hermes-memory-pgvector 0.4.1__tar.gz → 0.4.2__tar.gz

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hermes-memory-pgvector
-Version: 0.4.1
+Version: 0.4.2
 Summary: Postgres + pgvector memory provider plugin for hermes-agent. Multi-agent storage layer with per-minion themes, identity governance, agent attribution + delegation provenance, async writer, no LLM in the memory hot path.
 Author: Andrea Borghi
 License: BSD-3-Clause
@@ -115,6 +115,12 @@ Maintenance CLI (`python -m pgvector`, installed as `hermes-pgvector`): `migrate
 
 Still a storage-layer feature: **no LLM, no entity graph, no new tables or columns** — just a GIN index over the existing `content` column (migration `003`) and a fused query. It stays inside invariant #1 (a second index over the same text is not a parallel ontology). Fail-soft as ever: a hybrid hiccup degrades to the proven pure-vector path, and a query that *itself* fails to embed degrades to full-text-only instead of erroring. Toggle with `plugins.pgvector.hybrid_search` (default `true`); the ambient `prefetch()` path stays pure-vector. Works without migration `003` — the GIN index only makes the full-text leg faster.
 
+## New in v0.4.2 — pip-native install + hardening
+
+- **`hermes-pgvector install`** — makes a plain `pip install hermes-memory-pgvector` deployable on ANY hermes-agent install: generates the `$HERMES_HOME/plugins/pgvector/` discovery shim (see *Install · Option 1*). No more vendored copies or editable checkouts.
+- **Migration `004`** — `hermes-pgvector migrate` now grants the runtime role DML on `memory_entries`/`conversations` itself; the manual OWNER-transfer step is gone (fresh installs previously hit `permission denied` if it was skipped).
+- **Correctness fixes** from a full-codebase review: `replace`/`remove` now match `old_text` as a *literal* substring (LIKE `%`/`_`/`\` metacharacters no longer over- or under-match — parity with the built-in tool's `in` semantics); the async writer drains its queue on shutdown instead of silently abandoning up to 255 accepted writes when full; a wrong-dimension embed model now surfaces as `expected 768 dims, got N` instead of a masking 404; DM-key bucketing no longer sweeps ordinary `:signal:`-containing theme names into `whatsapp-dm`; bulk MEMORY.md import circuit-breaks after 3 consecutive embed failures (a hanging endpoint can no longer block session start for minutes); `remap` re-checks its duplicate-drop guard under the advisory lock; tool errors redact credential-looking fragments and preserve `score: null` for full-text-only hybrid hits (with `rrf_score` now included); `recall_memory(scope='session')` returns a helpful error instead of silently matching nothing.
+
 ## Multi-agent / per-minion themes
 
 Each systemd-run minion sets one header on its OpenAI client; everything else flows automatically:
@@ -139,7 +145,28 @@ Set `plugins.pgvector.allowed_themes` to that product/worker list to enforce it
 
 ## Install
 
-### Option 1: clone + run the installer script (recommended)
+### Option 1: pip + discovery shim (recommended, v0.4.2+)
+
+```bash
+# 1. Install the package into the SAME environment hermes-agent runs in
+pip install hermes-memory-pgvector
+
+# 2. Create the discovery shim
+hermes-pgvector install          # writes $HERMES_HOME/plugins/pgvector/
+
+# 3. Apply ALL migrations (schema + attribution + FTS + runtime grants)
+hermes-pgvector migrate --admin-dsn \
+    "dbname=<your-memory-db> user=postgres host=/var/run/postgresql"
+
+# 4. Activate + verify
+hermes config set memory.provider pgvector
+sudo systemctl restart hermes.service
+hermes memory status             # expect: Provider: pgvector; Status: available
+```
+
+**Why the shim?** hermes-agent discovers memory providers by scanning plugin *directories* — `plugins/memory/<name>/` (bundled) and `$HERMES_HOME/plugins/<name>/` (user) — and never looks at installed packages. `pip install` alone is therefore invisible to it. `hermes-pgvector install` writes a two-line shim whose absolute import resolves to the pip-installed package, so upgrades are just `pip install -U hermes-memory-pgvector` + restart, and rollback is `pip install hermes-memory-pgvector==<prev>` + restart — the shim never changes. `--remove` deletes it; if the package is uninstalled the shim import fails cleanly and hermes falls back to built-in memory.
+
+### Option 2: clone + run the installer script (from source)
 
 ```bash
 git clone https://github.com/andreab67/hermes-memory-pgvector.git
@@ -153,7 +180,7 @@ That:
 2. Copies `pgvector/` into `$HERMES_HOME/plugins/pgvector/` (defaults to `~/.hermes/plugins/pgvector/`).
 3. Prints the admin migration + activation commands you run next.
 
-### Option 2: manual
+### Option 3: manual
 
 ```bash
 # Python deps
@@ -182,15 +209,13 @@ sudo -u postgres psql -d <your-memory-db> \
 # leg. No new tables/columns/GRANTs; needs no OWNER step.
 sudo -u postgres psql -d <your-memory-db> \
      -f ~/.hermes/plugins/pgvector/migrations/003_hybrid_search_fts.sql
-# (or apply every migration in order:  hermes-pgvector migrate --admin-dsn "user=postgres host=/var/run/postgresql dbname=<your-memory-db>")
 
-# Hand ownership of the v0.1 tables to the hermes runtime role
-sudo -u postgres psql -d <your-memory-db> -c "
-ALTER TABLE memory_entries OWNER TO hermes;
-ALTER SEQUENCE memory_entries_id_seq OWNER TO hermes;
-ALTER TABLE conversations OWNER TO hermes;
-ALTER SEQUENCE conversations_id_seq OWNER TO hermes;
-"
+# v0.4.2: grant the runtime role DML on the core tables (replaces the old
+# manual "ALTER TABLE ... OWNER TO hermes" step; skips with a NOTICE if your
+# runtime role isn't named 'hermes' — grant manually in that case).
+sudo -u postgres psql -d <your-memory-db> \
+     -f ~/.hermes/plugins/pgvector/migrations/004_runtime_grants.sql
+# (or apply every migration in order:  hermes-pgvector migrate --admin-dsn "user=postgres host=/var/run/postgresql dbname=<your-memory-db>")
 
 # Activate
 hermes config set memory.provider pgvector
@@ -314,4 +339,4 @@ Bug reports + PRs welcome. Open an issue describing the failure mode + your envi
 
 ## License
 
-[BSD 3-Clause](LICENSE) © 2026 Andrea Borghi.
+[BSD 3-Clause](LICENSE) © 2026 Green Yoga Inc

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/README.md

@@ -82,6 +82,12 @@ Maintenance CLI (`python -m pgvector`, installed as `hermes-pgvector`): `migrate
 
 Still a storage-layer feature: **no LLM, no entity graph, no new tables or columns** — just a GIN index over the existing `content` column (migration `003`) and a fused query. It stays inside invariant #1 (a second index over the same text is not a parallel ontology). Fail-soft as ever: a hybrid hiccup degrades to the proven pure-vector path, and a query that *itself* fails to embed degrades to full-text-only instead of erroring. Toggle with `plugins.pgvector.hybrid_search` (default `true`); the ambient `prefetch()` path stays pure-vector. Works without migration `003` — the GIN index only makes the full-text leg faster.
 
