@lotargo/memory_plugin 1.6.7 → 1.6.9

package/CHANGELOG.md

@@ -3,133 +3,155 @@
 All notable changes to `@lotargo/memory_plugin` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-### Changed
-
-- OpenCode's native auto-injection now explicitly suppresses redundant startup `recall` calls while preserving manual recall for inspection, filtering, history, and explicit scopes.
-- Added an OpenCode system-prompt overlay policy that treats user-approved personality, behavior, tone, style, preference, and working-convention memories as active personalization instructions rather than passive facts.
-- Updated shared prompts and the bundled memory skill to distinguish auto-injected clients from integrations that must initialize with `recall(scope: "all")`.
-- OpenCode now separates active `<PERSONAL_AGENT_OVERLAY>` entries from descriptive `<MEMORY_FACTS>` and injects the actual active directives into `experimental.chat.system.transform`.
-- `dev:link` now synchronizes managed prompts and bundled skills for non-OpenCode clients in addition to linking the OpenCode source and system CLI.
-- Claude Code, Gemini CLI, and Codex setup/uninstall now use each client's native MCP lifecycle command first, verify the resulting registration, and fall back to ownership-checked JSON/TOML editing only when the client CLI is missing, fails, or leaves the expected entry unchanged.
-- Gemini CLI is now a separate integration using `~/.gemini/settings.json`, `~/.gemini/GEMINI.md`, and `~/.gemini/skills`; Antigravity keeps its distinct `~/.gemini/config` and optional workspace `.agents` layout.
-- Normal OpenCode uninstall now preserves the host package cache. Cache cleanup is explicit through `--purge-cache` and removes only exact package-owned directories, including versioned cache entries.
-
-### Added
-
-- Added `npm run dev:link` / `memory-cli dev-link` for local development. It globally links the repository CLI and points OpenCode at the working tree through a `file://` plugin entry, eliminating npm publication and reinstall cycles during testing.
-- Added explicit Notebook `kind: "fact" | "directive"` semantics across MCP and OpenCode `remember` / `update_fact` tools, with `[DIRECTIVE]` recall badges and compatibility for legacy persona/preference tags.
-- Added managed persona prompt synchronization for Codex, Claude Code, and Antigravity through `memory-cli sync-persona` / `npm run persona:sync`, including automatic refresh after global directive mutations and cloud pulls.
-- Added idempotent `memory-cli migrate-persona [--dry-run]` / `npm run persona:migrate` to permanently classify legacy global personalization entries as `kind:directive` and regenerate managed client prompts.
-- Added `memory_plugin uninstall` / `memory-cli uninstall` and the `memory_plugin setup --uninstall` alias with per-client targeting, `--dry-run`, data-preserving defaults, guarded `--purge`, and explicit `--purge-cache` support.
-- Added a shared cross-platform client path and CLI execution layer with Windows npm-shim support plus `XDG_CONFIG_HOME`, `XDG_CACHE_HOME`, `OPENCODE_CONFIG_DIR`, and `MEMORY_DIR` handling.
-
-### Fixed
-
-- Fixed `remember_note` omitting the ingestion `blobHash` from its public result, which broke cross-device raw-blob portability consumers and was previously masked by Windows temp-cleanup errors.
-- Fixed concurrent `triggerBackgroundSync()` callers returning before the active queue drain completed; callers now join one active promise that includes requested follow-up passes.
-- Fixed uninstall ownership checks so foreign `memory-agent` registrations, unrelated OpenCode plugins/cache packages, modified skills, and user-authored content outside managed prompt/persona markers are never removed.
-- Fixed Codex TOML cleanup to remove only plugin-owned `memory-agent` tables while preserving unrelated formatting and child sections, and made malformed client configuration fail closed instead of being overwritten.
-- Fixed uninstall failure reporting to return a non-zero exit status when any requested cleanup step fails.
-
-## [1.6.6] - 2026-08-17
-
-### Fixed
-
-- Fixed npm package distribution files list to include `mcp-server/rag_scope.js` and all server modules.
