@phren/cli 0.0.17 → 0.0.19

package/mcp/dist/mcp-finding.js

@@ -15,6 +15,7 @@ import { appendChildFinding, editFinding as editFindingCore, readFindings } from
 import { getActiveTaskForSession } from "./task-lifecycle.js";
 import { FINDING_PROVENANCE_SOURCES } from "./content-citation.js";
 import { isInactiveFindingLine, supersedeFinding, retractFinding as retractFindingLifecycle, resolveFindingContradiction, } from "./finding-lifecycle.js";
+import { permissionDeniedError } from "./governance-rbac.js";
 const JACCARD_MAYBE_LOW = 0.30;
 const JACCARD_MAYBE_HIGH = 0.55; // above this isDuplicateFinding already catches it
 function findJaccardCandidates(phrenPath, project, finding) {
@@ -112,6 +113,9 @@ export function register(server, ctx) {
     }, async ({ project, finding, citation, sessionId, source, findingType, scope }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const addFindingDenied = permissionDeniedError(phrenPath, "add_finding", project);
+        if (addFindingDenied)
+            return mcpResponse({ ok: false, error: addFindingDenied });
         if (finding.length > 5000)
             return mcpResponse({ ok: false, error: "Finding text exceeds 5000 character limit." });
         const normalizedScope = normalizeMemoryScope(scope ?? "shared");
@@ -214,6 +218,9 @@ export function register(server, ctx) {
     }, async ({ project, findings, sessionId }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const addFindingsDenied = permissionDeniedError(phrenPath, "add_finding", project);
+        if (addFindingsDenied)
+            return mcpResponse({ ok: false, error: addFindingsDenied });
         if (findings.length > 100)
             return mcpResponse({ ok: false, error: "Bulk add limited to 100 findings per call." });
         if (findings.some((f) => f.length > 5000))
@@ -399,6 +406,9 @@ export function register(server, ctx) {
     }, async ({ project, old_text, new_text }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const editDenied = permissionDeniedError(phrenPath, "edit_finding", project);
+        if (editDenied)
+            return mcpResponse({ ok: false, error: editDenied });
         return withWriteQueue(async () => {
             const result = editFindingCore(phrenPath, project, old_text, new_text);
             if (!result.ok)
@@ -424,6 +434,9 @@ export function register(server, ctx) {
     }, async ({ project, finding }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const removeDenied = permissionDeniedError(phrenPath, "remove_finding", project);
+        if (removeDenied)
+            return mcpResponse({ ok: false, error: removeDenied });
         return withWriteQueue(async () => {
             const result = removeFindingCore(phrenPath, project, finding);
             if (result.ok) {
@@ -446,6 +459,9 @@ export function register(server, ctx) {
     }, async ({ project, findings }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const removeFindingsDenied = permissionDeniedError(phrenPath, "remove_finding", project);
+        if (removeFindingsDenied)
+            return mcpResponse({ ok: false, error: removeFindingsDenied });
         return withWriteQueue(async () => {
             const result = removeFindingsCore(phrenPath, project, findings);
             if (result.ok) {

