​

Bug Fixes

​

resolve_conflict deleted the wrong memory after the first resolution

• list_conflicts returns only unresolved conflicts, while resolve_conflict indexed into the full report — the two index spaces agreed only until the first resolution, then desynced. A caller resolving by filtered-list position could delete a memory it never selected, while the conflict the user actually chose stayed unresolved.
• list_conflicts now tags each conflict with its stable index into the full report; the Web UI resolves by that stable index instead of on-screen position; resolve_conflict rejects an already-resolved index as defense in depth. See Resolve Conflict.

​

OKF export corrupted multi-tag memories

• Moorcheh stores tags as a comma-separated string, but the OKF renderer wrapped it in list(tags), splitting the string character-by-character and emitting garbage one-character tags in the frontmatter — every multi-tag memory lost its real tags on export. Now splits-and-strips a string value and passes a list through unchanged.
• Colliding OKF context filenames are preserved instead of silently overwritten, and markdown-link parsing is now linear-time (was worst-case quadratic).

​

Daily analysis dates misaligned with UTC storage

• API, CLI, and Web UI daily-analysis date defaults are now aligned to the same UTC boundary memories are stored under, fixing off-by-one-day results near midnight depending on local timezone. Reflected in memanto daily-summary and the conflict endpoints.

​

Conversation extraction dropped oversized messages

• A single message exceeding the extraction character budget was dropped entirely, sending an empty query and producing an API error or garbage results. The first message is now always included (truncated if necessary), separators count toward the budget, and the budget was raised to 120,000 characters — the old cap came from an embedding-search bottleneck that no longer applies now that extraction runs in raw-LLM mode.

​

CLI: --min-confidence recall filter restored

• memanto recall --min-confidence had regressed to a no-op; filtering is restored and positional recall arguments are preserved. It filters on the memory’s own stored confidence, distinct from --min-similarity, which filters on query match score. See memanto recall.

​

Other fixes

• FastAPI header metadata leaking into backend API keys — an unresolved Header(...) default object could be forwarded to the Moorcheh SDK as if it were a real API key when the dependency was called directly rather than injected; only a genuine string is accepted now.
• LangGraph — fixed a key-collision case in MemantoStore and stale per-agent locks left behind after certain operations; legacy key tags are preserved for backward compatibility.
• Mem0 export now targets Mem0’s v3 API, and pagination validates the next field instead of terminating early on a malformed page.
• Incomplete memory exports are rejected rather than silently accepted as complete, while still falling back to the last good export when a refresh genuinely fails.
• Deleting an agent now cleans up its per-agent lock instead of leaving a stale lock object behind.

​

Tests

• New tests/test_conflict_index_desync.py, plus expanded tests/test_okf.py, tests/test_backend.py, tests/test_cli.py, tests/test_conversation_memory_extraction.py, and tests/test_export_resilience.py covering every fix above.

​

New Features

​

Langfuse integration

• New langfuse-memanto package — attach(agent_id=...) wires into an existing Langfuse setup and turns failing or notable spans into durable Memanto memories live, so lessons from observability data don’t have to be re-learned on every run. Rule-based (no LLM calls), runs off the hot path, and never breaks the traced application if a memory write fails. See Langfuse Integration.
• memanto migrate langfuse adds Langfuse as a fourth migration source (alongside Mem0, Letta, Supermemory), with its own discovery step, configurable capture rules, and a sync ledger for incremental runs. See memanto migrate.
• New Langfuse tile in the Web UI’s Migrate surface, for discovering and syncing a Langfuse project without touching the CLI.
• Live capture and batch migration share the same ledger, so they write identical memories and never duplicate each other.

​

Bug Fixes

​

memanto-mcp broken on MCP SDK 2.0

• The published memanto-mcp 0.1.1 declared an unbounded mcp[cli]>=1.2.0 dependency. MCP SDK 2.0 removed mcp.server.fastmcp, so a fresh install silently resolved to a version the server couldn’t import and failed to start. The mcp dependency is now pinned below 2.0, released as memanto-mcp 0.1.2.

​

Per-client write attribution in MCP

• MCP-written memories now default source to the connected client’s identity (e.g. cursor, codex, claude-ai) instead of a single generic value, falling back to mcp-agent when the transport carries no client identity — reusing core’s own source validation so the advertised tool schema matches what the write path accepts. Builds on the open source label introduced in v0.2.13.

​

Other fixes

• Loopback client misused as a real API key — internal/loopback UI operations were forwarding an unresolved FastAPI Header(...) default to the SDK as if it were a real API key, raising a TypeError inside httpx. Only a genuine string is treated as a supplied key now.
• Version resolution for source-archive installs — added a hatch-vcs fallback version so editable installs and installs from a source archive (e.g. a GitHub ZIP with no .git metadata) no longer fail version resolution at install time.

​

Tests

• New tests/test_langfuse_{config,discover,export,rules,state,sync}.py and integrations/langfuse/tests/{test_handler,test_span_mapper}.py covering the new integration end-to-end.
• New integrations/mcp/tests/test_packaging.py guarding the SDK version pin; expanded integrations/mcp/tests/{test_server,test_tools}.py.

​

New Features

​

Open source label for per-writer attribution

• source is no longer restricted to a fixed enum — any writer (CLI, MCP, LangGraph, Hermes, CrewAI, conversation-extraction, migration) can now stamp its own identifying label, enabling proper per-writer attribution in recall output instead of everything collapsing into a few generic values. See Remember.

​

Bug Fixes

​

Multi-type recall returned nothing

• Requesting more than one memory type built a query like "#memory_type:fact #memory_type:preference", which Moorcheh’s keyword syntax treats as an AND filter that no single document can satisfy — so multi-type recall silently returned zero results. Fixed to issue one query per type and union the results (now parallelized for latency).

​

Session storage hardening

• Session/secret files (which hold live bearer tokens) are now created with 0o700/0o600 permissions, symlinks are skipped rather than followed, and writes go through an atomic O_EXCL temp-file + os.replace pattern instead of writing in place.
• Session lifecycle locks are now scoped per-agent (was a single global lock), renewal is serialized against termination, concurrent auto-renewal races are fixed, and external session-marker races are tolerated instead of raising.
• Windows-specific: non-blocking lock retry via msvcrt, plus handling for additional OSError cases during session loading with improved error logging.
• Sessions are now preserved across interrupted writes instead of being left corrupted mid-write.

​

Temporal recall correctness

• search_as_of (point-in-time recall) now correctly recalls memories that were valid at the queried time but have since expired — it previously delegated to a helper that always filtered by current wall-clock time.
• As-of deduplication is now version-aware: a delete-and-recreate update that briefly exposes both the old and new document with the same id no longer causes the wrong version to win against created_before.
• Date-only as_of cutoffs (e.g. "2026-06-01") are now detected by parsing instead of string shape, fixing rejection of valid ISO-8601 basic format dates; date-only end-of-day bounds now correctly keep the final sub-second of the day instead of dropping it.
• “Yesterday” temporal recall is now bounded to that calendar day instead of a rolling 24h window.
• expires_at values stored as datetime (not just ISO strings) are now handled correctly in the as-of expiry path.

