@agentmemory/agentmemory 0.9.17 → 0.9.19

package/dist/index.mjs

@@ -325,6 +325,20 @@ var AnthropicProvider = class {
 	}
 };
 
+//#endregion
+//#region src/providers/_fetch.ts
+function fetchWithTimeout(url, init, timeoutMs) {
+	const parsed = timeoutMs ?? Number.parseInt(getEnvVar("AGENTMEMORY_LLM_TIMEOUT_MS") ?? "60000", 10);
+	const ms = Number.isFinite(parsed) && parsed > 0 ? parsed : 6e4;
+	const ctl = new AbortController();
+	const signal = init.signal ? AbortSignal.any([init.signal, ctl.signal]) : ctl.signal;
+	const t = setTimeout(() => ctl.abort(), ms);
+	return fetch(url, {
+		...init,
+		signal
+	}).finally(() => clearTimeout(t));
+}
+
 //#endregion
 //#region src/providers/minimax.ts
 /**
@@ -360,8 +374,7 @@ var MinimaxProvider = class {
 		return this.call(systemPrompt, userPrompt);
 	}
 	async call(systemPrompt, userPrompt) {
-		const url = `${this.baseUrl}/v1/messages`;
-		const response = await fetch(url, {
+		const response = await fetchWithTimeout(`${this.baseUrl}/v1/messages`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -405,11 +418,63 @@ var NoopProvider = class {
 	}
 };
 
+//#endregion
+//#region src/providers/_openai-shared.ts
+const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com";
+const DEFAULT_AZURE_API_VERSION = "2024-08-01-preview";
+function detectAzure(baseUrl) {
+	try {
+		return new URL(baseUrl).hostname.endsWith(".openai.azure.com");
+	} catch {
+		return false;
+	}
+}
+function azureStyleOf(baseUrl) {
+	try {
+		const u = new URL(baseUrl);
+		if (/\/openai\/deployments\//.test(u.pathname)) return "legacy";
+		return "v1";
+	} catch {
+		return "v1";
+	}
+}
+function legacyAzureUrl(baseUrl, path, apiVersion) {
+	const url = new URL(baseUrl);
+	url.pathname = `${url.pathname.replace(/\/+$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
+	url.searchParams.set("api-version", apiVersion);
+	return url.toString();
+}
+function v1AzureUrl(baseUrl, path) {
+	const url = new URL(baseUrl);
+	const route = path.startsWith("/") ? path.slice(1) : path;
+	url.pathname = `${url.pathname.replace(/\/?openai(?:\/v1)?\/?$/, "").replace(/\/+$/, "")}/openai/v1/${route}`;
+	return url.toString();
+}
+function buildChatUrl(baseUrl, isAzure, azureApiVersion) {
+	if (isAzure) return azureStyleOf(baseUrl) === "legacy" ? legacyAzureUrl(baseUrl, "/chat/completions", azureApiVersion) : v1AzureUrl(baseUrl, "/chat/completions");
+	return `${baseUrl}/v1/chat/completions`;
+}
+function buildEmbeddingUrl(baseUrl, isAzure, azureApiVersion) {
+	if (isAzure) return azureStyleOf(baseUrl) === "legacy" ? legacyAzureUrl(baseUrl, "/embeddings", azureApiVersion) : v1AzureUrl(baseUrl, "/embeddings");
+	return `${baseUrl}/v1/embeddings`;
+}
+function buildAuthHeaders(apiKey, isAzure) {
+	if (isAzure) return {
+		"Content-Type": "application/json",
+		"api-key": apiKey
+	};
+	return {
+		"Content-Type": "application/json",
+		Authorization: `Bearer ${apiKey}`
+	};
+}
+function normalizeBaseUrl(raw) {
+	return (raw || DEFAULT_OPENAI_BASE_URL).replace(/\/+$/, "");
+}
+
 //#endregion
 //#region src/providers/openai.ts
-const DEFAULT_BASE_URL$1 = "https://api.openai.com";
 const DEFAULT_TIMEOUT_MS = 6e4;
-const DEFAULT_AZURE_API_VERSION = "2024-08-01-preview";
 /**
 * OpenAI-compatible LLM provider.
 *
@@ -429,7 +494,12 @@ const DEFAULT_AZURE_API_VERSION = "2024-08-01-preview";
 *                              Azure: https://<resource>.openai.azure.com/openai/deployments/<deployment>
 *   OPENAI_MODEL             — model name (default: gpt-4o-mini)
 *   OPENAI_API_VERSION       — Azure api-version query param (default: 2024-08-01-preview)
-*   OPENAI_TIMEOUT_MS        — outbound fetch timeout in ms (default: 60000)
+*   OPENAI_TIMEOUT_MS        — outbound fetch timeout in ms (OpenAI-scoped alias,
+*                              takes precedence over AGENTMEMORY_LLM_TIMEOUT_MS
+*                              for back-compat with the v0.9.17 shipping name).
