knit-mcp 0.6.1 → 0.6.4

package/README.md

@@ -193,8 +193,9 @@ knit install-agents --all        # install every known agent
 knit install-agents --refresh    # re-fetch from network even if cached
 ```
 
-`ENGRAM_OFFLINE=1` disables network fetches (bundled-core still works).
-`ENGRAM_AGENT_REGISTRY_REF=main` overrides the pinned VoltAgent SHA.
+`KNIT_OFFLINE=1` disables network fetches (bundled-core still works).
+`KNIT_AGENT_REGISTRY_REF=main` overrides the pinned VoltAgent SHA.
+(Legacy `ENGRAM_OFFLINE` / `ENGRAM_AGENT_REGISTRY_REF` are still honored.)
 
 ## Parallel team worktrees
 

package/THIRD-PARTY-NOTICES.md

@@ -1,6 +1,6 @@
 # Third-Party Notices
 
-This file lists open-source components redistributed by engram and the licenses
+This file lists open-source components redistributed by Knit and the licenses
 they ship under. Each section satisfies the attribution requirements of the
 upstream license.
 
@@ -13,9 +13,9 @@ upstream license.
 - **License:** MIT
 - **Pinned commit:** `6f804f0cfab22fb62668855aa3d62ee3a1453077`
 
-Engram bundles a curated subset of these subagent definitions in
+Knit bundles a curated subset of these subagent definitions in
 `dist/agents/core/` and fetches additional ones on demand into
-`~/.engram/agents/cache/`. Each redistributed file carries an attribution
+`~/.knit/agents/cache/`. Each redistributed file carries an attribution
 comment immediately after its YAML frontmatter pointing back to the upstream
 source at the pinned commit. The original frontmatter and prompt content are
 unmodified.

package/dist/{cache-C6LI7UVN.js → cache-7HTB4MTJ.js}

@@ -2,11 +2,11 @@ import {
   detectProjectRoot,
   getBrain,
   refreshBrain
-} from "./chunk-NZXLCN4Q.js";
+} from "./chunk-QU46A5ZT.js";
 import "./chunk-QMICM263.js";
-import "./chunk-GRSYI2RR.js";
-import "./chunk-TH5QPD5E.js";
-import "./chunk-LW6NOFHF.js";
+import "./chunk-M3YZOJNW.js";
+import "./chunk-Y3I4NAKM.js";
+import "./chunk-7PPC6IG6.js";
 import "./chunk-BAUQEFYY.js";
 import "./chunk-YI37OAJ7.js";
 export {

package/dist/{chunk-LW6NOFHF.js → chunk-7PPC6IG6.js}

@@ -5,7 +5,7 @@ import { execSync } from "child_process";
 
 // src/engine/agent-registry.ts
 var VOLTAGENT_PINNED_SHA = "6f804f0cfab22fb62668855aa3d62ee3a1453077";
-var VOLTAGENT_REF = process.env.ENGRAM_AGENT_REGISTRY_REF || VOLTAGENT_PINNED_SHA;
+var VOLTAGENT_REF = process.env.KNIT_AGENT_REGISTRY_REF || process.env.ENGRAM_AGENT_REGISTRY_REF || VOLTAGENT_PINNED_SHA;
 var VOLTAGENT_RAW_BASE = "https://raw.githubusercontent.com/VoltAgent/awesome-claude-code-subagents";
 var AGENT_CATALOG = {
   // 02 — Language specialists

package/dist/{chunk-GRSYI2RR.js → chunk-M3YZOJNW.js}

@@ -1,5 +1,5 @@
 // src/engine/learnings.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "fs";
 import { dirname } from "path";
 function readLearnings(filePath) {
   if (!existsSync(filePath)) return [];

package/dist/{chunk-NZXLCN4Q.js → chunk-QU46A5ZT.js}

@@ -7,14 +7,14 @@ import {
 } from "./chunk-QMICM263.js";
 import {
   readLearnings
-} from "./chunk-GRSYI2RR.js";
+} from "./chunk-M3YZOJNW.js";
 import {
   installAgentsForProject,
   pruneSessionsByAge
-} from "./chunk-TH5QPD5E.js";
+} from "./chunk-Y3I4NAKM.js";
 import {
   scanProject
-} from "./chunk-LW6NOFHF.js";
+} from "./chunk-7PPC6IG6.js";
 import {
   importFromMarkdown,
   loadKnowledgeBase,