​

Multi-line memory title corruption

• A title containing a newline broke the "[TYPE] title\n\ncontent" document round-trip — the reader’s prefix regex couldn’t cross the embedded newline, corrupting the parsed title/content split, and each subsequent update compounded another "[TYPE] " prefix onto the title until it exceeded the 100-character limit and update started failing permanently. Fixed with a partition-based parser that handles embedded newlines correctly, plus newline normalization at write time.

​

source_ref dropped from recall responses

• source_ref is now preserved end-to-end in recall API responses instead of being silently dropped.

​

MCP integration repairs

• Fixed remember, list_agents, answer, and recall MCP tools that had regressed; automatic agent creation is now restricted to avoid unexpected agent proliferation; each agent now gets an isolated session client initialized independently (was a shared/serial init path).

​

LangGraph store fixes

• Repeated put() calls to the same key now correctly upsert (including under concurrent writers) instead of duplicating; removed a local lock-striping scheme and rate-limit fallback that masked real errors.

​

Config / metadata persistence made crash-safe

• Config writes and local agent-metadata writes are now atomic; a corrupt local agent metadata file is treated as absent instead of breaking agent listing, and surfaces as a warning in the list payload; connect no longer duplicates global instruction paths; export caches are now isolated per backend (cloud vs on-prem) instead of bleeding into each other.
• memanto memory sync now refreshes the export before syncing to a project (and reports the refreshed count) instead of syncing a stale cache.

​

Claude Code integration: turn anchoring and negation

• The Stop hook now distills only the current conversation turn instead of re-processing prior turns; turn anchoring and embedding-query bounds hardened, including bounding daily-summary embedding queries.
• Negated preferences (e.g. “I don’t like Python”) are now classified as preferences instead of misfiled as instructions.

​

Other fixes

• The Web UI’s answer panel now calls the answer function directly through the client rather than an intermediate path that had drifted out of sync.
• VoltAgent defaultLimit is now validated at tool-construction time instead of failing later at call time.
• On-prem: adapted to the reorganized package layout shipped in moorcheh-client 0.1.5.

​

Tests

• New tests/test_as_of_date_only_parsing.py, tests/test_as_of_expired_recall.py, tests/test_memory_read_multi_type.py, tests/test_session_summary_concurrency.py, tests/test_postcommit_summary_resilience.py, tests/test_title_newline_roundtrip.py, tests/test_moorcheh_user_config_compat.py, tests/test_daily_summary_query_length.py, tests/test_review_followups.py.
• Large expansion of tests/test_unit.py, tests/test_api.py, and MCP/LangGraph integration test suites covering every fix above.

​

Improvements

​

Config validation hardening

• Server URLs are normalized and ports validated before being written to config; session/answer config edits are validated against their schema; config setters now guard against malformed config sections instead of crashing.
• Schedule times are validated (format + range) before a scheduled job is enabled, both via the CLI and the UI — invalid times now return 400 instead of silently accepting garbage.

​

Moorcheh client cache invalidation

• MoorchehClientSingleton now tracks the config it was built from (backend, URL, timeout / API key) and rebuilds the cached client when that config changes, instead of serving a stale client after a backend or API-key switch.

​

Avoid storage writes during service initialization

• SessionService/AgentService no longer eagerly create directories or generate a secret key at construction time; both are now lazy (created/generated on first actual use).

​

memanto connect / skill install correctness

• Fixed false-positive shared-skill detection that could report a skill as installed for one agent when it was actually another agent’s install.
• connect --disconnect now preserves unmanaged rule files (including non-UTF-8 ones) instead of deleting content Memanto didn’t add, and cleans up the SessionStart hook entry and any permissions Memanto added — not just the instruction file and skill. See memanto connect remove.
• Hook-cleanup matching (used when disconnecting) tightened to avoid removing unrelated hook entries.

​

Agent list namespace counts hardened

• list agents now guards against malformed/missing item_count or namespace_name fields in the Moorcheh namespaces response instead of raising.

​

MCP integration: per-agent session isolation

• Concurrent MCP tool calls for different agent IDs no longer share one SdkClient session — each agent gets its own isolated, cached client, with batch payload validation happening before any readiness side effects and newly created scoped clients only cached once activation actually succeeds.
• MCP batch_remember now guards against and normalizes malformed item results instead of propagating a bad shape.

​

LangGraph integration fixes

• Non-string content values are stringified before being written to the store (previously could raise). min_confidence search filtering fixed. Setup now retries after an activation failure instead of getting stuck. Input limits enforced on remember.

​

Hermes / CrewAI integration fixes

• Fixed agent-id truncation collisions in Hermes (two different agent IDs could truncate to the same internal id). Hermes memory-mirror writes on exit are now non-blocking. CrewAI remember now enforces the same input length limits as the core API.

​

Memory validation / parsing hardening

• Fixed the ambiguity guard being systemically bypassed by common auxiliary verbs (is/are/was/were) matching STRONG_FACT_PATTERNS.
• Memory type is now schema-validated on write instead of accepted as any string; SourceType validation is strict and rate-limiting now fails closed on error instead of open.
• Tags and source labels are now length-bounded before storage (applies to both remember and memory edits).
• Fail-fast on malformed storage responses in the core write path, memanto migrate, and MCP batch_remember.

​

Timestamp formatting fix

• Epoch-integer timestamps are now coerced to ISO strings during memory-read formatting instead of being returned as raw ints, which broke downstream date parsing.

​

Tests

• New tests/test_connect_engine.py, tests/test_connect_detection.py, tests/test_config_manager_setters.py, tests/test_schedule_time_validation.py, integrations/mcp/tests/test_lifecycle.py.
• Large expansion of tests/test_api.py, tests/test_backend.py, tests/test_unit.py, and per-integration test suites covering every fix above.

​

Bug Fixes

​

Agent list crash on mixed timestamps

• Older agent JSON files stored created_at/last_session without a timezone (e.g. 2026-04-29T03:43:11.497100), while newer records use UTC-aware values (e.g. 2026-07-23T12:47:43.431783Z). Sorting agents by created_at then raised can't compare offset-naive and offset-aware datetimes, so memanto agent list — and List Agents — failed entirely once both kinds of record existed on disk.
• AgentInfo now normalizes created_at and last_session to UTC-aware via a Pydantic validator on load, and agent listing sorts using the normalized value, so legacy and new metadata coexist safely.

​

New Features

​

OKF in the Web UI

• The Migrate tab now supports importing an OKF bundle directly from the dashboard, alongside Mem0/Letta/Supermemory. See OKF Integration.

