@legioncodeinc/honeycomb 0.1.0 → 0.1.4

package/harnesses/claude-code/hooks/hooks.json

@@ -1,86 +1,86 @@
-{
-  "description": "Honeycomb memory — captures session activity and renders prior context via the local Honeycomb daemon (PRD-021c reference harness)",
-  "hooks": {
-    "SessionStart": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 10
-          }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 10,
-            "async": true
-          }
-        ]
-      }
-    ],
-    "PreToolUse": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 60
-          }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 15,
-            "async": true
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 30,
-            "async": true
-          }
-        ]
-      }
-    ],
-    "SubagentStop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 30,
-            "async": true
-          }
-        ]
-      }
-    ],
-    "SessionEnd": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
-            "timeout": 60
-          }
-        ]
-      }
-    ]
-  }
-}
+{
+  "description": "Honeycomb memory — captures session activity and renders prior context via the local Honeycomb daemon (PRD-021c reference harness)",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 10,
+            "async": true
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 60
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 15,
+            "async": true
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 30,
+            "async": true
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 30,
+            "async": true
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bundle/index.js\"",
+            "timeout": 60
+          }
+        ]
+      }
+    ]
+  }
+}

package/harnesses/codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeycomb-codex",
-  "version": "0.1.0",
+  "version": "0.1.4",
   "description": "Honeycomb — persistent shared memory for OpenAI Codex CLI via the local Honeycomb daemon",
   "type": "module",
   "license": "MIT"

package/harnesses/openclaw/dist/index.js

@@ -3,7 +3,7 @@ globalThis.__honeycomb_tuning__ ??= {};
 // src/shared/constants.ts
 var DAEMON_PORT = 3850;
 var DAEMON_HOST = "127.0.0.1";
-var HONEYCOMB_VERSION = true ? "0.1.0" : "0.0.0-dev";
+var HONEYCOMB_VERSION = true ? "0.1.4" : "0.0.0-dev";
 
 // src/daemon-client/index.ts
 function createDaemonClient(endpoint) {

package/harnesses/openclaw/openclaw.plugin.json

@@ -43,5 +43,5 @@
       }
     }
   },
-  "version": "0.1.0"
+  "version": "0.1.4"
 }

package/harnesses/openclaw/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeycomb-openclaw",
-  "version": "0.1.0",
+  "version": "0.1.4",
   "type": "module",
   "description": "Honeycomb — persistent shared memory for AI agents, OpenClaw harness",
   "license": "MIT",

package/mcp/bundle/server.js

@@ -6892,7 +6892,7 @@ var require_dist = __commonJS({
 // dist/src/shared/constants.js
 var DAEMON_PORT = 3850;
 var DAEMON_HOST = "127.0.0.1";
-var HONEYCOMB_VERSION = true ? "0.1.0" : "0.0.0-dev";
+var HONEYCOMB_VERSION = true ? "0.1.4" : "0.0.0-dev";
 
