superlocalmemory 4.1.21 → 4.1.23

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "author": {
         "name": "Qualixar"
       },
-      "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 38-tool code profile with graph intelligence.",
+      "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. Serves the 56-tool full profile by default; set SLM_MCP_PROFILE=code for the 38-tool code profile.",
       "homepage": "https://github.com/qualixar/superlocalmemory",
       "keywords": [
         "memory",
@@ -21,7 +21,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory",
       "source": "./plugin",
-      "version": "4.1.21"
+      "version": "4.1.23"
     },
     {
       "author": {
@@ -39,7 +39,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory-codex",
       "source": "./codex-plugin",
-      "version": "4.1.21"
+      "version": "4.1.23"
     }
   ]
 }

package/CHANGELOG.md

@@ -5,6 +5,216 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.23] — Your web apps and bots use the same memory, and it stays on your computer
+
+### Added
+
+- **Web access.** ChatGPT, Claude on the web, Claude Code on the web, Muse,
+  Composio and any MCP client that supports remote connections with OAuth can
+  use the memory on your computer. Turn it on from the dashboard's new
+  **Connected apps** page, sign in with GitHub, and choose per app whether it
+  may only read, also save, and use session tools. Your computer keeps one
+  outbound link to SLM's connection gateway; there is no port to open and no
+  tunnel or Cloudflare account to set up. The memory database never leaves the
+  computer, and SLM works fully without Web access. Each connection has a free
+  daily allowance of tool calls.
+- Web access renews its own credentials while your computer is online. If the
+  computer stays offline long enough for access to lapse, the Connected apps
+  page warns before it ends and says what to do after. Once the computer has
+  been silent for 45 seconds, for example asleep, a web app is told at once that
+  it is unavailable. A relayed recall answers inside the relay's time budget,
+  and remote answers are compact JSON with host details redacted.
+- **Connected apps** lists every app that can reach your memory and removes
+  any of them with immediate effect. Memory and local configuration are kept.
+- **Instructions for web agents.** `docs/web-agents/` has a full and a short
+  instruction block and an Agent Skill folder that tell a connected app when to
+  recall, when to say it has no answer, what to save (with kind, tags and an
+  idempotency key) and what to do when your computer is asleep or the daily
+  allowance is used up. The dashboard copies the short block for you.
+- **`slm-web-access` skill** in every editor plugin, so a local agent can help
+  you set up Web access and diagnose a connection.
+- **`slm db repair` brings the two vector indexes back in line with the
+  memories.** It rewrites sqlite-vec rows that no longer match their memory's
+  embedding and removes LanceDB rows for memories that are gone, withheld or
+  soft-deleted; `slm db integrity` reports both counts.
+- **SLM checks your memory store after an upgrade, and Health offers Repair
+  now.** A few minutes after the first start of a new version, the store is
+  checked in the background; the check only reads. The dashboard's Health page
+  lists what it found in plain words, the sidebar marks Health while something
+  can be repaired, and **Repair now** saves a full backup copy first, runs the
+  same repair as `slm db repair`, and checks again. If the backup copy cannot
+  be made, nothing is changed.
+- **Every editor plugin ships in the npm package**: Codex, VS Code / Copilot,
+  Hermes and Antigravity alongside Claude Code, with all skills, agents and
+  rules. `slm codex install` now installs every skill and all four sub-agents.
+  [Editor and agent plugins](docs/plugins.md) gives each host's install
+  commands.
+- **Model advice carries SLM's own measured results**, and a model measured on
+  a small sample is ranked conservatively.
+
+### Changed
+
+- The editor plugins' skills, agents and rules were checked against the
+  current tools and corrected where they had drifted.
+
+### Fixed
+
+- **4.1.22 could corrupt `memory.db` or lose saves (GitHub #153).** The start-up
+  cache read opened and closed `memory.db` inside the daemon. SQLite's locks
+  belong to the process, so that close dropped them: another process (a hook,
+  `slm mcp`, `slm doctor`) could then delete the WAL under the running daemon,
+  which logged "database disk image is malformed" or "disk I/O error" and could
+  write stale pages back into the store. The read now runs in a child process.
+  Thanks to @MelleKoning for the detailed report and an independent fix (#154).
+  **If you run 4.1.22, upgrade.** If `slm doctor` then reports a malformed
+  database, list restore points with `slm db restore-points` and go back to the
+  newest one with `slm db restore <id>`; then run `slm db integrity`. Upgrading
+  is the supported path: migrations are forward-only, so going back to an older
+  release needs a backup taken before it.
+- On SQLite older than 3.42 (for example Ubuntu 22.04), every start and every
+  erasure logged "keyword index secure delete not enabled: SQL logic error".
+  That SQLite cannot remove deleted words from the keyword index at once;
+  SLM now says so once at info level, and `slm db repair` removes them.
+- The "Lance semantic projection diverged from SQLite" warning at every start
+  is gone: LanceDB search now covers every tier the canonical search ranks.
+- Semantic search on LanceDB now finds cold and archived memories too.
+- A rebuilt vector projection leaves out withheld and soft-deleted memories.
+- An erasure also blanks the preview of the erased memory in auto-observe
+  activity events, and `slm db repair` blanks previews that earlier erasures
+  left in activity events.
+- A web app's save or recall is never filed under the session of an agent
+  running on your computer.
+- A second suggestion about the same memory no longer logs a warning on every
+  save.
+- A memory saved with the same words as another memory is no longer counted as
+  repair work that the repair could never do.
+- Maintenance never creates an empty database at a path where no store exists.
+- The Hermes guide named a release download that was never published; it now
+  installs the plugin from the repository. The VS Code guide named a connect
+  command that does not exist; it is `slm connect vscode-copilot --here`.
+- The laptop link no longer fails at start when two parts read its credential
+  at the same time.
+- The `remember` tool is declared additive, so clients do not treat saving as a
+  destructive action.
+
+### Security
+
+- The remote connector's HTTP clients never follow a redirect, and tests pin
+  that the API key cannot be sent to another host.
+- Web access grants are narrowed to the scopes you consented to, for one MCP
