v1.6.10 - Accept Real Turso Logins Without State Echo

Fixed

• Browser OAuth login actually works now. Turso redirects to /?jwt=<JWT>&username=<USERNAME> without echoing our state parameter, so the strict check rejected every real login with Invalid state parameter. A missing state is now accepted with a warning (the token is still validated against the Turso API afterwards); only a present-but-mismatched state is rejected as a CSRF attempt. Verified end-to-end with a live login.

Tests

• Extended tests/cloud/phase1_cloud.test.js: new case for the real Turso callback shape (no state → 200), alongside the existing match → 200 / mismatch → 400 cases.

Docs / CLI polish

• setup now accepts --api-token and --token as aliases for --api-key (previously silently ignored); login already accepted all three, usage lines unified.
• setup usage now documents [--api-key <TOKEN>]; uninstall help uses the same npx -y @lotargo/memory_plugin form as the README and landing.

Upgrade

npm i -g @lotargo/memory_plugin@1.6.10

v1.6.9 - Fix Turso Browser OAuth on Windows

Fixed

• Turso browser OAuth on Windows now works. The login URL no longer goes through cmd.exe, which truncated the query string at & and dropped redirect / state / type params. Browser launch on Windows now uses rundll32.exe url.dll,FileProtocolHandler (mcp-server/admin/auth.js).
• OAuth loopback race eliminated. The temporary server now binds an ephemeral port before the login URL is built, so the port= in the URL is always the real one. This also removes EADDRINUSE failures on the old fixed port 48900.
• OAuth state (CSRF) check preserved and covered: matching state → 200, mismatched → 400 with state parameter mismatch.

Tests

• Extended tests/cloud/phase1_cloud.test.js: Windows launch spec (no cmd.exe, full query string preserved), loopback bind on port 0, state match/mismatch.
• Made tests/unit/policy_retrieval.test.js offline-deterministic (generateEmbeddings: false, guaranteed DB/temp cleanup), so a corrupted ONNX cache no longer fails the whole suite and blocks the runner.

Also in this release (since v1.6.8)

• Website: landing page, Memory Matrix motion, grouped Quick Start (all-client + per-client), uninstall commands, GitHub Pages deploy (excluded from npm package).
• Docs: one-shot npx workflow consistency, roadmap with web dashboard, README architecture visuals.

Upgrade

npm i -g @lotargo/memory_plugin@1.6.9

v1.6.8 — Security & Packaging Maintenance

v1.6.8

Maintenance release focused on package security, discoverability, and npm distribution cleanup.

Security

• Replaced the stale npm xlsx@0.18.5 dependency with SheetJS CE 0.20.3 from the official SheetJS CDN.
• Fixed the known SheetJS prototype-pollution and ReDoS exposure in spreadsheet ingestion.
• Documented the remaining transitive sharp / libvips advisory from @huggingface/transformers. The plugin uses Transformers only for text feature extraction and explicitly disables its image-decoding path with env.sharp = false.

Changed

• Refreshed npm package positioning around local-first memory, hybrid RAG, agent personalization, and coding-agent integrations.
• Expanded npm discovery keywords for agent memory, coding agents, personalization, context engineering, MCP, and supported clients.
• Updated repository, homepage, and issue metadata after the GitHub repository rename to Lotargo/memory_plugin.
• Fixed README asset URLs and added a crawlable text H1.
• Updated spreadsheet parsing to use the SheetJS ESM-compatible namespace import.
• Added regression coverage for XLSX and CSV parsing.

Packaging

• Removed repository-only benchmark sources from the published npm tarball.
• Benchmark and test tooling remains available in the GitHub repository for development and evaluation.
• Reduced the npm package from approximately 222 kB to 182 kB, and from 821 kB to 681 kB unpacked.

Notes

npm audit may still report the upstream sharp advisory inherited through @huggingface/transformers. This dependency is not exercised through an image-processing path by memory_plugin.

v1.6.7 — Native Client Lifecycle, Safe Uninstall & Persona Directives

Release notes

Highlights

This release introduces a safe, cross-platform installation and uninstall lifecycle, first-class persona directives, improved client integration, and several cloud synchronization fixes.

