claude-self-reflect 2.3.2 → 2.3.3

package/README.md

@@ -2,6 +2,22 @@
 
 Claude forgets everything. This fixes that.
 
+## 🔒 Security & Privacy Notice
+
+**v2.3.3 Security Update**: This version addresses critical security vulnerabilities. Please update immediately.
+
+### Privacy Modes
+- **Local Mode (Default)**: Your conversations stay on your machine. No external API calls.
+- **Cloud Mode**: Uses Voyage AI for better search accuracy. Conversations are sent to Voyage for embedding generation.
+
+### Security Improvements in v2.3.3
+- ✅ Removed all hardcoded API keys
+- ✅ Fixed command injection vulnerabilities 
+- ✅ Patched vulnerable dependencies
+- ✅ Local embeddings by default for privacy
+
+**Important**: If using cloud mode, review [Voyage AI's privacy policy](https://www.voyageai.com/privacy) to understand how your data is handled.
+
 ## What You Get
 
 Ask Claude about past conversations. Get actual answers.
@@ -13,28 +29,30 @@ Your conversations become searchable. Your decisions stay remembered. Your conte
 
 ## Install
 
-### Quick Start (Recommended)
+### Quick Start (Local Mode - Default)
 ```bash
-# Step 1: Get your free Voyage AI key
-# Sign up at https://www.voyageai.com/ - it takes 30 seconds
-
-# Step 2: Install and run automatic setup
+# Install and run automatic setup
 npm install -g claude-self-reflect
-claude-self-reflect setup --voyage-key=YOUR_ACTUAL_KEY_HERE
+claude-self-reflect setup
 
 # That's it! The setup will:
 # ✅ Configure everything automatically
 # ✅ Install the MCP in Claude Code  
 # ✅ Start monitoring for new conversations
 # ✅ Verify the reflection tools work
+# 🔒 Keep all data local - no API keys needed
 ```
 
-### Alternative: Local Mode (No API Key)
+### Cloud Mode (Better Search Accuracy)
 ```bash
+# Step 1: Get your free Voyage AI key
+# Sign up at https://www.voyageai.com/ - it takes 30 seconds
+
+# Step 2: Install with Voyage key
 npm install -g claude-self-reflect
-claude-self-reflect setup --local
+claude-self-reflect setup --voyage-key=YOUR_ACTUAL_KEY_HERE
 ```
-*Note: Local mode uses basic embeddings. Semantic search won't be as good.*
+*Note: Cloud mode provides more accurate semantic search but sends conversation data to Voyage AI for processing.*
 
 5 minutes. Everything automatic. Just works.
 

package/installer/setup-wizard.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { execSync, spawn } from 'child_process';
+import { execSync, spawn, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import fs from 'fs/promises';
@@ -11,20 +11,42 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const projectRoot = join(__dirname, '..');
 
+// Safe command execution helper
+function safeExec(command, args = [], options = {}) {
+  const result = spawnSync(command, args, {
+    ...options,
+    shell: false // Never use shell to prevent injection
+  });
+  
+  if (result.error) {
+    throw result.error;
+  }
+  
+  if (result.status !== 0) {
+    const error = new Error(`Command failed: ${command} ${args.join(' ')}`);
+    error.stdout = result.stdout;
+    error.stderr = result.stderr;
+    error.status = result.status;
+    throw error;
+  }
+  
+  return result.stdout?.toString() || '';
+}
+
 // Parse command line arguments
 const args = process.argv.slice(2);
 let voyageKey = null;
-let localMode = false;
 let mcpConfigured = false;
 
 for (const arg of args) {
   if (arg.startsWith('--voyage-key=')) {
     voyageKey = arg.split('=')[1];
-  } else if (arg === '--local') {
-    localMode = true;
   }
 }
 
+// Default to local mode unless Voyage key is provided
+let localMode = !voyageKey;
+
 const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
 
 const rl = isInteractive ? readline.createInterface({
@@ -43,31 +65,39 @@ const question = (query) => {
 async function checkPython() {
   console.log('\n📦 Checking Python installation...');
   try {
-    const version = execSync('python3 --version').toString().trim();
+    const version = safeExec('python3', ['--version']).trim();
     console.log(`✅ Found ${version}`);
     
     // Check if SSL module works
     try {
-      execSync('python3 -c "import ssl"', { stdio: 'pipe' });
+      safeExec('python3', ['-c', 'import ssl'], { stdio: 'pipe' });
       return true;
     } catch (sslError) {
       console.log('⚠️  Python SSL module not working');
       
       // Check if we're using pyenv
-      const whichPython = execSync('which python3').toString().trim();
+      const whichPython = safeExec('which', ['python3']).trim();
       if (whichPython.includes('pyenv')) {
         console.log('🔍 Detected pyenv Python with broken SSL');
         
         // Check if brew Python is available
         try {
-          const brewPrefix = execSync('brew --prefix python@3.11 2>/dev/null || brew --prefix python@3.10 2>/dev/null || brew --prefix python@3.12 2>/dev/null', { shell: true }).toString().trim();
+          let brewPrefix = '';
+          for (const pythonVersion of ['python@3.11', 'python@3.10', 'python@3.12']) {
+            try {
+              brewPrefix = safeExec('brew', ['--prefix', pythonVersion]).trim();
+              if (brewPrefix) break;
+            } catch {}
+          }
           if (brewPrefix) {
             // Find the actual python executable
             let pythonPath = null;
             for (const exe of ['python3.11', 'python3.10', 'python3.12', 'python3']) {
               try {
                 const fullPath = `${brewPrefix}/bin/${exe}`;
-                execSync(`test -f ${fullPath}`);
+                // Use fs.existsSync instead of shell test command
+                const { existsSync } = await import('fs');
+                if (!existsSync(fullPath)) throw new Error('File not found');
                 pythonPath = fullPath;
                 break;
               } catch {}
@@ -77,7 +107,7 @@ async function checkPython() {
               console.log(`✅ Found brew Python at ${pythonPath}`);
               // Test if SSL works with brew Python
               try {
-                execSync(`${pythonPath} -c "import ssl"`, { stdio: 'pipe' });
+                safeExec(pythonPath, ['-c', 'import ssl'], { stdio: 'pipe' });
                 process.env.PYTHON_PATH = pythonPath;
                 return true;
               } catch {
@@ -89,8 +119,8 @@ async function checkPython() {
         