+*   AGENTMEMORY_LLM_TIMEOUT_MS — outbound fetch timeout in ms shared across all
+*                              raw-fetch LLM + embedding providers. Used when
+*                              OPENAI_TIMEOUT_MS is not set. Default: 60000.
 *   MAX_TOKENS               — max output tokens (default: from config or 4096)
 *   OPENAI_REASONING_EFFORT  — "low" | "medium" | "high" | "none"
 *                              Passthrough for reasoning models (e.g. Ollama Cloud
@@ -451,9 +521,9 @@ var OpenAIProvider = class {
 		this.apiKey = apiKey;
 		this.model = model;
 		this.maxTokens = maxTokens;
-		this.baseUrl = (baseURL || getEnvVar("OPENAI_BASE_URL") || DEFAULT_BASE_URL$1).replace(/\/+$/, "");
+		this.baseUrl = normalizeBaseUrl(baseURL || getEnvVar("OPENAI_BASE_URL"));
 		this.reasoningEffort = getEnvVar("OPENAI_REASONING_EFFORT") || void 0;
-		this.timeoutMs = parseTimeout(getEnvVar("OPENAI_TIMEOUT_MS"));
+		this.timeoutMs = resolveTimeout();
 		this.azureApiVersion = getEnvVar("OPENAI_API_VERSION") || DEFAULT_AZURE_API_VERSION;
 		this.isAzure = detectAzure(this.baseUrl);
 	}
@@ -463,25 +533,8 @@ var OpenAIProvider = class {
 	async summarize(systemPrompt, userPrompt) {
 		return this.call(systemPrompt, userPrompt);
 	}
-	buildUrl() {
-		if (this.isAzure) {
-			const sep = this.baseUrl.includes("?") ? "&" : "?";
-			return `${this.baseUrl}/chat/completions${sep}api-version=${encodeURIComponent(this.azureApiVersion)}`;
-		}
-		return `${this.baseUrl}/v1/chat/completions`;
-	}
-	buildHeaders() {
-		if (this.isAzure) return {
-			"Content-Type": "application/json",
-			"api-key": this.apiKey
-		};
-		return {
-			"Content-Type": "application/json",
-			Authorization: `Bearer ${this.apiKey}`
-		};
-	}
 	async call(systemPrompt, userPrompt) {
-		const url = this.buildUrl();
+		const url = buildChatUrl(this.baseUrl, this.isAzure, this.azureApiVersion);
 		const body = {
 			model: this.model,
 			max_tokens: this.maxTokens,
@@ -494,21 +547,16 @@ var OpenAIProvider = class {
 			}]
 		};
 		if (this.reasoningEffort) body.reasoning_effort = this.reasoningEffort;
-		const ac = new AbortController();
-		const t = setTimeout(() => ac.abort(), this.timeoutMs);
 		let response;
 		try {
-			response = await fetch(url, {
+			response = await fetchWithTimeout(url, {
 				method: "POST",
-				headers: this.buildHeaders(),
-				body: JSON.stringify(body),
-				signal: ac.signal
-			});
+				headers: buildAuthHeaders(this.apiKey, this.isAzure),
+				body: JSON.stringify(body)
+			}, this.timeoutMs);
 		} catch (err) {
-			if (ac.signal.aborted || err instanceof Error && err.name === "AbortError") throw new Error(`OpenAI API request timed out after ${this.timeoutMs}ms — set OPENAI_TIMEOUT_MS to raise the bound or check the provider status.`);
+			if (err instanceof Error && err.name === "AbortError") throw new Error(`OpenAI API request timed out after ${this.timeoutMs}ms — set OPENAI_TIMEOUT_MS (or AGENTMEMORY_LLM_TIMEOUT_MS) to raise the bound or check the provider status.`);
 			throw err;
-		} finally {
-			clearTimeout(t);
 		}
 		if (!response.ok) {
 			const text = await response.text();
@@ -523,17 +571,19 @@ var OpenAIProvider = class {
 		throw new Error(`OpenAI returned unexpected response: ${JSON.stringify(data).slice(0, 200)}`);
 	}
 };
-function parseTimeout(raw) {
-	if (!raw) return DEFAULT_TIMEOUT_MS;
-	const n = parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : DEFAULT_TIMEOUT_MS;
-}
-function detectAzure(baseUrl) {
-	try {
-		return new URL(baseUrl).hostname.endsWith(".openai.azure.com");
-	} catch {
-		return false;
-	}
+function resolveTimeout() {
+	const openai = parsePositiveInt(getEnvVar("OPENAI_TIMEOUT_MS"));
+	if (openai !== void 0) return openai;
+	const globalMs = parsePositiveInt(getEnvVar("AGENTMEMORY_LLM_TIMEOUT_MS"));
+	if (globalMs !== void 0) return globalMs;
+	return DEFAULT_TIMEOUT_MS;
+}
+function parsePositiveInt(raw) {
+	if (!raw) return void 0;
+	const trimmed = raw.trim();
+	if (!/^\d+$/.test(trimmed)) return void 0;
+	const n = Number(trimmed);
+	return Number.isFinite(n) && n > 0 ? n : void 0;
 }
 
 //#endregion
@@ -558,7 +608,7 @@ var OpenRouterProvider = class {
 		return this.call(systemPrompt, userPrompt);
 	}
 	async call(systemPrompt, userPrompt) {
-		const response = await fetch(this.baseUrl, {
+		const response = await fetchWithTimeout(this.baseUrl, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -727,7 +777,7 @@ var GeminiEmbeddingProvider = class {
 		const results = [];
 		for (let i = 0; i < texts.length; i += BATCH_LIMIT) {
 			const chunk = texts.slice(i, i + BATCH_LIMIT);
-			const response = await fetch(`${API_BASE}?key=${this.apiKey}`, {
+			const response = await fetchWithTimeout(`${API_BASE}?key=${this.apiKey}`, {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({ requests: chunk.map((t) => ({
@@ -764,7 +814,6 @@ function l2Normalize(vec) {
 
 //#endregion
 //#region src/providers/embedding/openai.ts
-const DEFAULT_BASE_URL = "https://api.openai.com";
 const DEFAULT_MODEL$1 = "text-embedding-3-small";
 /**
 * Known OpenAI embedding model dimensions. Extend as new models ship.
