@tpsdev-ai/flair 0.53.0 → 0.54.2

package/docs/upgrade.md

@@ -39,7 +39,11 @@ flair doctor
 `flair upgrade` checks and upgrades the npm-global packages (`@tpsdev-ai/flair`,
 `@tpsdev-ai/flair-mcp`) and, if present, the `openclaw-flair` plugin (via
 `openclaw plugins install --force --pin`, not `npm install -g` — it needs OpenClaw's
-own plugin loader). Pass `--all` to also see `flair-client` (normally hidden as a
+own plugin loader). It also refreshes every `@tpsdev-ai/flair-mcp@<version>` pin
+it previously wrote — MCP server entries **and** SessionStart hook commands —
+for each already-wired client (`~/.claude.json`, `~/.claude/settings.json`,
+`~/.codex/config.toml`, `~/.codex/hooks.json`, and the other auto-wired clients).
+Pass `--all` to also see `flair-client` (normally hidden as a
 transitive dependency). **Other integrations upgrade in their own ecosystem, not via
 `flair upgrade`:** `pi-flair` (pi's plugin manager), `langgraph-flair` / `hermes-flair`
 (pip / your Python package manager), `n8n-nodes-flair` (n8n's Community Nodes UI).
@@ -264,6 +268,20 @@ flair upgrade --target https://<fabric-node>/<instance-name> \
   --fabric-user <admin> --fabric-password <pass>
 ```
 
+### Post-deploy embedding-stamp verify
+
+As of flair#1073, both `flair deploy` and `flair upgrade --target` poll
+authenticated `/HealthDetail` after the served-API check until the
+`embedding-stamp` migration has converged — every real embedding is in the
+current `+searchprefix` space, and the migration is not halted or still
+running. Route verify only proves the component is serving; it does not
+prove the boot-keyed re-embed actually finished. A Fabric instance that
+stayed split for days after 0.30.0 was the incident this closes.
+
+`--no-verify` skips this check together with the served-API check.
+`--verify-timeout` covers both. Token-only auth skips the stamp check
+(it needs Basic admin to read `/HealthDetail`) and says so.
+
 ### Post-deploy fleet verify
 
 As of flair#636, both `flair deploy` and `flair upgrade --target` automatically run a
@@ -287,10 +305,10 @@ Exit codes:
 
 | Code | Meaning |
 |------|---------|
-| 0 | All nodes verified: healthy, authenticated, and version-matched |
+| 0 | All probed nodes verified. Unverifiable peers (no endpoint on file) are listed as a warning and do not fail |
 | 1 | Origin failed (unreachable, unauthenticated, or wrong version) |
-| 2 | Origin OK, but a reachable peer is running a different version (skew) |
-| 3 | Origin OK, no skew among reachable peers, but a peer couldn't be verified at all (unreachable, auth rejected, or no endpoint on file) |
+| 2 | A reachable node diverged (wrong version) — NOT converged |
+| 3 | A reachable peer was unreachable or rejected auth (not unverifiable) |
 
 **What "peer" means here — read before trusting a green sweep:** this checks
 *Flair's own* federation peer table, not Harper Fabric's own cluster-replication
@@ -300,8 +318,9 @@ in this cluster and are they in sync") is harper-pro-only and unavailable in the
 Fabric's own replication topology, on the origin or anywhere else. A Fabric replica
 that was never separately paired as a Flair federation peer (`flair federation pair`)
 is invisible to this sweep: `0 peers known` means "0 peers on file," never "0 peers
-exist." A peer with no usable endpoint is reported `unverifiable` — never silently
-dropped, never shown green. The sweep also needs Basic-auth credentials
+exist." A peer with no usable endpoint is reported `unverifiable` — listed and
+warned, never shown green, and does not fail the run (a reachable peer on the
+wrong version still does). The sweep also needs Basic-auth credentials
 (`FABRIC_USER`/`FABRIC_PASSWORD` env, or the discouraged inline
 `--fabric-user`/`--fabric-password`) to authenticate each peer probe; a token-only
 (`--fabric-token`) deploy skips it with a note instead of a silent no-op.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.53.0",
+  "version": "0.54.2",
   "packageManager": "bun@1.3.10",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
@@ -46,10 +46,10 @@
   ],
   "scripts": {
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
-    "prebuild": "npm run clean",
+    "prebuild": "npm run clean && node scripts/vendor-tool-descriptors.mjs",
     "build": "tsc -p tsconfig.json --noCheck && node scripts/write-build-info.mjs",
     "build:cli": "tsc -p tsconfig.cli.json --noCheck && node scripts/write-build-info.mjs",
-    "prepublishOnly": "npm run build && npm run build:cli",
+    "prepack": "npm run build && npm run build:cli",
     "test": "bun run test:unit",
     "test:unit": "bun scripts/test-unit.ts",
     "test:e2e": "playwright test",
@@ -80,7 +80,7 @@
     "fast-uri": "^4.1.3",
     "hono": "^4.13.5",
     "js-yaml": "^4.3.2",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "@opentelemetry/core": "^2.8.0",
     "uuid": "^11.1.1",
     "tar": "^7.5.22",

package/schemas/agent.graphql

@@ -76,3 +76,18 @@ type Integration @table(database: "flair") @export {
   createdAt: String!
   updatedAt: String
 }
+
+# Per-agent read-position (watermark) — durable catch-up cursor (flair#931).
+# A monotonic position per (agent, stream), not a wall-clock `since`. Reused
+# by OrgEventCatchup today and the light-comms board later (#1583); the stream
+# name is the only table-specific part. Not @export: agents use
+# /AgentReadPosition and /OrgEventCatchup, never raw-table REST. Owner-scoped
+# (each agent reads/advances only its own). Advance-on-ack, never silently
+# truncated. See resources/agent-read-position-lib.ts.
+type AgentReadPosition @table(database: "flair") {
+  id: ID @primaryKey          # `${agentId}:${stream}`
+  agentId: String! @indexed
+  stream: String! @indexed    # e.g. "org-event"
+  position: String!           # opaque total-order watermark; lexicographic compare
+  updatedAt: String!
+}