         console.log('\n🔧 Attempting to install Python with brew...');
         try {
-          execSync('brew install python@3.11', { stdio: 'inherit' });
-          const brewPython = execSync('brew --prefix python@3.11').toString().trim();
+          safeExec('brew', ['install', 'python@3.11'], { stdio: 'inherit' });
+          const brewPython = safeExec('brew', ['--prefix', 'python@3.11']).trim();
           process.env.PYTHON_PATH = `${brewPython}/bin/python3`;
           console.log('✅ Installed Python 3.11 with brew');
           return true;
@@ -110,7 +140,7 @@ async function checkPython() {
 
 async function checkDocker() {
   try {
-    execSync('docker info', { stdio: 'ignore' });
+    safeExec('docker', ['info'], { stdio: 'ignore' });
     return true;
   } catch {
     return false;
@@ -152,15 +182,15 @@ async function checkQdrant() {
     try {
       // Check if a container named 'qdrant' already exists
       try {
-        execSync('docker container inspect qdrant', { stdio: 'ignore' });
+        safeExec('docker', ['container', 'inspect', 'qdrant'], { stdio: 'ignore' });
         console.log('Removing existing Qdrant container...');
-        execSync('docker rm -f qdrant', { stdio: 'ignore' });
+        safeExec('docker', ['rm', '-f', 'qdrant'], { stdio: 'ignore' });
       } catch {
         // Container doesn't exist, which is fine
       }
       
       console.log('Starting Qdrant...');
-      execSync('docker run -d --name qdrant -p 6333:6333 -v qdrant_storage:/qdrant/storage qdrant/qdrant:latest', { stdio: 'inherit' });
+      safeExec('docker', ['run', '-d', '--name', 'qdrant', '-p', '6333:6333', '-v', 'qdrant_storage:/qdrant/storage', 'qdrant/qdrant:latest'], { stdio: 'inherit' });
       
       // Wait for Qdrant to be ready
       console.log('Waiting for Qdrant to start...');
@@ -181,7 +211,9 @@ async function checkQdrant() {
             console.log(`   Still waiting... (${retries} seconds left)`);
             // Check if container is still running
             try {
-              execSync('docker ps | grep qdrant', { stdio: 'pipe' });
+              // Check if container is running without using shell pipes
+              const psOutput = safeExec('docker', ['ps', '--filter', 'name=qdrant', '--format', '{{.Names}}'], { stdio: 'pipe' });
+              if (!psOutput.includes('qdrant')) throw new Error('Container not running');
             } catch {
               console.log('❌ Qdrant container stopped unexpectedly');
               return false;
@@ -226,11 +258,22 @@ async function setupPythonEnvironment() {
       console.log('Creating virtual environment...');
       const pythonCmd = process.env.PYTHON_PATH || 'python3';
       try {
-        execSync(`cd "${mcpPath}" && ${pythonCmd} -m venv venv`, { stdio: 'inherit' });
+        // Use spawn with proper path handling instead of shell execution
+        const { spawnSync } = require('child_process');
+        const result = spawnSync(pythonCmd, ['-m', 'venv', 'venv'], {
+          cwd: mcpPath,
+          stdio: 'inherit'
+        });
+        if (result.error) throw result.error;
       } catch (venvError) {
         console.log('⚠️  Failed to create venv with python3, trying python...');
         try {
-          execSync(`cd "${mcpPath}" && python -m venv venv`, { stdio: 'inherit' });
+          const { spawnSync } = require('child_process');
+          const result = spawnSync('python', ['-m', 'venv', 'venv'], {
+            cwd: mcpPath,
+            stdio: 'inherit'
+          });
+          if (result.error) throw result.error;
         } catch {
           console.log('❌ Failed to create virtual environment');
           console.log('📚 Fix: Install python3-venv package');
@@ -241,19 +284,21 @@ async function setupPythonEnvironment() {
       }
     }
     
-    // Activate and upgrade pip first to avoid SSL issues
+    // Setup paths for virtual environment
     console.log('Setting up pip in virtual environment...');
-    const activateCmd = process.platform === 'win32' 
-      ? 'venv\\Scripts\\activate' 
-      : 'source venv/bin/activate';
+    const venvPython = process.platform === 'win32'
+      ? join(mcpPath, 'venv', 'Scripts', 'python.exe')
+      : join(mcpPath, 'venv', 'bin', 'python');
+    const venvPip = process.platform === 'win32'
+      ? join(mcpPath, 'venv', 'Scripts', 'pip.exe')
+      : join(mcpPath, 'venv', 'bin', 'pip');
     
