OmniMem 7.0.4: v7.0.x into main #42

Merged

ric merged 13 commits from v7.0.x into main 2026-10-28 23:48:55 +00:00

Conversation 0 Commits 13 Files changed 47 +1677 -434

ric commented 2026-10-28 23:48:51 +00:00

Owner

• Copy link
• Copy Markdown

Brings main up to 7.0.4, released today from v7.0.x.

What's in it (the CHANGELOG has the full list under [7.0.4])

• omnimem install-hooks sets up the Claude Code hooks.
• Backups can carry the RSS reading list. Restoring one adds the feeds you don't have, matched by URL.
• Commands use the install's database instead of creating data/omnimem.db wherever they're run. This fixes GitHub #1.
• A trailing comment in omnimem.env no longer stops the server starting.
• /etc/omnimem/omnimem.env lists every setting.
• Security: ctutils 0.4.5 and tokio 1.54.1 fix RUSTSEC-2026-0385 and RUSTSEC-2026-0386.
• CI: checks.yml now runs on main too, and 6.x's security.yml is gone.

Checked

• Branch build run 74677 is green on 56846a2, the commit tagged v7.0.4. Its Linux amd64 job needed one re-run for the known intermittent abort on quit, after the smoke test had passed.
• Checks run 74678 is green.
• Tag build run 74681 is green and published 26 release files.
• Docker richarvey/omnimem:7.0.4 and latest are on Docker Hub.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

Brings `main` up to [7.0.4](https://code.squarecows.com/ric/omnimem/releases/tag/v7.0.4), released today from `v7.0.x`. **What's in it** (the CHANGELOG has the full list under `[7.0.4]`) - `omnimem install-hooks` sets up the Claude Code hooks. - Backups can carry the RSS reading list. Restoring one adds the feeds you don't have, matched by URL. - Commands use the install's database instead of creating `data/omnimem.db` wherever they're run. This fixes [GitHub #1](https://github.com/richarvey/OmniMem/issues/1). - A trailing comment in `omnimem.env` no longer stops the server starting. - `/etc/omnimem/omnimem.env` lists every setting. - Security: ctutils 0.4.5 and tokio 1.54.1 fix RUSTSEC-2026-0385 and RUSTSEC-2026-0386. - CI: `checks.yml` now runs on `main` too, and 6.x's `security.yml` is gone. **Checked** - Branch build run 74677 is green on `56846a2`, the commit tagged `v7.0.4`. Its Linux amd64 job needed one re-run for the known intermittent abort on quit, after the smoke test had passed. - Checks run 74678 is green. - Tag build run 74681 is green and published 26 release files. - Docker `richarvey/omnimem:7.0.4` and `latest` are on Docker Hub. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

ric added 13 commits 2026-10-28 23:48:52 +00:00

docs: 7.0.3 is out, and the Docker guide pins a tag that exists ... cc08922541

- guides/docker.md pinned richarvey/omnimem:7.0.0 in all three
  examples, a tag that was never published; the first release is 7.0.3.
- docs/README.md and the quick start no longer say 7 is unreleased. The
  port plan's cut-over row and its CHANGELOG reference say 7.0.3.
- The Flatpak's metainfo gains its 7.0.3 release entry. The 7.0.3 bundle
  shipped listing 7.0.2 as its newest release, which is what software
  centres show.
- CLAUDE.md gets the release steps CI doesn't do: the version, the
  CHANGELOG date, the metainfo line, the Docker guide's pin, and the
  four download redirects in the pages branch's _redirects for
  omnimem.org's buttons.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

ci: checks.yml covers main too, and 6.x's security.yml goes ... cb56ec3767

PR #41's run of security.yml failed without scanning anything. It
used runs-on: sqcows, which all three runners carry, so it landed on
the Mac, and actions/checkout found no Node there. Its run on main after
the 7.0.3 merge passed only because it landed on Linux.

security.yml was 6.x's lone secret scan for main, downloading gitleaks
without checking it. checks.yml already scans the history with a
checksum-checked gitleaks and audits Cargo.lock, on Linux runners, so
it now also runs on pushes to main and on pull requests into main, and
security.yml is deleted. The coverage badge still publishes only from
v7 branches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

release: OmniMem 7.0.4, glib's VariantStrIter advisory recorded as unreachable ... 2de483fb5a

RUSTSEC-2024-0429: glib 0.18's VariantStrIter passes an out-argument as
&p instead of &mut p, so an optimised build can hand CStr::from_ptr a null
pointer. The fix is glib 0.20, which can't be reached: tao, wry, muda,
tray-icon and webkit2gtk, latest releases included, all require gtk 0.18,
and gtk 0.18 pins glib 0.18.5.