​

Bug Fixes

​

Content silently wiped by a false-positive “Tags:” match

• The wire-format parser split stored memory text on every blank-line-separated chunk and dropped any chunk starting with "Tags: " — so content that legitimately began a paragraph with the literal text "Tags: " was silently deleted on read. Parsing now partitions strictly into title/content, and only strips a trailing tags block when the record actually has tags and the last blank-line-delimited segment starts with "Tags: ".

​

Temporal filter fail-open

• A silent-fail path in temporal filtering could fall through to returning unfiltered results instead of the intended filtered set; fixed to fail closed.

​

Phantom session summaries from failed writes

• remember/batch-remember logged a memory to the local session Markdown summary regardless of whether the underlying Moorcheh write actually succeeded. A new shared is_successful_write_result() helper gates summary logging (and batch per-item reporting) on a real success status (queued/success/ok), so a failed write no longer produces a phantom entry in the session log.
• Batch upload status now fails closed on unrecognized values — previously any non-empty status from Moorcheh was treated as ambiguous; now only queued/success/ok count as successful and anything else is explicitly marked "failed" with the returned status recorded as the error.

​

Timestamp / TTL invariant violations

• created_at/updated_at are now normalized to UTC-aware, clamped to “now” if a caller-supplied value is in the future, and created_at is forced to never exceed updated_at — closing cases where a bad/aware timestamp from an import or manual edit could produce a memory that looks “created after it was updated” or timestamped in the future.
• expires_at is now always serialized as an ISO string on the outgoing document instead of relying on the object’s default str().
• Pagination offset and aware-datetime comparison bugs in session listing fixed as part of the same batch.

​

Tags, metadata, and provenance preservation

• Consolidates four related fixes: Hermes agents no longer strip tags on read; the memanto recall CLI display now shows tags/provenance correctly; LangGraph’s MemantoStore normalizes tags consistently (including a fix for comma-containing tag keys and preserving wildcard tag filters); and a trailing-"Tags:" suffix leak in read formatting is fixed.
• MCP batch_remember tool now normalizes tags before sending.

​

Streaming uploads

• TypeScript SDK file uploads are now streamed via a multipart Readable generator instead of buffering the whole file in memory.
• The Claude Code integration’s transcript reader now streams the JSONL transcript line-by-line (bounded deque tail) instead of requiring readlines() to materialize the entire file — matters for long-running Claude Code sessions with large transcripts. Read failures during transcript parsing are now logged instead of silently swallowed.

​

Export limit validation

• limit_per_type for memanto memory export is now validated (integer, 1–100) before querying every memory type, instead of failing deep inside the export loop on a bad value.

​

UI date formatting

• Fixed a date-format bug in the Memory Explorer.

​

Tests

• New tests/test_memory_format.py covering the tags/content parsing fixes.
• New tests/test_memory_read_confidence.py additions, plus expanded tests/test_api.py, tests/test_cli.py, tests/test_unit.py for timestamp/TTL invariants, export-limit validation, and write-status gating.
• New/expanded test coverage in integrations/{langgraph,mcp,hermes-agents,claudecode}/tests/.

​

New Features

​

OKF (Open Knowledge Format) export / migrate / sync

• New --okf flag on memanto memory export / memanto memory sync writes an Open Knowledge Format v0.1 bundle instead of the default Markdown output — one file per memory (or a stacked file per type once a type exceeds a size threshold), YAML frontmatter, grouped by memory type.
• Memanto-only fields (id, confidence, provenance, source, status) are preserved under a namespaced x_memanto frontmatter block so Memanto → OKF → Memanto round-trips are lossless; other OKF consumers ignore the unknown keys.
• memanto migrate gains an OKF source: memanto migrate <agent> --okf <path> imports an OKF bundle back into an agent, alongside the existing Mem0/Letta/Supermemory sources.

​

VoltAgent TypeScript SDK integration

• New @moorcheh-ai/memanto/voltagent integration, mirroring the existing Vercel AI SDK / Mastra / OpenAI integrations, with its own test suite and dependency wiring.

​

Improvements

​

Temporal recall correctness

• Tag filters are now actually applied on recall, recall/as-of, recall/changed-since, and recall/recent — tags was accepted in the request body but silently dropped on the temporal endpoints.
• Date-only as-of queries (e.g. 2026-06-01) now include the full day instead of being treated as midnight.
• Malformed/unparseable timestamps are now skipped instead of raising during temporal filtering.
• changed-since sorting no longer breaks on memories with a null updated_at.
• Delete-and-recreate updates that briefly expose both the old and new document under the same id now resolve to the newest version by timestamp (previously could return the stale duplicate).
• The candidate pool fetched from Moorcheh is widened when post-retrieval filters (tags, type, temporal bounds) are active, so filtering no longer starves the result set below the requested limit.
• Temporal recall limits are validated before hitting the backend and capped to sane defaults; boolean and non-positive limits are rejected; duplicate recall-limit validation logic was consolidated into one shared helper.
• Session expiry now handles timezone-aware expiry timestamps consistently, fixing spurious “session expired” states.

​

LangGraph integration

• Refined recall/remember node behavior with expanded test coverage.

​

Tests

• New tests/test_okf.py, tests/test_memory_read_as_of.py, tests/test_memory_read_temporal_recall.py, plus expanded coverage across tests/test_temporal_helpers.py, tests/test_api.py, tests/test_cli.py, and tests/test_unit.py for every temporal-recall fix above and OKF round-tripping.

​

New Features

​

TypeScript SDK framework integrations

• Three new framework integrations ship as part of @moorcheh-ai/memanto, each behind its own subpath import: @moorcheh-ai/memanto/ai-sdk (Vercel AI SDK), @moorcheh-ai/memanto/mastra (Mastra), and @moorcheh-ai/memanto/openai (OpenAI Node SDK).
• Each exposes recallMemory / rememberMemory / answerMemory tools backed by the same Memanto client, with a shared MEMORY_TYPES export so the model can only emit valid memory types.
• Framework packages are optional peer dependencies (ai, @mastra/core, openai, plus zod) — install only the ones you use. Node engine requirement bumped to >=20.

​

Security

​

Management auth required for agent-lifecycle endpoints

• POST /agents, GET /agents, GET /agents/{agent_id}, DELETE /agents/{agent_id}, POST /agents/{agent_id}/activate, POST /agents/{agent_id}/deactivate, and GET /status previously only checked that the server had a configured MOORCHEH_API_KEY, not that the caller was authorized — with the default HOST=0.0.0.0 bind, any network peer could create agents, activate sessions, and obtain session tokens.
• These endpoints now require either a matching management credential (Authorization: Bearer <key> or X-Api-Key) or a loopback client origin.

​

Recall filter-token injection guard

• memory_type, tag, status, and metadata key/value filters passed to Moorcheh’s keyword query syntax are now validated against a strict token pattern before being interpolated, preventing query-syntax injection via crafted filter values.

