superlocalmemory 4.1.22 → 4.1.24

package/.claude-plugin/marketplace.json

@@ -21,7 +21,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory",
       "source": "./plugin",
-      "version": "4.1.22"
+      "version": "4.1.24"
     },
     {
       "author": {
@@ -39,7 +39,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory-codex",
       "source": "./codex-plugin",
-      "version": "4.1.22"
+      "version": "4.1.24"
     }
   ]
 }

package/CHANGELOG.md

@@ -5,6 +5,151 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.24] — Connecting ChatGPT, Grok Bot, Muse and dots works the first time
+
+### Added
+
+- **One setup prompt for bots and web apps.** Muse, Grok Bot, ChatGPT and
+  ChatGPT dots cannot be connected by a button alone: the connection gives
+  them the tools, not the judgment to use them. Paste
+  [the setup prompt](docs/web-agents/setup-prompt.md) into a chat with the app
+  once it is connected. It asks the app to keep the SuperLocalMemory skill
+  permanently, then tests saving and recall, showing the raw tool output at
+  each step. A test keeps the skill in it identical to the other copies.
+- **Step-by-step guides for each app** in
+  [Connect each app](docs/remote-access/hosts.md): ChatGPT (custom MCP server,
+  base scopes, a removed plugin's name stays taken), ChatGPT dots, Grok Bot,
+  Composio and Muse, with what to do when something goes wrong.
+
+### Changed
+
+- The instructions for web agents now say to report tool results as the tool
+  returned them, and never to say a save or recall worked unless a tool
+  returned that result.
+- The README opens with one centred block: name, tagline, badges, links and
+  a picture of the answer check.
+- The framework adapter READMEs say which adapters are on PyPI and how to
+  install the others, instead of an old version label.
+
+### Fixed
+
+- **Web apps were offered reading only.** The memory server advertised only
+  the read permission, so ChatGPT, Grok Bot and other apps never asked to
+  save, and the approval page could not offer it. The server now advertises
+  reading, saving and session tools; saving and session tools stay unticked on
+  the approval page until you tick them. ChatGPT keeps the permissions it
+  discovered when a plugin was created: if yours can only read, remove the
+  plugin and create it again (the guide shows how). This was fixed on the
+  connection gateway on 8 October, so it works with every SLM version.
+- **"This sign-in session is no longer valid" after a sign-in that worked.**
+  Going back to, refreshing or resubmitting the approval page after it
+  finished now says the sign-in already finished and that you can close the
+  page.
+- **Connected apps listed an app's old approval next to its new one.** When
+  an app connects again, the older approval is now marked "Replaced by a newer
+  approval" under the current one, with **Remove access**. Nothing is removed
+  for you; the older approval keeps working until you remove it.
+- The Hermes plugin manifest carries the release version.
+
+## [4.1.23] — Your web apps and bots use the same memory, and it stays on your computer
+
+### Added
+
+- **Web access.** ChatGPT, Claude on the web, Claude Code on the web, Muse,
+  Composio and any MCP client that supports remote connections with OAuth can
+  use the memory on your computer. Turn it on from the dashboard's new
+  **Connected apps** page, sign in with GitHub, and choose per app whether it
+  may only read, also save, and use session tools. Your computer keeps one
+  outbound link to SLM's connection gateway; there is no port to open and no
+  tunnel or Cloudflare account to set up. The memory database never leaves the
+  computer, and SLM works fully without Web access. Each connection has a free
+  daily allowance of tool calls.
+- Web access renews its own credentials while your computer is online. If the
+  computer stays offline long enough for access to lapse, the Connected apps
+  page warns before it ends and says what to do after. Once the computer has
+  been silent for 45 seconds, for example asleep, a web app is told at once that
+  it is unavailable. A relayed recall answers inside the relay's time budget,
+  and remote answers are compact JSON with host details redacted.
+- **Connected apps** lists every app that can reach your memory and removes
+  any of them with immediate effect. Memory and local configuration are kept.
+- **Instructions for web agents.** `docs/web-agents/` has a full and a short
+  instruction block and an Agent Skill folder that tell a connected app when to
+  recall, when to say it has no answer, what to save (with kind, tags and an
+  idempotency key) and what to do when your computer is asleep or the daily
+  allowance is used up. The dashboard copies the short block for you.
+- **`slm-web-access` skill** in every editor plugin, so a local agent can help
+  you set up Web access and diagnose a connection.
+- **`slm db repair` brings the two vector indexes back in line with the
+  memories.** It rewrites sqlite-vec rows that no longer match their memory's
+  embedding and removes LanceDB rows for memories that are gone, withheld or
+  soft-deleted; `slm db integrity` reports both counts.
+- **SLM checks your memory store after an upgrade, and Health offers Repair
+  now.** A few minutes after the first start of a new version, the store is
+  checked in the background; the check only reads. The dashboard's Health page
+  lists what it found in plain words, the sidebar marks Health while something
+  can be repaired, and **Repair now** saves a full backup copy first, runs the
+  same repair as `slm db repair`, and checks again. If the backup copy cannot
+  be made, nothing is changed.
+- **Every editor plugin ships in the npm package**: Codex, VS Code / Copilot,
+  Hermes and Antigravity alongside Claude Code, with all skills, agents and
+  rules. `slm codex install` now installs every skill and all four sub-agents.
+  [Editor and agent plugins](docs/plugins.md) gives each host's install
+  commands.
+- **Model advice carries SLM's own measured results**, and a model measured on
+  a small sample is ranked conservatively.
+
+### Changed
+
+- The editor plugins' skills, agents and rules were checked against the
+  current tools and corrected where they had drifted.
+
+### Fixed
+
+- **4.1.22 could corrupt `memory.db` or lose saves (GitHub #153).** The start-up
+  cache read opened and closed `memory.db` inside the daemon. SQLite's locks
+  belong to the process, so that close dropped them: another process (a hook,
+  `slm mcp`, `slm doctor`) could then delete the WAL under the running daemon,
+  which logged "database disk image is malformed" or "disk I/O error" and could
+  write stale pages back into the store. The read now runs in a child process.
+  Thanks to @MelleKoning for the detailed report and an independent fix (#154).
+  **If you run 4.1.22, upgrade.** If `slm doctor` then reports a malformed
+  database, list restore points with `slm db restore-points` and go back to the
+  newest one with `slm db restore <id>`; then run `slm db integrity`. Upgrading
+  is the supported path: migrations are forward-only, so going back to an older
+  release needs a backup taken before it.
+- On SQLite older than 3.42 (for example Ubuntu 22.04), every start and every
+  erasure logged "keyword index secure delete not enabled: SQL logic error".
+  That SQLite cannot remove deleted words from the keyword index at once;
+  SLM now says so once at info level, and `slm db repair` removes them.
+- The "Lance semantic projection diverged from SQLite" warning at every start
+  is gone: LanceDB search now covers every tier the canonical search ranks.
+- Semantic search on LanceDB now finds cold and archived memories too.
+- A rebuilt vector projection leaves out withheld and soft-deleted memories.
+- An erasure also blanks the preview of the erased memory in auto-observe
+  activity events, and `slm db repair` blanks previews that earlier erasures
+  left in activity events.
+- A web app's save or recall is never filed under the session of an agent
+  running on your computer.
+- A second suggestion about the same memory no longer logs a warning on every
+  save.
+- A memory saved with the same words as another memory is no longer counted as
+  repair work that the repair could never do.
+- Maintenance never creates an empty database at a path where no store exists.
+- The Hermes guide named a release download that was never published; it now
+  installs the plugin from the repository. The VS Code guide named a connect
+  command that does not exist; it is `slm connect vscode-copilot --here`.
+- The laptop link no longer fails at start when two parts read its credential
+  at the same time.
+- The `remember` tool is declared additive, so clients do not treat saving as a
+  destructive action.
+
+### Security
+
+- The remote connector's HTTP clients never follow a redirect, and tests pin
+  that the API key cannot be sent to another host.
+- Web access grants are narrowed to the scopes you consented to, for one MCP
+  resource; client registration keeps no diagnostic records.
+
 ## [4.1.22] — Faster recall from the first second, memories that stay findable, deletes you can trust
 