+## New in v0.4.2 — pip-native install + hardening
+
+- **`hermes-pgvector install`** — makes a plain `pip install hermes-memory-pgvector` deployable on ANY hermes-agent install: generates the `$HERMES_HOME/plugins/pgvector/` discovery shim (see *Install · Option 1*). No more vendored copies or editable checkouts.
+- **Migration `004`** — `hermes-pgvector migrate` now grants the runtime role DML on `memory_entries`/`conversations` itself; the manual OWNER-transfer step is gone (fresh installs previously hit `permission denied` if it was skipped).
+- **Correctness fixes** from a full-codebase review: `replace`/`remove` now match `old_text` as a *literal* substring (LIKE `%`/`_`/`\` metacharacters no longer over- or under-match — parity with the built-in tool's `in` semantics); the async writer drains its queue on shutdown instead of silently abandoning up to 255 accepted writes when full; a wrong-dimension embed model now surfaces as `expected 768 dims, got N` instead of a masking 404; DM-key bucketing no longer sweeps ordinary `:signal:`-containing theme names into `whatsapp-dm`; bulk MEMORY.md import circuit-breaks after 3 consecutive embed failures (a hanging endpoint can no longer block session start for minutes); `remap` re-checks its duplicate-drop guard under the advisory lock; tool errors redact credential-looking fragments and preserve `score: null` for full-text-only hybrid hits (with `rrf_score` now included); `recall_memory(scope='session')` returns a helpful error instead of silently matching nothing.
+
 ## Multi-agent / per-minion themes
 
 Each systemd-run minion sets one header on its OpenAI client; everything else flows automatically:
@@ -106,7 +112,28 @@ Set `plugins.pgvector.allowed_themes` to that product/worker list to enforce it
 
 ## Install
 
-### Option 1: clone + run the installer script (recommended)
+### Option 1: pip + discovery shim (recommended, v0.4.2+)
+
+```bash
+# 1. Install the package into the SAME environment hermes-agent runs in
+pip install hermes-memory-pgvector
+
+# 2. Create the discovery shim
+hermes-pgvector install          # writes $HERMES_HOME/plugins/pgvector/
+
+# 3. Apply ALL migrations (schema + attribution + FTS + runtime grants)
+hermes-pgvector migrate --admin-dsn \
+    "dbname=<your-memory-db> user=postgres host=/var/run/postgresql"
+
+# 4. Activate + verify
+hermes config set memory.provider pgvector
+sudo systemctl restart hermes.service
+hermes memory status             # expect: Provider: pgvector; Status: available
+```
+
+**Why the shim?** hermes-agent discovers memory providers by scanning plugin *directories* — `plugins/memory/<name>/` (bundled) and `$HERMES_HOME/plugins/<name>/` (user) — and never looks at installed packages. `pip install` alone is therefore invisible to it. `hermes-pgvector install` writes a two-line shim whose absolute import resolves to the pip-installed package, so upgrades are just `pip install -U hermes-memory-pgvector` + restart, and rollback is `pip install hermes-memory-pgvector==<prev>` + restart — the shim never changes. `--remove` deletes it; if the package is uninstalled the shim import fails cleanly and hermes falls back to built-in memory.
+
+### Option 2: clone + run the installer script (from source)
 
 ```bash
 git clone https://github.com/andreab67/hermes-memory-pgvector.git
@@ -120,7 +147,7 @@ That:
 2. Copies `pgvector/` into `$HERMES_HOME/plugins/pgvector/` (defaults to `~/.hermes/plugins/pgvector/`).
 3. Prints the admin migration + activation commands you run next.
 
-### Option 2: manual
+### Option 3: manual
 
 ```bash
 # Python deps
@@ -149,15 +176,13 @@ sudo -u postgres psql -d <your-memory-db> \
 # leg. No new tables/columns/GRANTs; needs no OWNER step.
 sudo -u postgres psql -d <your-memory-db> \
      -f ~/.hermes/plugins/pgvector/migrations/003_hybrid_search_fts.sql
-# (or apply every migration in order:  hermes-pgvector migrate --admin-dsn "user=postgres host=/var/run/postgresql dbname=<your-memory-db>")
 
-# Hand ownership of the v0.1 tables to the hermes runtime role
-sudo -u postgres psql -d <your-memory-db> -c "
-ALTER TABLE memory_entries OWNER TO hermes;
-ALTER SEQUENCE memory_entries_id_seq OWNER TO hermes;
-ALTER TABLE conversations OWNER TO hermes;
-ALTER SEQUENCE conversations_id_seq OWNER TO hermes;
-"
+# v0.4.2: grant the runtime role DML on the core tables (replaces the old
+# manual "ALTER TABLE ... OWNER TO hermes" step; skips with a NOTICE if your
+# runtime role isn't named 'hermes' — grant manually in that case).
+sudo -u postgres psql -d <your-memory-db> \
+     -f ~/.hermes/plugins/pgvector/migrations/004_runtime_grants.sql
+# (or apply every migration in order:  hermes-pgvector migrate --admin-dsn "user=postgres host=/var/run/postgresql dbname=<your-memory-db>")
 
 # Activate
 hermes config set memory.provider pgvector
@@ -281,4 +306,4 @@ Bug reports + PRs welcome. Open an issue describing the failure mode + your envi
 
 ## License
 
-[BSD 3-Clause](LICENSE) © 2026 Andrea Borghi.
+[BSD 3-Clause](LICENSE) © 2026 Green Yoga Inc

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/hermes_memory_pgvector.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hermes-memory-pgvector
-Version: 0.4.1
+Version: 0.4.2
 Summary: Postgres + pgvector memory provider plugin for hermes-agent. Multi-agent storage layer with per-minion themes, identity governance, agent attribution + delegation provenance, async writer, no LLM in the memory hot path.
 Author: Andrea Borghi
 License: BSD-3-Clause
@@ -115,6 +115,12 @@ Maintenance CLI (`python -m pgvector`, installed as `hermes-pgvector`): `migrate
 
 Still a storage-layer feature: **no LLM, no entity graph, no new tables or columns** — just a GIN index over the existing `content` column (migration `003`) and a fused query. It stays inside invariant #1 (a second index over the same text is not a parallel ontology). Fail-soft as ever: a hybrid hiccup degrades to the proven pure-vector path, and a query that *itself* fails to embed degrades to full-text-only instead of erroring. Toggle with `plugins.pgvector.hybrid_search` (default `true`); the ambient `prefetch()` path stays pure-vector. Works without migration `003` — the GIN index only makes the full-text leg faster.
 
+## New in v0.4.2 — pip-native install + hardening
+
+- **`hermes-pgvector install`** — makes a plain `pip install hermes-memory-pgvector` deployable on ANY hermes-agent install: generates the `$HERMES_HOME/plugins/pgvector/` discovery shim (see *Install · Option 1*). No more vendored copies or editable checkouts.
+- **Migration `004`** — `hermes-pgvector migrate` now grants the runtime role DML on `memory_entries`/`conversations` itself; the manual OWNER-transfer step is gone (fresh installs previously hit `permission denied` if it was skipped).
+- **Correctness fixes** from a full-codebase review: `replace`/`remove` now match `old_text` as a *literal* substring (LIKE `%`/`_`/`\` metacharacters no longer over- or under-match — parity with the built-in tool's `in` semantics); the async writer drains its queue on shutdown instead of silently abandoning up to 255 accepted writes when full; a wrong-dimension embed model now surfaces as `expected 768 dims, got N` instead of a masking 404; DM-key bucketing no longer sweeps ordinary `:signal:`-containing theme names into `whatsapp-dm`; bulk MEMORY.md import circuit-breaks after 3 consecutive embed failures (a hanging endpoint can no longer block session start for minutes); `remap` re-checks its duplicate-drop guard under the advisory lock; tool errors redact credential-looking fragments and preserve `score: null` for full-text-only hybrid hits (with `rrf_score` now included); `recall_memory(scope='session')` returns a helpful error instead of silently matching nothing.
+
 ## Multi-agent / per-minion themes
 