@@ -788,11 +837,20 @@ function resolveDimensions(model, override) {
 /**
 * OpenAI-compatible embedding provider.
 *
+* Shares transport (URL builder, auth header, Azure detection) with
+* the OpenAI LLM provider via `_openai-shared` (#371). Same env knobs
+* pick up automatically: when `OPENAI_BASE_URL` points at an Azure
+* resource (`.openai.azure.com` hostname) the embedding request uses
+* Azure's `/embeddings` path with the `api-version` query param and
+* `api-key` header instead of `Authorization: Bearer`.
+*
 * Required env vars:
 *   OPENAI_API_KEY            — API key
 *
 * Optional:
-*   OPENAI_BASE_URL           — base URL without path (default: https://api.openai.com)
+*   OPENAI_BASE_URL           — base URL without path (default: https://api.openai.com).
+*                               Azure: https://<resource>.openai.azure.com/openai/deployments/<deployment>
+*   OPENAI_API_VERSION        — Azure api-version query param (default: 2024-08-01-preview)
 *   OPENAI_EMBEDDING_MODEL    — model name (default: text-embedding-3-small)
 *   OPENAI_EMBEDDING_DIMENSIONS — override reported dimensions (required for
 *                                 custom / self-hosted models not in the
@@ -804,25 +862,25 @@ var OpenAIEmbeddingProvider = class {
 	apiKey;
 	baseUrl;
 	model;
+	isAzure;
+	azureApiVersion;
 	constructor(apiKey) {
 		this.apiKey = apiKey || getEnvVar("OPENAI_API_KEY") || "";
 		if (!this.apiKey) throw new Error("OPENAI_API_KEY is required");
-		this.baseUrl = getEnvVar("OPENAI_BASE_URL") || DEFAULT_BASE_URL;
+		this.baseUrl = normalizeBaseUrl(getEnvVar("OPENAI_BASE_URL"));
 		this.model = getEnvVar("OPENAI_EMBEDDING_MODEL") || DEFAULT_MODEL$1;
 		this.dimensions = resolveDimensions(this.model, getEnvVar("OPENAI_EMBEDDING_DIMENSIONS"));
+		this.isAzure = detectAzure(this.baseUrl);
+		this.azureApiVersion = getEnvVar("OPENAI_API_VERSION") || DEFAULT_AZURE_API_VERSION;
 	}
 	async embed(text) {
 		const [result] = await this.embedBatch([text]);
 		return result;
 	}
 	async embedBatch(texts) {
-		const url = `${this.baseUrl}/v1/embeddings`;
-		const response = await fetch(url, {
+		const response = await fetchWithTimeout(buildEmbeddingUrl(this.baseUrl, this.isAzure, this.azureApiVersion), {
 			method: "POST",
-			headers: {
-				Authorization: `Bearer ${this.apiKey}`,
-				"Content-Type": "application/json"
-			},
+			headers: buildAuthHeaders(this.apiKey, this.isAzure),
 			body: JSON.stringify({
 				model: this.model,
 				input: texts
@@ -852,7 +910,7 @@ var VoyageEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const response = await fetch(API_URL$2, {
+		const response = await fetchWithTimeout(API_URL$2, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -888,7 +946,7 @@ var CohereEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const response = await fetch(API_URL$1, {
+		const response = await fetchWithTimeout(API_URL$1, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -926,7 +984,7 @@ var OpenRouterEmbeddingProvider = class {
 		return result;
 	}
 	async embedBatch(texts) {
-		const response = await fetch(API_URL, {
+		const response = await fetchWithTimeout(API_URL, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.apiKey}`,
@@ -1229,7 +1287,8 @@ const KV = {
 	imageEmbeddings: "mem:image-embeddings",
 	slots: "mem:slots",
 	globalSlots: "mem:slots:global",
-	state: "mem:state"
+	state: "mem:state",
+	commits: "mem:commits"
 };
 const STREAM = {
 	name: "mem-live",
@@ -1423,7 +1482,7 @@ var GraphRetrieval = class {
 		const results = [];
 		const visitedObs = /* @__PURE__ */ new Set();
 		for (const startNode of matchingNodes) {
-			const paths = this.bfsTraversal(startNode, allNodes, allEdges, maxDepth);
+			const paths = this.dijkstraTraversal(startNode, allNodes, allEdges, maxDepth);
 			for (const path of paths) {
 				const lastNode = path[path.length - 1].node;
 				for (const obsId of lastNode.sourceObservationIds) {
@@ -1463,7 +1522,7 @@ var GraphRetrieval = class {
 		const results = [];
 		const visitedObs = new Set(obsIds);
 		for (const node of linkedNodes) {