 ### Added

package/README.md

@@ -1,32 +1,34 @@
-<p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="assets/branding/slm-wordmark-dark.svg">
-    <img src="assets/branding/slm-wordmark-light.svg" alt="SuperLocalMemory: local-first memory for AI agents" width="360">
-  </picture>
-</p>
-
-# SuperLocalMemory: governed, local-first memory for AI agents
+<div align="center">
 
-Claude Code, Codex, Cursor and other MCP clients forget what they learned when a session ends. SuperLocalMemory (SLM) gives them one long-term memory that lives on your machine: it learns from use, enforces who may read and erase what, coordinates many agents, and says "I don't have that" instead of guessing.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="assets/branding/slm-wordmark-dark.svg">
+  <img src="assets/branding/slm-wordmark-light.svg" alt="SuperLocalMemory" width="380">
+</picture>
 
-**Every recall is checked before your agent uses it.** A judge decides whether the memories found actually answer the question: **Laya** runs fully on your Mac, and **Jev** runs online on Windows, Linux and macOS. When they don't answer it, SLM says so instead of handing over a confident wrong answer: a hallucination guard for retrieval ([answer check](#answer-check-laya-and-jev)).
+### Long-term memory for your AI agents. On your computer, governed, and honest when it doesn't know.
 
-In Mode A, core remember and recall make no model-provider call. Anything that sends data out is a choice you make, and the docs say exactly what goes.
+Claude Code, Codex, Cursor, ChatGPT, Grok Bot and other MCP clients share one memory that lives on your machine. It learns from use, controls who may read and erase what, and says "I don't have that" instead of guessing.
 
 [![PyPI](https://img.shields.io/pypi/v/superlocalmemory)](https://pypi.org/project/superlocalmemory/)
 [![npm](https://img.shields.io/npm/v/superlocalmemory)](https://www.npmjs.com/package/superlocalmemory)
 [![PyPI downloads](https://img.shields.io/pepy/dt/superlocalmemory?label=PyPI%20downloads)](https://pepy.tech/project/superlocalmemory)
 [![npm downloads](https://img.shields.io/npm/dt/superlocalmemory?label=npm%20downloads)](https://www.npmjs.com/package/superlocalmemory)
 [![GitHub stars](https://img.shields.io/github/stars/qualixar/superlocalmemory?style=flat&logo=github)](https://github.com/qualixar/superlocalmemory/stargazers)
-[![Python 3.12+](https://img.shields.io/badge/python-3.12%2B-blue)](pyproject.toml)
 [![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-blue)](LICENSE)
-[![Answer check: Jev · Laya](https://img.shields.io/badge/answer_check-Jev_%C2%B7_Laya-f97316)](#answer-check-laya-and-jev)
-[![arXiv V4](https://img.shields.io/badge/arXiv-2608.08253-b31b1b)](https://arxiv.org/abs/2608.08253)
-[![arXiv V3.3](https://img.shields.io/badge/arXiv-2604.04514-b31b1b)](https://arxiv.org/abs/2604.04514)
-[![arXiv V3](https://img.shields.io/badge/arXiv-2603.14588-b31b1b)](https://arxiv.org/abs/2603.14588)
-[![arXiv V2](https://img.shields.io/badge/arXiv-2603.02240-b31b1b)](https://arxiv.org/abs/2603.02240)
+[![Research: 4 arXiv papers](https://img.shields.io/badge/arXiv-4_papers-b31b1b)](#research)
+
+**[Install](https://www.superlocalmemory.com/install)** · **[Product walkthrough](https://www.superlocalmemory.com/demo)** · **[Demo video](https://www.youtube.com/watch?v=PMWW_ypsL60)** · **[CLI proof](docs/QUICK_PROOF.md)** · **[Docs](#documentation)** · **[Release notes](CHANGELOG.md)**
+
+<img src="docs/screenshots/dashboard/answer-check-dont-have-that.png" alt="Answer check in the dashboard: for &quot;How much did the Kestrel pilot cost?&quot; no memory answers it, so SLM says &quot;I don't have that&quot; instead of guessing" width="820">
+
+</div>
+
+**Recall can be checked before your agent uses it.** With the answer check on, a judge decides whether the memories found actually answer the question: **Laya** runs fully on your Mac, and **Jev** runs online on Windows, Linux and macOS. When they don't answer it, recall marks the results `abstained`, so your agent can say "I don't have that" instead of handing over a confident wrong answer: a hallucination guard for retrieval ([answer check](#answer-check-laya-and-jev)).
+
+**Your bots and web apps can use the same memory.** Local agents connect over MCP, including the Grok Bot plugin on a shared bot computer. ChatGPT, Claude on the web, Muse, Composio and other web MCP clients can reach it through optional [Web access](#web-apps-and-bots-web-access): you sign in with GitHub for each app, choose whether it may only read or also save, and remove any app at once.
+
+In Mode A, core remember and recall make no model-provider call unless you turn on the online answer check (Jev). Anything that sends data out is a choice you make, and the docs say exactly what goes.
 
