v1.2.1 — security: the claude nightly writer can no longer read outside the vault

What you will notice

• Security fix: the claude nightly writer can no longer read files outside the vault. Up to 1.2.0 its Grep and
  Glob were allowed with no path, so it could print lines from any file in the account, the keys file included. Only
  a nightly job on the claude lane (installed by install.sh, --ask or --timer) was affected; upgrade by
  running the install line again.

Details

• Security: the claude nightly writer could read files outside the vault through Grep. Its allow-list scoped Read
  and Edit to the vault but allowed Glob and Grep with no path; in a test with a canary file outside the vault, Grep
  printed the canary line (Read was refused). Glob and Grep now carry the vault path too; the same test leaks nothing
  and Grep and Glob still work inside the vault. Affects only the nightly job installed by install.sh or --ask /
  --timer on the claude lane; the API-key, grok and Codex lanes, and the model steps (no tools at all), are not
  affected. Found by an outside review.
• first_run.sh ends by pointing at bootstrap.py --dry-run and the lookup-only install, not at install.sh (which
  installs the nightly job).

v1.2.0 — installing changes nothing you did not ask for; distill keeps more decisions; fewer confident wrong answers

What you will notice

• Installing changes nothing you did not ask for. The one-line install is lookup only, asks nothing and sends
  nothing; bootstrap.py --ask turns remembering on. A logged-in Codex, which can read the whole account, is no
  longer picked as the nightly writer unless you name it.
• Session distill writes down more of what was decided, changes of mind first: on the registered measurement set,
  missed 52% → 41% and changes of mind 11 → 15 of 24.
• A new session no longer starts from an answer you already changed.
• Fewer confident wrong answers: a question that names something no page mentions is refused, and one that matches
  a single word of a page says so. This release ships the refusal change before the registered real-traffic blind
  judge (it waits for 50 fresh queries); its result will be logged in bench/memory_honesty/HELDOUT.md against 1.0.3.
• Outside numbers: on LongMemEval (questions and labels by its authors, scored without a model), KRouter cites an
  answer session for 439 of 470 answerable questions and the latest update for 70 of 72, level with plain BM25. See
  HELDOUT.md, set 7.

