@lotargo/memory_plugin 1.5.3 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,352 +1,383 @@
1
- <div align="center">
2
-
3
- <img src="./assets/hero.jpg" alt="@lotargo/memory_plugin" width="800" style="max-width: 100%; border-radius: 12px; margin-bottom: 16px;">
4
-
5
- <br>
6
-
7
- <img src="./assets/title.svg" alt="@lotargo/memory_plugin" width="520" style="max-width: 100%; margin-bottom: 12px;">
8
-
9
- <br>
10
-
11
- [![npm version](https://img.shields.io/npm/v/@lotargo/memory_plugin)](https://www.npmjs.com/package/@lotargo/memory_plugin)
12
- [![npm downloads](https://img.shields.io/npm/dt/@lotargo/memory_plugin)](https://www.npmjs.com/package/@lotargo/memory_plugin)
13
- [![license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
14
- [![node version](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen)](https://nodejs.org)
15
- [![mcp](https://img.shields.io/badge/MCP-Supported-8A2BE2)](https://modelcontextprotocol.io)
16
- [![storage](https://img.shields.io/badge/Storage-Local%20%2B%20Cloud%20Sync-success)](#storage--privacy)
17
-
18
- <br>
19
-
20
- **Zero-Docker Local Hybrid RAG Engine & Long-Term Memory for AI Coding Agents**
21
-
22
- Automatically remembers durable user facts, ingests complex document repositories, and performs high-precision hybrid retrieval across sessions, platforms, and devices.
23
-
24
- </div>
25
-
26
- ---
27
-
28
- ## Overview
29
-
30
- Standard AI coding assistants lose context as soon as a chat session closes or a conversation is reset. You end up repeatedly re-explaining your preferences, architectural decisions, coding style, or project conventions.
31
-
32
- `@lotargo/memory_plugin` gives your AI tools durable, **persistent**, local-first long-term memory and document retrieval capabilities that persist across restarts and work seamlessly across all supported coding environments. Any LLM-based coding agent (OpenCode, Claude Code, Codex, Antigravity / Gemini CLI) can query its own memory and hybrid knowledge base via the **Model Context Protocol (MCP)**.
33
-
34
- > **Project Scope & Runtime Notes**:
35
- > `@lotargo/memory_plugin` is designed primarily as a practical plugin to expand capabilities and streamline daily interaction with AI coding tools. Benchmark scores in this repository represent internal synthetic evaluation runs and are not intended as generalized RAG benchmarks.
36
- >
37
- > **Hardware Acceleration**: GPU execution mode is an experimental feature and may vary in stability across different operating systems or models. For optimal stability and consistent runtime performance, using standard CPU mode with `multilingual-e5-small` or `multilingual-e5-base` is recommended.
38
-
39
- ### Practical Use Cases
40
-
41
- - **Architectural Decisions**: _"In this project, we use Fastify instead of Express and strict schema validation via Zod."_
42
- - **Coding Conventions**: _"Place all helper utilities inside `src/utils/` and cover new functions with Vitest tests."_
43
- - **Environment Constraints**: _"Our target deployment environment is Node.js 20 on AWS Lambda."_
44
- - **User Profile & Tone**: _"My name is Alex. I prefer concise, direct answers without conversational filler."_
45
-
46
- ---
47
-
48
- ## Quick Start
49
-
50
- ### Minimum System Requirements
51
-
52
- - **Node.js**: `18.0.0` or higher
53
- - **Package Manager**: `npm` / `npx` (included with Node.js)
54
- - **Supported Environment**: OpenCode, Antigravity / Gemini CLI, Claude Code, Codex, or Google Jules
55
-
56
- ### Installation & Auto-Setup
57
-
58
- Run the setup command to configure all detected AI environments automatically:
59
-
60
- ```bash
61
- # Recommended: Global installation & auto-setup across all environments
62
- npm install -g @lotargo/memory_plugin && memory_plugin setup
63
-
64
- # Or via npx
65
- npx @lotargo/memory_plugin setup
66
- ```
67
-
68
- To target a specific environment:
69
-
70
- ```bash
71
- # Antigravity / Gemini CLI
72
- memory_plugin setup --antigravity
73
-
74
- # OpenCode
75
- memory_plugin setup --opencode
76
-
77
- # Claude Code
78
- memory_plugin setup --claude
79
-
80
- # Codex
81
- memory_plugin setup --codex
82
- ```
83
-
84
- `setup` also accepts `--gemini` (alias for Antigravity) and `--local` (registers the MCP server in the project-local `.agents/` directory). Without a specific flag, all detected environments are configured.
85
-
86
- ### Headless & Cloud Setup (CI / Docker / Cloud Workspaces)
87
-
88
- For headless environments (e.g., Google Jules, VPS, CI/CD pipelines), configure auth and sync mode in a single non-interactive command:
89
-
90
- ```bash
91
- # Authenticate via Turso API token and set hybrid sync mode
92
- memory_plugin setup --api-key <TURSO_API_TOKEN> --mode hybrid-sync
93
-
94
- # Or set sync mode if already authorized
95
- memory_plugin setup --mode only-cloud
96
- ```
97
-
98
- ---
99
-
100
- ## Multi-Layer Architecture
101
-
102
- 1. **Layer 1: Notebook Store (Durable Facts)**
103
- - **Tools**: `remember`, `recall`, `get_fact`, `update_fact`, `forget`, `memory_info`
104
- - **Scope**: User preferences, identity, project conventions, system rules.
105
- - **Storage**: Human-readable Markdown format (`global` and per-project stores).
106
- - **Fact Schema**: Every fact is formatted as `**Title** — body` with inline metadata badges (`[id]`, `[ttl]`, `[keep]`, `[tags]`, `[supersedes]`, `[inject]`).
107
- - **Project Identity**: Project stores are bound to a **Git-based project identity** — the normalized remote URL (`git:github.com/owner/repo`) or `git:local:<repo basename>` — never to a directory path. Memories follow the repository across machines, OSes, and subdirectories. Legacy path/basename stores can be linked and merged via `link_project_memory`.
108
-
109
- 2. **Layer 2: RAG Knowledge Base (Technical Documents & Codebases)**
110
- - **Tools**: `ingest_document`, `query_knowledge_base`, `manage_knowledge_base`
111
- - **Capabilities**: Ingests raw text files, Markdown, HTML, Web URLs, office documents (PDF, DOCX, XLSX, CSV), and codebases.
