​

Security

​

Path traversal via agent_id / session_id / dates

• Unsanitized agent_id / session_id values were concatenated directly into pathlib.Path expressions (e.g. sessions_dir / f"{agent_id}.json"), letting a caller escape the storage directory with input like "../../etc/passwd". All filesystem call-sites now run through validate_safe_id().
• Extended the same guard to memory_export_service, daily_analysis_service (including the date parameter used in glob patterns and JSON output paths), and the --output-path CLI flag (anchored to a base dir via relative_to() containment checks).

​

CORS reflected-origin credential exposure

• Default ALLOWED_ORIGINS=["*"] combined with allow_credentials=True caused Starlette to mirror any request Origin back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true — letting any website make credentialed cross-origin requests to the Memanto API.
• Fixed to stop mirroring arbitrary origins when credentials are allowed.

​

Sensitive Web UI endpoints gated to localhost-only

• POST /api/ui/shutdown, GET /api/ui/browse, PATCH /api/ui/config, PUT /api/ui/api-key, POST /api/ui/onprem/restart, plus the connections and migrate endpoints, were reachable from any network host with no authentication (remote DoS, arbitrary file listing, config/API-key overwrite).
• Added a _require_local() dependency that returns 403 for any caller that isn’t 127.0.0.1 / ::1 (including IPv4-mapped IPv6 loopback), and blocked glob-pattern injection in the browse endpoint.

​

Unpredictable session secret

• Removed the hardcoded default JWT signing secret ("memanto-default-secret-change-in-production").
• When MEMANTO_SECRET_KEY isn’t set, a per-instance random secret is now generated (secrets.token_hex(32)) and persisted locally instead of falling back to a publicly-known constant.

​

Session token lifecycle hardening

• Deactivated/terminated session tokens are now rejected outright (401) instead of continuing to authorize writes.
• Cross-agent session/agent mismatches now consistently raise AuthorizationError → HTTP 403 (was a generic 500) across all session-scoped endpoints.
• CLI clients now validate cached sessions before reuse instead of trusting a stale cached token.
• TypeScript SDK resets its local session state after deleteAgent().

​

Improvements

​

Legacy scope model collapsed to agent_id

• Removed the scope_type / scope_id pair (and the underlying MemoryScope / namespace-parsing machinery) in favor of a single agent_id field; namespaces are now built by one free function (agent_namespace(agent_id)).
• Dead code from this and prior cleanups moved to memanto/app/legacy/ (excluded from CI lint/type-check).
• Removed orphaned “trust” fields that were never populated by any live write/read path (superseded_by, validation_count, contradiction_detected, etc.) and the unused ValidationPolicy class.

​

Confidence filtering bug fix

• Numeric min_confidence filtering in memory search previously relied on Moorcheh keyword syntax that never matched; it’s now applied as a post-filter on the numeric confidence field, fixing a zero-threshold edge case that silently returned nothing.

​

Manual conflict resolution validation

• ConflictResolveRequest now requires non-empty manual_content when action == "manual", both on the API and in the UI (blank submissions show a warning toast and refocus the textarea).

​

Timestamp normalization

• Parsed ISO timestamps are now consistently normalized to UTC, whether the input has an explicit offset or is naive.

​

CLI: honor custom title for short memories

• memanto remember no longer overrides an explicit --title with an auto-truncated content snippet when the memory content is short.

​

Memory deletion response handling

• Tightened success/failure detection for memory deletion and update-then-delete flows so partial or malformed backend responses aren’t reported as success.

​

TypeScript SDK & CI

• Updated dependencies, CI workflow permissions, regenerated openapi.json, and added an npm publishing workflow (.github/workflows/publish.yml).

​

Tests

• New tests/test_cors_fix.py, tests/test_output_path_traversal.py, tests/test_ui_auth.py, tests/test_remaining_ui_auth.py covering the CORS, path-traversal, and localhost-gating fixes.
• New tests/test_memory_read_confidence.py and tests/test_temporal_helpers.py.
• Expanded tests/test_api.py, tests/test_cli.py, tests/test_unit.py for session-secret generation, inactive-token rejection, and deletion handling.

