v0.26.2

Fixed

• Hermes plugin version is now 0.1.3, including the blank-setting fix below.
• Blank or whitespace-only vault settings now fall back to CAIRN_VAULT and
  then ~/agentcairn, instead of selecting the working directory. Hermes drops
  blank fields when saving configuration, and clearing a setting takes effect
  immediately as well as after restart. Explicit . paths remain supported.
  Reported by @yudontknowjack (#173).
• Redaction preserves letter-only code identifiers such as
  setDefaultModelAndProvider and configuration assignments such as
  DEFAULT_THINKING_TOKEN_BUDGET=32768. The entropy heuristic now requires a
  digit; named credential patterns still redact alphabetic secrets. Long hex
  values and fingerprint fragments retain the existing conservative policy.
  This prevents future over-redaction; it does not restore previously redacted
  notes. Reported by @sergiuszm (#168).

v0.26.1

Fixed

• Hermes: memory tool calls no longer kill sessions on strict providers
  (#163). handle_tool_call returned raw dicts,
  but the MemoryProvider ABC is declared -> str ("Must return a JSON string") and Hermes'
  MemoryManager passes the provider's return value straight through without coercion.

  The dict became the tool message's content and was persisted with the core's \x00json:
  marker, so when the request was rebuilt, strict OpenAI-compatible providers (DeepSeek
  confirmed) rejected the entire body with content should be a string or a list. The failure
  is non-retryable and poisons the saved history, so later sessions replaying it died too.
  Anthropic's converter tolerates dict content, which is why this stayed latent for most users.

  All tool results — including both error paths — are now serialized, and the method carries the
  -> str annotation so the contract is locally visible.

Upgrading fixes new sessions. Conversations already poisoned need the \x00json: marker
stripped from the affected state.db rows before they become replayable again.

Reported, root-caused, and verified by @thevibestack.

v0.26.0

Added

• vault_group_writable — opt-in group access for shared-GID setups
  (#159). New vault notes and directories are
  created 0600/0700, which breaks setups where a second container shares the group but not
  the UID — e.g. an Obsidian LiveSync sidecar on a NAS cannot even list the notes, so sync
  silently replicates nothing. Setting vault_group_writable = true (or
  CAIRN_VAULT_GROUP_WRITABLE=1) creates new vault notes/dirs 0660/0770 instead.

  Opt-in rather than a new default: on macOS every local user's primary group is staff, and
  shared groups like users are common on NAS hosts, so a group-readable default would expose
  the vault to other accounts on those systems without anyone granting it. The knob is scoped to
  the vault — the DuckDB index, dedup/judge/usage ledgers, lock files, host configs, and
  ~/.agentcairn/config.toml (which can hold API keys) stay owner-only regardless. Existing
  files keep whatever mode they already have.

  Reported with a precise root-cause analysis by @stegmajo.

Fixed

• cairn config aligned its key column to a hardcoded width, so the longer
  vault_group_writable name pushed that row's = and [source] out of line. The width now
  derives from the knob list.

v0.25.3

Fixed

• Capture no longer dies silently when the OS purges the model cache. fastembed
  defaults its ONNX cache to tempfile.gettempdir(); on macOS that directory is purged
  on a timer. The purge removes the small config/tokenizer blobs first and leaves the
  snapshot's symlinks dangling, so every model load then fails with
  Could not find config.json.

  The damage was invisible in two separate ways: cairn sweep crashed outright — and
  the plugin's capture hook sent its output to /dev/null, so sessions could go
  uncaptured for weeks with no error anywhere — while recall appeared to keep working
  because it silently fell back to BM25-only, quietly losing semantic retrieval.

  agentcairn now pins the cache to a persistent directory it owns
  (~/.cache/agentcairn/models, beside the index) for both the embedder and the
  cross-encoder reranker. An explicit FASTEMBED_CACHE_PATH still wins.

