@hawon/nexus 0.1.0 → 0.3.0

package/src/cli/index.ts

@@ -8,31 +8,15 @@ import { discoverAllSessions } from "../parser/unified.js";
 import { parseSession } from "../parser/parse.js";
 import type { ParsedSession } from "../parser/types.js";
 import { exportSession } from "../obsidian/exporter.js";
-import { extractSkills } from "../skills/extractor.js";
 import { reviewCode } from "../review/analyzer.js";
 import { mapCodebase } from "../codebase/mapper.js";
 import { generateOnboardingGuide } from "../codebase/onboard.js";
 import { checkTestHealth } from "../testing/health-check.js";
 import { suggestFixes } from "../testing/test-fixer.js";
 import { validateConfig } from "../config/validator.js";
-import { createCostTracker } from "../cost/tracker.js";
-import { createMemoryStore } from "../memory-engine/store.js";
+import { createNexusMemory } from "../memory-engine/nexus-memory.js";
 import { scan as scanPrompt } from "../promptguard/scanner.js";
-import {
-  addSkills,
-  exportToObsidian,
-  loadSkillLibrary,
-  saveSkillLibrary,
-  searchSkills,
-} from "../skills/library.js";
-import type { SkillLibrary } from "../skills/types.js";
-import { extractWisdom, exportWisdomToObsidian } from "../skills/wisdom-extractor.js";
-import {
-  reconcileWisdom,
-  loadRefinedLibrary,
-  saveRefinedLibrary,
-  exportRefinedSkills,
-} from "../skills/skill-reconciler.js";
+import { extractMemorySkills, renderKnowledgeBase } from "../skills/memory-skill-engine.js";
 import { readdirSync, rmSync, statSync } from "node:fs";
 
 // ── ANSI Colors ──────────────────────────────────────────────────
@@ -88,7 +72,7 @@ function resolveConfig(flags: Record<string, string | undefined>): VaultConfig {
     process.env["NEXUS_VAULT_PATH"] ??
     join(homedir(), "ObsidianVault", "Claude");
 
-  const dataDir = join(vaultPath, ".nexus");
+  const dataDir = process.env["NEXUS_DATA"] ?? join(homedir(), ".nexus");
   return { vaultPath, dataDir };
 }
 
@@ -252,9 +236,6 @@ function cmdSync(flags: Record<string, string | undefined>): void {
 
   const parsedSessions: ParsedSession[] = [];
   const exportedFiles: string[] = [];
-  let skillsExtracted = 0;
-
-  const library = loadSkillLibrary(config.dataDir);
 
   for (let i = 0; i < allSessionPaths.length; i++) {
     const { path: sessionPath } = allSessionPaths[i];
@@ -264,24 +245,14 @@ function cmdSync(flags: Record<string, string | undefined>): void {
       const session = parseSession(sessionPath);
       parsedSessions.push(session);
 
-      // 3. Export to Obsidian
       const filePath = exportSessionToObsidian(session, config.vaultPath);
       exportedFiles.push(filePath);
-
-      // 4. Extract skills
-      const skills = extractSkills(session);
-      const added = addSkills(library, skills);
-      skillsExtracted += added;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       log(`\n${c.yellow}Warning:${c.reset} Failed to parse ${sessionPath}: ${msg}`);
     }
   }
 
-  // 5. Save skill library & export to Obsidian
-  saveSkillLibrary(library, config.dataDir);
-  const skillFiles = exportToObsidian(library, config.vaultPath);
-
   // 6. Update MOC and daily notes
   logInfo("Updating MOC and daily notes...");
   updateMOC(parsedSessions, config.vaultPath);
@@ -291,19 +262,16 @@ function cmdSync(flags: Record<string, string | undefined>): void {
   const status: SyncStatus = {
     lastSync: new Date().toISOString(),
     totalSessions: parsedSessions.length,
-    totalSkills: library.skills.length,
+    totalSkills: 0,
     sessionsExported: parsedSessions.map((s) => s.sessionId),
   };
   saveStatus(status, config.dataDir);
 
