@phren/cli 0.0.10 → 0.0.12

package/mcp/dist/mcp-extract-facts.js

@@ -9,6 +9,7 @@ import * as path from "path";
 import { debugLog } from "./shared.js";
 import { safeProjectPath, isFeatureEnabled, errorMessage } from "./utils.js";
 import { callLlm } from "./content-dedup.js";
+import { withFileLock } from "./shared-governance.js";
 const FACT_EXTRACT_FLAG = "PHREN_FEATURE_FACT_EXTRACT";
 const MAX_FACTS = 50;
 function preferencesPath(phrenPath, project) {
@@ -24,7 +25,7 @@ export function readExtractedFacts(phrenPath, project) {
         return Array.isArray(data) ? data : [];
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+        if ((process.env.PHREN_DEBUG))
             process.stderr.write(`[phren] readExtractedFacts: ${errorMessage(err)}\n`);
         return [];
     }
@@ -64,13 +65,17 @@ export function extractFactFromFinding(phrenPath, project, finding) {
         const fact = raw.replace(/[\r\n]+/g, " ").trim().slice(0, 200);
         if (!fact)
             return;
-        // Re-read inside the callback to minimize race window (best-effort; not locked)
-        const existing = readExtractedFacts(phrenPath, project);
-        const normalized = fact.toLowerCase();
-        if (existing.some(f => f.fact.toLowerCase() === normalized))
+        const p = preferencesPath(phrenPath, project);
+        if (!p)
             return;
-        existing.push({ fact, source: finding.slice(0, 120), at: new Date().toISOString() });
-        writeExtractedFacts(phrenPath, project, existing);
+        withFileLock(p, () => {
+            const existing = readExtractedFacts(phrenPath, project);
+            const normalized = fact.toLowerCase();
+            if (existing.some(f => f.fact.toLowerCase() === normalized))
+                return;
+            existing.push({ fact, source: finding.slice(0, 120), at: new Date().toISOString() });
+            writeExtractedFacts(phrenPath, project, existing);
+        });
     })
         .catch((err) => {
         debugLog(`extractFactFromFinding: ${errorMessage(err)}`);

package/mcp/dist/mcp-extract.js

@@ -1,6 +1,6 @@
 import { mcpResponse } from "./mcp-types.js";
 import { z } from "zod";
-import { isValidProjectName, safeProjectPath } from "./utils.js";
+import { isValidProjectName, safeProjectPath, errorMessage } from "./utils.js";
 import { addFindingsToFile } from "./shared-content.js";
 import { checkOllamaAvailable, checkModelAvailable, generateText, getOllamaUrl, getExtractModel } from "./shared-ollama.js";
 import { debugLog } from "./shared.js";
@@ -34,7 +34,7 @@ function parseFindings(raw) {
         }
     }
     catch (err) {
-        debugLog(`auto_extract: failed to parse LLM output as JSON: ${cleaned.slice(0, 200)} (${err instanceof Error ? err.message : String(err)})`);
+        debugLog(`auto_extract: failed to parse LLM output as JSON: ${cleaned.slice(0, 200)} (${errorMessage(err)})`);
     }
     return [];
 }

