klypix-mcp 1.67.0 → 1.67.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klypix-mcp",
-  "version": "1.67.0",
+  "version": "1.67.1",
   "description": "Shared project brain and MCP coordination server for multi-agent coding.",
   "type": "module",
   "license": "Apache-2.0",
@@ -83,7 +83,7 @@
     "bench": "node bin/klypix-mcp.mjs bench",
     "test:bench": "node test/bench.mjs",
     "pretest": "node test/publish-workflow.mjs",
-    "test": "node test/publish-verdict.mjs && node test/remote-client.mjs && node test/project-graph.mjs && node test/project-map-cli.mjs && node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/runtime-inspector.mjs && node test/codex-hooks.mjs && node test/request-identity.mjs && node test/session-identity-core.mjs && node test/agent-presence.mjs && node test/message-delivery-v3.mjs && node test/claude-message-delivery-v3.mjs && node test/result-reconcile.mjs && node test/evidence-publication-gate.mjs && node test/release-evidence-cli.mjs && node test/intent-guard.mjs && node test/git-capture-install.mjs && node test/brain-history.mjs && node test/brain-graveyard.mjs && node test/archived-visibility.mjs && node test/finding-routing.mjs && node test/finding-routing-hook.mjs && node test/presence-relay.mjs && node test/install-version.mjs && node test/context-gateway.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brain-connect-orphans.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/skill-staleness.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-gate.mjs && node test/memory-runtime.mjs && node test/semantic-cache.mjs && node test/decay-status.mjs && node test/decay-hook.mjs && node test/evidence-anchors.mjs && node test/presence-visibility.mjs && node test/merge-brains.mjs && node test/concurrent-writes.mjs && node test/lock-interop.mjs && node test/a2a-smoke.mjs && node test/cli-args.mjs && node test/format-guard.mjs && node test/git-tools.mjs && node test/uninstall.mjs",
+    "test": "node test/publish-verdict.mjs && node test/remote-client.mjs && node test/project-graph.mjs && node test/project-map-cli.mjs && node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/runtime-inspector.mjs && node test/codex-hooks.mjs && node test/request-identity.mjs && node test/session-identity-core.mjs && node test/agent-presence.mjs && node test/message-delivery-v3.mjs && node test/claude-message-delivery-v3.mjs && node test/result-reconcile.mjs && node test/evidence-publication-gate.mjs && node test/release-evidence-cli.mjs && node test/intent-guard.mjs && node test/git-capture-install.mjs && node test/brain-history.mjs && node test/brain-graveyard.mjs && node test/archived-visibility.mjs && node test/finding-routing.mjs && node test/finding-routing-hook.mjs && node test/presence-relay.mjs && node test/install-version.mjs && node test/context-gateway.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brain-connect-orphans.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/skill-staleness.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-security.mjs && node test/semantic-gate.mjs && node test/memory-runtime.mjs && node test/semantic-cache.mjs && node test/decay-status.mjs && node test/decay-hook.mjs && node test/evidence-anchors.mjs && node test/presence-visibility.mjs && node test/merge-brains.mjs && node test/concurrent-writes.mjs && node test/lock-interop.mjs && node test/a2a-smoke.mjs && node test/cli-args.mjs && node test/format-guard.mjs && node test/git-tools.mjs && node test/uninstall.mjs",
     "test:memory": "node test/memory-runtime.mjs",
     "test:memory:soak": "node --expose-gc test/memory-soak.mjs",
     "runtime": "node bin/klypix-runtime.mjs"

package/src/brain-semantic.mjs

@@ -18,6 +18,7 @@ import fs from 'fs';
 import path from 'path';
 import os from 'os';
 import crypto from 'crypto';
+import { createRequire } from 'module';
 
