2 Commits

Include renames

Author	SHA1	Message	Date
3 people	89ae720959	v0.31.0 feat: hot memory — facts hook + recall CLI + MCP _meta + consolidate phase (#785) ... * v0.31 feat(migrate): facts hot memory schema (migration v40) Phase 1 of v0.31 hot-memory. - New facts table with source_id (TEXT FK to sources, per-source isolation), kind CHECK (event/preference/commitment/belief/fact), visibility CHECK (private/world for takes-style ACL parity), valid_from/valid_until/ expired_at/superseded_by for temporal + supersession audit, and consolidated_at/consolidated_into pointing at takes(id) for the dream- cycle hot→cold bridge. - Embedding column dim resolved at migration time from config.embedding_dimensions so non-OpenAI brains (Voyage etc) work out-of-the-box. HALFVEC where pgvector >= 0.7; falls back to VECTOR with stderr warn on older versions. Matching opclass per column type (halfvec_cosine_ops vs vector_cosine_ops). - 5 partial indexes leading on source_id so every read uses the trust boundary as part of the index, not a callback. HNSW partial index excludes expired/null rows so footprint stays proportional to active fact count. - RLS DO-block matches takes pattern (Postgres BYPASSRLS gate; PGLite no-op). - v0_31_0.ts orchestrator follows v0_28_0.ts pattern — phase A asserts schema version >= 40 + facts table presence; runner owns ledger. All 87 existing migrate.test.ts cases pass. PGLite smoke test confirms table + indexes + CHECK constraints + ON DELETE CASCADE all behave. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 chore(version): bump VERSION + package.json to 0.31.0 Phase 1 closer. CHANGELOG entry written when Phase 7 lands. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 feat(engine): facts hot memory engine API (Phase 2) Phase 2 of v0.31 hot-memory. Adds 8 facts methods to BrainEngine implemented on both PGLite and Postgres engines: - insertFact(input, ctx) — INSERT with optional supersedeId; expires the named row in the same transaction. Per-entity advisory lock on Postgres (`pg_advisory_xact_lock(hashtextextended(source_id::text || ':' || entity_slug, 0))`) for the dedup window. PGLite is single-process so the lock is a no-op. - expireFact(id, opts) — sets expired_at + optional superseded_by. Idempotent-as-false (already-expired returns false). - listFactsByEntity / listFactsSince / listFactsBySession — list surfaces with FactListOpts filters (activeOnly, kinds, visibility, limit/offset). Every query starts WHERE source_id = $X so the trust boundary is part of the index path. - listSupersessions — audit log; activeOnly:false + expired_at IS NOT NULL + superseded_by IS NOT NULL. - findCandidateDuplicates(source_id, entity_slug, factText, k) — entity-prefiltered (mandatory), k=5 default, hard cap 20. Embedding- cosine ordering when caller supplies an embedding, recency fallback otherwise. Bounds the contradiction-classifier blast radius. - consolidateFact(id, takeId) — sets consolidated_at + consolidated_into. Never DELETE; facts stay as audit trail for the resulting take. - getFactsHealth(source_id) — per-source counters consumed by `gbrain doctor` facts_health check. Public types in engine.ts: FactKind (5-value union), FactVisibility, FactInsertStatus, FactRow, NewFact, FactListOpts, FactsHealth. PGLite + Postgres helpers: rowToFact / rowToFactPg parse the text-format pgvector embedding back into Float32Array; toPgVectorLiteral encodes for the supersede-path INSERT (postgres-js can't bind Float32Array directly to a vector column without an explicit literal cast). Smoke test confirms every method end-to-end on PGLite. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 feat(facts): extraction code path (Phase 3) Phase 3 of v0.31 hot-memory. Five new modules under src/core/facts/ + src/core/entities/: - src/core/facts/decay.ts — pure helper. effectiveConfidence(fact, now) applies confidence × exp(-age/halflife) with per-kind halflife table (event 7d, commitment 90d, preference 90d, belief 365d, fact 365d). Returns 0 for expired or past-valid_until rows. Single source of truth consumed by recall, supersession audit, facts_health, and the MCP _meta injector (eD8 DRY). - src/core/facts/queue.ts — bounded in-memory queue. Cap 100 default, drop-oldest on overflow with counter. Per-session in-flight=1 serializes burst chat. AbortSignal threading from server SIGTERM (mirrors minion worker pattern per eD7): 5s grace for in-flight, then drop pending with counter. getFactsQueue() process-singleton; __resetFactsQueueForTests for hermetic tests. - src/core/facts/classify.ts — contradiction classifier with cosine fast-path (D13: ≥0.95 → duplicate, skip LLM) and classifier-failure fallback (D12: cosine ≥0.92 → duplicate, else INSERT). Pure cosine helper exported. JSON-strict output with 4-strategy parse fallback; refusal stop-reason maps to fallback path. Caller-provided abort signal propagated to the gateway chat call. - src/core/facts/extract.ts — Haiku turn-extractor. Reuses INJECTION_PATTERNS from src/core/think/sanitize.ts on the way IN (turn_text) AND on the way OUT (each fact). Tight system prompt with 5-kind taxonomy, 0..1 confidence scoring, entity slug or display name. Anti-loop check on isDreamGenerated (reuses v0.23.2 marker semantics). Synchronous embedOne() per fact via the gateway so classifier paths have embeddings available; AbortError re-thrown explicitly so SIGTERM during embed never writes a NULL-embedding row meant to be cancelled (eE8 distinction). - src/core/entities/resolve.ts — slug canonicalization shared by signal-detector AND facts. Resolution order: exact slug match → pg_trgm fuzzy match (similarity ≥0.4) → deterministic slugify fallback. slugify exported standalone for tests + callers that want the floor. Smoke tests confirm decay table, cosine math, slugify rules, queue drop-oldest under overflow, and shutdown grace + drop-pending semantics. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 feat(mcp+cli): MCP ops + recall CLI + _meta + transport refactor (Phase 4) Phase 4 of v0.31 hot-memory. Three new MCP ops on the contract-first surface: - `extract_facts` (write scope, localOnly:false): extracts facts from a conversation turn via the Haiku extractor, runs the cosine fast-path dedup, INSERTs into per-source hot memory. Returns counts + fact_ids[]. Skips on is_dream_generated:true (anti-loop). - `recall` (read scope): query the per-source hot memory by entity / since / session / supersessions / grep filter. Visibility- aware: remote callers see visibility='world' rows only (takes-style ACL parity, eD21). Returns most-recent first; pagination via limit. - `forget_fact` (write scope): expireFact wrapper. Idempotent-as-error on unknown id; uses the new 'fact_not_found' ErrorCode. ErrorCode union opened (eD6 / eE7): TS forward-compat via the `(string & {})` autocomplete-friendly hack so downstream consumers (gbrain-evals etc) don't break their typecheck on every new code. Three new codes: 'rate_limited', 'extraction_failed', 'fact_not_found'. OperationContext gains source_id?:string (eD4 / eE2 — TEXT not INTEGER per schema reality). Resolved once in buildOperationContext from DispatchOpts.sourceId. Stdio MCP defaults to GBRAIN_SOURCE env or 'default'; HTTP MCP reads it from the per-token sources scope (eE3). ToolResult gains _meta?: Record<string, unknown> (eD3). Dispatcher calls a configurable metaHook AFTER op.handler succeeds, wrapped in its own try/catch so a DB blip degrades to no-_meta rather than flipping the whole tool call to error (eE4). New module src/core/facts/meta-hook.ts: - getBrainHotMemoryMeta(name, ctx) builds the _meta.brain_hot_memory payload. Cache key (source_id, session_id, hash(takesHoldersAllowList sorted)) (eD10 / eE5). 