@cerefox/memory 1.17.3 → 1.18.0

package/dist/frontend/index.html

@@ -15,7 +15,7 @@
       href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600;700&display=swap"
     />
     <title>Cerefox</title>
-    <script type="module" crossorigin src="/app/assets/index-D7YyXio_.js"></script>
+    <script type="module" crossorigin src="/app/assets/index-CxMT7hjH.js"></script>
     <link rel="stylesheet" crossorigin href="/app/assets/index-B0H_N4if.css">
   </head>
   <body>

package/dist/server-assets/_shared/ef-meta/index.ts

@@ -18,7 +18,7 @@
  * doesn't touch `supabase/functions/` leaves it alone).
  */
 
-export const EF_VERSION = "1.17.3";
+export const EF_VERSION = "1.18.0";
 
 /**
  * The Cerefox RELEASE version — what `cerefox --version` reports and what npm
@@ -36,7 +36,7 @@ export const EF_VERSION = "1.17.3";
  * is imported by the Deno Edge Functions, which cannot reach into the npm
  * package.
  */
-export const CEREFOX_VERSION = "1.17.3";
+export const CEREFOX_VERSION = "1.18.0";
 
 /**
  * The most recent version whose EF-side SOURCE actually changed (#127).

package/dist/server-assets/db/migrations/0012_content_format.sql

@@ -2,7 +2,7 @@
 --
 -- Records how each chunk's content reconstructs into full document text:
 --   1 = legacy    — chunk contents were trimmed sections; reconstruction re-joins
---                   them with E'\n\n' (the pre-28D behaviour). All existing chunks.
+--                   them with E'\n\n' (the pre-28D behavior). All existing chunks.
 --   2 = blind-stitch — chunk contents are an exact, gapless partition of the
 --                   document; reconstruction is a plain concatenation (no separator
 --                   synthesized on read). Written by the exact-partition chunker.

package/dist/server-assets/db/migrations/0014_document_relations.sql

@@ -12,7 +12,7 @@ CREATE TABLE IF NOT EXISTS cerefox_document_relations (
     source_id    UUID        NOT NULL REFERENCES cerefox_documents(id) ON DELETE CASCADE,
     target_id    UUID        NOT NULL REFERENCES cerefox_documents(id) ON DELETE CASCADE,
     -- Free-text by design: agents define new types without a migration. The
-    -- type dictionary (in the RPCs) gives known types behaviour; unknown types
+    -- type dictionary (in the RPCs) gives known types behavior; unknown types
     -- are stored and returned, just without special handling.
     rel_type     TEXT        NOT NULL,
     metadata     JSONB       NOT NULL DEFAULT '{}'::jsonb,

package/dist/server-assets/db/migrations/0020_ingest_preserves_source.sql

@@ -55,5 +55,5 @@ BEGIN
         'Migration 0020: cerefox_ingest_document now preserves a document''s '
         'source when p_source is omitted. Before this, any content update '
         'without an explicit source silently rewrote provenance to ''agent'', '
-        'and migrate-format relabelled every document it converted (#191).';
+        'and migrate-format relabeled every document it converted (#191).';
 END $$;

package/dist/server-assets/db/migrations/0022_rls_on_document_relations.sql

@@ -26,7 +26,7 @@
 
 ALTER TABLE cerefox_document_relations ENABLE ROW LEVEL SECURITY;
 
--- Defence in depth: revoke the legacy blanket grants so the table is denied by
+-- Defense in depth: revoke the legacy blanket grants so the table is denied by
 -- privilege as well as by RLS. Harmless where the grants were never made.
 REVOKE ALL ON TABLE cerefox_document_relations FROM anon;
 

package/dist/server-assets/db/migrations/0032_derive_grants.sql

@@ -32,7 +32,7 @@ BEGIN
 
     GRANT USAGE ON SCHEMA public TO service_role;
 