-
-## [1.6.5] - 2026-08-17
-
-### Added
-
-- Added explicit `directory` (and `project` alias) parameter support to Notebook/Memory tools (`remember`, `recall`, `get_fact`, `forget`, `update_fact`, `memory_info`, `link_knowledge`) and RAG tools (`ingest_document`, `query_knowledge_base`, `batch_query_knowledge_base`, `manage_knowledge_base`) across both the MCP server and native OpenCode plugin.
-
-### Fixed
-
-- Fixed cross-directory workspace routing and isolation so operations targeting external project paths work reliably without directory mismatch or leaking npm process `INIT_CWD`.
-- Fixed `batch_query_knowledge_base` query execution and result formatting in the MCP server.
-
-## [1.6.4] - 2026-08-13
-
-### Added
-
-- `memory_info` now reports whether the current Git identity is `Registry: linked`
-  or `Registry: unlinked`, enabling agents to register new repositories automatically.
-- RAG documents now have explicit global/project scope associations. The default
-  project scope follows the current linked Git identity, while `scope: "all"`
-  retrieves only global knowledge plus the current project's knowledge. A source
-  shared by several scopes is stored once and associated with each scope.
-- The native OpenCode plugin now exposes `batch_query_knowledge_base`, bringing it
-  to all 15 shared tools plus its two OpenCode-only helpers.
-
-### Changed
-
-- OpenCode auto-injected memory now includes complete fact bodies for both global and
-  current-project stores without the previous ten-fact truncation and instructs the
-  agent to register an unlinked Git identity. Header-only initialization was removed
-  because it loses essential context.
-- The bundled memory skill now defines full-body session recall, strict project
-  isolation, agent-resolved conflicts, automatic Git project registration, and
-  selective RAG curation for important web findings and current technical
-  documentation, including links from project facts to supporting sources.
-- `recall` hides superseded facts by default and exposes history through
-  `includeSuperseded: true`. Filtered output keeps physical storage indices stable,
-  so a displayed number always targets the same fact in `forget`.
-
-### Fixed
-
-- Re-ingesting an existing path or URL now preserves its document ID, scope
-  associations, and fact links while rebuilding chunks, vectors, FTS rows, and
-  structural graph edges for changed content.
-- Snapshot export/import and hybrid cloud synchronization now preserve vectors,
-  retrieval policies, policy provenance, document scopes, knowledge links, and
-  structural graph metadata. The hybrid sync worker also drains tasks queued during
-  an active flush instead of leaving them pending.
-- Relinking a Git project now moves its RAG scope associations and fact-to-document
-  links together with Notebook facts.
-- Environment-specific setup flags now update only their requested integration.
-  Codex setup also synchronizes the skill to both `~/.codex/skills` and the shared
-  `~/.agents/skills` location.
-- Shared documents no longer expose fact-link metadata belonging to another project.
-  Document deletion now defaults to unlinking only the current project (or global
-  outside Git); broader `global` / `all` removal must be requested explicitly.
-- Updating or forgetting a linked Notebook fact now keeps its knowledge-graph
-  projection and cloud payload consistent. Line-range graph edges are included in
-  per-document cloud sync, and superseding legacy facts without IDs assigns distinct
-  IDs to the old and new versions.
-- README tool counts now match the implementations: 15 MCP tools, 17 native
-  OpenCode tools, and 17 unique tool names across both surfaces. The OpenCode tool
-  list documents all shared and OpenCode-only helpers explicitly.
-
-## [1.6.3] - 2026-08-13
-
-### Added
-
-- `memory_plugin doctor --codex` validates the configured executable and Node.js
-  version, performs direct MCP `initialize` / `tools/list`, and calls both
-  `memory_info` and `recall(scope="all")`.
-- Codex regression coverage for Windows paths with spaces, legacy config migration,
-  duplicate removal, standalone MCP protocol smoke testing, two-repository project
-  isolation, global-only recall outside Git, and prompt idempotency.