     // First, try to install certifi to help with SSL issues
     console.log('Installing certificate handler...');
     try {
-      execSync(`cd "${mcpPath}" && ${activateCmd} && pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org certifi`, { 
-        stdio: 'pipe',
-        shell: true 
-      });
+      safeExec(venvPip, [
+        'install', '--trusted-host', 'pypi.org', '--trusted-host', 'files.pythonhosted.org', 'certifi'
+      ], { cwd: mcpPath, stdio: 'pipe' });
     } catch {
       // Continue even if certifi fails
     }
@@ -261,10 +306,9 @@ async function setupPythonEnvironment() {
     // Upgrade pip and install wheel first
     try {
       // Use --no-cache-dir and --timeout to fail faster
-      execSync(`cd "${mcpPath}" && ${activateCmd} && python -m pip install --no-cache-dir --timeout 5 --retries 1 --upgrade pip wheel setuptools`, { 
-        stdio: 'pipe',
-        shell: true 
-      });
+      safeExec(venvPython, [
+        '-m', 'pip', 'install', '--no-cache-dir', '--timeout', '5', '--retries', '1', '--upgrade', 'pip', 'wheel', 'setuptools'
+      ], { cwd: mcpPath, stdio: 'pipe' });
       console.log('✅ Pip upgraded successfully');
     } catch {
       // If upgrade fails due to SSL, skip it and continue
@@ -274,10 +318,9 @@ async function setupPythonEnvironment() {
     // Now install dependencies
     console.log('Installing MCP server dependencies...');
     try {
-      execSync(`cd "${mcpPath}" && ${activateCmd} && pip install --no-cache-dir --timeout 10 --retries 1 -e .`, { 
-        stdio: 'pipe',
-        shell: true 
-      });
+      safeExec(venvPip, [
+        'install', '--no-cache-dir', '--timeout', '10', '--retries', '1', '-e', '.'
+      ], { cwd: mcpPath, stdio: 'pipe' });
       console.log('✅ MCP server dependencies installed');
     } catch (error) {
       // Check for SSL errors
@@ -286,29 +329,31 @@ async function setupPythonEnvironment() {
         console.log('⚠️  SSL error detected. Attempting automatic fix...');
         
         // Try different approaches to fix SSL
-        const fixes = [
+        const sslFixes = [
           {
             name: 'Using trusted host flags',
-            cmd: `${activateCmd} && pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org --no-cache-dir -e .`
+            install: () => safeExec(venvPip, [
+              'install', '--trusted-host', 'pypi.org', '--trusted-host', 'files.pythonhosted.org',
+              '--no-cache-dir', '-e', '.'
+            ], { cwd: mcpPath, stdio: 'pipe' })
           },
           {
             name: 'Using index-url without SSL',
-            cmd: `${activateCmd} && pip config set global.index-url https://pypi.org/simple/ && pip config set global.trusted-host "pypi.org files.pythonhosted.org" && pip install --no-cache-dir -e .`
-          },
-          {
-            name: 'Using system certificates',
-            cmd: `${activateCmd} && export SSL_CERT_FILE=$(python -m certifi) && pip install --no-cache-dir -e .`
+            install: () => {
+              safeExec(venvPip, ['config', 'set', 'global.index-url', 'https://pypi.org/simple/'], 
+                { cwd: mcpPath, stdio: 'pipe' });
+              safeExec(venvPip, ['config', 'set', 'global.trusted-host', 'pypi.org files.pythonhosted.org'], 
+                { cwd: mcpPath, stdio: 'pipe' });
+              return safeExec(venvPip, ['install', '--no-cache-dir', '-e', '.'], 
+                { cwd: mcpPath, stdio: 'pipe' });
+            }
           }
         ];
         
-        for (const fix of fixes) {
+        for (const fix of sslFixes) {
           console.log(`\n   Trying: ${fix.name}...`);
           try {
-            execSync(`cd "${mcpPath}" && ${fix.cmd}`, { 
-              stdio: 'pipe',
-              shell: true,
-              env: { ...process.env, PYTHONWARNINGS: 'ignore:Unverified HTTPS request' }
-            });
+            fix.install();
             console.log('   ✅ Success! Dependencies installed using workaround');
             return true;
           } catch (e) {
@@ -327,17 +372,16 @@ async function setupPythonEnvironment() {
     // Install script dependencies
     console.log('Installing import script dependencies...');
     try {
-      execSync(`cd "${mcpPath}" && ${activateCmd} && pip install -r "${scriptsPath}/requirements.txt"`, { 
-        stdio: 'inherit',
-        shell: true 
-      });
+      safeExec(venvPip, [
+        'install', '-r', join(scriptsPath, 'requirements.txt')
+      ], { cwd: mcpPath, stdio: 'inherit' });
     } catch (error) {
       // Try with trusted host if SSL error
       try {
-        execSync(`cd "${mcpPath}" && ${activateCmd} && pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org -r "${scriptsPath}/requirements.txt"`, { 
-          stdio: 'inherit',
-          shell: true 
-        });
+        safeExec(venvPip, [
+          'install', '--trusted-host', 'pypi.org', '--trusted-host', 'files.pythonhosted.org',
+          '-r', join(scriptsPath, 'requirements.txt')
+        ], { cwd: mcpPath, stdio: 'inherit' });
       } catch {
         console.log('⚠️  Could not install script dependencies automatically');
         console.log('   You may need to install them manually later');
@@ -446,6 +490,9 @@ async function configureEnvironment() {
   if (!envContent.includes('DECAY_SCALE_DAYS=')) {
     envContent += 'DECAY_SCALE_DAYS=90\n';
   }
+  if (!envContent.includes('PREFER_LOCAL_EMBEDDINGS=')) {
+    envContent += `PREFER_LOCAL_EMBEDDINGS=${localMode ? 'true' : 'false'}\n`;
+  }
   
   await fs.writeFile(envPath, envContent.trim() + '\n');
   console.log('✅ Environment file created/updated');
@@ -460,7 +507,7 @@ async function setupClaude() {
   
   // Check if Claude CLI is available
   try {
-    execSync('which claude', { stdio: 'ignore' });
+    safeExec('which', ['claude'], { stdio: 'ignore' });
     
     // Try to add the MCP automatically
     try {
@@ -479,7 +526,16 @@ async function setupClaude() {
         ? `claude mcp add claude-self-reflect "${runScript}" -e QDRANT_URL="http://localhost:6333"`
         : `claude mcp add claude-self-reflect "${runScript}" -e VOYAGE_KEY="${voyageKeyValue}" -e QDRANT_URL="http://localhost:6333"`;
       