+  resource; client registration keeps no diagnostic records.
+
+## [4.1.22] — Faster recall from the first second, memories that stay findable, deletes you can trust
+
+### Added
+
+- **Filter by exact tags.** `recall`, `search`, `list` and `slm recall/list`
+  take a tag filter, over MCP, HTTP and the daemon proxy. A tag filter searches
+  inside the tagged memories and says why a result is empty.
+- **Switch the embedding model without losing recall.** `slm embedder`
+  re-indexes in the background, keeps the previous vectors, gives way to
+  recall while it works, resumes after a crash and can roll back.
+- **Model recommendations for this computer.** A model catalogue with current
+  defaults and each local model's result in SLM's extraction test; the setup
+  wizard offers your installed Ollama models, best first, and `slm models` and
+  the dashboard suggest installed and recommended models.
+- **Every recall says whether its answer was checked**: supported,
+  unsupported or unjudged, and why.
+- **`slm db integrity` and `slm db repair`** show store health in five parts
+  and fix leftover rows, erased words, unfinished deletes and memories that
+  lost their searchable fact, with receipts and undo. A repair never brings
+  back anything that was erased, deleted or withheld.
+- **`slm corrections overtaken`** lists corrections SLM had only proposed
+  itself that a delete, replace or edit overtook; `restore-overtaken` puts one
+  back.
+- Older memories in an upgraded store are classified by kind once, on this
+  device, in the background.
+- SuperLocalMemory installs as a Cursor-format plugin for Grok Bot, with a
+  low-RAM profile for shared bot hosts and two skills for bots sharing one
+  computer.
+
+### Changed
+
+- **Recall is about 2.6 times faster, with the same answers.** On a copy of a
+  real store, typical recall went from 849 ms to 321 ms (slowest 5%: 1.2 s to
+  0.49 s), and on 124 held-out questions from 923 ms to 340 ms (slowest 5%:
+  2.0 s to 0.77 s). Every speed change returns the same top ten memories as
+  before on all 184 test questions.
+- **Fast from the first second after a start, and while you save.** The store
+  is read into memory once at start, graph rankings and stored vectors are
+  prepared in separate background processes, background work yields to a
+  running recall at fine grain, requests no longer open the database to check
+  the login setting, and several slow store queries now use indexes. On a
+  22,000-memory store with the answer check on, a recall every second and a
+  save every half second: recalls slower than 3 s went from 13 of 318 to 7 of
+  297, with none in the first minute after a start (3 before), and saves slower
+  than 1.5 s from 7 of 56 to 1 of 87.
+- **Background enrichment keeps up.** Saved memories finish enrichment while
+  you keep recalling, instead of waiting for a quiet moment that never came:
+  about six times as many per minute under steady recall.
+- **A stated rule answers a yes/no permission question.** "May the agent
+  publish without approval?" is answered by a memory that says "Never publish
+  until the owner approves", with the same answer-check threshold as before;
+  the answer says it came from a rule. A rule about one named thing does not
+  answer a general question.
+- A memory that says it corrects an earlier one keeps that suggestion when the
+  model's check is unsure.
+- Local models copy the extraction prompt's example into your memories no
+  more, and invent fewer dates and numbers (llama3.2: sources with a fact the
+  source did not support went from 36 to 22 of 102; gemma3:4b from 1 to 0;
+  qwen2.5:7b 6 before, 7 now).
+- A fresh install (and CI) starts in Mode A.
+- `slm --json` and MCP tool responses are no longer pretty-printed.
+
+### Fixed
+
+- **A note that looked like an older one no longer loses its searchable fact.**
+  Enrichment deleted a new memory's only fact when it resembled another
+  memory's, so notes that differed only in a number or a declared kind could
+  not be found a moment after saving. `slm db repair` gives existing ones back.
+- **A question that mentions a time like "recently" still finds an older
+  memory it matches**, instead of returning nothing.
+- **A memory you save stays findable while SLM's own guess that it updates an
+  older one waits for review.** Approving the guess retires the older memory;
+  rejecting it keeps both. In one real store this made 406 saved memories
+  findable again; how often the right memory comes first is unchanged.
+- **Saves are not refused when the computer briefly stalls**, and a save
+  acknowledged just before the service was killed is enriched as soon as it
+  restarts.
+- **Deleting and erasing.** Erasing a memory removes its words everywhere
+  (keyword index, journal, event previews, entity summaries, logs, soft-forget
+  copies, vectors kept for a model switch). Erasing a person also erases the
+  memories they corrected, and erasing a whole profile no longer stops partway.
+  A delete refused at the last moment no longer leaves a memory unfindable.
+  Deleting a profile moves its memories to default, still findable, linked and
+  correctable.
+- A save sees the people and things it just added, so it does not create them
+  twice; a cancelled save leaves no trace in recall's lookups.
+- A background computation that times out, or whose service was stopped, no
+  longer keeps running.
+- Two recalls at the same moment are both reranked.
+- Measurements like 2004.6 ms are kept as measurements, never turned into
+  dates.
+- Bounded Loops runs with a node that never ran (an approval or a join) are no
+  longer rejected, and a gate verdict must be a real true or false.
+- The first memory call after a fresh start waits for SLM to finish starting;
+  a tool call no longer waits 60 s when two starts race; stopping a daemon
+  stuck in start-up no longer hangs.
+- Windows: SLM notices a stopped daemon at once, and Codex and Claude Code
+  hooks run SLM's own command.
+- Linux hosts with no GPU install CPU-only torch.
+- The remote listener closes a connection that floods data before its first
+  request; which cached answers get re-checked can no longer be predicted from
+  outside this install.
+- Plugin listings state the tool counts they really serve; the Hermes plugin
+  reaches the new `slm models`, `slm corrections` and `slm embedder` commands.
+
+### Known issues
+
+- On very large stores under heavy saving, a few recalls can still take longer
+  than 3 s while the store is busy committing a large write.
+
+
 ## [4.1.21] — Recall that knows your project, and memories that stay findable
 
 ### Added

package/README.md

@@ -9,9 +9,11 @@
 
 Claude Code, Codex, Cursor and other MCP clients forget what they learned when a session ends. SuperLocalMemory (SLM) gives them one long-term memory that lives on your machine: it learns from use, enforces who may read and erase what, coordinates many agents, and says "I don't have that" instead of guessing.
 
