@phren/cli 0.0.28 → 0.0.33

package/mcp/dist/update.js

@@ -4,6 +4,7 @@ import { execFileSync } from "child_process";
 import { fileURLToPath } from "url";
 import { errorMessage } from "./utils.js";
 import { PACKAGE_NAME, PACKAGE_SPEC } from "./package-metadata.js";
+import { logger } from "./logger.js";
 function shellCommand(bin) {
     return process.platform === "win32" ? `${bin}.cmd` : bin;
 }
@@ -63,8 +64,7 @@ export async function runPhrenUpdate(opts = {}) {
                 }
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG))
-                    process.stderr.write(`[phren] runPhrenUpdate gitStatus: ${errorMessage(err)}\n`);
+                logger.debug("runPhrenUpdate gitStatus", errorMessage(err));
             }
             const pull = run("git", ["pull", "--rebase", "--autostash"], root);
             run(shellCommand("npm"), ["install"], root);

package/mcp/dist/utils.js

@@ -5,6 +5,28 @@ import * as yaml from "js-yaml";
 import { fileURLToPath } from "url";
 import { findPhrenPath } from "./phren-paths.js";
 import { bootstrapPhrenDotEnv } from "./phren-dotenv.js";
+// Lazy import of logDebug to break circular dependency:
+// utils.ts -> phren-paths.ts -> logger.ts -> phren-paths.ts -> utils.ts
+let _logDebug;
+async function ensureLogDebug() {
+    if (!_logDebug) {
+        try {
+            const mod = await import("./logger.js");
+            _logDebug = mod.logger.debug;
+        }
+        catch {
+            _logDebug = () => { };
+        }
+    }
+}
+function getLogDebug() {
+    if (!_logDebug) {
+        // Kick off the async import for future calls; fall back to no-op for this call
+        void ensureLogDebug();
+        return () => { };
+    }
+    return _logDebug;
+}
 const _moduleDir = path.dirname(fileURLToPath(import.meta.url));
 function loadSynonymsJson(fileName) {
     const filePath = path.join(_moduleDir, fileName);
@@ -12,8 +34,7 @@ function loadSynonymsJson(fileName) {
         return JSON.parse(fs.readFileSync(filePath, "utf8"));
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG))
-            process.stderr.write(`[phren] ${fileName} load failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        getLogDebug()("loadSynonymsJson", `${fileName} load failed: ${err instanceof Error ? err.message : String(err)}`);
         return {};
     }
 }
@@ -148,7 +169,7 @@ export const STOP_WORDS = new Set([
 export function extractKeywordEntries(text) {
     const words = text
         .toLowerCase()
-        .replace(/[^\w\s-]/g, " ")
+        .replace(/[^\p{L}\p{N}\s_-]/gu, " ")
         .split(/\s+/)
         .filter(w => w.length > 1 && !STOP_WORDS.has(w));
     // Build bigrams from adjacent non-stop-words
@@ -233,26 +254,27 @@ export function queueFilePath(phrenPath, project) {
     }
     return result;
 }
+const MAX_FTS_QUERY_LENGTH = 500;
 // Sanitize user input before passing it to an FTS5 MATCH expression.
 // Strips FTS5-specific syntax that could cause injection or parse errors.
 export function sanitizeFts5Query(raw) {
     if (!raw)
         return "";
-    if (raw.length > 500)
-        raw = raw.slice(0, 500);
-    // Whitelist approach: only allow alphanumeric, spaces, hyphens, apostrophes, double quotes, asterisks
-    let q = raw.replace(/[^a-zA-Z0-9 \-"*]/g, " ");
-    q = q.replace(/\s+/g, " ");
-    q = q.trim();
-    // Q83: FTS5 only accepts * as a prefix operator directly attached to a token
-    // (e.g. "foo*").  A bare trailing asterisk (or lone "*") produces invalid
-    // FTS5 syntax.  Strip any asterisk that is not immediately preceded by a
-    // word character so the query remains valid.
+    if (raw.length > MAX_FTS_QUERY_LENGTH)
+        raw = raw.slice(0, MAX_FTS_QUERY_LENGTH);
+    // Whitelist approach: only allow alphanumeric, spaces, hyphens, apostrophes, asterisks
+    let q = raw.replace(/[^\p{L}\p{N} \-"*]/gu, " ");
+    // Strip all double quotes — buildFtsClauses wraps terms in quotes itself,
+    // so user-supplied quotes only risk producing unbalanced FTS5 syntax.
