superlocalmemory 3.6.16 → 3.6.18

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to SuperLocalMemory V3 will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.6.17] - 2026-06-21 — Community PR round + dashboard-feedback fix + SQLite tuning
+
+Eight community pull requests merged after line-by-line review, plus fixes for the open issues. Every change was validated against the full test suite under the real 3.12 runtime; default single-machine behavior is unchanged.
+
+### Added
+
+- **HTTP write-path observability** (PR #52, @barrygfox). The HTTP fast paths (`/observe`, `/remember`, the AutoCapture pipeline, the materializer) now emit `EventBus` events tagged `source_protocol="http"`, so the dashboard event stream is no longer structurally empty. New event types: `memory.observed`, `memory.captured`, `memory.dropped`, `memory.queued`. Emission is best-effort and never affects the caller's response.
+- **Marker-bounded adapter writes** (PR #54, @barrygfox). `CopilotAdapter` now wraps its content in `<!-- SLM-START -->` / `<!-- SLM-END -->` markers and merges into `.github/copilot-instructions.md` instead of overwriting it, preserving user- and agent-curated content. `disable()` strips the SLM block instead of deleting the file. New `hooks/memory_protocol.py` is the shared single source of truth for the marker contract.
+
+### Fixed
+
+- **Dashboard feedback was completely broken** (issues #53/#59). The dashboard thumbs-up/down/pin and dwell handlers called `FeedbackCollector.record_dashboard_feedback()` — a method that did not exist, so every write raised `AttributeError` (caught by the route, so no lock leak, but the feature was dead). Implemented the method, mapping the dashboard vocabulary onto stored `(signal_type, value)` pairs; the raw query is hashed, never stored.
+- **NULL columns reloaded as `[]` instead of `None`** (PR #50, @barrygfox). `_jl()` collapsed "no default" and explicit `default=None`, defeating downstream `is None` guards and causing `Mean of empty slice` warnings in the Fisher–Langevin coupling. Fixed with a `_MISSING` sentinel + an empty-array guard.
+- **Lifecycle hooks hard-coded daemon port `:8765`** (PR #51, @barrygfox). Hooks now resolve the port from the per-user `~/.superlocalmemory/daemon.port` file; the non-loopback SSRF guard on `SLM_HOOK_DAEMON_URL` is preserved.
+- **`atomic_write` honored a stale sync-log skip** (PR #55, @barrygfox). The on-disk file is re-hashed before a durable skip, so an out-of-band edit (`git restore`, manual edit) is no longer silently ignored.
+- **Embedding/reranker workers ran single-threaded** (PR #56, @barrygfox). `OMP_NUM_THREADS` is restored in those subprocess workers (which load torch but never lightgbm, so the libomp SIGSEGV cannot occur).
+- **Anthropic provider ignored `api_base`** (PR #57, @barrygfox). The Anthropic backbone now honors a configured base URL (Anthropic-compatible proxy), mirroring the OpenAI provider.
+- **Dashboard screenshot committed as a raw binary** (PR #58, @MelleKoning). Converted to a Git LFS pointer per the existing `.gitattributes` rule.
+- **"Test Connection" blocked for remote dashboards** (issue #40 residue). In `SLM_REMOTE` mode, an allowlisted LAN client may probe its own LAN LLM endpoint, exactly like the loopback dashboard. The SSRF guard is not relaxed for any non-allowlisted caller.
+
+### Changed
+
+- **SQLite endurance knobs are env-tunable** (issue #53). `SLM_DB_BUSY_TIMEOUT_MS`, `SLM_DB_MAX_RETRIES`, and `SLM_DB_RETRY_BASE_DELAY` override the defaults for operators on slow/contended I/O. Unset env is byte-identical to the prior hard-coded constants.
+- **`outcome_queue` polling backs off when idle** (issue #53). The drain worker now relaxes its 0.25s poll (doubling, capped at 2s) when the queue drains empty and snaps back to 0.25s the instant there is work, reducing idle contention on the shared SQLite file.
+
 ## [3.6.14] - 2026-06-18 — Audit-hardened: memory bounds, cross-tenant cache isolation, atomic credentials
 