-    -- Derived from the catalogue, not from a list someone has to remember.
+    -- Derived from the catalog, not from a list someone has to remember.
     FOR t IN
         SELECT c.relname
         FROM pg_class c

package/dist/server-assets/db/migrations/0034_drop_vector_indexes.sql

@@ -0,0 +1,22 @@
+-- 0034_drop_vector_indexes.sql — drop the unused HNSW vector indexes (schema
+-- 0.19.0, release 1.18.0).
+--
+-- Since 0.18.1 the hybrid search RPCs rank vector candidates by an exact scan
+-- (`ORDER BY vec_score DESC`, see cerefox_hybrid_search in rpcs.sql), because
+-- the HNSW index answered the bare-distance ordering with at most
+-- `hnsw.ef_search` (40) rows, and on a store with heavy version churn those
+-- were mostly not the nearest ones. The two indexes have served no query since,
+-- while every chunk write still paid to maintain them and their quality kept
+-- degrading.
+--
+-- The exact scan is fast at knowledge-base scale: measured on a 1-CPU / 1 GB
+-- Postgres with 768-dim vectors, top-500 candidates took 2 ms at 2k chunks,
+-- 56 ms at 50k and 181 ms at 100k. A default-configured HNSW index was slower
+-- than that from 50k chunks and recalled 27% of the true top-250 at 100k.
+-- `cerefox doctor` reports the current chunk count and warns past 100k; a
+-- tuned index path for stores that large is tracked separately.
+--
+-- Idempotent: safe to re-run.
+
+DROP INDEX IF EXISTS idx_cerefox_chunks_emb_primary;
+DROP INDEX IF EXISTS idx_cerefox_chunks_emb_upgrade;

package/dist/server-assets/db/rpcs.sql

@@ -236,7 +236,7 @@ BEGIN
         fts_results AS (
             SELECT
                 c.id,
-                -- 0.18.0: normalisation 32 bounds the keyword score to
+                -- 0.18.0: normalization 32 bounds the keyword score to
                 -- rank/(rank+1), in [0, 1) like the cosine it is fused with.
                 -- Unbounded (up to ~4 when every term matches), one keyword
                 -- hit outweighed any semantic evidence, and the same document
@@ -305,7 +305,8 @@ BEGIN
             -- hnsw.ef_search (40) rows: on a store with heavy version churn it
             -- returned far fewer candidates than asked for, mostly not the
             -- nearest ones. An exact scan is also faster at knowledge-base
-            -- scale (thousands of chunks).
+            -- scale (thousands of chunks). 0.19.0 dropped the HNSW indexes
+            -- altogether (migration 0034).
             ORDER BY vec_score DESC
             LIMIT candidate_count
         ),
@@ -2005,7 +2006,7 @@ AS $$
         -- would share a timestamp and the order of operations inside the batch
         -- would be unrecoverable from the trail (iter-33). clock_timestamp()
         -- advances within a transaction, so entries stay orderable. Outside a
-        -- batch this is indistinguishable from the old behaviour.
+        -- batch this is indistinguishable from the old behavior.
         clock_timestamp()
     )
     RETURNING id AS audit_id, cerefox_audit_log.created_at;
@@ -2516,7 +2517,7 @@ $$;
 -- docs/research/document-relations-and-semantic-graph.md
 --
 -- Type dictionary: rel_type is free text (any string is accepted and returned),
--- but a few KNOWN types carry behaviour. Keeping the dictionary in one place
+-- but a few KNOWN types carry behavior. Keeping the dictionary in one place
 -- here — rather than scattered CASE expressions — is what lets the set/delete
 -- RPCs stay symmetric with each other.
 --   symmetric   both directions are written/removed together
@@ -3235,6 +3236,8 @@ SET search_path = public, pg_catalog
 AS $$
     -- Keep in lockstep with the `@version:` marker in schema.sql (cut_release.ts
     -- enforces it). Bump whenever schema.sql OR rpcs.sql changes.
+    -- 0.19.0: migration 0034 drops the unused HNSW vector indexes (search has
+    -- scanned exactly since 0.18.1). No RPC behavior change.
     -- 0.18.2: min_term_coverage built-in default 0.66 (two of three terms).
     -- 0.18.0's 0.67 required all three for a three-term query. RPC-only.
     -- 0.18.1: exact vector candidates. Hybrid and semantic search ordered by
@@ -3243,7 +3246,7 @@ AS $$
     -- they now order by the computed similarity (exact scan). Keyword matches
     -- carry their exact cosine into fusion. RPC-only.
     -- 0.18.0 (iteration 48): search calibration, RPC-only. Bounded keyword
-    -- score in hybrid fusion (ts_rank_cd normalisation 32); min_term_coverage
+    -- score in hybrid fusion (ts_rank_cd normalization 32); min_term_coverage
     -- default 0.67; built-in min_search_score follows the store's embedder
     -- (new cerefox_default_min_search_score). docs/specs/search-calibration.md.
     -- 0.17.0 (#251): trash auto-purge. New cerefox_purge_expired_trash, called
@@ -3287,7 +3290,7 @@ AS $$
     -- 0.11.0 supersedes 0.10.6 (v1.2.1, #191): this branch carries that fix plus
     -- the partial-edit surface, and both migrations (0019, 0020) are in the
     -- sequence, so a store deploying this gets everything from both lines.
-    SELECT '0.18.2'::TEXT;
+    SELECT '0.19.0'::TEXT;
 $$;
 