Details

• Session distill writes down more of what was decided, changes of mind first. A long session-day is distilled
  in segments of about 6 000 characters, plus one pass over the whole excerpt for changes of mind (decided early,
  changed later, often in different segments); near-duplicates are merged; changes come first; up to 24 lines per page
  (a new session still gets 8, changes first). The prompt says what is not a decision (steps, discussion, one-offs) and
  that a proposal the user accepted counts. On ten tuning sessions (not the measurement set): missed 44% → 22%,
  changes of mind 13 → 15 of 17, steps-or-fabricated share 29% → 31% (fabricated 1 → 7 of 202). More model calls per
  page (one per segment, plus one). On the
  registered measurement set (set 6: 22 session-days never used for tuning, scored by Grok against the same
  131-item reference): missed 51.9% → 40.5%, changes of mind 11 → 15 of 24, steps-or-fabricated 21.7% → 17.1%;
  all three registered criteria met.
• The one-line install is lookup only and asks nothing. It makes or finds the vault, installs the router,
  connects the agents, and stops: no session import, no nightly job, nothing leaves the machine. Its last lines say
  how to turn remembering on: bootstrap.py --ask puts the two questions it used to put at install (import recent
  sessions? install the nightly job?), with the same preview of what is sent; --import, --import-distill and
  --timer still say yes in advance. An upgrade where you said yes before (session import consent, or a nightly job
  on disk) keeps it and is not told it is off.
• Codex is no longer picked as the nightly writer on its own. It writes only the vault but can read the
  whole account, keys file included. It is used when you name it (KROUTER_WRITER, KROUTER_LEARN_CLI) or set
  KROUTER_ALLOW_CODEX=1; otherwise a logged-in grok or claude, both limited to the vault, is used instead, and a
  Codex-only machine is told why distilling was skipped (codex:reads-account).
• A question that names something the vault never mentions is refused (shipped before the real-traffic blind judge; see above).
  "Which did I start first, the Ferrari model or the Porsche model?" on a vault that has never mentioned a Porsche was
  answered from the Ferrari page. Now a capitalised word in mid-sentence (Porsche, Seattle, iPad) that no page
  contains refuses the question; sentence-initial capitals, two-letter words such as OK, and month and day names do
  not count. Tuned on LongMemEval S's 30 unanswerable questions (now a development set: refused 3 → 9, answerable
  questions refused 12 → 14 of 470) and dev3 (one more neighbour refused, nothing lost). heldout3, run once: wrong
  citations 26.6% → 26.1%, neighbours refused 46 → 47 of 80, answerable right 102 of 120 unchanged.
• A question that matches one word of a page now says so. On a 20-page vault, "小红书的笔记几点发？" was answered at
  medium confidence from a page about sealing days, on the single word 笔记: the score floors scale with vault size,
  so a new vault lets a one-word match through. On the dev sets such answers are right half the time and the score
  does not tell which half, so whether to answer is unchanged (dev, dev2, dev3 identical). What changes: confidence is
  low, the receipt carries a recall_note: line (only one word matched; say the vault may not cover the question),
  and no generated answer is attached. Alias hints no longer come from scattered characters or question words
  ("剪辑" was offered "剪藏原件"; "标题有什么讲究" was offered a page on 什么): a hint needs a shared two-character word.
• Docs: retrieval described as it is. PROTOCOL, ARCHITECTURE, DETAILS (en, zh) and VERIFY still called it "a lock on short
  nouns" and quoted "25/25 paraphrases miss" without saying that tests the alias lock alone; outside agents read that
  as "you must maintain an alias table and any rewording misses". Ranked recall answers most questions; the alias lock
  is an optional fast path that needs no upkeep. FOR-AGENTS gains "Common misreadings" (no alias upkeep, rewording,
  what leaves the machine, the earlier names Runtime36 and DSH-KRouter and what pages about them describe, stale
  version numbers).
• A new session no longer starts from an answer you already changed. The SessionStart hook injected a
  decision next to the later correction that replaced it ("本地 API 端口用 8080" beside "原来 8080 → 改成 9090"), so
  the agent saw both. Lines are ordered by page date, then their (HH:MM), then their place on the page; a line is left
  out when a later correction replaced the value it still holds ("8080", not just the shared words "本地 API") on the
  same subject, unless an even later correction restores it (same-day revert); chains (30 → 10, then 10 → 5) keep only
  the newest; unrelated decisions, and the same value on another subject, stay. A line that holds the replaced value
  but only part of the correction's subject ("测试环境 API 端口用 8080" against "本地 API 端口 8080 → 9090") is kept and
  marked "可能已被上面的「→」改过，先核对" instead of dropped. Found while designing the injection bench; an outside
  review caught two regressions in the first version and one remaining case in the second, now tests.
  tests/test_stale_injection.py.
• Docs: 1.1.x is the stable line (fixes only until 2026-11-12, at most one patch a week); DETAILS lists what the
  stability promise covers (core) and what is best-effort (extras); FOR-AGENTS and the status block name the smallest
  install, router only with nothing in the background.
• Docs: what outside reviews misread, checked against the code (FOR-AGENTS "Common misreadings": Obsidian is optional,
  no writer skips permission prompts, an existing vault or router is left alone, not only for code); ARCHITECTURE no
  longer says the claude and grok writers skip permission prompts (untrue since 0.12.0).
• Docs: docs/img/demo-content.gif, the same story as demo.gif for short-video work, recorded the same way; plugin,
  skill and package text call Obsidian optional.
• Bench: sets 7 (LongMemEval, scored from its authors' labels; bench/longmemeval/lme.py), 8 (answers over the
  vault's own git history) and 9 (written by people: corrections and their neighbours) registered before any run; set
  7 run and amended (S's unanswerable questions became a development set).