 Shipped through two adversarial audit passes (Qualixar Iron Pattern Stages 8–9), validated against a green 5933-test suite under the real 3.12 runtime. Default single-machine behavior is unchanged.

package/README.md

@@ -2,10 +2,10 @@
   <img src="https://superlocalmemory.com/assets/logo-mark.png" alt="SuperLocalMemory" width="200"/>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.6.16</h1>
+<h1 align="center">SuperLocalMemory V3.6.18</h1>
 <p align="center"><strong>Cache. Compress. Remember. Three surfaces — proxy, MCP tools, or skill. Every setup covered.</strong><br/>
 <em>To the best of our knowledge, the only zero-cloud agent memory that beats Mem0's zero-LLM score on LoCoMo. Mode A: 74.8% vs Mem0 64.2% — no GPU, no API key, on CPU.</em></p>
-<p align="center"><code>v3.6.16</code> — <strong>Plugin-native. Profile-aware. Distributed-ready.</strong><br/>
+<p align="center"><code>v3.6.18</code> — <strong>Plugin-native. Profile-aware. Distributed-ready.</strong><br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 published research papers</strong> (arXiv preprints + Zenodo-archived) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 
@@ -307,6 +307,7 @@ slm dashboard    # Opens at http://localhost:8765
 
 | Version | Codename | Key Features |
 |---|---|---|
+| **v3.6.17** | Community | 8 contributor PRs (observability events, marker-bounded adapter writes, daemon port discovery, anthropic `api_base`, OpenMP workers, atomic-write rehash, `_jl` sentinel, LFS pointer); dashboard-feedback fix (#53/#59); env-tunable SQLite knobs + idle backoff; remote LLM test-probe (#40) |
 | **v3.6.16** | Docs | Corrected Claude Code plugin install — adds the required `/plugin marketplace add` step; clarifies plugin vs pip/npm delivery |
 | **v3.6.15** | Multi-scope | **Opt-in [shared memory](docs/shared-memory.md)** (personal/shared/global, off by default), default-deny scope at every read path, recall scope-race fix, contributor PRs #42/#43/#44, fixes #46–#49 |
 | **v3.6.14** | Plugin-native | Claude Code Plugin (WP-06), MCP profiles (WP-01), IDE connect (WP-08), asset consolidation, UI polish (WP-12) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.6.16",
+  "version": "3.6.18",
   "description": "Information-geometric agent memory with mathematical guarantees. 4-channel retrieval, Fisher-Rao similarity, zero-LLM mode, EU AI Act compliant. Works with Claude, Cursor, Windsurf, and 17+ AI tools.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -16,5 +16,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.6.16"
+  "version": "3.6.18"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v3.6.16 -->
+<!-- BEGIN SuperLocalMemory v3.6.18 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene) · slm-optimize-advisor (context compression + KV cache)
 
-<!-- END SuperLocalMemory v3.6.16 -->
+<!-- END SuperLocalMemory v3.6.18 -->
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -41,4 +41,4 @@ recall→`slm recall "<q>" --limit N` (add `--include-global`/`--include-shared`
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit.
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -35,4 +35,4 @@ stats→`slm optimize status`/`savings` · compress→`slm compress` · cache→
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %.
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.6.16
+superlocalmemory==3.6.18

package/plugin/skills/slm-cache/SKILL.md

@@ -137,4 +137,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -140,4 +140,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-graph/SKILL.md

@@ -297,4 +297,4 @@ Without this, the six graph tools are not registered and will appear as unknown
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-recall/SKILL.md

@@ -201,4 +201,4 @@ trusts that what you surface came from the store.
 