package/mcp/dist/mcp-search.js

@@ -10,7 +10,7 @@ import { decodeStringRow, queryRows, queryDocRows, queryEntityLinks, logEntityMi
 import { runCustomHooks } from "./hooks.js";
 import { entryScoreKey, getQualityMultiplier, getRetentionPolicy } from "./shared-governance.js";
 import { callLlm } from "./content-dedup.js";
-import { rankResults, searchKnowledgeRows, applyTrustFilter } from "./shared-retrieval.js";
+import { rankResults, searchKnowledgeRows, applyTrustFilter, searchFederatedStores } from "./shared-retrieval.js";
 import { parseSourceComment } from "./content-citation.js";
 import { resolveActiveSessionScope } from "./mcp-session.js";
 /**
@@ -235,9 +235,35 @@ export function register(server, ctx) {
             const safeQuery = retrieval.safeQuery;
             if (!safeQuery)
                 return mcpResponse({ ok: false, error: "Search query is empty after sanitization." });
-            let rows = retrieval.rows;
+            let rows = retrieval.rows ?? [];
             const usedFallback = retrieval.usedFallback;
-            if (!rows || rows.length === 0) {
+            // Merge federated store results when PHREN_FEDERATION_PATHS is set and no project filter
+            // (federation is global by nature — per-project filter only makes sense within a single store)
+            if (!filterProject) {
+                try {
+                    const federatedRows = await searchFederatedStores(phrenPath, {
+                        query,
+                        maxResults,
+                        fetchLimit,
+                        filterType,
+                    });
+                    if (federatedRows.length > 0) {
+                        // Dedup by path to avoid duplicates if stores share files
+                        const localPaths = new Set(rows.map((r) => r.path || `${r.project}/${r.filename}`));
+                        const uniqueFederated = federatedRows.filter((r) => {
+                            const key = r.path || `${r.project}/${r.filename}`;
+                            return !localPaths.has(key);
+                        });
+                        rows = [...rows, ...uniqueFederated];
+                    }
+                }
+                catch (err) {
+                    if (process.env.PHREN_DEBUG) {
+                        process.stderr.write(`[phren] search_knowledge federation: ${errorMessage(err)}\n`);
+                    }
+                }
+            }
+            if (rows.length === 0) {
                 logSearchMiss(phrenPath, query, filterProject);
                 return mcpResponse({ ok: true, message: "No results found.", data: { query, results: [] } });
             }
@@ -368,6 +394,7 @@ export function register(server, ctx) {
             const results = rows.map((row) => {
                 const snippet = extractSnippet(row.content, query);
                 const lifecycle = row.type === "findings" ? lifecycleByRowKey.get(findingRowKey(row)) : undefined;
+                const federationSource = "federationSource" in row ? row.federationSource : undefined;
                 return {
                     project: row.project,
                     filename: row.filename,
@@ -376,6 +403,7 @@ export function register(server, ctx) {
                     path: row.path,
                     status: lifecycle?.primaryStatus,
                     statuses: lifecycle?.statuses,
+                    ...(federationSource ? { federation_source: federationSource } : {}),
                 };
             });
             let relatedFragments = [];
@@ -396,7 +424,10 @@ export function register(server, ctx) {
                 if ((process.env.PHREN_DEBUG))
                     process.stderr.write(`[phren] fragment query: ${errorMessage(err)}\n`);
             }
-            const formatted = results.map((r) => `### ${r.project}/${r.filename} (${r.type})\n${r.snippet}\n\n\`${r.path}\``);
+            const formatted = results.map((r) => {
+                const fedNote = r.federation_source ? ` [from: ${r.federation_source}]` : "";
+                return `### ${r.project}/${r.filename} (${r.type})${fedNote}\n${r.snippet}\n\n\`${r.path}\``;
+            });
             // Memory synthesis: generate a concise paragraph from top results when requested
             let synthesis;
             if (synthesize && results.length > 0) {
@@ -576,7 +607,15 @@ export function register(server, ctx) {
         const visibleItems = includeHistory
             ? allItems
             : allItems.filter(f => f.tier !== "archived" && !HISTORY_FINDING_STATUSES.has(f.status));
-        const filteredItems = status ? visibleItems.filter(f => f.status === status) : visibleItems;
+        // Apply scope filter: only show findings visible to the active scope
+        const activeScope = resolveActiveSessionScope(phrenPath, project);
+        const scopedItems = activeScope
+            ? visibleItems.filter(f => {
+                const itemScope = normalizeMemoryScope(f.scope);
+                return isMemoryScopeVisible(itemScope, activeScope);
+            })
+            : visibleItems;
+        const filteredItems = status ? scopedItems.filter(f => f.status === status) : scopedItems;
         if (!filteredItems.length) {
             const msg = historyCount > 0 && !includeHistory
                 ? `No findings found for "${project}" with current filters. ${historyCount} historical finding(s) hidden. Pass include_history=true to show history.`

package/mcp/dist/mcp-session.js

@@ -124,6 +124,10 @@ function findMostRecentSession(phrenPath) {
     return { file: best.fullPath, state: best.data };
 }
 export function resolveActiveSessionScope(phrenPath, project) {
+    // PHREN_SCOPE env var takes priority over session-derived scope
+    const envScope = normalizeMemoryScope(process.env.PHREN_SCOPE);
+    if (envScope)
+        return envScope;
     const dir = sessionsDir(phrenPath);
     const results = scanSessionFiles(dir, readSessionStateFile, (state) => {
         if (state.endedAt)

