audrey 2.0.0 → 2.1.1

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 2.1.1 - 2026-10-28
+
+### ChatGPT sign-in
+
+- Every refresh failure OpenAI documents as terminal (`invalid_grant`, `invalid_refresh_token`, `token_expired`, `refresh_token_expired`, `refresh_token_invalidated`, `refresh_token_reused`) now clears the stored tokens and asks for a new sign-in. 2.1.0 did that for `invalid_grant` only, so the other five left a dead grant in place that every later call retried against the authorization server. Any other error code keeps the credentials, as the documentation asks.
+- A token that is still valid is served straight from the credential file without taking the writer lock, so concurrent hook processes no longer queue behind one another to read it. When a refresh is needed, discovery and the signing keys are fetched before the lock is taken, the lock is removed only by the process whose stamp it still carries, and the credential file's rename is followed by a directory fsync.
+- A malformed request to the sign-in callback listener answers 400 instead of crashing the process that is waiting for the browser.
+- `AUDREY_CHATGPT_AUTH_DIR` may start with `~`, and `audrey install` resolves it to an absolute path before writing hook commands, so a relative or home-relative value no longer produces a different credential store for every project directory.
+- An `earliest_refresh_at` later than the token's own expiry is ignored rather than trusted; the field's unit is undocumented, and trusting a far-future value locked the account out until a manual login.
+- `audrey auth logout` reports `revoked: false` when the account held an access token but no refresh token to revoke; it previously reported success while the access token stayed valid until expiry.
+- On Windows, `powershell.exe` is launched by its installed path rather than looked up on `PATH` from a hook running inside the user's repository.
+
+### Release workflow
+
+- The MCP Registry publish waits for npm to list the new version before registering it. npm now processes a published package for a few minutes before it is visible, and the 2.1.0 registry publish failed on that window and had to be re-run by hand.
+
+## 2.1.0 - 2026-10-28
+
+### Guard can check what an action returned
+
+- `beforeAction` accepts `successChecks`: up to 16 comparisons, each naming a JSON Pointer into the output that `afterAction` will receive and the scalar value found there must equal. The receipt stores the compiled contract with expected values as SHA-256 fingerprints rather than plaintext, so the expectation is fixed before the action runs and a later `afterAction` cannot replace it. A reported success whose checks mismatch is recorded as `failed`; one whose checks cannot be evaluated (value missing, string that is not JSON when `parseJson` is set) is recorded as `unknown`; a reported failure stays failed, and passing checks never promote an unknown execution outcome to success. Blocked and skipped actions do not run the checks. MCP `memory_guard_before` takes `success_checks`, REST `POST /v1/guard/before` takes `success_checks` or `successChecks`, and `GuardOutcome` gains `reported_outcome` and `verification`. The contract and its limits are in `docs/SUCCESS_CHECKS.md`.
+- A failed check stays active for the exact-failure window until a later success passes the same contract. A retry that omits the checks, or declares different ones, does not clear it or hide it; the failure stands until a success passes the original contract or the exact-failure window ends. The older `MemoryController.beforeAction(AgentAction)` interface rejects `successChecks`; use `Audrey.beforeAction` and `Audrey.afterAction`.
+- `afterAction` records the outcome, the post-event, and any evidence feedback inside one immediate transaction and emits its events after the commit. Two hook processes closing the same receipt at once could previously both read "no outcome yet" and both write one, applying the same evidence feedback twice. It also rejects an outcome outside `succeeded`, `failed`, `blocked`, `skipped`, and `unknown` instead of storing it, and it sets `read_only` on the recorded outcome from the receipt rather than from caller metadata, so a failure cannot be kept out of failure learning by labelling it read-only.
+- Autopilot passes an explicit `unknown` outcome through instead of treating a zero exit code as success, learns a failure from the persisted outcome's error summary so a verification failure behind a clean exit still produces a failure memory, and the legacy controller path no longer writes a failure memory for a read-only command's non-zero exit.
+- The exact-action fingerprint keeps the command's case and whitespace. Folding both meant `rm -rf build` and `rm -rf BUILD` shared one failure history on a case-sensitive filesystem, and quoted arguments lost their spacing. Autopilot keys, which fingerprint the host's tool-input digest, are unchanged. Non-digest keys recorded through the SDK, MCP, or REST before this release do not match the exact-repeat check after upgrading; those failures still surface through the recent-failure path, which matches by what a command runs.
+
+### Reflection and consolidation on a ChatGPT subscription
+
+- `AUDREY_LLM_PROVIDER=chatgpt` runs reflection and consolidation through OpenAI's Responses API with a signed-in ChatGPT plan instead of an API key. `audrey auth login` completes the browser sign-in (`--no-browser` prints the URL instead of opening it; `--consent` asks for plan usage when it was not granted the first time), and `audrey auth status`, `accounts`, `select --account <ID>`, and `logout` manage saved registrations. ID tokens are verified against OpenAI's published keys (new dependency: `jose`). Credentials live in `AUDREY_CHATGPT_AUTH_DIR` (default `~/.audrey/auth`, created `0700` with `0600` files), outside the memory database, and `status` and `accounts` report connection state without printing tokens. The provider confirms the selected model is available to the account before using a new token, never substitutes a different model, and never falls back to API billing. Requests are sent with `store: false`, and the first request in a process prints the same one-line stderr notice the API providers print before memory content leaves the machine. On Windows the owner-only ACL is applied through the .NET access-control API rather than `Set-Acl`, so it needs neither an elevated shell nor a loadable PowerShell module.
+- `AUDREY_LLM_REASONING_EFFORT` (`low`, `medium`, `high`, `xhigh`, or `max`) sets the reasoning effort for the `chatgpt` provider, which defaults to `medium`, and for the `openai` provider, which sends no `reasoning_effort` unless the variable is set, since chat-tuned and older reasoning models reject the parameter. The `openai` provider's default model moves from `gpt-4o` to `gpt-6.1-sol`, and its `max_completion_tokens` handling now covers `gpt-6` models.
+- Autopilot hook commands accept `--llm-reasoning-effort`, `--chatgpt-auth-dir`, and `--chatgpt-account`, and `audrey install` writes them from the matching environment variables.
+
+### Promote
+
+- Promoted rule files are named by memory identity (`.claude/rules/audrey-sem-<hash>.md` and `audrey-proc-<hash>.md`) rather than by a slug of the title. Two memories whose titles slugified the same, or that differed only in case on a case-insensitive filesystem, could previously land in one file, and a memory id from an imported snapshot never becomes part of a path.
+- An existing rule file is preserved, not overwritten. Promotion reads the generated provenance header at the new name and at the older slug name, including the numbered variants the old renderer wrote; a file carrying this memory's provenance is recorded as already promoted and left as it is, so a rule someone edited survives a re-run. A file at the destination with different provenance is an error instead of an overwrite. New files are published by hard-linking a private temporary file into place, which fails rather than replaces when something else wrote the path first, so two promotions racing cannot clobber each other. On a filesystem without hard links (exFAT, some network and container mounts) the file is created with an exclusive open instead, which keeps the same no-overwrite guarantee. `overwritten` in the result is always `false` now.
