audrey 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 1.1.2 - 2026-07-13
+
+### Guard signal quality
+
+- Consolidation now sweeps every real owning agent instead of the CLI utility agent, so `audrey dream` and reflection actually convert episodes into semantic and procedural knowledge on stores that previously reported "evaluated 0 episodes".
+- Failure streaks are self-extinguishing: `failure_count` counts failures since the tool's last success in scope, and a subsequent success retires the warning instead of letting it nag at high confidence for the full window. Same-instant ties order by monotonic event id and fail toward warning. `include_resolved` preserves the raw diagnostic view.
+- Tool-failure signals are project-scoped: `memory_recent_failures`, `memory_capsule`, and preflight accept a `cwd` and exclude failures recorded in other projects. Directionality is asymmetric on purpose — failures without a recorded directory stay visible because they cannot be proven foreign, while only a success provably from the current project can extinguish a local streak. Autopilot passes the working directory even under shared scope, so cross-project semantic knowledge still travels while foreign failure noise does not.
+- Autopilot-learned tool-failure episodes (tool-result source) now categorize as risks, are tool-matched at medium severity in preflight, and cap their error summaries in capsules at 240 characters. User-authored memories that carry the same tag keep full high-severity risk treatment.
+- Redaction no longer destroys machine identifiers such as MCP tool names: consistently-cased word identifiers (three or more separator-delimited all-lowercase or all-uppercase segments) are exempt from the high-entropy secret rule. Title-cased memorable passphrases and digit-bearing tokens still redact.
+
+### Injection efficiency
+
+- Compact packet format (default; `AUDREY_PACKET_FORMAT=verbose` reverts): entries render as `[memory_id confidence] "content"` lines with a one-line safety preamble. Content stays JSON-quoted; injection-safety invariants are unchanged.
+- Session-delta injection (default; `AUDREY_PACKET_DELTA=0` reverts): each memory is injected once per session instead of on every prompt. SessionStart delivers the full packet and seeds the tracker; the tracker clears on session start and compaction — the moments earlier packets can leave the context window. A memory whose state changes after injection (for example, becoming disputed) reinjects with its new standing. Measured on a production store this removed a repeated 3.5k-character packet from every prompt after the first.
+
+### MCP Registry
+
+- Publishes Audrey to the official MCP Registry as `io.github.evilander/audrey` via GitHub OIDC in the release pipeline, after the npm publish gates pass.
+
+## 1.1.1 - 2026-07-10
+
+### npm 12 install compatibility
+
+- Documents and emits a least-privilege global install command that explicitly allows only Audrey's four required dependency lifecycle scripts. This keeps SQLite and local inference working under npm 12's new default-deny install-script policy without enabling arbitrary package scripts.
+- Adds pinned project-level npm 12 approvals for Audrey's current native/runtime dependencies and regression coverage for the CLI guidance.
+- Pins the trusted npm publisher to npm 11.14.1 so the immutable 1.1.0 tag can be recovered safely after npm 12 withheld `better-sqlite3`'s native binding during its first publish attempt.
+
 ## 1.1.0 - 2026-07-09
 
 ### Audrey Autopilot

package/README.md

@@ -34,10 +34,12 @@ The model does not have to remember that a memory tool exists. That is the point
 Install Audrey once, review the hooks once, and then use Codex or Claude Code normally.
 
 ```bash
-npm install -g audrey
+npm install -g audrey --allow-scripts=better-sqlite3,onnxruntime-node,sharp,protobufjs
 audrey install --host auto
 ```
 
+The explicit install-script list is for npm 12's safer dependency policy. It permits only the four packages Audrey needs for SQLite, local inference, and their generated runtime files. With npm 11 or earlier, the shorter `npm install -g audrey` is equivalent.
+
 `auto` configures whichever supported CLIs are installed. You can choose one explicitly:
 
 ```bash
@@ -76,7 +78,7 @@ This is more useful than “the vector search found a vaguely similar error.”
 Try the complete loop without an API key or network call:
 
 ```bash
-npx audrey demo --scenario repeated-failure
+audrey demo --scenario repeated-failure
 ```
 
 ## What Audrey remembers
@@ -127,12 +129,10 @@ Vector candidates are partitioned by agent before nearest-neighbor ranking, so o
 ## See it before installing anything
 
 ```bash
-npx audrey doctor
-npx audrey demo
-npx audrey install --host auto --dry-run
+npm exec --yes --package=audrey --allow-scripts=better-sqlite3,onnxruntime-node,sharp,protobufjs -- audrey demo --scenario repeated-failure
 ```
 
-The dry run prints the MCP and lifecycle-hook configuration for both hosts without changing files.
+That command runs from the npm cache, exercises the full SQLite-backed Guard loop, and leaves host configuration unchanged.
 
 <div align="center">
   <img src="docs/assets/audrey-feature-grid.jpg" alt="Audrey memory continuity, recall, evidence, local storage, and memory-before-action" width="760">
@@ -165,6 +165,13 @@ npm install audrey
 pip install audrey-memory
 ```
 
+For a project install with npm 12, approve Audrey's reviewed dependency scripts in the project root and rebuild once if npm reported that it blocked them:
+
+```bash
+npm install-scripts approve better-sqlite3 onnxruntime-node sharp protobufjs
+npm rebuild
+```
+
 For Autopilot, prefer a global or otherwise stable installation. Hook and MCP configuration pins the actual Node executable and Audrey entrypoint; an ephemeral `npx` cache is not a durable production runtime.
 