-      execSync(mcpCommand, { stdio: 'inherit' });
+      // Parse the MCP command properly
+      const mcpArgs = ['mcp', 'add', 'claude-self-reflect', runScript];
+      if (voyageKeyValue) {
+        mcpArgs.push('-e', `VOYAGE_KEY=${voyageKeyValue}`);
+      }
+      mcpArgs.push('-e', 'QDRANT_URL=http://localhost:6333');
+      if (localMode) {
+        mcpArgs.push('-e', 'PREFER_LOCAL_EMBEDDINGS=true');
+      }
+      safeExec('claude', mcpArgs, { stdio: 'inherit' });
       console.log('✅ MCP added successfully!');
       console.log('\n⚠️  You may need to restart Claude Code for the changes to take effect.');
       
@@ -540,7 +596,8 @@ async function showPreSetupInstructions() {
   console.log('📋 Before we begin, you\'ll need:');
   console.log('   1. Docker Desktop installed and running');
   console.log('   2. Python 3.10 or higher');
-  console.log('   3. A Voyage AI API key (we\'ll help you get one)\n');
+  console.log('\n🔒 By default, we use local embeddings (private but less accurate)');
+  console.log('   For better accuracy, run with: --voyage-key=<your-key>\n');
   
   if (isInteractive) {
     await question('Press Enter to continue...');
@@ -549,12 +606,7 @@ async function showPreSetupInstructions() {
 
 async function importConversations() {
   console.log('\n📚 Import Claude Conversations...');
-  
-  // Skip import in local mode
-  if (localMode) {
-    console.log('🏠 Skipping import in local mode (no API key for embeddings)');
-    return;
-  }
+  console.log(localMode ? '🏠 Using local embeddings for import' : '🌐 Using Voyage AI embeddings');
   
   // Check if Claude logs directory exists
   const logsDir = join(process.env.HOME || process.env.USERPROFILE, '.claude', 'projects');
@@ -694,7 +746,7 @@ async function showSystemDashboard() {
   
   // Docker status
   try {
-    execSync('docker info', { stdio: 'ignore' });
+    safeExec('docker', ['info'], { stdio: 'ignore' });
     status.docker = true;
   } catch {}
   
@@ -710,7 +762,7 @@ async function showSystemDashboard() {
   // Python status
   try {
     const pythonCmd = process.env.PYTHON_PATH || 'python3';
-    execSync(`${pythonCmd} --version`, { stdio: 'ignore' });
+    safeExec(pythonCmd, ['--version'], { stdio: 'ignore' });
     status.python = true;
   } catch {}
   
@@ -773,9 +825,9 @@ async function showSystemDashboard() {
   status.watcherErrors = [];
   status.lastImportTime = null;
   try {
-    const watcherLogs = execSync('docker logs claude-reflection-watcher --tail 50 2>&1', {
-      encoding: 'utf-8'
-    }).toString();
+    const watcherLogs = safeExec('docker', [
+      'logs', 'claude-reflection-watcher', '--tail', '50'
+    ], { encoding: 'utf-8' });
     
     // Check for recent errors
     const errorMatches = watcherLogs.match(/ERROR.*Import failed.*/g);
@@ -800,10 +852,9 @@ async function showSystemDashboard() {
     
     // Check if watcher is running via Docker
     try {
-      const dockerStatus = execSync('docker ps --filter "name=claude-reflection-watcher" --format "{{.Names}}" 2>/dev/null', {
-        cwd: projectRoot,
-        encoding: 'utf-8'
-      }).toString().trim();
+      const dockerStatus = safeExec('docker', [
+        'ps', '--filter', 'name=claude-reflection-watcher', '--format', '{{.Names}}'
+      ], { cwd: projectRoot, encoding: 'utf-8' }).trim();
       
       if (dockerStatus.includes('watcher')) {
         status.watcherRunning = true;
@@ -901,11 +952,8 @@ async function setupWatcher() {
     await fs.access(watcherScript);
     console.log('✅ Watcher script found');
     
-    // Skip in local mode
-    if (localMode) {
-      console.log('🏠 Skipping watcher in local mode');
-      return;
-    }
+    // Watcher works with both local and cloud embeddings
+    console.log(localMode ? '🏠 Watcher will use local embeddings' : '🌐 Watcher will use Voyage AI embeddings');
     
     // Ask if user wants to enable watcher
     let enableWatcher = 'y';
@@ -933,20 +981,26 @@ async function setupWatcher() {
           console.log('🧹 Cleaning up existing containers...');
           try {
             // Stop all claude-reflection containers
-            execSync('docker compose down 2>/dev/null || true', { 
-              cwd: projectRoot,
-              stdio: 'pipe' 
-            });
+            try {
+              safeExec('docker', ['compose', 'down'], { 
+                cwd: projectRoot,
+                stdio: 'pipe' 
+              });
+            } catch {}
             
             // Also stop any standalone containers
-            execSync('docker stop claude-reflection-watcher claude-reflection-qdrant qdrant 2>/dev/null || true', { 
-              stdio: 'pipe' 
-            });
+            try {
+              safeExec('docker', ['stop', 'claude-reflection-watcher', 'claude-reflection-qdrant', 'qdrant'], { 
+                stdio: 'pipe' 
+              });
+            } catch {}
             
             // Remove them
-            execSync('docker rm claude-reflection-watcher claude-reflection-qdrant qdrant 2>/dev/null || true', { 
-              stdio: 'pipe' 
-            });
+            try {
+              safeExec('docker', ['rm', 'claude-reflection-watcher', 'claude-reflection-qdrant', 'qdrant'], { 
+                stdio: 'pipe' 
+              });
+            } catch {}
             
             // Wait a moment for cleanup
             await new Promise(resolve => setTimeout(resolve, 2000));
@@ -954,7 +1008,7 @@ async function setupWatcher() {
           
           // Start both services with compose
           console.log('🚀 Starting Qdrant and Watcher services...');
-          execSync('docker compose --profile watch up -d', { 
+          safeExec('docker', ['compose', '--profile', 'watch', 'up', '-d'], { 
             cwd: projectRoot,
             stdio: 'pipe' // Use pipe to capture output 
           });
@@ -964,10 +1018,9 @@ async function setupWatcher() {
           