-  // Summary
   log("");
   log(`${c.bold}${c.green}Sync complete!${c.reset}`);
   log(`  ${c.cyan}Sessions exported:${c.reset}  ${exportedFiles.length}`);
-  log(`  ${c.cyan}New skills found:${c.reset}   ${skillsExtracted}`);
-  log(`  ${c.cyan}Total skills:${c.reset}       ${library.skills.length}`);
-  log(`  ${c.cyan}Skill files:${c.reset}        ${skillFiles.length}`);
   log(`  ${c.cyan}Vault path:${c.reset}         ${config.vaultPath}`);
+  log(`  ${c.dim}Run \`nexus reorganize\` to extract knowledge.${c.reset}`);
 }
 
 function cmdSessions(): void {
@@ -369,34 +337,41 @@ function cmdExport(sessionId: string | undefined, flags: Record<string, string |
   const filePath = exportSessionToObsidian(session, config.vaultPath);
   logSuccess(`Exported to ${filePath}`);
 
-  // Extract skills too
-  const library = loadSkillLibrary(config.dataDir);
-  const skills = extractSkills(session);
-  const added = addSkills(library, skills);
-  if (added > 0) {
-    saveSkillLibrary(library, config.dataDir);
-    logSuccess(`Extracted ${added} new skill(s)`);
-  }
 }
 
 function cmdSkills(flags: Record<string, string | undefined>): void {
   const config = resolveConfig(flags);
-  const library = loadSkillLibrary(config.dataDir);
+  const kbPath = join(config.dataDir, "knowledge.json");
 
-  if (library.skills.length === 0) {
-    logInfo("No skills extracted yet. Run `nexus sync` first.");
+  if (!existsSync(kbPath)) {
+    logInfo("No knowledge extracted yet. Run `nexus reorganize` first.");
     return;
   }
 
-  log(`\n${c.bold}Extracted Skills${c.reset} (${library.skills.length} total)\n`);
-  log(`${"Name".padEnd(45)} ${"Confidence".padEnd(12)} Tools`);
-  log(`${"-".repeat(45)} ${"-".repeat(12)} ${"-".repeat(30)}`);
+  const kb = JSON.parse(readFileSync(kbPath, "utf-8"));
+  const skills = kb.skills ?? [];
+  const tips = kb.tips ?? [];
+  const facts = kb.facts ?? [];
+
+  log(`\n${c.bold}Knowledge Base${c.reset} (${skills.length} skills | ${tips.length} tips | ${facts.length} facts)\n`);
 
-  for (const skill of library.skills) {
-    const name = skill.name.slice(0, 43).padEnd(45);
-    const conf = `${(skill.confidence * 100).toFixed(0)}%`.padEnd(12);
-    const tools = skill.toolsUsed.join(", ");
-    log(`${c.cyan}${name}${c.reset} ${c.yellow}${conf}${c.reset} ${tools}`);
+  if (skills.length > 0) {
+    log(`${c.bold}Skills:${c.reset}`);
+    for (const s of skills) {
+      log(`  ${c.cyan}${s.name.slice(0, 50)}${c.reset} — ${(s.confidence * 100).toFixed(0)}% | ${s.evidenceCount} evidence`);
+    }
+  }
+  if (tips.length > 0) {
+    log(`\n${c.bold}Tips:${c.reset}`);
+    for (const t of tips) {
+      log(`  💡 ${t.advice?.slice(0, 60) ?? t.name}`);
+    }
+  }
+  if (facts.length > 0) {
+    log(`\n${c.bold}Facts:${c.reset}`);
+    for (const f of facts) {
+      log(`  📌 ${f.statement?.slice(0, 60) ?? f.name}`);
+    }
   }
   log("");
 }
@@ -407,37 +382,18 @@ function cmdSkillsSearch(query: string | undefined, flags: Record<string, string
     process.exit(1);
   }
 
