ric/omnimem
Watch
1
0
Fork
You've already forked omnimem
 0
Code Issues 2 Pull requests Releases 16 Packages Activity Actions
16 releases 20 tags
  • v6.4.2 50fde316a1

    v6.4.2 Stable

    ric_harvey released this 2026-07-19 23:26:07 +00:00 | 4 commits to main since this release

    The 6.4 line lands on main: skills that travel between instances, skills that propose themselves, and a test suite that now covers 99.9% of the codebase. This release rolls up 6.4.0 through 6.4.2.

    Skills move between instances (6.4.0)

    Every skill on the web UI gains an Export button that downloads the skill together with all the source memories it was compiled from as a single zip bundle — self-describing, with a format version and a sha256 checksum for every file, the skill as both JSON and human-readable SKILL.md, and one JSON file per source memory. An Import Skill button takes such a bundle into another OmniMem instance: validated end to end, previewed before anything is written, and strictly additive — existing skills and memories are never overwritten, so replaying a bundle is a no-op. Embeddings never travel; everything is re-embedded on the receiving instance.

    Skills propose themselves (6.4.1)

    At most once a day, a briefing() runs an auto skill scan across all projects. Domains with no compiled skill whose lessons already clear the reinforcement gate get a draft proposed automatically — by default only when a rule spans two or more projects, the strongest signal a lesson deserves to become policy. Skills whose sources have changed get a fresh draft compiled so the diff is ready to review. The scan only ever creates proposal stashes, so the propose-and-accept gate is untouched and a human still commits every draft. Ignoring a draft declines it: the identical draft is never raised twice, and it only comes back when the underlying lessons change. Tunables: SKILL_SCAN_INTERVAL_HOURS, SKILL_SCAN_CROSS_PROJECT, SKILL_SCAN_MIN_POOL, SKILL_SCAN_MAX_PROPOSALS.

    Test coverage rose from 90% to 99.9% (6.4.1)

    The suite grew from 1032 to 1291 tests and every application module now sits at 100% line coverage, including code that had never been imported by a test at all: the MCP server entry point (Host/Origin allowlist derivation, the fail-closed public-bind check), the on-connect instructions, and the RSS worker's scheduler. The pass also caught tests that were passing while asserting nothing; all now assert unconditionally and are deterministic regardless of Python's hash seed.

    Web UI fixes (6.4.2)

    • The articles page shows which feed each article came from instead of a project column that said the same thing on every row
    • Articles list in the order they arrived (created_at), so startup migrations no longer shuffle them
    • The compiled skills table stays inside the page: long domain names wrap at their hyphens, badges stay in their columns, and the action buttons stack instead of pushing past the edge on narrow viewports

    Also fixed

    • One corrupt updated_at timestamp no longer takes down the whole /memories page
    • install.sh no longer hangs under curl | bash, and shows numbered step-by-step progress
    • Security scans run clean: bandit false positives on deliberate 0.0.0.0 test fixtures and a gitleaks false positive (the "key" in "valkey") are suppressed with targeted annotations

    Self-hosted, open source, runs on Docker Compose. Python 3.12, FastMCP, Valkey.

    Full detail in CHANGELOG.md.

    Downloads
  • V6.3.2 8ac49d0025

    V6.3.2
    Some checks failed
    Docker Build & Push / Build mcp_server (push) Has been cancelled
    Details
    Docker Build & Push / Build web_ui (push) Has been cancelled
    Details
    Docker Build & Push / Build rss_worker (push) Has been cancelled
    Details
    Stable

    ric_harvey released this 2026-07-17 15:05:44 +00:00 | 18 commits to main since this release

    Added

    • Five platform deployment guides: step-by-step setup for macOS (Docker Desktop, Apple Silicon and Intel), Raspberry Pi (64-bit OS, native arm64), AWS EC2 (Linux), GCP Compute Engine (Linux), and any Linux server with Tailscale Funnel for a public HTTPS endpoint without a domain or port forwarding. All linked from the README's documentation table and the docs index
    • Skill demo playbook: scripts/skill_demo_playbook.md walks a self-contained demo of the skill compiler — fictional moo-reports memories in, reinforcement gate visibly excluding a one-off lesson, propose-and-accept compile, a report written under the skill, knowledge watch flagging a contradicting article, and full cleanup. The seeded wordings and thresholds are verified against a live server (lesson texts cluster at 0.80; the watch trigger clears the 0.35 discovery-similarity floor)

