@cerefox/memory 1.1.0-beta.7 → 1.1.0

package/dist/bin/cerefox.js

@@ -7438,7 +7438,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "1.1.0-beta.7";
+var PKG_VERSION = "1.1.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -25858,7 +25858,7 @@ async function checkServerCompatibility(opts) {
 var COMPATIBILITY;
 var init_compatibility = __esm(() => {
   COMPATIBILITY = {
-    minSchema: "0.3.1",
+    minSchema: "0.10.3",
     minEdgeFunctions: "0.6.0"
   };
 });
@@ -75610,7 +75610,7 @@ import { homedir as homedir6 } from "node:os";
 import { join as join9 } from "node:path";
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.1.0-beta.7";
+var EF_VERSION = "1.1.0";
 var EF_LAST_CHANGED = "1.1.0-beta.7";
 
 // src/cli/util/checks.ts
@@ -75712,19 +75712,60 @@ var RETIRED_ENV_VARS = [
   { name: "CEREFOX_MIN_TERM_COVERAGE", configKey: "min_term_coverage", since: "v1.1.0" },
   { name: "CEREFOX_SEARCH_ALPHA", configKey: "search_alpha", since: "v1.1.0" }
 ];
-function checkRetiredEnvVars() {
+async function checkRetiredEnvVars() {
   const set = RETIRED_ENV_VARS.filter((v) => (process.env[v.name] ?? "").trim() !== "");
   if (set.length === 0) {
     return { name: "retired env", status: "ok", detail: "no retired variables set" };
   }
-  const moves = set.map((v) => `cerefox config set ${v.configKey} ${(process.env[v.name] ?? "").trim()}`).join(`
-      `);
+  const settings = loadSettings();
+  const stored = new Map;
+  if (settings.supabaseUrl && settings.supabaseKey) {
+    await Promise.all(set.map(async (v) => {
+      try {
+        const resp = await fetch(`${settings.supabaseUrl.replace(/\/$/, "")}/rest/v1/rpc/cerefox_get_config`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            apikey: settings.supabaseKey,
+            Authorization: `Bearer ${settings.supabaseKey}`
+          },
+          body: JSON.stringify({ p_key: v.configKey })
+        });
+        if (!resp.ok)
+          return;
+        const body = await resp.json();
+        stored.set(v.configKey, typeof body === "string" ? body : null);
+      } catch {}
+    }));
+  }
+  const sameNumber = (a, b2) => {
+    const x = Number(a);
+    const y = Number(b2);
+    return Number.isFinite(x) && Number.isFinite(y) ? x === y : a.trim() === b2.trim();
+  };
+  const pending = set.filter((v) => {
+    const dbValue = stored.get(v.configKey);
+    if (dbValue == null)
+      return true;
+    return !sameNumber(dbValue, (process.env[v.name] ?? "").trim());
+  });
   const names = set.map((v) => v.name).join(", ");
-  const prunedWasDisabled = set.some((v) => v.configKey.startsWith("version_"));
+  const isAre = set.length === 1 ? "is" : "are";
+  if (pending.length === 0) {
+    return {
+      name: "retired env",
+      status: "skipped",
+      detail: `${names} ${isAre} set in your .env but no longer read — the store already has the same value.`,
+      hint: "Safe to delete those lines; nothing reads them."
+    };
+  }
+  const moves = pending.map((v) => `cerefox config set ${v.configKey} ${(process.env[v.name] ?? "").trim()}`).join(`
+      `);
+  const prunedWasDisabled = pending.some((v) => v.configKey.startsWith("version_"));
   return {
     name: "retired env",
     status: "warn",
-    detail: `${names} ${set.length === 1 ? "is" : "are"} set in your .env but ` + `${set.length === 1 ? "is" : "are"} no longer read (moved into the database in ${set[0].since}).`,
+    detail: `${names} ${isAre} set in your .env but ${isAre} no longer read ` + `(moved into the database in ${set[0].since}).`,
     hint: "These are server-side settings, so they now live in the database and one value " + `governs every client.
     ` + (prunedWasDisabled ? `Your data is safe: the upgrade switched version pruning OFF and deleted nothing.
     ` : "") + `To carry your settings over, run:
@@ -82454,9 +82495,9 @@ var CONFIG_CATALOG = [
   },
   {
     key: "version_retention_hours",
-    description: "How long to keep archived versions of a document. The most recent version and any explicitly archived one are always kept, whatever this says.",
+    description: "How long to keep archived versions of a document (hours). The most recent version and any explicitly archived one are always kept, whatever this says.",
     kind: "number",
-    defaultValue: "48",
+    defaultValue: "120",
     min: 0,
     group: "Retention"
   },

