marketplace.json was missing required top-level name and owner fields,
and plugins[].source was incorrectly named path. Fixes plugin install
validation error in Claude Code.
- Add two-paragraph technical pitch above the fold with 3-line quick start
- Update tool count 37→38 (memory_verify), function count 50→52, test count 573
- Add memory_verify to MCP tools table, mem::verify and mem::cascade-update to functions table
- Add citation provenance and cascading staleness to capabilities table
- Add cross-agent sync and memory trust to comparison table
- Update API endpoint count 93→95, version 0.6.0→0.6.1
* feat: v0.6.1 — citations, cascading updates, expanded mesh (#53#56#59)
Add JIT verification with citation chains, self-organizing memory via
cascading staleness propagation, and expand mesh sync to 7 scopes
(semantic, procedural, relations, graph nodes/edges).
- mem::verify traces memory/observation provenance back to source
- mem::cascade-update flags stale graph items and sibling memories
- Mesh default scopes expanded from 2 to 7 with project-based filtering
- Memory.sourceObservationIds, CompressedObservation.confidence fields
- GraphNode.stale, GraphEdge.stale for staleness tracking
- MeshPeer.syncFilter for project-scoped action sync
- 573 tests passing across 49 files
* fix: address code review — stale filtering, LWW clock, validation, scoping
- Filter stale nodes/edges in graph-retrieval.ts and graph.ts traversals
- Use updatedAt (not createdAt) as LWW clock for graph node mesh sync
- Set updatedAt in cascade.ts when flagging nodes as stale
- Skip non-project scopes (semantic, procedural, relations, graph) when
syncFilter.project is set to prevent leaking unscoped data
- Validate sourceObservationIds as array of strings in remember.ts
- Deduplicate observation IDs in consolidate.ts sourceObservationIds
- mesh-export endpoint uses updatedAt for graph nodes, accepts project param
- Extract shared test helpers into test/helpers/mocks.ts
- Assert memory_verify tool name in mcp-standalone.test.ts
Performance:
- auto-forget.ts (#29): concept-bucketed contradiction detection with
pre-tokenized cache, O(n * avg_bucket) instead of O(n^2)
- consolidate.ts (#28): cap LLM calls at 10, process largest concept
groups first
- vector-index.ts (#30): bounded min-heap search replaces full sort,
early skip for low-scoring entries
Scheduling (#36):
- index.ts: setInterval auto-forget (1h default) and consolidation
(2h, opt-in via CONSOLIDATION_ENABLED=true)
- Configurable via AUTO_FORGET_INTERVAL_MS, CONSOLIDATION_INTERVAL_MS
- Timers use .unref() to not prevent process exit
Memory TTL (#63):
- remember.ts: optional ttlDays parameter auto-sets forgetAfter
Plugin (#75):
- plugin.json: version 0.2.0 -> 0.6.0
Closes#28#29#30#36#63#75
- Add Real-Time Viewer section with feature list
- Update stats: 87 source files, ~11,300 LOC, 232KB bundled
- Add viewer port info to Quick Start and Configuration
- Add Viewer link to nav bar
- Viewer auth: use timing-safe HMAC comparison instead of string equality
- Viewer HTML: add Content-Security-Policy header
- Viewer POST/DELETE: validate Content-Type is application/json (415 on mismatch)
- Evolve: supersede old memory before saving new to prevent dual-latest on partial failure
- Timing-safe HMAC auth in api.ts, mcp/server.ts (eliminates length leak)
- Keyed mutexes for race conditions in observe, remember, relations
- Write ordering: supersede before save to prevent dual-latest
- Single VERSION constant replacing 11 hardcoded strings
- Input validation: governance filter guard, team itemType, maxObs, commitHash regex
- Future-proof import version validation with VERSION in supported set
- Circuit breaker configurable thresholds with positiveFinite validation
- Health monitor interval.unref(), telemetry dead exports removed
- 3 new secret patterns (npm_, glpat-, dop_v1_), shared CSP constant
* feat: viewer UI redesign with real-time streaming and newsprint design
Redesigned the agentmemory viewer with a newsprint-inspired design system
and added real-time live updates via iii-engine StreamModule.