112
- - **Engine Components**: 3-tier hierarchy chunking (Big / Medium / Small), SQLite FTS5 BM25 search, ONNX dense vector embeddings (`multilingual-e5-small`), Reciprocal Rank Fusion (RRF / RSF), cross-encoder reranking (optional), and GraphRAG Lite code symbol extraction.
113
-
114
- 3. **Layer 3: Agent-Driven Knowledge Graph**
115
- - **Tools**: `link_knowledge` (plus `docId`, `startLine`, `endLine` in `remember`)
116
- - **Capabilities**: Connects Layer 1 notebook facts directly to Layer 2 documents, sections, or exact line ranges with semantic edge relations (`RULES_FOR`, `IMPLEMENTS`, `EXPLAINS`, `REFERENCES`).
117
- - **Surfacing**: Linked facts automatically highlight target documents and line ranges in `recall` output (`🔗 [Linked Docs: ...]`).
118
-
119
- ---
120
-
121
- ## Cloud Synchronization & Database Modes (Turso / LibSQL)
122
-
123
- The plugin provides local-first SQLite persistence with optional cloud database synchronization powered by Turso (LibSQL):
124
-
125
- ### 3 Storage Sync Modes
126
-
127
- | Mode | Command / Flag | Description |
128
- | :--- | :------------- | :---------- |
129
- | **`only-local`** (default) | `--mode only-local` | 100% local SQLite database. No external network traffic for data storage. |
130
- | **`only-cloud`** | `--mode only-cloud` | Direct LibSQL connection to a remote Turso database instance. |
131
- | **`hybrid-sync`** | `--mode hybrid-sync` | Local SQLite performance with background asynchronous synchronization to Turso Cloud, featuring automatic reverse-sync and conflict resolution. |
132
-
133
- ### Cloud Failover & Circuit Breaker
134
-
135
- When operating in cloud modes (`only-cloud` or `hybrid-sync`), the database engine incorporates a built-in **Circuit Breaker**:
136
- - If the primary cloud database endpoint is unreachable or encounters network failure, queries seamlessly fail over to the local database cache.
137
- - Prevents agent blocking or crash loops during internet outages or cloud service degradation.
138
-
139
- ### Secure Credential Storage
140
-
141
- Cloud authentication tokens and secrets are stored securely using platform-native hardware-bound encryption (Windows DPAPI / OS Secret Store), preventing token exposure in plain-text configuration files.
142
-
143
- ---
144
-
145
- ## Available MCP Tools
146
-
147
- The plugin registers **15 MCP tools** accessible across all connected AI environments:
148
-
149
- ### 1. Memory Notebook Tools (Layer 1)
150
-
151
- | Tool | Scope / Target | Key Parameters | Description |
152
- | :--- | :------------- | :------------- | :---------- |
153
- | `remember` | `project` / `global` | `fact`, `title`, `scope`, `docId`, `startLine`, `endLine`, `relationType`, `ttl`, `keep`, `tags`, `supersedes` | Save a durable fact or preference. Supports optional title, document linking, TTL, keep protection, tags, and version superseding. |
154
- | `recall` | `all`, `project`, `global`, `list_projects` | `scope`, `project`, `query`, `tags`, `since`, `until`, `mode`, `offset`, `limit` | Display saved facts with metadata badges and linked docs. Supports cross-project lookup via `project: '<path>'` and header-only mode (`mode: "headers"`). |
155
- | `get_fact` | `all`, `project`, `global` | `id`, `scope` | Retrieve full text, raw line, and metadata of a single fact by its metadata ID (e.g. `"8f3a2c"`). |
156
- | `update_fact` | `project` / `global` | `id`, `newText`, `scope` | Rewrite a fact while preserving its original creation date, metadata, and knowledge links. |
157
- | `forget` | `project` / `global` | `id` / `range` / `query`, `scope`, `force` | Remove a fact by index number, ID, range (e.g. `"3-30"`), or query. Requires `force: true` for protected (`[KEEP]`) facts. |
158
- | `memory_info` | - | - | Show storage paths, fact counts, RAG statistics, git identity bindings, and package version. |
159
-
160
- ### 2. Project Identity Tools
161
-
162
- | Tool | Key Parameters | Description |
163
- | :--- | :------------- | :---------- |
164
- | `link_project_memory` | `directory`, `remote` | Link a directory path to a Git-based project identity key, register aliases, and migrate legacy path/basename stores with deduplication. |
165
- | `unlink_project_memory` | `directory`, `purge` | Remove a path alias binding for a directory. Optionally purge the project identity entry if `purge: true`. |
166
- | `relink_project_memory` | `directory`, `remote` | Switch a project's primary identity to a new remote URL and merge all stored facts into the target store with fact-text deduplication. |
167
-
168
- ### 3. RAG Knowledge Base & Graph Tools (Layers 2 & 3)
169
-
170
- | Tool | Key Parameters | Description |
171
- | :--- | :------------- | :---------- |
172
- | `ingest_document` | `content`, `type`, `title`, `path`, `generateEmbeddings` | Ingest local files, URLs, or raw text into the 3-tier index (Big/Medium/Small) with ONNX vector embeddings and GraphRAG symbol extraction. |
173
- | `query_knowledge_base` | `query`, `limit`, `instruction`, `generateEmbeddings` | Perform hybrid search (RSF/RRF BM25 + dense vector similarity) to retrieve candidate document sections with defined code symbols. |
174
- | `manage_knowledge_base` | `action`, `docId`, `snapshotPath` | Inspect DB stats (`stats`), list documents (`list`), read full raw document (`read_document`), delete document (`delete`), or export/import snapshots (`export_snapshot` / `import_snapshot`). |
175