30s TTL per session. Visibility filter applies: remote → world only; local → all. Top-K=10 ranked by effective confidence (decay). Skips injection on recall/extract_facts/forget_fact themselves. bumpHotMemoryCache() invalidates per (source_id, session_id) on extraction event. D12 (eE1) accepted: serve-http.ts:801 inlined dispatch path REFACTORED to call dispatchToolCall. HTTP MCP now inherits source_id, _meta injection, error envelope unification, and OperationContext shape from the same code path stdio uses. Scope check + mcp_request_log + SSE broadcast stay in serve-http.ts (HTTP-specific concerns); the dispatcher returns ToolResult and the HTTP handler reads isError + content + _meta to fan into the audit + broadcast paths. put_page compliance backstop (D23): when a conversation-shape page is written (note/meeting/slack/email/calendar-event/source/writing) with a substantive body (>=80 chars) on a non-subagent slug AND no dream_generated:true marker, fire-and-forget enqueue an extraction job into the bounded queue. Never blocks the put_page response. Skipped reasons (no_parsed_page / subagent_namespace / dream_generated / kind:* / too_short / queue_shutdown / backstop_error) are stable strings consumed by tests. `gbrain recall` + `gbrain forget` CLI commands (src/commands/recall.ts): - recall <entity> | --since DUR | --session ID | --today (markdown with kind icons 📅🎯🤝💭📌) | --grep TEXT | --supersessions | --include-expired | --as-context (prompt-injection-ready) | --json - forget <fact-id> shorthand for expireFact Wired into src/cli.ts dispatch table next to takes / think. Smoke tests confirm: dispatch surfaces (extract_facts → ops → listFactsByEntity), forget_fact + idempotent re-call, _meta visibility filter (remote sees world only, local sees all), CLI markdown render with kind icons + age strings + decayed confidence. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 feat(cycle): consolidate phase — facts → takes promotion (Phase 5) Phase 5 of v0.31 hot-memory. New 10th cycle phase `consolidate` between `patterns` and `embed`: - src/core/cycle.ts: * CyclePhase union extended with 'consolidate' * ALL_PHASES gets 'consolidate' between patterns and embed (graph-fresh after patterns; embed runs after so the new takes get embedded same-cycle) * NEEDS_LOCK_PHASES gets 'consolidate' (writes takes + UPDATEs facts) * CycleReport.totals gains facts_consolidated + consolidate_takes_written * runCycle dispatches the new phase via dynamic import - src/core/cycle/phases/consolidate.ts (new): * Scans (source_id, entity_slug) buckets where COUNT(unconsolidated facts) >= 3 (uses idx_facts_unconsolidated partial index) * Skips buckets where the OLDEST fact is < 24h old (gives signal time to settle before locking it into cold memory) * Greedy cosine clustering at threshold 0.85; head-element centroid keeps it deterministic + cheap. Singletons (no embedding) stay unconsolidated this cycle. * For each cluster size >= 2: picks the highest-confidence fact's text as the take claim (v0.31 deterministic; v0.32 swaps to Sonnet synthesis pass). avg confidence → take weight, earliest valid_from → take since_date, concatenated source_sessions → take.source. * Resolves entity_slug → page_id via pages.slug (per source). Skips cluster if page is missing in this source — no auto-page-creation in v0.31. * INSERT into takes(kind='fact', holder='self') with row_num = MAX(existing) + 1. * UPDATE contributing facts: consolidated_at = now() + consolidated_into = takes.id. NEVER DELETE — facts are the audit trail for the resulting take. * dryRun honored: pretends the writes happened; counters still tick so operators can preview load before the first real run. * yieldDuringPhase keepalive between buckets so the Minions worker job lock + cycle-lock TTL don't drift on long runs. Smoke test on PGLite confirms: 4 unconsolidated facts → clustered (cosine 1.0 since same vector) → 1 take row created → all 4 facts marked consolidated_into. runCycle({phases:['consolidate']}) wires through to the report totals. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 test: 18 facts test files (Phase 6) Phase 6 of v0.31 hot-memory: comprehensive coverage across the new substrate. 