@@ -65,13 +65,13 @@ function generateLearningsContent(config) {
 }
 
 // src/generators/settings.ts
-var HOOKS_VERSION = 3;
+var HOOKS_VERSION = 6;
 function generateSettings(config, rootPath) {
   return {
     mcpServers: {
       "knit-brain": {
         command: "npx",
-        args: ["-y", "@piyushdua/engram-dev@latest"]
+        args: ["-y", "knit-mcp@latest"]
       }
     },
     hooks: generateHooks(config, rootPath),
@@ -83,7 +83,9 @@ function jsLit(s) {
 }
 function nodeHook(script) {
   const compact = script.split("\n").map((l) => l.replace(/\/\/.*$/, "").trim()).filter((l) => l.length > 0).join(" ");
-  return `node -e '${compact}'`;
+  const wrapped = `(() => { ${compact} })();`;
+  const escaped = wrapped.replace(/'/g, `'\\''`);
+  return `node -e '${escaped}'`;
 }
 var REPO_ROOT_JS = `
   const __getRoot = () => {
@@ -169,7 +171,7 @@ function generateHooks(config, rootPath) {
                   const i = JSON.parse(d);
                   const c = (i.tool_input && i.tool_input.command) || "";
                   if (/^git\\s+(push\\b.*\\s(--force|-f)|reset\\s+--hard|commit.*--no-verify)/.test(c)) {
-                    console.log(JSON.stringify({ decision: "block", reason: "Destructive git operation blocked by Engram. Ask the user first." }));
+                    console.log(JSON.stringify({ decision: "block", reason: "Destructive git operation blocked by Knit. Ask the user first." }));
                   }
                 } catch (e) {}
               });
@@ -344,7 +346,7 @@ function generateHooks(config, rootPath) {
             }
           `),
           timeout: 120,
-          statusMessage: "Engram: final build verification..."
+          statusMessage: "Knit: final build verification..."
         }
       ]
     });
@@ -375,7 +377,7 @@ function generateHooks(config, rootPath) {
           } catch (e) {}
         `),
         timeout: 10,
-        statusMessage: "Engram: capturing session state..."
+        statusMessage: "Knit: capturing session state..."
       }
     ]
   });
@@ -409,7 +411,7 @@ function generateHooks(config, rootPath) {
           } catch (e) {}
         `),
         timeout: 10,
-        statusMessage: "Engram: recording session tuple..."
+        statusMessage: "Knit: recording session tuple..."
       }
     ]
   });
@@ -426,14 +428,14 @@ function generateHooks(config, rootPath) {
             const ageSec = (Date.now() - fs.statSync(file).mtimeMs) / 1000;
             if (ageSec > 300) {
               console.log("");
-              console.log("[Engram] LEARN was not recorded this session. That's fine if nothing reusable surfaced.");
+              console.log("[Knit] LEARN was not recorded this session. That's fine if nothing reusable surfaced.");
               console.log("         If something did, call knit_record_learning in your next session.");
               console.log("");
             }
           } catch (e) {}
         `),
         timeout: 5,
-        statusMessage: "Engram: checking LEARN compliance..."
+        statusMessage: "Knit: checking LEARN compliance..."
       }
     ]
   });
@@ -467,7 +469,7 @@ function generateHooks(config, rootPath) {
           } catch (e) {}
         `),
         timeout: 10,
-        statusMessage: "Engram: updating session metrics..."
+        statusMessage: "Knit: updating session metrics..."