 ---
 
-*SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -191,4 +191,4 @@ slm remember "<content>" --scope shared --shared-with alice,bob
 
 ---
 
-*SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -204,4 +204,4 @@ slm doctor [--json]    # preflight check including daemon and embedding worker
 
 ---
 
-*SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -146,4 +146,4 @@ Note: the `slm optimize` subcommands have known pre-existing parse-test failures
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/agents/slm-memory-advisor.md

@@ -41,4 +41,4 @@ recall→`slm recall "<q>" --limit N` (add `--include-global`/`--include-shared`
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit.
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/agents/slm-optimize-advisor.md

@@ -35,4 +35,4 @@ stats→`slm optimize status`/`savings` · compress→`slm compress` · cache→
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %.
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.6.16",
+  "version": "3.6.18",
   "pluginName": "superlocalmemory",
   "displayName": "SuperLocalMemory",
   "repository": "https://github.com/qualixar/superlocalmemory",

package/plugin-src/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.6.16
+superlocalmemory==3.6.18

package/plugin-src/rules/AGENTS.md

@@ -88,4 +88,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 | `slm_cache_get`    | `key`                                                                          | KV cache get; returns hit, value   |
 | `slm_optimize_stats` | `()`                                                                         | Returns compress_runs, tokens_saved_compress, cache_kv_hits |
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/CLAUDE.md.fragment

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v3.6.16 -->
+<!-- BEGIN SuperLocalMemory v3.6.18 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene) · slm-optimize-advisor (context compression + KV cache)
 
-<!-- END SuperLocalMemory v3.6.16 -->
+<!-- END SuperLocalMemory v3.6.18 -->
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -137,4 +137,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -140,4 +140,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-graph/SKILL.md

@@ -297,4 +297,4 @@ Without this, the six graph tools are not registered and will appear as unknown
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-recall/SKILL.md

@@ -201,4 +201,4 @@ trusts that what you surface came from the store.
 
 ---
 
-*SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-remember/SKILL.md

@@ -191,4 +191,4 @@ slm remember "<content>" --scope shared --shared-with alice,bob
 
 ---
 
-*SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-session/SKILL.md

@@ -204,4 +204,4 @@ slm doctor [--json]    # preflight check including daemon and embedding worker
 
 ---
 
-*SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-status/SKILL.md

@@ -146,4 +146,4 @@ Note: the `slm optimize` subcommands have known pre-existing parse-test failures
 
 ---
 
-SuperLocalMemory v3.6.16 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "3.6.16"
+version = "3.6.18"
 description = "Information-geometric agent memory with mathematical guarantees"
 readme = "README.md"
 license = {text = "AGPL-3.0-or-later"}
@@ -146,8 +146,9 @@ superlocalmemory = ["ui/**/*"]
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["src"]
-addopts = "-m 'not slow and not ollama and not benchmark'"
+addopts = "-p no:cacheprovider -p no:subtests -m 'not slow and not ollama and not benchmark'"
 asyncio_mode = "auto"
+faulthandler_timeout = 0
 markers = [
     "slow: marks tests as slow — real engine/model loading (run with: pytest -m slow)",
     "ollama: marks tests that require a running Ollama instance",

package/scripts/build-plugin.js

@@ -30,7 +30,7 @@ import process from 'node:process';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
-const VERSION = '3.6.16';
+const VERSION = '3.6.18';
 const MANIFEST_REL = 'plugin-src/manifest.json';
 const GENERATED_BANNER = `# _GENERATED — DO NOT HAND-EDIT
 

package/scripts/postinstall-interactive.js

@@ -489,19 +489,99 @@ async function runInteractiveFlow(rl, recommendedProfile) {
 // under 60 LOC per Stage-8 G2 scope.
 function printLivingBrainDelta() {
   console.log('');
-  console.log('What\'s new in v3.4.21 FINAL:');
-  console.log('  + Engagement reward model (action_outcomes populated)');
-  console.log('  + Online LightGBM retrain (shadow-tested, auto-rollback)');
-  console.log('  + Real consolidation (hnswlib, reversible merges)');
-  console.log('  + Inline entity detection (<2 ms trigram lookup)');
-  console.log('  + Opt-in skill evolution (Haiku 4.5 default)');
-  console.log('  + Evo-Memory public benchmark');
+  console.log('What\'s new in v3.6.18:');
+  console.log('  + session_init mandate hook — Claude calls ToolSearch→session_init first, every session');
+  console.log('  + Plugin auto-install on npm/pip install — skills, agents, hooks wired automatically');
+  console.log('  + M017 migration — ccq_consolidated_blocks gets scope column (no more silent CCQ scope drop)');
+  console.log('  + GC-safe test flags baked into pyproject.toml + Makefile (no more macOS ARM SIGSEGV)');
   console.log('What\'s unchanged:');
   console.log('  * Your memory.db — zero deletes, zero rewrites');
   console.log('  * Your profile settings');
   console.log('  * All CLI commands you already use');
 }
 