- | `link_knowledge` | `action`, `factText`, `docId`, `scope`, `startLine`, `endLine`, `relationType` | Create, list, or retrieve semantic graph links connecting Notebook facts to Knowledge Base documents, sections, or line ranges. Actions: `link`, `list_links`, `get_doc_links`. |
176
-
177
- ### 4. Agent & OpenCode Helpers
178
-
179
- | Tool | Key Parameters | Description |
180
- | :--- | :------------- | :---------- |
181
- | `list-mcp-tools` | - | Discover all connected MCP servers and their available tool definitions. |
182
- | `mcp-reminder` | `task` | Recommends the appropriate MCP tool or server for a specific developer task. |
183
-
184
- ---
185
-
186
- ## CLI Command Reference
187
-
188
- The plugin provides both direct non-interactive CLI commands and an interactive terminal UI (TUI):
189
-
190
- ```bash
191
- # Executable commands (available globally or via npx)
192
- memory_plugin <command> [options]
193
- # or
194
- memory-cli <command> [options]
195
- ```
196
-
197
- ### Direct Non-Interactive Commands
198
-
199
- | Command | Options / Flags | Description |
200
- | :------ | :-------------- | :---------- |
201
- | **`setup`** | `--antigravity`, `--opencode`, `--claude`, `--codex`, `--local`, `--api-key <TOKEN>`, `--mode <MODE>` | Configures MCP server registrations across detected environments and sets initial cloud auth/sync mode. |
202
- | **`link`** | `--dir <path>`, `--remote <url>` | Links a directory to a Git project identity or remote URL. |
203
- | **`unlink`** | `--dir <path>`, `--purge` | Unlinks a directory path alias. `--purge` removes the identity record. |
204
- | **`relink`** | `--remote <url>`, `--dir <path>` | Relinks project identity to a new remote URL and merges facts. |
205
- | **`identity`** | `--dir <path>` | Inspects Git project identity key, primary remote, name, and toplevel path for a directory. |
206
- | **`migrate_titles`** | `--key <key>` | Auto-generates `**Title**` prefixes for legacy facts without titles. |
207
- | **`enable-prompt`** | - | Injects memory agent instructions into client agent files (`AGENTS.md`, `CLAUDE.md`). |
208
- | **`disable-prompt`** | - | Removes memory agent instructions from client agent files. |
209
- | **`login`** | `--api-key <TOKEN>`, `--from-env`, `--db-url <URL> --db-token <TOKEN>` | Authenticates with Turso Cloud via API key, direct DB token, or environment variables. |
210
- | **`logout`** | `--api-key` | Signs out of Turso Cloud or removes stored API key while retaining DB session. |
211
- | **`auth-status`** | - | Displays authentication source, endpoint URL, username, organization, database, and sync mode. |
212
-
213
- ### Interactive TUI (CLI Menu)
214
-
215
- Launch the interactive terminal UI to manage engine settings, tune retrieval algorithms, inspect databases, and run diagnostics:
216
-
217
- ```bash
218
- memory_plugin cli
219
- # or
220
- memory-cli
221
- ```
222
-
223
- #### TUI Menu Navigation
224
-
225
- Use **Up / Down** arrows to navigate, **ENTER** to select, and **BACKSPACE** to go back.
226
-
227
- - **Engine & Hybrid Search Settings**: Switch fusion algorithms (`rsf`, `rrf`, `semantic_only`, `lexical_only`), adjust RSF $\alpha$ balance, select ONNX embedding models, toggle Cross-Encoder rerankers, configure GPU attention budget, and set WASM threads.
228
- - **Knowledge Base & Storage Management**: Browse Layer 1 facts, manage Layer 2 RAG docs, export/import JSON snapshots, purge model cache, or perform a hard reset.
229
- - **Global Prompt & Integration**: Toggle memory instruction sync across client configurations (`~/.gemini/config/AGENTS.md`, `~/.codex/AGENTS.md`, `~/.claude/CLAUDE.md`).
230
- - **Diagnostics & System Actions**: Run in-process search quality benchmarks, execute verification queries, clear corpus cache, and reset config to factory defaults.
231
-
232
- ---
233
-
234
- ## Agent Skill & System Prompt Integration
235
-
236
- ### Built-in Agent Skill (`using-memory`)
237
-
238
- The plugin bundles a pre-configured Agent Skill located at [`skills/using-memory/SKILL.md`](./skills/using-memory/SKILL.md). When installed in supported environments (such as Antigravity / Gemini CLI or OpenCode), coding agents automatically read this skill to:
239
- 1. **Initialize Sessions**: Automatically invoke `recall(scope: "all")` at the start of every chat turn to load all saved preferences and project rules.
240
- 2. **Proactively Save Context**: Automatically call `remember` whenever you share durable facts, tech stack choices, or coding guidelines.
241
- 3. **Architect Knowledge Graphs**: Use `link_knowledge` or `remember(docId, startLine, endLine)` to connect memories directly to technical documentation.
242
-
243
- ### Global System Prompt Synchronization
244
-
245
- Run `memory_plugin enable-prompt` to automatically inject memory agent guidance into your global LLM configuration files:
246
- - `~/.gemini/config/AGENTS.md` (Antigravity / Gemini CLI)
247
- - `~/.codex/AGENTS.md` (Codex)
248
- - `~/.claude/CLAUDE.md` (Claude Code)
249
-
250
- This ensures your coding assistant is always aware of its memory capabilities even in fresh workspace sessions.
251
-
252
- ---
253
-
254
- ## GraphRAG Lite
255
-
256
- The RAG engine includes a lightweight graph layer built on SQLite. It combines code symbol extraction, hierarchy edges, and explicit memory-to-document links without requiring external graph databases or LLM calls at ingest time.