    Changed

    • The README became a front door and the manual moved to docs/: the README had grown to over 600 lines of everything at once. It now reads like the omnimem.org landing page — the problem, what OmniMem remembers, what makes it different, a quick start, and links out for the rest — while the detail moved into nine focused pages under docs/: quick start, features in depth, the skill compiler, the MCP tool reference, the configuration reference, RSS and knowledge, remote access (reverse proxy, OAuth, the 421/403 troubleshooting guide), the web UI tour, and architecture. A new docs/README.md indexes the lot, including the existing memory type specs and connection guides
    • The architecture diagram is Mermaid now: the ASCII box drawing gave way to a rendered Mermaid diagram in both the README and docs/architecture.md, which also gains a Mermaid recall-pipeline flowchart; the memory lifecycle in docs/features.md picked up a state diagram to match. Forgejo renders all three natively
    • README front-door polish: the omnimem.org link sits directly under the title, the Codeberg notice moved below the badges in small print (and is repeated in the contributing section), a get-going-quickly installer one-liner appears above the fold in a tip callout, the per-namespace memory specs are linked from the documentation section, and the long-obsolete SSE deprecation warning is gone

    CI

    • Security scans and Docker builds moved to the self-hosted sqcows runner; Python 3.12 is provisioned via uv (setup-python cannot install interpreters on Debian runners)
    Downloads
  • v6.1.0 5768cf3b0f

    v6.1.0 Pre-release

    ric_harvey released this 2026-07-10 22:15:38 +00:00 | 50 commits to v6 since this release

    First release of the v6 line: the skill compiler (6.0.0) plus the web UI to browse and manage it (6.1.0). The idea in one line — a memory error is noise, ranked and diluted by recall; a skill error is policy, because the agent obeys it. So skills are compiled from your raw memories behind a propose-and-accept gate, never written silently.

    The skill compiler (v6.0.0)

    Turns distilled domain procedure — drawn from experience and graveyard memories — into loadable SKILL.md documents an agent can pick up to work the way you work in a domain (python, rust, technical-blogging, ...). A skill earns its keep on greenfield projects where no project context exists yet and the skill is the only thing carrying your conventions.

    • Four new MCP tools: compile_skill (propose returns a unified diff plus a risk-classified change summary; write commits only that reviewed draft — there is no silent-commit path), find_skills (ranked discovery over name/description/domain, with hand-authored skills outranking generated ones on the same domain), get_skill (returns the whole body intact — skills are never chunked), and bless (promotes a single strong lesson past the reinforcement gate)
    • Promotion gating: a single episode is a memory; a pattern across episodes earns a rule. Breakthroughs become Do rules, gotchas become Watch rules, graveyard entries become Don't rules, each citing its source memories
    • Deterministic compilation: the same sources render the same body, so recompile diffs show substance, not noise. The description (the load trigger) is human-owned and pinned across recompiles
    • Briefing integration: briefing() suggests relevant skills (never auto-loads) and flags when a skill's source memories have changed since compile, with prominence scaled to risk

    The web UI rework (v6.1.0)

    • Skills section: a catalogue (name, domain, description, state, compile time, load count, pending-proposal banner) and a detail view rendering the rule manifest with reinforcement counts, the full SKILL.md body, and the source manifest linking back to every memory the skill was compiled from. Deliberately read-only — skills only change through the compile gate, so the pages point you at the raw memories instead of offering edit or delete
    • Dashboard: the projects card now counts distinct projects by state (active / deprioritised / archived) rather than raw records, a new skills card shows compiled skills and pending proposals, compiled skills join the recent activity feed, and card titles link through to their sections
    • Regrouped sidebar: Memory (memories, projects, preferences, experience, graveyard), Skills, Management (duplicates, contradictions, suppressions), Knowledge Management (articles, RSS feeds), and System Management (telemetry, backups)
    • Telemetry and metrics: skill loads now surface on /telemetry (via the shared recall counters) and /metrics gains namespace="skill" and the previously missing namespace="preference" series

    Self-hosted, open source, runs on Docker Compose. Python 3.12, FastMCP, Valkey.