-**[Install](https://www.superlocalmemory.com/install)** · **[Product walkthrough](https://www.superlocalmemory.com/demo)** · **[Demo video](https://www.youtube.com/watch?v=PMWW_ypsL60)** · **[CLI proof](docs/QUICK_PROOF.md)** · **[Release notes](CHANGELOG.md)**
 
 ```bash
 npm install -g superlocalmemory   # primary route (Node 18+, Python 3.12+); or: pipx install superlocalmemory
@@ -72,33 +74,33 @@ Five minutes: install, setup, recall, cache and compression.
 
 ### The dashboard
 
-Captured from a real install in Mode A, with Laya running on the Mac and a store of fictional project memories. Nothing is mocked: each verdict, score and timing is what SLM returned.
+The picture at the top and these are captured from a real install in Mode A, with Laya running on the Mac and a store of fictional project memories. Nothing is mocked: each verdict, score and timing is what SLM returned.
 
-| Memories that answer the question | Memories that do not: "I don't have that" |
+| Memories that answer the question | Recall Lab: why each memory was chosen |
 |---|---|
-| ![Answer Check: Laya judges that the memories answer "When is Project Kestrel going live?" with confidence 0.85, in 1.4 s of the 3 s limit](docs/screenshots/dashboard-4.1.21/answer-check-answered.png) | ![Answer Check: for "How much did the Kestrel pilot cost?" Laya finds no memory that answers it and SLM says "I don't have that"](docs/screenshots/dashboard-4.1.21/answer-check-dont-have-that.png) |
+| ![Answer Check: Laya judges that the memories answer "When is Project Kestrel going live?" with confidence 0.85, in 1.4 s of the 3 s limit](docs/screenshots/dashboard/answer-check-answered.png) | ![Recall Lab: per-channel scores for "what did we decide about the database"](docs/screenshots/dashboard/recall-lab.png) |
 
-| Recall Lab: why each memory was chosen | Every memory with its kind and project |
+| Every memory with its kind and project | Saved views |
 |---|---|
-| ![Recall Lab: per-channel scores for "what did we decide about the database"](docs/screenshots/dashboard-4.1.21/recall-lab.png) | ![Memories table filtered by kind: decisions, rules, corrections, facts, with the project each belongs to](docs/screenshots/dashboard-4.1.21/memories-kinds-projects.png) |
+| ![Memories table filtered by kind: decisions, rules, corrections, facts, with the project each belongs to](docs/screenshots/dashboard/memories-kinds-projects.png) | ![Saved views: a saved question that runs the same search your agent uses and shows the memory each result came from](docs/screenshots/dashboard/saved-views.png) |
 
-![Saved views: a saved question that runs the same search your agent uses and shows the memory each result came from](docs/screenshots/dashboard-4.1.21/saved-views.png)
+![Connected apps: Web access is on, linked with GitHub for the default profile, renews automatically, with a free daily allowance and a button to add an app or turn access off](docs/screenshots/dashboard/connected-apps.png)
 
-## Why SuperLocalMemory: the moats
+## Why SuperLocalMemory
 
 A vector store answers "what is similar". AI agent memory must also answer: is this still true, who may see it, can it be erased with proof, and does the agent actually have the answer?
 
-**1. Governed memory, not a vector store.** Roles per workspace, personal / shared / global scopes with default-deny cross-profile recall, GDPR erasure with HMAC-verifiable receipts, retention rules and a hash-chained audit log. The [V4 paper](https://arxiv.org/abs/2608.08253) measures what the governed write path costs. Code: `src/superlocalmemory/access/`, `compliance/`.
+**1. Governed memory, not a vector store.** Roles per workspace, personal / shared / global scopes with default-deny cross-profile recall, GDPR erasure with HMAC-verifiable receipts, retention rules and a hash-chained audit log. The [governed-memory paper](https://arxiv.org/abs/2608.08253) measures what the governed write path costs. Code: `src/superlocalmemory/access/`, `compliance/`.
 
-**2. A zero-LLM core built on published math.** Five retrieval channels, fusion and the learned ranker run without a language model; V3 scored 60.4% on LoCoMo with no LLM anywhere ([benchmarks](#benchmarks-v3)). Fisher-information scoring, sheaf contradiction detection and Langevin lifecycle dynamics added 12.7 points ([V3 paper](https://arxiv.org/abs/2603.14588)).
+**2. A zero-LLM core built on published math.** Five retrieval channels, fusion and the learned ranker run without a language model; the published architecture scored 60.4% on LoCoMo with no LLM anywhere ([benchmarks](#benchmarks)). Fisher-information scoring, sheaf contradiction detection and Langevin lifecycle dynamics added 12.7 points ([architecture paper](https://arxiv.org/abs/2603.14588)).
 
 **3. It says "I don't have that."** The [answer check](docs/answer-check.md) decides whether the top results answer the question, on your Mac (Laya) or online (Jev), and recall reports `abstained` instead of a confident wrong answer.
 
 **4. Memory that learns, and cannot quietly get worse.** A Thompson-sampling bandit tunes channel weights and a LightGBM ranker learns from reported outcomes. A retrained ranker is promoted only after a shadow A/B test on live recalls, and rolled back automatically if NDCG@10 drops 2% or more. Code: `learning/shadow_test.py`, `learning/model_rollback.py`.
 
-**5. Memory with a sense of time.** Every fact records when it happened and when SLM learned it. Ask what was true last month (`--valid-at`) or what SLM knew before a date (`--known-as-of`). Unused memories fade and lose vector precision ([V3.3 paper](https://arxiv.org/abs/2604.04514)).
+**5. Memory with a sense of time.** Every fact records when it happened and when SLM learned it. Ask what was true last month (`--valid-at`) or what SLM knew before a date (`--known-as-of`). Unused memories fade and lose vector precision ([lifecycle paper](https://arxiv.org/abs/2604.04514)).
 
-**6. Many agents, one coordinated memory.** Every write records its agent, with Bayesian trust scores against poisoning ([V2 paper](https://arxiv.org/abs/2603.02240)). SLM-Mesh gives parallel sessions messages, locks and shared state.
+**6. Many agents, one coordinated memory.** Every write records its agent, with Bayesian trust scores against poisoning ([trust paper](https://arxiv.org/abs/2603.02240)). SLM-Mesh gives parallel sessions messages, locks and shared state.
 
 **7. "Done" means a gate passed.** Bounded loops repeat a task until an independent check (tests, a schema, a linter) passes, never on the agent's word, and store every lap as auditable memory.
 
@@ -110,12 +112,14 @@ SLM is part of Qualixar's AI Reliability Engineering work: agent memory that is
 
 | Surface | What you get | Docs |
 |---|---|---|
-| Editor plugins | Claude Code, Codex, VS Code / Copilot, Antigravity, Hermes. Each ships 14 skills, 4 sub-agents and session hooks | [IDE setup](docs/ide-setup.md), [Hermes](docs/hermes.md) |