package/dist/server-assets/_shared/ef-meta/index.ts

@@ -18,7 +18,7 @@
  * doesn't touch `supabase/functions/` leaves it alone).
  */
 
-export const EF_VERSION = "1.1.0-beta.7";
+export const EF_VERSION = "1.1.0";
 
 /**
  * The most recent version whose EF-side SOURCE actually changed (#127).

package/dist/server-assets/db/migrations/0017_retention_default_120h.sql

@@ -0,0 +1,28 @@
+-- 0017_retention_default_120h.sql — raise the built-in version-retention window
+-- from 48 to 120 hours.
+--
+-- 48 hours does not survive a weekend: a bad edit made on Friday afternoon is
+-- unrecoverable by Monday morning, which is exactly when someone would look for
+-- it. 120 hours (5 days) covers that gap while still bounding growth — versions
+-- carry embeddings and are the largest rows in a busy store.
+--
+-- This is only the FALLBACK used when the store has expressed no preference. An
+-- explicit `version_retention_hours` in cerefox_config is untouched, as is the
+-- `version_cleanup_enabled=false` fail-safe that migration 0016 seeds on
+-- existing stores.
+--
+-- Unchanged: cleanup never deletes the most recent version, nor any version
+-- marked `archived`.
+--
+-- The value lives in `rpcs.sql`, which `cerefox server deploy` re-applies. This
+-- migration exists so the schema version moves and operators are told to
+-- redeploy.
+--
+-- Idempotent: safe to re-run.
+
+DO $$
+BEGIN
+    RAISE NOTICE
+        'Migration 0017: default version retention is now 120 hours (was 48). '
+        'An explicit version_retention_hours setting is unaffected.';
+END $$;

package/dist/server-assets/db/rpcs.sql

@@ -941,7 +941,9 @@ $$;
 --   p_document_id     : Document to snapshot
 --   p_source          : How the update was triggered ('file','paste','agent','manual')
 --   p_retention_hours : Retention window in hours. NULL (default) reads
---                       `version_retention_hours` from cerefox_config, else 48.
+--                       `version_retention_hours` from cerefox_config, else 120
+--                       (5 days — long enough that a bad edit made on a Friday
+--                       is still recoverable on Monday; 48h was not).
 --                       A non-NULL value overrides the store policy for this
 --                       call only.
 --
@@ -982,7 +984,7 @@ DECLARE
     -- data. Same COALESCE(param, config, default) shape the retrieval tunables
     -- already use.
     v_retention      INT     := COALESCE(p_retention_hours,
-                                         cerefox_config_int('version_retention_hours', 48));
+                                         cerefox_config_int('version_retention_hours', 120));
     v_cleanup        BOOLEAN := COALESCE(p_cleanup_enabled,
                                          cerefox_config_bool('version_cleanup_enabled', TRUE));
 BEGIN
@@ -2323,7 +2325,7 @@ SET search_path = public, pg_catalog
 AS $$
     -- Keep in lockstep with the `@version:` marker in schema.sql (cut_release.ts
     -- enforces it). Bump whenever schema.sql OR rpcs.sql changes.
-    SELECT '0.10.3'::TEXT;
+    SELECT '0.10.4'::TEXT;
 $$;
 
