wyrm-mcp 7.3.1 → 7.3.3

package/BENCHMARKS.md

@@ -2,6 +2,8 @@
 
 Wyrm competes on an axis the cloud memory layers can't stand on: **the number is produced with zero cloud calls and zero generative-LLM calls, and anyone can reproduce it offline.** mem0 / Zep / Supermemory headline end-to-end QA accuracy that depends on an LLM extracting and answering; the number below is the **retrieval floor underneath that** — *did the memory actually return a ground-truth supporting turn?* — measured deterministically.
 
+> **Comparing to mem0 / Zep / others?** See **[COMPARISON.md](./COMPARISON.md)** — a cited, honest side-by-side that keeps retrieval-recall and QA-answer-accuracy in *separate* columns (they measure different things, and every competitor number is vendor-self-reported).
+
 ## Metric
 
 Real **LoCoMo** (*Evaluating Very Long-Term Conversational Memory*, snap-research/locomo — 10 multi-session conversations, 1,986 QA). Every dialogue turn is ingested tagged with its `dia_id`; for each question that ships ground-truth `evidence` turns, Wyrm recalls over the question and we score whether a supporting `dia_id` comes back in the top-_k_.
@@ -50,8 +52,59 @@ node bench/locomo-hybrid.mjs bench/data/locomo10.json --k 10
 
 The committed `bench/longmemeval-fixture.json` ships a small self-contained corpus so `node bench/longmemeval.mjs` runs with **no download at all** — that fixture's no-LLM floor is the CI gate that keeps these numbers from regressing.
 
+## Beyond the retrieval floor — two more benchmarks
+
+Retrieval recall is the floor. Two more, all reproducible, all local (added 2026-06-27).
+
+### Negative learning — the firewall benchmark (the race we own)
+
+No public memory benchmark measures this. `bench/negative-learning.mjs` asks: when an agent is about to **repeat** a recorded mistake, does `wyrm_failure_check` block it — and stay silent on novel actions? Deterministic, no LLM, no cloud.
+
+| probe | result |
+|---|---|
+| same action re-attempted (the guard's real input) | **recall 100%** (16/16) |
+| novel actions | **precision 100%** · specificity 100% (0 false blocks of 16) |
+| reworded restatement | recall 12.5% — conjunctive-AND FTS is precision-first *by design* |
+| `checkVerdict` latency | p50 ~0.1 ms |
+
+Wyrm blocks literal repeats deterministically with zero false alarms. The reworded tier is intentionally conservative; a stopword filter on the fuzzy probe (so incidental filler words can't break the conjunctive-AND) recovered the filler-broken matches — **6.3% → 12.5% with precision held at 100%** (`tests/firewall-recall.test.ts` guards it). Going higher needs OR/threshold matching that would trade away that precision, so the firewall stays precision-first. Run: `node bench/negative-learning.mjs`.
+
+### Embedding-model sweep
+
+The hybrid number uses local `nomic-embed-text`. Swapping the embedder (same harness, `--model`):
+
+| embedder | hybrid r@5 | hybrid r@10 | MRR | multi-hop r@5 | note |
+|---|:--:|:--:|:--:|:--:|---|
+| `nomic-embed-text` (default, 274 MB) | 60.3% | 72.2% | .447 | 49.3% | the shipped default |
+| `mxbai-embed-large` (669 MB) | **61.1%** | **72.9%** | **.453** | **55.3%** | small net lift + notable multi-hop gain; 2.4× size |
+| `bge-m3` | — | — | — | — | errored under Ollama (NaN embeddings) — not benchmarkable here |
+
+`mxbai-embed-large` is a viable switchable upgrade (`--model mxbai-embed-large`), especially for multi-hop; nomic stays the lightweight default.
+
+### Cross-encoder reranker (opt-in) — measured: the biggest top-rank lift here
+
+`WYRM_RERANK_MODEL` engages `src/rerank.ts` (bge-reranker-v2-m3 over a local llama.cpp `/v1/rerank` endpoint) as a final, opt-in leg of `recallHybrid`. Measured on real LoCoMo (`bench/locomo-rerank.mjs`, 755 evidence QA / 4 convs, Q8_0, every query reranked — 0 fallbacks):
+
+| metric | hybrid (fused) | **+ reranker** | Δ |
+|---|:--:|:--:|:--:|
+| recall@1 | 33.2% | **52.6%** | **+19.4** |
+| recall@5 | 61.1% | **73.0%** | **+11.9** |
+| recall@10 | 73.2% | **76.6%** | +3.4 |
+| MRR@10 | .453 | **.613** | **+.16** |
+
+It lifts the **weak categories** most (recall@5): multi-hop **51.4 → 67.6**, open-domain **30.0 → 43.3**, single-hop 59.8 → 74.9, temporal 76.9 → 86.2. A cross-encoder's strength is precision at the *top* — hence the large recall@1 / MRR gains.
+
+**The tradeoff (why it's OFF by default):** a forward pass per candidate is slow — ~3.6 s/query on CPU at cand=15 (far faster on GPU). It's a quality lever for high-value retrieval, not the hot path; the deterministic hybrid stays the default. Setup + repro:
+
+```sh
+# 1. a llama.cpp server with reranking, serving bge-reranker-v2-m3 on :8088
+llama-server -m bge-reranker-v2-m3-Q8_0.gguf --reranking --pooling rank --port 8088
+# 2. the lift bench (local Ollama for embeddings, llama.cpp for the reranker)
+WYRM_RERANK_MODEL=bge-reranker-v2-m3 node bench/locomo-rerank.mjs bench/data/locomo10.json --convs 4
+```
+
 ## Why this framing, honestly
 