 -- ── cerefox_find_dead_links ──────────────────────────────────────────────────

package/dist/server-assets/db/schema.sql

@@ -5,7 +5,7 @@
 -- Requires extensions: vector (pgvector), uuid-ossp
 -- These are enabled at the top of db_deploy.py before this file is applied.
 --
--- @version: 0.18.2
+-- @version: 0.19.0
 -- The `@version` marker above is read by the schema-version-mismatch banner
 -- (see /api/v1/schema-version). Bump it whenever schema.sql OR rpcs.sql
 -- changes in a way that requires `cerefox server deploy` to be re-run —
@@ -166,7 +166,7 @@ CREATE TABLE IF NOT EXISTS cerefox_document_projects (
 -- ── Document relations (iteration 29) ─────────────────────────────────────────
 -- Typed, directed edges between documents. rel_type is free text by design so
 -- agents can define new types without a migration; the type dictionary lives in
--- the RPCs and gives KNOWN types behaviour (symmetry, lifecycle side effects).
+-- the RPCs and gives KNOWN types behavior (symmetry, lifecycle side effects).
 -- Design: docs/research/document-relations-and-semantic-graph.md §2.2.
 
 CREATE TABLE IF NOT EXISTS cerefox_document_relations (
@@ -267,17 +267,11 @@ CREATE INDEX IF NOT EXISTS idx_cerefox_chunks_fts
     ON cerefox_chunks USING GIN(fts)
     WHERE version_id IS NULL;
 
--- Vector similarity — primary embedding, current chunks only
-CREATE INDEX IF NOT EXISTS idx_cerefox_chunks_emb_primary
-    ON cerefox_chunks USING hnsw (embedding_primary vector_cosine_ops)
-    WITH (m = 16, ef_construction = 64)
-    WHERE version_id IS NULL;
-
--- Vector similarity — upgrade embedding, current chunks only
-CREATE INDEX IF NOT EXISTS idx_cerefox_chunks_emb_upgrade
-    ON cerefox_chunks USING hnsw (embedding_upgrade vector_cosine_ops)
-    WITH (m = 16, ef_construction = 64)
-    WHERE version_id IS NULL;
+-- Vector similarity: deliberately NO index (0.19.0, migration 0034). Search
+-- ranks vector candidates by an exact scan, which is both correct and fast at
+-- knowledge-base scale; the HNSW indexes it replaced returned too few, mostly
+-- wrong candidates on stores with version churn. Do not add one back without
+-- the measurements in docs/specs/search-calibration.md (scale section).
 
 -- Partial unique index: enforces (document_id, chunk_index) uniqueness for
 -- current chunks. Archived chunks are excluded and may share chunk_index values
@@ -408,7 +402,7 @@ ON CONFLICT (key) DO NOTHING;
 -- The review workflow (agent writes land pending_review, a person approves)
 -- is OFF on a fresh install (#241): most stores have no reviewer, and a queue
 -- nobody drains is noise. Migration 0031 seeds TRUE on stores that predate the
--- flag, so an upgrade never changes behaviour. Only this seed and that
+-- flag, so an upgrade never changes behavior. Only this seed and that
 -- migration ever write the value; the toggle itself is `cerefox config set`.
 INSERT INTO cerefox_config (key, value)
 VALUES ('review_workflow_enabled', 'false')
@@ -491,7 +485,7 @@ ALTER TABLE cerefox_document_relations    ENABLE ROW LEVEL SECURITY;
 -- Guarded: on the local (World B) stack this file deploys BEFORE roles.sql
 -- creates service_role, so missing-role must be a no-op (roles.sql re-runs the
 -- grants implicitly via its own PostgREST wiring; the next deploy picks them up).
--- DERIVED from the catalogue, never listed. The list used to be a hand-written
+-- DERIVED from the catalog, never listed. The list used to be a hand-written
 -- ARRAY and it drifted: cerefox_document_relations was added above and never
 -- added to the array, so a FRESH cloud deploy left that table with no Data API
 -- grant. Upgrades hid it (migration 0014 grants it inline) and the self-hosted

