v0.2.1 — Fix Linux/Windows install

Fixed

• npm install failed on Linux and Windows because sqlite-vec-darwin-arm64 was incorrectly declared as a regular dependencies entry in package.json. npm treated it as a hard, cross-platform requirement and bailed with EBADPLATFORM on non-macOS-arm64 hosts (including the GitHub Actions Ubuntu runner). The sqlite-vec package already declares all platform binaries as optionalDependencies and resolves the right one per host, so the explicit hard dep was both redundant and wrong. Removed; lockfile regenerated.

Users on 0.2.0 should upgrade to 0.2.1 if installing on Linux, Windows, or macOS x64. macOS arm64 installs were unaffected.

v0.2.0 — HTTP daemon + working hooks

Added

• HTTP daemon transport. New src/daemon.ts runs Smara as a long-lived background process on 127.0.0.1:3100 via Hono + @hono/node-server. Endpoints: POST /tools/call (invoke any smara.* tool without an MCP handshake), GET /health (liveness + version), GET /tools (list available tools). The stdio transport for Claude Desktop and other MCP clients is unchanged and still works alongside the daemon.
• Daemon lifecycle CLI (smara-daemon) with start | stop | status | restart. PID file at ~/.smara/daemon.pid, logs at ~/.smara/daemon.log.
• Working session-start hook (hooks/session-start.sh). When a project directory is opened, calls the HTTP daemon to fetch top memories and prints them as session context — the hook layer that 0.1.x documented as non-functional is now operational.
• MEMORY_TRANSPORT=http and MEMORY_PORT env vars (and server.transport = "http" in config.toml) to select the daemon transport.
• Five-method retrieval ablation in eval/run-benchmark.ts: FTS-only, vector-only, RRF (no decay), RRF + uniform decay, RRF + per-category decay. Generates eval/results/paper-table.json for direct citation in the paper.

Changed

• Hook adapters now talk to the HTTP daemon. hooks/core/memory-client.sh rewritten as a thin curl client against 127.0.0.1:3100. Auto-starts the daemon if /health is unreachable. The previous shell-based MCP-stdio approach silently no-op'd; this replaces it.
• hooks/README.md rewritten end-to-end to document daemon-based usage, install/uninstall flow, and per-tool wiring.
• README updated with the daemon quick-start, troubleshooting, and an honest description of what the hook layer does today.

Fixed

• FTS5 query sanitization (src/providers/sqlite/document-store.ts). Queries containing punctuation (:, ?, -) or FTS5 keywords (AND, OR, NOT, NEAR) no longer throw fts5: syntax error. User input is normalized before being passed to MATCH. Tracked as a known limitation in 0.1.5; closed.
• SQL injection defense in queryMemories. sortBy and sortOrder are now strict whitelists; invalid values are rejected instead of being interpolated into ORDER BY.
• Vector DB schema isolation (src/db/connection.ts). createConnection({ skipSchema: true }) lets SqliteVecStore open memory-vectors.db without running the full document schema, so the vectors file no longer carries unused tables.

Documentation

• arXiv paper updated to v0.2.0: §7.4 ("Tool-Lifecycle Hooks via the HTTP Daemon") describes the dual-transport architecture; §11 (Limitations) reframes the remaining gaps honestly (synthetic eval corpus, no head-to-head comparison against external systems); a new "Availability and Reproducibility" block pins the seed (0x5ada7a) and reference timestamp (2026-04-21T00:00:00Z).

Known limitations

• The 5-method ablation runs on a synthetic corpus generated by eval/generate-dataset.ts. No head-to-head comparison against external memory systems (e.g., Mem0, MemGPT, Letta) yet.
• Per-client adapter coverage (Cursor, Windsurf, Aider) is incremental — see hooks/README.md for current wiring status.

v0.1.5

0.1.5 — First installable release after audit

0.1.4 shipped with a broken install. 0.1.5 fixes it and is the
recommended version for anyone starting with Smara.

The bug in 0.1.4

package.json had a "files" whitelist that omitted scripts/, so the
published tarball did not include scripts/postinstall.mjs. When npm
ran the postinstall hook on the installed package it hit
MODULE_NOT_FOUND and aborted with exit 1 — every new user was blocked
before they could use the package.

Caught by a post-publish smoke test: installing the tarball into a
clean tempdir and actually running it, not just running local tests.
CI couldn't catch this because CI works from the source tree, not the
published tarball.

0.1.4 has been deprecated on npm with a pointer to upgrade.

Fixes in 0.1.5

• scripts/ is now in the files whitelist. npm pack --dry-run
  confirms scripts/postinstall.mjs is in the tarball (49 files, up
  from 48).
• scripts/postinstall.mjs is now wrapped in a top-level try/catch.
  Any unexpected error is logged and ignored — npm install can never
  be blocked by a bug in our postinstall logic again.

What 0.1.5 brings forward from 0.1.4

0.1.4 was the audit-driven pre-launch sweep. Its fixes are carried
forward:

• smara.update no longer crashes. A SQL parameter-count mismatch
  in SQLiteDocumentStore.updateMemory had 12 placeholders but only 11
  values bound. All 37 unit tests now pass.
• Missing native binaries no longer kill the server.
  LocalEmbeddingProvider failures fall back to a
  NullEmbeddingProvider stub; memories persist and remain searchable
  via FTS5. Cryptic startup errors are remapped to actionable hints on
  stderr (e.g., npm rebuild better-sqlite3, install platform binary
  for sqlite-vec).
• GitHub Actions CI. Ubuntu + macOS × Node 20 + 22 matrix on every
  push and PR.
• README rewritten to match reality. The "A Day with Smara"
  walkthrough now shows explicit MCP tool calls rather than the
  previous hooks-driven narrative. The hooks/ directory is clearly
  documented as not yet functional, with AUDIT.md in the repo
  describing the rewrite plan.
• AUDIT.md — the pre-launch audit that drove this work is
  committed. Worth reading if you're curious what broke and what's
  coming.

Known limitations

• hooks/ subsystem is non-functional pending rewrite (Phase 2 in AUDIT.md).
• FTS5 queries with punctuation or reserved keywords (:, AND, NOT)
  can throw — user input isn't escaped yet.

Install

npm install smara-mcp@0.1.5                                   
                                                                                                                                                    
Then wire it into your MCP client — see the Using with Your AI Client                                                                               
section of README.md for Claude Desktop, Claude Code,                                                                                               
and Gemini CLI.                                                                                                                                     
                                                                                                          
Verification                                                                                                                                        
                                                                                                          
This release was installed from npm into a clean tempdir and run        ...