-- This is **retrieval recall, not QA accuracy.** We do not claim to beat Supermemory's 81.6% LongMemEval *answer* score — that's a different, LLM-in-the-loop metric on a different task. We claim the **strongest deterministic, zero-cloud retrieval floor**, which is the thing those products don't publish because their pipelines can't run without a cloud LLM.
+- This is **retrieval recall, not QA accuracy.** We do not claim to beat the cloud memory layers' end-to-end *answer*-accuracy scores — that's a different, LLM-in-the-loop metric on a different task (see `COMPARISON.md`; note every competitor figure is vendor-self-reported, and circulating "81.6% LongMemEval"-type numbers could not be tied to a verifiable primary source). We claim the **strongest deterministic, zero-cloud retrieval floor**, which is the thing those products don't publish because their pipelines can't run without a cloud LLM.
 - The floor is **honest about its weak spots** — multi-hop and open-domain are where pure lexical retrieval struggles; the per-category table shows it rather than hiding behind an average.
 - Every number here is **offline and reproducible.** No leaderboard submission, no private eval harness — the dataset is public and the harness is in this repo.

package/COMPARISON.md

@@ -0,0 +1,117 @@
+# Wyrm vs. the field — an honest comparison
+
+> Companion to [`BENCHMARKS.md`](./BENCHMARKS.md). Last verified **2026-06-27** via a
+> multi-source, adversarially-verified literature pass against primary sources.
+> Every competitor number here is **vendor-self-reported** and cited to its paper/repo.
+
+## The one rule this document refuses to break
+
+There are **two different evaluation axes**, and they are routinely (and incorrectly)
+mixed in marketing tables:
+
+| Axis | Question it answers | Who reports it |
+|---|---|---|
+| **Retrieval recall@k** | "When the question is asked, did the memory layer *surface the ground-truth supporting evidence*?" | **Wyrm** |
+| **QA answer accuracy** | "Did a *separate LLM judge* rate the *generated answer* correct vs a golden answer?" | mem0, Zep, and effectively every other system below |
+
+These are **not comparable numbers.** A retrieval recall@k of 72.2 is *not* better or
+worse than a QA-accuracy of 66.9 — they measure different things. This document keeps
+them in **separate tables** on purpose. Anyone placing "Wyrm 72.2" next to "Mem0 66.9"
+in one ranked column is making a category error.
+
+(Note the naming trap: Zep's headline benchmark is literally called *Deep Memory
+**Retrieval*** (DMR), but its score is final-answer correctness judged by an LLM — **not**
+recall@k.)
+
+## What *is* apples-to-apples: architecture
+
+This table compares facts that mean the same thing for every system.
+
+| System | Open source | Runs fully local / no cloud | LLM at **write** (ingest) | LLM at **answer** | Headline metric |
+|---|---|---|---|---|---|
+| **Wyrm** | AGPL-3.0 (dual-licensed) | ✅ yes | ❌ **none** (deterministic FTS/vector) | ❌ **none** (retrieval only) | retrieval recall@k |
+| Mem0 | Apache-2.0 (+ managed cloud) | self-host possible | ✅ required (LLM extraction + ADD/UPDATE/DELETE/NOOP) | ✅ required | QA accuracy (LLM-judge "J") |
+| Zep / Graphiti | Graphiti Apache-2.0 (Zep cloud) | self-host possible | ✅ required (LLM graph construction) | ✅ required | QA accuracy (LLM-judge) |
+| SuperMemory · cognee · SuperLocalMemory | varies | varies | varies | varies | *no citable LoCoMo/LongMemEval number found* (see below) |
+
+**The defensible differentiator:** Wyrm reaches competitive *retrieval* with **zero cloud
+and zero LLM calls at both read and write.** mem0 and Zep each require an LLM at ingest
+*and* at answer time. (Plus Wyrm's structural differentiators: negative learning /
+failure memory, decision causality, MCP-native, deterministic — none of which these
+benchmarks measure.)
+
+## The published numbers (separated by axis — do **not** cross-rank)
+
+### Wyrm — retrieval recall@k, real LoCoMo, local + zero-LLM
+
+Reproduces the figures in [`BENCHMARKS.md`](./BENCHMARKS.md) (snap-research/LoCoMo, 10
+convs / 1,982 evidence-bearing QA, k=10; re-run 2026-06-27, HEAD).
+
+| Tier | recall@1 | recall@5 | recall@10 | MRR | LLM? | Cloud? |
+|---|---|---|---|---|---|---|
+| FTS floor (deterministic, offline) | 29.5 | 52.4 | 59.9 | .393 | none | none |
+| + vectors (nomic-embed-text, local) | 28.8 | 58.7 | 69.5 | .413 | none* | none |
+| hybrid (FTS ⊕ vector, RRF cand25) | 32.8 | 60.3 | 72.2 | .447 | none* | none |