 // dist/src/daemon-client/index.js
 function createDaemonClient(endpoint) {

package/package.json

@@ -1,137 +1,141 @@
-{
-  "name": "@legioncodeinc/honeycomb",
-  "version": "0.1.0",
-  "//go-public": "Go-public switches are flipped: scoped name, public+provenance publishConfig live, `private` removed. CI auth is npm Trusted Publishing (OIDC); there is NO NPM_TOKEN. The go-live procedure is RELEASING.md 'Cut the release': the first publish is a one-time manual 2FA bootstrap that creates the package, after which every CI publish from release.yaml is tokenless OIDC.",
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  },
-  "description": "Honeycomb monorepo foundation: a long-lived daemon plus thin clients for six coding harnesses, the unified honeycomb CLI, the MCP server, and the embed daemon.",
-  "license": "AGPL-3.0-or-later",
-  "type": "module",
-  "//build-order": "Fixed dependency direction enforced by import direction under one tsc pass: (1) core = src/shared + src/daemon-client, (2) connector-base = src/daemon, (3) plugins/native = embeddings, (4) connectors = harnesses/* + mcp + src/cli, (5) assembled distribution = esbuild per-target bundles (PRD-001b). tsc compiles the whole graph in one pass; dependents never import upward, so the single tsc invocation respects this order. PRD-001b appends '&& node esbuild.config.mjs' to the build script; that seam is intentional.",
-  "bin": {
-    "honeycomb": "bundle/cli.js"
-  },
-  "//exports": "PRD-019e: @legioncodeinc/honeycomb subpath exports. The core entry (.) is the fetch-only, browser-safe HoneycombClient (`@legioncodeinc/honeycomb`); the three framework helpers ship as separate entry points (`@legioncodeinc/honeycomb/react`, `/vercel`, `/openai`) reusing the core's token/actor model. react + ai are peerDependencies (never bundled into core).",
-  "exports": {
-    ".": "./sdk/index.js",
-    "./react": "./sdk/react.js",
-    "./vercel": "./sdk/vercel.js",
-    "./openai": "./sdk/openai.js"
-  },
-  "files": [
-    "bundle",
-    "sdk",
-    "daemon",
-    "assets/styles.css",
-    "assets/tokens",
-    "assets/logos/honeycomb-memory-cluster.svg",
-    "assets/logos/fonts",
-    "harnesses/claude-code/bundle",
-    "harnesses/claude-code/.claude-plugin",
-    "harnesses/claude-code/hooks",
-    "harnesses/codex/bundle",
-    "harnesses/codex/package.json",
-    "harnesses/cursor/bundle",
-    "harnesses/hermes/bundle",
-    "harnesses/pi/bundle",
-    "harnesses/openclaw/dist",
-    "harnesses/openclaw/openclaw.plugin.json",
-    "harnesses/openclaw/package.json",
-    "mcp/bundle",
-    "embeddings/embed-daemon.js",
-    ".claude-plugin",
-    "scripts/ensure-tree-sitter.mjs",
-    "scripts/ensure-embed-deps.mjs",
-    "README.md"
-  ],
-  "scripts": {
-    "prebuild": "node scripts/sync-versions.mjs",
-    "version": "node scripts/sync-versions.mjs && git add .claude-plugin/plugin.json harnesses/claude-code/.claude-plugin/plugin.json harnesses/openclaw/openclaw.plugin.json harnesses/openclaw/package.json harnesses/codex/package.json .claude-plugin/marketplace.json",
-    "build": "tsc && node esbuild.config.mjs",
-    "bundle": "node esbuild.config.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check .",
-    "format": "biome format --write .",
-    "dup": "jscpd src harnesses mcp embeddings",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:integration": "vitest run --config vitest.integration.config.ts",
-    "smoke:golden-path": "node scripts/golden-path-smoke.mjs",
-    "smoke:login": "node scripts/login-smoke.mjs",
-    "smoke:data-api": "node scripts/dogfood-acceptance-smoke.mjs",
-    "eval:recall": "node scripts/eval-recall.mjs",
-    "eval:prime": "node scripts/eval-prime.mjs",
-    "bench:hybrid": "node scripts/bench-hybrid.mjs",
-    "deeplake:stress": "node scripts/deeplake-stress.mjs",
-    "audit:openclaw": "node scripts/audit-openclaw-bundle.mjs",