-  const config = resolveConfig(flags);
-  const library = loadSkillLibrary(config.dataDir);
-  const results = searchSkills(library, query);
-
-  if (results.length === 0) {
-    logInfo(`No skills matching "${query}".`);
-    return;
-  }
-
-  log(`\n${c.bold}Skills matching "${query}"${c.reset} (${results.length} results)\n`);
-
-  for (const skill of results) {
-    log(`${c.cyan}${c.bold}${skill.name}${c.reset} ${c.dim}(${(skill.confidence * 100).toFixed(0)}% confidence)${c.reset}`);
-    log(`  ${c.dim}Trigger:${c.reset} ${skill.trigger}`);
-    log(`  ${c.dim}Tools:${c.reset}   ${skill.toolsUsed.join(", ")}`);
-    log(`  ${c.dim}Steps:${c.reset}   ${skill.steps.length}`);
-    log("");
-  }
+  logInfo(`Search not available yet. Use \`nexus skills\` to view all knowledge.`);
 }
 
 function cmdStatus(flags: Record<string, string | undefined>): void {
   const config = resolveConfig(flags);
   const status = loadStatus(config.dataDir);
-  const library = loadSkillLibrary(config.dataDir);
 
-  log(`\n${c.bold}Claude Vault Status${c.reset}\n`);
+  log(`\n${c.bold}Nexus Status${c.reset}\n`);
   log(`  ${c.cyan}Vault path:${c.reset}      ${config.vaultPath}`);
   log(`  ${c.cyan}Last sync:${c.reset}       ${status.lastSync || "never"}`);
-  log(`  ${c.cyan}Total sessions:${c.reset}  ${status.totalSessions}`);
-  log(`  ${c.cyan}Total skills:${c.reset}    ${library.skills.length}`);
-  log(`  ${c.cyan}Library ver:${c.reset}     ${library.version}`);
+  log(`  ${c.cyan}Sessions:${c.reset}        ${status.sessionsExported ?? 0}`);
+  log(`  ${c.cyan}Knowledge:${c.reset}       ${(status as Record<string, unknown>).totalKnowledge ?? "run reorganize"}`);
   log("");
 }
 
@@ -506,47 +462,42 @@ function cmdReorganize(flags: Record<string, string | undefined>): void {
   process.stdout.write("\n");
   logInfo(`Exported ${exportCount} sessions`);
 
-  // Step 3: Extract wisdom from all sessions
-  logInfo("Extracting wisdom...");
-  const allWisdoms = [];
-  for (const session of parsedSessions) {
-    const wisdoms = extractWisdom(session.messages, session.sessionId);
-    allWisdoms.push(...wisdoms);
-  }
-  logInfo(`Extracted ${allWisdoms.length} raw wisdoms`);
-
-  // Step 4: Reconcile into refined skills
-  logInfo("Reconciling into refined skills...");
-  const library = loadRefinedLibrary(config.dataDir);
-  // Clear old skills for full reorg
-  library.skills = [];
-  library.version = 1;
-
-  const result = reconcileWisdom(allWisdoms, library);
-  saveRefinedLibrary(library, config.dataDir);
-
-  logInfo(`Quality gate: ${result.rejected.length} rejected, ${result.created.length + result.updated.length} passed`);
-  logInfo(`Refined skills: ${library.skills.length}`);
-  logInfo(`Preferences learned: ${result.preferencesLearned.length}`);
-
-  // Step 5: Export refined skills to Obsidian
-  const skillFiles = exportRefinedSkills(library, config.vaultPath);
-  logInfo(`Exported ${skillFiles.length} refined skill files`);
+  // Step 3: Memory-based knowledge extraction (Skills + Tips + Facts)
+  logInfo("Extracting knowledge from observations...");
+  const knowledgeResult = extractMemorySkills(parsedSessions, config.dataDir, 2);
+
+  logInfo(`Observations: ${knowledgeResult.observationsIngested} | Clusters: ${knowledgeResult.clustersFormed}`);
+  logInfo(`Skills: ${knowledgeResult.skills.length} | Tips: ${knowledgeResult.tips.length} | Facts: ${knowledgeResult.facts.length}`);
+
+  // Step 4: Export knowledge base to Obsidian
+  const kbPath = join(config.vaultPath, "Knowledge Base.md");
+  writeFileSync(kbPath, renderKnowledgeBase(knowledgeResult), "utf-8");
+  // Also save as JSON for MCP tool access
+  const knowledgeJson = {
+    skills: knowledgeResult.skills,
+    tips: knowledgeResult.tips,
+    facts: knowledgeResult.facts,
+  };
+  writeFileSync(join(config.dataDir, "knowledge.json"), JSON.stringify(knowledgeJson, null, 2), "utf-8");
+  logInfo("Exported Knowledge Base to Obsidian + MCP cache");
 