package/docs/api/openapi.json

@@ -5731,7 +5731,7 @@
     },
     "/api/v1/version": {
       "get": {
-        "summary": "Server version and environment label.",
+        "summary": "Server version, environment label, and the newest release on npm as the server last checked it (`latest`, plus `update_command` when it is newer).",
         "operationId": "get_version",
         "responses": {
           "200": {
@@ -5761,13 +5761,27 @@
                         "string",
                         "null"
                       ]
+                    },
+                    "latest": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "update_command": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
                     }
                   },
                   "required": [
                     "version",
                     "git_commit_short",
                     "build_date",
-                    "env_label"
+                    "env_label",
+                    "latest",
+                    "update_command"
                   ],
                   "additionalProperties": false
                 }

package/docs/guides/access-paths.md

@@ -60,8 +60,12 @@ Postgres RPCs
 ```
 
 **ChatGPT Custom GPT Actions** call the eight primitive Edge Functions directly over HTTPS
-using an OpenAPI schema. `cerefox-mcp` is not involved (ChatGPT does not support the
-Streamable HTTP MCP protocol).
+using an OpenAPI schema. `cerefox-mcp` is not involved. OpenAI retires Custom GPTs on **December 11, 2026**, and custom actions do not carry over to its plugins, so this path ends
+then. ChatGPT now supports remote MCP connectors (OAuth or no auth, no static bearer
+token), so its replacement is expected to be a connector to `cerefox-mcp` over OAuth,
+like cloud Claude; see
+[`chatgpt-after-custom-gpts.md`](../research/chatgpt-after-custom-gpts.md) and
+[#326](https://github.com/fstamatelopoulos/cerefox/issues/326).
 
 **curl / scripts / custom HTTP clients** can also call the primitives directly using the
 same Cerefox token as a Bearer token.
@@ -213,7 +217,7 @@ single container with an internally-held token.
 | Claude Code / Cursor | HTTPS → `cerefox-mcp` | Cerefox access token (`cfx_pat_…`) | Advanced/fallback; prefer local MCP for daily use |
 | Claude Desktop | HTTPS → `cerefox-mcp` (via `supergateway`) | Cerefox access token (`cfx_pat_…`) | Advanced/fallback; prefer local MCP for daily use |
 | **Cloud Claude (claude.ai web + mobile)** | HTTPS → `cerefox-mcp` over **OAuth 2.1** | Owner-pinned OAuth access token (JWKS-verified) | Optional; memory in the browser + on the phone |
-| ChatGPT Custom GPT | HTTPS → primitive Edge Functions | Cerefox access token (`cfx_pat_…`) | AI assistant via GPT Actions |
+| ChatGPT Custom GPT | HTTPS → primitive Edge Functions | Cerefox access token (`cfx_pat_…`) | AI assistant via GPT Actions; **ends 2026-12-11** (Custom GPTs retire) |
 | curl / HTTP scripts | HTTPS → primitive Edge Functions | Cerefox access token (`cfx_pat_…`) | Ad-hoc queries, automation |
 | Web UI (`cerefox web`) | Supabase REST API | Secret key (or legacy service_role) | Web UI backend (TS Hono) |
 | **HTTP client → `/api/v1`** | Plain HTTP to `cerefox web` / Cerefox Local | **None from loopback; API key otherwise** (v1.12.0) — `cerefox api-key generate` / `cerefox-local api-key` | A local program or bot harness that wants HTTP rather than MCP. Names itself with `X-Cerefox-Author` / `X-Cerefox-Requestor` (v1.11.0): a declared label for attribution, not a verified identity. See [`api.md`](api.md) |

package/docs/guides/api.md

@@ -179,7 +179,7 @@ default; Cerefox Local picks its own port and `cerefox-local status` prints it).
 
 | Method + path | Purpose |
 |---|---|
-| `GET /version` | Server version and environment label. |
+| `GET /version` | Server version, environment label, and the newest release on npm as the server last checked it (`latest`, plus `update_command` when it is newer). |
 | `GET /schema-version` | Deployed schema version. |
