@vib795/agent-memory 0.5.1 → 0.6.0

package/README.md

@@ -1,17 +1,45 @@
 # agent-memory
 
-[![npm](https://img.shields.io/npm/v/@vib795/agent-memory)](https://www.npmjs.com/package/@vib795/agent-memory)
-[![test](https://github.com/vib795/agent-memory/actions/workflows/test.yml/badge.svg)](https://github.com/vib795/agent-memory/actions/workflows/test.yml)
-[![release](https://github.com/vib795/agent-memory/actions/workflows/release.yml/badge.svg)](https://github.com/vib795/agent-memory/actions/workflows/release.yml)
-[![provenance](https://img.shields.io/badge/provenance-attested-brightgreen)](https://www.npmjs.com/package/@vib795/agent-memory)
-[![node](https://img.shields.io/badge/node-%3E%3D22.5-brightgreen)](https://nodejs.org)
-[![dependencies](https://img.shields.io/badge/runtime%20dependencies-0-brightgreen)](package.json)
-[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+**Durable memory for Claude Code and GitHub Copilot — that survives an IT security review.**
+
+Your agent forgets everything between windows. Most tools that fix that cannot be
+installed where you actually work.
+
+This one has **zero runtime dependencies, zero dev dependencies, and no install
+script**. Nothing runs when you install it; granting it your agents is a second,
+separate command. It has been [independently scanned](#independently-scanned) and
+passed. `npm ls -g --depth 0` shows nothing underneath it, because there is nothing
+underneath it.
+
+## Install
+
+Two commands, and the second one is not optional — it creates the store and installs
+into every agent on the machine, in whatever format that tool reads:
+
+```bash
+npm install -g @vib795/agent-memory
+agent-memory setup
+```
+
+Node >= 22.5, and nothing else.
 
-Give **GitHub Copilot** and **Claude Code** a memory that outlives the window, the
-repository, and the week — using nothing an IT security review would need to approve.
+In Claude Code you can take the three skills as a plugin instead of letting `setup`
+link them:
 
-Three user-level Agent Skills over one local store:
+```
+/plugin marketplace add vib795/agent-memory
+/plugin install agent-memory@vib795
+```
+
+The plugin carries the skills; `npm` carries the store. You want both — the skills
+will tell you so if you only have one.
+
+Behind a proxy that quarantines npm, or want the GitHub Packages mirror?
+[Every install path is here](#install-1).
+
+## What you get
+
+Three user-level Agent Skills over one local markdown store:
 
 | Skill | What it does |
 |---|---|
@@ -19,9 +47,23 @@ Three user-level Agent Skills over one local store:
 | `/remember` | Captures durable knowledge into a cross-repo graph — and fires on its own when a juncture passes |
 | `/recall` | Answers from that graph before deriving anything again |
 
-**New here? Read the [HOW-TO](HOWTO.md)** — install, first five minutes, and the
-per-tool notes for Claude Code, Codex and Copilot, written for people who do not
-want to read the rest of this file.
+The store is plain markdown in `~/.agents/memory/`, outside every repository — which
+is what lets a note written in one project be read from another. Nothing leaves the
+machine: no daemon, no scheduled task, no telemetry.
+
+**New here?** [HOWTO.md](HOWTO.md) — install, first five minutes, and the per-tool
+notes for Claude Code, Codex and Copilot.
+
+**How does it work?** [ARCHITECTURE.md](ARCHITECTURE.md) — the source-of-truth split,
+the write and read paths, the tiered context cost, and the invariants underneath.
+
+[![npm](https://img.shields.io/npm/v/@vib795/agent-memory)](https://www.npmjs.com/package/@vib795/agent-memory)
+[![test](https://github.com/vib795/agent-memory/actions/workflows/test.yml/badge.svg)](https://github.com/vib795/agent-memory/actions/workflows/test.yml)
+[![release](https://github.com/vib795/agent-memory/actions/workflows/release.yml/badge.svg)](https://github.com/vib795/agent-memory/actions/workflows/release.yml)
+[![provenance](https://img.shields.io/badge/provenance-attested-brightgreen)](https://www.npmjs.com/package/@vib795/agent-memory)
+[![node](https://img.shields.io/badge/node-%3E%3D22.5-brightgreen)](https://nodejs.org)
+[![dependencies](https://img.shields.io/badge/runtime%20dependencies-0-brightgreen)](package.json)
+[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
 ## Why this exists
 
@@ -207,6 +249,33 @@ name on it. What this is not: it is not encryption, access control, or a DLP pro
 It is one command that refuses to hand over identifiers, and it says exactly what it
 checked.
 