+- Promotions are recorded in a ledger inside the store (`audrey_config` keys prefixed `promotion_ledger:`) as well as in the activity log. The event retention sweep deletes old `Promotion` events, which made the candidate search forget what had been promoted and offer it again; the sweep now copies each promotion into the ledger before deleting its event, and `memory_export` and `memory_import` round-trip the ledger.
+- The footer of a generated rule no longer points at an `audrey forget` command that does not exist. It names the `memory_forget` tool and the SDK call, and says that retracting the memory does not delete the file.
+
+### Recall
+
+- Keyword candidates are scored the same way as vector candidates. A semantic or procedural memory that only full-text search found used to get a reduced confidence (its support ratio alone, with no age, interference, or salience), so hybrid ranking fused two different scales; both paths now run the same confidence and provenance computation, and `min_confidence` applies uniformly during fusion.
+- Full-text search includes `context_dependent` semantic and procedural memories, and `dormant` ones when `include_dormant` is set. It previously matched only `active` rows, so a memory the vector path would return could be invisible to a keyword query for the same words.
+- The post-encode contradiction check finds the nearest semantic memory with a bounded nearest-neighbour query instead of computing a distance to every one of the agent's semantic rows and sorting them. When the nearest vector belongs to a retired memory it runs one more indexed query restricted to live rows.
+- `greeting` excludes superseded episodes from its recent, identity, unresolved, and affect summaries, and `encode` with `supersedes` and `resolveTruth` drop or restore the affected row's vector immediately rather than at the next sweep.
+- `recall` requires an integer `limit` of at least 1 (the MCP schema now rejects fractions), and the local embedding provider rejects a `batchSize` that is not a positive integer.
+
+### Encode, import, and consolidation
+
+- `encodeBatch` validates every item before writing any of them. The context, causal, and supersedes checks lived only in the single-item path, so a batch with a bad later item committed its earlier items, queued their post-encode work, and then threw without returning their ids.
+- `encode` validates what it is given: `context` must be an object of string values and is redacted as one document, `causal` must carry string `trigger` and `consequence` values, and `supersedes` must name an episode owned by the acting agent. An agent could previously supersede another agent's episode by id.
+- Import no longer caps snapshot size (50,000 characters per content field, 25,000 rows per section, 25 MB of content in total). Those caps blocked restoring a store that was simply larger than an interactive request; shape validation stays, and embedding runs in batches of 256 with each returned vector checked for the right dimension and finite values. Imported semantic and procedural memories inherit `private` from any private evidence episode in the snapshot, matching what consolidation does.
+- Each consolidation run records a commit sequence in its undo journal, assigned under the write lock, because run ids and timestamps record when preparation started rather than the order merges committed. Rollback refuses a run that is not `completed`, and refuses to undo a merge that a later completed run built on until that later run is rolled back first; two journals without sequences whose completion times tie are refused rather than guessed.
+
+### REST sidecar
+
+- Startup and shutdown are deliberate. `startServer` resolves only after the listener is bound and rejects, closing the store and any sockets, if binding fails. `close()` stops accepting connections, waits for in-flight requests up to `shutdownTimeoutMs` (default 10 seconds), then drains queued post-encode work and reports any that did not finish. `audrey serve` handles `SIGINT` and `SIGTERM` the same way and forces exit one second past the grace period.
+- The API key comparison refuses an `Authorization` header longer than its fixed 4 KiB compare buffer instead of silently comparing only the first 1 KiB, and the configured key must fit that buffer; the compare itself stays constant-time over the whole buffer.
+- Routes with optional bodies (`consolidate`, `dream`, `decay`, `greeting`) answer 400 to a body that is not a JSON object instead of treating it as empty. `validate` answers 400 to an unknown `outcome` instead of recording it as `used`. `encode` accepts `causal`, requires string context values, and accepts `supersedes` only when admin tools are enabled, because retiring a memory is the same class of operation as `forget` and the acting agent on this transport is whatever the caller named. `capsule` accepts `cwd`. `forget` by query and `reflect` act as the request's agent rather than the server's default agent.
+
+### Hosts and CLI
+
+- `audrey --help` and `-h` work after a subcommand, and `audrey auth` joins the command list.
+- `server.json` (the MCP Registry listing) is a release version surface: the release cut bumps it with the other four, readiness checks it for alignment, and it now lists the embedding, LLM, and admin-tools variables alongside the data directory and agent name. It had declared 1.1.3 since that release.
+- The shell classifier no longer treats `git remote -v add …` or `git remote --verbose set-url …` as read-only, since the verbose flag is a global option that can precede a mutating subcommand, and a redirect to `nul` or `NUL:` counts as a write, because under Bash on Windows those names can be ordinary files.
+
+### Python SDK
+
+- `StatusResponse` matches what `/v1/status` returns: `episodes`, `semantics`, `procedures`, `healthy`, the vector and searchable counts, dimensions, schema version, warm-up, and recall-health fields. The previous model's fields were never populated. `episodic`, `semantic`, and `procedural` remain as read-only aliases. `context` on encode and recall is typed `dict[str, str]` and rejected client-side otherwise, and the README states that snapshot export and restore need `AUDREY_ENABLE_ADMIN_TOOLS=1` on the sidecar.
+
+### Dependencies
+
+- The production dependency audit is clean again. `@modelcontextprotocol/sdk` moves to 1.32 (six advisories against the HTTP transports, OAuth client, and bearer-token checks, none of which the stdio server uses but all of which ship in the package), `zod` to 4.6.7 (memory exhaustion while validating oversized constrained collections), `hono` to 4.13.14 and `@hono/node-server` to 2.1 (`serveStatic` double-decoding, unused here; the node-server major drops Node 18 and the Vercel adapter and changes nothing Audrey calls), and the transitive `sharp`, `body-parser`, `proxy-addr`, `qs`, `ip-address`, and `fast-uri` pins to their patched releases.
+
+### Documentation
+
+- The README describes each feature by what it checks and what it does not: Guard verifies action fingerprints and declared result checks, not whether a prose prerequisite was satisfied; grounding checks that paths and scripts still exist, not that they are correct; `impact` reports explicit feedback, not time saved; and hook latency includes process startup even with a warm model cache. `.env.example` says that Audrey does not load `.env` files itself.
+- Removes non-reference material from `docs/paper` (a copy bank, a submission plan, and a posting log), the pre-writing outline and submission notes, and the three scripts and the readiness check that existed only to validate them. The arXiv title and abstract, the two entries the paper build needs, now live in `docs/paper/arxiv-metadata.json`, which `paper:arxiv` reads. The paper pipeline itself is unchanged: claims, arXiv source and compile, the submission bundle, and the evidence ledger all still build and verify, and the paper and ledger no longer describe the removed tooling.
+
 ## 2.0.0 - 2026-09-16
 
