Reverting the GH Packages publish from #545. GH Packages is a
separate registry from npmjs.com — anyone installing
`@rohitg00/agentmemory` from `npm.pkg.github.com` needs to point
their registry there and authenticate, which is friction users
don't have on the canonical `@agentmemory/agentmemory` install
from public npm.
The right-sidebar Packages widget on the repo page was the only
motivation for the mirror. Acceptable to leave it empty — the
single canonical install path is the better DX.
- Drop `publish-github-packages` job from `.github/workflows/publish.yml`
- Drop `packages: write` perm wording from the workflow comment block
- Remove "GitHub Packages mirror" badge from README
Manual follow-up (post-merge): delete the already-published
`@rohitg00/agentmemory@0.9.20` from GH Packages registry via
github.com/users/rohitg00/packages/npm/agentmemory/settings → Delete.
Sponsor button still missing from the repo page despite #545 merging.
The committed FUNDING.yml started with 4 lines of `#` comments before
the canonical `github: [rohitg00]` directive. GitHub's FUNDING parser
documents only the canonical key-value form; leading comments
shouldn't break it but some users have reported indexer lag when the
file starts with non-data lines. Strip to the bare single-line form
to match the documented schema and remove any ambiguity.
Sponsor profile is enabled (github.com/sponsors/rohitg00 returns 200
+ 'Sponsor @rohitg00' button), so the only remaining gap is GitHub's
side-bar indexing. Tightening the file forces a re-parse.
* feat(repo): add Sponsor button + GH Packages mirror for sidebar surface
Three additions that make the repo page surface clearer + give users
a single place to fund the project:
1. `.github/FUNDING.yml` — `github: [rohitg00]` renders the "Sponsor"
button at the top of the repo + the Sponsor widget in the right
sidebar. Requires GitHub Sponsors to be enabled at
github.com/sponsors/accounts on the rohitg00 profile before the
link resolves (currently 404s — enable before merging this PR).
2. `.github/workflows/publish.yml` — new `publish-github-packages`
job runs after the existing public-npm publish completes.
Republishes the main package as `@rohitg00/agentmemory` to
`npm.pkg.github.com`. The repo's right-sidebar "Packages" widget
only surfaces packages on GitHub Packages, not packages on the
public npm registry, so this is what makes the sidebar widget
non-empty. Public npm remains the canonical install source;
GH Packages is purely a discovery surface.
- Uses built-in GITHUB_TOKEN, no new secrets needed.
- Rewrites package.json `name` + `publishConfig` in-runner via a
small node one-liner, publishes, then restores the original so
main isn't permanently scope-changed.
- Skip-on-already-published guard mirrors the existing public
publish steps.
- Marked `|| echo "non-fatal"` so a GH Packages hiccup never blocks
the canonical npm release.
- `permissions: packages: write` added at workflow level.
3. README badge row — added `npm downloads`, `GitHub Packages mirror`,
and `Sponsor rohitg00 on GitHub Sponsors` badges alongside the
existing `npm version` / `CI` / `License` / `Stars` row. The
sponsor badge is the same link the FUNDING.yml sidebar widget
uses; surfacing it in-README means readers who don't notice the
sidebar still see it.
Out of scope (asked, declined):
- Docker Hub / ghcr.io publish workflow. Not in this PR.
* ci(publish): scope write perms per-job + persist-credentials false
Inline review on #545 flagged that the workflow-level permissions
block granted `id-token: write` + `packages: write` to every job,
including ones that don't need them. Tightened to least-privilege:
- Workflow-level: only `contents: read`.
- `publish` job: adds `id-token: write` (required for `npm publish
--provenance` to mint a Sigstore OIDC token). The GH Packages
job doesn't inherit this.
- `publish-github-packages` job: adds `packages: write` (required
to push to npm.pkg.github.com). The public-npm publish job
doesn't inherit this.
Both `actions/checkout@v6` calls also pick up `persist-credentials:
false`. The publish steps never push back to the repo, so the
GITHUB_TOKEN doesn't need to land in `.git/config` after checkout.
Same posture both jobs.
Skipped from the same review pass:
- **Pin actions to commit SHAs.** Industry rule but introduces real
maintenance friction — Renovate/Dependabot don't auto-bump
SHA-pinned actions to new minors, so SHA pinning trades easy
semver tracking for stale-action drift. We stay on `@v6` major-tag
pins (GitHub publishes those via verified moving refs).
- **Disable setup-node cache.** `actions/setup-node@v6` defaults to
cache-off (the `cache:` input is opt-in). `package-manager-cache`
only auto-enables when `package.json` has a `packageManager` field
— agentmemory's doesn't (verified via `grep`). The fix is a no-op
on this workflow.
* chore(deps): bundle 10 Dependabot bumps + README agents grid refresh
Closes the open Dependabot wave in one PR.