-**Every recall is checked before your agent uses it.** A judge decides whether the memories found actually answer the question: **Laya** runs fully on your Mac, and **Jev** runs online on Windows, Linux and macOS. When they don't answer it, SLM says so instead of handing over a confident wrong answer: a hallucination guard for retrieval ([answer check](#answer-check-laya-and-jev)).
+**Recall can be checked before your agent uses it.** With the answer check on, a judge decides whether the memories found actually answer the question: **Laya** runs fully on your Mac, and **Jev** runs online on Windows, Linux and macOS. When they don't answer it, recall marks the results `abstained`, so your agent can say "I don't have that" instead of handing over a confident wrong answer: a hallucination guard for retrieval ([answer check](#answer-check-laya-and-jev)).
 
-In Mode A, core remember and recall make no model-provider call. Anything that sends data out is a choice you make, and the docs say exactly what goes.
+**Your bots and web apps can use the same memory.** Local agents connect over MCP, including the Grok Bot plugin on a shared bot computer. ChatGPT, Claude on the web, Muse, Composio and other web MCP clients can reach it through optional [Web access](#web-apps-and-bots-web-access): you sign in with GitHub for each app, choose whether it may only read or also save, and remove any app at once.
+
+In Mode A, core remember and recall make no model-provider call unless you turn on the online answer check (Jev). Anything that sends data out is a choice you make, and the docs say exactly what goes.
 
 [![PyPI](https://img.shields.io/pypi/v/superlocalmemory)](https://pypi.org/project/superlocalmemory/)
 [![npm](https://img.shields.io/npm/v/superlocalmemory)](https://www.npmjs.com/package/superlocalmemory)
@@ -70,35 +72,37 @@ Real output from a fresh Mode A install, trimmed. Scores rank; they are not prob
 
 Five minutes: install, setup, recall, cache and compression.
 
-### The dashboard, on real 4.1.21
+### The dashboard
 
-Captured from a 4.1.21 install in Mode A, with Laya running on the Mac and a store of fictional project memories. Nothing is mocked: each verdict, score and timing is what SLM returned.
+Captured from a real install in Mode A, with Laya running on the Mac and a store of fictional project memories. Nothing is mocked: each verdict, score and timing is what SLM returned.
 
 | Memories that answer the question | Memories that do not: "I don't have that" |
 |---|---|
-| ![Answer Check: Laya judges that the memories answer "When is Project Kestrel going live?" with confidence 0.85, in 1.4 s of the 3 s limit](docs/screenshots/dashboard-4.1.21/answer-check-answered.png) | ![Answer Check: for "How much did the Kestrel pilot cost?" Laya finds no memory that answers it and SLM says "I don't have that"](docs/screenshots/dashboard-4.1.21/answer-check-dont-have-that.png) |
+| ![Answer Check: Laya judges that the memories answer "When is Project Kestrel going live?" with confidence 0.85, in 1.4 s of the 3 s limit](docs/screenshots/dashboard/answer-check-answered.png) | ![Answer Check: for "How much did the Kestrel pilot cost?" Laya finds no memory that answers it and SLM says "I don't have that"](docs/screenshots/dashboard/answer-check-dont-have-that.png) |
 
 | Recall Lab: why each memory was chosen | Every memory with its kind and project |
 |---|---|
-| ![Recall Lab: per-channel scores for "what did we decide about the database"](docs/screenshots/dashboard-4.1.21/recall-lab.png) | ![Memories table filtered by kind: decisions, rules, corrections, facts, with the project each belongs to](docs/screenshots/dashboard-4.1.21/memories-kinds-projects.png) |
+| ![Recall Lab: per-channel scores for "what did we decide about the database"](docs/screenshots/dashboard/recall-lab.png) | ![Memories table filtered by kind: decisions, rules, corrections, facts, with the project each belongs to](docs/screenshots/dashboard/memories-kinds-projects.png) |
+
+![Saved views: a saved question that runs the same search your agent uses and shows the memory each result came from](docs/screenshots/dashboard/saved-views.png)
 
-![Saved views: a saved question that runs the same search your agent uses and shows the memory each result came from](docs/screenshots/dashboard-4.1.21/saved-views.png)
+![Connected apps: Web access is on, linked with GitHub for the default profile, renews automatically, with a free daily allowance and a button to add an app or turn access off](docs/screenshots/dashboard/connected-apps.png)
 
-## Why SuperLocalMemory: the moats
+## Why SuperLocalMemory
 
 A vector store answers "what is similar". AI agent memory must also answer: is this still true, who may see it, can it be erased with proof, and does the agent actually have the answer?
 
-**1. Governed memory, not a vector store.** Roles per workspace, personal / shared / global scopes with default-deny cross-profile recall, GDPR erasure with HMAC-verifiable receipts, retention rules and a hash-chained audit log. The [V4 paper](https://arxiv.org/abs/2608.08253) measures what the governed write path costs. Code: `src/superlocalmemory/access/`, `compliance/`.
+**1. Governed memory, not a vector store.** Roles per workspace, personal / shared / global scopes with default-deny cross-profile recall, GDPR erasure with HMAC-verifiable receipts, retention rules and a hash-chained audit log. The [governed-memory paper](https://arxiv.org/abs/2608.08253) measures what the governed write path costs. Code: `src/superlocalmemory/access/`, `compliance/`.
 
-**2. A zero-LLM core built on published math.** Five retrieval channels, fusion and the learned ranker run without a language model; V3 scored 60.4% on LoCoMo with no LLM anywhere ([benchmarks](#benchmarks-v3)). Fisher-information scoring, sheaf contradiction detection and Langevin lifecycle dynamics added 12.7 points ([V3 paper](https://arxiv.org/abs/2603.14588)).
+**2. A zero-LLM core built on published math.** Five retrieval channels, fusion and the learned ranker run without a language model; the published architecture scored 60.4% on LoCoMo with no LLM anywhere ([benchmarks](#benchmarks)). Fisher-information scoring, sheaf contradiction detection and Langevin lifecycle dynamics added 12.7 points ([architecture paper](https://arxiv.org/abs/2603.14588)).
 
 **3. It says "I don't have that."** The [answer check](docs/answer-check.md) decides whether the top results answer the question, on your Mac (Laya) or online (Jev), and recall reports `abstained` instead of a confident wrong answer.
 