-    "audit:sql": "node scripts/audit-sql-safety.mjs",
-    "mutation": "npm run mutation:sql && npm run mutation:prune && npm run mutation:normalize && npm run mutation:state",
-    "mutation:sql": "stryker run stryker/sql.json",
-    "mutation:prune": "stryker run stryker/prune.json",
-    "mutation:normalize": "stryker run stryker/normalize.json",
-    "mutation:state": "stryker run stryker/state.json",
-    "pack:check": "node scripts/pack-check.mjs",
-    "rebuild:native": "node scripts/ensure-tree-sitter.mjs",
-    "ensure:embed-deps": "node scripts/ensure-embed-deps.mjs",
-    "ci": "npm run typecheck && npm run dup && npm run test && npm run audit:sql",
-    "postinstall": "node scripts/ensure-tree-sitter.mjs && node scripts/ensure-embed-deps.mjs",
-    "prepack": "npm run build",
-    "smoke:daemon-bundle": "node scripts/smoke-daemon-bundle.mjs"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^2.5.0",
-    "@stryker-mutator/core": "^8.7.1",
-    "@stryker-mutator/vitest-runner": "^8.7.1",
-    "@types/node": "^22.0.0",
-    "@types/react": "^18.3.31",
-    "@types/react-dom": "^18.3.7",
-    "@vitest/coverage-v8": "^3.2.6",
-    "esbuild": "^0.28.1",
-    "fast-check": "^4.8.0",
-    "jscpd": "^4.0.5",
-    "jsdom": "^25.0.1",
-    "react": "18.3.1",
-    "react-dom": "18.3.1",
-    "typescript": "^5.7.0",
-    "vitest": "^3.2.6"
-  },
-  "engines": {
-    "node": ">=22.5.0"
-  },
-  "//peerDependencies": "PRD-019e: react powers @legioncodeinc/honeycomb/react; ai powers @legioncodeinc/honeycomb/vercel. Both are OPTIONAL peers (peerDependenciesMeta) so the core entry stays dependency-free for Node/Bun/browser. The core client (.) pulls in NEITHER.",
-  "peerDependencies": {
-    "ai": ">=3.0.0",
-    "react": ">=18.0.0"
-  },
-  "peerDependenciesMeta": {
-    "react": {
-      "optional": true
-    },
-    "ai": {
-      "optional": true
-    }
-  },
-  "dependencies": {
-    "@hono/node-server": "^1.19.14",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@noble/ciphers": "^2.2.0",
-    "hono": "^4.12.25",
-    "tree-sitter-wasms": "^0.1.13",
-    "web-tree-sitter": "^0.22.6",
-    "yaml": "^2.9.0",
-    "zod": "^4.4.3"
-  },
-  "//optionalDependencies": "PRD-025 D-2: the embedding RUNTIME (@huggingface/transformers + its ONNX native runtime, ~600 MB with the nomic-embed-text-v1.5 model acquired at first-run) ships as an OPTIONAL dependency, NOT in the `files` allowlist. This keeps the published @legioncodeinc/honeycomb tarball LEAN (the model is downloaded + cached on the daemon's first warmup, not packed — AC-7) and keeps `npm i` fast for everyone; a `--no-optional` / slimmed / offline install simply runs recall on the BM25/ILIKE lexical fallback (no quality cliff — D-4). The embed daemon dynamic-imports this only at warmup, so the bundle + CI never require it.",
-  "optionalDependencies": {
-    "@huggingface/transformers": "^3.8.1"
-  },
-  "//overrides": "Dependabot transitive-devDependency remediation. All are DEV-only and never ship (the `files` allowlist packs built bundles, not node_modules), so consumer risk is nil — these clear the dev/CI tree. tmp ^0.2.6 fixes GHSA-ph9p-34f9-6g65 (HIGH path traversal) + GHSA-52f5-9888-hmc6 (symlink write), reached only via @stryker-mutator/core -> @inquirer/prompts -> external-editor -> tmp (which calls only tmpNameSync, stable across the 0.0.33->0.2.x major). esbuild ^0.28.1 fixes GHSA-g7r4-m6w7-qqqr (Windows dev-server file read) in vitest's nested copy; the direct dep is already 0.28.1. @babel/core ^7.29.6 fixes GHSA-4x5r-pxfx-6jf8 (sourceMappingURL file read) under @stryker-mutator/instrumenter. ajv ^8.20.0 fixes GHSA-2g4f-4pwh-qvx6 ($data ReDoS) under @stryker-mutator/core's schema validator — a same-major bump (8.17.1 -> 8.20.x), preferred over npm audit's suggested breaking @stryker-mutator/core 9.x major. Validated by npm run mutation (exercises tmp+babel+ajv schema load) + npm run ci/build (exercises esbuild).",