Viewer UI:
- Newsprint design with Playfair Display / Lora / Inter typography
- Dashboard with semantic memory, procedural memory, consolidation status
- Knowledge graph with curved edges, node shapes, legend, search, tooltips
- Visual vertical timeline with alternating cards and type filter chips
- Activity tab with GitHub-style heatmap, type breakdown, activity feed
- Profile, Sessions, Audit, Memories tabs
Real-time streaming:
- Fixed stream event propagation (engine uses exact group_id matching)
- Added viewer broadcast group for cross-session live updates
- Switched from blocking trigger to fire-and-forget triggerVoid
- Viewer subscribes to 'viewer' group, handles create/update events
New files:
- iii-config.yaml: engine config with StreamModule, PubSub, Otel
- src/viewer/server.ts: standalone viewer HTTP server on port 3113
API additions:
- GET /agentmemory/memories endpoint with ?latest=true filter
- Viewer file resolution with multiple candidate paths
* fix: address review findings — CORS, 404 status, validation, cleanup
- Restrict CORS allowed_origins to local dev origins instead of wildcard
- Return 404 instead of 200 when viewer HTML file is not found
- Add /agentmemory/viewer path to standalone viewer server routing
- Validate sessionId in session/end handler before KV operations
- Clear stale graph nodes/edges before writing rebuilt data
- Capture viewer server and close gracefully on shutdown
* fix: dynamic CORS origin validation and memNode property accumulation
Replace static CORS wildcard with dynamic corsHeaders(req) that validates
the request Origin against an allowlist. Pass req to all json() call sites.
Change memNode.properties from scalar memoryId/memoryType to array-based
memoryIds/memoryTypes to prevent overwrite when multiple memories map to
the same graph node.
- Fix main/bin/start to use .mjs extension (tsdown outputs ESM)
- Remove duplicate shebang banner from standalone build config
- Update integration test: health status "healthy" (v0.4.0), viewer HTML check
- Add POST body to pre-compact hook for claude-bridge sync
* feat: agentmemory v0.4.0 — the memory layer for all AI coding agents
7 new features: Claude Code memory bridge, standalone cross-agent MCP server,
knowledge graph with entity extraction, 4-tier memory consolidation pipeline,
team/shared memory, memory governance with audit trail, git-versioned snapshots.
33 functions, 18 MCP tools, 6 MCP resources, 3 MCP prompts, 49 REST endpoints,
21 KV scopes, 216 tests. All features opt-in via env vars.
* fix: address 28 CodeRabbit findings across v0.4.0 codebase
Critical: Fix bin path mismatch (dist/mcp-standalone.mjs -> dist/standalone.mjs)
Bugs: Fix procedural decay, parseFloat||0.5 for zero values, snapshot restore
missing graphNodes/observations, git catch too broad, N+1 graph query, BFS
duplicate edges, array mutation in audit sort, date validation
Improvements: Lazy readline in transport, JSON-RPC validation, persist error
handling, ID collision prevention, defensive null coalescing for concepts/files,
Windows backslash support in config, direction required for bridge sync tool,
try-catch for audit/governance MCP, team profile fallback teamId, POST body for
bridge sync hook, observations validation for graph-extract endpoint, await in test
* feat: agentmemory v0.4.0 — MCP resources, prompts, enrichment, confidence
Add 4 MCP resources (status, project profile, recent sessions, latest memories),
3 MCP prompts (recall_context, session_handoff, detect_patterns), confidence-scored
memory relations, and a unified enrich endpoint that aggregates file context,
relevant observations, and past bug memories for PreToolUse hook injection.
- Add confidence field to MemoryRelation with auto-scoring from co-occurrence,
recency, and relation type
- Add mem::enrich function aggregating 3 sources with resilient .catch() fallbacks
- Add POST /agentmemory/enrich REST endpoint
- Switch PreToolUse hook from file-context to enrich endpoint with search term extraction
- Add minConfidence filter and confidence-desc sorting to mem::get-related
- 27 new tests (171 total), all passing
* fix: address review findings — input validation, XML escaping, confidence scoring
- enrich.ts: Sort bug memories by recency before slicing top 3; add escapeXml()
for narratives and bug content injected into XML tags
- relations.ts: Use filter+max instead of find() for matchingRelation to pick
highest confidence when multiple edges exist; normalize minConfidence with
Number.isFinite + clamp to [0,1]
- mcp/server.ts: Guard decodeURIComponent with try/catch returning 400 on
malformed percent-encoding; use typeof checks for prompt args instead of
truthy checks; normalize minConfidence/maxHops at MCP layer
- api.ts: Validate files[] and terms[] element types are strings before
calling mem::enrich
- Tests: Add malformed URI and non-string prompt arg test cases (173 total)
* docs: rewrite README for v0.3.0
- Add "Why agentmemory" section explaining what it provides and comparison table
- Add "Supported Agents" section with native hooks, MCP, and REST API paths
- Add integration decision matrix for choosing the right approach
- Document hybrid search, embedding providers, and progressive disclosure
- Document memory evolution, versioning, relationships, and auto-forget