The iterator is only built by Variant::array_iter_str(). Nothing in the
registry sources of the tree calls it, and the desktop app's one D-Bus
call (tray_host_running) reads its reply as a (bool,). The headless
server doesn't link glib at all. So it goes in .cargo/audit.toml with
that reasoning, beside the zip advisories, until the tray and webview
crates move past gtk 0.18.

- Version 7.0.4 in the workspace and lock, a dated CHANGELOG section,
  the metainfo's release line and the Docker guide's pin.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix: commands use the install's database, and settings files allow comments ... d1875636af

Issue #1: with no --db or OMNIMEM_DB, every command but the desktop app
fell back to data/omnimem.db under the current folder and created it,
so `omnimem import backup.json` from ~/Downloads filled a database the
server never saw. The CLI now reads the install's settings file and
resolves the database the way the install does: OMNIMEM_DB from the
environment or the file, then /var/lib/omnimem/omnimem.db where the
server package is installed, then the desktop app's data folder. Only
serve, the desktop app and the new `import --create` start a database;
import, export, stats, search, rss and hook stop and say where they
looked and how it was chosen (the hook says so in its log and lets the
work carry on). import and export print the database they use.

A trailing comment stopped the service: systemd's EnvironmentFile hands
`MCP_PORT=8765 # the default` over as "8765 # the default" (checked
with systemd 257), and .env.example's own lines had such comments. The
unit now sets OMNIMEM_ENV_FILE and OmniMem reads the file itself with
omnimem_core::env::parse_settings, which treats `#` after whitespace as
a comment, as a shell does, and keeps it inside quotes. OMNIMEM_LOG and
HF_HOME/HF_HUB_CACHE are read through the overlay so the file reaches
them too.

- /etc/omnimem/omnimem.env lists every documented setting, unused ones
  commented out with their defaults, comments on their own lines.
  .env.example is the same list. tests/settings_files.rs fails if
  either misses a setting docs/configuration.md documents.
- OMNIMEM_DB and HF_HOME move from the unit into the file, which is
  now root:omnimem 0640 since the service reads it as omnimem.
  postinst and install.sh add the two to a kept file lacking them, so
  an upgrade doesn't re-download the model; no percent signs, since
  postinst is pasted into the rpm spec.
- The .deb check in linux-package.sh expects 640:root:omnimem and that
  `omnimem stats` as the service user finds the database through the
  settings file.
- Docs: configuration, quick start, architecture, memory types, the
  hook guide and CLAUDE.md's dev command lose the ./data default.

Tested by hand: stats/import/export/hook against a missing, an
unreadable (this host's /var/lib/omnimem) and a file-named database,
import --create, a missing OMNIMEM_ENV_FILE, the environment beating
the file, and serve coming up on the port a commented line sets. The
desktop crate isn't built here (no GTK dev libraries).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat: omnimem install-hooks sets up the Claude Code hooks ... 4e2cc47092

Adds the three hooks from docs/claude-code-hook.md (session-start, the
pre-tool-use guard and session-end, with the guide's matcher and
timeouts) to ~/.claude/settings.json, or with --project to the
project's .claude/settings.json.