-			const paths = this.bfsTraversal(node, allNodes, allEdges, maxDepth);
+			const paths = this.dijkstraTraversal(node, allNodes, allEdges, maxDepth);
 			for (const path of paths) {
 				const lastNode = path[path.length - 1].node;
 				for (const obsId of lastNode.sourceObservationIds) {
@@ -1535,37 +1594,104 @@ var GraphRetrieval = class {
 		}
 		return latest;
 	}
-	bfsTraversal(startNode, allNodes, allEdges, maxDepth) {
-		const paths = [];
-		const visited = /* @__PURE__ */ new Set();
-		const queue = [{
+	dijkstraTraversal(startNode, allNodes, allEdges, maxDepth) {
+		const nodeIndex = /* @__PURE__ */ new Map();
+		for (const n of allNodes) nodeIndex.set(n.id, n);
+		const adjacency = /* @__PURE__ */ new Map();
+		for (const edge of allEdges) {
+			const a = edge.sourceNodeId;
+			const b = edge.targetNodeId;
+			if (!adjacency.has(a)) adjacency.set(a, []);
+			if (!adjacency.has(b)) adjacency.set(b, []);
+			adjacency.get(a).push({
+				neighborId: b,
+				edge
+			});
+			adjacency.get(b).push({
+				neighborId: a,
+				edge
+			});
+		}
+		const dist = /* @__PURE__ */ new Map();
+		const pathTo = /* @__PURE__ */ new Map();
+		dist.set(startNode.id, 0);
+		pathTo.set(startNode.id, [{ node: startNode }]);
+		const heap = new MinHeap((a, b) => a.cost - b.cost);
+		heap.push({
 			nodeId: startNode.id,
 			depth: 0,
-			path: [{ node: startNode }]
-		}];
-		visited.add(startNode.id);
-		while (queue.length > 0) {
-			const { nodeId, depth, path } = queue.shift();
-			paths.push(path);
+			cost: 0
+		});
+		while (heap.size() > 0) {
+			const { nodeId, depth, cost } = heap.pop();
+			if (cost > (dist.get(nodeId) ?? Infinity)) continue;
 			if (depth >= maxDepth) continue;
-			const neighborEdges = allEdges.filter((e) => e.sourceNodeId === nodeId || e.targetNodeId === nodeId);
-			for (const edge of neighborEdges) {
-				const nextId = edge.sourceNodeId === nodeId ? edge.targetNodeId : edge.sourceNodeId;
-				if (visited.has(nextId)) continue;
-				visited.add(nextId);
-				const nextNode = allNodes.find((n) => n.id === nextId);
+			const neighbors = adjacency.get(nodeId) ?? [];
+			for (const { neighborId, edge } of neighbors) {
+				const nextNode = nodeIndex.get(neighborId);
 				if (!nextNode) continue;
-				queue.push({
-					nodeId: nextId,
-					depth: depth + 1,
-					path: [...path, {
+				const newCost = cost + 1 / Math.max(edge.weight, .01);
+				if (newCost < (dist.get(neighborId) ?? Infinity)) {
+					dist.set(neighborId, newCost);
+					pathTo.set(neighborId, [...pathTo.get(nodeId), {
 						node: nextNode,
 						edge
-					}]
-				});
+					}]);
+					heap.push({
+						nodeId: neighborId,
+						depth: depth + 1,
+						cost: newCost
+					});
+				}
 			}
 		}
-		return paths;
+		pathTo.delete(startNode.id);
+		return Array.from(pathTo.values());
+	}
+};
+var MinHeap = class {
+	heap = [];
+	constructor(compare) {
+		this.compare = compare;
+	}
+	size() {
+		return this.heap.length;
+	}
+	push(value) {
+		this.heap.push(value);
+		this.bubbleUp(this.heap.length - 1);
+	}
+	pop() {
+		if (this.heap.length === 0) return void 0;
+		const top = this.heap[0];
+		const last = this.heap.pop();
+		if (this.heap.length > 0) {
+			this.heap[0] = last;
+			this.sinkDown(0);
+		}
+		return top;
+	}
+	bubbleUp(i) {
+		while (i > 0) {
+			const parent = i - 1 >> 1;
+			if (this.compare(this.heap[i], this.heap[parent]) < 0) {
+				[this.heap[i], this.heap[parent]] = [this.heap[parent], this.heap[i]];
+				i = parent;
+			} else break;
+		}
+	}
+	sinkDown(i) {
+		const n = this.heap.length;
+		while (true) {
+			const left = 2 * i + 1;
+			const right = 2 * i + 2;
+			let smallest = i;
+			if (left < n && this.compare(this.heap[left], this.heap[smallest]) < 0) smallest = left;
+			if (right < n && this.compare(this.heap[right], this.heap[smallest]) < 0) smallest = right;
+			if (smallest === i) break;
+			[this.heap[i], this.heap[smallest]] = [this.heap[smallest], this.heap[i]];
+			i = smallest;
+		}
 	}
 };
 
@@ -4543,7 +4669,11 @@ function registerContextFunction(sdk, kv, tokenBudget) {
 	sdk.registerFunction("mem::context", async (data) => {