257
-
258
- ### Multilingual Code Symbol Parsing
259
-
260
- During `ingest_document`, code symbols are extracted from code blocks using fast regex heuristics across 10 programming languages:
261
-
262
- - **JavaScript / TypeScript**: `function`, `class`, `interface`, `type`, `enum`, `const`, `let`, `var`
263
- - **Python**: `def`, `class`
264
- - **Go**: `struct`, `interface`, `func` (including methods with receivers)
265
- - **Rust**: `struct`, `enum`, `trait`, `fn` (including async/pub)
266
- - **C++**: `class`, `struct`, `namespace`, functions and methods
267
- - **Java & Kotlin**: `class`, `interface`, `record`, `enum`, `fun`, synchronized methods
268
- - **C#**: `class`, `interface`, `struct`, `record`, methods and properties
269
- - **PHP**: `class`, `interface`, `trait`, functions
270
- - **Ruby**: `module`, `class`, methods
271
-
272
- ### Graph Edges
273
-
274
- | Relation Type | Direction / Example |
275
- | :--- | :--- |
276
- | `CONTAINS` | Document -> Section -> Micro-Chunk (3-tier hierarchy) |
277
- | `DEFINES_SYMBOL` | Section -> `symbol:<name>` (extracted code symbol) |
278
- | `LINKS_TO` (default) | Memory fact -> Document or line range (via `link_knowledge`) |
279
-
280
- ---
281
-
282
- ## Supported Platforms
283
-
284
- | Platform | Status | Configuration Mechanism |
285
- | :--- | :--- | :--- |
286
- | **Antigravity / Gemini CLI** | Supported | MCP Server (`~/.gemini/config/mcp_config.json` & `.agents/mcp_config.json`) |
287
- | **OpenCode** | Native | Native plugin + MCP Server (`~/.config/opencode/opencode.json`) |
288
- | **Claude Code** | Supported | MCP Server (`~/.claude.json`) |
289
- | **Codex** | Supported | MCP Server (`~/.codex/config.toml`) |
290
- | **Google Jules** | Supported | MCP Server via global install + setup (`memory_plugin setup`) |
291
-
292
- ---
293
-
294
- ## Configuration
295
-
296
- The engine is configured through `<memory-dir>/config.json` (created with defaults on first run):
297
-
298
- | Key | Default | Description |
299
- | :--- | :--- | :--- |
300
- | `mode` | `only-local` | Storage sync mode: `only-local`, `only-cloud`, or `hybrid-sync` |
301
- | `fusionAlgorithm` | `rsf` | `rsf`, `rrf`, `semantic_only`, or `lexical_only` |
302
- | `alpha` | `0.5` | Vector vs BM25 weight in RSF `[0.0 - 1.0]` |
303
- | `embeddingModel` | `Xenova/multilingual-e5-small` | ONNX dense embedding model (E5 / BGE families supported) |
304
- | `rerankerModel` | `none` | Cross-encoder reranker model (e.g. `Xenova/bge-reranker-base`) |
305
- | `rerankerEnabled` | `false` | Enable cross-encoder re-ranking |
306
- | `batchSize` | `12` | Ingestion vector batch size `[1 - 256]` |
307
- | `gpuAttentionBudget` | `2000000` | GPU micro-batch attention budget `[1M - 16M]` |
308
- | `onnxThreads` | `0` | ONNX WASM threads: `0` auto-detect, or `1-16` |
309
- | `executionDevice` | `cpu` | `cpu` or `webgpu` (experimental) |
310
-
311
- ---
312
-
313
- ## Testing & Benchmarking
314
-
315
- To run the automated test suite and benchmarks locally:
316
-
317
- ```bash
318
- cd mcp-server
319
-
320
- # Run unit and integration tests
321
- npm test
322
-
323
- # Run search quality & ingestion benchmarks
324
- npm run benchmark
325
- ```
326
-
327
- For complete methodology details and search quality evaluation metrics, see [`docs/BENCHMARKS.md`](./docs/BENCHMARKS.md).
328
-
329
- ### Empirical Search Quality Results
330
-
331
- Evaluated across a 32-document technical corpus (21 queries) using Mean Reciprocal Rank (MRR@5), Recall@5, and Normalized Discounted Cumulative Gain (NDCG@5):
332
-
333
- | Retrieval Strategy | MRR@5 | Recall@5 | NDCG@5 |
334
- | :---------------------------- | :--------: | :---------: | :--------: |
335
- | BM25 Lexical Search Only | 0.6706 | 76.19% | 0.6934 |
336
- | Dense ONNX Vector Only | 0.8135 | 100.00% | 0.8612 |
337
- | Hybrid RRF ($k=10$) | 0.8810 | 95.24% | 0.8997 |
338
- | **Hybrid RSF ($\alpha=0.5$)** | **0.9286** | **100.00%** | **0.9473** |
339
-
340
- ---
341
-
342
- ## Storage & Privacy
343
-
344
- - **Local-First Storage**: All SQLite indexes, ONNX models, CAS blobs, and Markdown notebooks are stored locally in the memory directory (`$MEMORY_DIR` or `%LOCALAPPDATA%\opencode\memory`).
345
- - **Dual-Source Failover Model Fetching**: Primary model weights are fetched from HuggingFace CDN with automatic failover to GitHub Repository Mirror.
346
- - **Zero Telemetry**: No third-party network telemetry calls are made.
347
-
348
- ---
349
-
350
- ## License
351
-
352
- [MIT](./LICENSE)
1
+ <div align="center">
2
+
3
+ <img src="./assets/hero.jpg" alt="@lotargo/memory_plugin" width="800" style="max-width: 100%; border-radius: 12px; margin-bottom: 16px;">
4
+
5
+ <br>
6
+
7
+ <img src="./assets/title.svg" alt="@lotargo/memory_plugin" width="520" style="max-width: 100%; margin-bottom: 12px;">
8
+
9
+ <br>
10
+
11
+ [![npm version](https://img.shields.io/npm/v/@lotargo/memory_plugin)](https://www.npmjs.com/package/@lotargo/memory_plugin)
12
+ [![npm downloads](https://img.shields.io/npm/dt/@lotargo/memory_plugin)](https://www.npmjs.com/package/@lotargo/memory_plugin)
13
+ [![license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
14
+ [![node version](https://img.shields.io/badge/node-%3E%3D22.5.0-brightgreen)](https://nodejs.org)
15
+ [![mcp](https://img.shields.io/badge/MCP-Supported-8A2BE2)](https://modelcontextprotocol.io)
16
+ [![storage](https://img.shields.io/badge/Storage-Local%20%2B%20Cloud%20Sync-success)](#storage--privacy)
17
+
18
+ <br>
19
+
20
+ **Zero-Docker Local Hybrid RAG Engine & Long-Term Memory for AI Coding Agents**
21
+
22
+ Automatically remembers durable user facts, ingests complex document repositories, and performs high-precision hybrid retrieval across sessions, platforms, and devices.
23
+
24
+ </div>
25
+
26
+ ---
27
+
28
+ ## Overview
29
+
30
+ Standard AI coding assistants lose context as soon as a chat session closes or a conversation is reset. You end up repeatedly re-explaining your preferences, architectural decisions, coding style, or project conventions.
31
+
32
+ `@lotargo/memory_plugin` gives your AI tools durable, **persistent**, local-first long-term memory and document retrieval capabilities that persist across restarts and work seamlessly across all supported coding environments. Any LLM-based coding agent (OpenCode, Claude Code, Codex, Antigravity / Gemini CLI) can query its own memory and hybrid knowledge base via the **Model Context Protocol (MCP)**.
33
+
34
+ > **Project Scope & Runtime Notes**:
35
+ > `@lotargo/memory_plugin` is designed primarily as a practical plugin to expand capabilities and streamline daily interaction with AI coding tools. Benchmark scores in this repository represent internal synthetic evaluation runs and are not intended as generalized RAG benchmarks.
36
+ >
37
+ > **Hardware Acceleration**: GPU execution mode is an experimental feature and may vary in stability across different operating systems or models. For optimal stability and consistent runtime performance, using standard CPU mode with `multilingual-e5-small` or `multilingual-e5-base` is recommended.