+| production (convex fusion, cand50 α0.7) | 32.1 | 61.6 | 72.5 | .446 | none* | none |
+
+\* the embedding model is a local Ollama call, not a generative LLM; the FTS floor needs
+no model at all and is the CI-gated, fully-deterministic number.
+
+### Competitors — QA answer accuracy (LLM-judge), vendor-self-reported
+
+| System | Benchmark | Metric | Score | Source |
+|---|---|---|---|---|
+| Mem0 (paper) | LoCoMo | LLM-judge "J" | **66.88%** (mem0-graph 68.44%) | arXiv 2504.19413 |
+| ↳ same table, comparators | LoCoMo | LLM-judge "J" | Full-Context 72.90 · Zep 65.99† · LangMem 58.10 · OpenAI-memory 52.90 | arXiv 2504.19413 |
+| Mem0 (managed Platform v3 — *different config from the paper*) | LoCoMo | answer acc. | 92.5% (Top-200) / 91.8% (Top-50) | github: mem0ai/memory-benchmarks |
+| Mem0 (managed Platform v3) | LongMemEval | answer acc. | 94.4% (Top-200) / 94.8% (Top-50) | github: mem0ai/memory-benchmarks |
+| Zep (paper) | LongMemEval | answer acc. (GPT-4o judge) | 71.2% (gpt-4o) / 63.8% (gpt-4o-mini) vs baseline 60.2 / 55.4 | arXiv 2501.13956 |
+| Zep (paper) | DMR | answer acc. | 94.8% (gpt-4-turbo) / 98.2% (gpt-4o-mini) vs MemGPT 93.4% | arXiv 2501.13956 |
+
+## Footnotes that matter (read before quoting any number)
+
+- **† The "Zep LoCoMo 65.99%" figure is not Zep's.** Zep's own paper reports **no LoCoMo
+  numbers at all** — only DMR and LongMemEval. The 65.99% comes from *Mem0's* table
+  (Mem0 scoring Zep). A separate third-party correction (getzep/zep-papers issue #5)
+  recalculated a circulating "Zep 84% LoCoMo" claim down to ~58.44% once the otherwise-
+  excluded adversarial category is included.
+- **Mem0's paper (~67%) and Mem0's repo (~92%) disagree** because they measure different
+  systems/configs (the ECAI paper's OSS pipeline vs. the managed Platform v3). Both are
+  answer-accuracy, both vendor-self-reported.
+- **Everything in the competitor table is vendor-self-reported** — the paper authors carry
+  `@mem0.ai` / `@getzep.com` affiliations and the benchmark repos are the vendors' own.
+  No independent third-party reproduction was found.
+- **LoCoMo is a weak benchmark.** The QA-eval set is only **10 conversations**; the
+  **adversarial category is excluded** because ground-truth answers are unavailable; and
+  the dialogues are **synthetically LLM-generated** with documented gold-answer quality
+  flaws. Treat all LoCoMo numbers — ours included — with that caution.
+- **Zep itself calls its DMR gains "marginal"** over both MemGPT and a full-context
+  baseline (94.8 vs 94.4), and notes DMR's 60-message conversations fit in a modern
+  context window, making DMR a weak test of memory.
+
+## What we looked for and did **not** find
+
+No citable, primary-source LoCoMo or LongMemEval number survived verification for
+**SuperMemory**, **cognee**, **Letta/MemGPT** (it appears only as a *baseline* inside
+Zep's DMR table at 93.4%), or **SuperLocalMemory**. Figures circulating for these (e.g.
+a "SuperMemory 81.6% LongMemEval" or "SuperLocalMemory 74.8% LoCoMo") could not be tied
+to a verifiable primary source and are deliberately omitted rather than repeated.
+
+## The honest takeaway
+
+- You **cannot** say "Wyrm beats mem0/Zep" — they report a different metric on a
+  partly-different benchmark, with an LLM in the loop that Wyrm doesn't use.
+- What is **true and rare**: Wyrm delivers competitive *retrieval* (recall@10 72.2 on
+  real LoCoMo) **with no cloud and no LLM at read or write**, where mem0 and Zep both
+  require an LLM at ingest and answer time. That — plus negative learning, decision
+  causality, and MCP-native local-first operation — is the moat. Not a bigger number.
+
+## Sources
+
+- Mem0 — "Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory",
+  arXiv:2504.19413 (ECAI 2025). Benchmark repo: github.com/mem0ai/memory-benchmarks.
+- Zep — "Zep: A Temporal Knowledge Graph Architecture for Agent Memory",
+  arXiv:2501.13956 (Jan 2025). Blog: blog.getzep.com.
+- LoCoMo — snap-research/locomo (the dataset Wyrm's retrieval numbers are measured on).
+- Wyrm retrieval numbers + methodology — [`BENCHMARKS.md`](./BENCHMARKS.md); reproduce with
+  `node bench/locomo-real.mjs` (FTS floor) and `node bench/locomo-hybrid.mjs` (hybrid).

package/README.md

@@ -3,14 +3,14 @@
 > Persistent memory is table stakes. The real problem is what agents *do* with it — Wyrm blocks the repeat, keeps decisions true, and learns as a fleet. Memory is the substrate; the judgment is the moat.
 