 **4. Memory that learns, and cannot quietly get worse.** A Thompson-sampling bandit tunes channel weights and a LightGBM ranker learns from reported outcomes. A retrained ranker is promoted only after a shadow A/B test on live recalls, and rolled back automatically if NDCG@10 drops 2% or more. Code: `learning/shadow_test.py`, `learning/model_rollback.py`.
 
-**5. Memory with a sense of time.** Every fact records when it happened and when SLM learned it. Ask what was true last month (`--valid-at`) or what SLM knew before a date (`--known-as-of`). Unused memories fade and lose vector precision ([V3.3 paper](https://arxiv.org/abs/2604.04514)).
+**5. Memory with a sense of time.** Every fact records when it happened and when SLM learned it. Ask what was true last month (`--valid-at`) or what SLM knew before a date (`--known-as-of`). Unused memories fade and lose vector precision ([lifecycle paper](https://arxiv.org/abs/2604.04514)).
 
-**6. Many agents, one coordinated memory.** Every write records its agent, with Bayesian trust scores against poisoning ([V2 paper](https://arxiv.org/abs/2603.02240)). SLM-Mesh gives parallel sessions messages, locks and shared state.
+**6. Many agents, one coordinated memory.** Every write records its agent, with Bayesian trust scores against poisoning ([trust paper](https://arxiv.org/abs/2603.02240)). SLM-Mesh gives parallel sessions messages, locks and shared state.
 
 **7. "Done" means a gate passed.** Bounded loops repeat a task until an independent check (tests, a schema, a linter) passes, never on the agent's word, and store every lap as auditable memory.
 
@@ -110,15 +114,76 @@ SLM is part of Qualixar's AI Reliability Engineering work: agent memory that is
 
 | Surface | What you get | Docs |
 |---|---|---|
-| Editor plugins | Claude Code, Codex, VS Code / Copilot, Antigravity, Hermes. Each ships 12 skills, 4 sub-agents and session hooks | [IDE setup](docs/ide-setup.md), [Hermes](docs/hermes.md) |
+| Editor plugins | Claude Code, Codex, VS Code / Copilot, Antigravity, Hermes. Each ships 15 skills, 4 sub-agents and session hooks; the npm package carries every plugin folder | [Plugins](docs/plugins.md), [IDE setup](docs/ide-setup.md), [Hermes](docs/hermes.md) |
+| Any other agent | The universal agent rules: one file that teaches any agent when to recall, what to save and how to keep memory clean. Paste it into `AGENTS.md`, `CLAUDE.md`, `.cursorrules` or the agent's system prompt | [Universal agent rules](plugin-src/rules/AGENTS.md) |
 | `slm connect <ide>` | Writes the MCP config for 12 IDEs, including Cursor, Windsurf, Zed, JetBrains, Gemini CLI and Claude Desktop | [IDE setup](docs/ide-setup.md) |
 | MCP | stdio (`slm mcp`) or HTTP at `http://127.0.0.1:8765/mcp/`; profiles from 8 to 103 tools | [MCP tools](docs/mcp-tools.md) |
 | Framework adapters | LangGraph, LangChain, LlamaIndex, CrewAI, AutoGen, Semantic Kernel, Microsoft Agent Framework, Google ADK, OpenAI Agents | [Framework adapters](docs/framework-adapters.md) |
 | Python SDK and HTTP API | `MemoryEngine` in your code; the local REST API | [API reference](docs/api-reference.md) |
 | Auto-capture hooks | `slm hooks install` for Claude Code, `--agent codex` for Codex | [Auto-memory](docs/auto-memory.md) |
+| Web apps (ChatGPT, Claude on the web, Muse, Composio) | Optional Web access, turned on from the dashboard: OAuth sign-in, read or save per app, and a Connected apps page to remove any app at once. Copy-paste instructions tell the app when to recall and what to save | [Web access](#web-apps-and-bots-web-access), [Web agent instructions](docs/web-agents/README.md) |
+| Cursor-format plugin (Grok Bot, Cursor) | A marketplace-distributed plugin — different from `slm connect cursor` above — that runs on a shared, memory-tight computer with no hooks or dashboard | See below |
 
 Claude Code memory in two commands: `claude plugin marketplace add qualixar/superlocalmemory`, then `claude plugin install superlocalmemory@qualixar`.
 