-
-### Fixed
-
-- Codex setup no longer launches the memory MCP through `npx` or a Windows `.cmd`
-  shim. It writes absolute paths for the active Node executable and packaged
-  `mcp-server/boot.js` entry point after validating Node.js >= 22.5.0.
-- Existing plugin-owned `[mcp_servers.memory-agent]` sections, including the legacy
-  `opencode-memory-plugin` entry, are migrated in place without modifying unrelated
-  TOML sections or creating duplicates.
-- Repeated prompt setup now collapses duplicate plugin-owned blocks while preserving
-  user-authored AGENTS.md / CLAUDE.md content.
-- README tool counts match the v1.6.3 implementations: 15 MCP tools, 16 native
-  OpenCode tools, and 17 unique tool names across both surfaces. The OpenCode tool
-  list and the MCP-only status of `batch_query_knowledge_base` are documented explicitly.
-
-## [1.6.2] - 2026-08-12
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.6.9] - 2026-09-08
+
+### Fixed
+
+- Fixed Turso browser OAuth on Windows: URLs no longer go through `cmd.exe` (which truncated the query string at `&`), browser launch now uses `rundll32.exe url.dll,FileProtocolHandler`. The OAuth loopback server now binds an ephemeral port before the login URL is built, eliminating the listen race and `EADDRINUSE` on the fixed port.
+- Made the `policy_retrieval` unit test offline-deterministic: ingestion now runs with `generateEmbeddings: false` (BM25/policy path only) and DB/temp cleanup is guaranteed via `try/finally`, so a corrupted ONNX model cache no longer fails the suite and blocks the runner.
+
+## [1.6.8] - 2026-08-25
+
+### Changed
+
+- Refreshed npm package positioning around local-first memory, hybrid RAG, agent personalization, and coding-agent integrations.
+- Expanded package keywords for agent memory, coding agents, personalization, context engineering, local-first workflows, and Google Jules discovery.
+- Updated package repository, homepage, and issue metadata to the canonical `Lotargo/memory_plugin` repository after the GitHub rename.
+- Updated README hero asset URLs to the canonical repository and added a text H1 covering memory, hybrid RAG, and agent personalization.
+- Updated the spreadsheet parser import to the ESM-compatible SheetJS namespace form.
+
+### Security
+
+- Replaced the stale public-npm `xlsx@0.18.5` dependency with SheetJS CE `0.20.3` from the official SheetJS CDN, moving spreadsheet ingestion outside the affected ranges for the known prototype-pollution and ReDoS advisories.
+- Updated dependency-security documentation to distinguish the fixed direct SheetJS exposure from the remaining transitive `sharp` / libvips warning in `@huggingface/transformers`; the project disables the Transformers image-decoding path with `env.sharp = false`.
+
+## [1.6.7] - 2026-08-24
+
+### Changed
+
+- OpenCode's native auto-injection now explicitly suppresses redundant startup `recall` calls while preserving manual recall for inspection, filtering, history, and explicit scopes.
+- Added an OpenCode system-prompt overlay policy that treats user-approved personality, behavior, tone, style, preference, and working-convention memories as active personalization instructions rather than passive facts.
+- Updated shared prompts and the bundled memory skill to distinguish auto-injected clients from integrations that must initialize with `recall(scope: "all")`.
+- OpenCode now separates active `<PERSONAL_AGENT_OVERLAY>` entries from descriptive `<MEMORY_FACTS>` and injects the actual active directives into `experimental.chat.system.transform`.
+- `dev:link` now synchronizes managed prompts and bundled skills for non-OpenCode clients in addition to linking the OpenCode source and system CLI.
+- Claude Code, Gemini CLI, and Codex setup/uninstall now use each client's native MCP lifecycle command first, verify the resulting registration, and fall back to ownership-checked JSON/TOML editing only when the client CLI is missing, fails, or leaves the expected entry unchanged.
+- Gemini CLI is now a separate integration using `~/.gemini/settings.json`, `~/.gemini/GEMINI.md`, and `~/.gemini/skills`; Antigravity keeps its distinct `~/.gemini/config` and optional workspace `.agents` layout.