38
+
39
+ ### Practical Use Cases
40
+
41
+ - **Architectural Decisions**: _"In this project, we use Fastify instead of Express and strict schema validation via Zod."_
42
+ - **Coding Conventions**: _"Place all helper utilities inside `src/utils/` and cover new functions with Vitest tests."_
43
+ - **Environment Constraints**: _"Our target deployment environment is Node.js 20 on AWS Lambda."_
44
+ - **User Profile & Tone**: _"My name is Alex. I prefer concise, direct answers without conversational filler."_
45
+
46
+ ---
47
+
48
+ ## Quick Start
49
+
50
+ ### Minimum System Requirements
51
+
52
+ - **Node.js**: `22.5.0` or higher (required by the built-in `node:sqlite` module)
53
+ - **Package Manager**: `npm` / `npx` (included with Node.js)
54
+ - **Supported Environment**: OpenCode, Antigravity / Gemini CLI, Claude Code, Codex, or Google Jules
55
+
56
+ ### Installation & Auto-Setup
57
+
58
+ Run the setup command to configure all detected AI environments automatically:
59
+
60
+ ```bash
61
+ # Recommended: Global installation & auto-setup across all environments
62
+ npm install -g @lotargo/memory_plugin && memory_plugin setup
63
+
64
+ # Or via npx
65
+ npx @lotargo/memory_plugin setup
66
+ ```
67
+
68
+ To target a specific environment:
69
+
70
+ ```bash
71
+ # Antigravity / Gemini CLI
72
+ memory_plugin setup --antigravity
73
+
74
+ # OpenCode
75
+ memory_plugin setup --opencode
76
+
77
+ # Claude Code
78
+ memory_plugin setup --claude
79
+
80
+ # Codex
81
+ memory_plugin setup --codex
82
+ ```
83
+
84
+ `setup` also accepts `--gemini` (alias for Antigravity) and `--local` (registers the MCP server in the project-local `.agents/` directory). Without a specific flag, all detected environments are configured.
85
+
86
+ ### Headless & Cloud Setup (CI / Docker / Cloud Workspaces)
87
+
88
+ For headless environments (e.g., Google Jules, VPS, CI/CD pipelines), configure auth and sync mode in a single non-interactive command:
89
+
90
+ ```bash
91
+ # Authenticate via Turso API token and set hybrid sync mode
92
+ memory_plugin setup --api-key <TURSO_API_TOKEN> --mode hybrid-sync
93
+
94
+ # Or set sync mode if already authorized
95
+ memory_plugin setup --mode only-cloud
96
+ ```
97
+
98
+ ---
99
+
100
+ ## Multi-Layer Architecture
101
+
102
+ 1. **Layer 1: Notebook Store (Durable Facts)**
103
+ - **Tools**: `remember`, `recall`, `get_fact`, `update_fact`, `forget`, `memory_info`
104
+ - **Scope**: User preferences, identity, project conventions, system rules.
105
+ - **Storage**: Human-readable Markdown format (`global` and per-project stores).
106
+ - **Fact Schema**: Every fact is formatted as `**Title** — body` with inline metadata badges (`[id]`, `[ttl]`, `[keep]`, `[tags]`, `[supersedes]`, `[inject]`).
107
+ - **Project Identity**: Project stores are bound to a **Git-based project identity** — the normalized remote URL (`git:github.com/owner/repo`) or `git:local:<repo basename>` — never to a directory path. Memories follow the repository across machines, OSes, and subdirectories. Legacy path/basename stores can be linked and merged via `link_project_memory`.
108
+
109
+ 2. **Layer 2: RAG Knowledge Base (Technical Documents & Codebases)**
110
+ - **Tools**: `ingest_document`, `query_knowledge_base`, `manage_knowledge_base`, `reindex_knowledge_base`
111
+ - **Capabilities**: Ingests raw text files, Markdown, HTML, Web URLs, office documents (PDF, DOCX, XLSX, CSV), and codebases.
112
+ - **Engine Components**: 3-tier hierarchy chunking (Big / Medium / Small), SQLite FTS5 BM25 search, ONNX dense vector embeddings (`multilingual-e5-small`), Reciprocal Rank Fusion (RRF / RSF), cross-encoder reranking (optional), and GraphRAG Lite code symbol extraction.
113
+
114
+ 3. **Layer 3: Agent-Driven Knowledge Graph**
115
+ - **Tools**: `link_knowledge` (plus `docId`, `startLine`, `endLine` in `remember`)
116
+ - **Capabilities**: Connects Layer 1 notebook facts directly to Layer 2 documents, sections, or exact line ranges with semantic edge relations (`RULES_FOR`, `IMPLEMENTS`, `EXPLAINS`, `REFERENCES`).
117
+ - **Surfacing**: Linked facts automatically highlight target documents and line ranges in `recall` output (`🔗 [Linked Docs: ...]`).
118
+
119
+ ---
120
+
121
+ ## Cloud Synchronization & Database Modes (Turso / LibSQL)
122
+
123
+ The plugin provides local-first SQLite persistence with optional cloud database synchronization powered by Turso (LibSQL):
124
+
125
+ ### 3 Storage Sync Modes
126
+
127
+ | Mode | Command / Flag | Description |
128
+ | :--- | :------------- | :---------- |
129
+ | **`only-local`** (default) | `--mode only-local` | 100% local SQLite database. No external network traffic for data storage. |
130
+ | **`only-cloud`** | `--mode only-cloud` | Direct LibSQL connection to a remote Turso database instance. |
131
+ | **`hybrid-sync`** | `--mode hybrid-sync` | Local SQLite performance with background asynchronous synchronization to Turso Cloud, featuring automatic reverse-sync and conflict resolution. |
132
+
133
+ ### Cloud Failover & Circuit Breaker
134
+
135
+ When operating in cloud modes (`only-cloud` or `hybrid-sync`), the database engine incorporates a built-in **Circuit Breaker**:
136
+ - If the primary cloud database endpoint is unreachable or encounters network failure, queries fail over to the secondary cloud endpoint configured in `failoverUrl`. Failover is disabled when `failoverUrl` is empty (the default).
137
+ - In `hybrid-sync` the local SQLite copy keeps serving reads regardless; in `only-cloud` no local database is opened, so an outage with no `failoverUrl` surfaces as an error.
138
+ - Prevents agent blocking or crash loops during internet outages or cloud service degradation.
139
+
140
+ ### Secure Credential Storage
141
+
142
+ Cloud authentication tokens are never written to `config.json`. They are stored in `auth_secrets.enc`, encrypted with **AES-256-GCM** using a key derived via **PBKDF2-HMAC-SHA256 (600,000 iterations)** from a stable machine fingerprint (OS machine ID + platform + architecture). The file is written with owner-only permissions (`0600`).