 | `GET /openapi.json` | This API's OpenAPI 3.1 description, served by the version you are talking to. Every `/api/v1` response points at it with `Link: </api/v1/openapi.json>; rel="service-desc"` (RFC 8631). |
 | `GET /search?q=…` | Hybrid search (FTS + semantic). `&review_status=approved\|pending_review` filters server-side; `400` while the review workflow is off. The response's `embedder` (`openai` or `local`) says which scale the scores are on. |

package/docs/guides/cli.md

@@ -773,11 +773,11 @@ These flat commands handle install, configuration, and health. Run any with `--h
 | Command | Purpose |
 |---|---|
 | `cerefox init` | Interactive first-run setup; writes `~/.cerefox/.env`, offers `server deploy` + self-docs ingest. |
-| `cerefox doctor` | Diagnose the install (credentials, DB reachability, schema version, whether the review workflow is on). |
+| `cerefox doctor` | Diagnose the install (credentials, DB reachability, schema version, whether the review workflow is on, whether a newer release is out). |
 | `cerefox status` | Show connection + schema status. |
 | `cerefox configure-agent --tool <client>` | Write MCP client config (`claude-code`, `claude-desktop`, `cursor`, `codex`, `gemini`). |
 | `cerefox token generate` / `rotate` / `list` | Manage the Cerefox access token (`cfx_pat_…`) — the Edge Function Bearer credential (remote MCP, GPT Actions, curl). See the [`cerefox token`](#cerefox-token-generate--cerefox-token-rotate--cerefox-token-list) section above. |
-| `cerefox self-update` | Update the installed `@cerefox/memory` package. |
+| `cerefox self-update` | Update the installed `@cerefox/memory` package. Other commands print a one-line notice when a newer release is out; see [configuration.md → Update check](configuration.md#update-check) to turn it off. |
 | `cerefox completion` | Emit a shell completion script. |
 | `cerefox backup create` / `cerefox backup restore` | File-system backup / restore of the knowledge base (see [`ops-scripts.md`](ops-scripts.md)). |
 

package/docs/guides/configuration.md

@@ -344,6 +344,27 @@ there matters.
 
 ---
 
+## Update check
+
+Cerefox tells you when a newer release is on npm (v1.18.0, #323): one line after
+a CLI command (at most once a day, only at a terminal), an `updates` row in
+`cerefox doctor`, and a note in the web UI footer. Inside the Cerefox Local
+container it points at `cerefox-local upgrade` instead of `cerefox self-update`.
+
+The only network call is a GET of the `latest` release from the npm registry
+(`registry.npmjs.org`), the same request `cerefox self-update` makes. It is made
+by `cerefox web` (at startup, then daily), `cerefox mcp` (at startup, when the
+last answer is over a day old), `cerefox doctor` and `cerefox self-update`.
+Every other command only reads the saved answer, `update-check.json` in
+`~/.cerefox` (or in `CEREFOX_CONFIG_DIR`, when set), so it never adds latency.
+Offline, the check stays quiet.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CEREFOX_NO_UPDATE_CHECK` | _(unset)_ | Set to `1` to turn the check off entirely: no request to npm, and no notice anywhere. `NO_UPDATE_NOTIFIER` (the convention other CLIs use) and `CI` do the same. |
+
+---
+
 ## Logging
 
 | Variable | Default | Description |
@@ -422,7 +443,7 @@ cerefox server deploy --functions-only
 
 Contributors with a repo clone can instead redeploy individual functions with `npx supabase functions deploy cerefox-search` (and `cerefox-ingest`), or through the Supabase Dashboard → Edge Functions → Deploy.
 
-> **If you only use the local MCP server** (Claude Desktop, ChatGPT Desktop, Cursor), Step 3 is
+> **If you only use the local MCP server** (Claude Code, Claude Desktop, Codex, Cursor), Step 3 is
 > optional — the Edge Functions are only used for GPT Actions and direct HTTP access.
 
 > **Future improvement**: the Edge Functions will be updated to read model config from Supabase

package/docs/guides/connect-agents.md