+- Normal OpenCode uninstall now preserves the host package cache. Cache cleanup is explicit through `--purge-cache` and removes only exact package-owned directories, including versioned cache entries.
+
+### Added
+
+- Added `npm run dev:link` / `memory-cli dev-link` for local development. It globally links the repository CLI and points OpenCode at the working tree through a `file://` plugin entry, eliminating npm publication and reinstall cycles during testing.
+- Added explicit Notebook `kind: "fact" | "directive"` semantics across MCP and OpenCode `remember` / `update_fact` tools, with `[DIRECTIVE]` recall badges and compatibility for legacy persona/preference tags.
+- Added managed persona prompt synchronization for Codex, Claude Code, and Antigravity through `memory-cli sync-persona` / `npm run persona:sync`, including automatic refresh after global directive mutations and cloud pulls.
+- Added idempotent `memory-cli migrate-persona [--dry-run]` / `npm run persona:migrate` to permanently classify legacy global personalization entries as `kind:directive` and regenerate managed client prompts.
+- Added `memory_plugin uninstall` / `memory-cli uninstall` and the `memory_plugin setup --uninstall` alias with per-client targeting, `--dry-run`, data-preserving defaults, guarded `--purge`, and explicit `--purge-cache` support.
+- Added a shared cross-platform client path and CLI execution layer with Windows npm-shim support plus `XDG_CONFIG_HOME`, `XDG_CACHE_HOME`, `OPENCODE_CONFIG_DIR`, and `MEMORY_DIR` handling.
+
+### Fixed
+
+- Fixed `remember_note` omitting the ingestion `blobHash` from its public result, which broke cross-device raw-blob portability consumers and was previously masked by Windows temp-cleanup errors.
+- Fixed concurrent `triggerBackgroundSync()` callers returning before the active queue drain completed; callers now join one active promise that includes requested follow-up passes.
+- Fixed uninstall ownership checks so foreign `memory-agent` registrations, unrelated OpenCode plugins/cache packages, modified skills, and user-authored content outside managed prompt/persona markers are never removed.
+- Fixed Codex TOML cleanup to remove only plugin-owned `memory-agent` tables while preserving unrelated formatting and child sections, and made malformed client configuration fail closed instead of being overwritten.
+- Fixed uninstall failure reporting to return a non-zero exit status when any requested cleanup step fails.
+
+## [1.6.6] - 2026-08-17
+
+### Fixed
+
+- Fixed npm package distribution files list to include `mcp-server/rag_scope.js` and all server modules.
+
+## [1.6.5] - 2026-08-17
+
+### Added
+
+- Added explicit `directory` (and `project` alias) parameter support to Notebook/Memory tools (`remember`, `recall`, `get_fact`, `forget`, `update_fact`, `memory_info`, `link_knowledge`) and RAG tools (`ingest_document`, `query_knowledge_base`, `batch_query_knowledge_base`, `manage_knowledge_base`) across both the MCP server and native OpenCode plugin.
+
+### Fixed
+
+- Fixed cross-directory workspace routing and isolation so operations targeting external project paths work reliably without directory mismatch or leaking npm process `INIT_CWD`.
+- Fixed `batch_query_knowledge_base` query execution and result formatting in the MCP server.
+
+## [1.6.4] - 2026-08-13
+
+### Added
+
+- `memory_info` now reports whether the current Git identity is `Registry: linked`
+  or `Registry: unlinked`, enabling agents to register new repositories automatically.
+- RAG documents now have explicit global/project scope associations. The default
+  project scope follows the current linked Git identity, while `scope: "all"`
+  retrieves only global knowledge plus the current project's knowledge. A source
+  shared by several scopes is stored once and associated with each scope.
+- The native OpenCode plugin now exposes `batch_query_knowledge_base`, bringing it
+  to all 15 shared tools plus its two OpenCode-only helpers.
+
+### Changed
+
+- OpenCode auto-injected memory now includes complete fact bodies for both global and
+  current-project stores without the previous ten-fact truncation and instructs the
+  agent to register an unlinked Git identity. Header-only initialization was removed
+  because it loses essential context.