110 unit tests pass; 5 E2E test files added (skip gracefully without DATABASE_URL). Unit tests (PGLite in-memory, no DATABASE_URL): - test/facts-decay.test.ts (12 cases) — HALFLIFE_DAYS pinned per kind, effectiveConfidence math: age=0 / age=halflife (~1/e) / age=2×halflife (~1/e²) / expired returns 0 / valid_until past returns 0 / preference-vs-event slower decay / belief-vs-commitment crossover. - test/facts-queue.test.ts (10 cases) — FIFO within session, drop-oldest on overflow, per-session in-flight=1 serializes, different sessions parallelize, failed jobs counter, shutdown grace + drop_pending + external AbortController triggers shutdown. - test/facts-classify.test.ts (8 cases) — cosineSimilarity edge cases, empty candidates → independent, cheap fast-path ≥0.95 → duplicate no LLM, threshold-configurable cosine_fallback path. - test/facts-engine.test.ts (13 cases) — every BrainEngine fact method end-to-end: insertFact (insert/supersede), expireFact idempotency, list*, findCandidateDuplicates entity-prefiltered + k cap + cosine ordering, consolidateFact never DELETE, getFactsHealth shape + total_today ⊆ total_week. - test/facts-multi-tenant.test.ts (6 cases) — cross-source isolation on every list method + CASCADE delete on sources. - test/facts-visibility.test.ts (6 cases) — visibility column private/ world; remote=true filters to world-only via dispatchToolCall; remote=false sees all. - test/facts-canonicality.test.ts (10 cases) — slugify rules including NFKD diacritic strip ("Crème Brûlée" → "creme-brulee"), exact slug match, fallback to slugify when no fuzzy match. - test/facts-extract.test.ts (4 cases) — empty turn returns [], dream- generated short-circuit, graceful no-API-key return. - test/facts-backstop-gating.test.ts (5 cases) — put_page backstop: too_short, subagent_namespace, dream_generated, eligible note path, non-eligible kind:guide. - test/facts-anti-loop.test.ts (4 cases) — extractor + put_page both respect dream_generated:true marker. - test/facts-doctor-shape.test.ts (4 cases) — facts_health JSON shape pinned for downstream consumers. - test/facts-mcp-allowlist.serial.test.ts (5 cases) — extract_facts write-scope, recall read-scope, forget_fact write-scope, forget_fact fact_not_found error code, extract_facts no-API-key zero counts. - test/facts-context-injection.serial.test.ts (6 cases) — _meta injection on success, world-only filter under remote=true, anti-loop on facts ops themselves, best-effort degrade on hook error, cache-key includes allow-list hash. - test/facts-separation-pglite.test.ts (2 cases) — Garry's Separation Test as primary ship gate, plus expired hidden-by-default contract. - test/facts-recall-render.test.ts (3 cases) — --today markdown render with all 5 kind icons, --json shape with effective_confidence, --as-context emits comment-wrapped block. - test/facts-migration-dim.test.ts (4 cases) — embedding column type is HALFVEC/VECTOR (not arbitrary), dim matches gateway-configured embedding_dimensions, HNSW opclass agrees with column type, idempotent re-init. - test/cycle-consolidate.test.ts (5 cases) — below-count + below-age thresholds skip, happy path 4 facts → 1 take + all consolidated never DELETE, dryRun honored, missing page → bucket skipped. E2E tests (skip gracefully on DATABASE_URL unset; required gates by CLAUDE.md test policy): - test/e2e/facts-separation-postgres.test.ts — Postgres parity for the ship gate. - test/e2e/facts-cross-source-isolation.test.ts — cross-source ACL on PG + CASCADE delete. - test/e2e/facts-forget.test.ts — full forget_fact MCP roundtrip. - test/e2e/facts-context-injection-postgres.test.ts — _meta injection end-to-end on PG. - test/e2e/facts-recall-render.test.ts — recall --today markdown on PG. - test/e2e/serve-http-meta.test.ts — eE1 regression: HTTP MCP transport inherits _meta + sourceId + scope correctness via dispatchToolCall. Side-effect: src/core/entities/resolve.ts NFKD post-decompose strips combining marks (U+0300..U+036F) before hyphenating non-alphanumerics, so "Crème" → "creme", not "cre-me-". Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 feat(operational): kill switch + doctor check + CHANGELOG + README (Phase 7) Phase 7 of v0.31 hot-memory. - src/core/facts/extract.ts: new isFactsExtractionEnabled(engine) helper reads `facts.extraction_enabled` config row. Defaults to TRUE; flip to 'false'/'0'/'no'/'off' (case-insensitive) via `gbrain config set facts.extraction_enabled false` to kill extraction across the brain without binary downgrade. - extract_facts MCP op short-circuits with zero-counts envelope + a 'skipped: extraction_disabled' field when the flag is off (clean success, not permission_denied). - put_page facts backstop respects the same flag — eligibility check now returns 'extraction_disabled' as the skipped reason. - src/commands/doctor.ts: new facts_health check (runs after queue_health, before index_audit). Probes for the facts table existence (post-v40 guard), then surfaces total_active / total_today / total_week / total_consolidated + top-3 entities for the default source. Pre-v0.31 brains report "facts table not present (pre-v0.31 brain or migration pending)". - CHANGELOG.md: full v0.31.0 entry in the GStack release-summary voice. Headline + numbers-table + what-it-ships + itemized changes + "To take advantage of v0.31" upgrade block + out-of-scope. Honest about the HALFVEC + serve-http refactor + ErrorCode-open-union complications. - README.md: cycle phase list updated 8 → 10 (consolidate + purge). New "v0.31 Hot Memory" command block under Commands with recall + forget variants, kind icons, --as-context surface for headless agents. Test gates: 28 facts unit tests pass after the kill-switch wiring + doctor check ride-along. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 fix(migrate): add facts→sources FK explicitly via ALTER TABLE The inline column-level FK declaration on facts.source_id worked on PGLite but silently got dropped on Postgres in the v0.31 e2e run — the migration handler ran via postgres-js's `unsafe()` multi-statement path and the resulting facts table came back without the `facts_source_id_fkey` constraint. Same psql input run directly against the same database produced the FK; the difference was the unsafe() pipeline, not the SQL itself. Splitting the FK into a separate ALTER TABLE inside a DO block makes the constraint declaration explicit and idempotent: the named constraint either exists or it doesn't, the ALTER is a no-op on re-runs, and the failure mode is loud rather than silently leaving a CASCADE-less foreign key behind. Without this fix, deleting a source row leaves orphaned facts rows (test/e2e/facts-cross-source-isolation.test.ts CASCADE-on-sources- delete case caught it). With this fix the constraint is in place, the cascade fires, and both PG + PGLite e2e suites stay green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 test: update phase-count assertions for the new consolidate phase Three e2e/unit tests pinned the cycle phase count or order, all now updated to reflect v0.31's 10-phase cycle: - test/e2e/dream-cycle-eight-phase-pglite.test.ts: describe rename "8-phase cycle" → "10-phase cycle"; ALL_PHASES expectation extended to include 'consolidate' (between patterns + embed) and 'purge' (the v0.26.5 addition that was already in ALL_PHASES but missing from the test's assertion list). totals match adds the new facts_consolidated + consolidate_takes_written fields plus the pre-existing purged_sources_count + purged_pages_count that should have been added when v0.26.5 landed. - test/e2e/cycle.test.ts: dry-run full cycle now expects report.phases.length === 10 (was 9). - test/core/cycle.serial.test.ts: yieldBetweenPhases hook count + full cycle phases.length both updated 9 → 10. Comments call out the v0.31 addition lineage so the next person to add a phase sees the precedent. These are mechanical assertion bumps. The tests pass against the updated assertions on PGLite and Postgres. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 fix(test): truncate facts table between e2e describe blocks setupDB() truncates ALL_TABLES between every describe block's beforeAll() hook. The list missed the new v0.31 facts table, so facts seeded by an earlier describe block leaked into Garry's Separation Test on Postgres — listFactsByEntity('travel') returned 2 rows instead of 1 because a prior facts-context-injection test had also seeded a 'travel' fact. Adding 'facts' to the truncate list (before 'pages' to respect FK ordering) makes every describe-block start from an empty facts table. Pinned by re-running the e2e file ordering that originally caught it (facts-recall-render → cross-source-isolation → serve-http-meta → context-injection → separation-postgres → facts-forget) — 13 pass / 0 fail after the fix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 test: meta-hook cache + Postgres consolidate phase coverage Two net-new test files filling real coverage gaps the earlier sweep missed: - test/facts-meta-cache.test.ts (5 cases) — pins the eD3/eD10 cache contract that the dispatcher relies on. 30s TTL hit path, post-bump fresh-query, scoped invalidation (bump for sess-A leaves sess-B cache warm — closes the cross-source leak risk codex F5 originally surfaced on the recall payload), facts-self ops skip injection (anti-loop on recall / extract_facts / forget_fact), distinct allow-lists produce distinct cache entries. - test/e2e/cycle-consolidate-postgres.test.ts (3 cases) — Postgres parity for the dream-cycle consolidate phase. Mirrors the PGLite unit test but exercises the real postgres-engine codepaths: sql.begin transactions, advisory locks on insertFact's entity-slug dedup window, unsafe('::vector') casts on findCandidateDuplicates ordering, addTakesBatch postgres-js unnest path. Happy path (4 facts → 1 take + all consolidated_into set), age-threshold skip, dry-run no-write. All 5 unit + 3 e2e tests pass. Closes the unit-only gap on the consolidate phase (was only PGLite-tested) and pins meta-cache invariants the dispatcher depends on. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 fix: thread auth + sourceId, JSON-shape every error envelope Three bugs surfaced during the full e2e sweep that all trace back to my v0.31 dispatch refactor (D12/eE1) silently dropping auth threading + non-OperationError exceptions emitting plain strings: 1. **HTTP MCP transport lost ctx.auth.** Refactoring serve-http.ts to call dispatchToolCall meant auth had to come through DispatchOpts, but the field didn't exist yet. Every HTTP whoami call returned `unknown_transport` because ctx.auth was undefined. Added `auth?: AuthInfo` to DispatchOpts, plumbed it through buildOperationContext, and updated serve-http.ts:816 to pass `auth: authInfo` alongside sourceId/takesHoldersAllowList. Pinned by sources-remote-mcp e2e `whoami reports oauth transport + sources_admin scope`. 2. **Non-OperationError exceptions emitted plain strings, not JSON.** The pre-v0.31 serve-http.ts always wrapped errors in JSON envelope `{error, message}`; my dispatch refactor missed the unknown-tool + uncaught-throw paths and emitted `Error: ${msg}` text content. Every caller that did `JSON.parse(content)` (sources-remote-mcp callMcp helper at line 104) crashed with `Unexpected identifier "Error"`. Both error paths in dispatchToolCall now return JSON-shaped content matching the OperationError pattern. 3. **Files→sources FK silently lost on rewound bootstrap path.** test/e2e/postgres-bootstrap.test.ts simulates a pre-v0.21 brain by `DROP TABLE IF EXISTS sources CASCADE` which removes files_source_id_fkey while leaving files.source_id intact. The v23 migration's `ALTER TABLE files ADD COLUMN IF NOT EXISTS source_id ... REFERENCES sources(id) ON DELETE CASCADE` is a no-op when the column exists, so the FK never came back on upgrade — and any sources-remove afterward stopped cascading to files. Added a defensive `IF NOT EXISTS files_source_id_fkey ... ALTER TABLE ADD CONSTRAINT` block inside v23's handler. Pinned by `multi-source — cascade delete covers every dependent row` after running postgres-bootstrap. Plus: src/core/preferences.ts