​

New Features

​

TypeScript SDK (sdks/typescript/)

• New @moorcheh-ai/memanto npm package — a fully-typed client generated from the API’s OpenAPI spec (openapi-ts), covering agents, sessions, remember, recall, answer, upload, and the extract/edit endpoints.
• Lifecycle helpers (src/lifecycle.ts) for session start/stop memory flows, plus a doctor command (src/doctor.ts) for config/connectivity checks.
• All recently-added API features exposed as first-class SDK methods.
• CI workflow .github/workflows/sdk-typescript.yml builds, tests (Vitest), and publishes the package; full test suite (memanto.test.ts, lifecycle.test.ts, doctor.test.ts).
• See the TypeScript SDK reference for the full method list.

​

memanto edit command and PATCH endpoint

• New PATCH /{agent_id}/memories/{memory_id} endpoint with MemoryEditRequest for partial in-place updates.
• CLI memanto edit <memory_id> with --title, --content, --type, --confidence, --tags, --source options (at least one required).
• Field validation on both the API and direct-client paths: non-empty content with length limits, confidence range 0.0–1.0, and valid memory-type membership — matching the create-endpoint contract.
• See memanto edit and Edit Memory.

​

v2 memory route response models

• Explicit Pydantic response_model schemas added to the v2 memory routes, giving typed/validated responses and accurate OpenAPI documentation (which in turn feeds the TypeScript SDK codegen).

​

Improvements

​

Local metadata logging

• Session service now logs memory metadata locally alongside the memory write, keeping the local session summary in sync with stored memories.

​

Security

​

Cross-agent authorization returns 403

• All 12 agent-scoped endpoints now return HTTP 403 (not 500) when a session’s agent_id doesn’t match the URL’s agent_id, correctly signaling an authorization failure instead of a server error.

​

Upload path-traversal fixed (CWE-22)

• Uploaded filenames are stripped to their basename (Path.name) with a defense-in-depth realpath check, preventing a crafted filename (e.g. ../../../etc/cron.d/backdoor.txt) from escaping the temp directory.

​

Secrets removed from UI config endpoint

• GET /api/ui/config no longer returns the plaintext Moorcheh API key or session JWT; only safe metadata (api_key_configured, api_key_preview) remains, closing an unauthenticated secret-disclosure path.

​

Tests

• Expanded tests/test_api.py and tests/test_cli.py for the edit endpoint, v2 response models, the 403 scope guard, and filename sanitization.
• New TypeScript test suites under sdks/typescript/test/.

​

New Features

​

Conversation memory extraction

• New POST /{agent_id}/remember/extract endpoint that distills chat-style conversation turns into typed memory candidates, using the same Moorcheh answer-generation path as the RAG answer endpoint.
• Candidates are auto-classified into valid memory types, de-duplicated, confidence-scored, and tagged conversation-extract; secrets, API keys, and tokens are explicitly excluded by the extraction prompt.
• dry_run returns candidates without persisting; otherwise they’re written through the standard batch_remember path and logged to the session summary.
• New ExtractMemoriesRequest / ConversationMessage models with bounded limits (≤200 messages, ≤100 memories, 12k-char cap).
• CLI memanto remember --from-conversation <path|-> reads a JSON message array from a file or stdin, with --dry-run, --max-memories, and --ai-model flags, and renders each extracted candidate as a panel.
• SDK and direct clients gain extract_memories_from_conversation().

​

Improvements

​

Provenance metadata in recall

• recall output now displays Source, Ref, and Provenance for each memory (in addition to tags), unifying file-upload source names and origin (user / agent / tool) into one consistent block.
• MCP MemoryHit model extended with status, source, source_ref, and provenance fields so MCP clients receive full memory metadata.
• Web UI memory cards surface the same source / provenance metadata.

​

Tests

• New tests/test_conversation_memory_extraction.py covering extraction, JSON parsing / normalization, validation limits, and dry-run behavior.
• Expanded tests/test_api.py and tests/test_cli.py for the extract endpoint and --from-conversation CLI flow.