 Each systemd-run minion sets one header on its OpenAI client; everything else flows automatically:
@@ -139,7 +145,28 @@ Set `plugins.pgvector.allowed_themes` to that product/worker list to enforce it
 
 ## Install
 
-### Option 1: clone + run the installer script (recommended)
+### Option 1: pip + discovery shim (recommended, v0.4.2+)
+
+```bash
+# 1. Install the package into the SAME environment hermes-agent runs in
+pip install hermes-memory-pgvector
+
+# 2. Create the discovery shim
+hermes-pgvector install          # writes $HERMES_HOME/plugins/pgvector/
+
+# 3. Apply ALL migrations (schema + attribution + FTS + runtime grants)
+hermes-pgvector migrate --admin-dsn \
+    "dbname=<your-memory-db> user=postgres host=/var/run/postgresql"
+
+# 4. Activate + verify
+hermes config set memory.provider pgvector
+sudo systemctl restart hermes.service
+hermes memory status             # expect: Provider: pgvector; Status: available
+```
+
+**Why the shim?** hermes-agent discovers memory providers by scanning plugin *directories* — `plugins/memory/<name>/` (bundled) and `$HERMES_HOME/plugins/<name>/` (user) — and never looks at installed packages. `pip install` alone is therefore invisible to it. `hermes-pgvector install` writes a two-line shim whose absolute import resolves to the pip-installed package, so upgrades are just `pip install -U hermes-memory-pgvector` + restart, and rollback is `pip install hermes-memory-pgvector==<prev>` + restart — the shim never changes. `--remove` deletes it; if the package is uninstalled the shim import fails cleanly and hermes falls back to built-in memory.
+
+### Option 2: clone + run the installer script (from source)
 
 ```bash
 git clone https://github.com/andreab67/hermes-memory-pgvector.git
@@ -153,7 +180,7 @@ That:
 2. Copies `pgvector/` into `$HERMES_HOME/plugins/pgvector/` (defaults to `~/.hermes/plugins/pgvector/`).
 3. Prints the admin migration + activation commands you run next.
 
-### Option 2: manual
+### Option 3: manual
 
 ```bash
 # Python deps
@@ -182,15 +209,13 @@ sudo -u postgres psql -d <your-memory-db> \
 # leg. No new tables/columns/GRANTs; needs no OWNER step.
 sudo -u postgres psql -d <your-memory-db> \
      -f ~/.hermes/plugins/pgvector/migrations/003_hybrid_search_fts.sql
-# (or apply every migration in order:  hermes-pgvector migrate --admin-dsn "user=postgres host=/var/run/postgresql dbname=<your-memory-db>")
 
-# Hand ownership of the v0.1 tables to the hermes runtime role
-sudo -u postgres psql -d <your-memory-db> -c "
-ALTER TABLE memory_entries OWNER TO hermes;
-ALTER SEQUENCE memory_entries_id_seq OWNER TO hermes;
-ALTER TABLE conversations OWNER TO hermes;
-ALTER SEQUENCE conversations_id_seq OWNER TO hermes;
-"
+# v0.4.2: grant the runtime role DML on the core tables (replaces the old
+# manual "ALTER TABLE ... OWNER TO hermes" step; skips with a NOTICE if your
+# runtime role isn't named 'hermes' — grant manually in that case).
+sudo -u postgres psql -d <your-memory-db> \
+     -f ~/.hermes/plugins/pgvector/migrations/004_runtime_grants.sql
+# (or apply every migration in order:  hermes-pgvector migrate --admin-dsn "user=postgres host=/var/run/postgresql dbname=<your-memory-db>")
 
 # Activate
 hermes config set memory.provider pgvector
@@ -314,4 +339,4 @@ Bug reports + PRs welcome. Open an issue describing the failure mode + your envi
 
 ## License
 
-[BSD 3-Clause](LICENSE) © 2026 Andrea Borghi.
+[BSD 3-Clause](LICENSE) © 2026 Green Yoga Inc

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/hermes_memory_pgvector.egg-info/SOURCES.txt

@@ -17,7 +17,9 @@ pgvector/writer.py
 pgvector/migrations/001_schema.sql
 pgvector/migrations/002_agent_attribution.sql
 pgvector/migrations/003_hybrid_search_fts.sql
+pgvector/migrations/004_runtime_grants.sql
 tests/test_hybrid_search.py
 tests/test_identity.py
+tests/test_install_shim.py
 tests/test_smoke.py
 tests/test_store_v04.py

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/__init__.py

@@ -84,6 +84,17 @@ _NOISE_RE = re.compile(
 logger = logging.getLogger(__name__)
 
 
+# Credential-looking fragments that must never round-trip into a tool response
+# (psycopg/libpq errors can echo conninfo verbatim; tool errors flow back to
+# the model and can be persisted durably by conversation capture).
+_CRED_RE = re.compile(r"(password|passfile|sslkey|sslpassword)=\S+", re.IGNORECASE)
+
+
+def _safe_err(exc: BaseException) -> str:
+    """Exception text safe to return to the model: truncated + creds redacted."""
+    return _CRED_RE.sub(r"\1=[redacted]", str(exc)[:300])
+
+
 # ---------------------------------------------------------------------------
 # Tool schema — one explicit search over memory_entries
 # ---------------------------------------------------------------------------
@@ -195,7 +206,7 @@ DEFAULTS = {
     "bulk_sync_on_init": True,
     # v0.2 — conversation turn capture
     "sync_turns": True,
-    "turn_min_chars": 40,  # turns shorter than this are noise unless > 200 chars or contain tool refs
+    "turn_min_chars": 40,  # turns shorter than this (after strip) are boilerplate noise
     # v0.4 — identity governance
     "allowed_themes": None,        # None/empty = governance off; set a list to enforce an allow-list
     "identity_aliases": {},        # {raw: canonical} remaps applied before normalization
@@ -257,6 +268,11 @@ class PgvectorMemoryProvider(MemoryProvider):
 
     def initialize(self, session_id: str, **kwargs) -> None:
         self._session_id = session_id
+        # Per-session log-signal reset (v0.4.2): the provider instance is
+        # reused across sessions, so without this a single embed failure in
+        # any past session silences the one-time warning for the process
+        # lifetime — a later session with a broken endpoint gets zero signal.
+        self._embed_warned = False
         # Per-agent theme scoping — priority order:
         #   1. gateway_session_key — from the `X-Hermes-Session-Key` header on
         #      API requests. This is the EXPLICIT minion-scope signal sent by
@@ -837,6 +853,14 @@ class PgvectorMemoryProvider(MemoryProvider):
             agent_filter: Optional[str] = self._agent_identity
         elif scope == "all":
             agent_filter = None
+        elif scope == "session":
+            # Only recall_conversation supports 'session'. Falling through
+            # would silently filter on a literal 'session' theme and return
+            # zero rows — indistinguishable from "nothing found" (v0.4.2).
+            return tool_error(
+                "scope='session' is only valid for recall_conversation; "
+                "use 'current', 'all', or a theme name here."
+            )
         else:
             agent_filter = scope
 