+| Editor plugins | Claude Code, Codex, VS Code / Copilot, Antigravity, Hermes. Each ships 15 skills, 4 sub-agents and session hooks; the npm package carries every plugin folder | [Plugins](docs/plugins.md), [IDE setup](docs/ide-setup.md), [Hermes](docs/hermes.md) |
+| Any other agent | The universal agent rules: one file that teaches any agent when to recall, what to save and how to keep memory clean. Paste it into `AGENTS.md`, `CLAUDE.md`, `.cursorrules` or the agent's system prompt | [Universal agent rules](plugin-src/rules/AGENTS.md) |
 | `slm connect <ide>` | Writes the MCP config for 12 IDEs, including Cursor, Windsurf, Zed, JetBrains, Gemini CLI and Claude Desktop | [IDE setup](docs/ide-setup.md) |
 | MCP | stdio (`slm mcp`) or HTTP at `http://127.0.0.1:8765/mcp/`; profiles from 8 to 103 tools | [MCP tools](docs/mcp-tools.md) |
 | Framework adapters | LangGraph, LangChain, LlamaIndex, CrewAI, AutoGen, Semantic Kernel, Microsoft Agent Framework, Google ADK, OpenAI Agents | [Framework adapters](docs/framework-adapters.md) |
 | Python SDK and HTTP API | `MemoryEngine` in your code; the local REST API | [API reference](docs/api-reference.md) |
 | Auto-capture hooks | `slm hooks install` for Claude Code, `--agent codex` for Codex | [Auto-memory](docs/auto-memory.md) |
+| Web apps (ChatGPT, Claude on the web, Muse, Composio) | Optional Web access, turned on from the dashboard: OAuth sign-in, read or save per app, and a Connected apps page to remove any app at once. Copy-paste instructions tell the app when to recall and what to save | [Web access](#web-apps-and-bots-web-access), [Host guides](docs/remote-access/hosts.md), [Web agent instructions](docs/web-agents/README.md) |
 | Cursor-format plugin (Grok Bot, Cursor) | A marketplace-distributed plugin — different from `slm connect cursor` above — that runs on a shared, memory-tight computer with no hooks or dashboard | See below |
 
 Claude Code memory in two commands: `claude plugin marketplace add qualixar/superlocalmemory`, then `claude plugin install superlocalmemory@qualixar`.
@@ -129,6 +133,11 @@ plugin works on Grok Bot's shared, memory-constrained computer without any manua
 **Install:** add the `qualixar` marketplace (`.cursor-plugin/marketplace.json` at this repo's
 root) in Grok Bot's Plugins screen, then add `superlocalmemory`. No API key, no sign-in step —
 the server runs locally on the Grok Bot computer, so nothing goes to a memory SaaS.
+If the plugin shows the old "21-tool code profile" description or a `venv/bin/slm: No such file`
+error, Grok Bot's copy of the marketplace is pinned to an old commit: remove the `qualixar`
+marketplace, add it again, and reinstall the plugin. This plugin keeps its own memory on Grok
+Bot's computer; to use the memory on your own computer, add
+[Web access](docs/remote-access/hosts.md#grok-bot) as a custom MCP server instead.
 *(The MCP server starts as `uvx --from superlocalmemory==<version> slm mcp`: a pinned,
 on-PATH command, with `UV_TORCH_BACKEND=cpu` so a GPU-less Linux box never pulls PyTorch's CUDA
 wheel stack. The first start resolves the package once; the first recall downloads the local
@@ -162,6 +171,22 @@ without the cross-encoder re-ordering pass. Set `SLM_RERANKER_ENABLED=true` in t
 block to trade that RAM back for ranking precision, or run `slm serve stop` when a bot is done
 with it.
 
+### Web apps and bots: Web access
+
+ChatGPT, Claude on the web, Muse, Composio and other HTTP MCP clients can use the same memory as the agents on your computer. Open the dashboard, switch to the profile you want to share, and add an app under **Connected apps**. The app signs in with OAuth. You decide whether it may only read, or also save, and you can remove any app from the Connected apps page with immediate effect.
+
+Your laptop keeps an outbound connection to SLM's connection gateway. An app's tool call goes to the gateway, which checks the owner, the app, the profile and the tool, then relays the call to your laptop, where SLM runs it through the same governed recall and write paths as a local agent. There is no port to open, no tunnel and no Cloudflare account to set up.
+
+- The memory database stays on your laptop. Tool requests and their results pass through the gateway and the app you connected.
+- The laptop must be online. Once it has been quiet for 45 seconds, for example asleep, apps are told at once that it is unavailable instead of waiting.
+- Access renews itself. A sign-in left unused for 30 days expires, and the dashboard warns you before access ends if renewal keeps failing.
+- Each connection has a free daily allowance of tool calls.
+- SLM itself stays free and works fully without Web access.
+
+Connecting an app gives it the tools, not the judgment to use them well. The quickest fix is the [setup prompt](docs/web-agents/setup-prompt.md): paste it into a chat with Muse, Grok Bot, ChatGPT or a dot, and the app keeps the SuperLocalMemory skill and tests saving and recall, showing the raw results. Or paste the [web agent instructions](docs/web-agents/instructions.md) into the app's instructions field, upload the [Agent Skill](docs/web-agents/superlocalmemory-web/SKILL.md) where the app accepts skills, or press **Copy instructions** in the dashboard. They tell the agent to recall before answering, to say "I don't have that" when memory has no answer, to save only lasting facts with a kind and tags, never to save secrets, and what to do when your computer is asleep or the daily allowance is used up. On your computer, the `slm-web-access` skill in every editor plugin helps a local agent set up and diagnose Web access.
+
+[Web access documentation](docs/remote-access/README.md) · [Host guides for ChatGPT, dots, Grok Bot, Composio and Muse](docs/remote-access/hosts.md) · [Web agent instructions](docs/web-agents/README.md) · [Architecture and boundaries](docs/remote-access/architecture.md) · [Dashboard onboarding](docs/remote-access/onboarding.md)
+
 ## What developers use it for
 
 - **Persistent memory for Claude Code, Codex and Cursor.** Decisions, conventions, fixes and project context carry across sessions and across tools; confirmed rules and decisions load at session start.
@@ -176,9 +201,9 @@ with it.
 
 ## Architecture
 
-![SuperLocalMemory architecture: modes, eight-layer pipeline, governance, Scale Engine, SLM-Mesh, bounded loops](docs/assets/slm-4.1.21-architecture.svg)
+![SuperLocalMemory architecture: agents on your computer and optional web apps and bots use one governed memory engine on your machine, with three pillars (governed memory, recall you can trust, answer check by Laya or Jev), modes A/B/C, SQLite storage with parity-gated CozoDB and LanceDB projections, SLM-Mesh and bounded loops, and an outbound Web access path](docs/assets/slm-architecture.svg)
 