    Full detail in CHANGELOG.md.

    Downloads
  • v5.5.3 f783e5dc31

    v5.5.3 Stable

    ric_harvey released this 2026-07-09 17:58:28 +00:00 | 81 commits to main since this release

    If you're coming from the 3.x line, this is a big jump. v5 has been run hard internally for months before shipping. This release page collects the headline changes since v3 alongside the v5.5.3 fixes.

    Fixed in v5.5.3

    • bandit B324 High-severity failure in the security pipeline: _cache_key() in mcp_server/memory/query_expansion.py used hashlib.sha1() to fingerprint a query into a cache key, which bandit flags as a weak hash for security. The digest carries no security property (it's only a cache key), so the call now passes usedforsecurity=False, the idiomatic fix that clears the finding without a blanket # nosec

    Also in the 5.5.x line

    • v5.5.2: OAuth refresh raised AttributeError → 500 under FastMCP 3.x. The newer MCP SDK reads refresh_token.expires_at, but _StoredToken only stored created_at + expires_in, so every refresh 500d and desktop/claude.ai clients couldn't get a token. _StoredToken now exposes expires_at as a computed property
    • v5.5.1: OAuth / MCP access behind a reverse proxy or tunnel (Traefik, Caddy, Tailscale funnel) broke after the FastMCP 3.x upgrade. Its HostOriginGuardMiddleware 421d on unlisted hosts and 403d on scheme-mismatched origins. server.py now derives the allowed host and full scheme://host[:port] origin from OAUTH_BASE_URL / MCP_PUBLIC_URL, with MCP_ALLOWED_HOSTS / MCP_ALLOWED_ORIGINS for extras

    Highlights since v3

    Connect claude.ai from the browser (v4.0.0)

    A full OAuth 2.1 authorisation server, so claude.ai connects to your self-hosted OmniMem as a connector with no local proxy. Dynamic client registration, PKCE, token refresh with rotation, and a browser login page. Token state persists in Valkey (with AOF) so sessions survive restarts. The 5.5.x fixes above harden this path for real-world proxy/tunnel deployments.

    Smarter recall (v5.0.0)

    • Fact extraction at ingest: Claude Haiku pulls atomic facts from raw input before storing
    • New preference namespace for prescriptive rules ("always update the changelog after a feature")
    • Temporal-aware retrieval: date-shaped queries get a scoring boost against a memory's event_date
    • Query expansion: alternative phrasings unioned at recall time
    • remember_document() with turn-pair chunking took zero-recall on long transcripts from 45% down to 0%

    Faster (v5.2.0, v5.3.0)

    • Non-blocking ingest via a background enrichment queue (~0.25s to store and return)
    • Recall, dedup and maintenance reuse embeddings already stored in Valkey instead of recomputing them
    • Project and state filters are pushed into the vector search so candidate slots stay in-scope
    • Projected batch fetches (get_fields_multi) halve round trips on the scan-heavy hot paths

    Security pass (v5.3.0)

    • Constant-time bearer token comparison (hmac.compare_digest)
    • Fail closed: the server refuses to start unauthenticated on a non-loopback address, and Compose refuses an empty VALKEY_PASSWORD
    • Path-traversal hardening on all web UI backup operations
    • Denial-of-service caps on uploads (100 MB) and RSS page fetches (RSS_MAX_PAGE_BYTES)
    • Per-IP brute-force protection on OAuth login

    Self-hosted, open source, runs on Docker Compose. Python 3.12, FastMCP, Valkey.

    Full detail in CHANGELOG.md.