@@ -855,7 +879,7 @@ class PgvectorMemoryProvider(MemoryProvider):
             )
         except EmbeddingError as exc:
             if not hybrid:
-                return json.dumps({"results": [], "count": 0, "error": f"embed: {exc}"})
+                return json.dumps({"results": [], "count": 0, "error": f"embed: {_safe_err(exc)}"})
             # Hybrid on: the query text still drives a full-text search without a
             # vector, so degrade to lexical recall instead of erroring.
             logger.debug("recall_memory embed failed; full-text-only: %s", exc)
@@ -889,23 +913,28 @@ class PgvectorMemoryProvider(MemoryProvider):
                         limit=limit,
                     )
                 except Exception as exc2:  # noqa: BLE001
-                    return json.dumps({"results": [], "count": 0, "error": f"db: {exc2}"})
+                    return json.dumps({"results": [], "count": 0, "error": f"db: {_safe_err(exc2)}"})
             else:
-                return json.dumps({"results": [], "count": 0, "error": f"db: {exc}"})
+                return json.dumps({"results": [], "count": 0, "error": f"db: {_safe_err(exc)}"})
 
         results = []
         for r in rows:
             ts = r.get("updated_at") or r.get("created_at")
-            results.append(
-                {
-                    "id": r.get("id"),
-                    "agent_identity": r.get("agent_identity"),
-                    "target": r.get("target"),
-                    "ts": ts.isoformat() if ts else None,
-                    "score": round(float(r.get("score") or 0.0), 4),
-                    "content": (r.get("content") or "")[:2000],
-                }
-            )
+            score = r.get("score")
+            entry = {
+                "id": r.get("id"),
+                "agent_identity": r.get("agent_identity"),
+                "target": r.get("target"),
+                "ts": ts.isoformat() if ts else None,
+                # None stays None (v0.4.2): a full-text-only hybrid hit has no
+                # cosine score; flattening it to 0.0 made a strong lexical
+                # match look identical to an orthogonal vector match.
+                "score": round(float(score), 4) if score is not None else None,
+                "content": (r.get("content") or "")[:2000],
+            }
+            if r.get("rrf_score") is not None:
+                entry["rrf_score"] = round(float(r["rrf_score"]), 6)
+            results.append(entry)
         return json.dumps({"results": results, "count": len(results)})
 
     def _handle_recall_conversation(self, args: Dict[str, Any]) -> str:
@@ -942,7 +971,7 @@ class PgvectorMemoryProvider(MemoryProvider):
             )
         except EmbeddingError as exc:
             if not hybrid:
-                return json.dumps({"results": [], "count": 0, "error": f"embed: {exc}"})
+                return json.dumps({"results": [], "count": 0, "error": f"embed: {_safe_err(exc)}"})
             logger.debug("recall_conversation embed failed; full-text-only: %s", exc)
             vec = None
 
@@ -972,24 +1001,26 @@ class PgvectorMemoryProvider(MemoryProvider):
                         limit=limit,
                     )
                 except Exception as exc2:  # noqa: BLE001
-                    return json.dumps({"results": [], "count": 0, "error": f"db: {exc2}"})
+                    return json.dumps({"results": [], "count": 0, "error": f"db: {_safe_err(exc2)}"})
             else:
-                return json.dumps({"results": [], "count": 0, "error": f"db: {exc}"})
+                return json.dumps({"results": [], "count": 0, "error": f"db: {_safe_err(exc)}"})
 
         results = []
         for r in rows:
             ts = r.get("ts")
-            results.append(
-                {
-                    "id": r.get("id"),
-                    "agent_identity": r.get("agent_identity"),
-                    "session_id": r.get("session_id"),
-                    "role": r.get("role"),
-                    "ts": ts.isoformat() if ts else None,
-                    "score": round(float(r.get("score") or 0.0), 4),
-                    "content": (r.get("content") or "")[:2000],
-                }
-            )
+            score = r.get("score")
+            entry = {
+                "id": r.get("id"),
+                "agent_identity": r.get("agent_identity"),
+                "session_id": r.get("session_id"),
+                "role": r.get("role"),
+                "ts": ts.isoformat() if ts else None,
+                "score": round(float(score), 4) if score is not None else None,
+                "content": (r.get("content") or "")[:2000],
+            }
+            if r.get("rrf_score") is not None:
+                entry["rrf_score"] = round(float(r["rrf_score"]), 6)
+            results.append(entry)
         return json.dumps({"results": results, "count": len(results)})
 
     # -- Setup hooks ---------------------------------------------------------

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/__main__.py

@@ -2,6 +2,7 @@
 
 Runs standalone (no hermes-agent runtime needed), so it is safe in cron:
 
+    python -m pgvector install  [--hermes-home ~/.hermes] [--remove] [--force]
     python -m pgvector migrate  --admin-dsn "dbname=hermes_memory user=postgres host=/var/run/postgresql"
     python -m pgvector stats    [--dsn ...]
     python -m pgvector backfill [--dsn ...] [--embed-url ...] [--batch-size 100] [--dry-run]
@@ -9,6 +10,11 @@ Runs standalone (no hermes-agent runtime needed), so it is safe in cron:
     python -m pgvector cleanup  --identities "agent:main:whatsapp:dm:17192714834,skill-bench,skill-bench-ws" [--execute]
     python -m pgvector remap    --old hermes --new agent-hermes [--execute] [--force]
 
+`install` (v0.4.2) makes a pip-installed package discoverable by hermes-agent:
+it writes a tiny shim into $HERMES_HOME/plugins/pgvector/ that resolves to
+this package at import time. Required because hermes-agent discovers memory
+providers by scanning plugin DIRECTORIES only — never site-packages.
+
 Destructive commands (prune/cleanup/remap) DEFAULT TO DRY-RUN. Pass --execute
 to actually mutate. Every destructive run that mutates is recorded in
 memory_maintenance_log.
@@ -21,7 +27,9 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 import sys
+from pathlib import Path
 from typing import Optional
 
 from . import DEFAULTS
@@ -66,10 +74,135 @@ def _make_embed_fn(args, file_cfg: dict):
 # --- commands -------------------------------------------------------------
 