​

Unique on-prem upload staging paths

• Uploaded files on the on-prem backend are now staged under a UUID-suffixed filename instead of the original name, preventing same-named concurrent uploads from colliding with each other’s staged file.

​

Improvements

​

On-prem restart and session-end no longer block the event loop

• restart_onprem_backend previously ran blocking subprocess and HTTP calls directly inside an async def, freezing the entire API for the whole restart window (up to several minutes). It’s now fully async, and the restart itself runs as a cancellation-safe background task so a client timeout can no longer interleave concurrent restarts against the same on-prem stack.

​

Batch upload status normalization

• Batch memory writes now count "ok" (in addition to "queued"/"success") as a successful per-item status, and count "failed" case-insensitively — on-prem batch uploads were previously miscounted as failed despite succeeding.

​

On-prem answer model omission

• Conversation extraction now omits ai_model when no on-prem LLM is configured, letting the server pick its own default instead of erroring — matching the existing answer endpoint behavior.

​

memanto export / memanto memory sync no longer overwrite a good cache on backend outage

• memanto memory export previously swallowed every per-type recall failure into an empty list and wrote it unconditionally — during a full backend outage this silently wiped the cached export (and, via memanto memory sync, the project’s MEMORY.md) even though nothing was actually forgotten. It now fails loudly instead when every memory type fails to recall (a genuine “no memories of this type” still exports fine).
• memanto memory sync falls back to the previous export when a refresh fails and a prior export exists, instead of wiping MEMORY.md.

​

Memory-update metadata handling

• memanto edit now preserves extra metadata fields from the existing record (e.g. on-prem original_id) that aren’t part of the standard memory schema — but explicitly excludes the trust fields removed on 2026-06-29 (superseded_by, supersedes, validated_at, validation_count, contradiction_detected) so old on-prem records don’t resurrect dead schema on update.

​

Tests

• New tests/test_memory_read_filter_sanitization.py and tests/test_export_resilience.py, plus expanded tests/test_backend.py, tests/test_unit.py, and tests/test_api.py covering the filter-injection guard, stale-cache export fallback, batch upload status normalization, and trust-field exclusion on update.
• New sdks/typescript/test/integrations/*.test.ts for the three new SDK integrations.

​

Security

​

Session cookie hardening

• Browser UI sessions now use an HttpOnly, SameSite=Strict cookie (memanto_session_token) instead of JS-readable token storage, via new set_session_cookie() / clear_session_cookie() helpers.
• The cookie’s Secure flag is now set dynamically from the actual request scheme (Secure only over HTTPS) rather than hardcoded — Memanto defaults to plain HTTP (0.0.0.0, no built-in TLS), so a hardcoded Secure=True would have silently stopped browsers from ever sending the cookie back in that default deployment. See Cookie-Based Authentication.
• Session renewal now correctly updates the cookie with the new token on the response — previously a renewed session invalidated the old token without refreshing the cookie, breaking the very next request.

​

Streaming file uploads

• upload_file previously buffered the entire file in memory before writing to disk; for the documented 5 GB max, concurrent large uploads could trivially exhaust server RAM. Uploads are now streamed to disk in 1 MB chunks with the 5 GB cap enforced during the stream (413 if exceeded), not after full buffering.
• The chunk write itself is now dispatched via asyncio.to_thread so large uploads no longer block the event loop on synchronous disk I/O.

​

Blank/invalid input rejected across API and CLI

• answer/recall queries, conversation-extraction messages, and CLI batch memory content now reject blank/whitespace-only strings via Pydantic validators instead of silently accepting empty input.
• remember provenance values and recall memory-type filters are now validated against the allowed enum values instead of passed through unchecked.

​

Session cleared when deleting the active agent

• Deleting an agent now also deletes its persisted session state, so a saved session token for a deleted agent can no longer be replayed via X-Session-Token.

​

TypeScript SDK: URL-encode agent/memory IDs

• All REST paths built from agentId/memoryId now run through encodeURIComponent(), preventing malformed requests or path injection when an ID contains special characters.

​

Improvements

​

Timestamp normalization for imports

• Imported memory timestamps (e.g. from memanto migrate) are now preserved as source chronology while being normalized to UTC-naive values for downstream confidence calculations, via a shared as_utc_naive() helper (deduplicated out of memory_write_service into temporal_helpers).
• Session-listing sort and session comparisons now normalize datetimes consistently before comparing, avoiding naive/aware datetime comparison errors.

​

Error handling

• map_error_to_http_exception now passes an existing HTTPException through unchanged instead of re-wrapping it (e.g. avoids turning a 413 upload-too-large into a generic 500).

​

TypeScript SDK fixes

• Fixed status() session bootstrap so a session established outside the constructor is recognized correctly.
• Fixed a file-size fallback bug in the upload path.

​

Tests

• Large expansion of tests/test_api.py, tests/test_cli.py, and tests/test_unit.py covering session-cookie renewal (including the HTTP-vs-HTTPS Secure flag behavior), streaming upload limits, blank-input validators, provenance/type validation, session deletion on agent removal, and timestamp normalization.
• Expanded sdks/typescript/test/memanto.test.ts for agent-ID encoding and session bootstrap behavior.

​

Security

​

Path traversal via agent_id / session_id / dates

• Unsanitized agent_id / session_id values were concatenated directly into pathlib.Path expressions (e.g. sessions_dir / f"{agent_id}.json"), letting a caller escape the storage directory with input like "../../etc/passwd". All filesystem call-sites now run through validate_safe_id().
• Extended the same guard to memory_export_service, daily_analysis_service (including the date parameter used in glob patterns and JSON output paths), and the --output-path CLI flag (anchored to a base dir via relative_to() containment checks).

​

CORS reflected-origin credential exposure

• Default ALLOWED_ORIGINS=["*"] combined with allow_credentials=True caused Starlette to mirror any request Origin back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true — letting any website make credentialed cross-origin requests to the Memanto API.
• Fixed to stop mirroring arbitrary origins when credentials are allowed.

​

Sensitive Web UI endpoints gated to localhost-only

• POST /api/ui/shutdown, GET /api/ui/browse, PATCH /api/ui/config, PUT /api/ui/api-key, POST /api/ui/onprem/restart, plus the connections and migrate endpoints, were reachable from any network host with no authentication (remote DoS, arbitrary file listing, config/API-key overwrite).
• Added a _require_local() dependency that returns 403 for any caller that isn’t 127.0.0.1 / ::1 (including IPv4-mapped IPv6 loopback), and blocked glob-pattern injection in the browse endpoint.

​

Unpredictable session secret

• Removed the hardcoded default JWT signing secret ("memanto-default-secret-change-in-production").
• When MEMANTO_SECRET_KEY isn’t set, a per-instance random secret is now generated (secrets.token_hex(32)) and persisted locally instead of falling back to a publicly-known constant.

