Tier-1 path (ADR-143)
 export const hooksCodemod = {
     name: 'hooks_codemod',

package/dist/src/mcp-tools/import-limits.d.ts

@@ -0,0 +1,4 @@
+export declare const MAX_IMPORT_BYTES: number;
+/** Bound allocation and reads even if an import file grows after its size check. */
+export declare function readImportFile(file: string): Buffer;
+//# sourceMappingURL=import-limits.d.ts.map

package/dist/src/mcp-tools/import-limits.js

@@ -0,0 +1,28 @@
+import { closeSync, constants, fstatSync, openSync, readSync } from 'node:fs';
+export const MAX_IMPORT_BYTES = 16 * 1024 * 1024;
+/** Bound allocation and reads even if an import file grows after its size check. */
+export function readImportFile(file) {
+    const fd = openSync(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error('Import input must be a regular file');
+        if (stat.size > MAX_IMPORT_BYTES)
+            throw new Error('Import file exceeds the 16 MiB limit');
+        const buffer = Buffer.alloc(stat.size + 1);
+        let total = 0;
+        while (total < buffer.length) {
+            const count = readSync(fd, buffer, total, buffer.length - total, null);
+            if (count === 0)
+                break;
+            total += count;
+        }
+        if (total > stat.size)
+            throw new Error('Import input changed size while reading');
+        return buffer.subarray(0, total);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=import-limits.js.map

