v0.3.1: PyPI project_urls metadata

What's new

• Added project_urls to pyproject.toml (Homepage, Documentation, Repository, Issues, Changelog) — PyPI's project page was showing no sidebar links at all, since this metadata was empty.
• Also added Cloudflare Web Analytics to the website (no code change here, website repo).

No functional/runtime changes to the package itself.

Full Changelog: v0.3.0...v0.3.1

v0.3.0: uvx install, SKILL.md, session import

Three real gaps closed, not just planned

uvx: nothing to pre-install. Every client's config example now shows
uvx --from 'spomory[llm,embedding,mcp]' spomory-mcp as the recommended
way to run Spomory -- no pip install, no virtual environment to build
by hand, and it sidesteps the macOS ~/Documents TCC gotcha for free
(uv's cache was never under there). The manual venv install is still
documented as an alternative for anyone who wants a pinned version.

skill/spomory/SKILL.md: the tools are reactive, this makes them get
used. The six memory tools don't call themselves -- an agent has to
decide to. This skill teaches "recall first, store last": search memory
before assuming you don't know something, save durable facts as they
come up without being asked, and (for a genuinely empty account) run a
short onboarding flow instead of starting cold. Copy the spomory folder
into your client's skills directory (.claude/skills/, .cursor/skills/,
etc.) -- open SKILL.md format, works anywhere that supports it.

spomory-import-sessions: fix the empty-on-day-one problem. A new
console script that reads Claude Code's, Codex's, or Cursor's own local
session history and runs it through the exact same extraction pipeline
add_memory uses, so a fresh account starts with real memories instead
of nothing:

spomory-import-sessions --client claude-code   # or codex / cursor

Parsers were written against real session file formats read from a real
machine, not guessed from a spec. This command has real side effects --
it reads your actual local conversation content and sends it to whichever
LLM you've configured -- so it's documented, not silently automatic.

Also in this release

• The REST API (/v1/memories, /v1/graph, /v1/export) shipped
  earlier now has properly declared OpenAPI securitySchemes, so tools
  that auto-import the spec (n8n, Zapier, ChatGPT Actions) correctly
  prompt for a credential instead of silently 401ing.
• A real pre-existing bug fixed: export_memory 500'd on any relation
  whose provenance had session_id=None (the common case) -- the export
  schema's provenance field was still typed for a version before
  client_name/session_id existed.

v0.2.1

Fixed

Refines the cross-client conflict detection added in v0.2.0. client_name identifies the client application (e.g. claude-ai), not a specific window or connection of it — two Claude Desktop windows on the same machine report an identical client_name, so the v0.2.0 check (conflict only when client_name differs) waved that case through as a same-session correction. A reviewer caught this directly.

Provenance now also carries session_id: the MCP connection's server-assigned session id, populated on remote/streamable-http deployments (via the transport's Mcp-Session-Id), None on local stdio (one process is one connection, nothing finer to distinguish). Read from the connection object the server itself assigned, not from a request header — headers are client-supplied and must never be treated as an identity assertion.

_is_cross_client_conflict() now treats two relations as conflicting when either the declared client differs, or the declared client matches but the session id differs (confirmed two different connections of the same app). A missing signal on either side stays conservative and falls through to the existing update-in-place behavior.

Non-breaking — this only changes behavior for the specific case it fixes (same app, two windows/sessions); everything else is unchanged.

Full diff: v0.2.0...v0.2.1

v0.2.0

Breaking

• forget_all_memory now requires confirm=true to actually delete anything. A bare call reports the entity/relation counts a real call would remove and deletes nothing. destructive_hint=true on this tool is only an advisory hint the MCP spec doesn't require a host to enforce, so a host that treats it as cosmetic (or an agent auto-approving destructive tools) could previously wipe a whole memory graph on the first call with zero human confirmation. This closes that gap at the protocol level instead of relying solely on the host.

Added

• Provenance.client_name, captured automatically from the calling MCP client's initialize handshake (not a tool argument). When two clients write contradicting facts (same subject+predicate, different object) and both declare a different client, the write no longer silently overwrites the older fact — both are kept and add_memory's response says so, since nothing in a memory graph makes the newer write the correct one. Same-client corrections and unrecognized clients keep the existing update-in-place behavior.

Both changes came directly from real technical review on a public post about this project, not internal speculation.

Full diff: v0.1.3...v0.2.0

v0.1.3

Added

• Pluggable embedding provider for fully-local deployments: EMBEDDING_PROVIDER=openai_compatible routes embedding through any OpenAI-compatible /v1/embeddings server — vLLM, Ollama, llama.cpp, or MLX — instead of the local sentence-transformers model. Verified for real against a local Ollama server; drops the sentence-transformers/torch dependency entirely when selected.
• Dockerfile for MCP directories/hosts (e.g. Glama) that deploy from a container image.
• Published to PyPI as spomory; local-install entry added to the official MCP Registry alongside the existing remote entries.

Fixed

• The embedding model was loading synchronously at server startup, blocking the process from responding to anything (including a health-check ping) for several seconds — confirmed against a real Glama container-deploy failure. Now loads lazily on first use.

Changed

• README restructured around a plain-language quickstart instead of leading with a full dev-environment setup.

Full diff: v0.1.2...v0.1.3

v0.1.2

Matches the version published to PyPI (pip install spomory).