+- The bundled memory skill now defines full-body session recall, strict project
+  isolation, agent-resolved conflicts, automatic Git project registration, and
+  selective RAG curation for important web findings and current technical
+  documentation, including links from project facts to supporting sources.
+- `recall` hides superseded facts by default and exposes history through
+  `includeSuperseded: true`. Filtered output keeps physical storage indices stable,
+  so a displayed number always targets the same fact in `forget`.
+
+### Fixed
+
+- Re-ingesting an existing path or URL now preserves its document ID, scope
+  associations, and fact links while rebuilding chunks, vectors, FTS rows, and
+  structural graph edges for changed content.
+- Snapshot export/import and hybrid cloud synchronization now preserve vectors,
+  retrieval policies, policy provenance, document scopes, knowledge links, and
+  structural graph metadata. The hybrid sync worker also drains tasks queued during
+  an active flush instead of leaving them pending.
+- Relinking a Git project now moves its RAG scope associations and fact-to-document
+  links together with Notebook facts.
+- Environment-specific setup flags now update only their requested integration.
+  Codex setup also synchronizes the skill to both `~/.codex/skills` and the shared
+  `~/.agents/skills` location.
+- Shared documents no longer expose fact-link metadata belonging to another project.
+  Document deletion now defaults to unlinking only the current project (or global
+  outside Git); broader `global` / `all` removal must be requested explicitly.
+- Updating or forgetting a linked Notebook fact now keeps its knowledge-graph
+  projection and cloud payload consistent. Line-range graph edges are included in
+  per-document cloud sync, and superseding legacy facts without IDs assigns distinct
+  IDs to the old and new versions.
+- README tool counts now match the implementations: 15 MCP tools, 17 native
+  OpenCode tools, and 17 unique tool names across both surfaces. The OpenCode tool
+  list documents all shared and OpenCode-only helpers explicitly.
+
+## [1.6.3] - 2026-08-13
+
+### Added
+
+- `memory_plugin doctor --codex` validates the configured executable and Node.js
+  version, performs direct MCP `initialize` / `tools/list`, and calls both
+  `memory_info` and `recall(scope="all")`.
+- Codex regression coverage for Windows paths with spaces, legacy config migration,
+  duplicate removal, standalone MCP protocol smoke testing, two-repository project
+  isolation, global-only recall outside Git, and prompt idempotency.
+
+### Fixed
+
+- Codex setup no longer launches the memory MCP through `npx` or a Windows `.cmd`
+  shim. It writes absolute paths for the active Node executable and packaged
+  `mcp-server/boot.js` entry point after validating Node.js >= 22.5.0.
+- Existing plugin-owned `[mcp_servers.memory-agent]` sections, including the legacy
+  `opencode-memory-plugin` entry, are migrated in place without modifying unrelated
+  TOML sections or creating duplicates.
+- Repeated prompt setup now collapses duplicate plugin-owned blocks while preserving
+  user-authored AGENTS.md / CLAUDE.md content.
+- README tool counts match the v1.6.3 implementations: 15 MCP tools, 16 native
+  OpenCode tools, and 17 unique tool names across both surfaces. The OpenCode tool
+  list and the MCP-only status of `batch_query_knowledge_base` are documented explicitly.
+
+## [1.6.2] - 2026-08-12
 
 ### Added
 
@@ -272,5 +294,8 @@ a critical retrieval regression introduced after `v1.5.3`.
 - `BENCHMARKS.md` tables were re-derived from the stored JSON artifacts; the
   bge-m3 section had carried e5-small numbers shifted by a column.
 
-[1.6.1]: https://github.com/Lotargo/memory_pugin/releases/tag/v1.6.1
-[1.6.0]: https://github.com/Lotargo/memory_pugin/releases/tag/v1.6.0
+[1.6.9]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.9
+[1.6.8]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.8
+[1.6.7]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.7
+[1.6.1]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.1
+[1.6.0]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.0