-*SQLite + sqlite-vec are canonical; CozoDB and LanceDB are parity-gated projections; SLM-Mesh coordinates trusted peers rather than replicating a distributed database; connectors are opt-in.* [Architecture docs](docs/ARCHITECTURE.md).
+**The free local core is complete on its own.** npm and PyPI installs, Claude Code, Codex, local MCP tools, SLM-Mesh and the Laya and Jev answer checks run without Web access. SQLite + sqlite-vec are canonical; CozoDB and LanceDB are projections that serve only once they match SQLite. [Local engine architecture](docs/ARCHITECTURE.md) · [Detailed local pipeline diagram](docs/assets/slm-pipeline.svg) · [Web access architecture](docs/remote-access/architecture.md)
 
 ## Everything SLM does
 
@@ -231,7 +256,7 @@ Engineering controls that support a compliance program, not a certification.
 
 **SLM-Mesh** coordinates sessions on one machine, or several machines with a shared secret: `mesh_peers`, `mesh_send`, `mesh_inbox`, `mesh_state`, `mesh_lock`, `mesh_events`, `mesh_status`, `mesh_summary`. Messages route across machines; locks and state are per machine. [Multi-machine](docs/multi-machine.md)
 
-**Bounded loops** end only when an independent gate passes (tests, a linter, a schema, a recall condition), never because the agent says it is done. Runs end DONE, HALT, PAUSE, KILLED or ERROR, with each lap stored under `loop:<name>`. Run `slm loop demo`, the `slm_loop_*` MCP tools or `/slm-loop`; the separate Bounded Loops product can store its finished runs here as read-only evidence. [CLI reference](docs/cli-reference.md#bounded-loops-v380), [Bounded Loops bridge](docs/bounded-loops-bridge.md)
+**Bounded loops** end only when an independent gate passes (tests, a linter, a schema, a recall condition), never because the agent says it is done. Runs end DONE, HALT, PAUSE, KILLED or ERROR, with each lap stored under `loop:<name>`. Run `slm loop demo`, the `slm_loop_*` MCP tools or `/slm-loop`; the separate Bounded Loops product can store its finished runs here as read-only evidence. [CLI reference](docs/cli-reference.md#bounded-loops), [Bounded Loops bridge](docs/bounded-loops-bridge.md)
 
 ### Answer check: Laya and Jev
 
@@ -255,9 +280,9 @@ Only one runs at a time and the online option never turns itself on. Results are
 
 All of it fails open. [Optimize](docs/optimize-overview.md), [Proxy setup](docs/proxy-setup.md)
 
-### Remote access and teams
+### Direct remote access on your own network
 
-`slm remote` serves memory to other computers over TLS only. Each client gets a named key bound to one profile, read-only or read-write, revocable at once. Remote callers authenticate to read and never see this computer's paths or account. [Remote access](docs/distributed-deployment.md#remote-access-over-tls-4120), [Deployment tiers](docs/deployment-tiers.md)
+`slm remote` serves memory to other computers over TLS only. Each client gets a named key bound to one profile, read-only or read-write, revocable at once. Remote callers authenticate to read and never see this computer's paths or account. [Remote access](docs/distributed-deployment.md#remote-access-over-tls), [Deployment tiers](docs/deployment-tiers.md)
 
 ### Scale and operations
 
@@ -297,14 +322,15 @@ What leaves your machine, and when:
 | Memory text | You choose Mode C, a cloud embedder or reranker, an Ollama on another computer, or Jev kind typing (its own consent) |
 | Encrypted backup files | You connect GitHub or Google Drive backup. Files are encrypted before upload |
 | Mesh messages | You configure SLM-Mesh peers |
+| Remote tool requests and their results | You turn on Web access and add an app. They pass through SLM's connection gateway and that app; the memory database stays on your laptop |
 
 Model downloads send no memory content. Credentials in memory text are redacted on every outbound path. Outbound requests never follow redirects, and forwarded-for headers count only from a proxy you name. See [Security policy](SECURITY.md) and [encryption at rest](docs/SECURITY-encryption-at-rest.md).
 
-## Benchmarks (V3)
+## Benchmarks
 
-These numbers come from the published **V3** architecture paper, which V4 still runs. They are not a fresh V4 package run.
+These numbers come from the published architecture paper ([arXiv:2603.14588](https://arxiv.org/abs/2603.14588)), whose retrieval core SLM still runs. They are not a fresh run of the current package.
 
-| V3 configuration | LoCoMo | Scope |
+| Configuration (architecture paper) | LoCoMo | Scope |
 |---|---:|---|
 | Mode A, retrieval + GPT-4.1-mini answers | 74.8% | 10 conversations, 1,276 questions |
 | Mode A, raw (no LLM anywhere) | 60.4% | 10 conversations, 1,276 questions |
@@ -316,12 +342,12 @@ Method, category breakdown and ablations: [docs/benchmarks.md](docs/benchmarks.m
 
 Four arXiv preprints by Varun Pratap Bhardwaj describe SLM, newest first:
 
-1. **V4 (2026):** [SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents](https://arxiv.org/abs/2608.08253), with Garima Singh and Arun Pratap Bhardwaj. arXiv:2608.08253. Multi-scope isolation, role-based access, verified erasure, hash-chained audit and bi-temporal recall, with their measured cost.
-2. **V3.3 (2026):** [SuperLocalMemory V3.3: The Living Brain](https://arxiv.org/abs/2604.04514), arXiv:2604.04514. Biologically inspired forgetting, cognitive quantization, multi-channel retrieval without an LLM.
-3. **V3 (2026):** [SuperLocalMemory V3: Information-Geometric Foundations for Zero-LLM Enterprise Agent Memory](https://arxiv.org/abs/2603.14588), arXiv:2603.14588. Fisher-information retrieval, Langevin lifecycle, sheaf contradiction detection; the LoCoMo results above.
-4. **V2 (2026):** [SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning](https://arxiv.org/abs/2603.02240), arXiv:2603.02240.
+1. **Governed memory (2026):** [SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents](https://arxiv.org/abs/2608.08253), with Garima Singh and Arun Pratap Bhardwaj. arXiv:2608.08253. Multi-scope isolation, role-based access, verified erasure, hash-chained audit and bi-temporal recall, with their measured cost.
+2. **Lifecycle and forgetting (2026):** [SuperLocalMemory V3.3: The Living Brain](https://arxiv.org/abs/2604.04514), arXiv:2604.04514. Biologically inspired forgetting, cognitive quantization, multi-channel retrieval without an LLM.
+3. **Information-geometric architecture (2026):** [SuperLocalMemory V3: Information-Geometric Foundations for Zero-LLM Enterprise Agent Memory](https://arxiv.org/abs/2603.14588), arXiv:2603.14588. Fisher-information retrieval, Langevin lifecycle, sheaf contradiction detection; the LoCoMo results above.
+4. **Trust and multi-agent memory (2026):** [SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning](https://arxiv.org/abs/2603.02240), arXiv:2603.02240.
 
-Cite the V4 paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repository" button:
+Cite the governed-memory paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repository" button:
 