v1.1.1 — the nightly learner stops making recall worse; unconfined CLIs need your yes

What you will notice

• The nightly learner stops making recall worse. Up to 1.1.0 it could learn a question onto a page that only
  shares its subject; on the dev sets one night of that raised wrong citations (2 → 5, 7 → 9). It now has to copy the
  sentence that answers the question, and learns only when that sentence is on the page and is about the question.
  Triggers it learned before stay; look at 90 系统文件/自动化/下意识触发词-自学习.psv if your recall got worse.
• CLIs KRouter cannot confine are no longer used without your yes. If your only logged-in CLI is opencode, kimi,
  pi, vibe, antigravity or cursor-agent, the nightly job and model steps now skip it and say why; set
  KROUTER_ALLOW_UNCONFINED=1 in ~/.dsh-krouter-keys.env to keep using it. grok, Codex, claude and API keys are
  unchanged.
• Every page an agent may land on tells the same, current story, checked in CI against the bench and the version.

Details

• Release: the release workflow refuses to pack when the tag, package.json, plugin.json, extras/dsh/package.json,
  the newest CHANGELOG heading and the status block do not name the same version, or when changes are still listed
  under "Unreleased". The status block now says it describes main and names the latest release.
• Docs: every entry file an agent may read on its own (PROTOCOL, SECURITY, VERIFY, ARCHITECTURE, BENCHMARK, DETAILS,
  FOR-AGENTS) now opens with the same current-status block: the held-out numbers and that they are not real traffic,
  that BM25 with the two rules is level, that the real-traffic blind test has not run, who wrote the questions, how the
  nightly job is installed and what each writer lane can reach. One source (docs/STATUS.md, docs/STATUS.zh.md),
  copied by scripts/sync_status.py; a test fails when a copy drifts.
• Docs: who the "outside reviewer" is, said plainly in HELDOUT.md, BENCHMARK.md and FOR-AGENTS.md: Claude Opus in
  claude.ai chat sessions the maintainer starts, not a human, same model family as the coding sessions. A set written
  by a person is planned.
• CLIs KRouter cannot confine are no longer picked on their own. The nightly writer and the model steps use grok,
  Codex and claude without asking (a kernel sandbox, a write sandbox, a tool allow-list). opencode, kimi, pi, vibe,
  antigravity and cursor-agent run with no confinement KRouter can set, so a logged-in one is now skipped, and a
  confined CLI further down the list is used instead, unless you set KROUTER_ALLOW_UNCONFINED=1 (environment or
  keys file). A pinned KROUTER_WRITER or KROUTER_LEARN_CLI follows the same rule; the writer and host_action say
  why one was skipped.
• The nightly learner no longer learns from neighbour pages. On the dev sets it picked pages that only share a
  question's subject and so made recall worse after one night (wrong citations 2 → 5 and 7 → 9). It now sees the start
  of each candidate page and must copy the sentence that answers the question; a pick is learned only if that quote is
  on the page, is a sentence (four words or more) and shares a content word with the question. The old bare-path
  answer no longer counts. After one night on the dev sets: no wrong triggers, and few learned at all (3 and 0); no
  gain shown yet. Secret pages and 03 资料与证据 (clipped, pasted text) are never candidates. The learner now sends,
  per unanswered question, up to 4 candidate pages' first 600 characters, redacted (SECURITY.md). learn_bench.py
  measures this.
• Benchmark: bench/memory_honesty/human_set/ (instructions, template, checker) for a held-out set written by a
  person, each thing asked twice in different words; learn_bench.py ("learns from use": week 1 through the router
  and one night of learning, week 2 scored before and after).
• Docs: one story for the nightly job everywhere. PROTOCOL.md, first_run.sh, install.sh and the nightly writer's
  files said "timer on by default"; the one-line install asks first, and only the manual install.sh installs it.
• Docs: the comparison with claude-mem and basic-memory says up front that neither can refuse, so their 0 of 80 is
  structural, and that BM25 with KRouter's two rules is level with it; the answerable-right column (102 / 72 / 45 of
  120) is the comparison that does not depend on refusing. Their heldout3 per-question output is stored and regraded
  in CI. extras/hooks/exec-gate.py is described as an accident guard, not a security boundary.