 		const budget = data.budget || tokenBudget;
 		const blocks = [];
-		const [pinnedSlots, profile] = await Promise.all([isSlotsEnabled() ? listPinnedSlots(kv).catch(() => []) : Promise.resolve([]), kv.get(KV.profiles, data.project).catch(() => null)]);
+		const [pinnedSlots, profile, lessons] = await Promise.all([
+			isSlotsEnabled() ? listPinnedSlots(kv).catch(() => []) : Promise.resolve([]),
+			kv.get(KV.profiles, data.project).catch(() => null),
+			kv.list(KV.lessons).catch(() => [])
+		]);
 		const slotContent = renderPinnedContext(pinnedSlots);
 		if (slotContent) blocks.push({
 			type: "memory",
@@ -4567,6 +4697,24 @@ function registerContextFunction(sdk, kv, tokenBudget) {
 				});
 			}
 		}
+		const relevantLessons = lessons.filter((l) => !l.deleted && (!l.project || l.project === data.project)).sort((a, b) => {
+			const scoreA = (a.project === data.project ? 1.5 : 1) * a.confidence;
+			return (b.project === data.project ? 1.5 : 1) * b.confidence - scoreA;
+		}).slice(0, 10);
+		if (relevantLessons.length > 0) {
+			const lessonsContent = `## Lessons Learned\n${relevantLessons.map((l) => `- (${l.confidence.toFixed(2)}) ${l.content}${l.context ? ` — ${l.context}` : ""}`).join("\n")}`;
+			const mostRecent = relevantLessons.reduce((acc, l) => {
+				const t = new Date(l.lastReinforcedAt || l.updatedAt).getTime();
+				return t > acc ? t : acc;
+			}, 0);
+			blocks.push({
+				type: "memory",
+				content: lessonsContent,
+				tokens: estimateTokens$1(lessonsContent),
+				recency: mostRecent,
+				sourceIds: relevantLessons.map((l) => l.id)
+			});
+		}
 		const sessions = (await kv.list(KV.sessions)).filter((s) => s.project === data.project && s.id !== data.sessionId).sort((a, b) => new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime()).slice(0, 10);
 		const summariesPerSession = await Promise.all(sessions.map((s) => kv.get(KV.summaries, s.id).catch(() => null)));
 		const sessionsNeedingObs = [];
@@ -5389,6 +5537,46 @@ const DEFAULTS$1 = {
 	lowImportanceThreshold: 3,
 	maxObservationsPerProject: 1e4
 };
+function isValidRecoveryResult(result) {
+	if (!result || typeof result !== "object") return false;
+	if (!("success" in result)) return true;
+	return result.success !== false;
+}
+function isCompressedObservation(observation) {
+	return "title" in observation && typeof observation.title === "string" && observation.title.length > 0;
+}
+async function recoverStaleSession(sdk, sessionId) {
+	try {
+		const result = await sdk.trigger({
+			function_id: "event::session::stopped",
+			payload: { sessionId }
+		});
+		if (!isValidRecoveryResult(result)) {
+			logger.warn("Stale session recovery failed", {
+				sessionId,
+				result
+			});
+			return false;
+		}
+		return true;
+	} catch (err) {
+		logger.warn("Stale session recovery failed", {
+			sessionId,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		return false;
+	}
+}
+async function runRecoveredSessionConsolidation(sdk) {
+	try {
+		await sdk.trigger({
+			function_id: "mem::consolidate-pipeline",
+			payload: { tier: "all" }
+		});
+	} catch (err) {
+		logger.warn("Recovered session consolidation failed", { error: err instanceof Error ? err.message : String(err) });
+	}
+}
 function registerEvictFunction(sdk, kv) {
 	sdk.registerFunction("mem::evict", async (data) => {
 		const dryRun = data?.dryRun ?? false;
@@ -5407,6 +5595,7 @@ function registerEvictFunction(sdk, kv) {
 			nonLatestMemories: 0,
 			dryRun
 		};
+		let recoveredStaleSessions = 0;
 		const sessions = await kv.list(KV.sessions).catch(() => []);
 		const summaries = await kv.list(KV.summaries).catch(() => []);
 		const summaryIds = new Set(summaries.map((s) => s.sessionId));
@@ -5414,6 +5603,23 @@ function registerEvictFunction(sdk, kv) {
 			if (!session.startedAt) continue;
 			if (now - new Date(session.startedAt).getTime() > cfg.staleSessionDays * MS_PER_DAY$1 && !summaryIds.has(session.id)) if (dryRun) stats.staleSessions++;
 			else {
+				const observations = await kv.list(KV.observations(session.id)).catch((err) => {
+					logger.warn("Stale session observation scan failed", {