 Breaking changes: Node 20 and Node 23 are no longer supported. The SDK's `audrey.db` now exposes Audrey's SQLite adapter instead of a `better-sqlite3` instance; code using driver-specific methods must be updated. Existing memory stores need no conversion.

package/README.md

@@ -15,19 +15,19 @@
   </p>
 </div>
 
-## Your agent should remember the work, not just the chat
+## Memory before action
 
 You fix the deploy command on Monday. On Thursday, a fresh session tries the broken version again.
 
-You explain that this repository never commits generated files. The next agent helpfully commits them.
+Audrey brings relevant project memory into the next session, checks supported tool calls before they run, and links their reported outcomes to the check that preceded them. A Guard decision carries evidence IDs you can inspect. Grounding can flag memories that reference deleted files or package scripts.
 
-You discover a subtle migration rule, write it down somewhere, and still have to remember to paste it into every new conversation.
+Try the SQLite-backed demo before configuring a host:
 
-That is the gap Audrey closes.
-
-Audrey sits beside the agent and participates in the work automatically. At the start of a session it brings back a small, relevant memory packet. When you submit a prompt, it recalls project facts, preferences, procedures, and recent risks. Before a side-effectful tool runs, Audrey checks the proposed action against prior evidence. Afterward, it links the outcome back to the exact check that preceded it.
+```bash
+npm exec --yes --package=audrey -- audrey demo --scenario repeated-failure
+```
 
-The model does not have to remember that a memory tool exists. That is the point.
+The demo simulates a failed deploy, passes read-only inspection commands through the hook, and checks a proposed retry. It does not execute a deployment or change host configuration. After npm fetches the package, the demo needs no API key, model download, or network call.
 
 ## Meet Audrey Autopilot
 
@@ -60,7 +60,9 @@ Autopilot then closes the loop:
 | A tool failure is reported | Forms a durable, sanitized failure memory for the next attempt |
 | The turn stops or context compacts | Runs lightweight, due-only consolidation without holding the conversation open |
 
-Each hook event carries a host-declared timeout (30 seconds for the `PreToolUse` Guard check); Audrey races its own internal embedding/LLM timeout a few seconds ahead of that deadline so it can exit cleanly instead of losing the race to the host's kill. Infrastructure failures are fail-open by default: if Audrey itself errors or runs out of time, the tool call proceeds unguarded rather than freezing the session. Set `AUDREY_HOOK_FAIL_CLOSED=1` to deny the action instead when the `PreToolUse` check fails this way; other lifecycle hooks (session start, prompt recall, post-tool bookkeeping) have no "deny" to fall back to and always degrade open regardless of this setting.
+An outcome reflects the tool's reported status. A zero exit code can still produce stale or incorrect output. Custom integrations can declare [required result checks](docs/SUCCESS_CHECKS.md) in `beforeAction` and supply the actual output to `afterAction`. Guard then records a mismatch as failed and an unverifiable reported success as unknown. Audrey does not generate application-specific checks or infer the expected values.
+
+Each hook event carries a host-declared timeout (30 seconds for the `PreToolUse` Guard check). Audrey caps individual hosted embedding/LLM requests below that deadline; this is not a deadline for the entire hook, and local model initialization has no equivalent internal timeout. Errors caught by Audrey fail open by default: the hook emits no decision. Set `AUDREY_HOOK_FAIL_CLOSED=1` to deny a `PreToolUse` action on a caught error. If the host terminates the process first, the host determines what happens. Other lifecycle hooks have no deny path and always degrade open on caught errors.
 
 ## A small story about a failed deploy
 
@@ -71,21 +73,17 @@ $ npm run deploy
 Error: deployment target is missing
 ```
 
-Audrey keeps a redacted trace and the exact action fingerprint. If another session proposes the same action before the problem is fixed, Guard returns a denial with evidence. Change the command or fix the target and Audrey lets the work continue. Once that exact action succeeds, the old failure no longer blocks it.
+Audrey keeps a redacted trace and an action fingerprint. If another session under the same agent identity proposes that action, Guard can deny the retry with evidence. A later recorded success for that fingerprint clears the exact-failure block. If the failed action declared result checks, recovery must pass the same checks. The default exact-failure window is seven days; other memory warnings are evaluated separately.
 
-This is more useful than “the vector search found a vaguely similar error.” Audrey creates a receipt before the action, records what happened after it, and preserves the lineage between the two.
+Fixing a file or deployment target does not itself clear the block. For a deliberate retry, the Guard API accepts `acknowledgePriorFailure: true` (MCP/REST: `acknowledge_prior_failure`; CLI: `--acknowledge-prior-failure`). Autopilot also recognizes retry language in the current user prompt. Acknowledgement lowers the exact-failure block to a warning and preserves its evidence; it does not bypass separate policy warnings.
 
-Try the complete loop without an API key or network call:
-
-```bash
-audrey demo --scenario repeated-failure
-```
+Guard does not yet evaluate whether a natural-language prerequisite has been satisfied. A trusted must-follow memory can keep blocking even after its suggested repair succeeds. Review the cited rule when that happens; changing a command's spelling is not proof that its underlying problem is fixed.
 
 ## Looking is not doing
 
-Between the failed deploy and the retry, an agent runs a lot of commands that cannot change anything: `grep` for the error, `git status`, `cat` on a config file, `ls` on a directory that turns out not to exist. A memory system that treats every one of those as a risk, or remembers `grep` finding nothing as a "failure", becomes a smoke alarm that goes off when you make toast. People stop listening, and then it is worth nothing on the day the toaster is on fire.
+Inspection commands such as `grep`, `git status`, and `cat` normally need no memory check. A non-zero exit from `grep` can simply mean there was no match.
 
-Audrey reads the command the way an engineer would. A command whose every part is positively recognised as read-only (`grep`, `git log`, `npm view`, `docker ps`, `sed -n '1,40p'`, and their kind, with no command substitution, no redirect except to `/dev/null`, no `sudo` or `xargs`, no environment assignment that could change what the verb resolves to) never reaches the Guard at all. Its exit code is recorded but never counted as a lesson. Everything else is guarded exactly as before, and anything Audrey cannot positively recognise is treated as doing.
+A command whose every part is positively recognised as read-only skips Guard. The classifier rejects command substitution, redirects other than `/dev/null`, `sudo`, `xargs`, and environment assignments that could change command resolution. Inspection outcomes can be recorded, but are excluded from failure learning. Unrecognised commands remain guarded.
 
