v0.37.0-beta.2

Second beta of 0.37.0. On npm it is bantamkit-mcp@0.37.0-beta.2 under dist-tag beta, so latest stays 0.36.0. On PyPI it is bantamkit==0.37.0b2.

npx -y bantamkit-mcp@beta --install claude
pip install "bantamkit[mcp]==0.37.0b2"

New: recall by likely prompts, with no embedding (#207, PR #215)

• memory_save takes an optional queries: the prompts a user would type when that fact is the one they need. They are stored in a sidecar per store, ~/.bantamkit/queries/, for every layer, native facts included. The fact files do not change.
• A new 15th tool, memory_queries, lists the facts that have no queries yet and writes queries for them. Claude does the writing: no local model, no network.
• When a prompt is short, the hook adds the session's previous prompt to the query.
• bantamkit_status prints queries: N of M facts, and SessionStart prints a nudge while some facts have none.
• Measured on the gold set, which is still UNVALIDATED: p@inject rose from 0.4317 to 0.5411 and r@3 from 0.2494 to 0.3541, which passes the bar. The #199 target of p ≥ 0.8 is still missed.
• The hook's p50 latency rose by at most +3.8 ms, inside the 5 ms limit.
• Both runtimes behave the same: run.mjs --all ran 17,164 cases with 0 failures.

Verified after publish by installing each package from its registry into a sandbox and running it. Both report their own version and serve 15 tools, including memory_queries, and memory_save with queries succeeds on both.

v0.37.0-beta.1

Prerelease. npm: bantamkit-mcp@0.37.0-beta.1 (dist-tag beta; latest stays 0.36.0). PyPI: bantamkit==0.37.0b1.

• #200 touch graph: touch log with a bounded cap (1,000,000 bytes, folded under the lock to 750,000), refs, bash-turn, file graph, memory_recall({file}); via path off by default (BANTAMKIT_VIA=on). Both runtimes, conformance-gated (#209).
• #199 recall by meaning: BM25F pooled ranker shipped; the 0.8 precision@inject bar was NOT met (0.432 on an UNVALIDATED gold set) — see the issue's closing comment.
• Conformance: storage-tiers compares the prerelease version spelling (#211).

🤖 Generated with Claude Code

bantamkit 0.36.0

bantamkit 0.36.0

npm bantamkit-mcp@0.36.0 (shasum 83b083fd…) and PyPI bantamkit==0.36.0 (wheel sha256 997b1871…, sdist ebf47f11…), both verified byte-for-byte against the local build by tools/release/publish.sh.

Served changes

• tools/list: all 14 tools carry a title and MCP annotations; the 8 read-only tools advertise readOnlyHint: true. Every inputSchema has additionalProperties: false.
• New refusal on both runtimes: unknown argument '<key>'; known: <keys> (#133).
• Python prompts/get with an unknown name answers -32602 Unknown prompt: <name>, like Node (#198).
• memory_save skips an unreadable fact file by name and refuses to overwrite it (#120, #176).
• skill_audit / token_ledger descriptions name the bantamkit_degraded footer key.
• --statusline is bounded at 80 columns; the tool name is shortened with … (#189).
• Hook: an args --store X pin is honoured; Node --hook no longer loads the MCP SDK (p50 ~90 → ~32-38 ms) (#170, #172).
• Docs sweep (#149, #157, #175, #179, #183) and refreshed README pages on GitHub, npm and PyPI.
• Checkout tooling: update-probe asks npm/pip under their own config (#201) and keeps no cache in HOME.

Gates at release: pytest 3499 passed, npm 1460 tests 0 fail, ruff clean, conformance PASS: 14881 cases … 0 failures.

PRs: #202, #203.

bantamkit 0.35.9

Bug-fix release. It fixes the 17 bugs deferred from 0.35.8's audit sweep, plus the rest of #118. Each fix lands in both runtimes, and a conformance case compares the two.

Security

• The MCP SDK is now 1.31.0, which is past GHSA-6qxp-vccf-f47h. --update now reports found 0 vulnerabilities. (#143)

MCP protocol (Node now matches Python)

• A request whose params fail the schema, including a bad _meta, gets -32602 Invalid request parameters. (#147)
• A request sent before initialize is refused, except ping. (#178)
• resources/read with an odd URI answers Unknown resource. This covers a multi-segment name, a percent-encoded name, NUL, .. and an absolute path. (#180)
• Each message keeps its own side table. -32700 and -32600 answers carry id null. Big ids are kept exactly. The server exits quietly when stdout closes. (#146 #148 #181)

Install, hooks and CLI

• Host JSON keeps literal UTF-8 and the file's own indent, including in a CR-only file. (#118)
• Both update commands use an absolute interpreter. Python's --hook works without [mcp]. (#171 #173)
• Stacked one-shot flags are refused. A missing assets root is counted. int() parsing matches across runtimes. (#139 #140 #174)

Packaging and the token ledger

• The .d.ts files no longer need @types/node, and the asset loaders take a bare name. (#144 #145)
• token_ledger prints one JSON document when degraded. A BOM is not parsed on either side, and symlinked directories are not followed. (#124 #150 #151)

Gates: conformance --all PASS 14689 cases, 0 failures; pytest 3471 passed; npm 1438 tests, 0 fail.

