vesper-memory 0.3.2 → 0.5.0

package/.env.example

@@ -9,7 +9,9 @@ REDIS_PORT=6379
 QDRANT_URL=http://localhost:6333
 
 # SQLite (Knowledge Graph)
-SQLITE_DB=./data/memory.db
+# Default: ~/.vesper/data/memory.db (user-level storage)
+# Override with absolute path if needed
+# SQLITE_DB=~/.vesper/data/memory.db
 
 # Embedding Service (BGE-large)
 EMBEDDING_SERVICE_URL=http://localhost:8000
@@ -21,8 +23,10 @@ LOG_LEVEL=info
 # =============================================================================
 # Quick Start
 # =============================================================================
-# 1. Copy this file: cp .env.example .env
-# 2. Start services: docker-compose up -d
+# 1. Install: npm install -g vesper-memory
+# 2. Setup: vesper install
 # 3. That's it! No passwords or API keys required for local use.
 #
-# The system will automatically create the data/ directory for SQLite.
+# Data is stored at ~/.vesper/ (user-level storage, persists across projects)
+# - SQLite database: ~/.vesper/data/memory.db
+# - Docker volumes: ~/.vesper/docker-data/

package/CHANGELOG.md

@@ -5,6 +5,132 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-02-06
+
+### Added
+
+**Multi-Agent Namespace Isolation**
+- All memory operations now support `namespace` parameter for multi-agent isolation
+- Default namespace is `"default"` - fully backward compatible
+- Namespace column added to: memories, entities, relationships, facts, conflicts, skills
+- Redis keys prefixed with namespace: `{namespace}:working:{id}`
+- Qdrant payload filtering by namespace
+
+**Agent Attribution**
+- `agent_id`, `agent_role`, `task_id` fields on stored memories
+- Filter retrieval by agent_id, task_id, or exclude_agent
+- Track which agent stored which memory
+
+**Decision Memory Type**
+- New `memory_type: "decision"` for architectural and project decisions
+- Reduced temporal decay (decay_factor: 0.25) so decisions persist longer
+- Supersedes mechanism: new decisions can mark old ones as superseded
+- Automatic conflict detection against existing decisions
+
+**4 New MCP Tools**
+- `share_context`: Copy memories between namespaces with handoff tracking
+- `store_decision`: Store decisions with reduced decay and conflict detection
+- `list_namespaces`: Discover all namespaces with counts
+- `namespace_stats`: Per-namespace breakdown of memories, entities, skills, agents
+
+**Validation**
+- Added `NamespaceSchema` (alphanumeric + hyphens/underscores)
+- Extended memory_type enum to include `"decision"`
+- All existing tool schemas updated with optional `namespace` parameter
+
+**Tests**
+- 112 new tests across 5 test files (namespace-isolation, agent-attribution, share-context, store-decision, namespace-tools)
+- Total: 909 tests passing (up from 632)
+
+### Changed
+- `SemanticMemoryLayer`: all methods accept `namespace` parameter
+- `SkillLibrary` / `SkillLazyLoader`: namespace-scoped queries
+- `ConflictDetector`: namespace-scoped detection
+- `ConsolidationPipeline`: iterates all namespaces when none specified
+- `SmartRouter`: `RoutingContext` includes optional `namespace`
+- `HybridSearchEngine`: `filter` parameter for Qdrant namespace filtering
+- `WorkingMemoryLayer`: Redis keys use `{namespace}:` prefix
+
+### Backward Compatibility
+- All new columns use `DEFAULT 'default'` - existing data automatically works
+- All new tool params are optional - existing tool calls unchanged
+- Old Redis keys expire naturally via 7-day TTL
+- Qdrant: falls back to unfiltered search for `"default"` namespace
+
+---
+
+## [0.4.0] - 2026-02-03
+
+### BREAKING CHANGES
+
+**User-Level Storage Migration**
+- All data now stored at `~/.vesper/` (user-level) instead of project directories
+- SQLite database: `~/.vesper/data/memory.db` (was `./data/memory.db`)
+- Docker volumes: `~/.vesper/docker-data/` (were named volumes `qdrant_storage`, `redis_storage`)
+- Memories now persist across all projects
+
+**Migration Required:**
+```bash
+# Automatic migration from v0.3.x
+vesper migrate
+
+# Or manually:
+mkdir -p ~/.vesper/data
+cp ./data/memory.db ~/.vesper/data/memory.db
+docker-compose down
+docker-compose up -d
+```
+
+### Added
+
+**CLI Enhancements**
+- `vesper migrate` command for automatic data migration from v0.3.x
+- User-level directory structure creation with secure permissions (0o700)
+- `VESPER_HOME` environment variable for custom storage location
+- Improved `vesper status` showing data directory and database size
+- Detection of old data needing migration
+
+**Path Utilities**
+- Cross-platform path resolution module (`src/utils/paths.ts`)
+- `getVesperHome()` - Resolves `~/.vesper` with platform-specific home directory
+- `getSqlitePath()` - Returns user-level SQLite database path
+- `ensureDirectories()` - Creates all required directories with proper permissions
+- Tilde expansion support in environment variables
+
+**Security Improvements**
+- Path traversal warnings for system directories
+- Restrictive directory permissions (owner-only: 0o700)
+- Fixed command injection vulnerability in CLI uninstall
+- Secrets excluded from version control (.claude/settings.local.json)
+
+**Testing**
+- 62 new tests for path utilities, CLI migration, and Docker config
+- Total: 632 tests passing (up from 570)
+- 100% test coverage for migration logic
+
+### Changed
+
+- Docker volumes changed from named volumes to host bind mounts
+- Default SQLITE_DB path from `./data/memory.db` to `~/.vesper/data/memory.db`
+- CLI install creates `~/.vesper/` structure instead of local `data/` directory
+- Server logs now indicate whether using user-level storage or override
+- Environment variable handling improved with `VESPER_HOME` support
+
+### Fixed
+
+- Command injection vulnerability in `vesper uninstall` (replaced shell `rm -rf` with `fs.rmSync`)
+- Race condition in directory creation (removed redundant `existsSync` checks)
+- Missing error handling for directory creation failures
+- Secrets exposure risk (added .claude/settings.local.json to .gitignore)
+
+### Security
+
+- **CRITICAL**: Prevented hardcoded secrets in version control
+- **HIGH**: Fixed command injection in CLI uninstall
+- **HIGH**: Added path traversal warnings for dangerous paths
+- **MEDIUM**: Set restrictive permissions on data directories
+- Security review conducted by automated security-reviewer agent
+
 ## [0.3.0] - 2026-02-02
 