@@ -24,7 +24,7 @@ client; you can also run both in parallel.
 Three top-level paths plus a few special cases:
 
 - **Path A** — MCP server (local subprocess or remote Edge Function). Best for purpose-built agent clients like Claude Desktop, Cursor, and Claude Code's MCP integration.
-- **Path B** — direct Edge Function HTTP. Best for ChatGPT Custom GPTs and any HTTP caller (curl, scripts).
+- **Path B** — direct Edge Function HTTP. For any HTTP caller (curl, scripts), and for ChatGPT Custom GPTs until OpenAI retires them on December 11, 2026.
 - **Path C** — local shell CLI invoked by a coding agent's Bash tool. Best for Claude Code, Codex CLI, opencode, OpenClaw, Hermes, and similar local-agent CLIs **when the user prefers not to configure MCP** but still wants the agent to read and write Cerefox.
 
 | Client | Path | Search | Requirements / caveats |
@@ -33,7 +33,8 @@ Three top-level paths plus a few special cases:
 | Claude Code (remote) | Path A-Remote — `cerefox-mcp` Edge Function | Hybrid | URL + Cerefox token only; no local install. Advanced/fallback — prefer Path A-Local |
 | Cursor (remote) | Path A-Remote — `cerefox-mcp` Edge Function | Hybrid | URL + Cerefox token only; no local install. Advanced/fallback — prefer Path A-Local |
 | OpenAI Codex CLI (remote) | Path A-Remote — `cerefox-mcp` Edge Function | Hybrid | URL + Cerefox token env var; TOML config. Advanced/fallback — prefer Path A-Local |
-| ChatGPT (chatgpt.com or desktop) | Path B — Custom GPT → Edge Functions | Hybrid | ChatGPT Plus required |
+| ChatGPT (chatgpt.com or desktop) | Path B — Custom GPT → Edge Functions | Hybrid | ChatGPT Plus required. **Ends 2026-12-11** when Custom GPTs retire; see [ChatGPT Custom GPT](#chatgpt-custom-gpt-cloud--chatgptcom) |
+| OpenAI Codex (CLI, and Codex threads in the ChatGPT desktop app) (local) | Path A-Local — `cerefox configure-agent --tool codex` | Hybrid | Writes `~/.codex/config.toml`; all 15 tools; zero Edge Function invocations. **Recommended for Codex** |
 | Claude Desktop (local) | Path A-Local — `@cerefox/memory` via `npx` | Hybrid | Local alternative; Node.js; zero Edge Function invocations |
 | Claude Code (local) | Path A-Local — `@cerefox/memory` via `npx` | Hybrid | Local alternative; zero Edge Function invocations |
 | Cursor (local) | Path A-Local — `@cerefox/memory` via `npx` | Hybrid | Local alternative; zero Edge Function invocations |
@@ -50,7 +51,8 @@ Three top-level paths plus a few special cases:
 > over the standard tool surface — no Cloud Run needed. Setup:
 > [setup-supabase Step 7](setup-supabase.md#step-7--oauth-for-cloud-agents-claudeai--mobile-optional)
 > + [Cloud Claude](#cloud-claude-claudeai-web--mobile-oauth) below. (An OAuth connector for
-> ChatGPT becomes possible on the same server but is not yet documented.)
+> ChatGPT is expected to replace the Custom GPT path when Custom GPTs retire; it is being
+> validated in [#326](https://github.com/fstamatelopoulos/cerefox/issues/326).)
 
 > **Perplexity** supports stdio-only MCP on macOS Desktop (via Helper App). Remote MCP is
 > "coming soon." Perplexity's CTO has signaled a strategic shift away from MCP (March 2026),
@@ -265,15 +267,26 @@ For the manual JSON (for the curious, or to debug if the CLI can't write your co
 
 ---
 
-### ChatGPT Desktop
+### ChatGPT Desktop and Codex
 
-> **ChatGPT Desktop does not support local stdio MCP servers.**
-> OpenAI's MCP implementation for ChatGPT only supports remote servers via SSE or
-> streaming HTTP — not local subprocess (stdio) servers like `cerefox mcp`.
-> The "dev mode" MCP connector visible in the app also requires a public URL.
->
-> **Use Path B (Custom GPT + Edge Functions) for all ChatGPT access** — both the web
-> app and the desktop app. The Custom GPT approach is fully validated and works well.
+The ChatGPT desktop app hosts two different things, and they connect differently:
+
+- **Codex threads** (and the Codex CLI) run local stdio MCP servers. Set them up with