​

Session token lifecycle hardening

• Deactivated/terminated session tokens are now rejected outright (401) instead of continuing to authorize writes.
• Cross-agent session/agent mismatches now consistently raise AuthorizationError → HTTP 403 (was a generic 500) across all session-scoped endpoints.
• CLI clients now validate cached sessions before reuse instead of trusting a stale cached token.
• TypeScript SDK resets its local session state after deleteAgent().

​

Improvements

​

Legacy scope model collapsed to agent_id

• Removed the scope_type / scope_id pair (and the underlying MemoryScope / namespace-parsing machinery) in favor of a single agent_id field; namespaces are now built by one free function (agent_namespace(agent_id)).
• Dead code from this and prior cleanups moved to memanto/app/legacy/ (excluded from CI lint/type-check).
• Removed orphaned “trust” fields that were never populated by any live write/read path (superseded_by, validation_count, contradiction_detected, etc.) and the unused ValidationPolicy class.

​

Confidence filtering bug fix

• Numeric min_confidence filtering in memory search previously relied on Moorcheh keyword syntax that never matched; it’s now applied as a post-filter on the numeric confidence field, fixing a zero-threshold edge case that silently returned nothing.

​

Manual conflict resolution validation

• ConflictResolveRequest now requires non-empty manual_content when action == "manual", both on the API and in the UI (blank submissions show a warning toast and refocus the textarea).

​

Timestamp normalization

• Parsed ISO timestamps are now consistently normalized to UTC, whether the input has an explicit offset or is naive.

​

CLI: honor custom title for short memories

• memanto remember no longer overrides an explicit --title with an auto-truncated content snippet when the memory content is short.

​

Memory deletion response handling

• Tightened success/failure detection for memory deletion and update-then-delete flows so partial or malformed backend responses aren’t reported as success.

​

TypeScript SDK & CI

• Updated dependencies, CI workflow permissions, regenerated openapi.json, and added an npm publishing workflow (.github/workflows/publish.yml).

​

Tests

• New tests/test_cors_fix.py, tests/test_output_path_traversal.py, tests/test_ui_auth.py, tests/test_remaining_ui_auth.py covering the CORS, path-traversal, and localhost-gating fixes.
• New tests/test_memory_read_confidence.py and tests/test_temporal_helpers.py.
• Expanded tests/test_api.py, tests/test_cli.py, tests/test_unit.py for session-secret generation, inactive-token rejection, and deletion handling.

​

New Features

​

TypeScript SDK (sdks/typescript/)

• New @moorcheh-ai/memanto npm package — a fully-typed client generated from the API’s OpenAPI spec (openapi-ts), covering agents, sessions, remember, recall, answer, upload, and the extract/edit endpoints.
• Lifecycle helpers (src/lifecycle.ts) for session start/stop memory flows, plus a doctor command (src/doctor.ts) for config/connectivity checks.
• All recently-added API features exposed as first-class SDK methods.
• CI workflow .github/workflows/sdk-typescript.yml builds, tests (Vitest), and publishes the package; full test suite (memanto.test.ts, lifecycle.test.ts, doctor.test.ts).
• See the TypeScript SDK reference for the full method list.

​

memanto edit command and PATCH endpoint

• New PATCH /{agent_id}/memories/{memory_id} endpoint with MemoryEditRequest for partial in-place updates.
• CLI memanto edit <memory_id> with --title, --content, --type, --confidence, --tags, --source options (at least one required).
• Field validation on both the API and direct-client paths: non-empty content with length limits, confidence range 0.0–1.0, and valid memory-type membership — matching the create-endpoint contract.
• See memanto edit and Edit Memory.

​

v2 memory route response models

• Explicit Pydantic response_model schemas added to the v2 memory routes, giving typed/validated responses and accurate OpenAPI documentation (which in turn feeds the TypeScript SDK codegen).

​

Improvements

​

Local metadata logging

• Session service now logs memory metadata locally alongside the memory write, keeping the local session summary in sync with stored memories.

​

Security

​

Cross-agent authorization returns 403

• All 12 agent-scoped endpoints now return HTTP 403 (not 500) when a session’s agent_id doesn’t match the URL’s agent_id, correctly signaling an authorization failure instead of a server error.

​

Upload path-traversal fixed (CWE-22)

• Uploaded filenames are stripped to their basename (Path.name) with a defense-in-depth realpath check, preventing a crafted filename (e.g. ../../../etc/cron.d/backdoor.txt) from escaping the temp directory.

​

Secrets removed from UI config endpoint

• GET /api/ui/config no longer returns the plaintext Moorcheh API key or session JWT; only safe metadata (api_key_configured, api_key_preview) remains, closing an unauthenticated secret-disclosure path.

​

Tests

• Expanded tests/test_api.py and tests/test_cli.py for the edit endpoint, v2 response models, the 403 scope guard, and filename sanitization.
• New TypeScript test suites under sdks/typescript/test/.

​

New Features

​

Conversation memory extraction

• New POST /{agent_id}/remember/extract endpoint that distills chat-style conversation turns into typed memory candidates, using the same Moorcheh answer-generation path as the RAG answer endpoint.
• Candidates are auto-classified into valid memory types, de-duplicated, confidence-scored, and tagged conversation-extract; secrets, API keys, and tokens are explicitly excluded by the extraction prompt.
• dry_run returns candidates without persisting; otherwise they’re written through the standard batch_remember path and logged to the session summary.
• New ExtractMemoriesRequest / ConversationMessage models with bounded limits (≤200 messages, ≤100 memories, 12k-char cap).
• CLI memanto remember --from-conversation <path|-> reads a JSON message array from a file or stdin, with --dry-run, --max-memories, and --ai-model flags, and renders each extracted candidate as a panel.
• SDK and direct clients gain extract_memories_from_conversation().

​

Improvements

​

Provenance metadata in recall

• recall output now displays Source, Ref, and Provenance for each memory (in addition to tags), unifying file-upload source names and origin (user / agent / tool) into one consistent block.
• MCP MemoryHit model extended with status, source, source_ref, and provenance fields so MCP clients receive full memory metadata.
• Web UI memory cards surface the same source / provenance metadata.

​

Tests

• New tests/test_conversation_memory_extraction.py covering extraction, JSON parsing / normalization, validation limits, and dry-run behavior.
• Expanded tests/test_api.py and tests/test_cli.py for the extract endpoint and --from-conversation CLI flow.

​

New Features

​

memanto migrate command suite

• Replaces the old analyze command with a full migration workflow: export a provider’s data (Mem0, Letta, Supermemory), map each source row onto Memanto memory types (auto-classified via the rule-based parser), bulk-write via batch_remember (100 items/request), and optionally generate a storage/token/latency savings report — all in one command.
• Provider metadata (scope IDs, confidence scores, hashes) is preserved in a bounded [Supporting data] footer so nothing is lost; original created_at / source / source_ref map naturally onto the schema.
• --dry-run previews the mapping (types, confidence, tags) without writing. --report generates the Markdown comparison on real runs. Outputs live in ~/.memanto/migrate/<provider>/<timestamp>/ (separate from legacy analyze/ artifacts).
• Works on both cloud and on-prem backends; on-prem batch_remember respects the same chunking.