Changed

• cairn doctor now verifies the embedder actually loads and fails with a PROBLEM
  when it does not. A healthy index never implied a healthy model: the index is a static
  file, the model is a cache that can rot long after it was built. Doctor previously
  reported status: OK while capture was dead and recall was degraded.
• The capture hook keeps its output in ~/.cache/agentcairn/logs/capture.log
  (truncated per run) instead of discarding it, so a failing sweep leaves a trace.
  Claude Code plugin 0.4.2, Codex plugin 0.1.4.

If capture has been quiet for you, upgrade and run cairn doctor — it will now tell
you the truth. A single cairn sweep re-distills any sessions whose transcripts are
still on disk, so a backlog is usually recoverable rather than lost.

v0.25.2

Fixed

• The MCP server no longer fails to start on a fresh install (#152).
  mcp was pinned as >=1.26.0 with no upper bound, so once the SDK published 2.0.0 — which removed
  mcp.server.fastmcp (renamed to mcp.server.mcpserver) — uvx/uv resolved the new major and
  cairn.mcp.server died on import with ModuleNotFoundError: No module named 'mcp.server.fastmcp'.

  This broke every fresh uvx agentcairn run and both the Claude Code and Codex plugins, while
  existing installs with a warm uv cache kept working — which is why it went unnoticed. CI could not
  catch it either, because it runs uv run --locked against a lockfile pinning mcp 1.28.1; the locked
  resolution is not what users get.

  The dependency is now bounded to >=1.26.0,<2.0.0. Migrating to the 2.x API (and widening the
  bound) is tracked separately.

If you hit this, just upgrade — no workaround needed anymore. The previously required
uvx --with 'mcp<2.0.0' agentcairn is no longer necessary.

Thanks to @fernandomartineztax-pixel for a precise report with a confirmed workaround.

v0.25.1

Stock Hermes compatibility

AgentCairn 0.25.1 restores the native Hermes MemoryProvider path on a standard managed Hermes installation.

• Supports Python 3.11+, including Hermes's managed Python 3.11 environment.
• Supports Hermes 0.18.2's pinned mcp==1.26.0 dependency.
• Requires no replacement interpreter, second environment, or reduced-functionality MCP workaround.
• Adds a built-wheel contract test against stock hermes-agent[all]==0.18.2 to required CI and the PyPI release gate.

Agent-assisted setup

• Adds the public agentcairn-setup skill for guided, harness-aware installation through skills.sh.
• Keeps runtime installation owned by AgentCairn's native CLI and plugins.
• Makes the plugin-delivered memory skill fail closed when its MCP tools are unavailable and direct users to setup.
• Advances the native plugin manifests to Claude Code 0.4.1, Codex 0.1.3, and Antigravity 0.1.2.

Other fixes

• Corrects the Hermes index-rebuild example to use the vault as the positional cairn reindex argument.

Verification

• 766 tests passed on Python 3.11; 6 skipped.
• 766 tests passed on Python 3.12; 6 skipped.
• Isolated built-wheel Hermes/MCP contract: 73 passed with uv pip check clean.
• Main CI, end-to-end, website/Playwright, benchmark, security, and release workflows passed.
• Wheel and source distribution published through PyPI Trusted Publishing with attestations.

PyPI: https://pypi.org/project/agentcairn/0.25.1/

Full changelog: v0.25.0...v0.25.1

Hermes compatibility PR: #141
Setup skill PR: #140

v0.25.0

Claude Code memory, now portable

AgentCairn 0.25.0 adds a safe, one-way bridge from Claude Code's project auto-memory into the shared AgentCairn vault.

Added

• cairn import claude-memory previews the current repository without writing.
• cairn import claude-memory --apply imports and indexes MEMORY.md and topic Markdown files.
• Imported notes are sanitized, redacted, provenance-rich, and explicitly treated as model-generated historical context—not authoritative instructions.
• Source updates create inspectable superseding versions; deleted sources expire, and interrupted imports repair themselves on retry.
• Discovery supports Claude's current and legacy project encodings, CLAUDE_CONFIG_DIR, user-configured memory directories, and explicit --source.
• CLAUDE.md and .claude/rules/ are deliberately excluded.

