zeekay
9addabbf10
Adds pnpm overrides for 31 high / 3 critical advisories that the pnpm-audit-prod pre-commit hook surfaces (CI was failing). Key bumps: hono >=4.12.18, axios >=1.15.2, protobufjs >=8.0.2, fast-xml-parser >=5.7.0, @opentelemetry/sdk-node >=0.217.0, dompurify >=3.4.0, file-type >=21.3.1, ip-address >=10.1.1, postcss >=8.5.10, vite >=7.3.2, yaml >=2.8.3, lodash >=4.18.0 and several others. Also: extensions/brain and extensions/memory had '@hanzo/bot-graph-links: "*"' which pnpm 10 no longer auto-resolves to a workspace package without an existing lockfile entry. Switched to explicit 'workspace:*' so a clean lockfile regen works. Audit: 85 vulns (3 critical / 31 high / 49 moderate / 2 low) → 12 vulns (0 critical / 0 high / 11 moderate / 1 low). At --audit-level=high CI hook now passes (exit 0).
@hanzo/bot-brain
The Hanzo Brain meta-pack. Drops
memory + graph-links + recipesinto Hanzo Bot. Single binary, single config, SQLite by default.
What gbrain is to Hanzo Bot, this is to Hanzo Bot — except we are Hanzo Bot (forked), so the gateway, channels, voice, mobile apps, and 355 atomic skills come along for free.
Install
The brain meta-pack is shipped with @hanzo/bot. Enable in hanzo.toml:
[plugins.brain]
enabled = true
[plugins.brain.memory]
# Optional. Defaults below.
# backend = "sqlite"
# dbPath = "~/.hanzo/brain/brain.db"
[plugins.brain.graph]
enabled = true # zero-LLM typed-link extraction on every page write
[plugins.brain.recipes]
# Daily-life automations. See recipes-brain/recipes/.
enabled = ["email"]
Then run the bot — solo dev or multi-tenant, same binary:
hanzo-bot serve
Drop markdown into ~/.hanzo/workspace/. Edges auto-extract. Facts queryable via the brain.recall and brain.search MCP tools.
What lives inside
| Sub-extension | What it does |
|---|---|
@hanzo/bot-memory |
Pluggable BrainStore — SQLite default. pages, edges, facts, FTS5. |
@hanzo/bot-graph-links |
Zero-LLM typed-link extractor. Emits attended/works_at/invested_in/founded/advises. |
@hanzo/bot-recipes-brain |
YAML recipes — email today, calendar/slack/X/notion next. |
Architecture
Hanzo Bot (Hanzo Bot fork)
│
▼
@hanzo/bot-brain (this pack)
│
┌─────────┼───────────┐
▼ ▼ ▼
memory graph-links recipes-brain
(SQLite) (regex) (YAML loader)
│ │ │
▼ ▼ ▼
~/.hanzo/brain/brain.db (one file, the brain)
MCP tools exposed
| Tool | What it does |
|---|---|
brain.recall |
{ entity, limit? } → facts about an entity, newest first |
brain.search |
{ query, topK? } → hybrid search (FTS + vector + RRF) across all pages |
These wire into Claude Code / Cursor / Windsurf the moment you claude mcp add hanzo.
Pluggability
The memory extension exposes registerBackend(name, factory). Anyone can ship a Postgres / LanceDB / D1 / libSQL backend as a sibling extension — no fork of this pack needed. See memory/README.md.
Compared to gbrain
| gbrain | Hanzo Brain | |
|---|---|---|
| Runtime | Hanzo Bot mod | Hanzo Bot extension (we own the gateway) |
| Default store | PGLite | SQLite |
| Schema | pages/edges/facts | same — pages/edges/facts/FTS5 |
| Graph extraction | regex, zero-LLM | regex, zero-LLM (same approach) |
| Skills | 34 curated | 355 atomic + 88 specialized agents in ~/work/hanzo/skills |
| Channels | 0 (BYO gateway) | 30+ (Slack/Discord/WhatsApp/Telegram/iMessage/…) |
| Voice | Twilio + Realtime via Hanzo Bot | Twilio/Telnyx/Plivo + LiveKit native |
| Mobile apps | none | iOS / Android / macOS ship with the bot |
| Pricing model | single-user | multi-tenant, shared credits via Hanzo Node |