Root npm bumps:
- @anthropic-ai/claude-agent-sdk ^0.2.56 → ^0.3.142 (closes#389 group)
- dotenv ^16.4.7 → ^17.4.2 (closes#356)
- @types/node ^22 → ^25.7.0 (closes#357)
- typescript ^5.7 → ^6.0.3 (closes#358)
- vitest ^3 → ^4.1.6 (closes#359)
Website npm bumps:
- @types/node 22.10.2 → ^25.7.0 (closes#354)
- typescript 5.7.2 → ^6.0.3 (closes#353)
- react/react-dom ^19.2.5 → ^19.2.6 (closes#352 group)
github-actions bumps:
- actions/checkout v4 → v6 (closes#351)
- actions/setup-node v4 → v6 (closes#350)
Verified:
- npm run build clean against new TypeScript 6 + vitest 4 stack
- npm test 903 / 903 pass
- website npm run build clean (next 16.2.6 + react 19.2.6 + ts 6 stack
generates 5 static pages, finalises optimisation)
- No source changes were needed for any breaking-version bump — the
agent-sdk 0.3.x removal of unstable_v2_createSession etc. is not on
any path agentmemory exercises (we use query() + the existing
AgentSDKProvider shape).
Plus README refresh on the Works-with-every-agent grid:
- Added OpenHuman entry (tinyhumansai/openhuman) pointing at the
recently-landed Memory trait backend (PR tinyhumansai/openhuman#1743)
- Added pi as a native-plugin entry (we already ship
integrations/pi/security.ts and the plugin file in-tree)
- Reordered the grid so native-plugin agents sit in row 1 and
MCP-only / REST-only agents sit in row 2
- Updated sub-text on Claude Code / Codex CLI / OpenClaw / Hermes / pi
to consistently say "native plugin" rather than mixing "plugin",
"skills", "hooks". Counter on assets/tags/section-agents.svg moved
from "16 integrations" to "15 integrations" because we dropped the
meta "Any agent" + "Claude SDK" cells that double-counted REST and
the AgentSDKProvider path already represented by Claude Code.
* docs(readme): swap pi logo to first-party SVG
Drops the generic GitHub-org avatar for the brand-mark SVG. Lives in
assets/agents/ so the README + future grid renders reach it directly.
Ships the new filesystem connector to npm on every release.
Also adds workflow_dispatch so we can manually publish packages
without cutting a release — useful for back-filling fs-watcher
against v0.9.0 which merged before the workflow knew about it.
- 04-mesh-unauth.md: correct 4->5 mesh REST endpoints in patch summary.
- 05-obsidian-export-traversal.md: document the known symlink-traversal
limitation of resolveVaultDir(). The 0.8.2 fix uses lexical containment
only (path.resolve + startsWith) and does not call realpath/lstat, so a
pre-existing symlink under AGENTMEMORY_EXPORT_ROOT pointing outside the
root is still a viable escape. Advisory now names this explicitly and
points users at sandboxing or a follow-up issue for full hardening.
0.8.5's publish workflow got blocked on the unscoped `agentmemory-mcp`
name by npm's name-similarity policy (there's an unrelated third-party
package called `agent-memory-mcp`). Publishing the shim under the
`@agentmemory` scope we already own sidesteps the conflict.
Changes:
- Rename packages/agentmemory-mcp → packages/mcp
- Package name: agentmemory-mcp → @agentmemory/mcp (0.8.4 → 0.8.6)
- Keep bin name `agentmemory-mcp` so `npm i -g @agentmemory/mcp`
still installs a binary at `agentmemory-mcp` for muscle memory
- Log prefix [agentmemory-mcp] → [@agentmemory/mcp] in standalone.ts
and in-memory-kv.ts
- README / integrations/openclaw / integrations/hermes / src/cli.ts
all point at `npx -y @agentmemory/mcp`
- .github/workflows/publish.yml working-directory and npm view queries
target packages/mcp and @agentmemory/mcp
- Shim dependency on @agentmemory/agentmemory bumped to ~0.8.6
- Main package 0.8.5 → 0.8.6 across the 8 version files
- CHANGELOG [0.8.6] entry documenting the scope move
* fix: retention scoring (#119) + npx agentmemory-mcp 404 (#120), release 0.8.3
Issue #119 — retention score ignored agent-side reads
`mem::retention-score` previously hardcoded `accessCount=0` and
`accessTimestamps=[]` for episodic memories and used only a single-sample
`lastAccessedAt` for semantic memories, so the time-frequency decay
formula was a dead path. All read endpoints now record access events to
a new `mem:access` KV namespace via a keyed-mutex'd access tracker:
- mem::search, mem::smart-search (compact + expand), mem::context,
mem::timeline, mem::file-context, mem::get-related, mem::working-context
- retention.ts pre-fetches the full access log in one kv.list call,
normalizes every row defensively, and builds an O(1) lookup Map
- recordAccessBatch uses Promise.allSettled so a slow keyed-lock on one
id does not block the rest of the batch
- Bounded ring buffer of the last 20 access timestamps per memory
- Backwards-compat fallback: pre-0.8.3 semantic memories with only the
legacy sem.lastAccessedAt still score correctly
- Corrupt lastAccessedAt values are NaN-safe via Date.parse + isFinite
- reinforcementBoost is reported as the raw formula output, not the
clamped residual
Memory deletion sites (retention-evict, evict, auto-forget,
governance-delete, governance-bulk, forget, import replace) now call
deleteAccessLog to prevent mem:access from accumulating zombie entries.
mem::export / mem::import and mem::snapshot-create / mem::snapshot-restore
round-trip the new namespace so backup/restore cycles no longer zero out
reinforcement signals.