143
+
144
+ > **Note:** this is not an OS keychain (DPAPI / Keychain / Secret Service). The fingerprint components are readable by other processes running as the same user, so the encryption protects against file exfiltration and casual inspection, not against a compromised local account. Secrets are bound to the machine — copying `auth_secrets.enc` to another computer will not decrypt.
145
+ >
146
+ > **Exception:** the headless fallback via `MEMORY_DIR/.env` (`TURSO_DB_URL`, `TURSO_DB_TOKEN`, `TURSO_API_TOKEN`) stores credentials in **plain text** by design, for Docker/CI deployments.
147
+
148
+ ---
149
+
150
+ ## Available MCP Tools
151
+
152
+ The MCP server registers **14 MCP tools** accessible across all connected AI environments, plus **2 OpenCode-plugin helper tools** available only inside OpenCode:
153
+
154
+ ### 1. Memory Notebook Tools (Layer 1)
155
+
156
+ | Tool | Scope / Target | Key Parameters | Description |
157
+ | :--- | :------------- | :------------- | :---------- |
158
+ | `remember` | `project` / `global` | `fact`, `title`, `scope`, `docId`, `startLine`, `endLine`, `relationType`, `ttl`, `keep`, `tags`, `supersedes` | Save a durable fact or preference. Supports optional title, document linking, TTL, keep protection, tags, and version superseding. |
159
+ | `recall` | `all`, `project`, `global`, `list_projects` | `scope`, `project`, `query`, `tags`, `since`, `until`, `mode`, `offset`, `limit` | Display saved facts with metadata badges and linked docs. Supports cross-project lookup via `project: '<path>'` and header-only mode (`mode: "headers"`). |
160
+ | `get_fact` | `all`, `project`, `global` | `id`, `scope` | Retrieve full text, raw line, and metadata of a single fact by its metadata ID (e.g. `"8f3a2c"`). |
161
+ | `update_fact` | `project` / `global` | `id`, `newText`, `title`, `scope` | Rewrite a fact (and optionally its `**Title**`) while preserving its original creation date, metadata, and knowledge links. |
162
+ | `forget` | `project` / `global` | `id` / `range` / `query`, `scope`, `force` | Remove a fact by index number, ID, range (e.g. `"3-30"`), or query. Requires `force: true` for protected (`[KEEP]`) facts. |
163
+ | `memory_info` | - | - | Show storage paths, fact counts, RAG statistics, git identity bindings, and package version. |
164
+
165
+ ### 2. Project Identity Tools
166
+
167
+ | Tool | Key Parameters | Description |
168
+ | :--- | :------------- | :---------- |
169
+ | `link_project_memory` | `directory`, `remote` | Link a directory path to a Git-based project identity key, register aliases, and migrate legacy path/basename stores with deduplication. |
170
+ | `unlink_project_memory` | `directory`, `purge` | Remove a path alias binding for a directory. Optionally purge the project identity entry if `purge: true`. |
171
+ | `relink_project_memory` | `directory`, `remote` | Switch a project's primary identity to a new remote URL and merge all stored facts into the target store with fact-text deduplication. |
172
+
173
+ ### 3. RAG Knowledge Base & Graph Tools (Layers 2 & 3)
174
+
175
+ | Tool | Key Parameters | Description |
176
+ | :--- | :------------- | :---------- |
177
+ | `ingest_document` | `content`, `type`, `title`, `path`, `generateEmbeddings` | Ingest local files, URLs, or raw text into the 3-tier index (Big/Medium/Small) with ONNX vector embeddings and GraphRAG symbol extraction. |
178
+ | `query_knowledge_base` | `query`, `limit`, `instruction`, `generateEmbeddings` | Perform hybrid search (RSF/RRF BM25 + dense vector similarity) to retrieve candidate document sections with defined code symbols. |
179
+ | `manage_knowledge_base` | `action`, `docId`, `snapshotPath` | Inspect DB stats (`stats`), list documents (`list`), read full raw document (`read_document`), delete document (`delete`), or export/import snapshots (`export_snapshot` / `import_snapshot`). |
180
+ | `reindex_knowledge_base` | `model`, `dimension` | Re-embed all stored vectors with the active (or specified) embedding model and vector dimension. Use after switching the embedding model or vector dimension so previously indexed documents remain retrievable. Preserves documents, FTS index, graph edges, and fact links. |
181
+ | `link_knowledge` | `action`, `factText`, `docId`, `scope`, `startLine`, `endLine`, `relationType` | Create, list, or retrieve semantic graph links connecting Notebook facts to Knowledge Base documents, sections, or line ranges. Actions: `link`, `list_links`, `get_doc_links`. |
182
+
183
+ ### 4. Agent & OpenCode Helpers (OpenCode plugin only, not exposed by the MCP server)
184
+
185
+ | Tool | Key Parameters | Description |
186
+ | :--- | :------------- | :---------- |
187
+ | `list-mcp-tools` | - | Discover all connected MCP servers and their available tool definitions. |
188
+ | `mcp-reminder` | `task` | Recommends the appropriate MCP tool or server for a specific developer task. |
189
+
190
+ ---
191
+
192
+ ## CLI Command Reference
193
+
194
+ The plugin provides both direct non-interactive CLI commands and an interactive terminal UI (TUI):
195
+
196
+ ```bash
197
+ # Executable commands (available globally or via npx)
198
+ memory_plugin <command> [options]
199
+ # or
200
+ memory-cli <command> [options]
201
+ ```
202
+
203
+ Both binaries accept the same commands. `memory_plugin` with **no** command starts the MCP server on stdio; `memory-cli` with no command opens the interactive TUI. Use `--help` on either for the full usage text.
204
+
205
+ > **Secrets:** prefer the environment variables `TURSO_API_TOKEN`, `TURSO_DB_URL` and `TURSO_DB_TOKEN` over `--api-key` / `--db-token` flags — arguments passed on the command line are visible in the process list and shell history. Without a flag or env var, `login` prompts for the token on stdin with echo disabled.