 const PB_DIR = path.join(os.homedir(), '.claude', 'project-brain');
 const EMB_DIR = path.join(PB_DIR, 'embeddings');
@@ -29,6 +30,46 @@ export const HOOK_EMBEDDING_MODEL_ID = 'Xenova/bge-small-en-v1.5';
 export const HOOK_EMBEDDING_QUERY_PREFIX = 'Represent this sentence for searching relevant passages: ';
 export const HOOK_EMBEDDING_POOLING = 'cls';
 export const HOOK_EMBEDDING_CACHE_KEY = `${HOOK_EMBEDDING_MODEL_ID}|q8|${HOOK_EMBEDDING_POOLING}|query-instruction-v1`;
+const MIN_SAFE_SHARP_VERSION = [0, 35, 3];
+
+function findPackageManifest(entryPath, expectedName) {
+    let dir = path.dirname(entryPath);
+    while (dir !== path.dirname(dir)) {
+        try {
+            const manifestPath = path.join(dir, 'package.json');
+            const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+            if (manifest?.name === expectedName) return { manifestPath, manifest };
+        } catch { /* keep walking */ }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+
+function isSafeSharpVersion(version) {
+    const parts = String(version || '').split('.').slice(0, 3).map(Number);
+    if (parts.length !== 3 || parts.some(part => !Number.isInteger(part) || part < 0)) return false;
+    for (let i = 0; i < MIN_SAFE_SHARP_VERSION.length; i++) {
+        if (parts[i] !== MIN_SAFE_SHARP_VERSION[i]) return parts[i] > MIN_SAFE_SHARP_VERSION[i];
+    }
+    return true;
+}
+
+export function semanticRuntimeEntryIfSafe(transformersEntry) {
+    try {
+        const transformers = findPackageManifest(transformersEntry, '@huggingface/transformers');
+        if (!transformers) return null;
+        const sharpEntry = createRequire(transformers.manifestPath).resolve('sharp');
+        const sharp = findPackageManifest(sharpEntry, 'sharp');
+        return sharp && isSafeSharpVersion(sharp.manifest.version) ? transformersEntry : null;
+    } catch { return null; }
+}
+
+function ambientTransformersEntryIfSafe() {
+    try {
+        const entry = createRequire(import.meta.url).resolve('@huggingface/transformers');
+        return semanticRuntimeEntryIfSafe(entry);
+    } catch { return null; }
+}
 
 // Memoized within THIS process only (a one-shot hook run) — across prompts it
 // reloads cold, which is exactly why we only pay it on a lexical miss.
@@ -37,15 +78,20 @@ function getEmbedder() {
     if (_embedder !== undefined) return _embedder;
     _embedder = (async () => {
         let t;
-        try { t = await import('@huggingface/transformers'); }
-        catch {
+        const ambientEntry = ambientTransformersEntryIfSafe();
+        if (ambientEntry) {
+            try { t = await import('@huggingface/transformers'); } catch { /* try owned runtime */ }
+        }
+        if (!t) {
             const base = path.join(PB_DIR, 'semantic', 'node_modules', '@huggingface', 'transformers', 'dist');
             let last;
             for (const f of ['transformers.node.mjs', 'transformers.mjs']) {
-                try { t = await import(new URL('file:///' + path.join(base, f).replace(/\\/g, '/')).href); last = null; break; }
+                const entry = path.join(base, f);
+                if (!semanticRuntimeEntryIfSafe(entry)) continue;
+                try { t = await import(new URL('file:///' + entry.replace(/\\/g, '/')).href); last = null; break; }
                 catch (e) { last = e; }
             }
-            if (!t) throw last;
+            if (!t) throw last || new Error('semantic runtime rejected: sharp must be >=0.35.3');
         }
         t.env.cacheDir = path.join(PB_DIR, 'hf-cache');
         return await t.pipeline('feature-extraction', HOOK_EMBEDDING_MODEL_ID, { dtype: 'q8' });

package/src/semantic-memory.mjs

@@ -13,6 +13,7 @@ import { createRequire } from 'module';
 const PB_DIR = path.join(os.homedir(), '.claude', 'project-brain');
 const EMB_DIR = path.join(PB_DIR, 'embeddings');
 const sha1 = (s) => crypto.createHash('sha1').update(String(s)).digest('hex');
+const MIN_SAFE_SHARP_VERSION = [0, 35, 3];
 export const EMBEDDING_MODEL_ID = 'Xenova/bge-small-en-v1.5';
 export const EMBEDDING_QUERY_PREFIX = 'Represent this sentence for searching relevant passages: ';
 export const EMBEDDING_POOLING = 'cls';
@@ -236,16 +237,59 @@ function disposeTensorTree(value, seen = new Set()) {
   for (const item of Object.values(value)) disposeTensorTree(item, seen);
 }
 