 [![npm version](https://img.shields.io/npm/v/wyrm-mcp?color=00B89F&label=npm)](https://www.npmjs.com/package/wyrm-mcp)
-[![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-00B89F.svg)](LICENSE)
+[![License: Proprietary](https://img.shields.io/badge/License-Proprietary-b91c1c.svg)](LICENSE)
 [![Tests](https://img.shields.io/badge/tests-1820%20passing-00B89F)](https://github.com/Ghosts-Protocol-Pvt-Ltd/Wyrm)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![MCP](https://img.shields.io/badge/MCP-compatible-00B89F)](https://modelcontextprotocol.io)
 
 **[wyrm.ghosts.lk](https://wyrm.ghosts.lk)**  ·  **[npm](https://www.npmjs.com/package/wyrm-mcp)**  ·  **[GitHub](https://github.com/Ghosts-Protocol-Pvt-Ltd/Wyrm)**  ·  **[Ghost Protocol](https://ghosts.lk)**  ·  `npm i -g wyrm-mcp`
 
-Local-first persistent memory for AI agents over MCP — by [Ghost Protocol](https://ghosts.lk). Runs fully offline on your machine: no cloud, no account, no LLM required. The managed cloud tier lives at **[wyrm.ghosts.lk](https://wyrm.ghosts.lk)**.
+Local-first persistent memory for AI agents over MCP — by [Ghost Protocol](https://ghosts.lk). Runs fully offline on your machine: no cloud, no LLM required. The official build activates with a one-time free `wyrm login`; your memory stays local either way. The managed cloud tier lives at **[wyrm.ghosts.lk](https://wyrm.ghosts.lk)**.
 
 ---
 
@@ -24,7 +24,12 @@ Wyrm is not "AI memory." It's the **substrate** that turns one-shot AI conversat
 4. **↯ Federation.** Wyrm calls other MCP servers (GitHub, Slack, Linear, …) as tools. Buddy Protocol v1.0 lets Wyrm talk to other AI memory tools. Composes your whole stack into one mind.
 5. **✺ Creative substrate.** First-class design tokens (colour / type / spacing / motion / shadow / radius / breakpoint) and a tagged design-reference clipper — Wyrm is not just for code.
 