+### Independently scanned
+
+Public supply-chain scanners index every package published to npm, so this one is
+reviewed by people who owe it nothing. That is worth more than a clean claim from its
+author.
+
+[LPM Firewall](https://firewall.lpm.dev/npm/@vib795/agent-memory) currently reports
+**Passed — safe to install**, with no policy match and no flagged code. Its reading of
+the artefact — signed, provenance attached, zero dependencies, no install hooks — is a
+third-party check on what this README says about itself. Four low-signal patterns
+remain, and they are descriptive rather than policy: environment variables, scripts
+present, filesystem, high-entropy strings. That is what a CLI which reads
+`AGENT_MEMORY_HOME` and writes files in your home directory looks like from outside.
+
+**It did not start there.** Version 0.3.1 was flagged **Critical — AI Agent Control
+Hijack**, because `postinstall` wrote skill files into `~/.claude`, `~/.codex` and your
+editor's prompt folder. The finding was correct. An install script that grants an AI
+agent new instructions without the user asking is indistinguishable from an attack
+that does exactly that, and good intent is not observable to a scanner. The hook was
+removed in 0.4.0 rather than argued with, which is why `agent-memory setup` is a
+command you type.
+
+The 0.3.1 report is still public and still says Critical. Old version pages do not
+come down, and they should not: a supply-chain record that could be edited after the
+fact would be worth nothing. What a project can offer is the next version and the
+reason for it.
+
 ## Engagements
 
 If you work for more than one client on one machine, knowledge from one of them is
@@ -445,7 +514,7 @@ Claude Code can take the same three as a plugin:
 
 ```
 /plugin marketplace add vib795/agent-memory
-/plugin install agent-memory@agent-memory
+/plugin install agent-memory@vib795
 ```
 
 The same caveat applies: the plugin carries the skills, `npm` carries the store.
@@ -472,7 +541,7 @@ is generated state, and the committed value is only a placeholder.
 
 Needs Node 22.5 or newer; `doctor` says so plainly if the version is too old.
 
-Run `npm test` for the suite (88 tests, no dependencies). CI runs it on Linux,
+Run `npm test` for the suite (91 tests, no dependencies). CI runs it on Linux,
 macOS and Windows across Node 22 and 24, and separately installs the packed tarball
 and exercises it end to end on all three.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vib795/agent-memory",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Durable cross-repo knowledge graph for GitHub Copilot and Claude Code. Markdown source of truth, disposable SQLite index, zero runtime dependencies.",
   "keywords": [
     "github-copilot",

package/src/cli.js

@@ -75,7 +75,7 @@ function git(args, cwd = process.cwd()) {
 const USAGE = `agent-memory — durable cross-repo knowledge for coding agents
 
   setup                                  link all three skills, build the store
-                                         (runs automatically on npm install)
+                                         (run this once, by hand, after install)
   uninstall                              remove the skill links; keeps every note
   init [--skills "<p1>,<p2>"]            create the store; register skill files
   index                                  rebuild index.db from notes/

package/src/promptfile.js

@@ -15,7 +15,7 @@ export const GENERATED_MARKER =
 
 /** Split a leading `---` frontmatter block from the body. */
 function splitFrontmatter(text) {
-  const src = String(text).replace(/^/, '').replace(/\r\n/g, '\n');
+  const src = String(text).replace(/^\uFEFF/, '').replace(/\r\n/g, '\n');
   if (!src.startsWith('---')) return { head: '', body: src.trim() };
   const end = src.indexOf('\n---', 3);
   if (end === -1) return { head: '', body: src.trim() };