 def cmd_migrate(args) -> int:
-    store = MemoryStore("dbname=postgres")  # dsn unused; admin path opens its own conn
+    # The store is constructed on the ADMIN dsn so the post-migration probe
+    # below checks the database that was actually migrated. (v0.4.2 — it
+    # previously probed a hard-coded 'dbname=postgres', so the "migration 002
+    # present" line reported on the wrong database.)
+    store = MemoryStore(args.admin_dsn)
     applied = store.apply_all_migrations(admin_dsn=args.admin_dsn)
     print(f"applied migrations: {', '.join(applied) if applied else '(none found)'}")
     print(f"migration 002 present: {store.ensure_migration_002_applied()}")
+    store.close()
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# install — discovery shim for pip-installed packages (v0.4.2)
+# ---------------------------------------------------------------------------
+
+SHIM_MARKER = "Auto-generated by `hermes-pgvector install`"
+
+# The docstring deliberately contains the literal strings "MemoryProvider" and
+# "register_memory_provider": hermes-agent's discovery heuristic
+# (_is_memory_provider_dir) greps the first 8 KiB of __init__.py for them.
+SHIM_INIT = '''"""Discovery shim for the pip-installed hermes-memory-pgvector package.
+
+''' + SHIM_MARKER + ''' — do not edit; re-run the installer to regenerate.
+Delete this directory (or run `hermes-pgvector install --remove`) to
+deactivate the plugin.
+
+hermes-agent discovers memory providers by scanning plugin DIRECTORIES —
+plugins/memory/<name>/ (bundled) and $HERMES_HOME/plugins/<name>/ (user) —
+for an __init__.py mentioning MemoryProvider / register_memory_provider.
+It never looks at installed packages, so `pip install hermes-memory-pgvector`
+alone is invisible to it. This shim bridges the gap: the loader imports this
+file, and the absolute import below resolves to the real package installed
+in the SAME environment hermes-agent runs in. Uninstall the package and the
+import fails cleanly — the loader logs it and falls back to built-in memory.
+"""
+
+from pgvector import PgvectorMemoryProvider, register  # noqa: F401
+'''
+
+
+def _resolve_hermes_home(cli_value: Optional[str]) -> Path:
+    """--hermes-home flag > $HERMES_HOME > hermes_constants > ~/.hermes."""
+    if cli_value:
+        return Path(cli_value).expanduser()
+    env = os.environ.get("HERMES_HOME")
+    if env:
+        return Path(env).expanduser()
+    try:
+        from hermes_constants import get_hermes_home
+        return Path(get_hermes_home())
+    except Exception:  # noqa: BLE001 — standalone venv without hermes-agent
+        return Path.home() / ".hermes"
+
+
+def cmd_install(args) -> int:
+    """Create/refresh (or --remove) the discovery shim in $HERMES_HOME/plugins/pgvector."""
+    home = _resolve_hermes_home(args.hermes_home)
+    shim_dir = home / "plugins" / "pgvector"
+    init_py = shim_dir / "__init__.py"
+
+    if args.remove:
+        if shim_dir.is_symlink():
+            shim_dir.unlink()
+            print(f"removed symlink {shim_dir}")
+            return 0
+        if not shim_dir.exists():
+            print(f"nothing to remove at {shim_dir}")
+            return 0
+        if init_py.exists() and SHIM_MARKER not in init_py.read_text(
+            encoding="utf-8", errors="replace"
+        ):
+            print(
+                f"refusing to remove {shim_dir}: not a generated shim (no marker)",
+                file=sys.stderr,
+            )
+            return 1
+        import shutil
+        shutil.rmtree(shim_dir)
+        print(f"removed shim {shim_dir}")
+        return 0
+
+    # A pre-existing symlink or hand-installed plugin dir is not ours to
+    # clobber silently. --force replaces a symlink outright and moves a real
+    # directory aside with a timestamped .bak suffix.
+    if shim_dir.is_symlink():
+        if not args.force:
+            print(
+                f"{shim_dir} is a symlink (existing manual install); "
+                "re-run with --force to replace it with the shim",
+                file=sys.stderr,
+            )
+            return 1
+        shim_dir.unlink()
+    elif init_py.exists() and SHIM_MARKER not in init_py.read_text(
+        encoding="utf-8", errors="replace"
+    ):
+        if not args.force:
+            print(
+                f"{shim_dir} already contains a non-shim plugin install; "
+                "move it aside or re-run with --force",
+                file=sys.stderr,
+            )
+            return 1
+        from datetime import datetime
+        bak = shim_dir.with_name(
+            shim_dir.name + ".bak-" + datetime.now().strftime("%Y%m%d-%H%M%S")
+        )
+        shim_dir.rename(bak)
+        print(f"moved existing install aside to {bak}")
+
+    shim_dir.mkdir(parents=True, exist_ok=True)
+    init_py.write_text(SHIM_INIT, encoding="utf-8")
+    # plugin.yaml beside the shim lets discovery display the description.
+    try:
+        src = Path(__file__).parent / "plugin.yaml"
+        (shim_dir / "plugin.yaml").write_text(
+            src.read_text(encoding="utf-8"), encoding="utf-8"
+        )
+    except Exception as exc:  # noqa: BLE001 — cosmetic only
+        print(f"warning: could not copy plugin.yaml: {exc}", file=sys.stderr)
+
+    print(f"installed discovery shim: {shim_dir}")
+    print("  -> resolves to the pip-installed `pgvector` package at import time")
+    print("next steps:")
+    print("  1. config.yaml:  memory.provider: pgvector   (+ plugins.pgvector settings)")
+    print("  2. migrations (admin, once):")
+    print("       hermes-pgvector migrate --admin-dsn 'dbname=<db> user=postgres host=/var/run/postgresql'")
+    print("  3. restart hermes; verify with:  hermes memory status")
     return 0
 
 
@@ -179,6 +312,21 @@ def build_parser() -> argparse.ArgumentParser:
         sp.add_argument("--dsn", default=None, help="Postgres DSN (runtime hermes role)")
         sp.add_argument("--config", default=None, help="config.yaml to read plugins.pgvector from")
 
+    ins = sub.add_parser(
+        "install",
+        help="create the $HERMES_HOME/plugins/pgvector discovery shim for a pip-installed package",
+    )
+    ins.add_argument(
+        "--hermes-home", default=None,
+        help="override HERMES_HOME (default: $HERMES_HOME env, hermes_constants, ~/.hermes)",
+    )
+    ins.add_argument("--remove", action="store_true", help="remove a previously generated shim")
+    ins.add_argument(
+        "--force", action="store_true",
+        help="replace an existing symlink / move a non-shim install aside (.bak-<ts>)",
+    )
+    ins.set_defaults(func=cmd_install)
+
     m = sub.add_parser("migrate", help="apply all migrations as DB admin")
     m.add_argument("--admin-dsn", required=True, help="superuser/owner DSN (CREATE/GRANT)")
     m.set_defaults(func=cmd_migrate)

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/embed.py

@@ -22,6 +22,16 @@ class EmbeddingError(Exception):
     """Raised when the embedding endpoint fails to return a usable vector."""
 
 
+class EmbeddingDimensionError(EmbeddingError):
+    """Endpoint reachable but returned wrong-dimension vectors.
+
+    Distinct from generic EmbeddingError so the protocol-fallback path can
+    tell "endpoint down, try the other protocol" apart from "endpoint fine,
+    the MODEL is misconfigured" — the latter must surface as-is (invariant
+    #7), not be masked by a 404 from retrying the other protocol (v0.4.2).
+    """
+
+
 def embed(
     text: str,
     *,
@@ -74,6 +84,11 @@ def _embed_once(text: str, *, base_url: str, model: str, timeout: float) -> List
             timeout=timeout,
             extract=lambda d: d["data"][0]["embedding"],
         )
+    except EmbeddingDimensionError:
+        # The endpoint answered — the model is just wrong-dimensional.
+        # Falling through to the native protocol would 404 on a pure
+        # OpenAI-compatible server and bury the actionable message.
+        raise
     except EmbeddingError as exc:
         logger.debug("OpenAI-compat embed failed (%s); trying native", exc)
 
@@ -112,7 +127,7 @@ def _post(url: str, body: dict, *, timeout: float, extract) -> List[float]:
     if not isinstance(vec, list) or not vec:
         raise EmbeddingError("response had no embedding array")
     if len(vec) != 768:
-        raise EmbeddingError(f"expected 768 dims, got {len(vec)}")
+        raise EmbeddingDimensionError(f"expected 768 dims, got {len(vec)}")
     return vec
 
 

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/identity.py

@@ -35,8 +35,17 @@ from typing import Iterable, Mapping, Optional, Tuple
 # segment. Collapse the whole family to ONE bucket so we neither get a theme
 # per contact (cardinality) nor store the phone number as an agent_identity
 # (PII). Matches e.g. 'agent:main:whatsapp:dm:17192714834',
-# 'agent:x:telegram:dm:55512345', 'signal:dm:+1...'.
-_DM_RE = re.compile(r"(?:^|:)dm:|:whatsapp:|:telegram:|:signal:", re.IGNORECASE)
+# 'agent:x:telegram:dm:55512345', 'signal:dm:+1...', 'whatsapp:17195550000'.
+#
+# v0.4.2: a platform token alone no longer triggers — it must be followed by
+# a 'dm:' segment or a phone/chat id. The old pattern's bare ':signal:'
+# alternative swept ordinary colon-namespaced themes (e.g. a trading key like
+# 'desk:signal:main') into the DM bucket, breaking theme isolation on nothing
+# but the word "signal".
+_DM_RE = re.compile(
+    r"(?:^|:)dm:|(?:^|:)(?:whatsapp|telegram|signal):(?=dm:|\+?\d)",
+    re.IGNORECASE,
+)
 