           // Check container status
           try {
-            const psOutput = execSync('docker ps --filter "name=claude-reflection" --format "table {{.Names}}\t{{.Status}}"', {
-              cwd: projectRoot,
-              encoding: 'utf8'
-            });
+            const psOutput = safeExec('docker', [
+              'ps', '--filter', 'name=claude-reflection', '--format', 'table {{.Names}}\t{{.Status}}'
+            ], { cwd: projectRoot, encoding: 'utf8' });
             
             const qdrantReady = psOutput.includes('claude-reflection-qdrant') && psOutput.includes('Up');
             const watcherReady = psOutput.includes('claude-reflection-watcher') && psOutput.includes('Up');
@@ -1033,7 +1086,7 @@ async function verifyMCP() {
   
   try {
     // Check if MCP is listed
-    const mcpList = execSync('claude mcp list', { encoding: 'utf8' });
+    const mcpList = safeExec('claude', ['mcp', 'list'], { encoding: 'utf8' });
     if (!mcpList.includes('claude-self-reflect')) {
       console.log('❌ MCP not found in Claude Code');
       return;
@@ -1103,10 +1156,15 @@ asyncio.run(test_mcp())
     // Run the test
     console.log('\n🧪 Testing MCP functionality...');
     try {
-      const testResult = execSync(`cd "${projectRoot}" && source mcp-server/venv/bin/activate && python test-mcp.py`, {
-        encoding: 'utf8',
-        shell: '/bin/bash'
+      // Create test script that activates venv and runs test
+      const testScriptPath = join(projectRoot, 'run-test.sh');
+      const testScript = `#!/bin/bash\nsource mcp-server/venv/bin/activate\npython test-mcp.py`;
+      await fs.writeFile(testScriptPath, testScript, { mode: 0o755 });
+      const testResult = safeExec('bash', [testScriptPath], {
+        cwd: projectRoot,
+        encoding: 'utf8'
       });
+      await fs.unlink(testScriptPath);
       console.log(testResult);
       
       // Clean up test script
@@ -1151,14 +1209,9 @@ async function main() {
     }
   }
   
-  // Check for non-interactive mode without required flags
-  if (!isInteractive && !voyageKey && !localMode) {
-    console.log('❌ Non-interactive mode requires either --voyage-key or --local flag\n');
-    console.log('Usage:');
-    console.log('  claude-self-reflect setup --voyage-key=<your-key>');
-    console.log('  claude-self-reflect setup --local\n');
-    console.log('Get your free API key at: https://www.voyageai.com/');
-    process.exit(1);
+  // In non-interactive mode, just use defaults (local mode unless key provided)
+  if (!isInteractive) {
+    console.log(voyageKey ? '🌐 Using Voyage AI embeddings' : '🔒 Using local embeddings for privacy');
   }
   
   await showPreSetupInstructions();

package/mcp-server/pyproject.toml

@@ -9,11 +9,12 @@ authors = [
 ]
 dependencies = [
     "fastmcp>=0.0.7",
-    "qdrant-client>=1.7.0",
-    "voyageai>=0.1.0",
-    "python-dotenv>=1.0.0",
-    "pydantic>=2.0.0",
-    "pydantic-settings>=2.0.0",
+    "qdrant-client>=1.7.0,<2.0.0",
+    "voyageai>=0.1.0,<1.0.0",
+    "python-dotenv>=1.0.0,<2.0.0",
+    "pydantic>=2.9.2,<3.0.0",  # Pin to avoid CVE-2024-3772
+    "pydantic-settings>=2.0.0,<3.0.0",
+    "fastembed>=0.4.0,<1.0.0",
 ]
 
 [project.scripts]

package/mcp-server/src/server.py

@@ -1,6 +1,7 @@
 """Claude Reflect MCP Server with Memory Decay."""
 
 import os
+import asyncio
 from pathlib import Path
 from typing import Any, Optional, List, Dict, Union
 from datetime import datetime
@@ -30,8 +31,25 @@ DECAY_WEIGHT = float(os.getenv('DECAY_WEIGHT', '0.3'))
 DECAY_SCALE_DAYS = float(os.getenv('DECAY_SCALE_DAYS', '90'))
 USE_NATIVE_DECAY = os.getenv('USE_NATIVE_DECAY', 'false').lower() == 'true'
 
-# Initialize Voyage AI client
-voyage_client = voyageai.Client(api_key=VOYAGE_API_KEY) if VOYAGE_API_KEY else None
+# Embedding configuration
+PREFER_LOCAL_EMBEDDINGS = os.getenv('PREFER_LOCAL_EMBEDDINGS', 'false').lower() == 'true'
+EMBEDDING_MODEL = os.getenv('EMBEDDING_MODEL', 'sentence-transformers/all-MiniLM-L6-v2')
+
+# Initialize Voyage AI client (only if not using local embeddings)
+voyage_client = None
+if not PREFER_LOCAL_EMBEDDINGS and VOYAGE_API_KEY:
+    voyage_client = voyageai.Client(api_key=VOYAGE_API_KEY)
+
+# Initialize local embedding model if needed
+local_embedding_model = None
+if PREFER_LOCAL_EMBEDDINGS or not VOYAGE_API_KEY:
+    try:
+        from fastembed import TextEmbedding
+        local_embedding_model = TextEmbedding(model_name=EMBEDDING_MODEL)
+        print(f"[DEBUG] Initialized local embedding model: {EMBEDDING_MODEL}")
+    except ImportError:
+        print("[ERROR] FastEmbed not available. Install with: pip install fastembed")
+        raise
 