 ```text
 $ grep -rn "prisma" src/          Guard: silent
@@ -97,11 +95,11 @@ Audrey Guard: BLOCKED
 - must_follow (high): Before running npm run deploy, run npm run db:generate because Prisma client must be generated first.
 ```
 
-That is the output of `audrey demo --scenario repeated-failure`, which runs the whole sequence with no API key and no network.
+This excerpt illustrates the output of `audrey demo --scenario repeated-failure`.
 
 When Guard does speak, it names the memory it is speaking from, and a remembered failure is matched to the proposed command by what it runs (`npm run deploy` against `npm run deploy`), not by how similar two strings look to an embedding.
 
-The line between looking and doing is drawn fail-closed and was tested adversarially before release: five independent review passes ran the classifier's "read-only" verdicts against real tools and found thirteen ways to hide a write inside a command that looked harmless (`node --check -r ./x.js`, `GIT_EXTERNAL_DIFF=./x git diff`, `sort -ofile`, a backslash-newline hiding `$(`, `jobs -x`). Every one is closed and is a test case, and the fifth pass found none left. Two limits remain by design: a git configuration that already names an external program runs on any read, and a file whose name is a flag can change what a pure reader does with a glob. Both require a prior write that Guard did see.
+Commands with execution-capable options or lifecycle scripts are guarded, including `git ls-remote --upload-pack=...`, `npm pack --dry-run`, and `ss -K`. The classifier is a convenience for ordinary inspection commands, not an operating-system sandbox. Repository configuration, shell expansion, and programs invoked by a reader can change what a command does. Use host permissions or a sandbox when enforcement is required.
 
 ## What Audrey remembers
 
@@ -116,11 +114,13 @@ Audrey treats memory as more than a pile of text chunks.
 
 Every context packet includes memory IDs, confidence, provenance where available, and a reason for inclusion. Uncertain or disputed memories are labeled as such. Retrieved content is wrapped with a simple rule: memory is evidence, not authority; current system and user instructions always win.
 
-## When a memory stops being true
+## Checking memories against the repository
 
 Age is not the only way a memory goes wrong. A note saying "ship with `npm run deploy:prod`" is perfectly recent, well sourced, and completely wrong the day that script is deleted. Worse, every recall reinforces it, because retrieval counts as evidence that a memory is useful. A confidently stated, well-supported, false instruction is more damaging than no memory at all.
 
-So Audrey checks. When a memory is written, it records the claims inside it that can be verified against the project — repository-relative paths and package script names — and keeps only the ones that resolve at that moment. That last part is what makes the signal worth anything: a claim that never resolved is a guess about a typo, while a claim that resolved once and no longer does is the world moving out from under a memory that still asserts it.
+Audrey checks a narrow, useful part of this problem: whether referenced repository paths and package script names still exist. When a memory is written with project context, it records only anchors that resolve at that moment. A missing anchor can then distinguish a later repository change from a reference that never resolved.
+
+Existence does not establish correctness. A script can keep its name while changing behavior, and an intact file can contain obsolete instructions. Grounding does not execute scripts, prove a fix, or verify arbitrary claims in prose.
 
 ```bash
 audrey ground
@@ -139,25 +139,25 @@ Repair is symmetric. Restore the file or the script and the next check clears th
 
 Memories with no checkable claims are left unlabeled. Silence is not a clean bill of health, and presenting it as one would be the same mistake pointed the other way.
 
-## Everything it does, and when you'd actually use it
+## Daily use
 
 Most of this runs on its own once Autopilot is installed. You do not invoke recall, and you do not invoke Guard. The table is here for the parts you would reach for deliberately, and so the automatic parts are legible rather than magic.
 