​

New Features

​

memanto migrate command suite

• Replaces the old analyze command with a full migration workflow: export a provider’s data (Mem0, Letta, Supermemory), map each source row onto Memanto memory types (auto-classified via the rule-based parser), bulk-write via batch_remember (100 items/request), and optionally generate a storage/token/latency savings report — all in one command.
• Provider metadata (scope IDs, confidence scores, hashes) is preserved in a bounded [Supporting data] footer so nothing is lost; original created_at / source / source_ref map naturally onto the schema.
• --dry-run previews the mapping (types, confidence, tags) without writing. --report generates the Markdown comparison on real runs. Outputs live in ~/.memanto/migrate/<provider>/<timestamp>/ (separate from legacy analyze/ artifacts).
• Works on both cloud and on-prem backends; on-prem batch_remember respects the same chunking.

​

memanto forget command and REST endpoint

• New DELETE /{agent_id}/memories/{memory_id} endpoint for single-memory deletion. Checks session scope (the session must own the agent) and removes the memory from Moorcheh.
• CLI memanto forget <memory_id> for quick terminal deletion.
• UI Delete button on each memory card in the Memory Explorer.

​

Improvements

​

On-prem backend enhancements

• Session namespace creation now reuses an existing namespace on-prem instead of erroring when the namespace already exists (idempotent namespace setup).
• On-prem forget error messages are now clear and actionable (differentiate “memory not found” from “namespace issue”).
• On-prem threshold boundary checks fixed (no off-by-one on min-similarity validation).

​

Mapper robustness

• Mappers now extract all available info from source exports, including less-common fields like interaction hashes, scope IDs, and custom metadata, preserving them in the [Supporting data] footer for compliance and audit trails.

​

Migrate + on-prem API key handling

• The migrate command correctly propagates the API key dependency for the on-prem backend (no double-init of the backend client).

​

Tests

• New tests/test_cli.py coverage for the migrate and forget commands (dry-run, report generation, single-memory delete flow).
• New tests/test_unit.py coverage for mappers (all three providers) and session namespace idempotency.
• Integration tests expanded across CrewAI and LangGraph tooling.

​

New Features

​

On-prem Moorcheh backend

• New MEMANTO_BACKEND setting (cloud | on-prem) routes every call through a backend-aware dispatcher that exposes the same namespaces / documents / similarity_search / answer / files / vectors shape regardless of target — service code never branches.
• First-run wizard now asks Cloud vs On-Prem; on-prem path installs moorcheh-client>=0.1.3, prompts for embedding + LLM provider (ollama / openai / cohere), persists choices to ~/.memanto/on-prem/state.json, writes the full LLM block to ~/.moorcheh/config.json before moorcheh up, then pulls Ollama models into the container.
• On-prem data lives under ~/.memanto/on-prem/ (sessions, agents, summaries) so cloud and on-prem never share local state; switching backends clears the active session.
• New memanto config backend [cloud|on-prem] CLI command for runtime switching, plus Backend, MOORCHEH_ONPREM_URL (default http://localhost:8080) and MOORCHEH_ONPREM_TIMEOUT (default 300) rows in memanto config show.
• Health check, startup validation, and the agent delete flow are all backend-aware.

​

memanto detect-conflicts + scheduled job split

• Conflict detection split out of daily-summary into its own command, POST /{agent_id}/conflicts/generate REST endpoint, and DirectClient.generate_conflict_report() method.
• New hidden memanto schedule _run entrypoint executes daily-summary + detect-conflicts back-to-back; OS scheduler now points at it. On-prem backend short-circuits with a clear error (scheduled job depends on cloud-only LLM Answer).
• daily_summary_service.py renamed → daily_analysis_service.py.

​

UI: Connect tab, memory timeline, daily summary, file pagination

• Connect tab installs/removes Memanto skills into any registered agent (Claude Code, Cursor, etc.) via the underlying install_agent / remove_agent engine, with a connections.json registry tracking project-local vs global installs.
• Memory History page with a vertical timeline of every change (created, updated, conflict resolved) per memory.
• Daily summary + Unreviewed conflicts widget surfaced on the dashboard (Daily Summary tab renders the generated MD and shows days with pending conflict review).
• Answer panel is backend-aware — on-prem shows provider/model/api-key only (no cloud-only knobs) and writes to ~/.moorcheh/config.json without polluting the shared cloud yaml.
• Memory Explorer now use cursor pagination through documents.fetch_text_data (next_token / has_more) instead of being capped at 100 items per namespace.