-  "overrides": {
-    "tmp": "^0.2.6",
-    "esbuild": "^0.28.1",
-    "@babel/core": "^7.29.6",
-    "ajv": "^8.20.0"
-  }
-}
+{
+  "name": "@legioncodeinc/honeycomb",
+  "version": "0.1.4",
+  "//go-public": "Go-public switches are flipped: scoped name, public+provenance publishConfig live, `private` removed. CI auth is npm Trusted Publishing (OIDC); there is NO NPM_TOKEN. The go-live procedure is RELEASING.md 'Cut the release': the first publish is a one-time manual 2FA bootstrap that creates the package, after which every CI publish from release.yaml is tokenless OIDC.",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "description": "Honeycomb monorepo foundation: a long-lived daemon plus thin clients for six coding harnesses, the unified honeycomb CLI, the MCP server, and the embed daemon.",
+  "license": "AGPL-3.0-or-later",
+  "type": "module",
+  "//build-order": "Fixed dependency direction enforced by import direction under one tsc pass: (1) core = src/shared + src/daemon-client, (2) connector-base = src/daemon, (3) plugins/native = embeddings, (4) connectors = harnesses/* + mcp + src/cli, (5) assembled distribution = esbuild per-target bundles (PRD-001b). tsc compiles the whole graph in one pass; dependents never import upward, so the single tsc invocation respects this order. PRD-001b appends '&& node esbuild.config.mjs' to the build script; that seam is intentional.",
+  "bin": {
+    "honeycomb": "bundle/cli.js"
+  },
+  "//exports": "PRD-019e: @legioncodeinc/honeycomb subpath exports. The core entry (.) is the fetch-only, browser-safe HoneycombClient (`@legioncodeinc/honeycomb`); the three framework helpers ship as separate entry points (`@legioncodeinc/honeycomb/react`, `/vercel`, `/openai`) reusing the core's token/actor model. react + ai are peerDependencies (never bundled into core).",
+  "exports": {
+    ".": "./sdk/index.js",
+    "./react": "./sdk/react.js",
+    "./vercel": "./sdk/vercel.js",
+    "./openai": "./sdk/openai.js"
+  },
+  "files": [
+    "bundle",
+    "sdk",
+    "daemon",
+    "assets/styles.css",
+    "assets/tokens",
+    "assets/logos/honeycomb-memory-cluster.svg",
+    "assets/logos/fonts",
+    "harnesses/claude-code/bundle",
+    "harnesses/claude-code/.claude-plugin",
+    "harnesses/claude-code/hooks",
+    "harnesses/codex/bundle",
+    "harnesses/codex/package.json",
+    "harnesses/cursor/bundle",
+    "harnesses/hermes/bundle",
+    "harnesses/pi/bundle",
+    "harnesses/openclaw/dist",
+    "harnesses/openclaw/openclaw.plugin.json",
+    "harnesses/openclaw/package.json",
+    "mcp/bundle",
+    "embeddings/embed-daemon.js",
+    ".claude-plugin",
+    "scripts/ensure-tree-sitter.mjs",
+    "scripts/ensure-embed-deps.mjs",
+    "README.md"
+  ],
+  "scripts": {
+    "prebuild": "node scripts/sync-versions.mjs",
+    "version": "node scripts/sync-versions.mjs && git add .claude-plugin/plugin.json harnesses/claude-code/.claude-plugin/plugin.json harnesses/openclaw/openclaw.plugin.json harnesses/openclaw/package.json harnesses/codex/package.json .claude-plugin/marketplace.json",
+    "build": "tsc && node esbuild.config.mjs",
+    "bundle": "node esbuild.config.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "dup": "jscpd src harnesses mcp embeddings",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "smoke:golden-path": "node scripts/golden-path-smoke.mjs",
+    "smoke:login": "node scripts/login-smoke.mjs",
+    "smoke:data-api": "node scripts/dogfood-acceptance-smoke.mjs",
+    "eval:recall": "node scripts/eval-recall.mjs",
+    "eval:prime": "node scripts/eval-prime.mjs",
+    "bench:hybrid": "node scripts/bench-hybrid.mjs",
+    "deeplake:stress": "node scripts/deeplake-stress.mjs",
+    "audit:openclaw": "node scripts/audit-openclaw-bundle.mjs",
+    "audit:sql": "node scripts/audit-sql-safety.mjs",