 # Benchmark / test-harness identities that must not pollute durable prod memory.
 # 'skill-bench', 'skill-bench-ws', '<x>-bench', '<x>-bench-ws', 'bench'.

hermes_memory_pgvector-0.4.2/pgvector/migrations/004_runtime_grants.sql

@@ -0,0 +1,36 @@
+-- 004_runtime_grants.sql — v0.4.2 runtime-role DML grants for the 001 tables.
+--
+-- ADDITIVE ONLY. Never edit 001/002/003. Idempotent (GRANT is); safe to re-run.
+-- Apply once as DB admin, AFTER 001:
+--   sudo -u postgres psql -d hermes_memory -f 004_runtime_grants.sql
+--
+-- ===========================================================================
+-- WHY
+-- ===========================================================================
+-- 001 creates memory_entries + conversations with NO grants: the runtime role
+-- only gained access through a MANUAL "ALTER TABLE ... OWNER TO hermes" step
+-- documented in the README — a step `hermes-pgvector migrate` never ran. An
+-- operator following the CLI path alone got "permission denied for table
+-- memory_entries" on every plugin write (002 grants covered only the v0.4
+-- provenance tables). This migration closes that gap so `migrate` alone
+-- yields a fully-functional install.
+--
+-- GRANTs (not ownership transfer): the runtime role needs DML + sequence
+-- usage, nothing more — ownership stays with the admin role that ran the
+-- migration, consistent with the admin/runtime DDL split (invariant #5).
+--
+-- The role name 'hermes' matches this plugin's default DSN and migration
+-- 002's existing GRANTs. Deployments using a different runtime role get a
+-- NOTICE and must grant manually (same as they already had to for 002).
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'hermes') THEN
+    GRANT USAGE ON SCHEMA public TO hermes;
+    GRANT SELECT, INSERT, UPDATE, DELETE ON memory_entries, conversations TO hermes;
+    GRANT USAGE, SELECT ON SEQUENCE memory_entries_id_seq, conversations_id_seq TO hermes;
+  ELSE
+    RAISE NOTICE 'role "hermes" not found — grant DML on memory_entries/conversations (and USAGE on their id sequences) to your runtime role manually';
+  END IF;
+END
+$$;

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/plugin.yaml

@@ -1,5 +1,5 @@
 name: pgvector
-version: 0.4.1
+version: 0.4.2
 description: "Postgres + pgvector storage layer for hermes-agent. Mirrors built-in MEMORY.md / USER.md + captures every substantive (user, assistant) chat turn into a conversations table. Per-agent themes via X-Hermes-Session-Key with v0.4 identity governance (PII/DM-key bucketing, bench isolation, allow-list). Agent attribution + parent->child delegation provenance (memory_agents / memory_agent_edges). 768-dim semantic recall with hybrid vector+full-text (RRF) ranking, embedding backfill, conversation TTL. Async writer + connection pool. No LLM mediation."
 pip_dependencies:
   - "psycopg[binary]>=3.3.4"

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/store.py

@@ -31,6 +31,20 @@ from .embed import to_pgvector_literal
 logger = logging.getLogger(__name__)
 
 
+def _escape_like(text: str) -> str:
+    """Escape LIKE metacharacters so `text` matches as a literal substring.
+
+    The built-in memory tool matches old_text with plain Python `in` — no
+    wildcards. Postgres LIKE treats %/_ as wildcards and backslash as the
+    default escape character, so an unescaped pattern both over-matches
+    ('15% YoY' matches '15<anything>YoY' and can hit unrelated rows) and
+    under-matches (backslashes in stored Windows paths are consumed as
+    escapes, so the row that literally contains them never matches).
+    Escaping all three restores exact-substring semantics (v0.4.2).
+    """
+    return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+
+
 class MemoryStore:
     """Postgres-backed mirror of hermes-agent's built-in memory entries."""
 
@@ -136,8 +150,10 @@ class MemoryStore:
                 cur.execute("SELECT to_regclass('memory_entries')")
                 if cur.fetchone()[0] is None:
                     raise self.SchemaNotApplied(
-                        "memory_entries table missing. Apply the migration as DB admin: "
-                        "psql -d <dbname> -f plugins/memory/pgvector/migrations/001_schema.sql"
+                        "memory_entries table missing. Apply migrations as DB admin: "
+                        "hermes-pgvector migrate --admin-dsn 'dbname=<db> user=postgres "
+                        "host=/var/run/postgresql' (or psql -f the files in the "
+                        "installed package's pgvector/migrations/ directory, in order)"
                     )
 
     def apply_migration_as_admin(self, *, admin_dsn: str, migration: str = "001_schema.sql") -> None:
@@ -261,7 +277,8 @@ class MemoryStore:
                        AND target = %s
                        AND content LIKE %s
                     """,
-                    (new_content, vec_literal, agent_identity, target, f"%{old_text}%"),
+                    (new_content, vec_literal, agent_identity, target,
+                     f"%{_escape_like(old_text)}%"),
                 )
                 updated = cur.rowcount
                 conn.commit()
@@ -287,7 +304,7 @@ class MemoryStore:
                        AND target = %s
                        AND content LIKE %s
                     """,
-                    (agent_identity, target, f"%{old_text}%"),
+                    (agent_identity, target, f"%{_escape_like(old_text)}%"),
                 )
                 deleted = cur.rowcount
                 conn.commit()
@@ -555,15 +572,31 @@ class MemoryStore:
 
         inserted = 0
         skipped = 0
+        # Circuit breaker (v0.4.2): this loop runs SYNCHRONOUSLY inside
+        # initialize(), and a hanging (not refused) embed endpoint costs up to
+        # ~20s per entry (two protocol attempts × 10s timeout). Without a
+        # breaker, 50 new entries would block session start for ~17 minutes.
+        # After 3 consecutive failures, stop embedding and insert the rest
+        # text-only — the nightly backfill re-embeds them later.
+        consecutive_embed_failures = 0
         for entry in entries:
             if entry in existing:
                 skipped += 1
                 continue
             vec = None
-            try:
-                vec = embed_fn(entry) if embed_fn else None
-            except Exception:  # noqa: BLE001 — fail-soft on bulk embed
-                vec = None
+            if embed_fn and consecutive_embed_failures < 3:
+                try:
+                    vec = embed_fn(entry)
+                    consecutive_embed_failures = 0
+                except Exception:  # noqa: BLE001 — fail-soft on bulk embed
+                    vec = None
+                    consecutive_embed_failures += 1
+                    if consecutive_embed_failures == 3:
+                        logger.warning(
+                            "bulk_upsert_md: 3 consecutive embed failures — "
+                            "inserting remaining entries text-only "
+                            "(the backfill sweep will re-embed them)"
+                        )
             row_id = self.add(
                 agent_identity=agent_identity,
                 target=target,
@@ -908,19 +941,24 @@ class MemoryStore:
                 batch_progress = 0
                 for r in rows:
                     processed += 1
+                    # The whole embed → literal → UPDATE pipeline is fail-soft
+                    # per row (v0.4.2): a vector that embeds "successfully" but
+                    # is unstorable (NaN/Inf tokens rejected by vector_in, a
+                    # transient DB error) must mark THIS row failed and move
+                    # on, not abort the run for every remaining table.
                     try:
                         vec = embed_fn(r["content"])
+                        vec_literal = to_pgvector_literal(vec)
+                        with self._get_pool().connection() as conn:
+                            with conn.cursor() as cur:
+                                cur.execute(
+                                    f"UPDATE {t} SET embedding = %s::vector WHERE id = %s",
+                                    (vec_literal, r["id"]),
+                                )
+                                conn.commit()
                     except Exception:  # noqa: BLE001 — fail-soft, leave NULL
                         failed += 1
                         continue
-                    vec_literal = to_pgvector_literal(vec)
-                    with self._get_pool().connection() as conn:
-                        with conn.cursor() as cur:
-                            cur.execute(
-                                f"UPDATE {t} SET embedding = %s::vector WHERE id = %s",
-                                (vec_literal, r["id"]),
-                            )
-                            conn.commit()
                     succeeded += 1
                     batch_progress += 1
                 # If an entire batch failed to embed (endpoint flapping), stop —
@@ -1053,14 +1091,33 @@ class MemoryStore:
                     "memory_entries": {"moved": me_old - dupes, "dropped_duplicates": dupes},
                     "conversations": {"moved": conv_old},
                 }
-            if dupes > 10 and not force:
-                raise RuntimeError(
-                    f"remap {old_identity!r} -> {new_identity!r} would drop {dupes} "
-                    "duplicate memory_entries rows; re-run with force=True to proceed"
-                )
 