v1.1.0 — Cursor sessions import on day one

What you will notice

• Cursor users get their history on day one. The install's "import the agent sessions already on this machine?"
  now covers Cursor agent sessions as well as Claude Code and Codex: one page per session and day, your questions and
  each turn's closing answer, redacted, nothing leaving the machine.

Details

• Cursor sessions import too. Cursor agent transcripts (~/.cursor/projects/*/agent-transcripts/) become
  session pages like Claude Code and Codex ones: your questions (the <user_query> part), each turn's closing answer,
  redacted, on the day and minute Cursor stamped on the question. The project folder is recovered from Cursor's
  folder name by checking which path exists. KROUTER_CURSOR_PROJECTS points at another root. Closes #26.

v1.0.4 — two popular memory tools on 200 held-out questions; README for the deciding reader; provenance-attested packages

What you will notice

• Two popular memory tools measured on 200 questions. On the outside reviewer's third bench (200 held-out
  questions in English and Chinese, 80 the vault cannot answer, 20 daily logs as distractors), every system at its
  defaults: KRouter cites a wrong page 27% of the time, claude-mem 13.39 64%, basic-memory 0.23 78%. KRouter refuses
  46 of the 80 unanswerable questions; they refuse none. Every difference is significant. Recall is unchanged since
  1.0.3, so these numbers hold for 1.0.4.
• The README is written for someone deciding. The numbers come first, with a command that reruns them in about a
  second and needs no install; then a look-first install path, and who it is and is not for. docs/FOR-AGENTS.md
  gives an agent asked to recommend it the table, the limits and the risks in one place.
• Packages you can trace to their source. Release packages now carry a GitHub build-provenance attestation:
  gh attestation verify dsh-krouter-1.0.4.tgz --repo 398894496-arch/KRouter. SECURITY.md explains each flag a
  static scanner raises.

Details

• Docs: the README opens with the 200-question numbers, a look-first install (clone, sample receipt, --dry-run,
  then install with the nightly job off), who it is and is not for, and a one-second way to rerun the numbers.
  docs/FOR-AGENTS.md carries the third-bench table and the risks in one place; SECURITY.md maps each flag a static
  scanner raises to its file.
• Release: packages get a GitHub build-provenance attestation (gh attestation verify), so a package can be tied to
  the tagged source and the workflow that built it, not only to a checksum in the same release.
• Benchmark: claude-mem 13.39.0 (latest) on the 200-question third bench, at its defaults: 64% wrong citations,
  0 of 80 neighbours refused, 72 of 120 right, against KRouter 1.0.3's 27%, 46 and 102 (every difference significant).
• Benchmark: basic-memory 0.23.2 (latest) on the 200-question third bench, at its defaults: 78% wrong citations,
  0 of 80 neighbour questions refused, 45 of 120 right, against KRouter 1.0.3's 27%, 46 and 102 (every difference
  significant). floor.py and both adapters now run on all three vaults; the container runs offline.
• Docs: the README's honest numbers now come from the third bench (200 held-out questions, 95% intervals): level
  with BM25 plus the two rules at equal coverage, not ahead. The fresh-traffic blind judge waits for 50 new queries
  instead of a fixed 2026-10-16 date.
• Benchmark: a third held-out set by the outside reviewer, heldout3.jsonl.gz: 200 questions (80 neighbours, half
  Chinese) on vault3/, 110 pages including 20 daily logs as distractors, with no dev set on that vault. run.py
  gains --ci (bootstrap intervals), --vs (paired intervals), --vs-matched (equal coverage) and --curve.
  Baseline: KRouter 1.0.3 is ahead of BM25 with the two rules at equal coverage on every measure, significant on
  none. The decision rule for "surpasses BM25" and for a new default is in HELDOUT.md, written before any candidate.
• Benchmark: a negative result recorded. Recall changes that were better on both dev sets were worse on held-out
  (38% / 31% wrong citations vs 25%), so they were not shipped (docs/BENCHMARK.md, "Tried and not shipped"). A
  second dev set, questions_dev2.jsonl (50 questions, written by the maintainer), is added for tuning.
• Benchmark: a second, bilingual bench written by the outside reviewer. vault2/ (60 pages, half Chinese), 50 dev
  questions (questions_dev3.jsonl) and 50 held-out (heldout2.jsonl.gz, gzipped so it stays out of greps), each
  with 20 neighbour questions whose missing term CI checks is on no page. First run, before any change: KRouter 33%
  wrong citations on heldout2 (9 / 20 neighbours refused, 24 / 30 answerable right); BM25 with the two rules 23%
  (15 / 20, 17 / 30); plain BM25 61%. run.py --set dev3|heldout2; the vault2 BM25 baselines search Chinese by
  character pairs.