​

memanto forget command and REST endpoint

• New DELETE /{agent_id}/memories/{memory_id} endpoint for single-memory deletion. Checks session scope (the session must own the agent) and removes the memory from Moorcheh.
• CLI memanto forget <memory_id> for quick terminal deletion.
• UI Delete button on each memory card in the Memory Explorer.

​

Improvements

​

On-prem backend enhancements

• Session namespace creation now reuses an existing namespace on-prem instead of erroring when the namespace already exists (idempotent namespace setup).
• On-prem forget error messages are now clear and actionable (differentiate “memory not found” from “namespace issue”).
• On-prem threshold boundary checks fixed (no off-by-one on min-similarity validation).

​

Mapper robustness

• Mappers now extract all available info from source exports, including less-common fields like interaction hashes, scope IDs, and custom metadata, preserving them in the [Supporting data] footer for compliance and audit trails.

​

Migrate + on-prem API key handling

• The migrate command correctly propagates the API key dependency for the on-prem backend (no double-init of the backend client).

​

Tests

• New tests/test_cli.py coverage for the migrate and forget commands (dry-run, report generation, single-memory delete flow).
• New tests/test_unit.py coverage for mappers (all three providers) and session namespace idempotency.
• Integration tests expanded across CrewAI and LangGraph tooling.

​

New Features

​

On-prem Moorcheh backend

• New MEMANTO_BACKEND setting (cloud | on-prem) routes every call through a backend-aware dispatcher that exposes the same namespaces / documents / similarity_search / answer / files / vectors shape regardless of target — service code never branches.
• First-run wizard now asks Cloud vs On-Prem; on-prem path installs moorcheh-client>=0.1.3, prompts for embedding + LLM provider (ollama / openai / cohere), persists choices to ~/.memanto/on-prem/state.json, writes the full LLM block to ~/.moorcheh/config.json before moorcheh up, then pulls Ollama models into the container.
• On-prem data lives under ~/.memanto/on-prem/ (sessions, agents, summaries) so cloud and on-prem never share local state; switching backends clears the active session.
• New memanto config backend [cloud|on-prem] CLI command for runtime switching, plus Backend, MOORCHEH_ONPREM_URL (default http://localhost:8080) and MOORCHEH_ONPREM_TIMEOUT (default 300) rows in memanto config show.
• Health check, startup validation, and the agent delete flow are all backend-aware.

​

memanto detect-conflicts + scheduled job split

• Conflict detection split out of daily-summary into its own command, POST /{agent_id}/conflicts/generate REST endpoint, and DirectClient.generate_conflict_report() method.
• New hidden memanto schedule _run entrypoint executes daily-summary + detect-conflicts back-to-back; OS scheduler now points at it. On-prem backend short-circuits with a clear error (scheduled job depends on cloud-only LLM Answer).
• daily_summary_service.py renamed → daily_analysis_service.py.

​

UI: Connect tab, memory timeline, daily summary, file pagination

• Connect tab installs/removes Memanto skills into any registered agent (Claude Code, Cursor, etc.) via the underlying install_agent / remove_agent engine, with a connections.json registry tracking project-local vs global installs.
• Memory History page with a vertical timeline of every change (created, updated, conflict resolved) per memory.
• Daily summary + Unreviewed conflicts widget surfaced on the dashboard (Daily Summary tab renders the generated MD and shows days with pending conflict review).
• Answer panel is backend-aware — on-prem shows provider/model/api-key only (no cloud-only knobs) and writes to ~/.moorcheh/config.json without polluting the shared cloud yaml.
• Memory Explorer now use cursor pagination through documents.fetch_text_data (next_token / has_more) instead of being capped at 100 items per namespace.

​

Improvements

​

Backend-aware recall_* REST endpoints

• recall_as_of, recall_changed_since, recall_recent and the underlying MemoryReadService methods now treat limit=None as “fetch all” — the CostGuard.validate_k_limit cap is only applied when a limit is explicitly set.
• answer.generate calls route through get_active_llm_model() so the LLM identifier comes from cloud settings on cloud, on-prem state.json on on-prem, with the field omitted entirely when on-prem has no LLM configured (server picks its own default).

​

Stale active-session handling

• get_active_session() now clears the stale active marker and returns None when the session has expired, instead of returning an expired Session.
• All datetimes flow through a single utc_now() helper; Pydantic v1 Config.json_encoders blocks removed from session models.

​

Connect engine ↔ registry sync

• install_agent / remove_agent now sync their results into ~/.memanto/connections.json so the UI’s Connections page reflects what the CLI did and vice versa.

​

Tests

• New tests/test_backend.py covering cloud/on-prem dispatcher behavior and get_active_llm_model fallbacks.
• New tests/test_analyze.py covering the Mem0/Letta/Supermemory export + compare + report flow end-to-end with mocked provider responses.
• tests/test_cli.py and tests/test_unit.py expanded to cover the new detect-conflicts / schedule _run paths.

​

New Features

​

Recall similarity threshold

• New recall.min_similarity setting (0.0–1.0) in CLI config with validation; default 0.0.
• REST POST /memories/recall and SDK/Direct recall() resolve min_similarity from the request, then fall back to the config value, then to unset.
• CLI flag renamed --min-confidence → --min-similarity on memanto recall.
• memanto config show surfaces the new Min Similarity row.

​

Agents page in the Web UI

• New sidebar entry listing every registered agent with status, pattern, memory and session counts; activate/deactivate from the table.
• GET /api/v2/agents and GET /api/v2/agents/{agent_id} now populate memory_count from the live Moorcheh namespace document count instead of the stale local metadata value.

​

File upload in the Playground

• New Upload File tab accepts .pdf, .docx, .xlsx, .json, .txt, .csv, .md (max 5 GB) and ingests into the active agent’s namespace, with client-side size/extension validation.

​

Fuzzy fallback for auto memory-type parsing

• When deterministic rules abstain, a rapidfuzz-backed pass scans tokens against a curated list of long, distinctive keywords per type and picks the best match above FUZZY_SCORE_CUTOFF = 88.0 — recovering obvious misspellings like “decded” → decision, “crahsed” / “tracebck” → error.
• New runtime dependency: rapidfuzz>=3.0.0.

​

Smart-parse config switch

• New memanto.cli.smart_parse setting in config.yaml propagates to the AUTO_PARSE_ENABLED env var on startup, letting users toggle auto-parsing without editing code.