-**Reproducible numbers.** On real LoCoMo (1,982 evidence QA, verified on 7.3.0), Wyrm's deterministic **zero-LLM, zero-cloud** retrieval floor is recall@5 **52.4%** / recall@10 **59.9%**, lifting to **60.3% / 72.2%** with local Ollama vectors — every number offline and reproducible from this repo. → **[BENCHMARKS.md](BENCHMARKS.md)**
+**Reproducible numbers — with receipts.** Every figure below is offline and reproducible from this repo → **[BENCHMARKS.md](BENCHMARKS.md)**:
+
+- **Retrieval** — real LoCoMo (1,982 evidence QA): the deterministic **zero-LLM, zero-cloud** floor is recall@5 **52.4%** / recall@10 **59.9%**, lifting to **60.3% / 72.2%** with local Ollama vectors.
+- **Negative learning** — the benchmark no recall-only memory runs: the firewall blocks a repeated mistake at **100% recall · 100% precision** (0 false blocks on novel actions), deterministic, p50 ~0.1 ms.
+- **Reranker (opt-in)** — a local cross-encoder lifts recall@1 **33% → 53%** (+19 pts) and MRR **.45 → .61**.
+- **Honest vs the field** → **[COMPARISON.md](COMPARISON.md)**: Wyrm reports *retrieval recall@k*; mem0 / Zep report *LLM-judged QA-accuracy* — different axes, never conflated, every competitor figure cited + vendor-self-reported.
 
 ```
 You: "What did we decide about the auth architecture last week?"
@@ -258,7 +263,7 @@ Once connected, your AI has access to all Wyrm tools. Try:
 
 ## MCP Tools Reference
 
-Wyrm exposes 38 tools via the Model Context Protocol:
+Wyrm exposes a frozen 32-verb typed surface (137 tools callable) via the Model Context Protocol:
 
 ### Projects
 
@@ -480,15 +485,9 @@ Wyrm/
 
 ## Contributing
 
-Contributions are welcome! Here's how:
-
-1. **Fork** the repository
-2. **Create** a feature branch (`git checkout -b feat/amazing-feature`)
-3. **Commit** your changes (`git commit -m 'feat: add amazing feature'`)
-4. **Push** to the branch (`git push origin feat/amazing-feature`)
-5. **Open** a Pull Request
+Wyrm is a **proprietary repository** — free to use, but not open to external contributions. We do **not** accept forks or external pull requests.
 
-Please ensure tests pass (`npm test`) and the project builds (`npm run build`) before submitting.
+Issues and bug reports are welcome: please open an issue or email ryan@ghosts.lk.
 
 ---
 
@@ -499,7 +498,7 @@ Please ensure tests pass (`npm test`) and the project builds (`npm run build`) b
 - **Optional encryption** — AES-256-GCM for sensitive context data.
 - **Audited** — Security audits documented in [SECURITY_AUDIT.md](SECURITY_AUDIT.md) and [SECURITY_AUDIT_V2.md](SECURITY_AUDIT_V2.md).
 
-Found a vulnerability? Please open an issue or email security@ghosts.lk.
+Found a vulnerability? Please open an issue or email ryan@ghosts.lk.
 
 ---
 
@@ -508,9 +507,9 @@ Found a vulnerability? Please open an issue or email security@ghosts.lk.
 **Open standard + protected implementation:**
 
 - **The Wyrm Memory Protocol** ([`PROTOCOL.md`](../../PROTOCOL.md)) is an **open spec, freely implementable** by anyone (CC-BY-4.0) — build a WMP-compatible memory without touching Wyrm's code.
-- **This implementation** (`wyrm-mcp`) is **[AGPL-3.0-or-later](LICENSE)** — Copyright © 2024-2026 [Ghost Protocol (Pvt) Ltd](https://ghosts.lk).
+- **This implementation** (`wyrm-mcp`) is **[Proprietary Freeware](LICENSE)** — free to use, all rights reserved. Copyright © 2024-2026 [Ghost Protocol (Pvt) Ltd](https://ghosts.lk).
 
-For a **commercial license** (embedding Wyrm in a closed product, or running it as a managed service without AGPL's source-sharing obligations), contact [ghosts.lk@proton.me](mailto:ghosts.lk@proton.me).
+For a **commercial license** (embedding Wyrm in a closed product, or running it as a managed service), contact [ryan@ghosts.lk](mailto:ryan@ghosts.lk).
 
 ---
 

package/dist/activation.js

@@ -1 +1,59 @@
-import{getLicenseInfo as r,selfTestVerifier as n}from"./license.js";import{OFFICIAL_BUILD as e}from"./build-flags.js";const i=e||/^(1|true|yes|on)$/i.test(process.env.WYRM_REQUIRE_ACTIVATION??""),t=e?!n().ok:!1;if(t)try{console.error("Wyrm: integrity self-test FAILED \u2014 license verifier tampered; activation gate locked.")}catch{}function s(){return t?!1:!i||r().valid}function c(){return{content:[{type:"text",text:"\u{1F512} Wyrm requires a free account on this build.\n\nRun `wyrm login` in your terminal to sign in and activate (free). Your memory stays local \u2014 login just ties usage to an account so it can be managed.\n\nAlready logged in? Your activation may have expired \u2014 run `wyrm login` again to refresh."}],isError:!0}}export{i as REQUIRE_ACTIVATION,c as activationGateResult,s as activationSatisfied};
+/**
+ * Activation gate for account-required builds.
+ *
+ * OFF by default in source — the test suite and local dev builds are unaffected.
+ * The OFFICIAL distribution bakes `WYRM_REQUIRE_ACTIVATION=1`, so the free tier
+ * needs a (free) account: `wyrm login` fetches a short-lived, account-bound signed
+ * license that's validated locally by license.ts. A suspended account can't
+ * refresh, so access lapses at expiry. Memory is local either way — login only
+ * ties usage to a revocable identity. (Wyrm is proprietary; see LICENSE.)
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license Proprietary — (c) 2026 Ghost Protocol (Pvt) Ltd. All rights reserved. See LICENSE.