Install: npm i -g bantamkit-mcp@0.35.9 · pip install "bantamkit[mcp]==0.35.9"

Milestone: https://github.com/Ink01101011/bantamkit/milestone/3 · PRs #196 #197

bantamkit 0.35.8

bantamkit 0.35.8 contains the job65 bug sweep (PR #193): 47 bugs from the 2026-10-13 PVT audit are fixed in both runtimes. Each fix has conformance cases that compare the two runtimes, plus mutation evidence.

Published on npm as bantamkit-mcp@0.35.8 and on PyPI as bantamkit==0.35.8. Both artifacts were verified by installing them and listing their tools over stdio.

What changed for users

• Shiftwork
  • The checkpoint is written atomically (#116).
  • Accounting can no longer forge the ledger's own keys (#117).
  • A failed commit hands the brief back (#162).
  • The default clock_in checks readiness (#164).
• Memory
  • A read-only store still answers recall (#123).
  • A store that cannot be written gives a "not writable" refusal (#141).
  • Concurrent saves all land (#161).
  • A malformed or non-UTF-8 fact costs only that fact, and the file is named (#119, #159).
  • Descriptions must be one line (#155).
  • Names over 128 characters are refused (#156).
  • Lone surrogates are refused (#160).
  • The Node fact codec reads YAML block scalars and flow lists the way PyYAML does (#120).
• validate_json
  • Local $ref resolves (#125, #126).
  • pattern follows Python re on both runtimes, with a 500 ms budget (#131, #132).
  • Scalar documents validate (#152).
  • Feedback is clipped (#153).
• Hooks
  • "1 fact" (#188).
  • No raw prompt text goes into the log (#168).
  • Only a real save silences the save nudge (#169).
  • Unreadable files are never ledgered (#192).
  • Filegraph fixes (#166, #167, #190).
• Install and update
  • Host JSON numbers are kept losslessly (#118, partial).
  • --update installs exactly the version it compared and verifies it (#128).
  • npm registry config is honoured (#135).
• Status, report and statusline
  • bantamkit_status names the bound store (#142).
  • A missing --start is refused (#142).
  • A tab in config.yaml is refused (#158).
  • The event log never creates the store (#154).
  • Report and statusline fixes (#130, #187).

Changed tool descriptions

• validate_json: the supported drafts, local $ref, and the pattern dialect and budget.
• work_plan: four refusals; depends_on is optional.
• memory_recall.k: a clamp, not min/max.
• memory_compact.reserve: its formula.
• shiftwork_clock_out.accounting: the reserved keys.
• shiftwork_clock_in: the readiness check on the default call.

Not in this release

• 17 deferred bugs, going to 0.35.9.
• #133, #120's ruling, the enhancement issues and the documentation issues, going to 0.36.0.

Full changes: v0.35.7...v0.35.8

v0.35.7 — a runnable stale-install hint

The stale-install hint is a command that runs. Carries PR #114 and the bump (PR #115).

What changed

• SessionStart stale-install line. When the installed bantamkit is behind the registry, the hook now prints node "<kept install>/dist/cli.js" --update — the absolute path of the install it checked — so the command runs with nothing on PATH, including under a GUI-launched host.
• Release pipeline. A non-zero exit from npm publish asks the registry whether the version landed before stopping, so a publish that succeeded on the wire but failed on its own post-step no longer aborts the PyPI half.

Full changelog: v0.35.6...v0.35.7

v0.35.6 — recall hygiene

Recall hygiene: the automatic hook injection stops counting as a recall, a fact the context has already seen is not injected twice, and memory_recall answers an exact name with that one fact. Carries job64 (PR #112) and the bump (PR #113).

What changed

• An automatic injection is not a recall. SessionStart / UserPromptSubmit injection no longer stamps last_recalled, so the eviction order reflects what the agent actually asked for (J64-1).
• Per-session inject dedupe. A fact already shown in this session's context is not injected again; the seen-set answers only for its own keys, and a ledger holding an array where an object belongs still remembers (J64-2, J64-8, PR 112 review).
• Dream preview reruns only when content changed. The fingerprint is a content hash, not a mtime (J64-3).
• Exact-name recall. A query that is exactly a fact's name returns that fact alone, and the tool description now says what the store default of 3 means (J64-4).
• Docs: the job64 register, review corrections and the unreachable __proto__ row (J64-7, J64-9).