Native client lifecycle and safe uninstall

• Added memory_plugin uninstall, memory-cli uninstall, and the memory_plugin setup --uninstall alias.
• Claude Code, Gemini CLI, and Codex now use their native MCP lifecycle commands when available.
• Added ownership-checked JSON/TOML fallbacks for missing, outdated, failing, or no-op client CLIs.
• Added per-client targeting:
  • --opencode
  • --claude
  • --codex
  • --gemini
  • --antigravity
• Added --dry-run for safe previews.
• Local Notebook and RAG data are preserved by default.
• Added guarded --purge for explicit local data removal.
• Added --purge-cache for removing only package-owned OpenCode cache directories.
• Foreign memory-agent registrations, unrelated plugins, modified skills, and user-authored prompt content are never removed.

Gemini CLI and Antigravity separation

Gemini CLI is now a separate integration using:

• ~/.gemini/settings.json
• ~/.gemini/GEMINI.md
• ~/.gemini/skills

Antigravity keeps its existing integration through:

• ~/.gemini/config/mcp_config.json
• ~/.gemini/config/AGENTS.md
• Optional workspace .agents configuration

Typed persona directives

• Added explicit Notebook kind: "fact" | "directive" semantics.
• Active directives are separated from descriptive memory facts.
• OpenCode injects directives through its system-prompt transform.
• Codex, Claude Code, Gemini CLI, and Antigravity receive synchronized managed persona blocks.
• Added [DIRECTIVE] recall badges.
• Legacy persona and preference tags remain compatible.
• Added memory-cli migrate-persona [--dry-run] for idempotent migration.
• Added memory-cli sync-persona and npm run persona:sync.

Improved local development

• Added npm run dev:link / memory-cli dev-link.
• The command globally links the working repository, connects OpenCode through a file:// plugin entry, and synchronizes prompts and skills.
• Local development no longer requires repeated npm publication and reinstallation.

Fixes

• Fixed remember_note omitting blobHash from its public result.
• Fixed concurrent triggerBackgroundSync() calls returning before the active queue drain completed.
• Fixed Codex TOML cleanup to preserve unrelated sections and formatting.
• Malformed client configuration now fails closed instead of being overwritten.
• Uninstall returns a non-zero exit status when a requested cleanup step fails.
• Added cross-platform Windows npm-shim execution and XDG path support.

Upgrade

npm install -g @lotargo/memory_plugin@1.6.7
memory_plugin setup

Restart the affected clients after setup.

Uninstall examples

memory_plugin uninstall --dry-run
memory_plugin uninstall
memory_plugin uninstall --opencode --purge-cache
memory_plugin uninstall --purge --yes

v1.6.6: Fix npm package contents and cross-directory workspace routing

What's Changed

Added

• Explicit directory (and project alias) parameter support across Notebook/Memory tools (remember, recall, get_fact, forget, update_fact, memory_info, link_knowledge) and RAG tools (ingest_document, query_knowledge_base, batch_query_knowledge_base, manage_knowledge_base) in both MCP server and OpenCode plugin.
• Ability to target project-scoped memory and RAG stores from an external working directory or when invoked outside the repository root.

Fixed

• Fixed npm distribution package manifest to include mcp-server/rag_scope.js and all server modules on install.
• Fixed workspace path resolution and isolation to prevent npm process INIT_CWD leaks when running from external working directories.
• Fixed batch_query_knowledge_base argument handling and result formatting in the MCP server.

Full Changelog: v1.6.4...v1.6.6

v1.6.5: Explicit workspace directory targeting and routing fixes

What's Changed

Added

• Explicit directory (and project alias) parameter support across Notebook/Memory tools (remember, recall, get_fact, forget, update_fact, memory_info, link_knowledge) and RAG tools (ingest_document, query_knowledge_base, batch_query_knowledge_base, manage_knowledge_base) in both MCP server and OpenCode plugin.
• Ability to target project-scoped memory and RAG stores from an external working directory or when invoked outside the repository root.

Fixed

• Fixed workspace path resolution and isolation to prevent npm process INIT_CWD leaks when running from external working directories.
• Fixed batch_query_knowledge_base argument handling and result formatting in the MCP server.

Full Changelog: v1.6.4...v1.6.5

v1.6.4 — Project-Scoped RAG, Complete Memory Context & Reliable Sync

Highlights

This release strengthens project isolation across the Memory Notebook, RAG knowledge base, knowledge graph, snapshots, and cloud synchronization.