​

Improvements

​

Backend-aware recall_* REST endpoints

• recall_as_of, recall_changed_since, recall_recent and the underlying MemoryReadService methods now treat limit=None as “fetch all” — the CostGuard.validate_k_limit cap is only applied when a limit is explicitly set.
• answer.generate calls route through get_active_llm_model() so the LLM identifier comes from cloud settings on cloud, on-prem state.json on on-prem, with the field omitted entirely when on-prem has no LLM configured (server picks its own default).

​

Stale active-session handling

• get_active_session() now clears the stale active marker and returns None when the session has expired, instead of returning an expired Session.
• All datetimes flow through a single utc_now() helper; Pydantic v1 Config.json_encoders blocks removed from session models.

​

Connect engine ↔ registry sync

• install_agent / remove_agent now sync their results into ~/.memanto/connections.json so the UI’s Connections page reflects what the CLI did and vice versa.

​

Tests

• New tests/test_backend.py covering cloud/on-prem dispatcher behavior and get_active_llm_model fallbacks.
• New tests/test_analyze.py covering the Mem0/Letta/Supermemory export + compare + report flow end-to-end with mocked provider responses.
• tests/test_cli.py and tests/test_unit.py expanded to cover the new detect-conflicts / schedule _run paths.

​

New Features

​

Recall similarity threshold

• New recall.min_similarity setting (0.0–1.0) in CLI config with validation; default 0.0.
• REST POST /memories/recall and SDK/Direct recall() resolve min_similarity from the request, then fall back to the config value, then to unset.
• CLI flag renamed --min-confidence → --min-similarity on memanto recall.
• memanto config show surfaces the new Min Similarity row.

​

Agents page in the Web UI

• New sidebar entry listing every registered agent with status, pattern, memory and session counts; activate/deactivate from the table.
• GET /api/v2/agents and GET /api/v2/agents/{agent_id} now populate memory_count from the live Moorcheh namespace document count instead of the stale local metadata value.

​

File upload in the Playground

• New Upload File tab accepts .pdf, .docx, .xlsx, .json, .txt, .csv, .md (max 5 GB) and ingests into the active agent’s namespace, with client-side size/extension validation.

​

Fuzzy fallback for auto memory-type parsing

• When deterministic rules abstain, a rapidfuzz-backed pass scans tokens against a curated list of long, distinctive keywords per type and picks the best match above FUZZY_SCORE_CUTOFF = 88.0 — recovering obvious misspellings like “decded” → decision, “crahsed” / “tracebck” → error.
• New runtime dependency: rapidfuzz>=3.0.0.

​

Smart-parse config switch

• New memanto.cli.smart_parse setting in config.yaml propagates to the AUTO_PARSE_ENABLED env var on startup, letting users toggle auto-parsing without editing code.

​

Improvements

​

CrewAI tool schema

• MemantoRecallTool now exposes min_similarity (0.0–1.0) to the LLM, raises the default limit from 5 to 10, and enforces ge=1, le=100 via Pydantic instead of a hardcoded min(limit, 20) clamp.

​

UI timestamps & filters

• fmtDate appends Z to naive UTC timestamps so the browser converts them to the user’s locale instead of treating them as local time.
• Memory Explorer gains an All Sources filter dropdown; navigation helper goToPage() added; favicon shipped.

​

memanto connect agent templates rewritten

• Reframed as an “active memory companion” with five non-negotiable rules (read MEMORY.md, search before guessing, store proactively, always pass --type/--confidence/--provenance/--source, never keep mental scratchpads).
• Adds an operations table (recall vs answer vs remember), worked memanto remember examples per type, full memory-type/provenance/confidence references, and the new temporal flags (--recent, --as-of, --changed-since).
• Cursor MDC rules file mirrors the same content under alwaysApply: true.

​

Tests

• New fuzzy-fallback cases in tests/test_memory_parsing.py (typo’d decision/error detection; confirms no false-fire on unrelated text).
• tests/conftest.py resets settings.AUTO_PARSE_ENABLED = True before every test so local smart_parse config can’t leak into the suite.