             with conn.cursor() as cur:
                 cur.execute("SELECT pg_advisory_xact_lock(9999)")
+                # Re-count duplicates INSIDE the advisory lock (v0.4.2): the
+                # pre-count above ran unlocked (it also feeds the dry-run
+                # report), so a concurrent writer inserting colliding rows
+                # between count and mutate could push real duplicates past the
+                # unlocked estimate — the >10 force-guard must be enforced
+                # against the locked truth, mirroring delete_by_identity's
+                # count-under-lock ordering.
+                cur.execute(
+                    """
+                    SELECT count(*) FROM memory_entries o
+                     WHERE o.agent_identity = %s
+                       AND EXISTS (SELECT 1 FROM memory_entries n
+                                    WHERE n.agent_identity = %s
+                                      AND n.target = o.target
+                                      AND n.content = o.content)
+                    """,
+                    (old_identity, new_identity),
+                )
+                dupes = int(cur.fetchone()[0])
+                if dupes > 10 and not force:
+                    raise RuntimeError(
+                        f"remap {old_identity!r} -> {new_identity!r} would drop {dupes} "
+                        "duplicate memory_entries rows; re-run with force=True to proceed"
+                    )
                 cur.execute(
                     """
                     INSERT INTO memory_entries

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pgvector/writer.py

@@ -63,7 +63,8 @@ class AsyncWriter:
         self._worker_fn = worker_fn
         self._queue: "queue.Queue[Optional[_PendingWrite]]" = queue.Queue(maxsize=maxsize)
         self._thread: Optional[threading.Thread] = None
-        self._stop = threading.Event()
+        self._stop = threading.Event()      # hard stop: exit ASAP, abandon queue
+        self._draining = threading.Event()  # graceful stop: exit once queue is empty
         self._dropped = 0
         self._dropped_warned = False
         self._lock = threading.Lock()
@@ -109,17 +110,31 @@ class AsyncWriter:
             return False
 
     def shutdown(self, timeout: float = 5.0) -> None:
-        """Signal stop + wait for the queue to drain (up to `timeout` seconds)."""
+        """Drain the queue (up to `timeout` seconds), then stop the thread.
+
+        The drain flag is set FIRST, so the thread exits only once the queue
+        is empty — a full queue at shutdown time is drained rather than
+        silently abandoned, and items racing in behind the wake-up sentinel
+        are still processed (v0.4.2; previously a full queue downgraded to a
+        hard stop that dropped up to maxsize-1 accepted writes with no log).
+        """
         if not self._thread or not self._thread.is_alive():
             return
-        # Sentinel wakes the thread even if the queue is empty.
+        self._draining.set()
         try:
+            # Sentinel wakes the thread instantly if it's idle on an empty
+            # queue; if the queue is full the 0.5s get-timeout wakes it anyway.
             self._queue.put_nowait(None)
         except queue.Full:
-            self._stop.set()
+            pass
         self._thread.join(timeout=timeout)
         if self._thread.is_alive():
             logger.warning("pgvector writer thread did not drain within %.1fs", timeout)
+        leftover = self._queue.qsize()
+        if leftover:
+            logger.warning(
+                "pgvector writer shutdown abandoned %d queued write(s)", leftover
+            )
 
     def stats(self) -> Dict[str, Any]:
         return {
@@ -136,6 +151,7 @@ class AsyncWriter:
             if self._thread and self._thread.is_alive():
                 return
             self._stop.clear()
+            self._draining.clear()
             self._thread = threading.Thread(
                 target=self._run,
                 name="pgvector-writer",
@@ -148,9 +164,15 @@ class AsyncWriter:
             try:
                 item = self._queue.get(timeout=0.5)
             except queue.Empty:
+                if self._draining.is_set():
+                    break  # queue fully drained — graceful shutdown complete
                 continue
-            if item is None:  # shutdown sentinel
+            if item is None:  # shutdown wake-up sentinel
                 self._queue.task_done()
+                if self._draining.is_set():
+                    # Keep draining — real items can be queued BEHIND the
+                    # sentinel (enqueue racing shutdown); exit on Empty above.
+                    continue
                 break
             try:
                 self._worker_fn(item)

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hermes-memory-pgvector"
-version = "0.4.1"
+version = "0.4.2"
 description = "Postgres + pgvector memory provider plugin for hermes-agent. Multi-agent storage layer with per-minion themes, identity governance, agent attribution + delegation provenance, async writer, no LLM in the memory hot path."
 readme = "README.md"
 requires-python = ">=3.11"

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/tests/test_identity.py

@@ -1,7 +1,9 @@
 """Unit tests for pgvector/identity.py — pure normalization, no DB or embed.
 
 These run everywhere (no PG_TEST_DSN needed); identity.py has no I/O.
-Import style matches test_smoke.py (sibling import via sys.path insert).
+Import style matches test_smoke.py (repo root on sys.path, package imports —
+v0.4.2: the old pgvector/-dir insert leaked bare module names onto sys.path
+for the whole pytest process, masking broken imports in sibling test files).
 """
 
 from __future__ import annotations
@@ -9,9 +11,9 @@ from __future__ import annotations
 import sys
 from pathlib import Path
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "pgvector"))
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
-from identity import (  # noqa: E402
+from pgvector.identity import (  # noqa: E402
     BENCH_BUCKET,
     DEFAULT_IDENTITY,
     DM_BUCKET,
@@ -68,6 +70,21 @@ def test_dm_bucket_is_idempotent():
     assert normalized is False  # already canonical, nothing changed
 
 
+def test_platform_token_alone_is_not_a_dm_key():
+    # v0.4.2: a bare ':signal:'/':whatsapp:' segment no longer sweeps ordinary
+    # colon-namespaced themes into the DM bucket on nothing but the word.
+    canon, _, reason = normalize_identity("desk:signal:main")
+    assert canon == "desk:signal:main"
+    assert reason == "unchanged"
+
+
+def test_platform_followed_by_id_is_a_dm_key():
+    for raw in ("whatsapp:17195550000", "agent:x:signal:12345", "telegram:+15551234"):
+        canon, _, reason = normalize_identity(raw)
+        assert canon == DM_BUCKET
+        assert reason == "dm-bucket"
+
+
 # --- bench isolation ------------------------------------------------------
 
 def test_skill_bench_buckets_by_default():