 # Debug environment loading
 print(f"[DEBUG] Environment variables loaded:")
@@ -39,6 +57,8 @@ print(f"[DEBUG] ENABLE_MEMORY_DECAY: {ENABLE_MEMORY_DECAY}")
 print(f"[DEBUG] USE_NATIVE_DECAY: {USE_NATIVE_DECAY}")
 print(f"[DEBUG] DECAY_WEIGHT: {DECAY_WEIGHT}")
 print(f"[DEBUG] DECAY_SCALE_DAYS: {DECAY_SCALE_DAYS}")
+print(f"[DEBUG] PREFER_LOCAL_EMBEDDINGS: {PREFER_LOCAL_EMBEDDINGS}")
+print(f"[DEBUG] EMBEDDING_MODEL: {EMBEDDING_MODEL}")
 print(f"[DEBUG] env_path: {env_path}")
 
 
@@ -63,22 +83,50 @@ mcp = FastMCP(
 # Create Qdrant client
 qdrant_client = AsyncQdrantClient(url=QDRANT_URL)
     
-async def get_voyage_collections() -> List[str]:
-    """Get all Voyage collections."""
+async def get_all_collections() -> List[str]:
+    """Get all collections (both Voyage and local)."""
     collections = await qdrant_client.get_collections()
-    return [c.name for c in collections.collections if c.name.endswith('_voyage')]
+    # Support both _voyage and _local collections, plus reflections
+    return [c.name for c in collections.collections 
+            if c.name.endswith('_voyage') or c.name.endswith('_local') or c.name.startswith('reflections')]
 
 async def generate_embedding(text: str) -> List[float]:
-    """Generate embedding using Voyage AI."""
-    if not voyage_client:
-        raise ValueError("Voyage AI API key not configured")
-    
-    result = voyage_client.embed(
-        texts=[text],
-        model="voyage-3-large",
-        input_type="query"
-    )
-    return result.embeddings[0]
+    """Generate embedding using configured provider."""
+    if PREFER_LOCAL_EMBEDDINGS or not voyage_client:
+        # Use local embeddings
+        if not local_embedding_model:
+            raise ValueError("Local embedding model not initialized")
+        
+        # Run in executor since fastembed is synchronous
+        loop = asyncio.get_event_loop()
+        embeddings = await loop.run_in_executor(
+            None, lambda: list(local_embedding_model.embed([text]))
+        )
+        return embeddings[0].tolist()
+    else:
+        # Use Voyage AI
+        result = voyage_client.embed(
+            texts=[text],
+            model="voyage-3-large",
+            input_type="query"
+        )
+        return result.embeddings[0]
+
+def get_embedding_dimension() -> int:
+    """Get the dimension of embeddings based on the provider."""
+    if PREFER_LOCAL_EMBEDDINGS or not voyage_client:
+        # all-MiniLM-L6-v2 produces 384-dimensional embeddings
+        return 384
+    else:
+        # voyage-3-large produces 1024-dimensional embeddings
+        return 1024
+
+def get_collection_suffix() -> str:
+    """Get the collection suffix based on embedding provider."""
+    if PREFER_LOCAL_EMBEDDINGS or not voyage_client:
+        return "_local"
+    else:
+        return "_voyage"
     
 # Register tools
 @mcp.tool()
@@ -115,17 +163,18 @@ async def reflect_on_past(
         # Generate embedding
         query_embedding = await generate_embedding(query)
         
-        # Get all Voyage collections
-        voyage_collections = await get_voyage_collections()
-        if not voyage_collections:
+        # Get all collections
+        all_collections = await get_all_collections()
+        if not all_collections:
             return "No conversation collections found. Please import conversations first."
         
-        await ctx.debug(f"Searching across {len(voyage_collections)} collections")
+        await ctx.debug(f"Searching across {len(all_collections)} collections")
+        await ctx.debug(f"Using {'local' if PREFER_LOCAL_EMBEDDINGS or not voyage_client else 'Voyage AI'} embeddings")
         
         all_results = []
         
         # Search each collection
-        for collection_name in voyage_collections:
+        for collection_name in all_collections:
             try:
                 if should_use_decay and USE_NATIVE_DECAY:
                     # Use native Qdrant decay
@@ -179,7 +228,7 @@ async def reflect_on_past(
                             timestamp=point.payload.get('timestamp', datetime.now().isoformat()),
                             role=point.payload.get('start_role', point.payload.get('role', 'unknown')),
                             excerpt=(point.payload.get('text', '')[:500] + '...'),
-                            project_name=point.payload.get('project', collection_name.replace('conv_', '').replace('_voyage', '')),
+                            project_name=point.payload.get('project', collection_name.replace('conv_', '').replace('_voyage', '').replace('_local', '')),
                             conversation_id=point.payload.get('conversation_id'),
                             collection_name=collection_name
                         ))
@@ -240,7 +289,7 @@ async def reflect_on_past(
                             timestamp=point.payload.get('timestamp', datetime.now().isoformat()),
                             role=point.payload.get('start_role', point.payload.get('role', 'unknown')),
                             excerpt=(point.payload.get('text', '')[:500] + '...'),
-                            project_name=point.payload.get('project', collection_name.replace('conv_', '').replace('_voyage', '')),
+                            project_name=point.payload.get('project', collection_name.replace('conv_', '').replace('_voyage', '').replace('_local', '')),
                             conversation_id=point.payload.get('conversation_id'),
                             collection_name=collection_name
                         ))
@@ -261,7 +310,7 @@ async def reflect_on_past(
                             timestamp=point.payload.get('timestamp', datetime.now().isoformat()),
                             role=point.payload.get('start_role', point.payload.get('role', 'unknown')),
                             excerpt=(point.payload.get('text', '')[:500] + '...'),
-                            project_name=point.payload.get('project', collection_name.replace('conv_', '').replace('_voyage', '')),
+                            project_name=point.payload.get('project', collection_name.replace('conv_', '').replace('_voyage', '').replace('_local', '')),
                             conversation_id=point.payload.get('conversation_id'),
                             collection_name=collection_name
                         ))
@@ -302,8 +351,46 @@ async def store_reflection(
     """Store an important insight or reflection for future reference."""
     