-  // Step 6: Update MOC and daily notes
+  // Step 5: Update MOC and daily notes
   logInfo("Updating MOC and daily notes...");
   updateMOC(parsedSessions, config.vaultPath);
   updateDailyNotes(parsedSessions, config.vaultPath);
 
-  // Step 7: Save status
+  // Step 6: Save status
+  const totalKnowledge = knowledgeResult.skills.length + knowledgeResult.tips.length + knowledgeResult.facts.length;
   const status = {
     lastSync: new Date().toISOString(),
     lastReorg: new Date().toISOString(),
     sessionsExported: exportCount,
-    refinedSkills: library.skills.length,
-    wisdomsExtracted: allWisdoms.length,
-    wisdomsRejected: result.rejected.length,
-    preferencesLearned: result.preferencesLearned.length,
+    skills: knowledgeResult.skills.length,
+    tips: knowledgeResult.tips.length,
+    facts: knowledgeResult.facts.length,
+    totalKnowledge,
+    observations: knowledgeResult.observationsIngested,
+    durationMs: knowledgeResult.durationMs,
   };
   mkdirSync(config.dataDir, { recursive: true });
   writeFileSync(join(config.dataDir, "status.json"), JSON.stringify(status, null, 2), "utf-8");
@@ -555,11 +506,11 @@ function cmdReorganize(flags: Record<string, string | undefined>): void {
   log("");
   logSuccess("Reorganization complete!");
   log(`  ${c.cyan}Sessions:${c.reset}           ${exportCount}`);
-  log(`  ${c.cyan}Raw wisdoms:${c.reset}        ${allWisdoms.length}`);
-  log(`  ${c.cyan}Rejected (noise):${c.reset}   ${result.rejected.length}`);
-  log(`  ${c.cyan}Refined skills:${c.reset}     ${library.skills.length}`);
-  log(`  ${c.cyan}Preferences:${c.reset}        ${result.preferencesLearned.length}`);
-  log(`  ${c.cyan}Old folders cleaned:${c.reset} ${foldersToClean.filter((f) => existsSync(join(config.vaultPath, f))).length === 0 ? "yes" : "partial"}`);
+  log(`  ${c.cyan}Observations:${c.reset}       ${knowledgeResult.observationsIngested}`);
+  log(`  ${c.cyan}Skills:${c.reset}             ${knowledgeResult.skills.length}`);
+  log(`  ${c.cyan}Tips:${c.reset}               ${knowledgeResult.tips.length}`);
+  log(`  ${c.cyan}Facts:${c.reset}              ${knowledgeResult.facts.length}`);
+  log(`  ${c.cyan}Total knowledge:${c.reset}    ${totalKnowledge}`);
   log(`  ${c.cyan}Vault:${c.reset}              ${config.vaultPath}`);
 }
 
@@ -746,51 +697,10 @@ async function cmdConfig(dir: string | undefined, flags: Record<string, string |
   log("");
 }
 
-function cmdCost(flags: Record<string, string | undefined>): void {
-  const config = resolveConfig(flags);
-  const tracker = createCostTracker(config.dataDir);
-  const report = tracker.getReport();
-  const projected = tracker.getProjectedCost();
-
-  if ("--json" in flags) {
-    log(JSON.stringify({ ...report, projectedMonthlyCost: projected }, null, 2));
-    return;
-  }
-
-  log(`\n${c.bold}AI Cost Report${c.reset}\n`);
-  log(`  ${c.cyan}Total cost:${c.reset}        $${report.totalCost.toFixed(4)}`);
-  log(`  ${c.cyan}Total requests:${c.reset}    ${report.totalRequests}`);
-  log(`  ${c.cyan}Avg per request:${c.reset}   $${report.averageCostPerRequest.toFixed(4)}`);
-  log(`  ${c.cyan}Projected/month:${c.reset}   $${report.projectedMonthlyCost.toFixed(2)}`);
-
-  const providers = Object.entries(report.byProvider);
-  if (providers.length > 0) {
-    log(`\n${c.bold}By Provider:${c.reset}`);
-    for (const [provider, cost] of providers) {
-      log(`  ${c.yellow}${provider}${c.reset}: $${cost.toFixed(4)}`);
-    }
-  }
-
-  const models = Object.entries(report.byModel);
-  if (models.length > 0) {
-    log(`\n${c.bold}By Model:${c.reset}`);
-    for (const [model, cost] of models) {
-      log(`  ${c.yellow}${model}${c.reset}: $${cost.toFixed(4)}`);
-    }
-  }
-
-  if (report.alerts.length > 0) {
-    log(`\n${c.bold}Alerts:${c.reset}`);
-    for (const alert of report.alerts) {
-      log(`  ${c.red}[${alert.type}]${c.reset} ${alert.message}`);
-    }
-  }
-  log("");
-}
 