hermes_memory_pgvector-0.4.2/tests/test_install_shim.py

@@ -0,0 +1,74 @@
+"""Unit tests for the `hermes-pgvector install` discovery-shim generator.
+
+Pure filesystem — no DB, no embed endpoint, runs everywhere. The shim is the
+bridge that makes a pip-installed package visible to hermes-agent's
+directory-scan provider discovery, so its exact contents are contract:
+the loader greps the first 8 KiB of __init__.py for "MemoryProvider" /
+"register_memory_provider", and the absolute import must resolve the real
+package.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from pgvector.__main__ import SHIM_MARKER, main  # noqa: E402
+
+
+def test_install_creates_shim(tmp_path):
+    assert main(["install", "--hermes-home", str(tmp_path)]) == 0
+    init = tmp_path / "plugins" / "pgvector" / "__init__.py"
+    text = init.read_text(encoding="utf-8")
+    assert SHIM_MARKER in text
+    # Discovery heuristic strings the hermes-agent loader scans for.
+    assert "MemoryProvider" in text
+    assert "register_memory_provider" in text
+    # The actual bridge: absolute import of the installed package.
+    assert "from pgvector import PgvectorMemoryProvider, register" in text
+    # plugin.yaml copied beside the shim for the discovery description.
+    assert (tmp_path / "plugins" / "pgvector" / "plugin.yaml").exists()
+
+
+def test_install_is_idempotent(tmp_path):
+    assert main(["install", "--hermes-home", str(tmp_path)]) == 0
+    assert main(["install", "--hermes-home", str(tmp_path)]) == 0
+    assert SHIM_MARKER in (
+        tmp_path / "plugins" / "pgvector" / "__init__.py"
+    ).read_text(encoding="utf-8")
+
+
+def test_install_refuses_foreign_dir(tmp_path):
+    d = tmp_path / "plugins" / "pgvector"
+    d.mkdir(parents=True)
+    (d / "__init__.py").write_text("# hand-written plugin, not a shim\n", encoding="utf-8")
+    assert main(["install", "--hermes-home", str(tmp_path)]) == 1
+    # untouched
+    assert "hand-written" in (d / "__init__.py").read_text(encoding="utf-8")
+
+
+def test_install_force_moves_foreign_dir_aside(tmp_path):
+    d = tmp_path / "plugins" / "pgvector"
+    d.mkdir(parents=True)
+    (d / "__init__.py").write_text("# hand-written plugin, not a shim\n", encoding="utf-8")
+    assert main(["install", "--hermes-home", str(tmp_path), "--force"]) == 0
+    baks = list((tmp_path / "plugins").glob("pgvector.bak-*"))
+    assert len(baks) == 1
+    assert "hand-written" in (baks[0] / "__init__.py").read_text(encoding="utf-8")
+    assert SHIM_MARKER in (d / "__init__.py").read_text(encoding="utf-8")
+
+
+def test_remove_deletes_generated_shim(tmp_path):
+    main(["install", "--hermes-home", str(tmp_path)])
+    assert main(["install", "--hermes-home", str(tmp_path), "--remove"]) == 0
+    assert not (tmp_path / "plugins" / "pgvector").exists()
+
+
+def test_remove_refuses_foreign_dir(tmp_path):
+    d = tmp_path / "plugins" / "pgvector"
+    d.mkdir(parents=True)
+    (d / "__init__.py").write_text("# hand-written plugin, not a shim\n", encoding="utf-8")
+    assert main(["install", "--hermes-home", str(tmp_path), "--remove"]) == 1
+    assert d.exists()

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/tests/test_smoke.py

@@ -6,7 +6,7 @@ tools.registry, …) and is only exercised when the plugin runs inside
 hermes-agent.
 
 Run with:
-    pytest plugins/memory/pgvector/tests/
+    pytest tests/
 
 DB tests skip when PG_TEST_DSN is unset; embed live tests skip when
 PG_TEST_EMBED_URL is unset.
@@ -20,8 +20,9 @@ from pathlib import Path
 
 import pytest
 
-# Import sibling modules without going through hermes-agent's package
-# system (which isn't on the sys.path during workstation testing).
+# Repo root on sys.path so `pgvector.*` imports resolve without installing.
+# (v0.4.2: bare `from embed import ...` only worked when another test file
+# happened to leak pgvector/ onto sys.path first — order-dependent.)
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 
@@ -30,7 +31,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 # ---------------------------------------------------------------------------
 
 def test_pgvector_literal_roundtrip():
-    from embed import to_pgvector_literal
+    from pgvector.embed import to_pgvector_literal
 
     lit = to_pgvector_literal([0.1, -0.25, 0.333333])
     assert lit.startswith("[") and lit.endswith("]")
@@ -38,7 +39,7 @@ def test_pgvector_literal_roundtrip():
 
 
 def test_embed_empty_input_raises():
-    from embed import embed, EmbeddingError
+    from pgvector.embed import embed, EmbeddingError
 
     with pytest.raises(EmbeddingError):
         embed("", base_url="http://localhost:11434")
@@ -46,12 +47,21 @@ def test_embed_empty_input_raises():
         embed("   ", base_url="http://localhost:11434")
 
 
+def test_escape_like_literalizes_metacharacters():
+    from pgvector.store import _escape_like
+
+    assert _escape_like("15% YoY") == "15\\% YoY"
+    assert _escape_like("a_b") == "a\\_b"
+    assert _escape_like("C:\\U") == "C:\\\\U"
+    assert _escape_like("plain text") == "plain text"
+
+
 @pytest.mark.skipif(
     not os.environ.get("PG_TEST_EMBED_URL"),
     reason="PG_TEST_EMBED_URL not set",
 )
 def test_embed_live_returns_768_dims():
-    from embed import embed
+    from pgvector.embed import embed
 
     base_url = os.environ["PG_TEST_EMBED_URL"]
     vec = embed("hello world", base_url=base_url, model="nomic-embed-text")
@@ -74,7 +84,7 @@ def store():
     if not dsn:
         pytest.skip("PG_TEST_DSN not set")
 
-    from store import MemoryStore
+    from pgvector.store import MemoryStore
 
     s = MemoryStore(dsn)
     s.ensure_schema()

{hermes_memory_pgvector-0.4.1 → hermes_memory_pgvector-0.4.2}/tests/test_store_v04.py

@@ -118,6 +118,31 @@ def test_remap_identity_merges_and_dedupes(store):
     assert s.count(agent_identity=new) == 2  # shared (once) + unique-to-old
 
 
+# --- LIKE-literal substring semantics (v0.4.2) -----------------------------
+
+def test_replace_treats_percent_as_literal(store):
+    s, agent = store
+    s.add(agent_identity=agent, target="memory", content="Q3 revenue grew 15 million YoY")
+    s.add(agent_identity=agent, target="memory", content="Q3 revenue grew 15% YoY")
+    n = s.replace(
+        agent_identity=agent, target="memory",
+        old_text="15% YoY", new_content="Q3 revenue grew 15pct YoY",
+    )
+    assert n == 1  # only the literal-'%' row — never the 'million' row via wildcard
+    contents = {r["content"] for r in s.list_entries(agent_identity=agent, target="memory", limit=10)}
+    assert "Q3 revenue grew 15 million YoY" in contents
+
+
+def test_remove_underscore_and_backslash_literal(store):
+    s, agent = store
+    s.add(agent_identity=agent, target="memory", content="snake_case_name noted")
+    s.add(agent_identity=agent, target="memory", content="snakeXcaseXname noted")  # unescaped '_' would match this too
+    s.add(agent_identity=agent, target="memory", content=r"path C:\Users\andreab noted")
+    assert s.remove(agent_identity=agent, target="memory", old_text="snake_case_name") == 1
+    assert s.remove(agent_identity=agent, target="memory", old_text=r"C:\Users\andreab") == 1
+    assert s.count(agent_identity=agent, target="memory") == 1  # only the X-row remains
+
+
 # --- prune ----------------------------------------------------------------
 
 def test_prune_conversations_deletes_old(store):