+// T1-B: Auto-install the Claude Code plugin after pip/npm install.
+// Best-effort: never fails the installer, never blocks the main flow.
+// Checks for `claude` CLI, then runs:
+//   1. claude plugin marketplace add qualixar/superlocalmemory
+//   2. claude plugin install superlocalmemory@qualixar
+//   3. slm hooks install
+async function tryInstallClaudePlugin() {
+  const { execFile } = require('child_process');
+  const { promisify } = require('util');
+  const execFileAsync = promisify(execFile);
+
+  // Find claude binary — try PATH first, then common install locations.
+  const claudeCandidates = ['claude'];
+  if (process.platform !== 'win32') {
+    claudeCandidates.push(
+      '/usr/local/bin/claude',
+      process.env.HOME + '/.npm-global/bin/claude',
+      process.env.HOME + '/.local/bin/claude',
+    );
+  }
+
+  let claudeBin = null;
+  for (const candidate of claudeCandidates) {
+    try {
+      await execFileAsync(candidate, ['--version'], { timeout: 5000 });
+      claudeBin = candidate;
+      break;
+    } catch (_e) { /* keep looking */ }
+  }
+
+  if (!claudeBin) {
+    // Claude Code not installed — print guidance and skip.
+    console.log('SLM: Claude Code CLI not found — skipping plugin auto-install.');
+    console.log('SLM: To install the plugin manually after installing Claude Code:');
+    console.log('SLM:   claude plugin marketplace add qualixar/superlocalmemory');
+    console.log('SLM:   claude plugin install superlocalmemory@qualixar');
+    console.log('SLM:   slm hooks install');
+    return;
+  }
+
+  console.log('SLM: Claude Code found — installing SLM plugin...');
+
+  // Step 1: Add marketplace
+  try {
+    await execFileAsync(claudeBin,
+      ['plugin', 'marketplace', 'add', 'qualixar/superlocalmemory'],
+      { timeout: 30000 });
+    console.log('SLM: marketplace added (qualixar/superlocalmemory)');
+  } catch (e) {
+    // "already exists" or network error — not fatal
+    console.log('SLM: marketplace add note: ' + (e.stderr || e.message || String(e)).trim().split('\n')[0]);
+  }
+
+  // Step 2: Install plugin
+  try {
+    await execFileAsync(claudeBin,
+      ['plugin', 'install', 'superlocalmemory@qualixar'],
+      { timeout: 30000 });
+    console.log('SLM: plugin installed (superlocalmemory@qualixar)');
+  } catch (e) {
+    console.log('SLM: plugin install note: ' + (e.stderr || e.message || String(e)).trim().split('\n')[0]);
+  }
+
+  // Step 3: Install hooks (only if not already current — avoids needless writes)
+  // `slm hooks install` uses atomic tmp-then-rename and only touches the SLM
+  // section of settings.json; all other Claude Code settings are preserved.
+  try {
+    const statusResult = await execFileAsync('slm', ['hooks', 'status', '--json'],
+      { timeout: 10000 }).catch(() => null);
+    const alreadyCurrent = statusResult &&
+      (() => { try { const s = JSON.parse(statusResult.stdout); return s.installed && !s.needs_upgrade; } catch { return false; } })();
+    if (!alreadyCurrent) {
+      await execFileAsync('slm', ['hooks', 'install'], { timeout: 15000 });
+      console.log('SLM: hooks installed into Claude Code settings');
+    } else {
+      console.log('SLM: hooks already current — skipped');
+    }
+  } catch (e) {
+    console.log('SLM: hooks install note: ' + (e.stderr || e.message || String(e)).trim().split('\n')[0]);
+  }
+}
+
 function printFirstRunChecklist(config) {
   console.log('');
   console.log('SuperLocalMemory is configured.');
@@ -692,6 +772,13 @@ async function main() {
 