+  `cerefox configure-agent --tool codex`, which writes the `cerefox` entry into
+  `~/.codex/config.toml`; the app's **Plugins → MCPs** screen edits the same entry. Start
+  a new Codex session after changing it (it reads the config at session start), then ask
+  it to call `cerefox_get_help`: the reply begins with the server version. All 15 tools
+  are available.
+- **Regular ChatGPT chats** do not get local MCP servers, in the desktop app or anywhere
+  else. ChatGPT only connects to **remote** MCP servers (OAuth or no auth). Today ChatGPT
+  chats reach Cerefox through the [Custom GPT](#chatgpt-custom-gpt-cloud--chatgptcom)
+  path, which ends on December 11, 2026; see the notice there.
+
+> **Tip**: `configure-agent` writes the `npx` form, which runs whatever version npx has
+> cached. To keep Codex on the same version as your installed CLI (and start faster),
+> point the entry at the binary instead: `command = "<path to cerefox>"`, `args = ["mcp"]`
+> (`which cerefox` prints the path; use the full path, since GUI apps may not see your
+> shell's `PATH`).
 
 ---
 
@@ -593,6 +606,8 @@ You have access to a personal knowledge base via the searchKnowledgeBase action.
 When the user asks a question, always search the knowledge base first using a
 relevant query. Present results by document title, citing the source for every claim.
 Use ingestNote to save any new information the user asks you to remember.
+Pass author: "ChatGPT" on every action call, so your reads and writes are
+attributed in the audit and usage logs.
 When UPDATING an existing document, first call getDocument and note its
 content_hash, then pass it as expected_content_hash on ingestNote. If you get a
 409 conflict, the document changed underneath you: call getDocument again, merge
@@ -620,6 +635,14 @@ Expected: JSON response with `results` array containing documents.
 
 ### ChatGPT Custom GPT (cloud — chatgpt.com)
 
+> **Retiring on December 11, 2026.** OpenAI is retiring Custom GPTs in favor of plugins,
+> and **custom actions do not carry over**: they have to be rebuilt as a connector or a
+> custom MCP server. This section works until then, but do not build a new setup on it.
+> ChatGPT will need a new connection, an MCP connector to `cerefox-mcp` over OAuth (the
+> way [cloud Claude](#cloud-claude-claudeai-web--mobile-oauth) connects), which is being
+> validated in [#326](https://github.com/fstamatelopoulos/cerefox/issues/326). Background and plan: [`chatgpt-after-custom-gpts.md`](../research/chatgpt-after-custom-gpts.md).
+> For **Codex**, use the local MCP instead (see [ChatGPT Desktop and Codex](#chatgpt-desktop-and-codex)).
+
 A Custom GPT with Actions pointing at the Edge Functions gives ChatGPT full hybrid search from
 any browser — no local install, no MCP client, works free with ChatGPT Plus.
 
@@ -1084,15 +1107,16 @@ paths:
 In the action's **Authentication** settings:
 - Type: **API Key**
 - Auth type: **Bearer**
-- API key: your **Cerefox access token** (`cfx_pat_…`). Generate it with
-  `cerefox token generate` (it prints the token once and sets it on Supabase).
+- API key: your **Cerefox access token** (`cfx_pat_…`). If you already have one
+  (`cerefox token list` shows it; the value is `CEREFOX_ACCESS_TOKEN` in your `.env`),
+  reuse it. Only on a first setup run `cerefox token generate`: it **replaces** the
+  server's token, which breaks every client still using the old one. To add a second
+  token alongside the first, use `cerefox token rotate`.
   The legacy Supabase anon key is no longer accepted (iter-28E).
 
-> **Important:** ChatGPT resets the stored API key when you update the action
-> schema. This release bumps the schema `info.version`, so on your next schema
-> paste ChatGPT will clear the key — re-enter your **Cerefox access token** in the
-> authentication settings. (That reset is expected here: it's what swaps you off
-> the old anon key.)
+> **Important:** ChatGPT clears the stored API key whenever you save a changed action