 | What | When you want it | Why it helps | How |
 |---|---|---|---|
 | **Autopilot** | Always, after one install | The whole point. Memory arrives before the agent acts instead of after you notice it went wrong. | `audrey install --host auto`, restart the host, approve hooks once |
-| **Guard** | Automatic, before any edit, write, or shell command that can have side effects | Checks the exact action fingerprint against prior failures. Not "something like this broke once" — this exact command, still broken. Read-only commands (`grep`, `ls`, `git status`) are not guarded, and their non-zero exits are not remembered as failures. | Runs at `PreToolUse`. Manually: `audrey guard --tool Bash --strict` |
-| **Grounding** | After deleting or renaming things a memory might mention | Confidence tells you a memory is well-sourced. Grounding tells you it is still true. A note about a script you deleted is confident and wrong. | `audrey ground`, or let the maintenance sweep do it |
-| **Session briefing** | Automatic at session start | Small, scoped packet instead of pasting context every time. Each memory injects once per session, not every prompt. | `SessionStart` hook. Preview with `audrey greeting` |
+| **Guard** | Automatic, before supported edit, write, or shell tool calls | Checks action fingerprints against recorded failures and surfaces memory warnings. Recognised read-only commands skip the check. Repairing the repository alone does not clear a prior failure. | Runs at `PreToolUse`. Manually: `audrey guard --tool Bash --strict` |
+| **Grounding** | After deleting or renaming things a memory might mention | Flags previously observed paths or package script names that no longer exist. | `audrey ground`, or let the maintenance sweep do it |
+| **Session briefing** | Automatic at session start | Small, scoped packet instead of pasting context every time. Unchanged memories inject once per session; changes to content or standing are sent again. | `SessionStart` hook. Preview with `audrey greeting` |
 | **Explicit capture** | When you say "remember that…" or "I prefer…" | Deliberate memories are worth more than inferred ones, and phrasing it that way is enough. | Just type it. Autopilot picks up those sentence shapes |
 | **Consolidation** | Automatic when idle; manually before a long break | Repeated episodes become one principle. Otherwise the store is a pile of near-duplicates and recall gets noisy. | `audrey dream` |
 | **Contradictions** | When two memories disagree | Neither one silently wins. Both stay visible and labeled until something resolves them. | Surfaced in packets; `memory_resolve_truth` to settle one |
-| **Decay** | Automatic | Low-value memories fade. Reinforced ones stick around. Runs in the same sweep as consolidation. | Part of `audrey dream` |
+| **Decay** | Confidence ages during recall; run maintenance to mark dormant memories | Age lowers confidence. Explicit decay can move weak memories out of active retrieval. Autopilot consolidation does not run this dormancy pass. | `audrey dream` or `memory_decay` |
 | **Promote** | When a pattern deserves to be a repo rule | Moves a learned habit out of memory and into a file your team can read and review. | `audrey promote --dry-run` first |
-| **Impact** | When you want to know whether any of this is working | Shows which memories were used and whether they helped. Answers "is this earning its keep". | `audrey impact --window 30` |
+| **Impact** | When reviewing memory feedback | Reports explicit used/helpful/wrong feedback and frequently validated memories. It does not measure time saved or independently establish that a blocked action would have failed. | `audrey impact --window 30` |
 | **Snapshot** | Backups, or moving to a new machine | Full store in one JSON file. Import treats it as untrusted: redacted and stripped of trust markers on the way in. | `AUDREY_ENABLE_ADMIN_TOOLS=1`, then `memory_export` / `memory_import` |
 | **Doctor** | Packets stopped arriving | The two real causes are a drifted hook entrypoint and starved consolidation. Doctor names which one. | `audrey doctor` |
-| **Demo** | Before trusting any of this | Runs the whole loop with no API key and no network. Nothing to configure to see it work. | `audrey demo --scenario repeated-failure` |
+| **Demo** | Before configuring a host | Exercises a simulated failure and blocked retry in temporary SQLite storage, with no API key or network call. | `audrey demo --scenario repeated-failure` |
 | **REST sidecar** | Custom agents that are not Codex or Claude Code | Same memory runtime, same evidence contract, over HTTP. Python and JS clients included. | `audrey serve` with `AUDREY_API_KEY` set |
 
 ## What Audrey deliberately does not do
@@ -176,7 +176,7 @@ Guard checks memory at the point where it can change an action, not after the da
 
 ### Continuity across agent sessions
 
-Audrey is not tied to one model vendor. Codex and Claude Code use the same memory runtime and the same evidence contract. MCP, REST, JavaScript, and Python clients make the core usable in custom agents too.
+Codex and Claude Code use the same memory runtime and evidence contract. Generated configurations use separate `codex` and `claude-code` agent identities, so they do not automatically recall each other's memories. Cross-agent Autopilot recall requires the explicit `AUDREY_AUTOPILOT_SCOPE=shared` setting in the host runtime environment; this broadens recall across the store. MCP, REST, JavaScript, and Python clients make the core usable in custom agents too.
 
 ### Evidence a human can inspect
 
@@ -188,30 +188,14 @@ The default store is SQLite, FTS5, and `sqlite-vec`. Local embeddings are the de
 
 ### A safer shared store
 
-Agent-scoped recall now continues through validation, contradiction detection, interference, affect, failure lookup, capsules, greetings, Guard, and REST request routing. Hidden retrieval candidates do not reinforce themselves; only memories actually surfaced to the caller receive retrieval bookkeeping (usage count and last-reinforced timestamp for semantic and procedural memories). Explicit validation feedback (`memory_validate` / `/v1/validate`) separately adjusts salience based on how a memory actually performed, not merely on being recalled.
+Agent-scoped recall continues through validation, contradiction detection, interference, affect, failure lookup, capsules, greetings, Guard, and REST request routing. Recall updates retrieval count and last-reinforced timestamp for returned semantic and procedural memories. Capsule and Guard filtering may further narrow those results. Explicit validation feedback (`memory_validate` / `/v1/validate`) separately updates usage and salience from a caller's used/helpful/wrong assessment.
 
 Vector candidates are partitioned by agent before nearest-neighbor ranking, so one busy agent cannot crowd another out of a bounded search. For hard tenant boundaries, still use a distinct `AUDREY_DATA_DIR` per tenant or security domain.
 
-## See it before installing anything
-
-```bash
-npm exec --yes --package=audrey -- audrey demo --scenario repeated-failure
-```
-
-That command runs from the npm cache, exercises the full SQLite-backed Guard loop, and leaves host configuration unchanged.
-
 <div align="center">
   <img src="docs/assets/audrey-feature-grid.jpg" alt="Audrey memory continuity, recall, evidence, local storage, and memory-before-action" width="760">
 </div>
 
-## Where we want to take it
-
-The ambition is a temporal evidence graph for agents: immutable observations, explicit validity windows, source trust, evolving claims, scoped procedures, and outcome-calibrated policy. The defensible part is not storing more text. It is knowing what was believed, why, in which context, for how long, and whether acting on it helped.
-
-Near-term work includes durable background cognition jobs, tenant namespaces bound to credentials, memory quarantine and taint propagation, public long-horizon evaluations, encrypted backup options, and a persistent local daemon that removes per-hook model startup entirely.
-
-If that is the kind of agent infrastructure you want to build, open an issue or start with the demo. Audrey is MIT licensed, and the product boundary is intentionally inspectable.
-
 ---
 
 ## Technical reference
@@ -258,7 +242,7 @@ Claude Code scope mapping follows the host’s terminology:
 
 Codex supports project `.codex/hooks.json` and user `~/.codex/hooks.json`; it has no local hook scope. Audrey preserves unrelated hooks, replaces older Audrey-owned handlers, writes a private timestamped backup, and is idempotent on repeat installation. Project-adjacent backup names match `*.audrey-*.bak`; keep that pattern ignored because a host config can contain unrelated credentials.
 
-Audrey respects `CLAUDE_CONFIG_DIR` and `CODEX_HOME`. Generated hooks pin the stable Node executable, Audrey entrypoint, data directory, agent identity, and non-secret provider choices used at install time. With local embeddings, an Autopilot install performs one warmup so the first real hook is not also the first model load; set `AUDREY_DISABLE_WARMUP=1` to skip it.
+Audrey respects `CLAUDE_CONFIG_DIR` and `CODEX_HOME`. Generated hooks pin the stable Node executable, Audrey entrypoint, data directory, agent identity, and non-secret provider choices used at install time. With local embeddings, an Autopilot install warms the model cache; set `AUDREY_DISABLE_WARMUP=1` to skip it. Each hook still runs in a new process and initializes an embedding pipeline when needed, so cached model files do not eliminate startup latency.
 