    Downloads
  • v3.13.1 cc17d554dd

    v3.13.1 Stable

    ric_harvey released this 2026-04-03 16:24:44 +00:00 | 117 commits to main since this release

    Fixed

    • Restored memories not searchable until manual intervention (#10): restore_from_file now automatically re-embeds all restored mem:* keys after writing them back to Valkey. Previously, backups excluded binary vector data (required by decode_responses=True), so restored memories had no embeddings and were invisible to recall and recall_index. The restore response now includes a re_embedded count
    • restore_all return type extended: Now returns (restored_count, skipped_count, restored_keys) so callers know exactly which keys were written
    • 2 new tests for the dump-restore-recall round-trip and selective re-embedding (462 total)

    Removed

    • CVE-2026-4539 --ignore-vuln workaround: Upstream pygments has patched the ReDoS vulnerability in AdlLexer. Removed the --ignore-vuln CVE-2026-4539 flag from the pip-audit CI step
    Downloads
  • v3.13.0 f1ad7f49c9

    v3.13.0 Stable

    ric_harvey released this 2026-03-31 15:37:20 +00:00 | 118 commits to main since this release

    What's new

    RSS knowledge expiry and new tools

    • expires_at on RSS knowledge articles: Ingested articles now auto-archive after MAX_KNOWLEDGE_AGE_DAYS (default 30) during maintenance. Manually stored knowledge is never affected
    • recent_knowledge() tool: Query recent articles with filters for days, feed name, topics, and limit. Sorted newest first
    • promote_knowledge() tool: Clear an article's expiry to keep it permanently
    • Phase 3 in auto-maintenance: Expired RSS knowledge items archived automatically alongside dedup and contradiction scans
    • 22 new tests (458 total)

    Community contribution from @timstoop (PR #9, resolves #6)

    Also included since v3.10.2

    • Real tool call telemetry via FastMCP middleware (v3.11.0)
    • Token overhead page with measured usage since uptime (v3.11.1)
    • Performance optimisations (v3.12.0): briefing 3 scans to 1, dashboard/memories single-pass, metrics 60s cache, Docker multi-stage builds, maintenance comparison cap, dedup max_sim during union-find
    • Contradiction scanner fix (v3.12.1): similarity gate (>= 0.5) before negation check, results capped at 10
    • Version update tooltip fix (v3.10.4, #5)
    • Button ordering fix (v3.11.1, #8)
    Downloads
  • v3.12.1 72e6299ccf

    v3.12.1 Stable

    ric_harvey released this 2026-03-30 11:59:51 +00:00 | 124 commits to main since this release

    What's new

    Performance optimisations (v3.12.0)

    • Briefing: 3 episodic scans consolidated into 1 — stale memories, contradiction warnings, and reinstate candidates collected in a single pass. Reduces session-start latency by ~200-400ms per 1,000 memories
    • Dashboard: single-pass scan — state counts and recent memories in one loop per namespace instead of two
    • Memories page: projects extracted during same scan — removed separate re-scan of all namespaces
    • Metrics endpoint: 60-second cache — /metrics no longer re-scans all memories on every Prometheus scrape. Configurable via METRICS_CACHE_TTL
    • Docker: multi-stage builds — all three Dockerfiles use a builder stage with gcc/g++ and slim runtime with only libgomp1/libopenblas0. Removes ~300-500MB from final images
    • Maintenance: pairwise comparison cap — capped at 2,000 comparisons (was unbounded O(n^2))
    • Dedup: max_similarity tracked during union-find — eliminates redundant re-scan
    • RSS worker: configurable connection pool — VALKEY_MAX_CONNECTIONS env var (default 50)

    Bug fix (v3.12.1)

    • Auto-maintenance contradiction scanner producing mass false positives: The heuristic negation check was running on all pairwise combinations without semantic similarity filtering. Memories containing common words like "use", "with", or "works" matched against almost everything, producing 100+ false positives per briefing. Now embeds content and requires cosine similarity >= 0.5 before checking negation patterns, matching the Tier 1 approach used in remember(). Results capped at 10 per maintenance run

    Also included (v3.11.0–v3.11.1)