​

New Features

​

Configurable rule-based memory parsing

• MemoryParsingService (memory_parsing_service.py) auto-detects a memory’s type at ingestion using score-based classification with priority tie-breaking across all 13 supported types — no more blind default to fact.
• MemoryRecord.type is now optional (None); the parser assigns the type when the caller omits it.
• New AUTO_PARSE_ENABLED setting (default True).
• remember and batch-remember run the parser when type is omitted and return the resolved type in the response.
• CLI — memanto remember no longer forces --type fact; it displays the parsed type instead.

​

MCP server integration

• The MCP server integration is now available — it exposes Memanto memory operations to any MCP client. Install it with:
  pip install memanto-mcp
  
• See the Integrations section for setup details.

​

Hermes Agents integration

• The Hermes Agents integration is now available — a hermes_memanto provider for Hermes Agents. Install it with:
  pip install hermes-memanto
  
• See the Integrations section for setup details.

​

Improvements

​

Unified content-length cap across layers

• SDK/Direct clients now use InputLimits.MAX_TEXT_LENGTH instead of a hardcoded 500, aligning the cap with the REST/Pydantic models (10,000 chars).
• Removed the unused MAX_MEMORY_SIZE / MAX_TITLE_SIZE settings.

​

Chronological recall --recent

• New recall_recent() on SdkClient and DirectClient returns the most recently stored memories (newest first).
• New memanto recall --recent flag — lists recent memories directly, no search query required (mutually exclusive with --as-of / --changed-since).

​

Unified kiosk_mode and threshold defaults

• kiosk_mode and threshold defaults now resolve from config.yaml.
• threshold is only applied when kiosk_mode is on; the kiosk-mode fallback threshold is unified to 0.15 across REST and config defaults.

​

CrewAI integration

• Install the CrewAI integration with:
  pip install crewai-memanto
  
• LLM tool schemas now enumerate all 13 memory types with definitions to guide classification.
• See the Integrations section for setup details.

​

Docker

• The Docker image can now be pulled directly:
  docker pull moorcheh/memanto:latest
  

​

Breaking Changes

​

Temporal endpoints no longer accept a query

• API — POST /{agent_id}/recall/as-of and POST /{agent_id}/recall/changed-since request bodies dropped the query field; response bodies dropped the echoed query field.
• CLI — memanto recall --as-of … / --changed-since … now errors if a QUERY argument is also supplied. Remove the query to list all memories for that window.
• Python clients — recall_as_of() on DirectClient and SdkClient no longer take a query argument.

​

Improvements

​

Temporal retrieval switched to documents.fetch_text_data

• New _fetch_all_memories() helper (memory_read_service.py) paginates through Moorcheh’s fetch_text_data endpoint across all matched namespaces, applies optional type/tags filters in-process, deduplicates by ID, and strips summary chunks.
• Fewer round trips — search_as_of and recall_changed_since use the fetch path instead of iterating similarity_search.query() per memory type, returning complete result sets within Moorcheh’s 100-item-per-namespace fetch limit.

​

CrewAI integration as a publishable package

• New memanto-crewai package (v0.1.0) in integrations/crewai/ with pyproject.toml, hatchling build backend, MIT license, Python >=3.10.
• Public exports — MemantoSetup, MemantoRememberTool, MemantoRecallTool, MemantoAnswerTool, create_memanto_tools from memanto_crewai.

​

Breaking Changes

​

Memory endpoints migrated to POST

• recall, answer, recall/as-of, recall/changed-since — now accept JSON request bodies instead of query parameters.
• memory_types renamed to type — accepts a list of strings across all recall endpoints and CLI recall commands.

​

Session and auth changes

• /session/current renamed to /status — requires no session token; reads active session from local state.
• /session/extend removed — session extension is no longer supported.
• /sessions list endpoint removed.
• Authorization header dropped for API key — MOORCHEH_API_KEY is read from server config only; Bearer header auth is removed.
• X-Session-Token is the only auth mechanism for per-request memory operations.

​

Legacy routes removed

• /api/v1/namespaces, /api/v1/memory, /api/v2/context — moved to memanto/app/legacy/.