+> schema. After pasting a new schema version, re-enter your **Cerefox access token** in
+> the authentication settings.
 
 **Step 4 — Save and test**
 

package/docs/guides/quickstart.md

@@ -83,7 +83,8 @@ in place, so re-run it after upgrading. Detailed walkthrough:
 ## 3b. Generate the Edge Function access token
 
 The Edge Functions authenticate callers with a **Cerefox access token**. You need it
-if you'll connect a **Custom GPT** (GPT Actions) or a **remote HTTP MCP** client, and
+if you'll connect a **Custom GPT** (GPT Actions, until OpenAI retires Custom GPTs on
+December 11, 2026) or a **remote HTTP MCP** client, and
 for a fully-green `cerefox doctor`. The **local MCP** (local agents), **cloud Claude**
 (OAuth), and the CLI/web reach Supabase over the Data API and don't use it — so this
 step is optional if that's your whole setup, but it's quick and harmless to run:
@@ -147,8 +148,11 @@ clone the repo, run `bun install`, and use the contributor scripts
 - **Search from the CLI**: `cerefox search "your query"`
 - **Discover all commands**: `cerefox --help`
 - **Run the web UI**: `cerefox web` (TypeScript — Hono backend + React SPA); see [`cli.md`](cli.md)
-- **Connect more AI clients** (Cursor, Codex, ChatGPT GPT Actions, etc.):
-  [`connect-agents.md`](connect-agents.md)
+- **Connect more AI clients** (Cursor, Codex, Gemini, cloud Claude, etc.):
+  [`connect-agents.md`](connect-agents.md). Codex works with the local MCP
+  (`cerefox configure-agent --tool codex`). ChatGPT's Custom GPT path ends on
+  December 11, 2026; see
+  [`chatgpt-after-custom-gpts.md`](../research/chatgpt-after-custom-gpts.md)
 - **Configuration reference**: [`configuration.md`](configuration.md)
 - **Backup + restore**: [`ops-scripts.md`](ops-scripts.md)
 

package/docs/guides/setup-supabase.md

@@ -220,6 +220,11 @@ FTS-only `mcp.supabase.com` path). This needs a one-time OAuth setup — see
 [Step 7](#step-7--oauth-for-cloud-agents-claudeai--mobile-optional) below.
 
 **For cloud ChatGPT** — create a Custom GPT with GPT Actions pointing at the Edge Functions.
+This works until **December 11, 2026**, when OpenAI retires Custom GPTs (custom actions do
+not carry over to its plugins). ChatGPT's replacement connection, an MCP connector over
+OAuth like the cloud Claude one, is being validated in
+[#326](https://github.com/fstamatelopoulos/cerefox/issues/326). **For Codex**, use the local
+MCP: `cerefox configure-agent --tool codex`.
 
 See `docs/guides/connect-agents.md` for the complete guide including system prompts,
 architecture explanation, and ChatGPT GPT Actions setup.

package/docs/guides/upgrading.md

@@ -223,7 +223,8 @@ MCP path needs no reconfiguration; for the local stdio server, restart the
 client. `cerefox configure-agent --tool <client>` (re)writes a client's config
 if you need it.
 
-**ChatGPT Custom GPT (GPT Actions):** after an upgrade, check the OpenAPI schema
+**ChatGPT Custom GPT (GPT Actions, until December 11, 2026, when OpenAI retires
+Custom GPTs):** after an upgrade, check the OpenAPI schema
 version in [`connect-agents.md`](connect-agents.md); if it changed, paste the new
 schema into the Custom GPT editor and **re-enter your Cerefox access token**
 (`cfx_pat_…`, from `cerefox token generate`) as the Bearer token. (The editor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cerefox/memory",
-  "version": "1.17.3",
+  "version": "1.18.0",
   "description": "Cerefox \u2014 user-owned shared memory for AI agents. CLI + stdio MCP server + web UI + ingestion for a knowledge base on your own Supabase project (or fully self-hosted with Cerefox Local).",
   "license": "Apache-2.0",
   "homepage": "https://github.com/fstamatelopoulos/cerefox",
@@ -40,7 +40,7 @@
   ],
   "dependencies": {
     "@hono/node-server": "^2.1.1",
-    "@modelcontextprotocol/sdk": "^1.30.1",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@supabase/supabase-js": "^2.117.2",
     "cli-progress": "^3.12.0",
     "commander": "^15.0.0",