 -- ── cerefox_content_format_stats ─────────────────────────────────────────────

package/dist/server-assets/db/schema.sql

@@ -5,7 +5,7 @@
 -- Requires extensions: vector (pgvector), uuid-ossp
 -- These are enabled at the top of db_deploy.py before this file is applied.
 --
--- @version: 0.10.3
+-- @version: 0.10.4
 -- The `@version` marker above is read by the schema-version-mismatch banner
 -- (see /api/v1/schema-version). Bump it whenever schema.sql OR rpcs.sql
 -- changes in a way that requires `cerefox server deploy` to be re-run —

package/docs/guides/configuration.md

@@ -140,10 +140,10 @@ This handles intermittent OpenAI API errors (500s) that would otherwise cause se
 
 > **Which paths read these?** Client-side tunables in this section are read
 > from *your* `.env` by the **CLI**, the **local MCP server**, and `cerefox
-> web`. Since **v1.0.6** the same values are also honored on the **remote MCP /
-> Edge Function path** when set as Supabase **Function secrets**
-> (`supabase secrets set CEREFOX_MIN_SEARCH_SCORE=0.55 --project-ref <ref>`) —
-> the shared helpers read `Deno.env` as well as `process.env`. Per-call
+> web`. **Since v1.1.0 these are database settings only** — the `CEREFOX_*`
+> variables and the equivalent Supabase **Function secrets** are no longer read,
+> on any path. One `cerefox config set` (or the Settings page) governs the CLI,
+> the web UI, local and remote MCP, and the Edge Functions alike. Per-call
 > parameters (`min_score`, `min_term_coverage`, `alpha` on `cerefox_search`)
 > override both. A single setting that governs every path without secrets is
 > tracked as issue #133 (DB-backed config).
@@ -248,7 +248,7 @@ Cerefox automatically archives previous document content whenever a document is
 When a document's content changes during ingestion, Cerefox calls the `cerefox_snapshot_version` database function before writing new chunks. This function:
 1. Creates a version record in `cerefox_document_versions`
 2. Moves all current chunks to that version (by setting their `version_id`)
-3. If `CEREFOX_VERSION_CLEANUP_ENABLED` is `true`, deletes stale versions older than `CEREFOX_VERSION_RETENTION_HOURS` (skipping archived versions)
+3. If `version_cleanup_enabled` is `true`, deletes versions older than `version_retention_hours` — skipping archived versions and always keeping the most recent one. Both are `cerefox_config` settings (v1.1.0+); before that they came from each client's environment.
 
 Metadata-only updates (same content, different title or project) do **not** create a new version.
 
@@ -413,11 +413,10 @@ Two things the page does deliberately:
   `require_requestor_identity` starts rejecting agents that don't identify
   themselves. Neither is a bare toggle — you get a dialog naming the
   consequence first.
-- **Local overrides are shown, read-only.** If the server has
-  `CEREFOX_MIN_SEARCH_SCORE` (or the `..._TERM_COVERAGE` / `..._SEARCH_ALPHA`
-  equivalents) in its environment, that value beats the stored one *on that
-  machine*, and the row says so. Without this the page would report a value the
-  server isn't using. The page never edits `.env` — that file holds your
+- **Retired `.env` lines are flagged.** If a variable that used to control a
+  setting is still present in the server's environment, the row says so — it no
+  longer does anything, and the value shown is what actually runs. The page
+  never edits `.env` — that file holds your
   service-role key, OpenAI key and database password, and the server only reads
   it at boot.
 

package/docs/guides/setup-local.md

@@ -62,7 +62,9 @@ data volume, so it survives `cerefox-local upgrade`.
 
 > Scores are calibrated per embedder: with the local model the default semantic
 > threshold is **0.6** (vs 0.5 for OpenAI) because nomic scores unrelated text
-> higher. Override per call with `--min-score` or via `CEREFOX_MIN_SEARCH_SCORE`.
+> higher. The container seeds `min_search_score = 0.6` into its own config at
+> first boot; change it with `cerefox config set min_search_score <value>` or the
+> Settings page, or override a single query with `--min-score`.
 
 ---
 

package/docs/guides/upgrading.md

@@ -20,18 +20,55 @@ to re-run.
 