​

New Features

​

Recall and conflict endpoints

• POST /{agent_id}/recall/recent — retrieves most recent memories without a query string; replaces /recall/current.
• GET /{agent_id}/conflicts — lists detected memory contradictions.
• POST /{agent_id}/conflicts/resolve — resolves a flagged contradiction.
• DELETE /agents/{agent_id}?delete-backup-too=true — optionally wipes the agent’s remote Moorcheh namespace on deletion.

​

Startup validation

• Fail-fast API key check — server validates MOORCHEH_API_KEY on startup and refuses to start if missing or authentication fails.

​

Improvements

​

Structured request body models

• Pydantic models (RecallRequest, RecallAsOfRequest, RecallChangedSinceRequest, RecallRecentRequest) with full field validation and bounds checking.
• Smart date defaults — date-only as_of defaults to end-of-day; since defaults to start-of-day, so full ISO datetimes are not required for daily windows.

​

Auth and session service

• get_moorcheh_api_key() reads from server config only — no per-request header parsing.
• verify_moorcheh_api_key() validates once at startup instead of on every request.
• extend_session() removed; moorcheh_api_key parameter removed from create_session(), validate_session(), and renew_session().

​

Health check

• /health no longer requires client dependency injection.
• Status reports "unhealthy" (was "degraded") when Moorcheh is unreachable.

​

CLI

• memanto session extend removed.
• “Activation” terminology replaces “session” across agent create, agent activate, agent deactivate, and memanto status.
• memanto status panel renamed to Active Agent (was “Active Session”).

​

UI Fixes

​

UI shutdown fix

• Server stability — fixed an issue where the API server would unexpectedly shut down when refreshing or closing the browser tab. The server now stays alive unless explicitly stopped or running in specific UI-only modes.

​

Tests

• Added tests/test_e2e.py with end-to-end API coverage.

​

Improvements

​

API input validation

• Content fields — remember, recall, answer, recall/as-of, recall/current, and recall/changed-since enforce min_length=1 on query/content fields and max_length=500 on title.
• Numeric bounds — confidence, min_similarity, threshold, and temperature bounded [0.0, 1.0]; limit enforced ge=1.
• CostGuard validators (validate_text_length, validate_query_length, validate_k_limit) applied across all memory read/write endpoints.

​

Session extension guard

• API — extending a session with additional_hours <= 0 now returns HTTP 422.
• CLI — memanto session extend rejects non-positive --hours values before sending the request.

​

Daily summary custom output path

• output_path parameter added to generate_summary() and generate_daily_summary().
• When provided, the summary Markdown file is written to the specified path; parent directories are created automatically.

​

Agent pattern options

• memanto agent create --pattern help text updated to list only available patterns: project, support, tool (removes unavailable chat, research, custom).

​

Dependencies

• moorcheh-sdk minimum version bumped from >=0.1.0 to >=1.3.5.

​

Bug Fixes

​

UI dashboard authentication

• Root cause — the masked API key was being used for backend authentication, causing all dashboard data to fail loading after login.
• Fix — restored transmission of the full API key in the configuration response so the dashboard can authenticate backend requests properly.
• Display — api_key_preview remains masked (........XXXXXX) in the settings tab; only the backend communication is affected.

​

Tests

• Full test suite: 54 passed. UI connectivity verified.

​

Improvements

​

API key verification

• First-run setup — memanto now actively verifies the key against Moorcheh before saving; invalid keys are rejected immediately; transient network issues surface as a warning rather than blocking setup.
• Lighter auth ping — verification switched from client.namespaces.list() to client.documents.get(...) against a sentinel namespace. NamespaceNotFound is treated as success (key authenticated; namespace simply doesn’t exist).
• Clearer error codes — auth dependency returns 401 on AuthenticationError and 500 on unexpected errors.

​

Server health check

• /health uses the same documents-based ping, so health reflects real authentication state.

​

Configurable summary model

• SUMMARY_MODEL setting (default anthropic.claude-sonnet-4-6) used for daily summary and conflict reports.
• ~/.memanto/config.yaml now supports memanto.summary.model, memanto.answer.model, temperature, and answer_limit — loaded at startup so models can be swapped without code changes.

​

UI security

• /api/ui/config and the API-key update endpoint now return a masked preview (••••••••<last6>) instead of the raw key — plaintext key is no longer sent to the browser.