v1.0.3 — matched baselines: the gap is the two rules, not the ranker

What you will notice

• The comparison no longer flatters KRouter. An outside review showed that the "25% vs 60%" gap was mostly
  structural: at their defaults the other systems cannot refuse and do not know a page was replaced. With the same two
  rules given to them (superseded pages left out, a refusal floor picked on the dev set only), plain BM25 reaches 19%
  wrong citations on held-out and basic-memory 30%. At the same coverage as KRouter they cite slightly fewer wrong
  pages (2 vs 3 of 12). The README and docs/BENCHMARK.md now say so plainly: KRouter's advantage on this bench is
  those two rules on by default, plus receipts, not a better ranker. Reproduced, not taken on trust; KRouter was
  not changed in response, because the held-out set is not a tuning target.
• Release cadence written down as practised: minor releases at most weekly, patch releases when ready.

Details

• run.py --adapter bm25-floor; bench/memory_honesty/floor.py applies "skip superseded + dev-picked floor" to any
  adapter output that carries scores; the basic-memory adapter now records scores.
• Third-party systems run in a Linux container (bench/memory_honesty/adapters/Dockerfile): basic-memory was re-run
  there, with identical answers to the host run. A container does not share the host's keychain or launchd.
• HELDOUT.md log: the reviewer's and the maintainer's baseline runs (aggregates only; no --reveal; no KRouter
  change).

v1.0.2 — basic-memory and claude-mem on the honesty bench; claude-mem import checked live

What you will notice

• A comparison, with the other systems actually run. On the 25 held-out questions, KRouter cites the wrong page
  25% of the time. basic-memory 0.22.1 does 60%, claude-mem 13.35.0 60%, and plain full-text search 61%. Of 10
  neighbour questions, KRouter refuses 8; the others refuse 0, 0 and 1. The cost is stated next to it: KRouter got 9
  of 15 answerable held-out questions right, basic-memory and claude-mem 10, full-text search 9, because KRouter refuses some questions phrased in
  words the page does not use. Both sets, how each system was run, and every system's raw per-question output on the
  dev set are in docs/BENCHMARK.md and bench/memory_honesty/results/.
• claude-mem import, checked on a live install (13.35.0), is no longer beta. One fix came from the real data:
  claude-mem files most decisions as change (only the reversal of an earlier decision came out as decision), so
  the decisions page now takes decision, change, feature, bugfix and refactor. In the live run, the model
  pass sorted them correctly: "any branch, manual upload → tags on main, CI publishes" was marked as replaced, and the
  session-start hook brought exactly that correction into a new session in the same repository and nothing into the
  other one. The decisions page's how line is now a summary of the page; the line matching the question comes from
  recall.
• The memory honesty bench has a held-out set. The 25 questions the 1.0.1 headline number comes from are now in
  bench/memory_honesty/heldout.jsonl: 9 corrections, 6 current, 10 neighbour questions on the same vault, written
  by the outside reviewer and never used for tuning. run.py --set heldout prints aggregates only; --reveal prints
  the misses and, followed by a ranking change, burns the set. Rules, the baseline at freeze and a log of who has
  seen what: bench/memory_honesty/HELDOUT.md.