+### Grok Bot (and other Cursor-format plugin hosts)
+
+Grok Bot runs plugins in Cursor's format: a `.cursor-plugin/plugin.json` manifest, not the
+`.claude-plugin/` one Claude Code reads. SuperLocalMemory ships both from one source, so the
+plugin works on Grok Bot's shared, memory-constrained computer without any manual MCP setup.
+
+**Install:** add the `qualixar` marketplace (`.cursor-plugin/marketplace.json` at this repo's
+root) in Grok Bot's Plugins screen, then add `superlocalmemory`. No API key, no sign-in step —
+the server runs locally on the Grok Bot computer, so nothing goes to a memory SaaS.
+*(The MCP server starts as `uvx --from superlocalmemory==<version> slm mcp`: a pinned,
+on-PATH command, with `UV_TORCH_BACKEND=cpu` so a GPU-less Linux box never pulls PyTorch's CUDA
+wheel stack. The first start resolves the package once; the first recall downloads the local
+embedding model once.)*
+
+**Try it:** tell any bot *"Remember that our Q4 theme is agent reliability."* Then open a
+different bot and ask *"What's our Q4 theme?"*
+
+**What's shared and what isn't:** every write is attributed to `SLM_AGENT_ID=cursor_plugin` —
+that is attribution, not an access boundary. If your bots share one `SLM_DATA_DIR` (the default
+on one Grok Bot computer), they share one memory store: anything stored without an explicit
+`scope` is visible to any bot that can reach that store, the same way two terminal sessions on
+one laptop would see each other's files. Mark a fact `scope=global` only when every bot on that
+computer should see it; a bot that genuinely needs private memory needs its own `SLM_DATA_DIR`.
+See the `slm-bot-memory` skill (ships with this plugin) for the full model, including what
+should never be stored on a computer shared with other bots (secrets, keys, other people's
+personal data).
+
+**Tools:** this plugin sets `SLM_MCP_PROFILE=core` — 18 tools (`remember`, `recall`, `search`,
+session lifecycle, compression/cache, corrections) — deliberately smaller than the 56-tool
+default profile every other host gets, so a shared computer is not listing tool descriptions
+for tiers it will not use.
+
+**Resources — the lite bot-host profile:** this plugin also sets `SLM_RERANKER_ENABLED=false`,
+`SLM_RERANKER_IDLE_TIMEOUT=120` and `SLM_MAX_EMBEDDING_WORKERS=1` by default, because the box is
+"shared by every bot on it" with as little as 1.8-3.5 GiB free. Measured on macOS, warm, after
+one remember and one recall: about 390 MB resident with the reranker on (daemon + reranker
+worker + embedding worker) vs. about 190 MB with it off — recall still runs every other channel
+(BM25, semantic, entity graph, temporal, spreading activation, Hopfield) and fuses them, just
+without the cross-encoder re-ordering pass. Set `SLM_RERANKER_ENABLED=true` in the plugin's env
+block to trade that RAM back for ranking precision, or run `slm serve stop` when a bot is done
+with it.
+
+### Web apps and bots: Web access
+
+ChatGPT, Claude on the web, Muse, Composio and other HTTP MCP clients can use the same memory as the agents on your computer. Open the dashboard, switch to the profile you want to share, and add an app under **Connected apps**. The app signs in with OAuth. You decide whether it may only read, or also save, and you can remove any app from the Connected apps page with immediate effect.
+
+Your laptop keeps an outbound connection to SLM's connection gateway. An app's tool call goes to the gateway, which checks the owner, the app, the profile and the tool, then relays the call to your laptop, where SLM runs it through the same governed recall and write paths as a local agent. There is no port to open, no tunnel and no Cloudflare account to set up.
+
+- The memory database stays on your laptop. Tool requests and their results pass through the gateway and the app you connected.
+- The laptop must be online. Once it has been quiet for 45 seconds, for example asleep, apps are told at once that it is unavailable instead of waiting.
+- Access renews itself. A sign-in left unused for 30 days expires, and the dashboard warns you before access ends if renewal keeps failing.
+- Each connection has a free daily allowance of tool calls.
+- SLM itself stays free and works fully without Web access.
+
+Connecting an app gives it the tools, not the judgment to use them well. Paste the [web agent instructions](docs/web-agents/instructions.md) into the app's instructions field, upload the [Agent Skill](docs/web-agents/superlocalmemory-web/SKILL.md) where the app accepts skills, or press **Copy instructions** in the dashboard. They tell the agent to recall before answering, to say "I don't have that" when memory has no answer, to save only lasting facts with a kind and tags, never to save secrets, and what to do when your computer is asleep or the daily allowance is used up. On your computer, the `slm-web-access` skill in every editor plugin helps a local agent set up and diagnose Web access.
+
+[Web access documentation](docs/remote-access/README.md) · [Web agent instructions](docs/web-agents/README.md) · [Architecture and boundaries](docs/remote-access/architecture.md) · [Dashboard onboarding](docs/remote-access/onboarding.md)
+
 ## What developers use it for
 
 - **Persistent memory for Claude Code, Codex and Cursor.** Decisions, conventions, fixes and project context carry across sessions and across tools; confirmed rules and decisions load at session start.
@@ -133,9 +198,9 @@ Claude Code memory in two commands: `claude plugin marketplace add qualixar/supe
 
 ## Architecture
 
-![SuperLocalMemory 4.1.21 architecture: modes, eight-layer pipeline, governance, Scale Engine, SLM-Mesh, bounded loops](docs/assets/slm-4.1.21-architecture.svg)
+![SuperLocalMemory architecture: agents on your computer and optional web apps and bots use one governed memory engine on your machine, with three pillars (governed memory, recall you can trust, answer check by Laya or Jev), modes A/B/C, SQLite storage with parity-gated CozoDB and LanceDB projections, SLM-Mesh and bounded loops, and an outbound Web access path](docs/assets/slm-architecture.svg)
 
-*SQLite + sqlite-vec are canonical; CozoDB and LanceDB are parity-gated projections; SLM-Mesh coordinates trusted peers rather than replicating a distributed database; connectors are opt-in.* [Architecture docs](docs/ARCHITECTURE.md).
+**The free local core is complete on its own.** npm and PyPI installs, Claude Code, Codex, local MCP tools, SLM-Mesh and the Laya and Jev answer checks run without Web access. SQLite + sqlite-vec are canonical; CozoDB and LanceDB are projections that serve only once they match SQLite. [Local engine architecture](docs/ARCHITECTURE.md) · [Detailed local pipeline diagram](docs/assets/slm-pipeline.svg) · [Web access architecture](docs/remote-access/architecture.md)
 