 ## End-user upgrade
 
-> **Upgrading to v1.1.0: run `cerefox server deploy`, don't defer it.** Most
-> releases let you postpone the server step. This one should not be postponed:
-> schema **0.10.2** fixes a defect where a stale or blank
-> `expected_content_hash` raised its conflict under a SQLSTATE that infrastructure
-> treats as *retryable*. Because the conflict is permanent, retry-aware layers
-> could replay the request without limit — one report reached ~47 million calls
-> over about a day and exhausted the project's disk-IO budget. The fix lives in
-> `rpcs.sql`, so **upgrading the client alone does not apply it**; the database
-> keeps the old behaviour until the RPCs are redeployed. `cerefox doctor` will
-> say so, and the web UI shows a banner.
+> ### Upgrading to v1.1.0 — `cerefox server deploy` is required
 >
-> Cerefox Local users need no separate step — the schema ships inside the image.
+> Most releases let you postpone the server step. **This one does not.** Until
+> you redeploy, the client and the database disagree in ways that cost data:
+>
+> - The conflict fix that stops [unbounded retry
+>   storms](../../CHANGELOG.md) lives in `rpcs.sql`, so upgrading the client
+>   alone leaves the defect live.
+> - The v1.1.0 client stops sending retention and retrieval settings and expects
+>   the **server** to resolve them from `cerefox_config`. An older server does
+>   not read those keys, so a store configured to "keep every version" silently
+>   reverts to pruning — quiet data loss.
+>
+> Because of that second point, v1.1.0 raises the **minimum supported schema**
+> to `0.10.3` — the version where the RPCs began resolving those settings from
+> `cerefox_config`. (The release ships schema `0.10.4`; the extra step only
+> changed a default value, which degrades gracefully, so it is not part of the
+> minimum. A schema bump does **not** normally raise the minimum.) What the
+> minimum actually gates:
+>
+> | Surface | Below the minimum |
+> |---|---|
+> | `cerefox web` | **Refuses to start** — "Refusing to start: the deployed Cerefox server is incompatible with this client" |
+> | `cerefox doctor` | Reports an error and exits non-zero |
+> | Web UI banner | Red, blocking |
+> | CLI commands (`search`, `document`, `ingest`, …) | **Keep working** |
+> | MCP servers (local and remote) | **Keep working** |
+>
+> So the practical effect is: **your web UI is unavailable between upgrading the
+> client and running `server deploy`.** Run them together and the window is
+> seconds. Nothing is destroyed by being in that state — it exists to stop you
+> operating a mismatched pair for days without noticing.
+>
+> **After redeploying**, carry over any settings you had tuned in `.env`.
+> `cerefox doctor` lists them with the exact commands, and stops mentioning them
+> once the store matches. The five retired variables are
+> `CEREFOX_MIN_SEARCH_SCORE`, `CEREFOX_MIN_TERM_COVERAGE`, `CEREFOX_SEARCH_ALPHA`,
+> `CEREFOX_VERSION_RETENTION_HOURS`, `CEREFOX_VERSION_CLEANUP_ENABLED`.
+>
+> **Version pruning is switched off on existing stores** by migration 0016, so
+> the change above cannot quietly discard history. Nothing is deleted. Re-enable
+> when you have chosen a policy:
+> `cerefox config set version_cleanup_enabled true`. The default retention
+> window is now 120 hours (was 48) — long enough that a Friday mistake is still
+> recoverable on Monday.
+>
+> **Cerefox Local** users need no separate step: the schema ships inside the
+> image, so `cerefox-local upgrade` moves both halves together.
+
 
 ```bash
 cerefox self-update      # or: re-run the installer, or bun/npm update -g @cerefox/memory

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cerefox/memory",
-  "version": "1.1.0-beta.7",
+  "version": "1.1.0",
   "description": "Cerefox — user-owned shared memory for AI agents. CLI + stdio MCP server + web UI + ingestion for a knowledge base on your own Supabase project (or fully self-hosted with Cerefox Local).",
   "license": "Apache-2.0",
   "homepage": "https://github.com/fstamatelopoulos/cerefox",