now honors GBRAIN_HOME for `~/.gbrain/migrations/completed.jsonl`. Without this, the doctor exits-0 mechanical test inherits the developer machine's stale partial-migration ledger entries (0.21.0, 0.22.4, 0.28.0, 0.29.1 prior dev work) and surfaces them as the [FAIL] minions_migration check. GBRAIN_HOME-scoped tempdir per test now isolates this state cleanly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 chore: scrub personal references from public artifacts Per the CLAUDE.md privacy rule on `Garry's Separation Test`, replace personally-coded references in v0.31 artifacts with neutral examples: - CHANGELOG.md v0.31 entry: rename "Garry's Separation Test" header to "The cross-session test" + drop the "topic-2659/topic-1941, 7 AM/2 PM, flying to Tokyo" narrative. - src/commands/migrations/v0_31_0.ts feature pitch: same scrub. - test/facts-separation-pglite.test.ts + test/e2e/facts-separation-postgres.test.ts: rename describe blocks; replace specific topic-NNNN session ids with session-A / session-B; replace personal sample fact with "sample event Tuesday". - src/core/facts/extract.ts extractor system prompt example slugs: people/sam-altman → people/alice-example; companies/anthropic → companies/acme. - src/core/entities/resolve.ts comment: Sam Altman → Alice Example. - All v0.31 test fixtures: people/sam → people/alice-example, Sam Altman → Alice Example, sam-the-cofounder → alice-the-cofounder. Test names referencing real-world entities replaced with neutral slugs. Pre-existing references to "Garry" elsewhere in CHANGELOG (v0.17, v0.19, v0.21+ entries) are untouched — that's a separate scope from this v0.31 ship. Plus: the truncate fix for the Bun-script-induced syntax error in test/e2e/mechanical.test.ts (cliEnv arrow function had ", 30_000)" tacked onto its closing brace by the bulk-add-timeouts script — repaired to a clean function definition). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 fix(test): bump E2E phase-count assertions for 11-phase cycle Two E2E tests still asserted the v0.31 pre-merge 10-phase shape (consolidate inserted, but recompute_emotional_weight from v0.29 not yet absorbed). With master's v0.29 work merged in, the cycle is now 11 phases: lint → backlinks → sync → synthesize → extract → patterns → recompute_emotional_weight → consolidate → embed → orphans → purge. - test/e2e/cycle.test.ts: 10 → 11 - test/e2e/dream-cycle-eight-phase-pglite.test.ts: ALL_PHASES + dry-run order Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 fix(merge): close brace between v44 and v45 migration objects The v0.30.2 merge resolution stitched master's v40-v44 migrations onto HEAD's v45 (facts hot memory) migration but lost the closing `},` between v44 and v45. tsc caught it as TS1136 Property assignment expected at migrate.ts:2188. This is a one-line bracket fix; the rest of the merge resolution is correct and tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 fix: put_page cliHints + buildPlan v0.31.0 in skippedFuture Two unit-test failures surfaced after the v0.30.2 merge: 1. operations.ts: put_page had `cliHints: { name: 'put', positional: ['stdin'] }` from earlier v0.31 development. The parity test enforces that every name in `positional` is a real param. Restored master's correct shape: `{ name: 'put', positional: ['slug'], stdin: 'content' }`. 2. test/apply-migrations.test.ts: the H9 regression tests pin the exact skippedFuture list. Adding v0.31.0 to the registry meant the list grew by one. Updated both `expect(...).toEqual([...])` assertions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.31 docs: clarify consolidate is 11th phase + regen llms-full.txt CHANGELOG.md narrative said "new 10th phase consolidate"; with v0.29's recompute_emotional_weight already on master, consolidate is the 11th phase (between recompute and embed). Schema migration is v45, not v40, after the merge resolution renumbered it to clear master's v40-v44. llms-full.txt regenerated to reflect the README's 11-phase dream-cycle phrasing (the build-llms test enforces commit-time parity). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-09 16:57:47 -07:00