       }
     ]
   });
@@ -484,7 +486,7 @@ function maybeRefreshHooks(rootPath, config) {
   if (!existsSync(settingsPath)) return;
   try {
     const existing = JSON.parse(readFileSync(settingsPath, "utf-8"));
-    const storedVersion = existing?._knitHooks?.version ?? 0;
+    const storedVersion = existing?._knitHooks?.version ?? (existing?._engramHooks ? 0 : 0);
     if (storedVersion < HOOKS_VERSION) {
       writeKnitHooks(rootPath, config);
     }
@@ -660,7 +662,7 @@ function writeKnitHooks(rootPath, config) {
   } catch {
     return;
   }
-  if ("_knitHooks" in existing) {
+  if ("_knitHooks" in existing || "_engramHooks" in existing) {
     mkdirSync(claudeDir, { recursive: true });
     writeFileSync(settingsPath, JSON.stringify(fresh, null, 2), "utf-8");
     return;
@@ -680,7 +682,9 @@ function writeKnitHooks(rootPath, config) {
   for (const event of Object.keys(fresh.hooks)) {
     const userEntries = Array.isArray(userHooks[event]) ? userHooks[event] : [];
     const preserved = userEntries.filter((entry) => {
-      return !(entry && typeof entry === "object" && entry._knitOwned === true);
+      if (!entry || typeof entry !== "object") return true;
+      const e = entry;
+      return e._knitOwned !== true && e._engramOwned !== true;
     });
     userHooks[event] = [...preserved, ...fresh.hooks[event]];
   }
@@ -689,6 +693,7 @@ function writeKnitHooks(rootPath, config) {
     hooks: userHooks,
     _knitHooks: { ...fresh._knitHooks, merged: true }
   };
+  delete merged._engramHooks;
   mkdirSync(claudeDir, { recursive: true });
   writeFileSync(settingsPath, JSON.stringify(merged, null, 2), "utf-8");
 }

package/dist/{chunk-TH5QPD5E.js → chunk-Y3I4NAKM.js}

@@ -5,7 +5,7 @@ import {
   isBundledCore,
   knownAgents,
   rawAgentUrl
-} from "./chunk-LW6NOFHF.js";
+} from "./chunk-7PPC6IG6.js";
 import {
   agentsCacheFile,
   projectAgentFile,
@@ -65,9 +65,9 @@ async function fetchAgent(name, opts = {}) {
   if (existsSync(cachePath)) {
     return readFileSync(cachePath, "utf-8");
   }
-  if (process.env.ENGRAM_OFFLINE === "1") {
+  if (process.env.KNIT_OFFLINE === "1" || process.env.ENGRAM_OFFLINE === "1") {
     throw new AgentFetchError(
-      `Agent "${name}" not bundled and not cached, and ENGRAM_OFFLINE=1 is set. Either unset ENGRAM_OFFLINE or run \`engram install-agents\` when online to populate the cache.`
+      `Agent "${name}" not bundled and not cached, and KNIT_OFFLINE=1 is set. Either unset KNIT_OFFLINE (and legacy ENGRAM_OFFLINE) or run \`knit install-agents\` when online to populate the cache.`
     );
   }
   const url = rawAgentUrl(bare, ref);

package/dist/cli.js

@@ -2,6 +2,14 @@
 
 // src/cli.ts
 import { Command } from "commander";
+
+// src/version.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var VERSION = pkg.version;
+
+// src/cli.ts
 var args = process.argv.slice(2);
 var hasSubcommand = args.length > 0 && ["setup", "status", "refresh", "install-agents", "export", "--help", "-h", "--version", "-V"].includes(args[0]);
 var isTTY = process.stdin.isTTY;
@@ -16,11 +24,11 @@ if (hasSubcommand) {
 async function runCLI() {
   const gradient = (await import("gradient-string")).default;
   const chalk = (await import("chalk")).default;
-  const { setupCommand } = await import("./setup-EQMYVVZ6.js");
-  const { statusCommand } = await import("./status-56MCC7KE.js");
-  const { refreshCommand } = await import("./refresh-3UK7NS5A.js");
-  const { installAgentsCommand } = await import("./install-agents-2UVEAP2W.js");