​

Tests

• Full test suite: 54 passed.

​

Bug Fixes

​

Web UI authentication after CLI activation

• Dashboard, Memory Explorer, recall, and analytics views now load correctly after memanto agent activate.
• “Session may be expired” and “Activate an agent via CLI to explore memories” error states are resolved.

​

Improvements

​

Simplified first-run setup

• Single-step onboarding — memanto setup now prompts only for the Moorcheh API key.
• Removed the schedule time (HH:MM) prompt, related validation, and automatic ScheduleManager().enable(...) call from onboarding.

​

Improvements

​

Onboarding and documentation

• README quick start de-emphasizes memanto serve as a prerequisite — users can run memanto, create an agent, and try memories without keeping a local API process running.
• memanto serve documented as optional, for HTTP/REST use only.
• Agent integration guide shortens quick start to create → remember → recall, and updates Python examples.
• Session architecture doc notes that memanto agent create auto-activates in the CLI.

​

CLI output polish

• memanto status / memanto serve use Local REST API wording; healthy API shows online.
• Success messages drop the OK prefix across agent create, remember, upload, and daily summary flows.
• Welcome Quick Start lists memanto ui, reorders commands, and describes memanto serve as starting the local REST API.

​

memanto connect list

• Column renamed to Agent Name; rows show agent name instead of display_name.

​

Behavioral Changes

• memanto agent create already auto-started a session; docs and Quick Start now consistently reflect this so separate memanto agent activate is not shown as a required step.
• Default session/extension examples reference 6 hours where updated.

​

Tests

• Full test suite: 54 passed.

​

Improvements

​

CLI onboarding flow

• Quick start now shows memanto serve first and guides users to open a new terminal for agent commands.
• memanto serve prints a clear “next step” hint after startup.
• memanto agent create <agent-id> now starts a session automatically.

​

Documentation

• Updated README.md, docs/CLI_USER_GUIDE.md, docs/CLI_INSTALLATION.md, docs/AGENT_INTEGRATION_GUIDE.md.

​

Behavioral Changes

• memanto agent create auto-activates a session — separate memanto agent activate is usually not required in the quick start flow.

​

Tests

• Updated CLI tests for auto-session behavior. Full test suite: 54 passed.

​

Improvements

​

README branding

• Title updated to Memanto - Memory that AI agents love! to better capture what Memanto delivers to AI agents.

​

New Features

​

Semantic memory engine

• Agents — persistent identity with isolated memory namespaces (e.g. customer-support-bot, dev-assistant).
• Sessions — 6-hour active windows; memories persist forever and remain accessible across all future sessions.
• 13 memory types — fact, preference, decision, goal, instruction, event, and more, each stored with a confidence score.
• Zero-indexing semantic search — memories are available for retrieval the exact millisecond they are written; no indexing delay.
• State-of-the-art accuracy — 89.8% on LongMemEval, 87.1% on LoCoMo.

​

Memanto CLI

• pip install memanto — full memanto command-line interface with organized command groups: agent, memory, session, schedule, config, connect, and core utilities.
• Quickstart workflow:
  memanto                              # initial API key configuration
  memanto agent create my-agent
  memanto remember "Project kickoff is Monday" --type event
  memanto recall "When is project kickoff?"
  

​

REST API

• Full v2 HTTP API for agent lifecycle, session management, memory read/write, recall, and generative answers.
• Dual authentication — Authorization: Bearer <moorcheh-api-key> for all requests; X-Session-Token: <jwt> for memory operations.

​

Developer integrations

• 13+ AI coding assistants and IDEs — Claude Code, Cursor, Cline, Windsurf, Continue, GitHub Copilot, OpenCode, Goose, Roo, Antigravity, Augment, Gemini CLI, Codex.
• Connect via memanto connect <tool> with project-local or --global scope.

​

MemantoClaw

• Open-source reference stack combining OpenClaw, NVIDIA OpenShell, and Memanto memory.
• One-command provisioning — memantoclaw onboard configures inference routing, credentials, and memory bridge automatically.
• Enhanced security — stricter seccomp/Landlock policies, credential filtering, immutable gateway config, host-bridge memory architecture.