     try:
-        # TODO: Implement actual storage in a dedicated reflections collection
-        # For now, just acknowledge the storage
+        # Create reflections collection name
+        collection_name = f"reflections{get_collection_suffix()}"
+        
+        # Ensure collection exists
+        try:
+            collection_info = await qdrant_client.get_collection(collection_name)
+        except:
+            # Create collection if it doesn't exist
+            await qdrant_client.create_collection(
+                collection_name=collection_name,
+                vectors_config=VectorParams(
+                    size=get_embedding_dimension(),
+                    distance=Distance.COSINE
+                )
+            )
+            await ctx.debug(f"Created reflections collection: {collection_name}")
+        
+        # Generate embedding for the reflection
+        embedding = await generate_embedding(content)
+        
+        # Create point with metadata
+        point_id = datetime.now().timestamp()
+        point = PointStruct(
+            id=int(point_id),
+            vector=embedding,
+            payload={
+                "text": content,
+                "tags": tags,
+                "timestamp": datetime.now().isoformat(),
+                "type": "reflection",
+                "role": "user_reflection"
+            }
+        )
+        
+        # Store in Qdrant
+        await qdrant_client.upsert(
+            collection_name=collection_name,
+            points=[point]
+        )
+        
         tags_str = ', '.join(tags) if tags else 'none'
         return f"Reflection stored successfully with tags: {tags_str}"
         

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-self-reflect",
-  "version": "2.3.2",
+  "version": "2.3.3",
   "description": "Give Claude perfect memory of all your conversations - Installation wizard for Python MCP server",
   "keywords": [
     "claude",