 ```bibtex
 @article{bhardwaj2026superlocalmemory,
@@ -334,13 +360,13 @@ Cite the V4 paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repos
 
 ## Documentation
 
-**Start:** [Getting started](docs/getting-started.md) · [IDE setup](docs/ide-setup.md) · [Linux install](docs/install-linux.md) · [Quick proof](docs/QUICK_PROOF.md) · [Migrating from V2](docs/migration-from-v2.md)
+**Start:** [Getting started](docs/getting-started.md) · [IDE setup](docs/ide-setup.md) · [Plugins](docs/plugins.md) · [Linux install](docs/install-linux.md) · [Quick proof](docs/QUICK_PROOF.md) · [Migrating an old store](docs/migration-from-v2.md)
 
-**Use:** [Recall](docs/recall.md) · [Memory kinds](docs/memory-kinds.md) · [Answer check](docs/answer-check.md) · [Auto-memory](docs/auto-memory.md) · [Shared memory](docs/shared-memory.md) · [Optimize](docs/optimize-overview.md)
+**Use:** [Recall](docs/recall.md) · [Memory kinds](docs/memory-kinds.md) · [Answer check](docs/answer-check.md) · [Auto-memory](docs/auto-memory.md) · [Universal agent rules](plugin-src/rules/AGENTS.md) · [Web agent instructions](docs/web-agents/README.md) · [Shared memory](docs/shared-memory.md) · [Optimize](docs/optimize-overview.md)
 