+function findPackageManifest(entryPath, expectedName) {
+  let dir = path.dirname(entryPath);
+  while (dir !== path.dirname(dir)) {
+    try {
+      const manifestPath = path.join(dir, 'package.json');
+      const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+      if (manifest?.name === expectedName) return { manifestPath, manifest };
+    } catch { /* keep walking */ }
+    dir = path.dirname(dir);
+  }
+  return null;
+}
+
+function isSafeSharpVersion(version) {
+  const parts = String(version || '').split('.').slice(0, 3).map(Number);
+  if (parts.length !== 3 || parts.some(part => !Number.isInteger(part) || part < 0)) return false;
+  for (let i = 0; i < MIN_SAFE_SHARP_VERSION.length; i++) {
+    if (parts[i] !== MIN_SAFE_SHARP_VERSION[i]) return parts[i] > MIN_SAFE_SHARP_VERSION[i];
+  }
+  return true;
+}
+
+export function semanticRuntimeEntryIfSafe(transformersEntry) {
+  try {
+    const transformers = findPackageManifest(transformersEntry, '@huggingface/transformers');
+    if (!transformers) return null;
+    const sharpEntry = createRequire(transformers.manifestPath).resolve('sharp');
+    const sharp = findPackageManifest(sharpEntry, 'sharp');
+    return sharp && isSafeSharpVersion(sharp.manifest.version) ? transformersEntry : null;
+  } catch { return null; }
+}
+
+function ambientTransformersEntryIfSafe() {
+  try {
+    const entry = createRequire(import.meta.url).resolve('@huggingface/transformers');
+    return semanticRuntimeEntryIfSafe(entry);
+  } catch { return null; }
+}
+
 async function loadTransformers() {
-  try { return await import('@huggingface/transformers'); }
-  catch {
+  if (ambientTransformersEntryIfSafe()) {
+    try { return await import('@huggingface/transformers'); } catch { /* try owned runtime */ }
+  }
+  {
     const base = path.join(PB_DIR, 'semantic', 'node_modules', '@huggingface', 'transformers', 'dist');
     let lastErr;
     for (const f of ['transformers.node.mjs', 'transformers.mjs']) {
-      try { return await import(new URL('file:///' + path.join(base, f).replace(/\\/g, '/')).href); }
+      const entry = path.join(base, f);
+      if (!semanticRuntimeEntryIfSafe(entry)) continue;
+      try { return await import(new URL('file:///' + entry.replace(/\\/g, '/')).href); }
       catch (error) { lastErr = error; }
     }
-    throw lastErr;
+    throw lastErr || new Error('semantic runtime rejected: sharp must be >=0.35.3');
   }
 }
 
@@ -267,13 +311,15 @@ export function semanticRuntimeInstalled() {
   if (runtimeInstalledCache !== null) return runtimeInstalledCache;
   let found = false;
   try {
-    createRequire(import.meta.url).resolve('@huggingface/transformers');
-    found = true;
+    const entry = createRequire(import.meta.url).resolve('@huggingface/transformers');
+    found = Boolean(semanticRuntimeEntryIfSafe(entry));
   } catch {
+    // Fall through to the owned runtime below.
+  }
+  if (!found) {
     const base = path.join(PB_DIR, 'semantic', 'node_modules', '@huggingface', 'transformers', 'dist');
-    found = ['transformers.node.mjs', 'transformers.mjs'].some(f => {
-      try { return fs.existsSync(path.join(base, f)); } catch { return false; }
-    });
+    found = ['transformers.node.mjs', 'transformers.mjs']
+      .some(f => Boolean(semanticRuntimeEntryIfSafe(path.join(base, f))));
   }
   runtimeInstalledCache = found;
   return found;