206
+
207
+ ### Direct Non-Interactive Commands
208
+
209
+ | Command | Options / Flags | Description |
210
+ | :------ | :-------------- | :---------- |
211
+ | **`setup`** | `--antigravity`, `--opencode`, `--claude`, `--codex`, `--local`, `--api-key <TOKEN>`, `--mode <MODE>` | Configures MCP server registrations across detected environments and sets initial cloud auth/sync mode. |
212
+ | **`link`** | `--dir <path>`, `--remote <url>` | Links a directory to a Git project identity or remote URL. |
213
+ | **`unlink`** | `--dir <path>`, `--purge` | Unlinks a directory path alias. `--purge` removes the identity record. |
214
+ | **`relink`** | `--remote <url>`, `--dir <path>` | Relinks project identity to a new remote URL and merges facts. |
215
+ | **`identity`** | `--dir <path>` | Inspects Git project identity key, primary remote, name, and toplevel path for a directory. |
216
+ | **`migrate_titles`** | `--key <key>` | Auto-generates `**Title**` prefixes for legacy facts without titles. |
217
+ | **`enable-prompt`** | - | Injects memory agent instructions into client agent files (`AGENTS.md`, `CLAUDE.md`). |
218
+ | **`disable-prompt`** | - | Removes memory agent instructions from client agent files. |
219
+ | **`login`** | `--api-token`, `--from-env`, `--db-url <URL> --db-token`, `$TURSO_API_TOKEN`, `$TURSO_DB_TOKEN` | Authenticates with Turso Cloud via API token, direct DB token, or environment variables. Token values are read from the environment or a hidden stdin prompt. |
220
+ | **`logout`** | `--api-key` | Signs out of Turso Cloud or removes stored API key while retaining DB session. |
221
+ | **`auth-status`** | - | Displays authentication source, endpoint URL, username, organization, database, and sync mode. |
222
+
223
+ ### Interactive TUI (CLI Menu)
224
+
225
+ Launch the interactive terminal UI to manage engine settings, tune retrieval algorithms, inspect databases, and run diagnostics:
226
+
227
+ ```bash
228
+ memory_plugin cli
229
+ # or
230
+ memory-cli
231
+ ```
232
+
233
+ #### TUI Menu Navigation
234
+
235
+ Use **Up / Down** arrows to navigate, **ENTER** to select, and **BACKSPACE** to go back.
236
+
237
+ - **Engine & Hybrid Search Settings**: Switch fusion algorithms (`rsf`, `rrf`, `semantic_only`, `lexical_only`), adjust RSF $\alpha$ balance, select ONNX embedding models, set a fixed embedding vector dimension, toggle Cross-Encoder rerankers, configure GPU attention budget, and set WASM threads.
238
+ - **Knowledge Base & Storage Management**: Browse Layer 1 facts, manage Layer 2 RAG docs, re-embed all vectors after switching model/dimension (`[REINDEX]`), export/import JSON snapshots, purge model cache, or perform a hard reset.
239
+ - **Global Prompt & Integration**: Toggle memory instruction sync across client configurations (`~/.gemini/config/AGENTS.md`, `~/.codex/AGENTS.md`, `~/.claude/CLAUDE.md`).
240
+ - **Diagnostics & System Actions**: Execute a hybrid search verification query, run the graph & notebook linking check, and reset config to factory defaults.
241
+
242
+ ---
243
+
244
+ ## Agent Skill & System Prompt Integration
245
+
246
+ ### Built-in Agent Skill (`using-memory`)
247
+
248
+ The plugin bundles a pre-configured Agent Skill located at [`skills/using-memory/SKILL.md`](./skills/using-memory/SKILL.md). When installed in supported environments (such as Antigravity / Gemini CLI or OpenCode), coding agents automatically read this skill to:
249
+ 1. **Initialize Sessions**: Automatically invoke `recall(scope: "all")` at the start of every chat turn to load all saved preferences and project rules.
250
+ 2. **Proactively Save Context**: Automatically call `remember` whenever you share durable facts, tech stack choices, or coding guidelines.
251
+ 3. **Architect Knowledge Graphs**: Use `link_knowledge` or `remember(docId, startLine, endLine)` to connect memories directly to technical documentation.
252
+
253
+ ### Global System Prompt Synchronization
254
+
255
+ Run `memory_plugin enable-prompt` to automatically inject memory agent guidance into your global LLM configuration files:
256
+ - `~/.gemini/config/AGENTS.md` (Antigravity / Gemini CLI)
257
+ - `~/.codex/AGENTS.md` (Codex)
258
+ - `~/.claude/CLAUDE.md` (Claude Code)
259
+
260
+ This ensures your coding assistant is always aware of its memory capabilities even in fresh workspace sessions.
261
+
262
+ ---
263
+
264
+ ## GraphRAG Lite
265
+
266
+ The RAG engine includes a lightweight graph layer built on SQLite. It combines code symbol extraction, hierarchy edges, and explicit memory-to-document links without requiring external graph databases or LLM calls at ingest time.
267
+
268
+ ### Multilingual Code Symbol Parsing
269
+
270
+ During `ingest_document`, code symbols are extracted from code blocks using fast regex heuristics across the following language families:
271
+
272
+ - **JavaScript / TypeScript**: `function`, `class`, `interface`, `type`, `enum`, `const`, `let`, `var`
273
+ - **Python**: `def`, `class`
274
+ - **Go**: `struct`, `interface`, `func` (including methods with receivers)
275
+ - **Rust**: `struct`, `enum`, `trait`, `fn` (including async/pub)
276
+ - **C++**: `class`, `struct`, `namespace`, functions and methods
277
+ - **Java & Kotlin**: `class`, `interface`, `record`, `enum`, `fun`, synchronized methods
278
+ - **C#**: `class`, `interface`, `struct`, `record`, methods (properties without a parameter list are not captured)
279
+ - **PHP**: `class`, `interface`, `trait`, functions
280
+ - **Ruby**: `module`, `class`, methods
281
+
282
+ ### Graph Edges
283
+
284
+ | Relation Type | Direction / Example |
285
+ | :--- | :--- |
286
+ | `CONTAINS` | Document -> Section -> Micro-Chunk (3-tier hierarchy) |
287
+ | `DEFINES_SYMBOL` | Section -> `symbol:<name>` (extracted code symbol) |
288
+ | `LINKS_TO` (default) | Memory fact -> Document or line range (via `link_knowledge`) |