package/mcp/dist/mcp-finding.js

@@ -4,7 +4,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { isValidProjectName, safeProjectPath, errorMessage } from "./utils.js";
 import { removeFinding as removeFindingCore, removeFindings as removeFindingsCore, } from "./core-finding.js";
-import { debugLog, EXEC_TIMEOUT_MS, FINDING_TYPES, normalizeMemoryScope, } from "./shared.js";
+import { debugLog, EXEC_TIMEOUT_MS, FINDING_TYPES, normalizeMemoryScope, RESERVED_PROJECT_DIR_NAMES, } from "./shared.js";
 import { addFindingToFile, addFindingsToFile, checkSemanticConflicts, autoMergeConflicts, } from "./shared-content.js";
 import { jaccardTokenize, jaccardSimilarity, stripMetadata } from "./content-dedup.js";
 import { runCustomHooks } from "./hooks.js";
@@ -17,7 +17,6 @@ import { FINDING_PROVENANCE_SOURCES } from "./content-citation.js";
 import { isInactiveFindingLine, supersedeFinding, retractFinding as retractFindingLifecycle, resolveFindingContradiction, } from "./finding-lifecycle.js";
 const JACCARD_MAYBE_LOW = 0.30;
 const JACCARD_MAYBE_HIGH = 0.55; // above this isDuplicateFinding already catches it
-const RESERVED_PROJECT_DIRS = new Set(["global", ".runtime", ".sessions", ".governance"]);
 function findJaccardCandidates(phrenPath, project, finding) {
     try {
         const findingsPath = path.join(phrenPath, project, "FINDINGS.md");
@@ -134,14 +133,11 @@ export function register(server, ctx) {
                 if (!result.ok) {
                     return mcpResponse({ ok: false, error: result.error });
                 }
-                // Determine status from the returned message string
-                const isSkipped = result.data.startsWith("Skipped duplicate");
-                const isAdded = !isSkipped;
-                if (isSkipped) {
-                    return mcpResponse({ ok: true, message: result.data, data: { project, finding: taggedFinding, status: "skipped" } });
+                if (result.data.status === "skipped") {
+                    return mcpResponse({ ok: true, message: result.data.message, data: { project, finding: taggedFinding, status: "skipped" } });
                 }
                 updateFileInIndex(path.join(phrenPath, project, "FINDINGS.md"));
-                if (isAdded) {
+                if (result.data.status === "added" || result.data.status === "created") {
                     runCustomHooks(phrenPath, "post-finding", { PHREN_PROJECT: project });
                     incrementSessionFindings(phrenPath, 1, sessionId, project);
                     extractFactFromFinding(phrenPath, project, taggedFinding);
@@ -178,7 +174,7 @@ export function register(server, ctx) {
                 }
                 const conflictsWithList = semanticConflicts.checked
                     ? extractConflictsWith(semanticConflicts.annotations)
-                    : (result.data.match(/<!--\s*conflicts_with:\s*"([^"]+)"/)?.[1] ? [result.data.match(/<!--\s*conflicts_with:\s*"([^"]+)"/)[1]] : []);
+                    : (result.data.message.match(/<!--\s*conflicts_with:\s*"([^"]+)"/)?.[1] ? [result.data.message.match(/<!--\s*conflicts_with:\s*"([^"]+)"/)[1]] : []);
                 const conflictsWith = conflictsWithList[0];
                 // Extract fragment hints synchronously from the finding text (regex only, no DB).
                 // Full DB fragment linking happens on the next index rebuild via updateFileInIndex →
@@ -186,11 +182,11 @@ export function register(server, ctx) {
                 const detectedFragments = extractFragmentNames(taggedFinding);
                 return mcpResponse({
                     ok: true,
-                    message: result.data,
+                    message: result.data.message,
                     data: {
                         project,
                         finding: taggedFinding,
-                        status: "added",
+                        status: result.data.status,
                         ...(conflictsWith ? { conflictsWith } : {}),
                         ...(conflictsWithList.length > 0 ? { conflicts: conflictsWithList } : {}),
                         ...(detectedFragments.length > 0 ? { detectedFragments } : {}),
@@ -236,7 +232,7 @@ export function register(server, ctx) {
                     extraAnnotationsByFinding.push(conflicts.checked && conflicts.annotations.length > 0 ? conflicts.annotations : []);
                 }
                 catch (err) {
-                    if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                    if ((process.env.PHREN_DEBUG))