    • Real tool call telemetry via FastMCP middleware — records call count, duration, response size per tool to Valkey
    • Token overhead page shows measured averages from actual usage since uptime
    • Prometheus gauges for omnimem_tool_calls_total and omnimem_tool_errors_total
    • Token Overhead link moved after Refresh button on Telemetry page (#8)
    Downloads
  • v3.10.4 ea8db28080

    v3.10.4 Stable

    ric_harvey released this 2026-03-30 10:40:23 +00:00 | 130 commits to main since this release

    What's new

    Added

    • Token overhead estimation page: New /token-overhead endpoint in the web UI showing estimated token cost of running OmniMem per Claude Code session. Breaks down static overhead (MCP instructions, tool schemas, deferred tool names) and dynamic per-session overhead (briefing, recall, remember, warn_if_abandoned, update_project_state calls). Includes memory store metrics and project filtering
    • Sidebar link: "Token Overhead" added to the web UI sidebar under Telemetry
    • Configurable overhead constants: OMNIMEM_INSTRUCTIONS_CHARS and OMNIMEM_TOOL_SCHEMAS_CHARS env vars allow tuning static overhead estimates
    • 14 new tests for token overhead estimation (overall coverage now 91%, 431 tests)

    Fixed

    • Version update tooltip clipped by sidebar (#5): Hover tooltip showing available version was partially hidden due to sidebar overflow clipping. Changed tooltip alignment from centred to right-anchored so it stays within the sidebar bounds
    Downloads
  • v3.10.2 52d70cae07

    v3.10.2: Test coverage from 76% to 90% Stable

    ric_harvey released this 2026-03-27 23:15:18 +00:00 | 133 commits to main since this release

    What's changed

    Raised test coverage from 76% to 90% with 131 new tests (286 → 417 total).

    New test files

    • test_core_coverage.py — validation edges, query-based deprioritise/archive/reinstate/forget, recall optional fields (tags, effort, breakthrough, contradictions, source_url, reinstate_candidate), recall_detail metadata, find_duplicates, contradiction warnings in remember()
    • test_contradiction_coverage.py — check_contradiction_api with mocked anthropic (no key, placeholder key, success, non-JSON response, exception), link_contradiction duplicate avoidance, malformed JSON handling
    • test_backup_coverage.py — path traversal, dump/restore error paths (exception, file write, file too large, invalid JSON, invalid format, invalid keys, OS errors), list_backups edge cases
    • test_briefing_coverage.py — helper function None-data branches, project filtering, malformed JSON, experience parsing edge cases, auto-maintenance exception handling
    • test_recall_coverage.py — comma-separated tags fallback, effort score parsing errors, contradiction JSON parsing, warn_if_abandoned scan cap (5000 keys), log_recall_event exception handling

    Coverage highlights

    Module Before After
    tools/core.py 76% 100%
    memory/recall.py 87% 100%
    memory/contradiction.py 76% 100%
    tools/backup.py 82% 97%
    tools/briefing.py 86% 94%
    tools/contradiction.py 80% 95%
    tools/experience.py 89% 97%

    Bug fixes

    • Fixed Bandit B310 annotation in version_check.py — was using # noqa: S310 (Ruff) instead of # nosec B310 (Bandit)
    • Fixed version update indicator in web UI sidebar — warning triangle now red, tooltip text only appears on hover instead of rendering inline
    Downloads
  • v3.10.1 abba9b753a

    v3.10.1 Stable

    ric_harvey released this 2026-03-27 22:19:51 +00:00 | 137 commits to main since this release

    What's changed

    Added

    • Update available indicator in web UI: A warning triangle appears next to the version badge in the sidebar when a newer release is published on Codeberg. Hovering shows the available version number. Checks the Codeberg releases API with a 1-hour cache and 5-second timeout, fails silently if unreachable
    • Claude Desktop connection guide: New guide at guides/claude-desktop.md covering Streamable HTTP and legacy SSE setup via mcp-remote, config file locations for macOS and Windows, auth, migration steps, and troubleshooting
    • MCP_TRANSPORT in .env.example: Documented as a commented-out option
    Downloads