 ### Host configuration
@@ -340,6 +347,8 @@ The server also sends host instructions explaining the Guard receipt loop when l
 | `AUDREY_DEVICE` | `gpu` | Local embedding device; falls back to CPU |
 | `AUDREY_CONTEXT_BUDGET_CHARS` | `4000` | Maximum default capsule size |
 | `AUDREY_AUTOPILOT_SCOPE` | `agent` | `agent` or explicit cross-agent `shared` recall for hooks |
+| `AUDREY_PACKET_FORMAT` | `compact` | Injected packet style: `compact` line format or `verbose` key=value |
+| `AUDREY_PACKET_DELTA` | `1` | Inject each memory once per session; `0` resends full packets every prompt |
 | `AUDREY_HOOK_FAIL_CLOSED` | `0` | Deny guarded actions when Audrey itself fails |
 | `AUDREY_API_KEY` | unset | Bearer token for REST access |
 | `AUDREY_HOST` | `127.0.0.1` | REST bind address |
@@ -381,7 +390,7 @@ npm run pack:check
 GuardBench currently contains ten local, deterministic pre-action scenarios covering repeated failures, procedures, scope changes, recovery, redaction, conflicting instructions, and noisy stores. The checked-in v1 methodology uses a mock 64-dimensional embedding provider and exists to catch regressions. A perfect local pass is not a claim about real-provider latency or production false-positive rates.
 
 <!-- guardbench-summary:start -->
-Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 3.501ms / 20.658ms p50/p95 Guard latency under the mock-provider methodology.
+Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 4.253ms / 21.196ms p50/p95 Guard latency under the mock-provider methodology.
 <!-- guardbench-summary:end -->
 
 `benchmarks/perf-snapshot.js` measures encode and hybrid-recall p50/p95/p99 at configurable corpus sizes with machine and provider provenance. Run it on the hardware and embedding provider you plan to operate; hosted-provider latency is dominated by its network round trip.

package/benchmarks/output/adapter-self-test/guardbench-adapter-self-test.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench adapter self-test",
-  "generatedAt": "2026-07-10T15:00:46.455Z",
+  "generatedAt": "2026-07-13T14:48:54.144Z",
   "ok": true,
   "adapter": {
     "name": "Example Allow Adapter",
@@ -27,9 +27,9 @@
     "evidenceRecall": 0.1,
     "redactionLeaks": 0,
     "latency": {
-      "p50Ms": 0.01,
-      "p95Ms": 0.042,
-      "maxMs": 0.042
+      "p50Ms": 0.011,
+      "p95Ms": 0.041,
+      "maxMs": 0.041
     }
   },
   "contract": {

package/benchmarks/output/external/guardbench-external-dry-run.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench external adapter dry-run matrix",
-  "generatedAt": "2026-07-10T15:00:47.009Z",
+  "generatedAt": "2026-07-13T14:48:54.712Z",
   "ok": true,
   "registry": "benchmarks/adapters/registry.json",
   "outRoot": "benchmarks/output/external",

package/benchmarks/output/external/guardbench-external-evidence.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench external evidence verification",
-  "generatedAt": "2026-07-10T15:00:47.285Z",
+  "generatedAt": "2026-07-13T14:48:54.992Z",
   "ok": true,
   "allowPending": true,
   "registry": "benchmarks/adapters/registry.json",

package/benchmarks/output/guardbench-conformance-card.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench conformance card",
-  "generatedAt": "2026-07-10T15:00:42.135Z",
+  "generatedAt": "2026-07-13T14:48:49.667Z",
   "sourceDir": "benchmarks/output",
   "manifestVersion": "0.2.0",
   "suiteId": "guardbench-local-comparative",
@@ -25,9 +25,9 @@
     "evidenceRecall": 1,
     "redactionLeaks": 0,
     "latency": {
-      "p50Ms": 3.501,
-      "p95Ms": 20.658,
-      "maxMs": 20.658
+      "p50Ms": 4.253,
+      "p95Ms": 21.196,
+      "maxMs": 21.196
     }
   },
   "conformance": {
@@ -39,14 +39,14 @@
   "integrity": {
     "artifactHashes": {
       "guardbench-manifest.json": "57636ce19fdaa6e50fc3fc961d9e499a9f43632f588c713a9fefe8e8a6fa724c",
-      "guardbench-summary.json": "88cd54e091e5aa89e7ef873a2e440430b3c35eb3f4664d963a56d197cc3691e9",
-      "guardbench-raw.json": "1888c8524d54f10bb403ef09b923cec63376518bf6d202ef271ba895811d37d8"
+      "guardbench-summary.json": "3ba1c059558aa8b511ae510276078930649ba6aca9669324148726fac10c7ee8",
+      "guardbench-raw.json": "786b03ff8570444620c23b35621bbb14897f06310de7e8bd3a337a1acf5ce776"
     },
     "externalRunMetadataHash": null
   },
   "provenance": {
-    "generatedAt": "2026-07-10T15:00:41.781Z",
-    "gitSha": "af2534b9dc5b980fb879e88ca63afd502480dd24",
+    "generatedAt": "2026-07-13T14:48:49.313Z",
+    "gitSha": "7111c630be69d3ab96439018f094dc4fac826aca",
     "gitDirty": false,
     "node": "v24.18.0",
     "v8": "13.6.233.17-node.50",