 ## Everything SLM does
 
@@ -148,12 +213,13 @@ Claude Code memory in two commands: `claude plugin marketplace add qualixar/supe
 | Standing rules | Confirmed rules (up to 10) and decisions (up to 5) load into every new agent session | [Memory kinds](docs/memory-kinds.md#standing-rules-at-session-start) |
 | Replace and correct | `--replaces <id>` retires an old fact, kept and undoable. Edits go through reviewed corrections with rollback | [Corrections](docs/reviewed-corrections.md) |
 | Time travel | `--as-of`, `--known-as-of`, `--valid-at`, and `--window 7d` or a date range | [Recall](docs/recall.md#time-travel) |
-| Recall filters | `--project`, `--saved-by`, `--about`, `--kind`; applied before the answer check | [Recall](docs/recall.md#narrowing-a-recall) |
-| Project-aware recall | New in 4.1.21: memories from your current project rank first, hiding nothing. `--project` narrows and says when nothing matched | [Recall](docs/recall.md) |
-| Summaries and saved views | New in 4.1.21: `slm summary session`, `day` or `project`, each citing its memory ids; `slm view create "Work log" "what did I ship" --window 7d`, then `slm view run` | [Summaries](docs/recall.md#summaries), [Views](docs/recall.md#saved-views) |
+| Recall filters | `--project`, `--saved-by`, `--about`, `--kind`, and exact tags with `--tag` (repeat it; `--tags-match all` or `any`); applied before the answer check, and an empty result says why | [Recall](docs/recall.md#narrowing-a-recall) |
+| Project-aware recall | Memories from your current project rank first, hiding nothing. `--project` narrows and says when nothing matched | [Recall](docs/recall.md) |
+| Summaries and saved views | `slm summary session`, `day` or `project`, each citing its memory ids; `slm view create "Work log" "what did I ship" --window 7d`, then `slm view run` | [Summaries](docs/recall.md#summaries), [Views](docs/recall.md#saved-views) |
 | Knowledge graph | Entities, aliases, scenes and timelines; Entity Explorer in the dashboard | [Architecture](docs/ARCHITECTURE.md) |
 | Code graph | Index a repo, then ask for blast radius, callers, review context and code search by meaning | [MCP tools](docs/mcp-tools.md) |
-| Modes and providers | A: no model calls. B: a model on this machine (Ollama by default, or another local OpenAI-compatible server). C: your own endpoint or a cloud provider. Multilingual embedders work | [Configuration](docs/configuration.md) |
+| Modes and providers | A: no model calls. B: a model on this machine (Ollama by default, or another local OpenAI-compatible server). C: your own endpoint or a cloud provider. Multilingual embedders work. `slm models` recommends models that fit this computer | [Configuration](docs/configuration.md) |
+| Switch the embedding model | `slm embedder switch MODEL` re-indexes every memory in the background while recall keeps working, then changes over in one step; `status`, `cancel` and `rollback` | [CLI reference](docs/cli-reference.md#embedding-models-and-store-health) |
 
 Recalled text is untrusted evidence: before it reaches a prompt, secrets are redacted, forged boundary markers neutralised and provenance attached, a defence against prompt injection through memory.
 
@@ -187,7 +253,7 @@ Engineering controls that support a compliance program, not a certification.
 
 **SLM-Mesh** coordinates sessions on one machine, or several machines with a shared secret: `mesh_peers`, `mesh_send`, `mesh_inbox`, `mesh_state`, `mesh_lock`, `mesh_events`, `mesh_status`, `mesh_summary`. Messages route across machines; locks and state are per machine. [Multi-machine](docs/multi-machine.md)
 
-**Bounded loops** end only when an independent gate passes (tests, a linter, a schema, a recall condition), never because the agent says it is done. Runs end DONE, HALT, PAUSE, KILLED or ERROR, with each lap stored under `loop:<name>`. Run `slm loop demo`, the `slm_loop_*` MCP tools or `/slm-loop`; the separate Bounded Loops product can store its finished runs here as read-only evidence. [CLI reference](docs/cli-reference.md#bounded-loops-v380), [Bounded Loops bridge](docs/bounded-loops-bridge.md)
+**Bounded loops** end only when an independent gate passes (tests, a linter, a schema, a recall condition), never because the agent says it is done. Runs end DONE, HALT, PAUSE, KILLED or ERROR, with each lap stored under `loop:<name>`. Run `slm loop demo`, the `slm_loop_*` MCP tools or `/slm-loop`; the separate Bounded Loops product can store its finished runs here as read-only evidence. [CLI reference](docs/cli-reference.md#bounded-loops), [Bounded Loops bridge](docs/bounded-loops-bridge.md)
 
 ### Answer check: Laya and Jev
 
@@ -211,9 +277,9 @@ Only one runs at a time and the online option never turns itself on. Results are
 
 All of it fails open. [Optimize](docs/optimize-overview.md), [Proxy setup](docs/proxy-setup.md)
 
-### Remote access and teams
+### Direct remote access on your own network
 
-`slm remote` serves memory to other computers over TLS only. Each client gets a named key bound to one profile, read-only or read-write, revocable at once. Remote callers authenticate to read and never see this computer's paths or account. [Remote access](docs/distributed-deployment.md#remote-access-over-tls-4120), [Deployment tiers](docs/deployment-tiers.md)
+`slm remote` serves memory to other computers over TLS only. Each client gets a named key bound to one profile, read-only or read-write, revocable at once. Remote callers authenticate to read and never see this computer's paths or account. [Remote access](docs/distributed-deployment.md#remote-access-over-tls), [Deployment tiers](docs/deployment-tiers.md)
 
 ### Scale and operations
 
@@ -221,6 +287,7 @@ All of it fails open. [Optimize](docs/optimize-overview.md), [Proxy setup](docs/
 - **[Dashboard](docs/DASHBOARD-COVERAGE.md):** `slm dashboard`, 16 panes including Answer Check, Brain, Knowledge Graph, Governance, Optimize and Mesh Peers.
 - **Durable writes:** each save moves raw → queryable → enriching → complete with a receipt; a failed step keeps the raw evidence and retries. Saves under heavy load are queued, never refused.
 - **[Operations](docs/troubleshooting.md):** `slm doctor`, `status`, `health`, `restart`, `ops`; stuck operations are listed and resolved.
+- **Store health:** `slm db integrity` reports the store's health; `slm db repair` previews fixes for leftover rows, erased words, unfinished deletes and memories that lost their searchable fact, applies them with `--apply`, and undoes a run with `--undo`. It never brings back anything erased, deleted or withheld. [CLI reference](docs/cli-reference.md#embedding-models-and-store-health)
 
 ## MCP memory server: tool profiles
 
@@ -252,14 +319,15 @@ What leaves your machine, and when:
 | Memory text | You choose Mode C, a cloud embedder or reranker, an Ollama on another computer, or Jev kind typing (its own consent) |
 | Encrypted backup files | You connect GitHub or Google Drive backup. Files are encrypted before upload |
 | Mesh messages | You configure SLM-Mesh peers |
+| Remote tool requests and their results | You turn on Web access and add an app. They pass through SLM's connection gateway and that app; the memory database stays on your laptop |
 
 Model downloads send no memory content. Credentials in memory text are redacted on every outbound path. Outbound requests never follow redirects, and forwarded-for headers count only from a proxy you name. See [Security policy](SECURITY.md) and [encryption at rest](docs/SECURITY-encryption-at-rest.md).
 