- Document project profiles, timeline, export/import
- Update all stats (21 functions, 10 MCP tools, 28 endpoints, 144 tests)
- Update data model with new KV scopes (relations, profiles, embeddings, bm25)
- Update config section with embedding, fallback, and search weight env vars
* docs: add banner image to README
* docs: fix banner crop and size
Remove cream strip at bottom, cap width to 720px in README
* docs: include REST API in supported agents intro
Consistent wording in both the intro line and REST section
- remember: persist new memory before demoting old (write ordering)
- remember: capture superseded version during scan (no re-search)
- api: validate query/expandIds on smart-search endpoint (return 400)
- index: rebuild when vector index is empty (not just BM25)
- index: log persistence save failures on shutdown
- config: clamp embedding weights to [0, 1]
- config: validate fallback provider names against known set
- hybrid-search: parallelize KV fetches with Promise.all
- Extract shared circuit breaker call() helper in ResilientProvider
- Use COUNTER_NAMES/HISTOGRAM_NAMES arrays with shared noop objects in telemetry
- Add MS_PER_DAY constant to replace repeated 24*60*60*1000 in eviction
- metrics-store: track quality score calls separately to avoid diluted averages
- metrics-store: getAll() merges KV + cache for complete data
- summarize: reject and don't persist summaries that fail validation
- dedup: unref cleanup timer so it doesn't block process shutdown
- health/monitor: move connectionState into closure (no module-level mutation)
- health/monitor: compute real CPU percent via delta sampling
- health/thresholds: use heapUsed/heapTotal instead of rss/heapTotal
- providers/index: throw clear error on missing API keys instead of non-null assert
- remember: handle empty observationIds array explicitly in forget flow
- triggers/api: normalize dryRun to strict boolean
New hooks (7):
- PreToolUse: inject file history before edits (Edit/Write/Read/Glob/Grep)
- PostToolUseFailure: capture error patterns for learning
- PreCompact: preserve memory context through compaction
- SubagentStart/SubagentStop: track multi-agent workflows
- Notification: capture permission prompts (tool preferences)
- TaskCompleted: track team task completions
New functions (4):
- mem::file-context: file-centric memory index for PreToolUse
- mem::consolidate: merge observations into long-term memories via LLM
- mem::patterns + mem::generate-rules: detect co-change patterns and recurring errors
- mem::remember + mem::forget: explicit save/delete for long-term memory
MCP server (2 endpoints):
- GET /agentmemory/mcp/tools: list 5 MCP tools (recall, save, file_history, patterns, sessions)
- POST /agentmemory/mcp/call: dispatch tool calls to iii functions
Skills (4):
- /recall [query]: search past observations
- /remember [insight]: save to long-term memory
- /session-history: show past session timeline
- /forget [target]: delete specific memory data
New API endpoints (7):
- POST /agentmemory/file-context
- POST /agentmemory/remember
- POST /agentmemory/forget
- POST /agentmemory/consolidate
- POST /agentmemory/patterns
- POST /agentmemory/generate-rules
- GET/POST /agentmemory/mcp/*
Updated: types (7 new HookTypes, 3 new ObservationTypes), version 0.2.0
1. events.ts: Event triggers were calling api:: functions which
require ApiRequest shape and auth headers. Rewrote to call
core functions (kv.set, sdk.trigger) directly, bypassing auth.
2. All 5 hooks: Missing AGENTMEMORY_SECRET auth header. If secret
was set, every hook would get 401 from the API. Now all hooks
read AGENTMEMORY_SECRET and send Bearer token.
3. observe.ts: stripPrivateData on JSON string could break JSON
structure when replacement text differs in length. Added
try/catch fallback to string coercion.
4. post-tool-use.ts: truncate() for objects did
JSON.parse(str.slice(0, max-1) + '}') which produces invalid
JSON in nearly all cases. Changed to return truncated string.
5. compress.ts: LLM-returned importance was not clamped to 1-10
range. Added Math.max(1, Math.min(10, ...)) with NaN fallback.
6. compress.ts: LLM-returned observation type was not validated
against ObservationType union. Invalid types now fall back to
"other".
7. context.ts: Token estimate for observation blocks only counted
inner content, not the "## Session..." header. Fixed to estimate
the full block text.
8. viewer: WebSocket port now configurable via ?wsPort= query param
for non-default III_STREAMS_PORT configurations.
9. plugin/scripts: Rebuilt with auth header support matching the
updated hook source files.
- Add integration test suite covering all 11 API endpoints
- Rewrite README for clarity and user-friendliness
- Extract VIEWER_CSP constant, remove dead IndexEntry.terms field
- Consolidate SIGINT/SIGTERM handlers
- XML tag validation: reject invalid tag names before regex construction
- API auth: optional bearer token (AGENTMEMORY_SECRET) on POST endpoints
- Conservative token estimation: length/3 for code-heavy content
- XML-escape project name in context output
- Prefix-only search matching (startsWith vs includes)
- Dynamic viewer URLs from window.location
- CSP header on viewer endpoint
- Importance class sanitization in viewer
- 45 tests: privacy, XML parsing, search index, schema
Rohit Ghumare