                         process.stderr.write(`[phren] add_findings semanticConflict: ${errorMessage(err)}\n`);
                     extraAnnotationsByFinding.push([]);
                 }
@@ -356,7 +352,7 @@ export function register(server, ctx) {
         const projects = project
             ? [project]
             : fs.readdirSync(phrenPath, { withFileTypes: true })
-                .filter((entry) => entry.isDirectory() && !RESERVED_PROJECT_DIRS.has(entry.name) && isValidProjectName(entry.name))
+                .filter((entry) => entry.isDirectory() && !RESERVED_PROJECT_DIR_NAMES.has(entry.name) && isValidProjectName(entry.name))
                 .map((entry) => entry.name);
         const contradictions = [];
         for (const p of projects) {
@@ -490,8 +486,8 @@ export function register(server, ctx) {
                     .filter((name) => name && !name.startsWith(".") && name !== "profiles")));
                 const commitMsg = message || `phren: save ${files.length} file(s) across ${projectNames.length} project(s)`;
                 runCustomHooks(phrenPath, "pre-save");
-                // Restrict to known phren file types to avoid staging .env or credential files
-                runGit(["add", "--", "*.md", "*.json", "*.yaml", "*.yml", "*.jsonl", "*.txt"]);
+                // Stage all files including untracked (new project dirs, first FINDINGS.md, etc.)
+                runGit(["add", "-A"]);
                 runGit(["commit", "-m", commitMsg]);
                 let hasRemote = false;
                 try {
@@ -499,7 +495,7 @@ export function register(server, ctx) {
                     hasRemote = remotes.length > 0;
                 }
                 catch (err) {
-                    if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                    if ((process.env.PHREN_DEBUG))
                         process.stderr.write(`[phren] push_changes remoteCheck: ${errorMessage(err)}\n`);
                 }
                 if (!hasRemote) {
@@ -523,7 +519,7 @@ export function register(server, ctx) {
                                 runGit(["pull", "--rebase", "--quiet"], { timeout: 15000 });
                             }
                             catch (pullErr) {
-                                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                                if ((process.env.PHREN_DEBUG))
                                     process.stderr.write(`[phren] push_changes pullRebase: ${pullErr instanceof Error ? pullErr.message : String(pullErr)}\n`);
                                 const resolved = autoMergeConflicts(phrenPath);
                                 if (resolved) {
@@ -534,13 +530,13 @@ export function register(server, ctx) {
                                         });
                                     }
                                     catch (continueErr) {
-                                        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                                        if ((process.env.PHREN_DEBUG))
                                             process.stderr.write(`[phren] push_changes rebaseContinue: ${continueErr instanceof Error ? continueErr.message : String(continueErr)}\n`);
                                         try {
                                             runGit(["rebase", "--abort"]);
                                         }
                                         catch (abortErr) {
-                                            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                                            if ((process.env.PHREN_DEBUG))
                                                 process.stderr.write(`[phren] push_changes rebaseAbort: ${abortErr instanceof Error ? abortErr.message : String(abortErr)}\n`);
                                         }
                                         break;
@@ -551,7 +547,7 @@ export function register(server, ctx) {
                                         runGit(["rebase", "--abort"]);
                                     }
                                     catch (abortErr) {
-                                        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                                        if ((process.env.PHREN_DEBUG))
                                             process.stderr.write(`[phren] push_changes rebaseAbort2: ${abortErr instanceof Error ? abortErr.message : String(abortErr)}\n`);
                                     }
                                     break;