+    "mutation": "npm run mutation:sql && npm run mutation:prune && npm run mutation:normalize && npm run mutation:state",
+    "mutation:sql": "stryker run stryker/sql.json",
+    "mutation:prune": "stryker run stryker/prune.json",
+    "mutation:normalize": "stryker run stryker/normalize.json",
+    "mutation:state": "stryker run stryker/state.json",
+    "pack:check": "node scripts/pack-check.mjs",
+    "rebuild:native": "node scripts/ensure-tree-sitter.mjs",
+    "ensure:embed-deps": "node scripts/ensure-embed-deps.mjs",
+    "ci": "npm run typecheck && npm run dup && npm run test && npm run audit:sql",
+    "postinstall": "node scripts/ensure-tree-sitter.mjs && node scripts/ensure-embed-deps.mjs",
+    "prepack": "npm run build",
+    "smoke:daemon-bundle": "node scripts/smoke-daemon-bundle.mjs"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.0",
+    "@stryker-mutator/core": "^8.7.1",
+    "@stryker-mutator/vitest-runner": "^8.7.1",
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
+    "@vitest/coverage-v8": "^3.2.6",
+    "esbuild": "^0.28.1",
+    "fast-check": "^4.8.0",
+    "jscpd": "^4.0.5",
+    "jsdom": "^25.0.1",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.6"
+  },
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "//peerDependencies": "PRD-019e: react powers @legioncodeinc/honeycomb/react; ai powers @legioncodeinc/honeycomb/vercel. Both are OPTIONAL peers (peerDependenciesMeta) so the core entry stays dependency-free for Node/Bun/browser. The core client (.) pulls in NEITHER.",
+  "peerDependencies": {
+    "ai": ">=3.0.0",
+    "react": ">=18.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "ai": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@hono/node-server": "^1.19.14",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@noble/ciphers": "^2.2.0",
+    "hono": "^4.12.25",
+    "tree-sitter-wasms": "^0.1.13",
+    "web-tree-sitter": "^0.22.6",
+    "yaml": "^2.9.0",
+    "zod": "^4.4.3"
+  },
+  "//optionalDependencies": "PRD-025 D-2: the embedding RUNTIME (@huggingface/transformers + its ONNX native runtime, ~600 MB with the nomic-embed-text-v1.5 model acquired at first-run) ships as an OPTIONAL dependency, NOT in the `files` allowlist. This keeps the published @legioncodeinc/honeycomb tarball LEAN (the model is downloaded + cached on the daemon's first warmup, not packed — AC-7) and keeps `npm i` fast for everyone; a `--no-optional` / slimmed / offline install simply runs recall on the BM25/ILIKE lexical fallback (no quality cliff — D-4). The embed daemon dynamic-imports this only at warmup, so the bundle + CI never require it.",
+  "optionalDependencies": {
+    "@huggingface/transformers": "^3.8.1"
+  },
+  "//overrides": "Dependabot transitive-devDependency remediation. All are DEV-only and never ship (the `files` allowlist packs built bundles, not node_modules), so consumer risk is nil — these clear the dev/CI tree. tmp ^0.2.6 fixes GHSA-ph9p-34f9-6g65 (HIGH path traversal) + GHSA-52f5-9888-hmc6 (symlink write), reached only via @stryker-mutator/core -> @inquirer/prompts -> external-editor -> tmp (which calls only tmpNameSync, stable across the 0.0.33->0.2.x major). esbuild ^0.28.1 fixes GHSA-g7r4-m6w7-qqqr (Windows dev-server file read) in vitest's nested copy; the direct dep is already 0.28.1. @babel/core ^7.29.6 fixes GHSA-4x5r-pxfx-6jf8 (sourceMappingURL file read) under @stryker-mutator/instrumenter. ajv ^8.20.0 fixes GHSA-2g4f-4pwh-qvx6 ($data ReDoS) under @stryker-mutator/core's schema validator — a same-major bump (8.17.1 -> 8.20.x), preferred over npm audit's suggested breaking @stryker-mutator/core 9.x major. Validated by npm run mutation (exercises tmp+babel+ajv schema load) + npm run ci/build (exercises esbuild).",
+  "overrides": {
+    "tmp": "^0.2.6",
+    "esbuild": "^0.28.1",
+    "@babel/core": "^7.29.6",
+    "ajv": "^8.20.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/legioncodeinc/honeycomb.git"
+  }
+}