RAG now follows the same hygiene model as Notebook memory:

• scope: "all" returns global knowledge plus only the current Git project.
• Outside a Git repository, only global knowledge is available.
• Sources shared by multiple projects are stored once with separate scope associations.
• Global and project memories remain equal context sources; conflicts are resolved by the agent.

Project-scoped RAG

• Added explicit global/project scope associations for RAG documents.
• Project scope is now the default for document ingestion.
• Added all, project, and global scopes to RAG querying and management.
• Prevented documents and linked fact metadata from leaking across projects.
• Made document deletion safer:
  • By default, it unlinks only the current project.
  • Outside Git, it targets global scope.
  • Broader global or all removal must be explicitly requested.
• Reusing the same URL or path across projects no longer duplicates the underlying document.

Stable document updates

Re-ingesting an existing source now preserves:

• Document ID
• Project/global associations
• Notebook fact links
• Knowledge graph relationships

Changed content rebuilds its chunks, vectors, retrieval policies, FTS index, and structural graph edges without breaking existing references.

OpenCode improvements

• Removed the previous ten-fact auto-injection limit.
• OpenCode now receives complete fact bodies from global and current-project memory.
• Superseded facts remain excluded from active context.
• Added native batch_query_knowledge_base support.
• OpenCode now exposes all 15 shared tools plus two native helpers.

Current tool counts:

• 15 MCP server tools
• 17 native OpenCode tools
• 17 unique tool names across both integrations

Memory lifecycle fixes

• recall now hides superseded facts by default.
• Added includeSuperseded: true for explicit history inspection.
• Filtered recall results retain stable storage indices for safe update and deletion.
• Superseding legacy facts without IDs now assigns distinct IDs to both versions.
• Updating or forgetting linked facts keeps knowledge links and graph projections consistent.

Cloud sync and snapshots

Snapshot export/import and hybrid cloud synchronization now preserve:

• Dense vector data
• Retrieval policies and policy provenance
• Document scopes
• Notebook knowledge links
• Structural and line-range graph edges
• Graph metadata and timestamps

The hybrid-sync worker now drains writes queued during an active flush. Partial project-scope unlinking is also synchronized correctly.

Project identity and setup

• memory_info reports whether the current Git identity is linked or unlinked.
• Relinking a project moves its RAG associations and Notebook-to-document links.
• Environment-specific setup flags modify only the requested integration.
• Codex setup installs the bundled skill into:
  • ~/.codex/skills
  • ~/.agents/skills
• Repeated Codex setup now reports the configured environment count correctly.

Agent guidance

The bundled using-memory skill now clearly defines:

• Full-body memory initialization
• Automatic registration of unlinked Git repositories
• Global/current-project isolation
• Agent-resolved conflicts without store precedence
• Selective RAG curation
• Proper use of project and global RAG scopes
• Linking durable Notebook facts to supporting documentation
• Safe scoped document removal

Testing

Added regression coverage for:

• RAG isolation between projects
• Shared sources and partial unlinking
• Stable document re-ingestion
• Complete snapshot restoration
• Complete hybrid cloud synchronization
• Knowledge-link metadata isolation
• OpenCode full-body memory injection
• Superseded fact handling
• Legacy fact IDs
• Knowledge graph projection updates

All 18 unit, integration, MCP, and cloud test suites pass.

Upgrade

npm install -g @lotargo/memory_plugin@1.6.4
memory_plugin setup --codex
memory_plugin doctor --codex

Restart Codex Desktop or OpenCode after upgrading so the refreshed tool schemas and plugin code are loaded.

v1.6.3 — Reliable Codex MCP Support on Windows

Release title

v1.6.3 — Reliable Codex MCP Support on Windows

Release notes

Highlights

This release fixes memory-agent startup and tool exposure in Codex on Windows.

Codex no longer launches the MCP server through npx or Windows .cmd shims. Instead, setup now configures a direct and reliable process chain:

Codex → node.exe → mcp-server/boot.js

Fixed

• Replaced the Codex npx launcher with absolute paths to Node.js and boot.js.
• Added validation for Node.js 22.5.0 or newer before writing Codex configuration.
• Added safe migration of legacy [mcp_servers.memory-agent] sections.
• Legacy opencode-memory-plugin and @lotargo/memory_plugin entries are migrated automatically.
• Preserved unrelated settings in ~/.codex/config.toml.
• Prevented duplicate MCP sections during repeated setup.
• Improved global prompt idempotency and duplicate-block cleanup while preserving user-authored AGENTS.md and CLAUDE.md content.