-  const { exportCommand } = await import("./export-3MA272OR.js");
+  const { setupCommand } = await import("./setup-5TUUWLIJ.js");
+  const { statusCommand } = await import("./status-H2CU72CE.js");
+  const { refreshCommand } = await import("./refresh-UNT4HGYT.js");
+  const { installAgentsCommand } = await import("./install-agents-JS7WB5E6.js");
+  const { exportCommand } = await import("./export-D2FXGKBO.js");
   const ENGRAM_GRADIENT = gradient(["#7c3aed", "#2563eb", "#06b6d4"]);
   const banner = `
   \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
@@ -36,7 +44,7 @@ async function runCLI() {
   \u2551                                       \u2551
   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D`;
   const program = new Command();
-  program.name("knit").description("The second brain for Claude Code \u2014 MCP server + analytics dashboard").version("0.4.1").hook("preAction", () => {
+  program.name("knit").description("The second brain for Claude Code \u2014 MCP server + analytics dashboard").version(VERSION).hook("preAction", () => {
     console.log(ENGRAM_GRADIENT.multiline(banner));
     console.log();
   });
@@ -86,11 +94,11 @@ async function runMCP() {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
   const { ListToolsRequestSchema, CallToolRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
-  const { getBrain, detectProjectRoot, refreshBrain } = await import("./cache-C6LI7UVN.js");
-  const { getToolDefinitions, handleToolCall } = await import("./tools-VHBH4PPR.js");
+  const { getBrain, detectProjectRoot, refreshBrain } = await import("./cache-7HTB4MTJ.js");
+  const { getToolDefinitions, handleToolCall } = await import("./tools-PB7IDFNS.js");
   const ROOT_PATH = detectProjectRoot();
   const server = new Server(
-    { name: "knit-brain", version: "0.4.1" },
+    { name: "knit-brain", version: VERSION },
     { capabilities: { tools: {} } }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => ({

package/dist/{export-3MA272OR.js → export-D2FXGKBO.js}

@@ -94,7 +94,7 @@ async function exportObsidian(vaultPath, options) {
     renderIndex(exported, perProjectCount, globalCount, projectEntryCounts),
     "utf-8"
   );
-  if (!process.env.ENGRAM_EXPORT_QUIET) {
+  if (!process.env.KNIT_EXPORT_QUIET && !process.env.ENGRAM_EXPORT_QUIET) {
     console.log(chalk.green("  \u2713"), `Exported ${perProjectCount} per-project + ${globalCount} global learnings to ${vaultPath}`);
   }
 }

package/dist/{install-agents-2UVEAP2W.js → install-agents-JS7WB5E6.js}

@@ -1,12 +1,12 @@
 import {
   getBrain
-} from "./chunk-NZXLCN4Q.js";
+} from "./chunk-QU46A5ZT.js";
 import "./chunk-QMICM263.js";
-import "./chunk-GRSYI2RR.js";
+import "./chunk-M3YZOJNW.js";
 import {
   installAgentsForProject
-} from "./chunk-TH5QPD5E.js";
-import "./chunk-LW6NOFHF.js";
+} from "./chunk-Y3I4NAKM.js";
+import "./chunk-7PPC6IG6.js";
 import "./chunk-BAUQEFYY.js";
 import "./chunk-YI37OAJ7.js";
 
@@ -19,7 +19,7 @@ async function installAgentsCommand(targetDir, options) {
   const rootPath = targetDir === "." ? process.cwd() : targetDir;
   if (!existsSync(join(rootPath, "CLAUDE.md"))) {
     console.log(chalk.yellow("  No CLAUDE.md found in this directory."));
-    console.log(chalk.dim("  Open this project in Claude Code with engram MCP first \u2014 it auto-initializes on first tool call."));
+    console.log(chalk.dim("  Open this project in Claude Code with the Knit MCP first \u2014 it auto-initializes on first tool call."));