Try it

cairn import claude-memory
cairn import claude-memory --apply

Verification

• 761 tests passed; 5 skipped
• Main-only FastEmbed + MCP stdio end-to-end test passed
• Ruff, benchmarks, Trivy, and Bugbot passed
• Wheel and source distribution published through PyPI Trusted Publishing with attestations
• Fresh isolated PyPI install reports 0.25.0

Full changelog: v0.24.2...v0.25.0

Feature PR: #133
Release PR: #134

v0.24.2

Codex hook hotfix

agentcairn 0.24.2 fixes Codex SessionStart and SessionEnd hooks failing with exit code 127.

Fixed

• Codex hook handlers now use the documented single command string.
• The previous separate args array was ignored by Codex, which ran bare sh and interpreted hook JSON from stdin as shell input.
• The bundled Codex plugin is bumped to 0.1.2.

Upgrade existing Codex installs

codex plugin marketplace upgrade agentcairn
codex plugin add agentcairn@agentcairn

Start a fresh Codex session after upgrading. Codex may request renewed trust because the hook command hash changed.

Verification

• 744 tests passed; 5 skipped
• Installed SessionStart and SessionEnd cache probes exit 0
• Live AgentCairn doctor returned OK
• PyPI Trusted Publishing completed with attestations

Full changelog: v0.24.1...v0.24.2

Hotfix PR: #130

v0.24.1

Dogfood hotfix

agentcairn 0.24.1 fixes three issues uncovered while running 0.24.0 against a
real local vault and Codex installation.

Fixed

• cairn config now reports the actual vault-derived index default instead of
  the obsolete global index.duckdb path.
• cairn index-status opens DuckDB read-only and always closes its connection,
  avoiding unnecessary writer locks and permission failures.
• The test suite now isolates vault-derived caches and stubs the plugin-hook CLI
  boundary. Local test runs no longer leak temporary DuckDB indexes into the
  developer's real cache or depend on a globally installed cairn and DuckDB
  extension cache.

The leak was confirmed in dogfooding: repeated test runs had accumulated 961
indexes consuming 3.3 GB. The complete suite now creates zero real-cache indexes.

Verification

• 744 tests passed; 5 skipped
• Real stdio MCP startup reconciliation and write-through remember passed
• Live vault doctor returned OK
• Public release artifacts built and published with attestations

Full changelog: v0.24.0...v0.24.1

Hotfix PR: #129

v0.24.0

Trust boundary and consistency hardening

agentcairn 0.24.0 makes memory safer to recall, write, index, and share across
agent integrations.

Highlights

• Adds per-vault, cross-process writer coordination for CLI, MCP, and Hermes
  mutations, plus restrictive file modes and atomic replacements.
• Makes index reconciliation transactional and first-read aware, with explicit
  freshness diagnostics and visible BM25 fallback when vector retrieval cannot be
  trusted.
• Makes MCP remember write-through so a successful save is immediately recallable.
• Defaults automatic recall to project scope and renders recalled content as quoted,
  untrusted evidence in Claude Code, OpenCode, and Hermes.
• Redacts secrets before cloud/LLM egress and before model-generated filenames or
  Markdown are written; rejects vault symlinks that escape the vault.
• Fixes ranking with negative reranker logits and preserves fused ordering when the
  reranker fails.
• Stops Codex and Antigravity plugins from pinning ~/agentcairn; cloud embedding
  credentials and endpoints can now be supplied through the config file.

Version notes

• Python package: 0.24.0
• Codex plugin: 0.1.1
• Antigravity plugin: 0.1.1
• Hermes plugin: 0.1.1
• Claude Code plugin remains 0.4.0

Automatic recall is now project-scoped by default. Set
auto_recall_scope = "all" explicitly if you want cross-project automatic recall.

Full changelog: v0.23.0...v0.24.0

Release PR: #128