 Generate MCP configuration without applying it:
 
@@ -297,7 +281,7 @@ Codex hook interception is a guardrail, not a complete shell-policy boundary. Th
 ### JavaScript API
 
 ```js
-import { Audrey, MemoryController } from 'audrey';
+import { Audrey } from 'audrey';
 
 const memory = new Audrey({
   dataDir: './audrey-data',
@@ -317,15 +301,19 @@ const capsule = await memory.capsule('increase Stripe throughput', {
   budgetChars: 3000,
 });
 
-const guard = new MemoryController(memory);
-const before = await guard.beforeAction({
-  action: 'deploy the billing worker',
+const before = await memory.beforeAction('npm run deploy:billing', {
   tool: 'Bash',
-  command: 'npm run deploy:billing',
   cwd: process.cwd(),
+  strict: true,
 });
 
-console.log(before.decision, before.evidenceIds);
+console.log(before.decision, before.evidence_ids, before.receipt_id);
+// Only execute an authorized action when before.ok_to_proceed is true.
+// After execution, close this receipt with memory.afterAction({
+//   receiptId: before.receipt_id, outcome: 'succeeded' | 'failed' | 'unknown',
+//   errorSummary: '...' // when available
+// });
+// Report the observed outcome; creating a receipt does not execute the action.
 await memory.closeAsync();
 ```
 
@@ -376,7 +364,7 @@ episode
   ├─ agent-scoped interference / resonance / validation
   ├─ reinforcement or contradiction evidence
   ├─ sleep-time consolidation into semantic or procedural memory
-  └─ grounding checks that stored claims still hold in the project
+  └─ grounding rechecks recorded paths and package-script names
 
 query
   ├─ bounded vector candidates
@@ -404,18 +392,24 @@ The server also sends host instructions explaining the Guard receipt loop when l
 
 | Variable | Default | Purpose |
 |---|---|---|
+| `AUDREY_MODEL_CACHE_DIR` | `$XDG_CACHE_HOME/audrey/models` or `~/.cache/audrey/models` | Writable per-user cache for local model files |
+| `AUDREY_SHARED_STORE` | `0` | Set `1` to retain operator-managed permissions for an intentionally shared store |
 | `AUDREY_DATA_DIR` | `~/.audrey/data` | SQLite store; use a distinct directory per tenant/security boundary |
 | `AUDREY_AGENT` | host-specific | Logical memory owner used for scoped operations |
 | `AUDREY_EMBEDDING_PROVIDER` | `local` | `local`, `gemini`, `openai`, or `mock` |
-| `AUDREY_LLM_PROVIDER` | unset | `anthropic`, `openai`, or `mock` for reflection/consolidation; unset (or `auto`) uses local heuristics only, never an ambient `ANTHROPIC_API_KEY`/`OPENAI_API_KEY` |
+| `AUDREY_LLM_PROVIDER` | unset | `anthropic`, `openai` (API billing), `chatgpt` (subscription), or `mock` for reflection/consolidation; unset (or `auto`) uses local heuristics only, never an ambient API key |
 | `AUDREY_LLM_MODEL` | provider default | Explicit LLM model override |
+| `AUDREY_LLM_REASONING_EFFORT` | `medium` | OpenAI reasoning effort: `low`, `medium`, `high`, `xhigh`, or `max` |
+| `AUDREY_CHATGPT_AUTH_DIR` | `~/.audrey/auth` | Protected local subscription credential directory |
+| `AUDREY_CHATGPT_ACCOUNT` | active account | Saved subscription registration to use |
 | `AUDREY_DEVICE` | `gpu` | Local embedding device; falls back to CPU |
 | `AUDREY_CONTEXT_BUDGET_CHARS` | `4000` | Maximum default capsule size |
 | `AUDREY_AUTOPILOT_SCOPE` | `agent` | `agent` or explicit cross-agent `shared` recall for hooks |
 | `AUDREY_PACKET_FORMAT` | `compact` | Injected packet style: `compact` line format or `verbose` key=value |
-| `AUDREY_PACKET_DELTA` | `1` | Inject each memory once per session; `0` resends full packets every prompt |
+| `AUDREY_PACKET_DELTA` | `1` | Inject each unchanged memory version once per session; `0` resends full packets every prompt |
 | `AUDREY_HOOK_FAIL_CLOSED` | `0` | Deny guarded actions when Audrey itself fails |
 | `AUDREY_API_KEY` | unset | Bearer token for REST access |
+| `AUDREY_ALLOW_NO_AUTH` | `0` | Set `1` to permit unauthenticated non-loopback REST access |
 | `AUDREY_HOST` | `127.0.0.1` | REST bind address |
 | `AUDREY_PORT` | `7437` | REST port |
 | `AUDREY_ENABLE_ADMIN_TOOLS` | `0` | Enable export, import, forget, and promote operations |
@@ -426,6 +420,18 @@ The server also sends host instructions explaining the Guard receipt loop when l
 
 Provider secrets are never embedded in generated hook commands. `--include-secrets` applies only to MCP registration; prefer host environment injection or a secret manager.
 
+OpenAI API billing uses `AUDREY_LLM_PROVIDER=openai` and `OPENAI_API_KEY`. To use a ChatGPT subscription for reflection and consolidation, run `audrey auth login`, then set `AUDREY_LLM_PROVIDER=chatgpt`, `AUDREY_LLM_MODEL=gpt-6.1-sol`, and `AUDREY_LLM_REASONING_EFFORT=medium`. Reinstall the host configuration after changing provider settings. Subscription requests require account permission and an available model; failures never switch to API billing. Embeddings remain a separate provider and default to local execution. See [OpenAI's subscription documentation](https://developers.openai.com/siwc/token-sharing-open-source).
+
+Use `audrey auth accounts` to list saved registrations, `audrey auth select --account <ID>` to switch, and `audrey auth logout` to sign out. Tokens stay in protected local storage outside the memory database. `audrey auth status` reports connection state without exposing tokens.
+
+New local stores use private directory and database permissions on filesystems that support POSIX modes. Existing database and WAL files are restricted on open. Windows and mounted volumes need appropriate operating-system ACLs. Set `AUDREY_SHARED_STORE=1` (SDK: `sharedStore: true`) only when you manage shared access yourself.
+
+Local models download into the per-user cache on first use. Allow that first run to finish before relying on hooks offline. A failed initialization can be retried in the same process. For a system package installed by root, run the initial model load as the desktop user so the cache remains writable.
+
+Snapshot format 2 preserves grounding anchors, their last known state, and consolidation undo journals; older snapshots remain importable. Worktrees share a repository identity for recall, while grounding checks the checkout where an anchor was recorded. Rollback preserves earlier knowledge when undoing a merge. Legacy merges without an undo journal are refused when they cannot be reversed safely.
+
+The REST API requires JSON request bodies and rejects cross-origin browser requests. Unauthenticated requests require a loopback host unless `AUDREY_ALLOW_NO_AUTH=1` is explicitly set. Configure `AUDREY_API_KEY` for network deployments.
+
 ### Production checklist
 