+						sessionId: session.id,
+						error: err instanceof Error ? err.message : String(err)
+					});
+					return null;
+				});
+				if (!observations) continue;
+				let recovered = false;
+				if (observations.some(isCompressedObservation)) {
+					recovered = await recoverStaleSession(sdk, session.id);
+					if (!recovered) continue;
+					recoveredStaleSessions++;
+				} else if (observations.length > 0) {
+					logger.warn("Stale session has no compressed observations", { sessionId: session.id });
+					continue;
+				}
 				try {
 					await kv.delete(KV.sessions, session.id);
 					stats.staleSessions++;
@@ -5427,11 +5633,12 @@ function registerEvictFunction(sdk, kv) {
 				}
 				await recordAudit(kv, "delete", "mem::evict", [session.id], {
 					resource: "session",
-					reason: "stale_session_without_summary",
+					reason: recovered ? "stale_session_recovered_then_evicted" : "stale_session_without_summary",
 					dryRun
 				});
 			}
 		}
+		if (!dryRun && recoveredStaleSessions > 0) await runRecoveredSessionConsolidation(sdk);
 		const projectObs = /* @__PURE__ */ new Map();
 		for (const session of sessions) {
 			const compressed = (await kv.list(KV.observations(session.id)).catch(() => [])).filter((o) => o.title);
@@ -6110,7 +6317,7 @@ function registerAutoForgetFunction(sdk, kv) {
 
 //#endregion
 //#region src/version.ts
-const VERSION = "0.9.17";
+const VERSION = "0.9.19";
 
 //#endregion
 //#region src/functions/export-import.ts
@@ -6245,7 +6452,9 @@ function registerExportImportFunction(sdk, kv) {
 			"0.9.14",
 			"0.9.15",
 			"0.9.16",
-			"0.9.17"
+			"0.9.17",
+			"0.9.18",
+			"0.9.19"
 		]).has(importData.version)) return {
 			success: false,
 			error: `Unsupported export version: ${importData.version}`
@@ -14073,6 +14282,112 @@ function registerApiTriggers(sdk, kv, secret, metricsStore, provider) {
 			middleware_function_ids: ["middleware::api-auth"]
 		}
 	});
+	sdk.registerFunction("api::session::commit", async (req) => {
+		const body = req.body ?? {};
+		const sha = asNonEmptyString$1(body.sha);
+		if (!sha) return {
+			status_code: 400,
+			body: { error: "sha is required and must be a non-empty string" }
+		};
+		const sessionId = asNonEmptyString$1(body.sessionId) ?? void 0;
+		const branch = asNonEmptyString$1(body.branch) ?? void 0;
+		const repo = asNonEmptyString$1(body.repo) ?? void 0;
+		const message = asNonEmptyString$1(body.message) ?? void 0;
+		const author = asNonEmptyString$1(body.author) ?? void 0;
+		const authoredAt = asNonEmptyString$1(body.authoredAt) ?? void 0;
+		const files = Array.isArray(body.files) ? body.files.filter((f) => typeof f === "string" && f.length > 0) : void 0;
+		const link = await withKeyedLock(`commit:${sha}`, async () => {
+			const existing = await kv.get(KV.commits, sha);
+			const sessionSet = new Set(existing?.sessionIds ?? []);
+			if (sessionId) sessionSet.add(sessionId);
+			const merged = {
+				sha,
+				shortSha: existing?.shortSha ?? sha.slice(0, 7),
+				branch: branch ?? existing?.branch,
+				repo: repo ?? existing?.repo,
+				message: message ?? existing?.message,
+				author: author ?? existing?.author,
+				authoredAt: authoredAt ?? existing?.authoredAt,
+				files: files ?? existing?.files,
+				sessionIds: Array.from(sessionSet),
+				linkedAt: existing?.linkedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+			};
+			await kv.set(KV.commits, sha, merged);
+			return merged;
+		});
+		if (sessionId) await withKeyedLock(`session:${sessionId}`, async () => {
+			const session = await kv.get(KV.sessions, sessionId);
+			if (!session) return;
+			const shaSet = new Set(session.commitShas ?? []);
+			shaSet.add(sha);
+			session.commitShas = Array.from(shaSet);
+			await kv.set(KV.sessions, sessionId, session);
+		});
+		return {
+			status_code: 200,
+			body: { commit: link }
+		};
+	});
+	sdk.registerTrigger({
+		type: "http",
+		function_id: "api::session::commit",
+		config: {
+			api_path: "/agentmemory/session/commit",
+			http_method: "POST",
+			middleware_function_ids: ["middleware::api-auth"]
+		}
+	});
