v0.4.2 — security release: departments administered by their own users, private agents, approved skills, server-side redaction

Before you upgrade

This release tightens access. Check these before you upgrade; each one links to its section in UPGRADE → To 0.4.2.

If …	Then …
A Panel, script or client sends a department id that never ran init-admin	Run init-admin for it after upgrading (departments)
Scripts or monitoring call meta/*, pipeline/*, stats/overview, … with only the server API key	They now get 401: give them a system admin's user key, or use the internal/… routes (server API key)
The Panel runs outside Compose, or an override sets CORE_API_KEY for it	Remove CORE_API_KEY; the Panel no longer uses it
The server API key was handed to department admins	Change it after the upgrade: it is a root credential across departments
The distillation CLI goes through a cloud provider (Bedrock, Vertex AI, Azure) or a wrapper script	List the variables it needs in AGENT_MEMORY_LLM_CLI_PASS_ENV (CLI)
You rely on extracted skills appearing by themselves	Approve them on Panel → Skills, or set AGENT_MEMORY_SKILL_REQUIRE_APPROVAL=false (skills)
Each person has their own agent, but the agents are team-visible	Set each to "visibility": "private"

Warning

Going back to 0.4.1 after this upgrade means restoring the backup. memory-core runs schema migrations 4 (an index of the atoms without an embedding) and 5 (department redaction rules) at startup, and 0.4.1 refuses data at a newer schema version. upgrade.sh takes the backup; UPGRADE → Roll back restores it.

git fetch --tags && git checkout v0.4.2
./upgrade.sh

Then update amem on each client (REMOTE-CLIENTS §4).

Security

Advisories: GHSA-g73h-mwv4-hq6c, GHSA-w9gw-jgqg-wf4m, GHSA-c99j-f426-8w84, GHSA-v283-7qch-6992, GHSA-2jjp-45cp-qxfq, GHSA-2w2h-pg86-437m.

• Each department is administered by its own users. meta/*, pipeline/*, stats/overview and generation logs take a user key of the department and apply that user's role; prompts, knowledge and chat-memory clearing take a system admin's. The server API key opens only the operator routes (internal/*, department/destroy). The Panel no longer holds it (#68).
• A private agent is its owner's. Its memory, scenes, persona and skills are usable by its owner, the team's admins and system admins only; an archived agent is refused (#61).
• Recall output quotes what is stored, so stored text cannot open or close the blocks integrations inject; new scene paths are plain (#62, #63).
• Departments are created only by init-admin, and storage opens nothing else; a destroyed department stays gone, also for background work and across replicas (#64, #65).
• The distillation CLI gets an allowlisted environment: the basics, its own settings, and what llm.cli.passEnv names, never AGENT_MEMORY_* (#66).
• Skill extraction proposes; people approve. The model gets the conversation as JSON data, may change only the skills it was shown, and its changes wait on the Panel's Skills page for the conversation's user, a team admin or a system admin (#69).
• Secrets are redacted on the server on every write path, in English, the major languages of Asia and more, and by shape (#58).

What's new

• Department redaction rules (#60, #57): system admins add their own patterns in the Panel (Metadata → Redaction), with a preview, on top of the built-in and deployment rules.
• Missing embeddings are filled in later (#59): memory-core retries atoms stored without an embedding, and memory-server reembed does it on demand. Embedding concurrency and timeouts can be set by environment.
• /v3/session/add stores raw turns again, per team, agent, user and session (#67).

Fixes

• A CLI that closes its input early is judged by its output, not by the broken pipe (#69).
• Several flaky tests; CI now runs the Postgres suites on PostgreSQL 17.

Full list: CHANGELOG → 0.4.2.