package/mcp/dist/mcp-graph.js

@@ -2,14 +2,14 @@ import { mcpResponse } from "./mcp-types.js";
 import { z } from "zod";
 import * as fs from "fs";
 import * as crypto from "crypto";
-import { isValidProjectName } from "./utils.js";
+import { isValidProjectName, errorMessage } from "./utils.js";
 import { queryDocBySourceKey, queryRows, queryFragmentLinks, queryCrossProjectFragments, ensureGlobalEntitiesTable, logFragmentMiss } from "./shared-index.js";
 import { runtimeFile } from "./shared.js";
 import { withFileLock } from "./shared-governance.js";
 export function register(server, ctx) {
     // ── search_fragments ──────────────────────────────────────────────────
     server.registerTool("search_fragments", {
-        title: "phren : search fragments",
+        title: "◆ phren · search fragments",
         description: "Search named fragments in the knowledge graph (libraries, tools, concepts mentioned in findings). " +
             "Returns matching fragment names and how many findings reference each.",
         inputSchema: z.object({
@@ -209,8 +209,8 @@ export function register(server, ctx) {
                 db.run("INSERT OR IGNORE INTO entities (name, type, first_seen_at) VALUES (?, ?, ?)", [fragmentName, resolvedFragmentType, new Date().toISOString().slice(0, 10)]);
             }
             catch (err) {
-                if (process.env.PHREN_DEBUG || (process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] link_findings fragmentInsert: ${err instanceof Error ? err.message : String(err)}\n`);
+                if (process.env.PHREN_DEBUG)
+                    process.stderr.write(`[phren] link_findings fragmentInsert: ${errorMessage(err)}\n`);
             }
             const fragmentResult = db.exec("SELECT id FROM entities WHERE name = ? AND type = ?", [fragmentName, resolvedFragmentType]);
             if (!fragmentResult?.length || !fragmentResult[0]?.values?.length) {
@@ -232,8 +232,8 @@ export function register(server, ctx) {
                 db.run("INSERT OR IGNORE INTO entities (name, type, first_seen_at) VALUES (?, ?, ?)", [sourceDoc, "document", new Date().toISOString().slice(0, 10)]);
             }
             catch (err) {
-                if (process.env.PHREN_DEBUG || (process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] link_findings docFragmentInsert: ${err instanceof Error ? err.message : String(err)}\n`);
+                if (process.env.PHREN_DEBUG)
+                    process.stderr.write(`[phren] link_findings docFragmentInsert: ${errorMessage(err)}\n`);
             }
             const docFragmentResult = db.exec("SELECT id FROM entities WHERE name = ? AND type = ?", [sourceDoc, "document"]);
             if (!docFragmentResult?.length || !docFragmentResult[0]?.values?.length) {
@@ -245,8 +245,8 @@ export function register(server, ctx) {
                 db.run("INSERT OR IGNORE INTO entity_links (source_id, target_id, rel_type, source_doc) VALUES (?, ?, ?, ?)", [sourceId, targetId, relType, sourceDoc]);
             }
             catch (err) {
-                if (process.env.PHREN_DEBUG || (process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] link_findings linkInsert: ${err instanceof Error ? err.message : String(err)}\n`);
+                if (process.env.PHREN_DEBUG)
+                    process.stderr.write(`[phren] link_findings linkInsert: ${errorMessage(err)}\n`);
                 return mcpResponse({ ok: false, error: "Failed to insert fragment link." });
             }
             // 4a. Also populate global_entities so manual links appear in cross_project_fragments
@@ -255,8 +255,8 @@ export function register(server, ctx) {
                 db.run("INSERT OR IGNORE INTO global_entities (entity, project, doc_key) VALUES (?, ?, ?)", [fragmentName, project, sourceDoc]);
             }
             catch (err) {
-                if (process.env.PHREN_DEBUG || (process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] link_findings globalFragments: ${err instanceof Error ? err.message : String(err)}\n`);
+                if (process.env.PHREN_DEBUG)
+                    process.stderr.write(`[phren] link_findings globalFragments: ${errorMessage(err)}\n`);
             }
             // 4b. Persist manual link so it survives index rebuilds (mandatory — failure aborts the operation)
             const manualLinksPath = runtimeFile(ctx.phrenPath, "manual-links.json");
@@ -268,8 +268,8 @@ export function register(server, ctx) {
                             existing = JSON.parse(fs.readFileSync(manualLinksPath, "utf8"));
                         }
                         catch (err) {
-                            if (process.env.PHREN_DEBUG || (process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                                process.stderr.write(`[phren] link_findings manualLinksRead: ${err instanceof Error ? err.message : String(err)}\n`);
+                            if (process.env.PHREN_DEBUG)
+                                process.stderr.write(`[phren] link_findings manualLinksRead: ${errorMessage(err)}\n`);
                         }
                     }
                     const newEntry = { entity: fragmentName, entityType: resolvedFragmentType, sourceDoc, relType };

package/mcp/dist/mcp-hooks.js

@@ -23,7 +23,7 @@ function validateHookCommand(command) {
         return "Command too long (max 1000 characters).";
     // Reject shell metacharacters that allow injection or arbitrary execution
     // when the command is later run via `sh -c`.
-    if (/[`$(){}&|;<>]/.test(trimmed)) {
+    if (/[`$(){}&|;<>\n\r#]/.test(trimmed)) {
         return "Command contains disallowed shell characters: ` $ ( ) { } & | ; < >";
     }
     // eval and source can execute arbitrary code