- An event that already runs an omnimem hook, in any form, is left
  alone, so a second run changes nothing and a hand-written entry
  isn't duplicated.
- Everything else in the file is kept, in its order (serde_json's
  preserve_order). The old file is copied to
  settings.json.omnimem-backup, and the new one written beside it and
  renamed into place, as the desktop app does for Claude Desktop's
  config. A file that isn't valid JSON, or whose hooks aren't the
  expected shape, is refused and left untouched.
- The hooks call `omnimem` when the PATH finds this same binary, and
  its full path otherwise: the macOS app's binary is inside its bundle.
  Paths are double-quoted when they need it, backslashes always.
- --db before the command bakes that database into the hooks;
  --dry-run prints what would be added. Inside a Flatpak it refuses,
  since the sandbox can't reach Claude Code's settings.
- It reads no settings file, so it doesn't warn about one it can't read.

Tried against a scratch HOME: a file with other hooks and settings, a
rerun, --dry-run, --project with --db, and broken JSON.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

todo: 7.0.5's desktop menu sets up only the tools that are installed ... 4614a405e8

Detect which AI tools are installed (Claude Code, Claude Desktop, Codex,
maybe others) and whether OmniMem is already configured in each, then
offer the MCP connection and, for Claude Code, the hooks from 7.0.4's
install-hooks, only for those.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Merge branch 'main' into v7.0.x ... 7eae359525

security.yml: kept deleted. main moved its secret scan to a Linux
runner (00ca2c1); checks.yml's security job, which replaced it and
covers main too, already runs on [linux, amd64].

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix: the desktop build compiles again ... 9b7398888d

The settings change named a local bool `desktop`, which shadowed the
desktop() function, so every build with the desktop feature failed with
E0618 and CI went red on all four platforms. Plain `cargo test` doesn't
build the feature, which is why it passed locally.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat: backups can carry the RSS reading list, and restores add it back ... 48d40fb405

A backup may now hold feeds.yml's feeds as a top-level `feeds` list
beside `metadata` and `data`.
- Making one: tick "Include RSS feeds" beside Create Backup in the
  settings window, or run `omnimem export --feeds`. dump_to_file keeps
  6.x's parameters, so the MCP tool's backups are memories only.
- Restoring one, through the Backups page, `omnimem import` or
  restore_from_file: feeds the reading list doesn't have are added,
  matched by URL. Feeds it already has are left exactly as they are, as
  a restore never overwrites a newer memory. Added feeds get the
  uploaded-feeds.yml checks, and their skill influence is mirrored.
- A backup without feeds, 6.x's included, restores as before. It
  leaves the reading list alone and returns 6.x's result unchanged.

feeds.yml's reading and writing, and the upload checks, moved from the
settings panel into the engine (feeds_file), so the panel, the CLI and
the MCP tool share one path. The engine learns where feeds.yml is through
EngineConfig::feeds_path, which the app sets. The preview shows the
backup's feed count, and the restore message says how many were added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

fix(deps): ctutils 0.4.5 and tokio 1.54.1 for two new advisories ... 5a4ebf41ec

The security scan on 48d40fb failed on RUSTSEC-2026-0385, published on
23 October: ctutils 0.4.2's mask generation and u128 comparisons
weren't constant-time (fixed in 0.4.4). tokio 1.53.1 also carried an
unsoundness warning, RUSTSEC-2026-0386 (AsyncFd::new and related
constructors violate I/O safety), and 1.54.1 clears it. Both are
lockfile updates. A local cargo audit now reports no vulnerabilities,
and the 356 workspace tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

docs: the Open Design guide links to open-design.ai ... f89d3fc9fd

opendesign.ai, without the hyphen, is a parked domain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: the release checklist names the homepage's download buttons ... 304c86f855

They link straight to the release files since the site's d6c828f;
_redirects keeps the /download/<platform> links and short links like
/source. [skip ci]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

release: OmniMem 7.0.4, with feeds in backups and the two new advisories ... 56846a2a0a

7.0.4 was never tagged, so the notes waiting under 7.0.5 join it and it
takes today's date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9cZqempzHD2h4Xyjm3gFL

ric merged commit 57ba147532 into main 2026-10-28 23:48:55 +00:00

ric referenced this pull request from a commit 2026-10-28 23:48:56 +00:00

Merge pull request 'OmniMem 7.0.4: v7.0.x into main' (!42) from v7.0.x into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ric/omnimem!42

No description provided.