+ */
+import { getLicenseInfo, selfTestVerifier } from './license.js';
+import { OFFICIAL_BUILD } from './build-flags.js';
+/**
+ * Whether the account-required gate is enabled on this build. ON when this is the
+ * official published artifact (OFFICIAL_BUILD baked true at release), OR when the
+ * operator opts in via WYRM_REQUIRE_ACTIVATION. OFF in source + tests.
+ */
+export const REQUIRE_ACTIVATION = OFFICIAL_BUILD || /^(1|true|yes|on)$/i.test(process.env.WYRM_REQUIRE_ACTIVATION ?? '');
+/**
+ * Tamper-evidence: on the official build, verify at load that the license verifier
+ * still rejects a forged signature. If it doesn't, someone stubbed the verifier to
+ * bypass the gate — so we keep the gate CLOSED regardless of what getLicenseInfo()
+ * now claims. A determined forker can remove this too (patching the closed, minified dist) — a
+ * deterrent, not a guarantee.
+ */
+const TAMPERED = OFFICIAL_BUILD ? !selfTestVerifier().ok : false;
+if (TAMPERED) {
+    try {
+        console.error('Wyrm: integrity self-test FAILED — license verifier tampered; activation gate locked.');
+    }
+    catch { /* noop */ }
+}
+/**
+ * True when tool execution is permitted. Always true unless the build requires
+ * activation AND no valid (free or paid) account-bound license is loaded.
+ * Re-checked live so a mid-session `wyrm login` takes effect without a restart.
+ */
+export function activationSatisfied() {
+    if (TAMPERED)
+        return false; // verifier subverted → never satisfy the gate
+    return !REQUIRE_ACTIVATION || getLicenseInfo().valid;
+}
+/** The MCP error result returned for any tool call while activation is unmet. */
+export function activationGateResult() {
+    return {
+        content: [{
+                type: 'text',
+                text: '🔒 Wyrm requires a free account on this build.\n\n'
+                    + 'Run `wyrm login` in your terminal to sign in and activate (free). '
+                    + 'Your memory stays local — login just ties usage to an account so it can be managed.\n\n'
+                    + 'Already logged in? Your activation may have expired — run `wyrm login` again to refresh.',
+            }],
+        isError: true,
+    };
+}
+//# sourceMappingURL=activation.js.map

package/dist/agent-daemon.js

@@ -1,6 +1,283 @@
-import{spawn as E}from"child_process";import{existsSync as l,readFileSync as g,writeFileSync as I,statSync as w,openSync as M,closeSync as h,renameSync as v,unlinkSync as f,mkdirSync as O}from"fs";import{homedir as R}from"os";import{join as d,dirname as S,resolve as k}from"path";import{fileURLToPath as b}from"url";const m=d(R(),".wyrm"),i=d(m,"wyrm-loop.pid"),u=d(m,"wyrm-loop.log"),_=d(m,"wyrm-loop.log.1"),D=1e6;function T(){l(m)||O(m,{recursive:!0})}function C(){try{l(u)&&w(u).size>D&&(l(_)&&f(_),v(u,_))}catch{}}function L(){try{const p=g(i,"utf-8").trim(),t=parseInt(p,10);return Number.isFinite(t)&&t>0?t:null}catch{return null}}function y(p){try{return process.kill(p,0),!0}catch{return!1}}function F(){try{const t=b(import.meta.url),r=[k(S(t),"wyrm-loop.js"),k(S(t),"..","dist","wyrm-loop.js")];for(const n of r)if(l(n))return n}catch{}const p=(process.env.PATH??"").split(":");for(const t of p){const r=d(t,"wyrm-loop");if(l(r))return r}return null}class A{db;constructor(t){this.db=t}status(){const t=L(),r=t!=null&&y(t);let n,a;try{if(l(i)){const s=w(i);n=s.mtime.toISOString(),a=Math.round((Date.now()-s.mtime.getTime())/1e3)}}catch{}let e;try{const s=this.db.prepare(`
+/**
+ * Agent daemon process manager.
+ *
+ * Lets an AI client (Claude / Codex / Cursor / etc.) bootstrap, monitor,
+ * and tear down the `wyrm-loop` autonomous scheduler without the
+ * operator running shell commands. The MCP server can spawn the daemon
+ * as a detached background process, write a PID + log file under
+ * `~/.wyrm/`, and check liveness on demand.
+ *
+ * Files (all under `~/.wyrm/`):
+ *   wyrm-loop.pid    PID of the running daemon (single-line)
+ *   wyrm-loop.log    Stdout/stderr of the daemon (rotated at 1MB)
+ *
+ * Single-instance guarantee — if a PID file exists and the process is
+ * alive, `start()` refuses (no fork-bomb). `restart()` is provided as
+ * an explicit operation.
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license Proprietary — (c) 2026 Ghost Protocol (Pvt) Ltd. All rights reserved. See LICENSE.
+ */
+import { spawn } from 'child_process';
+import { existsSync, readFileSync, writeFileSync, statSync, openSync, closeSync, renameSync, unlinkSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
+import { join, dirname, resolve } from 'path';
+import { fileURLToPath } from 'url';
+const WYRM_DIR = join(homedir(), '.wyrm');
+const PID_FILE = join(WYRM_DIR, 'wyrm-loop.pid');
+const LOG_FILE = join(WYRM_DIR, 'wyrm-loop.log');
+const LOG_FILE_OLD = join(WYRM_DIR, 'wyrm-loop.log.1');
+const MAX_LOG_BYTES = 1_000_000;
+function ensureWyrmDir() {
+    if (!existsSync(WYRM_DIR))
+        mkdirSync(WYRM_DIR, { recursive: true });
+}
+function rotateLogIfLarge() {
+    try {
+        if (existsSync(LOG_FILE) && statSync(LOG_FILE).size > MAX_LOG_BYTES) {
+            if (existsSync(LOG_FILE_OLD))
+                unlinkSync(LOG_FILE_OLD);
+            renameSync(LOG_FILE, LOG_FILE_OLD);
+        }