package/scripts/import-conversations-unified.py

@@ -0,0 +1,269 @@
+#!/usr/bin/env python3
+"""
+Unified import script that supports both local and Voyage AI embeddings.
+"""
+
+import os
+import sys
+import json
+import glob
+import hashlib
+from datetime import datetime
+from typing import List, Dict, Any
+import logging
+from pathlib import Path
+
+from qdrant_client import QdrantClient
+from qdrant_client.models import (
+    VectorParams, Distance, PointStruct,
+    Filter, FieldCondition, MatchValue
+)
+
+# Configuration
+QDRANT_URL = os.getenv("QDRANT_URL", "http://localhost:6333")
+LOGS_DIR = os.getenv("LOGS_DIR", "/logs")
+STATE_FILE = os.getenv("STATE_FILE", "/config/imported-files.json")
+BATCH_SIZE = int(os.getenv("BATCH_SIZE", "100"))
+PREFER_LOCAL_EMBEDDINGS = os.getenv("PREFER_LOCAL_EMBEDDINGS", "false").lower() == "true"
+VOYAGE_API_KEY = os.getenv("VOYAGE_KEY")
+
+# Set up logging
+logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
+logger = logging.getLogger(__name__)
+
+# Initialize embedding provider
+embedding_provider = None
+embedding_dimension = None
+collection_suffix = None
+
+if PREFER_LOCAL_EMBEDDINGS or not VOYAGE_API_KEY:
+    # Use local embeddings
+    logger.info("Using local embeddings (fastembed)")
+    from fastembed import TextEmbedding
+    embedding_provider = TextEmbedding("sentence-transformers/all-MiniLM-L6-v2")
+    embedding_dimension = 384
+    collection_suffix = "_local"
+else:
+    # Use Voyage AI
+    logger.info("Using Voyage AI embeddings")
+    import voyageai
+    voyage_client = voyageai.Client(api_key=VOYAGE_API_KEY)
+    embedding_dimension = 1024
+    collection_suffix = "_voyage"
+
+# Initialize Qdrant client
+client = QdrantClient(url=QDRANT_URL)
+
+def generate_embeddings(texts: List[str]) -> List[List[float]]:
+    """Generate embeddings for a list of texts."""
+    if PREFER_LOCAL_EMBEDDINGS or not VOYAGE_API_KEY:
+        # Local embeddings using FastEmbed
+        embeddings = list(embedding_provider.passage_embed(texts))
+        return [embedding.tolist() for embedding in embeddings]
+    else:
+        # Voyage AI embeddings
+        result = voyage_client.embed(
+            texts=texts,
+            model="voyage-3-large",
+            input_type="document"
+        )
+        return result.embeddings
+
+def chunk_conversation(messages: List[Dict[str, Any]], chunk_size: int = 10) -> List[Dict[str, Any]]:
+    """Chunk conversation into smaller segments."""
+    chunks = []
+    
+    for i in range(0, len(messages), chunk_size):
+        chunk_messages = messages[i:i + chunk_size]
+        
+        # Extract text content
+        texts = []
+        for msg in chunk_messages:
+            role = msg.get("role", "unknown")
+            content = msg.get("content", "")
+            
+            if isinstance(content, list):
+                # Handle structured content
+                text_parts = []
+                for item in content:
+                    if isinstance(item, dict) and item.get("type") == "text":
+                        text_parts.append(item.get("text", ""))
+                    elif isinstance(item, str):
+                        text_parts.append(item)
+                content = " ".join(text_parts)
+            
+            if content:
+                texts.append(f"{role.upper()}: {content}")
+        
+        if texts:
+            chunks.append({
+                "text": "\n".join(texts),
+                "messages": chunk_messages,
+                "chunk_index": i // chunk_size,
+                "start_role": chunk_messages[0].get("role", "unknown") if chunk_messages else "unknown"
+            })
+    
+    return chunks
+
+def import_project(project_path: Path, collection_name: str) -> int:
+    """Import all conversations from a project."""
+    jsonl_files = list(project_path.glob("*.jsonl"))
+    
+    if not jsonl_files:
+        logger.warning(f"No JSONL files found in {project_path}")
+        return 0
+    
+    # Check if collection exists
+    collections = client.get_collections().collections
+    if collection_name not in [c.name for c in collections]:
+        logger.info(f"Creating collection: {collection_name}")
+        client.create_collection(
+            collection_name=collection_name,
+            vectors_config=VectorParams(
+                size=embedding_dimension,
+                distance=Distance.COSINE
+            )
+        )
+    
+    total_chunks = 0
+    
+    for jsonl_file in jsonl_files:
+        logger.info(f"Processing file: {jsonl_file.name}")
+        try:
+            # Read JSONL file and extract messages
+            messages = []
+            created_at = None
+            
+            with open(jsonl_file, 'r', encoding='utf-8') as f:
+                for line_num, line in enumerate(f, 1):
+                    line = line.strip()
+                    if not line:
+                        continue
+                    
+                    try:
+                        data = json.loads(line)
+                        
+                        # Extract timestamp from first message
+                        if created_at is None and 'timestamp' in data:
+                            created_at = data.get('timestamp')
+                        
+                        # Skip non-message lines (summaries, etc.)
+                        if data.get('type') == 'summary':
+                            continue
+                            
+                        # Extract message if present
+                        if 'message' in data and data['message']:
+                            msg = data['message']
+                            if msg.get('role') and msg.get('content'):
+                                # Handle content that's an array of objects
+                                content = msg['content']
+                                if isinstance(content, list):
+                                    text_parts = []
+                                    for item in content:
+                                        if isinstance(item, dict) and item.get('type') == 'text':
+                                            text_parts.append(item.get('text', ''))
+                                        elif isinstance(item, str):
+                                            text_parts.append(item)
+                                    content = '\n'.join(text_parts)
+                                
+                                if content:
+                                    messages.append({
+                                        'role': msg['role'],
+                                        'content': content
+                                    })
+                    except json.JSONDecodeError:
+                        logger.debug(f"Skipping invalid JSON at line {line_num}")
+                    except Exception as e:
+                        logger.error(f"Error processing line {line_num}: {e}")
+            
+            if not messages:
+                continue
+            
+            # Extract metadata
+            if created_at is None:
+                created_at = datetime.now().isoformat()
+            conversation_id = jsonl_file.stem
+            
+            # Chunk the conversation
+            chunks = chunk_conversation(messages)
+            
+            if not chunks:
+                continue
+            
+            # Process in batches
+            for batch_start in range(0, len(chunks), BATCH_SIZE):
+                batch = chunks[batch_start:batch_start + BATCH_SIZE]
+                texts = [chunk["text"] for chunk in batch]
+                
+                # Generate embeddings
+                embeddings = generate_embeddings(texts)
+                
+                # Create points
+                points = []
+                for chunk, embedding in zip(batch, embeddings):
+                    point_id = hashlib.md5(
+                        f"{conversation_id}_{chunk['chunk_index']}".encode()
+                    ).hexdigest()[:16]
+                    
+                    points.append(PointStruct(
+                        id=int(point_id, 16) % (2**63),  # Convert to valid integer ID
+                        vector=embedding,
+                        payload={
+                            "text": chunk["text"],
+                            "conversation_id": conversation_id,
+                            "chunk_index": chunk["chunk_index"],
+                            "timestamp": created_at,
+                            "project": project_path.name,
+                            "start_role": chunk["start_role"]
+                        }
+                    ))
+                
+                # Upload to Qdrant
+                client.upsert(
+                    collection_name=collection_name,
+                    points=points
+                )
+                
+                total_chunks += len(points)
+            
+            logger.info(f"Imported {len(chunks)} chunks from {jsonl_file.name}")
+            
+        except Exception as e:
+            logger.error(f"Failed to import {jsonl_file}: {e}")
+            import traceback
+            logger.error(traceback.format_exc())
+    
+    return total_chunks
+
+def main():
+    """Main import function."""
+    logs_path = Path(LOGS_DIR)
+    
+    if not logs_path.exists():
+        logger.error(f"Logs directory not found: {LOGS_DIR}")
+        return
+    
+    # Find all project directories
+    project_dirs = [d for d in logs_path.iterdir() if d.is_dir()]
+    
+    if not project_dirs:
+        logger.warning("No project directories found")
+        return
+    
+    logger.info(f"Found {len(project_dirs)} projects to import")
+    
+    # Import each project
+    total_imported = 0
+    for project_dir in project_dirs:
+        # Create collection name from project path
+        collection_name = f"conv_{hashlib.md5(project_dir.name.encode()).hexdigest()[:8]}{collection_suffix}"
+        
+        logger.info(f"Importing project: {project_dir.name} -> {collection_name}")
+        chunks = import_project(project_dir, collection_name)
+        total_imported += chunks
+        logger.info(f"Imported {chunks} chunks from {project_dir.name}")
+    
+    logger.info(f"Import complete! Total chunks imported: {total_imported}")
+
+if __name__ == "__main__":
+    main()

package/scripts/import-recent-only.py

@@ -23,7 +23,11 @@ for file in os.listdir(project_path):
 print(f"Found {len(recent_files)} recent files to import")
 
 # Set environment variable
-os.environ["VOYAGE_KEY"] = "pa-wdTYGObaxhs-XFKX2r7WCczRwEVNb9eYMTSO3yrQhZI"
+# VOYAGE_KEY must be set as environment variable
+if not os.getenv("VOYAGE_KEY"):
+    print("Error: VOYAGE_KEY environment variable not set")
+    print("Please set: export VOYAGE_KEY='your-voyage-api-key'")
+    sys.exit(1)
 
 # Import the whole project (the script will handle individual files)
 os.system(f"python {import_script} {project_path}")

package/scripts/import-watcher.py

@@ -19,7 +19,7 @@ WATCH_DIR = os.getenv("WATCH_DIR", "/logs")
 STATE_FILE = os.getenv("STATE_FILE", "/config/imported-files.json")
 WATCH_INTERVAL = int(os.getenv("WATCH_INTERVAL", "60"))  # seconds
 IMPORT_DELAY = int(os.getenv("IMPORT_DELAY", "30"))  # Wait before importing new files
-IMPORTER_SCRIPT = "/scripts/import-conversations-voyage-streaming.py"
+IMPORTER_SCRIPT = "/scripts/import-conversations-unified.py"
 
 # Set up logging
 logging.basicConfig(