package/mcp/dist/mcp-ops.js

@@ -4,7 +4,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { runtimeFile, getProjectDirs } from "./shared.js";
 import { findFtsCacheForPath } from "./shared-index.js";
-import { isValidProjectName } from "./utils.js";
+import { isValidProjectName, errorMessage } from "./utils.js";
 import { readReviewQueue, readReviewQueueAcrossProjects } from "./data-access.js";
 import { addProjectFromPath } from "./core-project.js";
 import { PROJECT_OWNERSHIP_MODES, parseProjectOwnershipMode } from "./project-config.js";
@@ -44,7 +44,7 @@ export function register(server, ctx) {
             catch (err) {
                 return mcpResponse({
                     ok: false,
-                    error: err instanceof Error ? err.message : String(err),
+                    error: errorMessage(err),
                 });
             }
         });
@@ -108,8 +108,8 @@ export function register(server, ctx) {
             version = pkg.version || "unknown";
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                process.stderr.write(`[phren] healthCheck version: ${err instanceof Error ? err.message : String(err)}\n`);
+            if ((process.env.PHREN_DEBUG))
+                process.stderr.write(`[phren] healthCheck version: ${errorMessage(err)}\n`);
         }
         // FTS index (lives in /tmpphren-fts-*/, not .runtime/)
         let indexStatus = { exists: false };
@@ -117,8 +117,8 @@ export function register(server, ctx) {
             indexStatus = findFtsCacheForPath(phrenPath, activeProfile);
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                process.stderr.write(`[phren] healthCheck ftsCacheCheck: ${err instanceof Error ? err.message : String(err)}\n`);
+            if ((process.env.PHREN_DEBUG))
+                process.stderr.write(`[phren] healthCheck ftsCacheCheck: ${errorMessage(err)}\n`);
         }
         // Hook registration
         let hooksEnabled = false;
@@ -127,8 +127,8 @@ export function register(server, ctx) {
             hooksEnabled = getHooksEnabledPreference(phrenPath);
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                process.stderr.write(`[phren] healthCheck hooksEnabled: ${err instanceof Error ? err.message : String(err)}\n`);
+            if ((process.env.PHREN_DEBUG))
+                process.stderr.write(`[phren] healthCheck hooksEnabled: ${errorMessage(err)}\n`);
         }
         let mcpEnabled = false;
         try {
@@ -136,8 +136,8 @@ export function register(server, ctx) {
             mcpEnabled = getMcpEnabledPreference(phrenPath);
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                process.stderr.write(`[phren] healthCheck mcpEnabled: ${err instanceof Error ? err.message : String(err)}\n`);
+            if ((process.env.PHREN_DEBUG))
+                process.stderr.write(`[phren] healthCheck mcpEnabled: ${errorMessage(err)}\n`);
         }
         // Profile/machine info
         const machineName = (() => {
@@ -145,8 +145,8 @@ export function register(server, ctx) {
                 return getMachineName();
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] healthCheck machineName: ${err instanceof Error ? err.message : String(err)}\n`);
+                if ((process.env.PHREN_DEBUG))
+                    process.stderr.write(`[phren] healthCheck machineName: ${errorMessage(err)}\n`);
             }
             return undefined;
         })();
@@ -160,8 +160,8 @@ export function register(server, ctx) {
             taskMode = workflowPolicy.taskMode;
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                process.stderr.write(`[phren] healthCheck taskMode: ${err instanceof Error ? err.message : String(err)}\n`);
+            if ((process.env.PHREN_DEBUG))
+                process.stderr.write(`[phren] healthCheck taskMode: ${errorMessage(err)}\n`);
         }
         try {
             const { readInstallPreferences } = await import("./init-preferences.js");
@@ -169,8 +169,8 @@ export function register(server, ctx) {
             proactivity = prefs.proactivity || "high";
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                process.stderr.write(`[phren] healthCheck proactivity: ${err instanceof Error ? err.message : String(err)}\n`);
+            if ((process.env.PHREN_DEBUG))
+                process.stderr.write(`[phren] healthCheck proactivity: ${errorMessage(err)}\n`);
         }
         const lines = [
             `Phren v${version}`,
@@ -262,8 +262,8 @@ export function register(server, ctx) {
                 return lines.filter(line => ERROR_PATTERNS.some(p => p.test(line)));
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] readErrorLines: ${err instanceof Error ? err.message : String(err)}\n`);
+                if ((process.env.PHREN_DEBUG))
+                    process.stderr.write(`[phren] readErrorLines: ${errorMessage(err)}\n`);
                 return [];
             }
         }

