3ngram 1.8.5

3ngram v1.8.5

Patch: a read-only commitment panel for Claude Code, index-served successor
lookups, and ten moderate advisories cleared.

Changes

• Read-only commitment panel for Claude Code (#255: #257, #258, #259,
  #260, #264, #272). 3ngram-hook commitments list|show|context prints one
  JSON envelope over GET-only reads of /api/v1/me, /api/v1/briefing and
  /api/v1/memories/:id, with a context fingerprint on every envelope and
  whole-response redaction on show. --github adds GitHub issues and pull
  requests a commitment names as related evidence through
  gh api --method GET, never as proof of completion. The 3ngram plugin
  (plugins/3ngram) opens the pane with /commitments; rows draw only next
  to the read that produced them, a context probe runs before every refresh,
  and a reload never shows rows held under another selection or account.
  The plugin also bundles the four session hooks and stands each copy down
  when it recognises the same hook in settings.json. The guard is
  best-effort and fails open: a registration it cannot recognise (a shell
  wrapper, a composite command, another settings source) runs twice, never
  not at all, so keep one registration path. Source-only in this release:
  the panel runs the 3ngram-hook binary, and no 3ngram-hook-v* tag has
  been cut yet, so until a maintainer publishes the first hook release it
  needs a build from source (cmd/3ngram-hook/README.md).

• memory_edges is indexed by target (#244, closes #240). Migration
  0038_memory_edges_target_idx adds (user_id, to_id, edge_type), so the
  superseded flag in search, supersededBy in get_memories and the REST
  history's direct relationships are index-served. get_memories resolves
  the successor with one lateral lookup per row. On a 5,000-memory,
  20,000-edge tenant a 20-id batch drops from 51 ms to 0.2 ms.

• Security triage 2026-10-06 (#256). hono moves to 4.13.11 and the
  hono, ip-address and qs advisory overrides are re-cut, clearing ten
  moderate transitive findings under @modelcontextprotocol/*. Only the
  hono bump reaches npm consumers of @3ngram/server; the ip-address
  and qs fixes are root pnpm-workspace.yaml overrides, applied in this
  repository's lockfile and container images. A consumer keeping its own
  lockfile should raise those two itself.

Operations

Migration 0038_memory_edges_target_idx builds its index inside the
migration transaction, which blocks writes to memory_edges for the build;
at current sizes that is sub-second. Apply it to every environment before a
deployment that consumes @3ngram/db 0.12.2 (@3ngram/core 0.13.2,
@3ngram/server 1.8.5). No configuration change.

Cloud-session bootstrap only: both repositories now commit a cloud-only
Claude Code SessionStart hook (#254); local sessions are untouched.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:6455250cb2a13eb961e27f4e47bada535856f2fc316ab2a5f3f0ec153fd62b1d