​

Improvements

​

CrewAI tool schema

• MemantoRecallTool now exposes min_similarity (0.0–1.0) to the LLM, raises the default limit from 5 to 10, and enforces ge=1, le=100 via Pydantic instead of a hardcoded min(limit, 20) clamp.

​

UI timestamps & filters

• fmtDate appends Z to naive UTC timestamps so the browser converts them to the user’s locale instead of treating them as local time.
• Memory Explorer gains an All Sources filter dropdown; navigation helper goToPage() added; favicon shipped.

​

memanto connect agent templates rewritten

• Reframed as an “active memory companion” with five non-negotiable rules (read MEMORY.md, search before guessing, store proactively, always pass --type/--confidence/--provenance/--source, never keep mental scratchpads).
• Adds an operations table (recall vs answer vs remember), worked memanto remember examples per type, full memory-type/provenance/confidence references, and the new temporal flags (--recent, --as-of, --changed-since).
• Cursor MDC rules file mirrors the same content under alwaysApply: true.

​

Tests

• New fuzzy-fallback cases in tests/test_memory_parsing.py (typo’d decision/error detection; confirms no false-fire on unrelated text).
• tests/conftest.py resets settings.AUTO_PARSE_ENABLED = True before every test so local smart_parse config can’t leak into the suite.

​

New Features

​

Configurable rule-based memory parsing

• MemoryParsingService (memory_parsing_service.py) auto-detects a memory’s type at ingestion using score-based classification with priority tie-breaking across all 13 supported types — no more blind default to fact.
• MemoryRecord.type is now optional (None); the parser assigns the type when the caller omits it.
• New AUTO_PARSE_ENABLED setting (default True).
• remember and batch-remember run the parser when type is omitted and return the resolved type in the response.
• CLI — memanto remember no longer forces --type fact; it displays the parsed type instead.

​

MCP server integration

• The MCP server integration is now available — it exposes Memanto memory operations to any MCP client. Install it with:
  pip install memanto-mcp
  
• See the Integrations section for setup details.

​

Hermes Agents integration

• The Hermes Agents integration is now available — a hermes_memanto provider for Hermes Agents. Install it with:
  pip install hermes-memanto
  
• See the Integrations section for setup details.

​

Improvements

​

Unified content-length cap across layers

• SDK/Direct clients now use InputLimits.MAX_TEXT_LENGTH instead of a hardcoded 500, aligning the cap with the REST/Pydantic models (10,000 chars).
• Removed the unused MAX_MEMORY_SIZE / MAX_TITLE_SIZE settings.

​

Chronological recall --recent

• New recall_recent() on SdkClient and DirectClient returns the most recently stored memories (newest first).
• New memanto recall --recent flag — lists recent memories directly, no search query required (mutually exclusive with --as-of / --changed-since).

​

Unified kiosk_mode and threshold defaults

• kiosk_mode and threshold defaults now resolve from config.yaml.
• threshold is only applied when kiosk_mode is on; the kiosk-mode fallback threshold is unified to 0.15 across REST and config defaults.

​

CrewAI integration

• Install the CrewAI integration with:
  pip install crewai-memanto
  
• LLM tool schemas now enumerate all 13 memory types with definitions to guide classification.
• See the Integrations section for setup details.

​

Docker

• The Docker image can now be pulled directly:
  docker pull moorcheh/memanto:latest
  

​

Breaking Changes

​

Temporal endpoints no longer accept a query

• API — POST /{agent_id}/recall/as-of and POST /{agent_id}/recall/changed-since request bodies dropped the query field; response bodies dropped the echoed query field.
• CLI — memanto recall --as-of … / --changed-since … now errors if a QUERY argument is also supplied. Remove the query to list all memories for that window.
• Python clients — recall_as_of() on DirectClient and SdkClient no longer take a query argument.

​

Improvements

​

Temporal retrieval switched to documents.fetch_text_data

• New _fetch_all_memories() helper (memory_read_service.py) paginates through Moorcheh’s fetch_text_data endpoint across all matched namespaces, applies optional type/tags filters in-process, deduplicates by ID, and strips summary chunks.
• Fewer round trips — search_as_of and recall_changed_since use the fetch path instead of iterating similarity_search.query() per memory type, returning complete result sets within Moorcheh’s 100-item-per-namespace fetch limit.

​

CrewAI integration as a publishable package

• New memanto-crewai package (v0.1.0) in integrations/crewai/ with pyproject.toml, hatchling build backend, MIT license, Python >=3.10.
• Public exports — MemantoSetup, MemantoRememberTool, MemantoRecallTool, MemantoAnswerTool, create_memanto_tools from memanto_crewai.

​

Breaking Changes

​

Memory endpoints migrated to POST

• recall, answer, recall/as-of, recall/changed-since — now accept JSON request bodies instead of query parameters.
• memory_types renamed to type — accepts a list of strings across all recall endpoints and CLI recall commands.

​

Session and auth changes

• /session/current renamed to /status — requires no session token; reads active session from local state.
• /session/extend removed — session extension is no longer supported.
• /sessions list endpoint removed.
• Authorization header dropped for API key — MOORCHEH_API_KEY is read from server config only; Bearer header auth is removed.
• X-Session-Token is the only auth mechanism for per-request memory operations.

​

Legacy routes removed

• /api/v1/namespaces, /api/v1/memory, /api/v2/context — moved to memanto/app/legacy/.

​

New Features

​

Recall and conflict endpoints

• POST /{agent_id}/recall/recent — retrieves most recent memories without a query string; replaces /recall/current.
• GET /{agent_id}/conflicts — lists detected memory contradictions.
• POST /{agent_id}/conflicts/resolve — resolves a flagged contradiction.
• DELETE /agents/{agent_id}?delete-backup-too=true — optionally wipes the agent’s remote Moorcheh namespace on deletion.

​

Startup validation

• Fail-fast API key check — server validates MOORCHEH_API_KEY on startup and refuses to start if missing or authentication fails.

​

Improvements

​

Structured request body models

• Pydantic models (RecallRequest, RecallAsOfRequest, RecallChangedSinceRequest, RecallRecentRequest) with full field validation and bounds checking.
• Smart date defaults — date-only as_of defaults to end-of-day; since defaults to start-of-day, so full ISO datetimes are not required for daily windows.

​

Auth and session service

• get_moorcheh_api_key() reads from server config only — no per-request header parsing.
• verify_moorcheh_api_key() validates once at startup instead of on every request.
• extend_session() removed; moorcheh_api_key parameter removed from create_session(), validate_session(), and renew_session().

​

Health check

• /health no longer requires client dependency injection.
• Status reports "unhealthy" (was "degraded") when Moorcheh is unreachable.

​

CLI

• memanto session extend removed.
• “Activation” terminology replaces “session” across agent create, agent activate, agent deactivate, and memanto status.
• memanto status panel renamed to Active Agent (was “Active Session”).