     process.exit(1);
   }
   const spinner = ora({ text: chalk.dim("Loading brain\u2026"), spinner: "dots" }).start();
@@ -53,7 +53,7 @@ async function installAgentsCommand(targetDir, options) {
     console.log();
   }
   if (result.skippedUserCurated.length > 0) {
-    console.log(chalk.bold("  Skipped (user-curated files; engram won't clobber)"));
+    console.log(chalk.bold("  Skipped (user-curated files; Knit won't clobber)"));
     for (const name of result.skippedUserCurated) {
       console.log(`  ${chalk.yellow("!")} knit-${name}.md`);
     }

package/dist/{refresh-3UK7NS5A.js → refresh-UNT4HGYT.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-QMICM263.js";
 import {
   findFalsePositives
-} from "./chunk-GRSYI2RR.js";
+} from "./chunk-M3YZOJNW.js";
 import {
   scanProject
-} from "./chunk-LW6NOFHF.js";
+} from "./chunk-7PPC6IG6.js";
 import {
   knowledgePath,
   learningsDir,
@@ -22,7 +22,7 @@ import ora from "ora";
 async function refreshCommand(targetDir) {
   const rootPath = targetDir === "." ? process.cwd() : targetDir;
   if (!existsSync(join(rootPath, "CLAUDE.md")) || !existsSync(projectDataDir(rootPath))) {
-    console.log(chalk.red("  No Engram setup found. Open this project in Claude Code with the Knit MCP \u2014 it will auto-initialize."));
+    console.log(chalk.red("  No Knit setup found. Open this project in Claude Code with the Knit MCP \u2014 it will auto-initialize."));
     process.exit(1);
   }
   const spinner = ora({ text: chalk.dim("Re-scanning project..."), spinner: "dots" }).start();

package/dist/{setup-EQMYVVZ6.js → setup-5TUUWLIJ.js}

@@ -7,7 +7,7 @@ import ora from "ora";
 var MCP_CONFIG = {
   "knit-brain": {
     command: "npx",
-    args: ["-y", "@piyushdua/engram-dev@latest"]
+    args: ["-y", "knit-mcp@latest"]
   }
 };
 async function setupCommand(options) {
@@ -60,9 +60,9 @@ async function setupCommand(options) {
   console.log(`  ${chalk.green("\u2713")} Auto-initializes on first use \u2014 no per-project setup needed`);
   console.log();
   const globalClaudeMd = join(homedir(), ".claude", "CLAUDE.md");
-  const engramInstruction = `
+  const knitInstruction = `
 
-## Engram Brain (MCP)
+## Knit Brain (MCP)
 
 You have the Knit MCP server connected. USE IT on every task:
 
@@ -75,21 +75,21 @@ For new projects, call \`knit_brain_status\` first \u2014 triggers auto-initiali
 `;
   if (existsSync(globalClaudeMd)) {
     const existing = readFileSync(globalClaudeMd, "utf-8");
-    if (!existing.includes("Engram Brain (MCP)")) {
-      writeFileSync(globalClaudeMd, existing + engramInstruction, "utf-8");
-      console.log(`  ${chalk.green("\u2713")} Engram instructions added to ${chalk.cyan("~/.claude/CLAUDE.md")}`);
+    if (!existing.includes("Knit Brain (MCP)") && !existing.includes("Engram Brain (MCP)")) {
+      writeFileSync(globalClaudeMd, existing + knitInstruction, "utf-8");
+      console.log(`  ${chalk.green("\u2713")} Knit instructions added to ${chalk.cyan("~/.claude/CLAUDE.md")}`);
     }
   } else {
     const dir2 = join(homedir(), ".claude");
     if (!existsSync(dir2)) mkdirSync(dir2, { recursive: true });
-    writeFileSync(globalClaudeMd, `# Claude Code Global Instructions${engramInstruction}`, "utf-8");
-    console.log(`  ${chalk.green("\u2713")} Created ${chalk.cyan("~/.claude/CLAUDE.md")} with Engram instructions`);
+    writeFileSync(globalClaudeMd, `# Claude Code Global Instructions${knitInstruction}`, "utf-8");