package/dist/src/mcp-tools/memory-tools.js

@@ -18,6 +18,8 @@ import { createHash } from 'crypto';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
 import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
+import { compileExclusionPatterns, MAX_EXCLUDE_PATTERNS, MAX_EXCLUDE_PATTERN_LENGTH } from './glob-exclusions.js';
+import { readImportFile } from './import-limits.js';
 // #1604: Align with memory-initializer.ts — single source of truth is .swarm/memory.db
 const MEMORY_DIR = '.swarm';
 const LEGACY_MEMORY_FILE = 'store.json';
@@ -124,37 +126,6 @@ function sanitizeMemoryKey(key) {
     const safe = key.replace(DANGEROUS_KEY_CHARS, '_');
     return safe.length > MAX_KEY_LENGTH ? safe.slice(0, MAX_KEY_LENGTH) : safe;
 }
-// #1937 — minimal glob → RegExp helper for memory_import_claude exclusion
-// patterns. Anchored. Supports the three operators the issue's voice-fidelity
-// workflow needs:
-//   `**` — any chars including path separators
-//   `*`  — any chars except path separators
-//   `?`  — exactly one char except a path separator
-// Everything else is regex-escaped. Used to match absolute file paths.
-function globToRegex(pattern) {
-    // Tokenize so we can replace `**` before `*` without overlap.
-    let out = '';
-    for (let i = 0; i < pattern.length; i++) {
-        const c = pattern[i];
-        if (c === '*' && pattern[i + 1] === '*') {
-            out += '.*';
-            i++;
-        }
-        else if (c === '*') {
-            out += '[^/\\\\]*';
-        }
-        else if (c === '?') {
-            out += '[^/\\\\]';
-        }
-        else if (/[.+^$|(){}\[\]\\]/.test(c)) {
-            out += '\\' + c;
-        }
-        else {
-            out += c;
-        }
-    }
-    return new RegExp('^' + out + '$');
-}
 // #1883 — resolve the Claude-Code project memory directory for the *current*
 // project. Claude Code hashes the project path differently per host OS, and
 // our previous logic only POSIX-slash-replaced cwd, which breaks for:
@@ -1128,8 +1099,9 @@ export const memoryTools = [
                 projectPath: { type: 'string', description: '#1883 — explicit project path to hash, used when cwd does not match Claude Code\'s view (e.g. WSL bridge to Windows host). Pass the canonical project root as Claude Code sees it.' },
                 excludeFilePatterns: {
                     type: 'array',
-                    items: { type: 'string' },
-                    description: '#1937 — glob patterns matched against the absolute file path. Files matching ANY pattern are skipped. Supports `*` (any chars within a path segment), `**` (any chars including separators), and `?` (single char). Examples: `**/voice-*.md`, `**/persona-*.md`. Combine with excludeFiles for explicit paths.',
+                    maxItems: MAX_EXCLUDE_PATTERNS,
+                    items: { type: 'string', maxLength: MAX_EXCLUDE_PATTERN_LENGTH },
+                    description: '#1937 — glob patterns matched against the absolute file path. Files matching ANY pattern are skipped. Supports `*` (any chars within a path segment), `**` (any chars including separators), and `?` (single char). At most 64 patterns, 1024 characters and 32 wildcard operators per pattern. Examples: `**/voice-*.md`, `**/persona-*.md`. Combine with excludeFiles for explicit paths.',
                 },
                 excludeFiles: {
                     type: 'array',
@@ -1139,6 +1111,13 @@ export const memoryTools = [
             },
         },
         handler: async (input) => {
+            let excludeMatchers;
+            try {
+                excludeMatchers = compileExclusionPatterns(input.excludeFilePatterns);
+            }
+            catch (error) {
+                return { success: false, imported: 0, error: error.message };
+            }
             await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
             const ns = input.namespace || 'claude-memories';
@@ -1151,13 +1130,11 @@ export const memoryTools = [
             const projectPathOverride = input.projectPath;
             const claudeProjectsDir = join(homedir(), '.claude', 'projects');
             // #1937 — voice-fidelity / persona-restricted exclusion.
-            const excludeFilePatterns = Array.isArray(input.excludeFilePatterns) ? input.excludeFilePatterns : [];
             const excludeFilesList = Array.isArray(input.excludeFiles) ? new Set(input.excludeFiles) : new Set();
-            const excludeRegexes = excludeFilePatterns.map(globToRegex);
             const isExcluded = (absPath) => {
                 if (excludeFilesList.has(absPath))
                     return true;
-                return excludeRegexes.some(re => re.test(absPath));
+                return excludeMatchers.some(matches => matches(absPath));
             };
             // Find memory files
             const memoryFiles = [];
@@ -1776,7 +1753,7 @@ export const memoryTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                inputPath: { type: 'string', description: 'Path to the JSON export file' },
+                inputPath: { type: 'string', description: 'Path to the JSON export file (maximum 16 MiB)' },
                 merge: { type: 'boolean', description: 'Merge into existing entries (upsert) vs. fail on conflict (default true)' },
                 namespace: { type: 'string', description: 'Override the namespace for all imported entries' },
                 dbPath: { type: 'string', description: 'Database file to import into (defaults to the MCP memory store)' },
@@ -1785,8 +1762,6 @@ export const memoryTools = [
         },
         handler: async (input, context) => {
             const dbPath = resolveDbPathOption(input.dbPath, context);
-            await ensureInitialized(dbPath);
-            const { storeEntry } = await getMemoryFunctions();
             const t0 = Date.now();
             // Values are re-embedded on import; count the vectors actually written
             // rather than reporting a constant 0 next to entries that show a vector.
@@ -1802,11 +1777,15 @@ export const memoryTools = [
             }
             let doc;
             try {
-                doc = JSON.parse(readFileSync(inputPath, 'utf-8'));
+                doc = JSON.parse(readImportFile(inputPath).toString('utf-8'));
             }
-            catch {
-                return { error: 'inputPath is not a valid memory export (JSON parse failed)' };
+            catch (error) {
+                return { error: error instanceof SyntaxError
+                        ? 'inputPath is not a valid memory export (JSON parse failed)'
+                        : error instanceof Error ? error.message : 'Could not read memory import' };
             }
+            await ensureInitialized(dbPath);
+            const { storeEntry } = await getMemoryFunctions();
             const entries = Array.isArray(doc.entries) ? doc.entries : [];
             const nsOverride = input.namespace ? String(input.namespace) : undefined;
             if (nsOverride) {