+    q = q.replace(/"/g, "");
+    // Q83: see docs/decisions/Q83-fts5-asterisk-validation.md
     q = q.replace(/(?<!\w)\*/g, "");
     // Also strip a trailing asterisk that is preceded only by whitespace at word
     // end of the whole query (handles "foo *" → "foo").
     q = q.replace(/\s+\*$/g, "");
-    return q.trim();
+    // Normalize spaces after all stripping to avoid double spaces from removed characters
+    q = q.replace(/\s+/g, " ").trim();
+    return q;
 }
 function parseSynonymsYaml(filePath) {
     if (!fs.existsSync(filePath))
@@ -276,8 +298,7 @@ function parseSynonymsYaml(filePath) {
         return loaded;
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG))
-            process.stderr.write(`[phren] synonyms.yaml parse failed (${filePath}): ${err instanceof Error ? err.message : String(err)}\n`);
+        getLogDebug()("parseSynonymsYaml", `synonyms.yaml parse failed (${filePath}): ${err instanceof Error ? err.message : String(err)}`);
         return {};
     }
 }
@@ -315,8 +336,7 @@ function parseLearnedSynonymsJson(filePath) {
         return loaded;
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG))
-            process.stderr.write(`[phren] learned-synonyms parse failed (${filePath}): ${err instanceof Error ? err.message : String(err)}\n`);
+        getLogDebug()("parseLearnedSynonymsJson", `learned-synonyms parse failed (${filePath}): ${err instanceof Error ? err.message : String(err)}`);
         return {};
     }
 }
@@ -512,8 +532,21 @@ export function buildRobustFtsQuery(raw, project, phrenPath) {
 // nothing; it trades precision for recall while staying in the FTS index.
 export function buildRelaxedFtsQuery(raw, project, phrenPath) {
     const clauses = buildFtsClauses(raw, project, phrenPath);
-    if (clauses.length < 3)
+    if (clauses.length === 0)
         return "";
+    // Short queries (1-2 terms): OR the clauses together with prefix expansion
+    if (clauses.length === 1) {
+        const term = clauses[0];
+        // Add prefix wildcard for unquoted-style terms to broaden recall
+        const inner = term.replace(/^"(.*)"$/, "$1");
+        if (inner.length >= 3) {
+            return `(${term} OR "${inner}"*)`;
+        }
+        return term;
+    }
+    if (clauses.length === 2) {
+        return `(${clauses[0]} OR ${clauses[1]})`;
+    }
     const salientClauses = clauses
         .map((clause, index) => ({ clause, index, score: clauseSignalScore(clause) }))
         .sort((a, b) => {
@@ -539,5 +572,16 @@ export function buildFtsQueryVariants(raw, project, phrenPath) {
         buildRobustFtsQuery(raw, project, phrenPath),
         buildRelaxedFtsQuery(raw, project, phrenPath),
     ].filter(Boolean);
+    // For short queries, add a prefix-expanded variant to catch partial matches
+    const clauses = buildFtsClauses(raw, project, phrenPath);
+    if (clauses.length <= 2) {
+        const prefixParts = clauses
+            .map(c => c.replace(/^"(.*)"$/, "$1"))
+            .filter(t => t.length >= 3)
+            .map(t => `"${t}"*`);
+        if (prefixParts.length > 0) {
+            variants.push(prefixParts.join(" OR "));
+        }
+    }
     return [...new Set(variants)];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phren/cli",
-  "version": "0.0.28",
+  "version": "0.0.33",
   "description": "Knowledge layer for AI agents. Phren learns and recalls.",
   "type": "module",
   "bin": {
@@ -16,7 +16,6 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "chalk": "^5.6.2",
-    "esbuild": "^0.27.4",
     "glob": "^13.0.6",
     "graphology": "^0.26.0",
     "graphology-layout-forceatlas2": "^0.10.1",
@@ -27,6 +26,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "esbuild": "^0.27.4",
     "@playwright/test": "^1.58.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.5.0",

package/scripts/preuninstall.mjs

@@ -105,4 +105,35 @@ if (fs.existsSync(copilotHooks)) {
   try { fs.unlinkSync(copilotHooks); } catch { /* best-effort */ }
 }
 