+    console.log(`  ${chalk.green("\u2713")} Created ${chalk.cyan("~/.claude/CLAUDE.md")} with Knit instructions`);
   }
   console.log();
   console.log(chalk.bold("  How it works"));
   console.log(`  ${chalk.cyan("1.")} Open ${chalk.bold("any project")} in Claude Code`);
   console.log(`  ${chalk.cyan("2.")} Agent calls \`knit_classify_task\` \u2192 brain auto-initializes`);
-  console.log(`  ${chalk.cyan("3.")} Agent gets 20 tools: imports, exports, tests, learnings, teams`);
+  console.log(`  ${chalk.cyan("3.")} Agent gets 35 tools: imports, exports, tests, learnings, teams`);
   console.log(`  ${chalk.cyan("4.")} Brain compounds with every session \u2014 gets smarter over time`);
   console.log();
   console.log(chalk.dim("  No CLI needed after this. The MCP server handles everything."));

package/dist/{status-56MCC7KE.js → status-H2CU72CE.js}

@@ -1,6 +1,6 @@
 import {
   readLearnings
-} from "./chunk-GRSYI2RR.js";
+} from "./chunk-M3YZOJNW.js";
 import {
   getKBSummary,
   getStaleEntries,
@@ -22,7 +22,7 @@ async function statusCommand(targetDir) {
   const kbPath = knowledgebasePath(rootPath);
   const knowledgeIndexPath = knowledgePath(rootPath);
   if (!existsSync(kbPath) && !existsSync(knowledgeIndexPath)) {
-    console.log(chalk.yellow("  No Engram data found. The brain will auto-initialize when you open this project in Claude Code."));
+    console.log(chalk.yellow("  No Knit data found. The brain will auto-initialize when you open this project in Claude Code."));
     console.log();
     return;
   }

package/dist/{tools-VHBH4PPR.js → tools-PB7IDFNS.js}

@@ -5,10 +5,10 @@ import {
   pruneSessionsByAge,
   searchSessions,
   sessionCount
-} from "./chunk-TH5QPD5E.js";
+} from "./chunk-Y3I4NAKM.js";
 import {
   scanProject
-} from "./chunk-LW6NOFHF.js";
+} from "./chunk-7PPC6IG6.js";
 import {
   appendGlobalLearning,
   buildGlobalLearning,
@@ -670,6 +670,28 @@ function findTagPairs(entries) {
   return Object.entries(pairs).sort((a, b) => b[1] - a[1]);
 }
 
+// src/mcp/sanitize.ts
+var PATTERNS = [
+  { name: "anthropic-key", regex: /sk-ant-[A-Za-z0-9\-_]{20,}/g },
+  { name: "openai-key", regex: /sk-[A-Za-z0-9]{32,}/g },
+  { name: "github-pat", regex: /ghp_[A-Za-z0-9]{20,}/g },
+  { name: "github-pat-fine", regex: /github_pat_[A-Za-z0-9_]{20,}/g },
+  { name: "github-oauth", regex: /gho_[A-Za-z0-9]{20,}/g },
+  { name: "gitlab-pat", regex: /glpat-[A-Za-z0-9\-_]{20,}/g },
+  { name: "aws-access-key-id", regex: /AKIA[A-Z0-9]{16}/g },
+  { name: "slack-token", regex: /xox[abopr]-[A-Za-z0-9-]{20,}/g },
+  { name: "npm-token", regex: /npm_[A-Za-z0-9]{36,}/g },
+  { name: "pem-private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g }
+];
+function redactSecrets(input) {
+  if (!input) return input;
+  let out = input;
+  for (const { name, regex } of PATTERNS) {
+    out = out.replace(regex, `[REDACTED:${name}]`);
+  }
+  return out;
+}
+
 // src/engine/teams.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, statSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
@@ -1126,11 +1148,11 @@ function handleRecordLearning(params, brain) {
   const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const entry = {
     date,
-    summary: params.summary || "Untitled learning",
+    summary: redactSecrets(params.summary || "Untitled learning"),
     domains: (params.domains || "general").split(",").map((d) => d.trim()),
-    approach: params.approach || "",
+    approach: redactSecrets(params.approach || ""),