   // UX-G2: show the one-screen delta banner so upgraders see what shipped.
   printLivingBrainDelta();
+
+  // T1-B: Auto-install Claude Code plugin + hooks. Best-effort, non-blocking.
+  // Only runs on npm install (not --dry-run), when claude CLI is present.
+  if (!args.dryRun) {
+    await tryInstallClaudePlugin();
+  }
+
   printFirstRunChecklist(config);
   return 0;
 }

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "3.6.16"
+__version__ = "3.6.18"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/cli/setup_wizard.py

@@ -789,6 +789,40 @@ def _maybe_install_hooks_on_first_use() -> None:
         # Best-effort: parity-fallback, never block CLI.
         pass
 
+    # T1-B: Auto-install Claude Code plugin (skills, agents, hooks).
+    # Runs after hooks install, best-effort — never blocks CLI startup.
+    _try_install_claude_plugin()
+
+
+def _try_install_claude_plugin() -> None:
+    """Auto-install the Claude Code plugin on first pip/uvx SLM install.
+
+    Runs ``claude plugin marketplace add qualixar/superlocalmemory`` then
+    ``claude plugin install superlocalmemory@qualixar`` if the ``claude``
+    CLI is found in PATH. Silent on any error — plugin install is a
+    convenience, not a hard requirement for SLM to function.
+    """
+    import shutil
+    import subprocess
+
+    claude = shutil.which("claude")
+    if not claude:
+        return  # Claude Code not in PATH — skip silently
+
+    _run = lambda cmd: subprocess.run(  # noqa: E731
+        cmd, capture_output=True, timeout=30, check=False
+    )
+
+    try:
+        _run([claude, "plugin", "marketplace", "add", "qualixar/superlocalmemory"])
+    except Exception:
+        pass
+
+    try:
+        _run([claude, "plugin", "install", "superlocalmemory@qualixar"])
+    except Exception:
+        pass
+
 
 # ---------------------------------------------------------------------------
 # Mode C provider config (preserved from original)

package/src/superlocalmemory/core/embeddings.py

@@ -473,6 +473,11 @@ class EmbeddingService:
                 "TOKENIZERS_PARALLELISM": "false",
                 "TORCH_DEVICE": "cpu",
                 "ORT_DISABLE_COREML": "1",
+                # Restore parallel OpenMP. The package caps OMP_NUM_THREADS
+                # globally to avoid a torch+lightgbm libomp SIGSEGV in the
+                # main process. This worker loads torch but never lightgbm,
+                # so there is no collision risk and full parallelism is safe.
+                "OMP_NUM_THREADS": str(os.cpu_count() or 4),
             }
             from superlocalmemory.core.platform_utils import popen_platform_kwargs
             self._worker_proc = subprocess.Popen(

package/src/superlocalmemory/dynamics/fisher_langevin_coupling.py

@@ -111,6 +111,8 @@ class FisherLangevinCoupling:
             CouplingState with derived temperature, direction, and weight.
         """
         var_arr = np.asarray(fisher_variance, dtype=np.float64)
+        if var_arr.size == 0:
+            return CouplingState()
 
         # Step 1: Fisher confidence from variance
         # Low variance = high confidence (memory is well-characterized)
@@ -203,6 +205,8 @@ class FisherLangevinCoupling:
             return self._base_temp
 
         var_arr = np.asarray(fisher_variance, dtype=np.float64)
+        if var_arr.size == 0:
+            return self._base_temp
         avg_var = float(np.mean(np.clip(var_arr, 1e-8, None)))
         fisher_conf = min(1.0, 1.0 / (1.0 + avg_var) + min(access_count * 0.02, 0.2))
         return self._base_temp / (fisher_conf + self._epsilon)

package/src/superlocalmemory/hooks/adapter_base.py

@@ -217,9 +217,16 @@ def atomic_write(
     prev = sync_log_last_content_sha256(sync_log_db, adapter_name, target_sha)
 