 ### Added
@@ -132,6 +258,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Per user: $0.49-0.73/month (100 users)
 - 97% cost reduction vs. target
 
-[0.3.0]: https://github.com/fitz2882/vesper/releases/tag/v0.3.0
-[0.2.0]: https://github.com/fitz2882/vesper/releases/tag/v0.2.0
-[0.1.0]: https://github.com/fitz2882/vesper/releases/tag/v0.1.0
+[0.3.0]: https://github.com/fitz2882/vesper-memory/releases/tag/v0.3.0
+[0.2.0]: https://github.com/fitz2882/vesper-memory/releases/tag/v0.2.0
+[0.1.0]: https://github.com/fitz2882/vesper-memory/releases/tag/v0.1.0

package/LICENSE

@@ -19,3 +19,62 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+---
+
+## Third-Party Software Attributions
+
+This software includes or is built upon the following third-party components:
+
+### Core Dependencies (MIT License)
+
+**HippoRAG**
+Copyright (c) 2024 OSU-NLP-Group
+https://github.com/OSU-NLP-Group/HippoRAG
+
+**FlagEmbedding (BGE Models)**
+Copyright (c) Beijing Academy of Artificial Intelligence (BAAI)
+https://github.com/FlagOpen/FlagEmbedding
+
+**Voyager**
+Copyright (c) MineDojo
+https://github.com/MineDojo/Voyager
+
+**better-sqlite3**
+Copyright (c) 2017 Joshua Wise
+https://github.com/WiseLibs/better-sqlite3
+
+**ioredis**
+https://github.com/redis/ioredis
+
+**@modelcontextprotocol/sdk**
+https://github.com/modelcontextprotocol/typescript-sdk
+
+### Apache 2.0 Licensed Components
+
+**Qdrant Vector Database**
+Apache License 2.0
+https://github.com/qdrant/qdrant
+
+**@qdrant/js-client-rest**
+Apache License 2.0
+https://github.com/qdrant/qdrant-js
+
+### Standalone Services (Not Distributed)
+
+**SQLite** - Public Domain (https://www.sqlite.org)
+**Redis** - AGPLv3 for v8+ (https://redis.io)
+
+Users are responsible for ensuring compliance with the licenses of any
+standalone services they choose to deploy alongside this software.
+
+### Academic Research Inspirations
+
+This software implements concepts from:
+- HippoRAG (Bernal et al., NeurIPS 2024)
+- Hippocampal Indexing Theory (Teyler & Rudy, 2007)
+- Word2Vec (Mikolov et al., 2013)
+- Reciprocal Rank Fusion (Cormack et al., SIGIR 2009)
+- Voyager (Wang et al., 2023)
+
+See README.md Research & Credits section for complete citations.