289
+
290
+ ---
291
+
292
+ ## Supported Platforms
293
+
294
+ | Platform | Status | Configuration Mechanism |
295
+ | :--- | :--- | :--- |
296
+ | **Antigravity / Gemini CLI** | Supported | MCP Server (`~/.gemini/config/mcp_config.json` & `.agents/mcp_config.json`) |
297
+ | **OpenCode** | Native | Native plugin + MCP Server (`~/.config/opencode/opencode.json`) |
298
+ | **Claude Code** | Supported | MCP Server (`~/.claude.json`) |
299
+ | **Codex** | Supported | MCP Server (`~/.codex/config.toml`) |
300
+ | **Google Jules** | Supported | MCP Server via global install + setup (`memory_plugin setup`) |
301
+
302
+ ---
303
+
304
+ ## Configuration
305
+
306
+ The engine is configured through `<memory-dir>/config.json` (created with defaults on first run):
307
+
308
+ | Key | Default | Description |
309
+ | :--- | :--- | :--- |
310
+ | `mode` | `only-local` | Storage sync mode: `only-local`, `only-cloud`, or `hybrid-sync` |
311
+ | `fusionAlgorithm` | `rsf` | `rsf`, `rrf`, `semantic_only`, or `lexical_only` |
312
+ | `alpha` | `0.5` | Vector vs BM25 weight in RSF `[0.0 - 1.0]` |
313
+ | `embeddingModel` | `Xenova/multilingual-e5-small` | ONNX dense embedding model (E5 / BGE families supported) |
314
+ | `vectorDimension` | `0` | Fixed embedding vector dimension; `0` = auto-detect from the model |
315
+ | `rerankerModel` | `none` | Cross-encoder reranker model (e.g. `Xenova/bge-reranker-base`) |
316
+ | `rerankerEnabled` | `false` | Enable cross-encoder re-ranking |
317
+ | `batchSize` | `12` | Ingestion vector batch size `[1 - 256]` |
318
+ | `gpuAttentionBudget` | `2000000` | GPU micro-batch attention budget `[1M - 16M]` |
319
+ | `onnxThreads` | `0` | ONNX WASM threads: `0` auto-detect, or `1-16` |
320
+ | `executionDevice` | `cpu` | `cpu` or `webgpu` (experimental) |
321
+ | `vectorScanLimit` | `50000` | Max micro-chunks scanned per vector query (`0` = unlimited) |
322
+ | `injectLimit` | `10` | Max facts injected into the agent's system prompt |
323
+ | `conflictStrategy` | `merge` | Hybrid-sync conflict resolution: `merge`, `cloud-wins`, or `local-wins` |
324
+ | `tursoUrl` | `""` | Primary Turso endpoint URL (set by `login`) |
325
+ | `failoverUrl` | `""` | Secondary cloud endpoint for the circuit breaker; empty = failover disabled |
326
+ | `authorized` | `false` | Set to `true` once a cloud login completed |
327
+ | `username` | `""` | Account username from the Turso profile |
328
+ | `ingestAllowedPaths` | `[]` | Extra directories `ingest_document(type: "file")` may read from |
329
+ | `ingestAllowAnyPath` | `false` | Escape hatch: allow reading **any** path from disk (unsafe) |
330
+
331
+ > `ingest_document(type: "file")` reads only from the current working directory and the plugin data directory by default. This prevents a prompt-injected agent from pulling `~/.ssh/id_rsa` or `.env` into the knowledge base (and, in `hybrid-sync`, into the cloud). Widen it deliberately via `ingestAllowedPaths`.
332
+
333
+ ---
334
+
335
+ ## Testing & Benchmarking
336
+
337
+ To run the automated test suite and benchmarks locally:
338
+
339
+ ```bash
340
+ cd mcp-server
341
+
342
+ # Run unit and integration tests
343
+ npm test
344
+
345
+ # Run search quality & ingestion benchmarks
346
+ npm run benchmark
347
+ ```
348
+
349
+ For complete methodology details and search quality evaluation metrics, see [`docs/BENCHMARKS.md`](./docs/BENCHMARKS.md).
350
+
351
+ ### Empirical Search Quality Results
352
+
353
+ Evaluated across a 32-document technical corpus (21 queries) using Mean Reciprocal Rank (MRR@5), Recall@5, and Normalized Discounted Cumulative Gain (NDCG@5):
354
+
355
+ | Retrieval Strategy | MRR@5 | Recall@5 | NDCG@5 |
356
+ | :---------------------------- | :--------: | :---------: | :--------: |
357
+ | BM25 Lexical Search Only | 0.6706 | 76.19% | 0.6934 |
358
+ | Dense ONNX Vector Only | 0.8135 | 100.00% | 0.8612 |
359
+ | Hybrid RRF ($k=60$) | 0.8810 | 95.24% | 0.8997 |
360
+ | **Hybrid RSF ($\alpha=0.5$)** | **0.9286** | **100.00%** | **0.9473** |
361
+
362
+ ---
363
+
364
+ ## Storage & Privacy
365
+
366
+ - **Local-First Storage**: All SQLite indexes, ONNX models, CAS blobs, and Markdown notebooks are stored locally in the memory directory. Resolution order: `$MEMORY_DIR` → `$OPENCODE_CONFIG_DIR/memory` → the legacy `~/.config/opencode/memory` directory when it already exists (this takes precedence on Windows too) → `%LOCALAPPDATA%\opencode\memory`.
367
+ - **Model Weights**: ONNX weights are downloaded on first use from `https://huggingface.co` and cached locally; later runs are fully offline.
368
+ - **Zero Telemetry**: No third-party analytics or telemetry calls are made. The only outbound traffic is the one-off model download, plus Turso requests in the cloud sync modes.
369
+
370
+ ### Known Dependency Advisories
371
+
372
+ `npm audit` reports three high-severity advisories with no upstream fix available. Both affected packages are only reachable through explicit user action:
373
+
374
+ | Package | Advisory | Reachability | Mitigation |
375
+ | :--- | :--- | :--- | :--- |
376
+ | `xlsx` (SheetJS) | Prototype Pollution ([GHSA-4r6h-8v6p-xvw6](https://github.com/advisories/GHSA-4r6h-8v6p-xvw6)), ReDoS ([GHSA-5pgg-2g8v-p4x9](https://github.com/advisories/GHSA-5pgg-2g8v-p4x9)) | Only when you ingest a `.xlsx` / `.xls` / `.csv` file | Do not ingest untrusted spreadsheets. A migration to `exceljs` is under consideration. |
377
+ | `sharp` `<0.35.0` (via `@huggingface/transformers`) | libvips CVE-2026-33327 / 33328 / 35590 / 35591 ([GHSA-f88m-g3jw-g9cj](https://github.com/advisories/GHSA-f88m-g3jw-g9cj)) | Image decoding path only; this plugin runs text embedding models exclusively and never feeds images to `sharp` | Not reachable in normal use; will clear once `@huggingface/transformers` bumps `sharp`. |
378
+
379
+ ---
380
+
381
+ ## License
382
+
383
+ [MIT](./LICENSE)