     outcome: ["success", "partial", "failure"].includes(params.outcome) ? params.outcome : "success",
-    lesson: params.lesson || "",
+    lesson: redactSecrets(params.lesson || ""),
     tags: (params.tags || "").split(/\s+/).filter((t) => t.startsWith("#"))
   };
   addEntry(brain.knowledgeBase, entry);
@@ -1161,11 +1183,11 @@ function handleRecordFalsePositive(params, brain) {
   const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const entry = {
     date,
-    summary: params.summary || "Untitled FP",
+    summary: redactSecrets(params.summary || "Untitled FP"),
     domains: ["General"],
     approach: "Verified manually",
     outcome: "success",
-    lesson: params.reason || "Confirmed non-issue",
+    lesson: redactSecrets(params.reason || "Confirmed non-issue"),
     tags: [...(params.tags || "").split(/\s+/).filter((t) => t.startsWith("#")), "#false-positive"]
   };
   addEntry(brain.knowledgeBase, entry);
@@ -1179,22 +1201,23 @@ function handleRecordFalsePositive(params, brain) {
 }
 function handleSaveHandoff(params, brain) {
   const handoffPath = join2(brain.rootPath, "handoff.md");
+  const r = (k, fallback) => redactSecrets(params[k] || fallback);
   const content = `# Session Handoff
 
-**Goal:** ${params.goal || "Not specified"}
+**Goal:** ${r("goal", "Not specified")}
 
-**Current State:** ${params.current_state || "Not specified"}
+**Current State:** ${r("current_state", "Not specified")}
 
-**Files in Flight:** ${params.files_in_flight || "None"}
+**Files in Flight:** ${r("files_in_flight", "None")}
 
-**What Changed:** ${params.what_changed || "Nothing"}
+**What Changed:** ${r("what_changed", "Nothing")}
 
 **Failed Attempts:**
-${params.failed_attempts || "None documented"}
+${r("failed_attempts", "None documented")}
 
-**Decisions Made:** ${params.decisions_made || "None"}
+**Decisions Made:** ${r("decisions_made", "None")}
 
-**Next Step:** ${params.next_step || "Not specified"}
+**Next Step:** ${r("next_step", "Not specified")}
 
 ---
 *Saved: ${(/* @__PURE__ */ new Date()).toISOString()}*
@@ -1431,8 +1454,8 @@ function handleGetSuggestions(params, brain) {
   });
 }
 function handleRecordGlobalLearning(params, brain) {
-  const summary = (params.summary || "").slice(0, 500);
-  const lesson = (params.lesson || "").slice(0, 2e3);
+  const summary = redactSecrets((params.summary || "").slice(0, 500));
+  const lesson = redactSecrets((params.lesson || "").slice(0, 2e3));
   const tags = (params.tags || "").split(/\s+/).filter((t) => t.startsWith("#"));
   const outcomeRaw = (params.outcome || "").toLowerCase();
   const outcome = ["success", "partial", "failure"].includes(outcomeRaw) ? outcomeRaw : void 0;
@@ -1604,7 +1627,7 @@ function handleInstallAgent(params, brain) {
     status: "queued",
     agent: name,
     target: `<project>/.claude/agents/knit-${name}.md`,
-    instruction: "Install started in background. File will be ready within a few seconds. If it fails, see stderr \u2014 engram does not throw from this handler."
+    instruction: "Install started in background. File will be ready within a few seconds. If it fails, see stderr \u2014 Knit does not throw from this handler."
   });
 }
 function handleSpawnTeamWorktree(params, brain) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "knit-mcp",
-  "version": "0.6.1",
+  "version": "0.6.4",
   "description": "Knit — second brain for Claude Code. MCP server giving any AI agent project-scoped memory, tiered workflow protocol, and parallel team worktrees.",
   "type": "module",
   "bin": {