 function cmdMemory(subcommand: string | undefined, query: string | undefined, flags: Record<string, string | undefined>): void {
   const config = resolveConfig(flags);
-  const store = createMemoryStore(config.dataDir);
+  const store = createNexusMemory(config.dataDir);
 
   if (subcommand === "search") {
     if (!query) {
@@ -798,7 +708,7 @@ function cmdMemory(subcommand: string | undefined, query: string | undefined, fl
       process.exit(1);
     }
 
-    const results = store.search({ query });
+    const results = store.search(query);
 
     if ("--json" in flags) {
       log(JSON.stringify(results, null, 2));
@@ -811,10 +721,9 @@ function cmdMemory(subcommand: string | undefined, query: string | undefined, fl
     }
 
     log(`\n${c.bold}Memory Search: "${query}"${c.reset} (${results.length} results)\n`);
-    for (const entry of results) {
-      log(`  ${c.cyan}${c.bold}${entry.id}${c.reset} ${c.dim}[${entry.tier}]${c.reset}`);
-      log(`    ${c.dim}Tags:${c.reset} ${entry.tags.join(", ")}`);
-      log(`    ${entry.content.slice(0, 120)}${entry.content.length > 120 ? "..." : ""}`);
+    for (const r of results) {
+      log(`  ${c.cyan}[${r.retrievalLevel}]${c.reset} score=${r.score.toFixed(2)}`);
+      log(`    ${r.observation.content.slice(0, 120)}`);
       log("");
     }
   } else if (subcommand === "stats") {
@@ -826,13 +735,12 @@ function cmdMemory(subcommand: string | undefined, query: string | undefined, fl
     }
 
     log(`\n${c.bold}Memory Stats${c.reset}\n`);
-    log(`  ${c.cyan}Total entries:${c.reset}      ${stats.totalEntries}`);
-    log(`  ${c.cyan}Total size:${c.reset}         ${(stats.totalSizeBytes / 1024).toFixed(1)} KB`);
-    log(`  ${c.cyan}Compression ratio:${c.reset}  ${(stats.compressionRatio * 100).toFixed(1)}%`);
-    log(`\n${c.bold}By Tier:${c.reset}`);
-    for (const [tier, count] of Object.entries(stats.byTier)) {
-      log(`  ${c.yellow}${tier}${c.reset}: ${count}`);
-    }
+    log(`  ${c.cyan}Observations:${c.reset}    ${stats.totalObservations}`);
+    log(`  ${c.cyan}Valid:${c.reset}           ${stats.validObservations}`);
+    log(`  ${c.cyan}Graph nodes:${c.reset}     ${stats.graphNodes}`);
+    log(`  ${c.cyan}Graph edges:${c.reset}     ${stats.graphEdges}`);
+    log(`  ${c.cyan}Tunnels:${c.reset}         ${stats.tunnels}`);
+    log(`  ${c.cyan}Domains:${c.reset}         ${stats.domains.join(", ")}`);
     log("");
   } else {
     logError("Usage: nexus memory <search|stats> [query]");
@@ -890,7 +798,6 @@ ${c.bold}Commands:${c.reset}
   ${c.cyan}onboard${c.reset} [dir]                   Generate onboarding guide
   ${c.cyan}test-health${c.reset} [dir]               Check test suite health
   ${c.cyan}config${c.reset} [dir]                    Validate config files
-  ${c.cyan}cost${c.reset}                           Show AI cost report
   ${c.cyan}memory${c.reset} <search|stats> [query]   Memory operations
   ${c.cyan}scan${c.reset} <text>                     Scan text for prompt injection
   ${c.cyan}--help${c.reset}                         Show this help
@@ -994,7 +901,7 @@ async function main(): Promise<void> {
       await cmdConfig(args[0], flags);
       break;
     case "cost":
-      cmdCost(flags);
+      logError("Cost tracking has been removed.");
       break;
     case "memory":
       cmdMemory(args[0], args.slice(1).join(" ") || undefined, flags);