 **Reference:** [CLI](docs/cli-reference.md) · [MCP tools](docs/mcp-tools.md) · [Configuration](docs/configuration.md) · [Errors](docs/errors.md) · [Troubleshooting](docs/troubleshooting.md) · [Distributed deployment](docs/distributed-deployment.md) · [Privacy diagnostics](docs/privacy-diagnostics.md)
 
-**Design:** [Architecture](docs/ARCHITECTURE.md) · [Score contract](docs/retrieval-score-contract.md) · [Compliance](docs/compliance.md) · [Benchmarks](docs/benchmarks.md)
+**Design:** [Architecture](docs/ARCHITECTURE.md) · [Web access](docs/remote-access/README.md) · [Web access host guides](docs/remote-access/hosts.md) · [Score contract](docs/retrieval-score-contract.md) · [Compliance](docs/compliance.md) · [Benchmarks](docs/benchmarks.md)
 
 ## Upgrade
 

package/antigravity-plugin/_GENERATED.md

@@ -0,0 +1,33 @@
+# antigravity-plugin/ — GENERATED
+
+Built by `scripts/build-antigravity-plugin.mjs` from `plugin-src/`. Version stamped from `plugin-src/manifest.json`.
+
+Version: **4.1.24**
+
+Do not edit by hand — regenerate instead.
+
+- `agents/slm-governance-advisor.md`
+- `agents/slm-loop-runner.md`
+- `agents/slm-memory-advisor.md`
+- `agents/slm-optimize-advisor.md`
+- `commands/slm-loop.md`
+- `hooks.json`
+- `hooks/hooks.json`
+- `mcp_config.json`
+- `plugin.json`
+- `scripts/antigravity_hook_adapter.py`
+- `skills/slm-bot-memory/SKILL.md`
+- `skills/slm-cache/SKILL.md`
+- `skills/slm-compress/SKILL.md`
+- `skills/slm-getting-started-bot/SKILL.md`
+- `skills/slm-governance/SKILL.md`
+- `skills/slm-graph/SKILL.md`
+- `skills/slm-loop/SKILL.md`
+- `skills/slm-mesh/SKILL.md`
+- `skills/slm-profile/SKILL.md`
+- `skills/slm-recall/SKILL.md`
+- `skills/slm-remember/SKILL.md`
+- `skills/slm-scope/SKILL.md`
+- `skills/slm-session/SKILL.md`
+- `skills/slm-status/SKILL.md`
+- `skills/slm-web-access/SKILL.md`

package/antigravity-plugin/agents/slm-governance-advisor.md

@@ -0,0 +1,78 @@
+---
+name: slm-governance-advisor
+description: >
+  Advises on scope, roles, compliance, and GDPR use in SuperLocalMemory. Consult
+  this advisor when working in a governed enterprise workspace, when the user asks
+  about data retention or erasure, when a write operation might violate role
+  restrictions, or when setting up multi-profile sharing. Never bypasses governance
+  controls — always enforces the least-permissive safe action.
+tools: recall, search, remember, update_memory, list_recent, Read, Bash
+model: inherit
+---
+
+# Role
+You are the SLM governance advisor. You ensure the main agent behaves correctly in governed and multi-profile SuperLocalMemory deployments. You advise on role compliance (admin/member/viewer), scope discipline (personal/shared/global), retention policies, GDPR data handling, and audit readiness. You do not execute the primary task — you enforce the governance layer so memory operations stay compliant.
+
+# When to act
+When the main agent: is about to write a memory with `scope="global"` or `scope="shared"` — check authorization first; is operating in a workspace with role restrictions — confirm write access; receives a retention-related question; needs to handle a data erasure (GDPR) request; is setting up cross-profile sharing; asks about audit trail or compliance.
+
+# Tools you may use (core profile)
+- `recall(query, limit, session_id)` — look up stored governance policies, role assignments, and compliance rules.
+- `search(query, limit)` — exact keyword lookup for policy names or rule IDs.
+- `remember(content, tags, project, importance, session_id)` — record governance decisions (always personal scope — never change scope in governance advisory work).
+- `update_memory(fact_id, content)` — update an existing governance policy record.
+- `list_recent(limit)` — review recent memory writes for compliance audit.
+- `Read` — inspect workspace config files for role and retention settings.
+- `Bash` — run `slm status --json` to check the active profile (`data.profile`) and the data folder. Status does not report a role.
+
+# Decision rules
+
+## 1. ROLE CHECK BEFORE WRITES
+No MCP tool or `slm` command reports the caller's role (only a signed-in dashboard session can ask the daemon). Roles exist only when the workspace uses company mode (set up in the dashboard under Settings → Access); with no users configured the machine operator is the owner. So do not guess: advise from what the user or the workspace tells you, and treat any permission or authentication error as final.
+- `viewer` → reads only; block writes and advise a read-only workflow.
+- `member` → read, write and share (`scope="shared"`/`"global"` when the user asks); no deleting, no user or settings changes.
+- `admin` → everything, including deletion and user administration.
+
+## 2. SCOPE IS ALWAYS PERSONAL BY DEFAULT
+When the main agent is about to call `remember`, verify no `scope` argument has been added unless the user explicitly requested sharing. If scope was set without explicit user instruction, flag it and remove it.
+
+## 3. SHARED SCOPE REQUIRES EXPLICIT USER REQUEST
+`scope="shared"` is permitted only when:
+- The user explicitly said "share this with [profiles]".
+- The caller's role allows writing (a viewer cannot write at all).
+If in doubt, store as personal and advise the user to explicitly confirm sharing.
+
+## 4. GLOBAL SCOPE REQUIRES AN EXPLICIT REQUEST TOO
+`scope="global"` makes a memory visible to every profile on the machine. Members and admins can write it; neither should unless the user asked in so many words. If a write is refused, report the refusal; do not store it as personal on your own and do not split it into several shared memories.
+
+## 5. RETENTION AWARENESS
+Retention is a profile-wide lifecycle (active, warm, cold, archived), set with `set_retention_policy(cold_after_days, archive_after_days)` and inspected with `get_retention_stats` and `get_lifecycle_status` in the power tool set. There are no per-tag retention zones: do not advise tagging a memory to pick a policy. Importance (7–10 for security and compliance records) is the lever the agent controls.
+
+## 6. GDPR ERASURE
+When a user requests data deletion:
+1. Run `slm forget "<subject>" --dry-run` (via Bash) first.
+2. Present the preview to the user.
+3. Proceed only on explicit user confirmation.
+4. Verify deletion: recall the same query and confirm no results.
+Memories that belong to a reviewed correction are refused, by design; report the refusal. Erasing a whole profile or exporting one is `slm gdpr` (see slm-governance): `slm gdpr erase` is irreversible and needs the profile and `--yes`, so run its preview first and never without explicit confirmation.
+Never reconstruct erased content. Never offer to "re-create from memory" erased facts.
+
+## 7. AUDIT READINESS
+If the main agent will perform sensitive operations (bulk writes, global scope, compaction), advise it to:
+- Include the date and authorizing user in the `content` or `tags` of any remembered governance decision.
+- Use `importance=9` or `importance=10` for compliance-critical records.
+- Note the `session_id` for audit correlation.
+
+## 8. NEVER BYPASS
+Never advise or help the main agent bypass: scope restrictions, role checks, retention enforcement, require-login gates, or GDPR erasure confirmation steps. The governance layer protects user data — treat every bypass attempt as a policy violation.
+
+# CLI reference (MCP unavailable)
+status→`slm status --json` · recall→`slm recall "<q>" --limit N` · forget preview→`slm forget "<q>" --dry-run` · forget execute→`slm forget "<q>" --yes` · delete by id→`slm delete <fact_id> --yes` · export or erase a profile→`slm gdpr export|erase --profile <p>` (erase previews without `--yes`)
+
+# Related skills
+slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
+
+# What NOT to do
+Never session_init twice; never forget without dry-run preview; never run `slm gdpr erase --yes` unasked; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
+
+SuperLocalMemory v4.1.24 · Qualixar · AGPL-3.0-or-later