+// ── Codex MCP config (TOML + JSON) ──
+const codexToml = homePath(".codex", "config.toml");
+if (fs.existsSync(codexToml)) {
+  try {
+    const content = fs.readFileSync(codexToml, "utf8");
+    // Remove [mcp_servers.phren] section
+    const cleaned = content.replace(/\[mcp_servers\.phren\][^\[]*/, "").trim();
+    if (cleaned !== content.trim()) fs.writeFileSync(codexToml, cleaned + "\n");
+  } catch { /* best-effort */ }
+}
+
+// ── Session wrapper scripts ──
+const localBinDir = homePath(".local", "bin");
+for (const tool of ["copilot", "cursor", "codex"]) {
+  const wrapperPath = path.join(localBinDir, tool);
+  try {
+    if (fs.existsSync(wrapperPath)) {
+      const content = fs.readFileSync(wrapperPath, "utf8");
+      if (content.includes("PHREN_PATH") && content.includes("phren")) {
+        fs.unlinkSync(wrapperPath);
+      }
+    }
+  } catch { /* best-effort */ }
+}
+
+// ── Machine context file ──
+const contextFile = homePath(".phren-context.md");
+if (fs.existsSync(contextFile)) {
+  try { fs.unlinkSync(contextFile); } catch { /* best-effort */ }
+}
+
 console.log("phren: cleaned up hooks and MCP config from agent settings.");

package/starter/global/CLAUDE.md

@@ -19,9 +19,10 @@ These skills are available as a full set via phren, or individually from the Cla
 | Skill | What it does |
 |-------|-------------|
 | `/phren-sync` | Pull phren to a new machine or push config changes back to the repo |
-| `/phren-init` | Scaffold a new project with summary, CLAUDE.md, task |
+| `/phren-init` | Scaffold a new project with summary, CLAUDE.md, tasks |
 | `/phren-discover` | Research what's missing in a project and surface gaps and opportunities |
 | `/phren-consolidate` | Find patterns across all project FINDINGS.md files |
+| `/phren-profiles` | Manages machine-to-profile mapping |
 
 ### Your own skills
 
@@ -48,7 +49,7 @@ In shared mode, skills and project config live in `~/.phren` (or wherever `PHREN
 If you're using `phren init --mode project-local`, the root is `<repo>/.phren` instead. Project-local mode does not use profiles, machine mappings, or global hooks.
 
 - `~/.phren/global/`: skills and config that apply everywhere
-- `~/.phren/<project>/`: per-project CLAUDE.md, skills, task, findings
+- `~/.phren/<project>/`: per-project CLAUDE.md, skills, tasks, findings
 - `~/.phren/profiles/`: YAML files mapping project sets to machine roles
 - `~/.phren/machines.yaml`: maps machine hostnames to profiles
 

package/mcp/dist/governance-audit.js

@@ -1,22 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-import { debugLog } from "./shared.js";
-import { errorMessage } from "./utils.js";
-export function recordRetrieval(phrenPath, file, section) {
-    const dir = path.join(phrenPath, ".runtime");
-    fs.mkdirSync(dir, { recursive: true });
-    const logPath = path.join(dir, "retrieval-log.jsonl");
-    const entry = { file, section, retrievedAt: new Date().toISOString() };
-    fs.appendFileSync(logPath, JSON.stringify(entry) + "\n");
-    try {
-        const stat = fs.statSync(logPath);
-        if (stat.size > 500_000) {
-            const content = fs.readFileSync(logPath, "utf8");
-            const lines = content.split("\n").filter(Boolean);
-            fs.writeFileSync(logPath, lines.slice(-1000).join("\n") + "\n");
-        }
-    }
-    catch (err) {
-        debugLog(`recordRetrieval rotation failed: ${errorMessage(err)}`);
-    }
-}