package/mcp/dist/mcp-tasks.js

@@ -9,6 +9,7 @@ import { buildTaskIssueBody, createGithubIssueForTask, parseGithubIssueUrl, reso
 import { clearTaskCheckpoint } from "./session-checkpoints.js";
 import { incrementSessionTasksCompleted } from "./mcp-session.js";
 import { normalizeMemoryScope } from "./shared.js";
+import { permissionDeniedError } from "./governance-rbac.js";
 const TASK_SECTION_ORDER = ["Active", "Queue", "Done"];
 const DEFAULT_TASK_LIMIT = 20;
 /** Done items are historical — cap tightly by default to avoid large responses. */
@@ -206,6 +207,9 @@ export function register(server, ctx) {
     }, async ({ project, item, scope }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const addTaskDenied = permissionDeniedError(phrenPath, "add_task", project);
+        if (addTaskDenied)
+            return mcpResponse({ ok: false, error: addTaskDenied });
         const normalizedScope = normalizeMemoryScope(scope ?? "shared");
         if (!normalizedScope)
             return mcpResponse({ ok: false, error: `Invalid scope: "${scope}". Use lowercase letters/numbers with '-' or '_' (max 64 chars), e.g. "researcher".` });
@@ -227,6 +231,9 @@ export function register(server, ctx) {
     }, async ({ project, items }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const addTasksDenied = permissionDeniedError(phrenPath, "add_task", project);
+        if (addTasksDenied)
+            return mcpResponse({ ok: false, error: addTasksDenied });
         return withWriteQueue(async () => {
             const result = addTasksBatch(phrenPath, project, items);
             if (!result.ok)
@@ -248,6 +255,9 @@ export function register(server, ctx) {
     }, async ({ project, item, sessionId }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const completeTaskDenied = permissionDeniedError(phrenPath, "complete_task", project);
+        if (completeTaskDenied)
+            return mcpResponse({ ok: false, error: completeTaskDenied });
         return withWriteQueue(async () => {
             const before = resolveTaskItem(phrenPath, project, item);
             const result = completeTaskStore(phrenPath, project, item);
@@ -278,6 +288,9 @@ export function register(server, ctx) {
     }, async ({ project, items, sessionId }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const completeTasksDenied = permissionDeniedError(phrenPath, "complete_task", project);
+        if (completeTasksDenied)
+            return mcpResponse({ ok: false, error: completeTasksDenied });
         return withWriteQueue(async () => {
             const resolvedItems = items
                 .map((match) => {
@@ -319,6 +332,9 @@ export function register(server, ctx) {
     }, async ({ project, item }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const removeTaskDenied = permissionDeniedError(phrenPath, "remove_task", project);
+        if (removeTaskDenied)
+            return mcpResponse({ ok: false, error: removeTaskDenied });
         return withWriteQueue(async () => {
             const result = removeTaskStore(phrenPath, project, item);
             if (!result.ok)
@@ -337,6 +353,9 @@ export function register(server, ctx) {
     }, async ({ project, items }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const removeTasksDenied = permissionDeniedError(phrenPath, "remove_task", project);
+        if (removeTasksDenied)
+            return mcpResponse({ ok: false, error: removeTasksDenied });
         return withWriteQueue(async () => {
             const result = removeTasksBatch(phrenPath, project, items);
             if (!result.ok)
@@ -367,6 +386,9 @@ export function register(server, ctx) {
     }, async ({ project, item, updates }) => {
         if (!isValidProjectName(project))
             return mcpResponse({ ok: false, error: `Invalid project name: "${project}"` });
+        const updateTaskDenied = permissionDeniedError(phrenPath, "update_task", project);
+        if (updateTaskDenied)
+            return mcpResponse({ ok: false, error: updateTaskDenied });
         return withWriteQueue(async () => {
             const result = updateTaskStore(phrenPath, project, item, updates);
             if (!result.ok)