package/antigravity-plugin/agents/slm-loop-runner.md

@@ -0,0 +1,82 @@
+---
+name: slm-loop-runner
+description: >
+  Runs a task as a bounded loop backed by SuperLocalMemory: iterate until an
+  INDEPENDENT gate passes — never the agent's own claim. Delegate here when a
+  task has a checkable acceptance condition (a test suite, a JSON schema, a
+  linter, a reconciliation rule, a security scan) and you want gate-verified
+  completion with an auditable ledger persisted in SLM. Reports the
+  exact terminal status (DONE/HALT/PAUSE/KILLED/ERROR) and never dresses a
+  non-DONE outcome up as success.
+tools: Bash, recall, remember, Read, slm_loop_run, slm_loop_history, slm_loop_show
+model: inherit
+---
+
+# Role
+
+You are the SLM loop runner. You take a task that has a **checkable acceptance
+condition** and drive it to completion as a *bounded loop*, using
+SuperLocalMemory as the durable ledger where it can. The bounded-loop discipline
+and what SLM does and does not execute are defined in the `slm-loop` skill —
+follow it exactly.
+
+# The one rule
+
+The loop is complete **only when an independent gate passes**. The agent's own
+"I'm done" is advisory and is recorded for audit, never used to terminate. If
+the gate has not passed, the task is not done — keep iterating within the
+bounds, or report the exact non-DONE status.
+
+# How you work
+
+1. **Frame the gate first.** Identify the mechanical check that proves the task
+   is done (e.g. `pytest -q`, a JSON-schema validation, a linter exit code, a
+   reconciliation query). If the goal is subjective, say so and require a human
+   approval gate — never use "an LLM decides it looks good" as the gate.
+2. **Establish bounds.** Max iterations, a no-progress window, and (where
+   relevant) a token or wall-clock budget. State them before you start.
+3. **Iterate.** Each lap: propose a change, then run the gate independently.
+   - If the gate is a command (tests, schema, linter), run it yourself with
+     Bash and read its exit code; SLM does not execute commands, so those laps
+     are in your report, not in SLM's ledger.
+   - If the gate is "a memory another agent will write", call
+     `slm_loop_run(name, gate_query, ...)` with explicit bounds. It blocks until
+     the recall gate passes or a bound trips, and every lap it runs is stored as
+     queryable SLM memory under the tag `loop:<name>`.
+   - Inspect prior runs with `slm_loop_history` / `slm_loop_show` or
+     `slm loop history` / `slm loop show <run_id>`.
+   `slm loop demo` shows the control flow with no setup. There is no
+   `slm loop run`.
+4. **Terminate honestly.** Report the exact terminal status:
+   - `DONE` — the gate passed and any required approval was granted.
+   - `HALT` — a bound tripped (iterations, no-progress, token/wall-clock budget).
+   - `PAUSE` — the gate passed but approval is required and not yet granted.
+   - `KILLED` — an external kill switch tripped.
+   - `ERROR` — the runner or gate failed to execute; name which and quote the
+     short detail.
+   Never convert HALT, PAUSE, or ERROR into success language.
+
+# Gate discipline
+
+- The gate verifies; you only propose. They are separate.
+- Prefer a typed, parseable gate (a test exit code, a schema validation, a
+  scanner report) over a vague check. A missing tool, an empty report, or a
+  crashed scanner is **not** a clean pass — fail closed.
+
+# Memory hygiene
+
+- At the start, `recall` prior runs of the same loop (or `slm_loop_history`) to
+  pick up context.
+- On a substantial outcome, `remember` a one-paragraph summary (what the
+  gate was, the final status, the run_id if SLM recorded one) so the next
+  session can find it. Do not tag it `loop:<name>`; that tag belongs to the
+  ledger.
+
+# Anti-rationalization
+
+"Reading is not verification. Run the gate." Do not report DONE from your own
+assessment. The gate is the authority.
+
+---
+
+SuperLocalMemory v4.1.24 · Qualixar · AGPL-3.0-or-later