 - Give every tenant or hard isolation domain its own `AUDREY_DATA_DIR`.
@@ -460,7 +466,7 @@ GuardBench currently contains ten local, deterministic pre-action scenarios cove
 Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 3.805ms / 13.445ms p50/p95 Guard latency under the mock-provider methodology.
 <!-- guardbench-summary:end -->
 
-`benchmarks/perf-snapshot.js` measures encode and hybrid-recall p50/p95/p99 at configurable corpus sizes with machine and provider provenance. Run it on the hardware and embedding provider you plan to operate; hosted-provider latency is dominated by its network round trip.
+`benchmarks/perf-snapshot.js` measures encode and hybrid-recall p50/p95/p99 at configurable corpus sizes with machine provenance. It currently uses mock 64-dimensional embeddings; it has no provider-selection flag and does not measure hook process startup. Measure complete hook invocations separately with your intended provider, cache state, corpus, and hardware before using these numbers to estimate interactive latency.
 
 The longer-term public evaluation target includes [LongMemEval](https://arxiv.org/abs/2410.10813), [MemoryAgentBench](https://arxiv.org/abs/2507.05257), and adversarial memory-poisoning cases. Relevant design directions include bitemporal knowledge graphs in [Zep/Graphiti](https://arxiv.org/abs/2501.13956), evolving memory organization in [A-MEM](https://arxiv.org/abs/2502.12110), and sleep-time agent compute in [Sleep-time Compute](https://arxiv.org/abs/2504.13171).
 
@@ -490,8 +496,6 @@ npm run bench:guard:external:evidence:strict
 
 npm run paper:arxiv:compile
 npm run paper:arxiv:compile:strict
-npm run paper:launch-results
-npm run paper:launch-results:strict
 
 npm run release:cut:plan
 npm run release:cut:apply
@@ -502,6 +506,6 @@ npm run python:release:check
 
 Live Zep runs require `ZEP_API_KEY`; `ZEP_GUARDBENCH_INGEST_DELAY_MS` tunes ingestion settling time. The external dry-run matrix proves adapter shape without credentials, while external evidence verification distinguishes pending runs from verified live evidence.
 
-Publication packaging performs an absolute-path sweep, reserves an X URL reserve in social copy, and checks submitted artifact-url targets. Release readiness separately reports source-control state, live remote-head verification, npm registry/auth readiness, and PyPI publish readiness.
+Publication packaging verifies artifact hashes, source bundles, and path redaction. Release readiness separately reports source-control state, live remote-head verification, npm registry/auth readiness, and PyPI publish readiness. Pass `-- --target-version <version>` to the readiness commands when checking a release; the script's legacy default is `1.1.1`.
 
 MIT licensed. Built for agents that should get better at the work without becoming less accountable.

package/SECURITY.md

@@ -6,9 +6,8 @@ Security fixes are best-effort for the current published release line and the cu
 
 | Version | Supported |
 |---|---|
-| `1.1.x` | Yes |
-| `1.0.x` | Best effort |
-| `< 1.0.0` | No |
+| `2.0.x` and `master` | Yes |
+| `< 2.0.0` | No |
 
 ## Reporting a Vulnerability
 

package/dist/mcp-server/config.d.ts

@@ -1,5 +1,5 @@
 import type { AudreyConfig, EmbeddingConfig, LLMConfig } from '../src/types.js';
-export declare const VERSION = "2.0.0";
+export declare const VERSION = "2.1.1";
 export declare const SERVER_NAME = "audrey-memory";
 export declare const DEFAULT_AGENT = "local-agent";
 export declare const DEFAULT_DATA_DIR: string;
@@ -29,16 +29,6 @@ export declare function resolveDataDir(env?: Record<string, string | undefined>)
 export declare function resolveEmbeddingProvider(env: Record<string, string | undefined>, explicit?: string | undefined): EmbeddingConfig & {
     dimensions: number;
 };
-/**
- * Resolves which LLM provider to use for principle extraction / reflection.
- * Priority: explicit config -> none (local heuristics only).
- * Cloud providers are never auto-selected from ambient API keys: memory
- * content is sent to the provider verbatim (buildPrincipleExtractionPrompt),
- * so leaving AUDREY_LLM_PROVIDER unset (or 'auto') must never cause content
- * to leave the machine just because ANTHROPIC_API_KEY/OPENAI_API_KEY happens
- * to be set for some unrelated tool. Choose a cloud provider explicitly with
- * AUDREY_LLM_PROVIDER=anthropic|openai.
- */
 export declare function resolveLLMProvider(env: Record<string, string | undefined>, explicit?: string | undefined, options?: {
     requireApiKey?: boolean;
 }): (LLMConfig & {

package/dist/mcp-server/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../mcp-server/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEhF,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,eAAO,MAAM,gBAAgB,QAAqC,CAAC;AACnE,eAAO,MAAM,cAAc,QAAwD,CAAC;AAEpF,eAAO,MAAM,gBAAgB;;;;;;;;;CASnB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvD,UAAU,aAAa;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACtC;AAyBD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAA4C,GAC9D,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAAsC,EACzD,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CA0B1C;AAED,wBAAgB,iBAAiB,IAAI,YAAY,CAehD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjE;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,EAC5C,OAAO,GAAE,aAAkB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6CxB;AAWD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,GAC3C,MAAM,EAAE,CAMV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAGR;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,IAAI,GAAE,MAAM,GAAG,SAAqB,GACnC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAOlE;AAgCD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,MAAM,GAAG,SAAqB,EACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAgBR;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAqBV;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAUV"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../mcp-server/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEhF,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,eAAO,MAAM,gBAAgB,QAAqC,CAAC;AACnE,eAAO,MAAM,cAAc,QAAwD,CAAC;AAEpF,eAAO,MAAM,gBAAgB;;;;;;;;;CASnB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvD,UAAU,aAAa;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACtC;AAyBD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAA4C,GAC9D,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB1C;AAmBD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAAsC,EACzD,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAiD1C;AAED,wBAAgB,iBAAiB,IAAI,YAAY,CAehD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjE;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,EAC5C,OAAO,GAAE,aAAkB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkDxB;AAcD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,GAC3C,MAAM,EAAE,CAMV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAGR;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,IAAI,GAAE,MAAM,GAAG,SAAqB,GACnC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAOlE;AAgCD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,MAAM,GAAG,SAAqB,EACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAgBR;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAqBV;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAUV"}