Details

• The held-out set from the outside review (#32): bench/memory_honesty/heldout.jsonl, 25 questions; run.py --set heldout prints aggregates only, --reveal shows misses and burns the set; rules and log in HELDOUT.md.
• tests/test_memory_honesty_heldout.py pins a SHA-256 of the questions and of the bench vault (line endings
  normalized), checks the set does not overlap the development questions, and checks only a sanity guard: fewer
  wrong citations and at least as many refusals as plain full-text search. No floor on the held-out score.
• Adapters for basic-memory and claude-mem (bench/memory_honesty/adapters/); tests/test_memory_honesty_competitors.py
  re-grades the stored raw output and re-runs KRouter and BM25 against the published dev rows.
• No ranking, refusal or card change. Held-out at freeze (1.0.1): 25% wrong citations (3 / 12), 8 / 10 refused,
  5 / 9 corrections, 4 / 6 current; BM25 61% (14 / 23), 1 / 10.

v1.0.1 — no cross-repo leak in session memory; honest headline number

Fixes from an outside review of 1.0.0.

What you will notice

• Fixed: decisions brought into a new session leaked across repositories that share a folder name. The session-start hook matched by folder name, so a session in beta-corp/api was given alpha/api's decisions. Reproduced, then fixed. A repository is now its git top level (or its directory, outside git). The path is written into each imported page (project_root:), and only pages for this exact repository are brought in. claude-mem's memory is split the same way, using the cwd it records. Pages imported by 1.0.0 have no path and are no longer brought in; re-run import_sessions.py --days 30 to backfill (existing digests are kept).
• Only what you confirmed, plus corrections, is brought in by default. That means every line of a page you confirmed (status: active or confirmed: true), and from unconfirmed pages only the "A → B" corrections, marked unconfirmed. KROUTER_INJECT=all restores the previous behaviour. The text is in English unless the decisions are in Chinese.
• Honest headline number. On 25 questions written by the reviewer and never used for tuning, KRouter cites the wrong page 25% of the time (3 of 12 answered), against 61% for plain full-text search. The README and docs/BENCHMARK.md now lead with this, not with the 0% on the bench's own questions, which is a development-set number.
• The claude-mem importer is marked beta until it has run against a live claude-mem install.
• README: the plugin needs Claude Code 2.1.275 (2.1.292 for the shell form), and third-party marketplaces do not auto-update (claude plugin update krouter@krouter, or Enable auto-update in /plugin → Marketplaces).

v1.0.0 — stable, with claude-mem import and session memory

1.0 means the surface agents and vaults depend on is now stable: the vault layout, the alias table, the receipt
fields, the routes, the MCP tools, the KROUTER_* variables and the importers' page markers change only in a major
release, with a migration. Scoring may still be retuned in minor releases, always with before / after numbers on
the public benches. Nothing breaks from 0.13.0: same vault, same table, same receipts; re-run the install line to
upgrade.

What you will notice

• Coming from claude-mem. The install finds claude-mem's memory and offers to import it. Its session summaries
  become log pages, and each project's decisions become one page you confirm (status: candidate). With distilling
  on, your model sorts each project's decisions into the ones still in force and the ones a later decision replaced
  ("原来 A → 改成 B"). In a real run it caught "manual tags from any branch → tags on main, CI publishes". claude-mem
  is opened read-only and never changed.
• The two things that make claude-mem feel like memory, in the Claude Code plugin. When a session ends, it is
  imported (in the background, local; distilled when you said yes to that). When a session starts, up to 8 of this
  project's decisions from the last 30 days come with it, corrections first, each naming its page. Both run only after
  you said yes to importing, and KROUTER_INJECT=0 turns the second off. Tested end to end with Claude Code: a new
  session answered "what did we decide about releases" with no tool call and named the page, and the session was in
  the vault when it ended.