     if prev == new_hash and resolved_path.exists():
-        # Durable skip — no write, no new sync-log row (the prior row still
-        # reflects on-disk truth).
-        return WriteResult(wrote=False, bytes_written=0, content_sha256=new_hash)
+        # Durable skip only if the on-disk content also matches the new hash.
+        # The sync-log row alone is not authoritative: the file may have been
+        # mutated out-of-band (e.g. ``git restore``, manual edit) since the
+        # last sync. Re-hash the file and re-write if it diverges.
+        try:
+            disk_hash = hashlib.sha256(resolved_path.read_bytes()).hexdigest()
+        except OSError:
+            disk_hash = None
+        if disk_hash == new_hash:
+            return WriteResult(wrote=False, bytes_written=0, content_sha256=new_hash)
 
     resolved_path.parent.mkdir(parents=True, exist_ok=True)
     tmp = resolved_path.with_suffix(resolved_path.suffix + ".slm-tmp")

package/src/superlocalmemory/hooks/claude_code_hooks.py

@@ -21,6 +21,7 @@ from __future__ import annotations
 
 import json
 import logging
+import os
 import sys
 import tempfile
 from pathlib import Path
@@ -31,7 +32,7 @@ CLAUDE_SETTINGS = Path.home() / ".claude" / "settings.json"
 VERSION_DIR = Path.home() / ".superlocalmemory" / "hooks"
 VERSION_FILE = VERSION_DIR / ".version"
 DISABLED_FILE = VERSION_DIR / ".hooks-disabled"
-HOOKS_VERSION = "3.4.43"
+HOOKS_VERSION = "3.6.18"
 
 # Cross-platform temp dir and marker paths
 _TMP = tempfile.gettempdir()
@@ -92,6 +93,19 @@ def _hook_definitions(include_gate: bool = False) -> dict[str, list]:
     """
     defs: dict[str, list] = {
         "SessionStart": [
+            # v3.6.18: mandate fires FIRST so session_init is never skipped.
+            # mcp__superlocalmemory__session_init is DEFERRED — Claude must call
+            # ToolSearch before it can invoke the tool. Without this hook,
+            # Claude responds before loading the schema → no 6-channel memory.
+            {
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": _wrap_python_cmd("mandate"),
+                        "timeout": 5000,
+                    }
+                ]
+            },
             {
                 "hooks": [
                     {
@@ -100,7 +114,7 @@ def _hook_definitions(include_gate: bool = False) -> dict[str, list]:
                         "timeout": 15000,
                     }
                 ]
-            }
+            },
         ],
         "PostToolUse": [
             {
@@ -278,9 +292,31 @@ def _read_settings() -> dict:
 
 
 def _write_settings(settings: dict) -> None:
-    """Write settings.json with pretty formatting."""
+    """Write settings.json atomically — tmp file + rename.
+
+    Direct .write_text() would truncate the file on a crash mid-write,
+    destroying the user's entire Claude Code configuration. The tmp-then-rename
+    pattern is atomic on POSIX (os.replace) and near-atomic on Windows: either
+    the full new content lands or the original file is untouched.
+
+    Never overwrites non-SLM settings — _merge_hooks() guarantees that only
+    the SLM hooks entries change; all other keys are preserved from the read.
+    """
     CLAUDE_SETTINGS.parent.mkdir(parents=True, exist_ok=True)
-    CLAUDE_SETTINGS.write_text(json.dumps(settings, indent=2) + "\n")
+    content = json.dumps(settings, indent=2) + "\n"
+    # Write to a sibling tmp file in the same directory so os.replace is atomic
+    # (cross-device rename would fail; same-dir rename is guaranteed atomic).
+    tmp_path = CLAUDE_SETTINGS.with_suffix(".json.slm_tmp")
+    try:
+        tmp_path.write_text(content, encoding="utf-8")
+        os.replace(tmp_path, CLAUDE_SETTINGS)
+    except Exception:
+        # Best-effort cleanup of the tmp file on failure
+        try:
+            tmp_path.unlink(missing_ok=True)
+        except Exception:
+            pass
+        raise
 
 
 # ---------------------------------------------------------------------------