+	sdk.registerFunction("api::session::by-commit", async (req) => {
+		const authErr = checkAuth(req, secret);
+		if (authErr) return authErr;
+		const sha = asNonEmptyString$1(req.query_params?.["sha"]);
+		if (!sha) return {
+			status_code: 400,
+			body: { error: "sha is required and must be a non-empty string" }
+		};
+		const link = await kv.get(KV.commits, sha);
+		if (!link) return {
+			status_code: 404,
+			body: { error: "no sessions linked to this commit" }
+		};
+		return {
+			status_code: 200,
+			body: {
+				commit: link,
+				sessions: (await Promise.all((link.sessionIds ?? []).map((sid) => kv.get(KV.sessions, sid)))).filter((s) => s !== null)
+			}
+		};
+	});
+	sdk.registerTrigger({
+		type: "http",
+		function_id: "api::session::by-commit",
+		config: {
+			api_path: "/agentmemory/session/by-commit",
+			http_method: "GET",
+			middleware_function_ids: ["middleware::api-auth"]
+		}
+	});
+	sdk.registerFunction("api::commits", async (req) => {
+		const authErr = checkAuth(req, secret);
+		if (authErr) return authErr;
+		const branch = asNonEmptyString$1(req.query_params?.["branch"]);
+		const repo = asNonEmptyString$1(req.query_params?.["repo"]);
+		const rawLimit = parseOptionalInt(req.query_params?.["limit"]);
+		const limit = Math.max(1, Math.min(500, rawLimit ?? 100));
+		return {
+			status_code: 200,
+			body: { commits: (await kv.list(KV.commits)).filter((c) => !branch || c.branch === branch).filter((c) => !repo || c.repo === repo).sort((a, b) => (a.linkedAt ?? "") < (b.linkedAt ?? "") ? 1 : -1).slice(0, limit) }
+		};
+	});
+	sdk.registerTrigger({
+		type: "http",
+		function_id: "api::commits",
+		config: {
+			api_path: "/agentmemory/commits",
+			http_method: "GET",
+			middleware_function_ids: ["middleware::api-auth"]
+		}
+	});
 	sdk.registerFunction("api::sessions", async (req) => {
 		const authErr = checkAuth(req, secret);
 		if (authErr) return authErr;
@@ -17073,6 +17388,39 @@ const CORE_TOOLS = [
 			},
 			required: ["memoryId"]
 		}
+	},
+	{
+		name: "memory_commit_lookup",
+		description: "Look up the agent session(s) that produced a specific git commit, given its SHA. Returns the commit metadata and linked sessions.",
+		inputSchema: {
+			type: "object",
+			properties: { sha: {
+				type: "string",
+				description: "Full git commit SHA"
+			} },
+			required: ["sha"]
+		}
+	},
+	{
+		name: "memory_commits",
+		description: "List recent commits linked to agent sessions, optionally filtered by branch or repo.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				branch: {
+					type: "string",
+					description: "Filter by branch name"
+				},
+				repo: {
+					type: "string",
+					description: "Filter by remote URL"
+				},
+				limit: {
+					type: "number",
+					description: "Max results (default 100, max 500)"
+				}
+			}
+		}
 	}
 ];
 const V040_TOOLS = [
@@ -19127,6 +19475,49 @@ function registerMcpEndpoints(sdk, kv, secret) {
 						}] }
 					};
 				}
+				case "memory_commit_lookup": {
+					const sha = asNonEmptyString(args.sha);
+					if (!sha) return {
+						status_code: 400,
+						body: { error: "sha required" }
+					};
+					const link = await kv.get(KV.commits, sha);
+					if (!link) return {
+						status_code: 200,
+						body: { content: [{
+							type: "text",
+							text: JSON.stringify({
+								commit: null,
+								sessions: []
+							}, null, 2)
+						}] }
+					};
+					const linkRecord = link;
+					const sessions = (await Promise.all((linkRecord.sessionIds ?? []).map((sid) => kv.get(KV.sessions, sid)))).filter((s) => s !== null);
+					return {
+						status_code: 200,
+						body: { content: [{
+							type: "text",
+							text: JSON.stringify({
+								commit: link,
+								sessions
+							}, null, 2)
+						}] }
+					};
+				}
+				case "memory_commits": {
+					const branch = typeof args.branch === "string" ? args.branch : void 0;
+					const repo = typeof args.repo === "string" ? args.repo : void 0;
+					const limit = Math.max(1, Math.min(500, asNumber(args.limit, 100) ?? 100));