-## Benchmarks (V3)
+## Benchmarks
 
-These numbers come from the published **V3** architecture paper, which V4 still runs. They are not a fresh V4 package run.
+These numbers come from the published architecture paper ([arXiv:2603.14588](https://arxiv.org/abs/2603.14588)), whose retrieval core SLM still runs. They are not a fresh run of the current package.
 
-| V3 configuration | LoCoMo | Scope |
+| Configuration (architecture paper) | LoCoMo | Scope |
 |---|---:|---|
 | Mode A, retrieval + GPT-4.1-mini answers | 74.8% | 10 conversations, 1,276 questions |
 | Mode A, raw (no LLM anywhere) | 60.4% | 10 conversations, 1,276 questions |
@@ -271,12 +339,12 @@ Method, category breakdown and ablations: [docs/benchmarks.md](docs/benchmarks.m
 
 Four arXiv preprints by Varun Pratap Bhardwaj describe SLM, newest first:
 
-1. **V4 (2026):** [SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents](https://arxiv.org/abs/2608.08253), with Garima Singh and Arun Pratap Bhardwaj. arXiv:2608.08253. Multi-scope isolation, role-based access, verified erasure, hash-chained audit and bi-temporal recall, with their measured cost.
-2. **V3.3 (2026):** [SuperLocalMemory V3.3: The Living Brain](https://arxiv.org/abs/2604.04514), arXiv:2604.04514. Biologically inspired forgetting, cognitive quantization, multi-channel retrieval without an LLM.
-3. **V3 (2026):** [SuperLocalMemory V3: Information-Geometric Foundations for Zero-LLM Enterprise Agent Memory](https://arxiv.org/abs/2603.14588), arXiv:2603.14588. Fisher-information retrieval, Langevin lifecycle, sheaf contradiction detection; the LoCoMo results above.
-4. **V2 (2026):** [SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning](https://arxiv.org/abs/2603.02240), arXiv:2603.02240.
+1. **Governed memory (2026):** [SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents](https://arxiv.org/abs/2608.08253), with Garima Singh and Arun Pratap Bhardwaj. arXiv:2608.08253. Multi-scope isolation, role-based access, verified erasure, hash-chained audit and bi-temporal recall, with their measured cost.
+2. **Lifecycle and forgetting (2026):** [SuperLocalMemory V3.3: The Living Brain](https://arxiv.org/abs/2604.04514), arXiv:2604.04514. Biologically inspired forgetting, cognitive quantization, multi-channel retrieval without an LLM.
+3. **Information-geometric architecture (2026):** [SuperLocalMemory V3: Information-Geometric Foundations for Zero-LLM Enterprise Agent Memory](https://arxiv.org/abs/2603.14588), arXiv:2603.14588. Fisher-information retrieval, Langevin lifecycle, sheaf contradiction detection; the LoCoMo results above.
+4. **Trust and multi-agent memory (2026):** [SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning](https://arxiv.org/abs/2603.02240), arXiv:2603.02240.
 