package/src/index.ts

@@ -10,44 +10,32 @@ export { exportSession } from "./obsidian/exporter.js";
 export { updateMOC } from "./obsidian/moc.js";
 export { appendToDailyNote } from "./obsidian/daily-note.js";
 
-// Skills — Wisdom Pipeline
-export { extractWisdom, renderWisdomMarkdown } from "./skills/wisdom-extractor.js";
-export { reconcileWisdom, loadRefinedLibrary, saveRefinedLibrary, exportRefinedSkills } from "./skills/skill-reconciler.js";
+// Skills — Memory-based Knowledge Extraction
+export { extractMemorySkills, renderKnowledgeBase } from "./skills/memory-skill-engine.js";
+export type { MemorySkill, Tip, Fact, SkillExtractionResult } from "./skills/memory-skill-engine.js";
 
-// Skills — Context Engine
-export { createContextEngine } from "./skills/context-engine.js";
-export { createGlobalContext } from "./skills/global-context.js";
-export { analyzePatternEvolution } from "./skills/pattern-engine.js";
-export { smartExtract } from "./skills/smart-extractor.js";
+// Prompt Injection Detection
+export { scan, isInjected, guard, scanBatch, PromptInjectionError } from "./promptguard/scanner.js";
+export { BUILTIN_RULES } from "./promptguard/rules.js";
+export { ADVANCED_RULES } from "./promptguard/advanced-rules.js";
+export { MULTILINGUAL_RULES } from "./promptguard/multilingual-rules.js";
+export { normalizeText } from "./promptguard/normalize.js";
+
+// Memory Engine
+export { createNexusMemory } from "./memory-engine/nexus-memory.js";
+export { semanticSimilarity, expandQuery, getSynonyms } from "./memory-engine/semantic.js";
 
-// Code Review (from superdev)
+// Code Review
 export { reviewCode } from "./review/analyzer.js";
 export { reviewDiff } from "./review/diff-reviewer.js";
 
-// Codebase Mapping (from superdev)
+// Codebase Mapping
 export { mapCodebase } from "./codebase/mapper.js";
 export { generateOnboardingGuide } from "./codebase/onboard.js";
 
-// Test Health (from superdev)
+// Test Health
 export { checkTestHealth } from "./testing/health-check.js";
 export { suggestFixes } from "./testing/test-fixer.js";
 
-// Cost Monitor (from superdev)
-export { createCostTracker } from "./cost/tracker.js";
-
-// Config Validator (from superdev)
+// Config Validator
 export { validateConfig } from "./config/validator.js";
-
-// Infinite Memory (from superdev)
-export { createMemoryStore } from "./memory-engine/store.js";
-export { createContextWindow } from "./memory-engine/context-window.js";
-
-// Prompt Injection Detection (from promptguard)
-export { scan, isInjected, guard, scanBatch, PromptInjectionError } from "./promptguard/scanner.js";
-export { BUILTIN_RULES } from "./promptguard/rules.js";
-export { ADVANCED_RULES } from "./promptguard/advanced-rules.js";
-export { MULTILINGUAL_RULES } from "./promptguard/multilingual-rules.js";
-export { normalizeText } from "./promptguard/normalize.js";
-export { analyzeEntropy } from "./promptguard/entropy.js";
-export { classifyIntent } from "./promptguard/semantic.js";
-export { analyzeTokens } from "./promptguard/token-analysis.js";