+					const filtered = (await kv.list(KV.commits)).filter((c) => !branch || c.branch === branch).filter((c) => !repo || c.repo === repo).sort((a, b) => (a.linkedAt ?? "") < (b.linkedAt ?? "") ? 1 : -1).slice(0, limit);
+					return {
+						status_code: 200,
+						body: { content: [{
+							type: "text",
+							text: JSON.stringify({ commits: filtered }, null, 2)
+						}] }
+					};
+				}
 				default: return {
 					status_code: 400,
 					body: { error: `Unknown tool: ${name}` }
@@ -19512,7 +19903,38 @@ function registerMcpEndpoints(sdk, kv, secret) {
 
 //#endregion
 //#region src/viewer/server.ts
+function loadViewerFavicon() {
+	const base = dirname(fileURLToPath(import.meta.url));
+	const candidates = [
+		join(base, "..", "src", "viewer", "favicon.svg"),
+		join(base, "..", "viewer", "favicon.svg"),
+		join(base, "viewer", "favicon.svg")
+	];
+	for (const path of candidates) try {
+		return readFileSync(path);
+	} catch {}
+	return null;
+}
 const ALLOWED_ORIGINS = (process.env.VIEWER_ALLOWED_ORIGINS || "http://localhost:3111,http://localhost:3113,http://127.0.0.1:3111,http://127.0.0.1:3113").split(",").map((o) => o.trim());
+const ALLOWED_HOSTS_OVERRIDE = (process.env.VIEWER_ALLOWED_HOSTS || "").split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+function buildAllowedHosts(origins, listenPort) {
+	const hosts = /* @__PURE__ */ new Set();
+	for (const o of origins) try {
+		const parsed = new URL(o);
+		if (parsed.host) hosts.add(parsed.host.toLowerCase());
+	} catch {}
+	hosts.add(`localhost:${listenPort}`);
+	hosts.add(`127.0.0.1:${listenPort}`);
+	hosts.add(`[::1]:${listenPort}`);
+	for (const h of ALLOWED_HOSTS_OVERRIDE) hosts.add(h);
+	return hosts;
+}
+function isHostAllowed(headerHost, allowed) {
+	if (typeof headerHost !== "string") return false;
+	const lower = headerHost.toLowerCase().trim();
+	if (!lower) return false;
+	return allowed.has(lower);
+}
 function corsHeaders(req) {
 	const origin = req.headers.origin || "";
 	const allowed = ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0];
@@ -19556,7 +19978,17 @@ const MAX_VIEWER_PORT_RETRIES = 10;
 function startViewerServer(port, _kv, _sdk, secret, restPort) {
 	const resolvedRestPort = restPort ?? port - 2;
 	const requestedPort = port;
+	let allowedHosts = null;
 	const server = createServer(async (req, res) => {
+		if (!allowedHosts) {
+			const addr = server.address();
+			allowedHosts = buildAllowedHosts(ALLOWED_ORIGINS, addr && typeof addr === "object" && "port" in addr ? addr.port : port);
+		}
+		if (!isHostAllowed(req.headers.host, allowedHosts)) {
+			res.writeHead(403, { "Content-Type": "text/plain" });
+			res.end("forbidden host");
+			return;
+		}
 		const raw = req.url || "/";
 		const qIdx = raw.indexOf("?");
 		const pathname = qIdx >= 0 ? raw.slice(0, qIdx) : raw;
@@ -19585,6 +20017,20 @@ function startViewerServer(port, _kv, _sdk, secret, restPort) {
 			res.end("viewer not found");
 			return;
 		}
+		if (method === "GET" && pathname === "/favicon.svg") {
+			const favicon = loadViewerFavicon();
+			if (favicon) {
+				res.writeHead(200, {
+					"Content-Type": "image/svg+xml",
+					"Cache-Control": "public, max-age=3600"
+				});
+				res.end(favicon);
+				return;
+			}
+			res.writeHead(404, { "Content-Type": "text/plain" });
+			res.end("favicon not found");
+			return;
+		}
 		try {
 			await proxyToRestApi(resolvedRestPort, pathname, qs, method, req, res, secret);
 		} catch (err) {
@@ -19984,7 +20430,7 @@ async function main() {
 		console.warn(`[agentmemory] Failed to backfill memories into BM25:`, err);
 	}
 	bootLog(`Ready. ${embeddingProvider ? "Triple-stream (BM25+Vector+Graph)" : "BM25+Graph"} search active.`);
-	bootLog(`REST API: 121 endpoints at http://localhost:${config.restPort}/agentmemory/*`);
+	bootLog(`REST API: 124 endpoints at http://localhost:${config.restPort}/agentmemory/*`);
 	bootLog(`MCP surface (opt-in via \`npx @agentmemory/mcp\`): ${getAllTools().length} tools · 6 resources · 3 prompts`);
 	const viewerServer = startViewerServer(config.restPort + 2, kv, sdk, secret, config.restPort);
 	const autoForgetIntervalMs = parseInt(process.env.AUTO_FORGET_INTERVAL_MS || "3600000", 10);