Issue #120 — npx agentmemory-mcp returned npm registry 404
The README instructed users to run `npx agentmemory-mcp`, but
`agentmemory-mcp` only existed as a `bin` entry inside
`@agentmemory/agentmemory`, not a real registry package. Two-part fix:
- New sibling package `packages/agentmemory-mcp/` — a thin shim that
depends on `@agentmemory/agentmemory` (~0.8.3, tilde to block 0.9.x
supply-chain drift) and forwards to dist/standalone.mjs via the new
`exports` field on the main package
- Canonical `npx @agentmemory/agentmemory mcp` subcommand on the CLI
for users who already have the main package installed
- Removed the dead `agentmemory-mcp` bin from the main package so the
shim owns the name unambiguously
- publish.yml publishes both packages in order with idempotent
guards and npm-view registry polling (no more fixed sleep)
- All MCP install snippets in README + integrations/openclaw + hermes
+ shim README use `npx -y agentmemory-mcp` to skip install prompts
Release 0.8.3
- 670 tests passing (665 + 11 new: access tracker, retention,
smart-search integration, corrupt-input, kv.list failure path,
Promise.allSettled resilience)
- Version bumped across package.json, src/version.ts, types.ts,
export-import supportedVersions, plugin.json
- package-lock.json regenerated
* fix: address CodeRabbit review feedback on #123
Real issues caught and fixed:
- access-tracker: deleteAccessLog now takes the same mem:access:<id>
keyed mutex used by recordAccess, eliminating the race where a
concurrent delete could drop an in-flight RMW update and leave a
stale access log for an evicted memory
- access-tracker: normalizeAccessLog now coerces count to a
non-negative integer, drops non-finite recent[] entries, truncates
recent[] to the last 20 on read (enforcing the ring-buffer invariant),
and guarantees count >= recent.length so a malformed row can't produce
NaN downstream. count is NOT capped at 20 — it is the lifetime access
counter, while recent[] is the 20-entry window
- export-import: import path now rejects accessLogs arrays above
MAX_ACCESS_LOGS (50_000), normalizes each entry via
normalizeAccessLog, and drops entries whose memoryId is not in the
imported memories set, so a crafted export can't blow up memory or
resurrect zombie access rows for memories that don't exist
- publish.yml: added a post-publish npm view polling loop for
agentmemory-mcp mirroring the one that already guards the main
package, so the workflow only succeeds when `npx agentmemory-mcp` is
actually visible on the registry
- CHANGELOG.md: added the missing [0.8.3] reference-style link target
at the bottom to match the [0.8.2]/[0.8.1]/[0.8.0] pattern
- README.md: standalone MCP inline examples now use `npx -y` to match
the MCP config snippets and skip the install confirmation prompt
Tests: 680/680 (+10 new — deleteAccessLog behavior, normalizeAccessLog
invariants, malformed mem:access row handling in retention scoring).
Findings deliberately not applied:
- auto-forget.ts / remember.ts / evict.ts recordAudit calls: existing
pattern in the codebase only audits governance deletes (user-initiated
admin actions), not automatic eviction. Adding audit everywhere is a
policy change, out of scope for this PR
- evict.ts gating deleteAccessLog on memory delete success: current
order is defensible, deleteAccessLog is already best-effort with its
own try/catch, and calling it after a failed memory delete is harmless
- snapshot.ts fail-fast on kv.list failure: inconsistent with the
existing .catch(() => []) pattern used for observations in the same
function
- retention.ts semantic evict only deletes KV.memories rows: real bug
but pre-existing on main (RetentionScore has no source/type field).
Tracked separately — out of scope for this PR
- bin.mjs fallback command: already present in the existing catch
handler
- Promise.all parallelization of delete+deleteAccessLog: micro
optimization not worth the readability cost
Six advisory drafts, one per vulnerability fixed in v0.8.2. These
match the content that should be published via GitHub's Security
Advisories UI at:
https://github.com/rohitg00/agentmemory/security/advisories/new
Each advisory includes:
- Severity + CVSS 3.1 vector
- CWE classification
- Affected/patched version ranges
- Full summary of the issue
- Impact analysis
- Patch description with commit reference
- Workarounds for users on affected versions
- References and credit
These drafts are reference material — the actual CVEs need to be
filed through the GitHub UI to get GHSA IDs assigned and to appear
in GitHub's vulnerability database for downstream scanners.
Order:
01. viewer-xss (CRITICAL, 9.6)
02. curl-sh-rce (CRITICAL, 9.8)
03. default-bind-0000 (HIGH, 8.1)
04. mesh-unauth (HIGH, 7.4)
05. obsidian-export-traversal (MEDIUM, 6.5)
06. privacy-redaction-incomplete (MEDIUM, 6.2)
Rohit Ghumare