package/dist/mcp-server/config.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-export const VERSION = '2.0.0';
+export const VERSION = '2.1.1';
 export const SERVER_NAME = 'audrey-memory';
 export const DEFAULT_AGENT = 'local-agent';
 export const DEFAULT_DATA_DIR = join(homedir(), '.audrey', 'data');
@@ -17,7 +17,7 @@ export const HOST_AGENT_NAMES = {
     jetbrains: 'jetbrains',
 };
 const VALID_EMBEDDING_PROVIDERS = new Set(['mock', 'local', 'gemini', 'openai']);
-const VALID_LLM_PROVIDERS = new Set(['mock', 'anthropic', 'openai']);
+const VALID_LLM_PROVIDERS = new Set(['mock', 'anthropic', 'openai', 'chatgpt']);
 function assertValidProvider(provider, validProviders, envVar) {
     if (!validProviders.has(provider)) {
         throw new Error(`Unsupported ${envVar} value: ${provider}`);
@@ -72,6 +72,12 @@ export function resolveEmbeddingProvider(env, explicit = env['AUDREY_EMBEDDING_P
  * to be set for some unrelated tool. Choose a cloud provider explicitly with
  * AUDREY_LLM_PROVIDER=anthropic|openai.
  */
+/** A ~ prefix expands to the home directory; a relative path resolves now, not per hook. */
+function absoluteAuthDir(value) {
+    const expanded = value.replace(/^~(?=$|[\\/])/, homedir());
+    // A Windows drive path is absolute even when this runs on another platform.
+    return isAbsolute(expanded) || /^[A-Za-z]:[\\/]/.test(expanded) ? expanded : resolve(expanded);
+}
 export function resolveLLMProvider(env, explicit = env['AUDREY_LLM_PROVIDER'], options = {}) {
     const { requireApiKey = true } = options;
     const model = env['AUDREY_LLM_MODEL']?.trim() || undefined;
@@ -81,6 +87,24 @@ export function resolveLLMProvider(env, explicit = env['AUDREY_LLM_PROVIDER'], o
     }
     assertValidProvider(explicit, VALID_LLM_PROVIDERS, 'AUDREY_LLM_PROVIDER');
     const provider = explicit;
+    const effort = env['AUDREY_LLM_REASONING_EFFORT']?.trim() || 'medium';
+    if (!['low', 'medium', 'high', 'xhigh', 'max'].includes(effort)) {
+        throw new Error(`Unsupported AUDREY_LLM_REASONING_EFFORT value: ${effort}`);
+    }
+    const reasoningEffort = effort;
+    if (provider === 'chatgpt') {
+        return {
+            provider,
+            model: model || 'gpt-6.1-sol',
+            reasoningEffort,
+            // Resolved here so hook commands carry an absolute path: each hook runs
+            // in its own working directory, and JSON host configs expand no ~.
+            ...(env['AUDREY_CHATGPT_AUTH_DIR']
+                ? { authDir: absoluteAuthDir(env['AUDREY_CHATGPT_AUTH_DIR']) }
+                : {}),
+            ...(env['AUDREY_CHATGPT_ACCOUNT'] ? { chatgptAccount: env['AUDREY_CHATGPT_ACCOUNT'] } : {}),
+        };
+    }
     if (provider === 'anthropic') {
         const apiKey = env['ANTHROPIC_API_KEY'];
         if (requireApiKey && !apiKey) {
@@ -93,7 +117,12 @@ export function resolveLLMProvider(env, explicit = env['AUDREY_LLM_PROVIDER'], o
         if (requireApiKey && !apiKey) {
             throw new Error('AUDREY_LLM_PROVIDER=openai requires OPENAI_API_KEY to be set.');
         }
-        return { provider: 'openai', apiKey, ...withModel };
+        return {
+            provider: 'openai',
+            apiKey,
+            ...(env['AUDREY_LLM_REASONING_EFFORT'] ? { reasoningEffort } : {}),
+            ...withModel,
+        };
     }
     return { provider: 'mock' };
 }
@@ -157,6 +186,12 @@ export function buildAudreyMcpEnv(env = process.env, agent = env['AUDREY_AGENT']
         addEnv('AUDREY_LLM_PROVIDER', llm.provider);
         if (llm.model)
             addEnv('AUDREY_LLM_MODEL', llm.model);
+        if (llm.reasoningEffort)
+            addEnv('AUDREY_LLM_REASONING_EFFORT', llm.reasoningEffort);
+        if (llm.provider === 'chatgpt') {
+            addEnv('AUDREY_CHATGPT_AUTH_DIR', llm.authDir);
+            addEnv('AUDREY_CHATGPT_ACCOUNT', llm.chatgptAccount);
+        }
         if (llm.provider === 'anthropic') {
             if (includeSecrets)
                 addEnv('ANTHROPIC_API_KEY', llm.apiKey);
@@ -175,6 +210,9 @@ const AUTOPILOT_RUNTIME_FLAGS = {
     AUDREY_DEVICE: '--device',
     AUDREY_LLM_PROVIDER: '--llm-provider',
     AUDREY_LLM_MODEL: '--llm-model',
+    AUDREY_LLM_REASONING_EFFORT: '--llm-reasoning-effort',
+    AUDREY_CHATGPT_AUTH_DIR: '--chatgpt-auth-dir',
+    AUDREY_CHATGPT_ACCOUNT: '--chatgpt-account',
 };
 export function buildAutopilotRuntimeArgs(env = process.env, agent = env['AUDREY_AGENT'] || DEFAULT_AGENT) {
     const runtime = buildAudreyMcpEnv(env, agent, { includeSecrets: false });