​

UI Fixes

​

UI shutdown fix

• Server stability — fixed an issue where the API server would unexpectedly shut down when refreshing or closing the browser tab. The server now stays alive unless explicitly stopped or running in specific UI-only modes.

​

Tests

• Added tests/test_e2e.py with end-to-end API coverage.

​

Improvements

​

API input validation

• Content fields — remember, recall, answer, recall/as-of, recall/current, and recall/changed-since enforce min_length=1 on query/content fields and max_length=500 on title.
• Numeric bounds — confidence, min_similarity, threshold, and temperature bounded [0.0, 1.0]; limit enforced ge=1.
• CostGuard validators (validate_text_length, validate_query_length, validate_k_limit) applied across all memory read/write endpoints.

​

Session extension guard

• API — extending a session with additional_hours <= 0 now returns HTTP 422.
• CLI — memanto session extend rejects non-positive --hours values before sending the request.

​

Daily summary custom output path

• output_path parameter added to generate_summary() and generate_daily_summary().
• When provided, the summary Markdown file is written to the specified path; parent directories are created automatically.

​

Agent pattern options

• memanto agent create --pattern help text updated to list only available patterns: project, support, tool (removes unavailable chat, research, custom).

​

Dependencies

• moorcheh-sdk minimum version bumped from >=0.1.0 to >=1.3.5.

​

Bug Fixes

​

UI dashboard authentication

• Root cause — the masked API key was being used for backend authentication, causing all dashboard data to fail loading after login.
• Fix — restored transmission of the full API key in the configuration response so the dashboard can authenticate backend requests properly.
• Display — api_key_preview remains masked (........XXXXXX) in the settings tab; only the backend communication is affected.

​

Tests

• Full test suite: 54 passed. UI connectivity verified.

​

Improvements

​

API key verification

• First-run setup — memanto now actively verifies the key against Moorcheh before saving; invalid keys are rejected immediately; transient network issues surface as a warning rather than blocking setup.
• Lighter auth ping — verification switched from client.namespaces.list() to client.documents.get(...) against a sentinel namespace. NamespaceNotFound is treated as success (key authenticated; namespace simply doesn’t exist).
• Clearer error codes — auth dependency returns 401 on AuthenticationError and 500 on unexpected errors.

​

Server health check

• /health uses the same documents-based ping, so health reflects real authentication state.

​

Configurable summary model

• SUMMARY_MODEL setting (default anthropic.claude-sonnet-4-6) used for daily summary and conflict reports.
• ~/.memanto/config.yaml now supports memanto.summary.model, memanto.answer.model, temperature, and answer_limit — loaded at startup so models can be swapped without code changes.

​

UI security

• /api/ui/config and the API-key update endpoint now return a masked preview (••••••••<last6>) instead of the raw key — plaintext key is no longer sent to the browser.

​

Tests

• Full test suite: 54 passed.

​

Bug Fixes

​

Web UI authentication after CLI activation

• Dashboard, Memory Explorer, recall, and analytics views now load correctly after memanto agent activate.
• “Session may be expired” and “Activate an agent via CLI to explore memories” error states are resolved.

​

Improvements

​

Simplified first-run setup

• Single-step onboarding — memanto setup now prompts only for the Moorcheh API key.
• Removed the schedule time (HH:MM) prompt, related validation, and automatic ScheduleManager().enable(...) call from onboarding.

​

Improvements

​

Onboarding and documentation

• README quick start de-emphasizes memanto serve as a prerequisite — users can run memanto, create an agent, and try memories without keeping a local API process running.
• memanto serve documented as optional, for HTTP/REST use only.
• Agent integration guide shortens quick start to create → remember → recall, and updates Python examples.
• Session architecture doc notes that memanto agent create auto-activates in the CLI.

​

CLI output polish

• memanto status / memanto serve use Local REST API wording; healthy API shows online.
• Success messages drop the OK prefix across agent create, remember, upload, and daily summary flows.
• Welcome Quick Start lists memanto ui, reorders commands, and describes memanto serve as starting the local REST API.

​

memanto connect list

• Column renamed to Agent Name; rows show agent name instead of display_name.

​

Behavioral Changes

• memanto agent create already auto-started a session; docs and Quick Start now consistently reflect this so separate memanto agent activate is not shown as a required step.
• Default session/extension examples reference 6 hours where updated.

​

Tests

• Full test suite: 54 passed.

​

Improvements

​

CLI onboarding flow

• Quick start now shows memanto serve first and guides users to open a new terminal for agent commands.
• memanto serve prints a clear “next step” hint after startup.
• memanto agent create <agent-id> now starts a session automatically.

​

Documentation

• Updated README.md, docs/CLI_USER_GUIDE.md, docs/CLI_INSTALLATION.md, docs/AGENT_INTEGRATION_GUIDE.md.

​

Behavioral Changes

• memanto agent create auto-activates a session — separate memanto agent activate is usually not required in the quick start flow.

​

Tests

• Updated CLI tests for auto-session behavior. Full test suite: 54 passed.

​

Improvements

​

README branding

• Title updated to Memanto - Memory that AI agents love! to better capture what Memanto delivers to AI agents.

​

New Features

​

Semantic memory engine

• Agents — persistent identity with isolated memory namespaces (e.g. customer-support-bot, dev-assistant).
• Sessions — 6-hour active windows; memories persist forever and remain accessible across all future sessions.
• 13 memory types — fact, preference, decision, goal, instruction, event, and more, each stored with a confidence score.
• Zero-indexing semantic search — memories are available for retrieval the exact millisecond they are written; no indexing delay.
• State-of-the-art accuracy — 89.8% on LongMemEval, 87.1% on LoCoMo.

​

Memanto CLI

• pip install memanto — full memanto command-line interface with organized command groups: agent, memory, session, schedule, config, connect, and core utilities.
• Quickstart workflow:
  memanto                              # initial API key configuration
  memanto agent create my-agent
  memanto remember "Project kickoff is Monday" --type event
  memanto recall "When is project kickoff?"
  

​

REST API

• Full v2 HTTP API for agent lifecycle, session management, memory read/write, recall, and generative answers.
• Dual authentication — Authorization: Bearer <moorcheh-api-key> for all requests; X-Session-Token: <jwt> for memory operations.

​

Developer integrations

• 13+ AI coding assistants and IDEs — Claude Code, Cursor, Cline, Windsurf, Continue, GitHub Copilot, OpenCode, Goose, Roo, Antigravity, Augment, Gemini CLI, Codex.
• Connect via memanto connect <tool> with project-local or --global scope.

​

MemantoClaw

• Open-source reference stack combining OpenClaw, NVIDIA OpenShell, and Memanto memory.
• One-command provisioning — memantoclaw onboard configures inference routing, credentials, and memory bridge automatically.
• Enhanced security — stricter seccomp/Landlock policies, credential filtering, immutable gateway config, host-bridge memory architecture.