package/mcp/dist/mcp-search.js

@@ -35,8 +35,8 @@ export function logSearchMiss(phrenPath, query, project) {
         fs.appendFileSync(missFile, entry + "\n");
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-            process.stderr.write(`[phren] logSearchMiss: ${err instanceof Error ? err.message : String(err)}\n`);
+        if ((process.env.PHREN_DEBUG))
+            process.stderr.write(`[phren] logSearchMiss: ${errorMessage(err)}\n`);
     }
 }
 const HISTORY_FINDING_STATUSES = new Set(["superseded", "retracted"]);
@@ -160,7 +160,7 @@ export function register(server, ctx) {
             createdAt = stat.birthtime.toISOString();
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+            if ((process.env.PHREN_DEBUG))
                 process.stderr.write(`[phren] search_knowledge statFile: ${errorMessage(err)}\n`);
         }
         // Extract tags from content (e.g. [decision], [pitfall], [pattern])
@@ -393,8 +393,8 @@ export function register(server, ctx) {
                 relatedFragments = [...new Set(relatedFragments)].slice(0, 10);
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] fragment query: ${err instanceof Error ? err.message : String(err)}\n`);
+                if ((process.env.PHREN_DEBUG))
+                    process.stderr.write(`[phren] fragment query: ${errorMessage(err)}\n`);
             }
             const formatted = results.map((r) => `### ${r.project}/${r.filename} (${r.type})\n${r.snippet}\n\n\`${r.path}\``);
             // Memory synthesis: generate a concise paragraph from top results when requested
@@ -408,7 +408,7 @@ export function register(server, ctx) {
                         synthCache = JSON.parse(fs.readFileSync(synthCachePath, "utf8"));
                     }
                     catch (err) {
-                        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                        if ((process.env.PHREN_DEBUG))
                             process.stderr.write(`[phren] search_knowledge synthCacheRead: ${errorMessage(err)}\n`);
                     }
                     const cached = synthCache[synthKey];
@@ -433,8 +433,8 @@ export function register(server, ctx) {
                                 fs.writeFileSync(synthCachePath, JSON.stringify(synthCache));
                             }
                             catch (err) {
-                                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-                                    process.stderr.write(`[phren] synthCache write: ${err instanceof Error ? err.message : String(err)}\n`);
+                                if ((process.env.PHREN_DEBUG))
+                                    process.stderr.write(`[phren] synthCache write: ${errorMessage(err)}\n`);
                             }
                         }
                     }
@@ -567,17 +567,12 @@ export function register(server, ctx) {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
         const includeHistory = include_history ?? include_superseded ?? false;
-        const result = readFindings(phrenPath, project, { includeArchived: includeHistory });
+        // Always read with archive so we can compute historyCount without a second read
+        const result = readFindings(phrenPath, project, { includeArchived: true });
         if (!result.ok)
             return mcpResponse({ ok: false, error: result.error });
         const allItems = result.data;
-        let historyCount = allItems.filter(f => f.tier === "archived" || HISTORY_FINDING_STATUSES.has(f.status)).length;
-        if (!includeHistory) {
-            const withArchive = readFindings(phrenPath, project, { includeArchived: true });
-            if (withArchive.ok) {
-                historyCount = withArchive.data.filter(f => f.tier === "archived" || HISTORY_FINDING_STATUSES.has(f.status)).length;
-            }
-        }
+        const historyCount = allItems.filter(f => f.tier === "archived" || HISTORY_FINDING_STATUSES.has(f.status)).length;
         const visibleItems = includeHistory
             ? allItems
             : allItems.filter(f => f.tier !== "archived" && !HISTORY_FINDING_STATUSES.has(f.status));

package/mcp/dist/mcp-session.js

@@ -90,6 +90,7 @@ function extractResumptionHint(summary, fallbackNextStep, fallbackLastAttempt) {
     };
 }
 /** Per-connection session map keyed by arbitrary connection ID (if provided). */
+const MAX_SESSION_MAP_ENTRIES = 200;
 const _sessionMap = new Map();
 function sessionsDir(phrenPath) {
     const dir = path.join(phrenPath, ".runtime", "sessions");
@@ -151,7 +152,10 @@ function lastSummaryPath(phrenPath) {
 function writeLastSummary(phrenPath, summary, sessionId, project) {
     try {
         const data = { summary, sessionId, project, endedAt: new Date().toISOString() };
-        fs.writeFileSync(lastSummaryPath(phrenPath), JSON.stringify(data, null, 2));
+        const summaryFile = lastSummaryPath(phrenPath);
+        const tmpPath = `${summaryFile}.tmp-${crypto.randomUUID()}`;
+        fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+        fs.renameSync(tmpPath, summaryFile);
     }
     catch (err) {
         debugError("writeLastSummary", err);
@@ -417,8 +421,14 @@ export function register(server, ctx) {
         };
         const newFile = sessionFileForId(phrenPath, sessionId);
         writeSessionStateFile(newFile, next);
-        if (connectionId)
+        if (connectionId) {
             _sessionMap.set(connectionId, sessionId);
+            if (_sessionMap.size > MAX_SESSION_MAP_ENTRIES) {
+                const oldest = _sessionMap.keys().next().value;
+                if (oldest !== undefined)
+                    _sessionMap.delete(oldest);
+            }
+        }
         const parts = [];
         if (priorSummary) {
             parts.push(`## Last session\n${priorSummary}`);