New Codex diagnostics

Added:

memory_plugin doctor --codex

The command verifies:

• Codex configuration and MCP registration
• Direct Node.js executable
• Node.js version compatibility
• Packaged boot.js entry point
• MCP initialize
• tools/list
• Live memory_info call
• Live recall(scope="all") call
• Current Git project identity
• Codex memory prompt installation

It also helps distinguish plugin startup failures from Codex Desktop tool-exposure issues.

Documentation

Corrected and clarified the available tool counts:

• 15 MCP server tools
• 16 native OpenCode plugin tools
• 17 unique tool names across both integrations

The README now explicitly lists the OpenCode tools and documents which tools are integration-specific.

Testing

Added regression coverage for:

• Windows paths containing spaces
• TOML escaping and section-aware migration
• Legacy and duplicate Codex configurations
• Direct MCP initialize, tool discovery, and tool calls
• Project isolation across multiple Git repositories
• Global-only memory outside Git repositories
• Prompt installation and removal idempotency

All unit, integration, Codex MCP, and cloud test suites pass.

Upgrade

npm install -g @lotargo/memory_plugin@1.6.3
memory_plugin setup --codex
memory_plugin doctor --codex

Restart Codex Desktop and open a new task after upgrading so the refreshed MCP tool list is loaded.

v1.6.2 — Batch Retrieval, Policy Expansion Toggle, RAG Evaluation

What's New

Batch Retrieval API

Execute multiple search queries in a single MCP call — all query embeddings computed in one ONNX pass, queries run in parallel. Ideal for cross-document comparisons and multi-part analysis.

• New MCP tool: batch_query_knowledge_base
• ~N× faster than N separate query_knowledge_base calls (shared ONNX inference)
• Returns one result set per query, in input order

Policy Expansion Toggle

Table summaries and code signatures are now automatically expanded to full content for better recall. Can be disabled when pure micro_chunk precision is needed.

• New config: policyExpansion (default: true)
• Trade-off: ~+5-10% recall, slight MRR decrease
• Per-call override: hybridQuery({ policyExpansion: false })

RAG Evaluation Test

Automated quality verification with 10 analytical queries against financial reports. Validates that retrieved chunks contain expected facts.

• 84/84 facts found (100% pass rate)
• Includes raw-question vs optimized-query comparison (+33% fact retrieval improvement)
• Run: npm run test:rag

Documentation & Agent Instructions

• Updated PROMPT_BLOCK with query optimization and batch usage directives
• SKILL.md updated with batch query tool and query formulation guidance
• README updated with new tool and config option

Files Changed

• mcp-server/retrieval/retriever.js — batchHybridQuery() + _precomputedVector parameter
• mcp-server/tools/rag_tools.js — batch_query_knowledge_base MCP tool
• mcp-server/config/config_manager.js — policyExpansion config option
• mcp-server/prompt_manager.js — updated agent instructions
• skills/using-memory/SKILL.md — batch query documentation
• tests/unit/rag_evaluation.test.js — new evaluation test
• CHANGELOG.md, README.md

v1.6.1 - Node.js version guards and ESM boot safety

Fixed

• Node.js version check before ESM loading: Fixed a crash on Node.js versions older than 22.5.0 (No such built-in module: node:sqlite). Lightweight boot entry points (boot.js and cli_boot.js) now verify Node version compatibility before loading the ESM module graph, displaying clear upgrade instructions if the Node version is unsupported.
• Strict engine enforcement: Added engine-strict=true to project configuration so npm install fails immediately on Node.js < 22.5.0 instead of emitting a warning.
• Preinstall warning: Added an explicit stderr warning during installation on unsupported Node versions explaining that node:sqlite is required.
• Process termination on update: Updated process-kill patterns in preinstall.js to target boot.js in addition to index.js, ensuring running server instances are properly terminated during global updates.

Changed

• All CLI binaries (memory_plugin, memory-agent, memory-cli) now route execution through boot.js and cli_boot.js.
• .npmrc is included in version control containing project-level engine-strict=true settings.