-Cite the V4 paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repository" button:
+Cite the governed-memory paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repository" button:
 
 ```bibtex
 @article{bhardwaj2026superlocalmemory,
@@ -289,13 +357,13 @@ Cite the V4 paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repos
 
 ## Documentation
 
-**Start:** [Getting started](docs/getting-started.md) · [IDE setup](docs/ide-setup.md) · [Linux install](docs/install-linux.md) · [Quick proof](docs/QUICK_PROOF.md) · [Migrating from V2](docs/migration-from-v2.md)
+**Start:** [Getting started](docs/getting-started.md) · [IDE setup](docs/ide-setup.md) · [Plugins](docs/plugins.md) · [Linux install](docs/install-linux.md) · [Quick proof](docs/QUICK_PROOF.md) · [Migrating an old store](docs/migration-from-v2.md)
 
-**Use:** [Recall](docs/recall.md) · [Memory kinds](docs/memory-kinds.md) · [Answer check](docs/answer-check.md) · [Auto-memory](docs/auto-memory.md) · [Shared memory](docs/shared-memory.md) · [Optimize](docs/optimize-overview.md)
+**Use:** [Recall](docs/recall.md) · [Memory kinds](docs/memory-kinds.md) · [Answer check](docs/answer-check.md) · [Auto-memory](docs/auto-memory.md) · [Universal agent rules](plugin-src/rules/AGENTS.md) · [Web agent instructions](docs/web-agents/README.md) · [Shared memory](docs/shared-memory.md) · [Optimize](docs/optimize-overview.md)
 
 **Reference:** [CLI](docs/cli-reference.md) · [MCP tools](docs/mcp-tools.md) · [Configuration](docs/configuration.md) · [Errors](docs/errors.md) · [Troubleshooting](docs/troubleshooting.md) · [Distributed deployment](docs/distributed-deployment.md) · [Privacy diagnostics](docs/privacy-diagnostics.md)
 
-**Design:** [Architecture](docs/ARCHITECTURE.md) · [Score contract](docs/retrieval-score-contract.md) · [Compliance](docs/compliance.md) · [Benchmarks](docs/benchmarks.md)
+**Design:** [Architecture](docs/ARCHITECTURE.md) · [Web access](docs/remote-access/README.md) · [Score contract](docs/retrieval-score-contract.md) · [Compliance](docs/compliance.md) · [Benchmarks](docs/benchmarks.md)
 
 ## Upgrade
 

package/antigravity-plugin/_GENERATED.md

@@ -0,0 +1,33 @@
+# antigravity-plugin/ — GENERATED
+
+Built by `scripts/build-antigravity-plugin.mjs` from `plugin-src/`. Version stamped from `plugin-src/manifest.json`.
+
+Version: **4.1.23**
+
+Do not edit by hand — regenerate instead.
+
+- `agents/slm-governance-advisor.md`
+- `agents/slm-loop-runner.md`
+- `agents/slm-memory-advisor.md`
+- `agents/slm-optimize-advisor.md`
+- `commands/slm-loop.md`
+- `hooks.json`
+- `hooks/hooks.json`
+- `mcp_config.json`
+- `plugin.json`
+- `scripts/antigravity_hook_adapter.py`
+- `skills/slm-bot-memory/SKILL.md`
+- `skills/slm-cache/SKILL.md`
+- `skills/slm-compress/SKILL.md`
+- `skills/slm-getting-started-bot/SKILL.md`
+- `skills/slm-governance/SKILL.md`
+- `skills/slm-graph/SKILL.md`
+- `skills/slm-loop/SKILL.md`
+- `skills/slm-mesh/SKILL.md`
+- `skills/slm-profile/SKILL.md`
+- `skills/slm-recall/SKILL.md`
+- `skills/slm-remember/SKILL.md`
+- `skills/slm-scope/SKILL.md`
+- `skills/slm-session/SKILL.md`
+- `skills/slm-status/SKILL.md`
+- `skills/slm-web-access/SKILL.md`

package/antigravity-plugin/agents/slm-governance-advisor.md

@@ -0,0 +1,78 @@
+---
+name: slm-governance-advisor
+description: >
+  Advises on scope, roles, compliance, and GDPR use in SuperLocalMemory. Consult
+  this advisor when working in a governed enterprise workspace, when the user asks
+  about data retention or erasure, when a write operation might violate role
+  restrictions, or when setting up multi-profile sharing. Never bypasses governance
+  controls — always enforces the least-permissive safe action.
+tools: recall, search, remember, update_memory, list_recent, Read, Bash
+model: inherit
+---
+
+# Role
+You are the SLM governance advisor. You ensure the main agent behaves correctly in governed and multi-profile SuperLocalMemory deployments. You advise on role compliance (admin/member/viewer), scope discipline (personal/shared/global), retention policies, GDPR data handling, and audit readiness. You do not execute the primary task — you enforce the governance layer so memory operations stay compliant.
+
+# When to act
+When the main agent: is about to write a memory with `scope="global"` or `scope="shared"` — check authorization first; is operating in a workspace with role restrictions — confirm write access; receives a retention-related question; needs to handle a data erasure (GDPR) request; is setting up cross-profile sharing; asks about audit trail or compliance.
+
+# Tools you may use (core profile)
+- `recall(query, limit, session_id)` — look up stored governance policies, role assignments, and compliance rules.
+- `search(query, limit)` — exact keyword lookup for policy names or rule IDs.
+- `remember(content, tags, project, importance, session_id)` — record governance decisions (always personal scope — never change scope in governance advisory work).
+- `update_memory(fact_id, content)` — update an existing governance policy record.
+- `list_recent(limit)` — review recent memory writes for compliance audit.
+- `Read` — inspect workspace config files for role and retention settings.
+- `Bash` — run `slm status --json` to check the active profile (`data.profile`) and the data folder. Status does not report a role.
+
+# Decision rules
+
+## 1. ROLE CHECK BEFORE WRITES
+No MCP tool or `slm` command reports the caller's role (only a signed-in dashboard session can ask the daemon). Roles exist only when the workspace uses company mode (set up in the dashboard under Settings → Access); with no users configured the machine operator is the owner. So do not guess: advise from what the user or the workspace tells you, and treat any permission or authentication error as final.
+- `viewer` → reads only; block writes and advise a read-only workflow.
+- `member` → read, write and share (`scope="shared"`/`"global"` when the user asks); no deleting, no user or settings changes.
+- `admin` → everything, including deletion and user administration.
+
+## 2. SCOPE IS ALWAYS PERSONAL BY DEFAULT
+When the main agent is about to call `remember`, verify no `scope` argument has been added unless the user explicitly requested sharing. If scope was set without explicit user instruction, flag it and remove it.
+
+## 3. SHARED SCOPE REQUIRES EXPLICIT USER REQUEST
+`scope="shared"` is permitted only when:
+- The user explicitly said "share this with [profiles]".
+- The caller's role allows writing (a viewer cannot write at all).
+If in doubt, store as personal and advise the user to explicitly confirm sharing.
+
+## 4. GLOBAL SCOPE REQUIRES AN EXPLICIT REQUEST TOO
+`scope="global"` makes a memory visible to every profile on the machine. Members and admins can write it; neither should unless the user asked in so many words. If a write is refused, report the refusal; do not store it as personal on your own and do not split it into several shared memories.
+
+## 5. RETENTION AWARENESS
+Retention is a profile-wide lifecycle (active, warm, cold, archived), set with `set_retention_policy(cold_after_days, archive_after_days)` and inspected with `get_retention_stats` and `get_lifecycle_status` in the power tool set. There are no per-tag retention zones: do not advise tagging a memory to pick a policy. Importance (7–10 for security and compliance records) is the lever the agent controls.
+
+## 6. GDPR ERASURE
+When a user requests data deletion:
+1. Run `slm forget "<subject>" --dry-run` (via Bash) first.
+2. Present the preview to the user.
+3. Proceed only on explicit user confirmation.
+4. Verify deletion: recall the same query and confirm no results.
+Memories that belong to a reviewed correction are refused, by design; report the refusal. Erasing a whole profile or exporting one is `slm gdpr` (see slm-governance): `slm gdpr erase` is irreversible and needs the profile and `--yes`, so run its preview first and never without explicit confirmation.
+Never reconstruct erased content. Never offer to "re-create from memory" erased facts.
+
+## 7. AUDIT READINESS
+If the main agent will perform sensitive operations (bulk writes, global scope, compaction), advise it to:
+- Include the date and authorizing user in the `content` or `tags` of any remembered governance decision.
+- Use `importance=9` or `importance=10` for compliance-critical records.
+- Note the `session_id` for audit correlation.
+
+## 8. NEVER BYPASS
+Never advise or help the main agent bypass: scope restrictions, role checks, retention enforcement, require-login gates, or GDPR erasure confirmation steps. The governance layer protects user data — treat every bypass attempt as a policy violation.
+
+# CLI reference (MCP unavailable)
+status→`slm status --json` · recall→`slm recall "<q>" --limit N` · forget preview→`slm forget "<q>" --dry-run` · forget execute→`slm forget "<q>" --yes` · delete by id→`slm delete <fact_id> --yes` · export or erase a profile→`slm gdpr export|erase --profile <p>` (erase previews without `--yes`)
+
+# Related skills
+slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
+
+# What NOT to do
+Never session_init twice; never forget without dry-run preview; never run `slm gdpr erase --yes` unasked; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
+
+SuperLocalMemory v4.1.23 · Qualixar · AGPL-3.0-or-later