@dcyfr/ai 1.0.3 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,111 @@
 # Changelog
 
+## 2.1.0
+
+### Minor Changes
+
+- [`7660a35`](https://github.com/dcyfr/dcyfr-ai/commit/7660a35224e577cd61ec002949ea0328c5d67891) Thanks [@dcyfr](https://github.com/dcyfr)! - Delegation framework improvements
+
+  - Fixed 584 TypeScript errors to 0 across the workspace
+  - Added SQLite-based delegation contract persistence with better-sqlite3
+  - Implemented delegation telemetry module for monitoring agent performance
+  - Enhanced capability registry with bulk operations and improved search
+  - Achieved 75.3% delegation test pass rate (332/441 tests passing)
+  - Added comprehensive delegation documentation and examples
+
+  This represents a major stability and functionality improvement to the delegation framework.
+
+- [`45e3e87`](https://github.com/dcyfr/dcyfr-ai/commit/45e3e87320ac85d21320c01ed2b7d1d8d2e0b2dd) Thanks [@dcyfr](https://github.com/dcyfr)! - Ralph Loop V2: prompt rewriting, pattern learning, and token budget management
+
+  - Added `DelegationManager.rewritePrompt()` with four failure-aware strategies: `wrong_direction`, `missing_context`, `wrong_format`, and `stuck_on_complexity` — each queries the memory layer for relevant context before rewriting
+  - Added `DelegationManager.runWithRetry()` for automatic retry with exponential backoff, rewriting on each attempt; emits structured `RetryResult` with per-attempt logs and Telegram escalation on persistent failure
+  - Added `DelegationManager.learnPattern()` and `queryHighConfidencePattern()` for persistent prompt pattern storage; high-confidence patterns (5+ successes) are applied as shortcuts before full rewrite
+  - Added token budget management: `estimateTokens()`, `TokenBudgetInfo` interface, automatic trimming to 80% of the model context window, and verbatim preservation of the 3 most recent injected blocks
+  - Exported `TokenBudgetInfo`, `PromptPattern`, `PatternLearningOptions`, `RetryOptions`, `RetryAttempt`, `RetryResult`, `RewriteTask`, `RewriteResult`, `FailureAnalysis` from `@dcyfr/ai`
+  - 111 new tests across 5 test files covering all new delegation manager capabilities
+
+### Patch Changes
+
+- [`486b11b`](https://github.com/dcyfr/dcyfr-ai/commit/486b11bee8c4abb88f9eacc2bd16daa72e15c437) Thanks [@dcyfr](https://github.com/dcyfr)! - # Security Update
+
+  Upgrade @qdrant/js-client-rest from 1.13.0 to 1.16.2 to fix 3 moderate-severity undici vulnerabilities:
+
+  - GHSA-g9mf-h72j-4rw9 (unbounded decompression in HTTP responses)
+  - GHSA-cxrh-j4jr-qwg3 (DoS via bad certificate data)
+
+  This is a minor version bump with no breaking API changes.
+
+- [`29cd73f`](https://github.com/dcyfr/dcyfr-ai/commit/29cd73fccd4771f52367667bb117bd47f78293d7) Thanks [@dcyfr](https://github.com/dcyfr)! - security: upgrade fastmcp 3.30.1→3.33.0 and downgrade mem0ai 2.2.2→1.0.39 to fix axios vulnerabilities
+
+  Fixed 3 high-severity axios vulnerabilities (GHSA-jr5f-v2jv-69x6 SSRF, GHSA-4hjh-wcwx-xvwj DoS, GHSA-43fc-jf86-j433 DoS) by downgrading mem0ai which had pinned axios@1.7.7. Also upgraded fastmcp to latest version (3.33.0) to improve MCP server performance.
+
+  Security improvements:
+
+  - Removed axios@1.7.7 (vulnerable) from mem0ai dependency tree
+  - All axios instances now at 1.13.5+ (safe versions)
+  - Workspace vulnerability count reduced from 22 → 18
+  - High-severity vulnerabilities reduced from 7 → 5
+
+  Breaking changes:
+
+  - mem0ai downgraded from 2.2.2 → 1.0.39 (MAJOR version downgrade)
+  - Limited API compatibility risk due to custom abstraction layer in packages/ai/memory/mem0-client.ts
+  - All tests passing (921/921)
+
+## [1.0.4] - 2026-02-12
+
+### Added
+
+#### Version Compatibility Protection
+
+- **Version Skew Protection**: AgentRuntime now performs automatic version compatibility checking during initialization
+- **Version Mismatch Warnings**: Clear warning logs when @dcyfr/ai and @dcyfr/ai-agents versions may be incompatible
+- **Compatibility Rules**:
+  - Major versions must match (1.x.x with 1.x.x)
+  - Runtime can be newer minor version than agents
+  - Warnings for agents more than 2 minor versions ahead of runtime
+
+#### Upgrade Paths
+
+When upgrading from older versions, follow these compatibility guidelines:
+
+**Same Major Version (Recommended)**
+
+```bash
+# For @dcyfr/ai-agents v1.0.x projects
+npm install @dcyfr/ai@^1.0.4
+
+# Check compatibility
+npm list @dcyfr/ai @dcyfr/ai-agents
+```
+
+**Version Mismatch Resolution**
+
+- If you see "Version Mismatch Warning" logs, upgrade both packages to latest:
+  ```bash
+  npm install @dcyfr/ai@latest @dcyfr/ai-agents@latest
+  ```
+- For major version differences, check migration guides in documentation
+
+**Enterprise Environments**
+
+- Pin exact versions in package-lock.json for consistent deployments
+- Test version combinations in staging before production deployment
+- Monitor AgentRuntime initialization logs for version warnings
+
+### Breaking Changes
+
+None. This release maintains full backward compatibility.
+
+### Migration Guide
+
+No migration required. Version checking is automatic and non-breaking.
+If you encounter version warnings:
+
+1. Update both @dcyfr/ai and @dcyfr/ai-agents to latest versions
+2. Test your agents with the new versions
+3. Update peer dependency constraints if needed
+
 ## 1.0.3
 
 ### Patch Changes

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Drew
+Copyright (c) 2025-2026 DCYFR Labs (https://www.dcyfr.ai)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,3 +19,29 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+---
+
+## Commercial Use
+
+This software is dual-licensed:
+
+- **MIT License** applies to personal, educational, and non-commercial use
+- **Commercial License** required for business and revenue-generating use
+
+### Commercial use includes:
+- Using @dcyfr/ai in a product or service that generates revenue
+- Deploying in a business environment (>5 employees)
+- Providing consulting/services using @dcyfr/ai for profit
+- Distributing as part of a commercial offering
+
+### To obtain a commercial license:
+- View tiers: https://github.com/dcyfr/workspace/blob/main/SPONSORSHIP.md
+- Contact: licensing@dcyfr.ai
+- GitHub Sponsors: https://github.com/sponsors/dcyfr
+
+For questions about whether your use requires a commercial license, contact licensing@dcyfr.ai.
+
+## Trademark
+
+"DCYFR" is a trademark of DCYFR Labs. See TRADEMARK.md for usage guidelines.