+    }
+    catch { /* best-effort */ }
+}
+function readPid() {
+    try {
+        const raw = readFileSync(PID_FILE, 'utf-8').trim();
+        const pid = parseInt(raw, 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        // signal 0 doesn't kill; just checks existence + permission
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Find the bundled `wyrm-loop` script path. Resolves relative to this
+ * module so it works whether installed via npm, run from source, or
+ * invoked from a global symlink. */
+function locateLoopBinary() {
+    // 1. import.meta.url → packages/mcp-server/dist/agent-daemon.js
+    try {
+        const here = fileURLToPath(import.meta.url);
+        const candidates = [
+            // installed alongside (dist/wyrm-loop.js)
+            resolve(dirname(here), 'wyrm-loop.js'),
+            // source layout
+            resolve(dirname(here), '..', 'dist', 'wyrm-loop.js'),
+        ];
+        for (const p of candidates) {
+            if (existsSync(p))
+                return p;
+        }
+    }
+    catch { /* fall through */ }
+    // 2. Look in PATH for the `wyrm-loop` binary (set up by `npm install -g`)
+    const pathDirs = (process.env.PATH ?? '').split(':');
+    for (const dir of pathDirs) {
+        const cand = join(dir, 'wyrm-loop');
+        if (existsSync(cand))
+            return cand;
+    }
+    return null;
+}
+export class AgentDaemon {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Current daemon status. Always safe to call. */
+    status() {
+        const pid = readPid();
+        const running = pid != null && isProcessAlive(pid);
+        let started_at;
+        let uptime_seconds;
+        try {
+            if (existsSync(PID_FILE)) {
+                const st = statSync(PID_FILE);
+                started_at = st.mtime.toISOString();
+                uptime_seconds = Math.round((Date.now() - st.mtime.getTime()) / 1000);
+            }
+        }
+        catch { /* best-effort */ }
+        // Read latest agent_actions row for "last action" summary
+        let last_action;
+        try {
+            const row = this.db.prepare(`
         SELECT actor, goal_id, action_kind, summary, result_status, ran_at
         FROM agent_actions ORDER BY id DESC LIMIT 1
-      `).get();s&&(e={ran_at:s.ran_at,actor:s.actor,goal_id:s.goal_id,summary:`${s.action_kind}: ${s.summary}`.slice(0,200),result_status:s.result_status})}catch{}let o=0,c=0;try{o=this.db.prepare("SELECT COUNT(*) as c FROM goals WHERE status = 'active'").get().c,c=this.db.prepare("SELECT COALESCE(SUM(iterations_count), 0) as c FROM goals").get().c}catch{}return{running:r,pid:r?t:null,pid_file:i,log_file:u,started_at:r?n:void 0,uptime_seconds:r?a:void 0,last_action:e,active_goals:o,total_iterations:c}}start(t={}){T(),C();const r=this.status();if(r.running)return{ok:!0,pid:r.pid??void 0,status:r};if(l(i))try{f(i)}catch{}const n=F();if(!n)return{ok:!1,error:"Could not locate wyrm-loop binary. Run `npm install -g wyrm-mcp` or `npm run build` in packages/mcp-server."};const a=["--interval",String(t.interval_seconds??600)];t.max_steps&&a.push("--max-steps",String(t.max_steps)),t.project_path&&a.push("--project",t.project_path),t.verbose&&a.push("--verbose");let e;try{e=M(u,"a")}catch(c){return{ok:!1,error:`Could not open log file ${u}: ${c.message}`}}let o;try{o=E("node",[n,...a],{detached:!0,stdio:["ignore",e,e],env:{...process.env,WYRM_LOOP_LOG:t.verbose?"1":"0"}})}catch(c){return{ok:!1,error:`spawn failed: ${c.message}`}}if(!o.pid){try{h(e)}catch{}return{ok:!1,error:"spawn returned no PID"}}try{I(i,String(o.pid),"utf-8")}catch(c){try{process.kill(o.pid,"SIGTERM")}catch{}try{h(e)}catch{}return{ok:!1,error:`Could not write PID file: ${c.message}`}}try{h(e)}catch{}return o.unref(),{ok:!0,pid:o.pid,status:this.status()}}async stop(t={}){const r=L();if(r==null)return{ok:!0,was_running:!1};if(!y(r)){try{f(i)}catch{}return{ok:!0,was_running:!1,pid:r}}try{process.kill(r,"SIGTERM")}catch(e){return{ok:!1,was_running:!0,pid:r,error:`SIGTERM failed: ${e.message}`}}const n=Math.max(100,Math.min(t.grace_ms??3e3,3e4)),a=Date.now();for(;Date.now()-a<n&&y(r);)await new Promise(e=>{setTimeout(e,100)});if(y(r))try{process.kill(r,"SIGKILL")}catch{}try{f(i)}catch{}return{ok:!0,was_running:!0,pid:r}}async restart(t={}){return await this.stop({grace_ms:3e3}),this.start(t)}recentLog(t=40){try{return l(u)?g(u,"utf-8").split(`
-`).slice(-Math.max(1,Math.min(t,1e3))).join(`
-`):"(log file does not exist)"}catch(r){return`(could not read log: ${r.message})`}}}export{A as AgentDaemon};
+      `).get();
+            if (row)
+                last_action = {
+                    ran_at: row.ran_at, actor: row.actor, goal_id: row.goal_id,
+                    summary: `${row.action_kind}: ${row.summary}`.slice(0, 200),
+                    result_status: row.result_status,
+                };
+        }
+        catch { /* table may not exist on pre-v5 DBs */ }
+        let active_goals = 0;
+        let total_iterations = 0;
+        try {
+            active_goals = this.db.prepare(`SELECT COUNT(*) as c FROM goals WHERE status = 'active'`).get().c;
+            total_iterations = this.db.prepare(`SELECT COALESCE(SUM(iterations_count), 0) as c FROM goals`).get().c;
+        }
+        catch { /* pre-v5 DB */ }