Full changelog: v0.35.5...v0.35.6

v0.35.5 — roadmap rows (ddd)-(ggg) closed in Docker

Four rows of docs/roadmap-toolbox.md closed by running them in Docker on this Mac, and the published trees brought back level with main. No runtime source moved (git diff --stat a2b5aae -- runtime-py/src runtime-ts/src is empty); the bump exists so npm and PyPI match the repository.

What closed (PR #111)

• (ddd) the store conformance reference called ntpath.splitroot (3.12+) while runtime-py declares >=3.11, so a 3.11 contributor had --all abort with five suites never run. Below 3.12 the one winpaths case is now withheld by name behind a counted note; a per-side literal pins that it is armed at 3.12+.
• (eee) root ignores permission bits, so the three chmod 0o555 sessions in the shiftwork suite could not arm as uid 0. As root the suite withholds every chmod-dependent session and prints one note counting the 56 cases.
• (fff) pwsh 7.4.2 measured in mcr.microsoft.com/powershell: the forward-slash recipe writes 2A 0A; Windows PowerShell 5.1 stays open as (ccc).
• (ggg) hook ownership was decided by the presence of the bantamkit key, never its value; now a value test on both sides, with 24 per-side literal cases that redden under the symmetric mutation.

Rows (hhh)–(kkk) register what the 3.11 and root runs found and this job did not act on.

Gates at e281828

conformance --all   8931 cases, 161 ruled-different, 0 failures
pytest              3205 passed, 57 skipped, 3 xfailed
npm test            1212 pass, fail 0
hook probes         18/18
ruff                All checks passed

Full changelog: v0.35.4...v0.35.5

v0.35.4 — native invocation A+B

The hook, moved to where npm can actually reach it, installed only after asking — plus a hook-ownership defect found by running the gates on Linux for the first time.

The hook reaches the published package now

tools/ ships in neither artifact: npm pack packs from runtime-ts/, the wheel packs runtime-py/src/bantamkit. So every hook adapter under tools/hooks/ was unreachable from the only way bantamkit is installed. --hook now lives inside both runtimes. tools/hooks/bantamkit-hook.mjs remains as a 33-line shim on purpose — it is the command already registered in existing settings.json files, and deleting it would unhook those machines silently.

Hooks are never a side effect

New paired --install-hooks / --remove-hooks in both runtimes, each behind a three-state gate: a TTY answer, or --yes, or refuse with exit 2. Removal asks too: it rewrites your settings file exactly as installation does. A dated backup is written either way.

Fixed: hooks that could not be removed

Ownership was decided by asking whether a hook entry's JSON happened to contain the literal bantamkit — and the Node command carries that word only if the directory it was installed into does. Measured from an install path that does not:

launch path	3x --install-hooks	--remove-hooks
contains bantamkit	7 entries, idempotent	removes them
does not	21 entries, +7 per run	"no bantamkit hooks are installed"

Both runtimes gave that same answer over that same file, so hook entries could accumulate in a user's settings that neither runtime could ever take back out. It reaches an npm install under another name, a Docker image copying dist/ elsewhere, and any vendored build. Ownership is now decided from the entry alone, with legacy arms so entries already written by earlier versions still remove cleanly.

Also

• One-way export of fact names into the host's own auto-memory — writes only when absent, never rewrites or deletes, and exports nothing rather than guessing when the directory is unknown.
• The MCP argument pre-parse the TypeScript port never had: 16 shapes across 7 tools.
• checked_at per registry entry, closing a starvation in --update that affected every successful run, not just partial failures.
• npm and PyPI READMEs split apart and gated so they cannot drift back together.
• The PowerShell BOM claim, asserted in a docstring for months and never run, is now measured: false of PowerShell 6+ on every platform. Windows PowerShell 5.1 is left explicitly UNMEASURED rather than assumed, and what still needs a real Windows kernel is registered in git with what would settle each row.

Gates

conformance --all   8906 cases, 161 ruled-different, 0 failures
pytest              3205 passed, 57 skipped, 2 deselected, 3 xfailed
npm test            1259 tests, fail 0, 47 skipped
hook probes         18 pass, 0 fail
ruff                All checks passed!

Full changelog: v0.35.3...v0.35.4

v0.35.3

What's Changed

• fix(release): the npm artifact catches up with its own source — 0.35.1 by @Ink01101011 in #105
• fix(status): tell the client its install is stale against the index by @Ink01101011 in #106
• fix(release): phase 7 waits on the wrong PyPI surface by @Ink01101011 in #107

Full Changelog: v0.35.0...v0.35.3