package/src/mcp/server.ts

@@ -17,8 +17,25 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, relative, join } from "node:path";
+
+/** Validate path is within allowed boundaries. */
+function validatePath(filePath: string): string {
+  const resolved = resolve(filePath);
+  const cwd = process.cwd();
+  const home = process.env.HOME ?? "/home";
+  // Allow paths within cwd, home, or /tmp
+  if (resolved.startsWith(cwd) || resolved.startsWith(home) || resolved.startsWith("/tmp") || resolved.startsWith("/mnt/c/")) {
+    return resolved;
+  }
+  throw new Error(`Path outside allowed boundary: ${filePath}`);
+}
+
+/** Limit input size to prevent DoS. */
+function limitInput(text: string, maxLen = 500_000): string {
+  return text.length > maxLen ? text.slice(0, maxLen) : text;
+}
 
 // Session intelligence
 import { discoverAllSessions } from "../parser/unified.js";
@@ -38,21 +55,25 @@ import { suggestFixes } from "../testing/test-fixer.js";
 // Config
 import { validateConfig } from "../config/validator.js";
 
-// Cost
-import { createCostTracker } from "../cost/tracker.js";
 
 // Memory
-import { createMemoryStore } from "../memory-engine/store.js";
+import { createNexusMemory } from "../memory-engine/nexus-memory.js";
 
 // Prompt injection
 import { scan, isInjected } from "../promptguard/scanner.js";
 import type { InjectionContext, Severity } from "../promptguard/types.js";
 
-// Skills
-import { loadRefinedLibrary } from "../skills/skill-reconciler.js";
+// Knowledge — uses cached data from last `nexus reorganize`
 
 const server = new McpServer({ name: "nexus", version: "0.1.0" });
-const dataDir = resolve(process.env.NEXUS_DATA ?? ".nexus");
+const dataDir = resolve(process.env.NEXUS_DATA ?? join(process.env.HOME ?? "/home", ".nexus"));
+
+// Singleton memory store (avoid re-reading from disk on every MCP call)
+let _memoryStore: ReturnType<typeof createNexusMemory> | null = null;
+function getMemoryStore() {
+  if (!_memoryStore) _memoryStore = createNexusMemory(dataDir);
+  return _memoryStore;
+}
 