+        return {
+            running,
+            pid: running ? pid : null,
+            pid_file: PID_FILE,
+            log_file: LOG_FILE,
+            started_at: running ? started_at : undefined,
+            uptime_seconds: running ? uptime_seconds : undefined,
+            last_action,
+            active_goals,
+            total_iterations,
+        };
+    }
+    /** Start the daemon. No-op if already running. */
+    start(opts = {}) {
+        ensureWyrmDir();
+        rotateLogIfLarge();
+        const cur = this.status();
+        if (cur.running) {
+            return { ok: true, pid: cur.pid ?? undefined, status: cur };
+        }
+        // Clear stale PID file from a crashed prior run
+        if (existsSync(PID_FILE)) {
+            try {
+                unlinkSync(PID_FILE);
+            }
+            catch { /* ignore */ }
+        }
+        const binary = locateLoopBinary();
+        if (!binary) {
+            return { ok: false, error: 'Could not locate wyrm-loop binary. Run `npm install -g wyrm-mcp` or `npm run build` in packages/mcp-server.' };
+        }
+        const args = ['--interval', String(opts.interval_seconds ?? 600)];
+        if (opts.max_steps)
+            args.push('--max-steps', String(opts.max_steps));
+        if (opts.project_path)
+            args.push('--project', opts.project_path);
+        if (opts.verbose)
+            args.push('--verbose');
+        // Open the log file once, share fd with the child
+        let logFd;
+        try {
+            logFd = openSync(LOG_FILE, 'a');
+        }
+        catch (err) {
+            return { ok: false, error: `Could not open log file ${LOG_FILE}: ${err.message}` };
+        }
+        let child;
+        try {
+            child = spawn('node', [binary, ...args], {
+                detached: true,
+                stdio: ['ignore', logFd, logFd],
+                env: { ...process.env, WYRM_LOOP_LOG: opts.verbose ? '1' : '0' },
+            });
+        }
+        catch (err) {
+            return { ok: false, error: `spawn failed: ${err.message}` };
+        }
+        if (!child.pid) {
+            try {
+                closeSync(logFd);
+            }
+            catch { /* ignore */ }
+            return { ok: false, error: 'spawn returned no PID' };
+        }
+        try {
+            writeFileSync(PID_FILE, String(child.pid), 'utf-8');
+        }
+        catch (err) {
+            // Process is up but we can't track it — kill to keep state consistent
+            try {
+                process.kill(child.pid, 'SIGTERM');
+            }
+            catch { /* ignore */ }
+            try {
+                closeSync(logFd);
+            }
+            catch { /* ignore */ }
+            return { ok: false, error: `Could not write PID file: ${err.message}` };
+        }
+        // Close the parent's copy of the log fd — the child inherits its own
+        // dup via stdio. Without this, every successful spawn leaks one fd in
+        // the parent (the MCP server).
+        try {
+            closeSync(logFd);
+        }
+        catch { /* ignore */ }
+        // unref so this process doesn't wait on the child
+        child.unref();
+        // Brief settle delay so status() reflects the new state
+        return { ok: true, pid: child.pid, status: this.status() };
+    }
+    /** Stop the daemon. Sends SIGTERM, then SIGKILL after a grace period. */
+    async stop(opts = {}) {
+        const pid = readPid();
+        if (pid == null) {
+            return { ok: true, was_running: false };
+        }
+        if (!isProcessAlive(pid)) {
+            // Stale PID file
+            try {
+                unlinkSync(PID_FILE);
+            }
+            catch { /* ignore */ }
+            return { ok: true, was_running: false, pid };
+        }
+        try {
+            process.kill(pid, 'SIGTERM');
+        }
+        catch (err) {
+            return { ok: false, was_running: true, pid, error: `SIGTERM failed: ${err.message}` };
+        }
+        const grace = Math.max(100, Math.min(opts.grace_ms ?? 3000, 30_000));
+        const start = Date.now();
+        while (Date.now() - start < grace) {
+            if (!isProcessAlive(pid))
+                break;
+            await new Promise(r => { setTimeout(r, 100); });
+        }
+        if (isProcessAlive(pid)) {
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch { /* may already be dead */ }
+        }
+        try {
+            unlinkSync(PID_FILE);
+        }
+        catch { /* ignore */ }
+        return { ok: true, was_running: true, pid };
+    }
+    /** Stop + Start in sequence. */
+    async restart(opts = {}) {
+        await this.stop({ grace_ms: 3000 });
+        return this.start(opts);
+    }
+    /** Read the last N lines of the daemon log. */
+    recentLog(lines = 40) {
+        try {
+            if (!existsSync(LOG_FILE))
+                return '(log file does not exist)';
+            const raw = readFileSync(LOG_FILE, 'utf-8');
+            const all = raw.split('\n');
+            return all.slice(-Math.max(1, Math.min(lines, 1000))).join('\n');
+        }
+        catch (err) {
+            return `(could not read log: ${err.message})`;
+        }
+    }
+}
+//# sourceMappingURL=agent-daemon.js.map