Details

• import_claude_mem.py reads both column generations of claude-mem's schema (memory_session_id and the older
  sdk_session_id; epoch milliseconds or seconds), as of claude-mem b3e036fa13. The tests build both from its
  schema; it has not been run against a live claude-mem install. Pages carry source: krouter-claude-mem, and a page
  without that marker is never touched.
• session_hook.py start|end, wired by hooks/hooks.json at the plugin root; import_sessions.py --file imports one
  transcript.
• nightly.py gains import_claude_mem. It stays off until consent, and is also off when claude-mem is not
  installed.

---

Also in this line since 0.12: see 0.13.0 — session import, MCP server and Claude Code plugin, new front page, memory honesty bench.

v0.13.0 — useful on day one

What you will notice

• Useful in five minutes, not after a night. The install asks whether to import the Claude Code and Codex
  sessions already on the machine (the last 7 days). On a yes, each session becomes a page (your questions and
  each turn's closing answer, redacted first, written only on this machine). A second question asks whether your
  model should write "what was decided, what changed" at the top of the latest sessions' pages, and says how many
  characters that sends first. Then it suggests a question to ask your agent.
• Claude Code and Codex find the vault on their own. The install registers KRouter as an MCP server
  (krouter_ask, krouter_status) with each CLI it finds and records the vault path, so no one has to export
  OBSIDIAN_VAULT first. Claude Code can also install it as a plugin:
  /plugin install krouter --marketplace 398894496-arch/KRouter.
• A new front page. One sentence on what it does, a 30-second demo (real Claude Code output), one install line,
  and how it differs from typical agent memory. Everything else moved to docs/DETAILS.md; facts
  for an agent deciding whether to recommend it moved to docs/FOR-AGENTS.md, phrased as
  facts rather than instructions.
• A public memory honesty bench (docs/BENCHMARK.md): wrong-citation rate, refusals on
  neighbour questions, corrections followed. Plain full-text search that always answers: 63% wrong citations.
  KRouter 0.12.1, first run: 22%. 0.13.0: 0%, all 10 neighbour questions refused, 8 of 10 corrections followed
  (a development-set number: the fix below was found on this bench).

Details

• import_sessions.py: Claude Code ~/.claude/projects, Codex ~/.codex/sessions; one page per session and day
  under 05 时间日志/会话摘录/, named after the session title. Headless runs (claude -p, codex exec, the nightly
  job's own calls), tool output, thinking, injected context and subagents are left out. A page it did not write is
  never touched. A session that grows is re-rendered, keeping its digest until the session changes. --dry-run,
  --consent and --revoke are supported, and the nightly job imports yesterday only after --consent. Imported
  pages rank as logs: clues, not rules.
• nightly.py gains import_sessions as its first step. It is off until the host consents, and off is not
  reported as a problem.
• mcp_server.py: MCP over stdio, standard library only. krouter_home.py: the router, the shell router and the
  MCP server fall back to ~/.config/krouter/vault when OBSIDIAN_VAULT is unset.
• Recall: English function words no longer count as unknown words. what, which, does, should and the
  like were in no stop list, so in a small vault they counted as words the vault had never seen. That refused real
  questions and let neighbour questions through on what and do. They are now dropped from ranking and refusal,
  and plural and singular forms match each other (services / service). The author's Chinese vault scores the same
  before and after.
• Fix: re-installing no longer deletes lines from the keys file. The key probe rewrote
  ~/.dsh-krouter-keys.env from its own results, dropping the claude long-lived token, pending keys, keys that
  failed that day's probe, and comments. It now updates only the names it manages. Found while testing this release
  on the author's machine: the token was restored and nothing was sent.
• Removed from the docs: the claim that the claude writer runs with --dangerously-skip-permissions and that the
  Windows task was never run on a real host. Both stopped being true in 0.12.