 // ─── Session Intelligence ────────────────────────────────────────
 
@@ -80,7 +101,8 @@ server.tool(
     platform: z.enum(["claude-code", "openclaw"]).optional().describe("Platform (auto-detected if omitted)"),
   },
   async ({ path, platform }) => {
-    const session = parseAnySession(path, platform ?? "claude-code");
+    const safePath = validatePath(path);
+    const session = parseAnySession(safePath, platform ?? "claude-code");
     return { content: [{ type: "text" as const, text: JSON.stringify({
       sessionId: session.sessionId,
       platform: session.platform,
@@ -102,7 +124,7 @@ server.tool(
     context: z.enum(["user_input", "tool_result", "mcp_response", "document", "unknown"]).optional(),
   },
   async ({ text, context }) => {
-    const result = scan(text, { context: (context as InjectionContext) ?? "unknown" });
+    const result = scan(limitInput(text), { context: (context as InjectionContext) ?? "unknown" });
     return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
   },
 );
@@ -128,7 +150,8 @@ server.tool(
     file_path: z.string().describe("Path to the file to review"),
   },
   async ({ file_path }) => {
-    const code = readFileSync(resolve(file_path), "utf-8");
+    const safePath = validatePath(file_path);
+    const code = readFileSync(safePath, "utf-8");
     const result = reviewCode(code, file_path);
     return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
   },
@@ -143,7 +166,7 @@ server.tool(
     directory: z.string().optional().describe("Root directory (default: current dir)"),
   },
   async ({ directory }) => {
-    const map = await mapCodebase({ root: resolve(directory ?? ".") });
+    const map = await mapCodebase({ root: validatePath(directory ?? ".") });
     return { content: [{ type: "text" as const, text: JSON.stringify({
       totalFiles: map.totalFiles,
       totalLines: map.totalLines,
@@ -161,7 +184,7 @@ server.tool(
     directory: z.string().optional().describe("Root directory (default: current dir)"),
   },
   async ({ directory }) => {
-    const map = await mapCodebase({ root: resolve(directory ?? ".") });
+    const map = await mapCodebase({ root: validatePath(directory ?? ".") });
     const guide = generateOnboardingGuide(map);
     return { content: [{ type: "text" as const, text: guide }] };
   },
@@ -176,7 +199,7 @@ server.tool(
     directory: z.string().optional(),
   },
   async ({ directory }) => {
-    const report = await checkTestHealth(resolve(directory ?? "."));
+    const report = await checkTestHealth(validatePath(directory ?? "."));
     const fixes = suggestFixes(report.issues);
     return { content: [{ type: "text" as const, text: JSON.stringify({ ...report, suggestedFixes: fixes }, null, 2) }] };
   },
@@ -191,22 +214,7 @@ server.tool(
     directory: z.string().optional(),
   },
   async ({ directory }) => {
-    const report = await validateConfig(resolve(directory ?? "."));
-    return { content: [{ type: "text" as const, text: JSON.stringify(report, null, 2) }] };
-  },
-);
-
-// ─── Cost Monitor ────────────────────────────────────────────────
-
-server.tool(
-  "nexus_cost",
-  "Show AI API cost report — total cost, by provider, by model, budget alerts.",
-  {
-    days: z.number().optional().describe("Days to report (default: 30)"),
-  },
-  async ({ days }) => {
-    const tracker = createCostTracker(dataDir);
-    const report = tracker.getReport(days ?? 30);
+    const report = await validateConfig(validatePath(directory ?? "."));
     return { content: [{ type: "text" as const, text: JSON.stringify(report, null, 2) }] };
   },
 );
@@ -221,8 +229,8 @@ server.tool(
     limit: z.number().optional().describe("Max results (default: 10)"),
   },
   async ({ query, limit }) => {
-    const store = createMemoryStore(dataDir);
-    const results = store.search({ query, limit: limit ?? 10 });
+    const store = getMemoryStore();
+    const results = store.search(query, limit ?? 10);
     return { content: [{ type: "text" as const, text: JSON.stringify(results, null, 2) }] };
   },
 );
@@ -235,21 +243,39 @@ server.tool(
     tags: z.array(z.string()).optional().describe("Tags for categorization"),
   },
   async ({ content, tags }) => {
-    const store = createMemoryStore(dataDir);
-    const entry = store.add({ content, tags: tags ?? [], tier: "working" });
-    return { content: [{ type: "text" as const, text: JSON.stringify({ saved: true, id: entry.id }) }] };
+    const store = getMemoryStore();
+    const count = store.ingest(content, "manual");
+    store.save();
+    return { content: [{ type: "text" as const, text: JSON.stringify({ saved: true, observations: count }) }] };
   },
 );
 
-// ─── Skills ──────────────────────────────────────────────────────
+// ─── Knowledge (Skills + Tips + Facts) ───────────────────────────
 
 server.tool(
   "nexus_skills",
-  "List all refined skills extracted from past sessions.",
-  {},
-  async () => {
-    const library = loadRefinedLibrary(dataDir);
-    return { content: [{ type: "text" as const, text: JSON.stringify(library.skills, null, 2) }] };
+  "List all knowledge: skills (complex patterns), tips (quick advice), and facts (reference info).",
+  {
+    tier: z.enum(["all", "skill", "tip", "fact"]).optional().describe("Filter by tier (default: all)"),
+  },
+  async ({ tier }) => {
+    // Read cached knowledge from last reorganize
+    const statusPath = join(dataDir, "status.json");
+    const kbPath = join(dataDir, "knowledge.json");
+    let knowledge: { skills: unknown[]; tips: unknown[]; facts: unknown[] } = { skills: [], tips: [], facts: [] };
+
+    try {
+      if (existsSync(kbPath)) {
+        knowledge = JSON.parse(readFileSync(kbPath, "utf-8"));
+      }
+    } catch { /* empty */ }
+
+    const filtered = tier === "skill" ? { skills: knowledge.skills }
+      : tier === "tip" ? { tips: knowledge.tips }
+      : tier === "fact" ? { facts: knowledge.facts }
+      : knowledge;
+
+    return { content: [{ type: "text" as const, text: JSON.stringify(filtered, null, 2) }] };
   },
 );