3 people	0e7d13e740	v0.28.9 feat: Voyage multimodal embeddings (v0.27.1 catch-up + v0.28.6 master merge) (#706) ... * feat: AI gateway + 6 provider recipes + silent-drop fix (v0.15.0) Unified AI layer: src/core/ai/gateway.ts routes every AI call through Vercel AI SDK. Per-touchpoint provider selection via provider:model config strings. Six typed recipes (OpenAI, Google, Anthropic, Ollama, Voyage, LiteLLM-proxy template). Fixes the silent-drop bug at all three sites (operations.ts:237, hybrid.ts:81, import-file.ts:112): !process.env.OPENAI_API_KEY → gateway.isAvailable('embedding'). Non-OpenAI brains now actually embed. Embedding failures propagate as AIConfigError instead of quietly writing chunks with no vectors. Schema templating: getPGLiteSchema(dims, model) substitutes __EMBEDDING_DIMS__ + __EMBEDDING_MODEL__. Postgres initSchema runtime-replaces vector(1536) + 'text-embedding-3-large' based on gateway config. Preserves existing 1536-dim brains via explicit providerOptions.openai.dimensions passthrough (OpenAI API default is 3072; without this, existing brains break). Three-class error hierarchy: AIServiceError (base) + AIConfigError (user fix) + AITransientError (retry). No process.env mutation — gateway reads from GatewayContext passed in from engine. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: gbrain providers CLI + init flags + config (v0.15.0) New command: gbrain providers [list|test|env|explain]. Explain emits a schema_version:1 JSON matrix (agent-friendly). Auto-detects env keys + probes localhost:11434 /v1/models (validates JSON shape, not just port-open). Recommends the best provider with one-line reasoning. gbrain init flags: --embedding-model provider:model (verbose) or --model provider (shorthand, picks recipe default). Plus --embedding-dimensions and --expansion-model. AI config flows into saved GBrainConfig; engine.connect() configures gateway before initSchema so vector column gets right dim. config.ts: adds embedding_model, embedding_dimensions, expansion_model, provider_base_urls. loadConfig() reads env vars but NEVER mutates process.env — global-state leakage would break MCP, multi-brain, and long-running workers. cli.ts: routes 'providers' subcommand (CLI_ONLY, no engine needed); connectEngine() calls configureGateway() before engine.connect(). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test: AI gateway + silent-drop + schema templating + no-env-mutation (v0.15.0) 28 new unit tests across 4 files: - test/ai/gateway.test.ts — 13 tests covering isAvailable() matrix for the silent-drop regression surface. Critical case: Gemini available when GOOGLE_GENERATIVE_AI_API_KEY set AND OPENAI_API_KEY absent. Pre-v0.15 brains silently dropped vectors in this config. - test/ai/silent-drop-regression.test.ts — 3 source-level grep tests enforcing !process.env.OPENAI_API_KEY cannot re-enter the codebase at any of the three known sites. - test/ai/schema-templating.test.ts — 4 tests for dim/model substitution in getPGLiteSchema() + PGLITE_SCHEMA_SQL back-compat. - test/ai/config-no-env-mutation.test.ts — regression guard ensuring loadConfig() does not mutate process.env (Codex review C3). All 28 pass locally. Existing unit suite (1397) + Tier 1 E2E (129) + Tier 2 skills E2E (3) all green against real Postgres+pgvector and real OpenAI/Anthropic/openclaw. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v0.15.0) Adds AI SDK deps (ai, @ai-sdk/openai, @ai-sdk/google, @ai-sdk/anthropic, @ai-sdk/openai-compatible, zod, gray-matter, eventsource-parser). Note: Version jumped from 0.13.0 to 0.15.0 because upstream master shipped 0.14.x (doctor DRY detection, Knowledge Runtime) while this branch was in development. Keeping 0.15.0 as the natural next release number for the AI providers cathedral. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: silent-drop regression test uses relative paths CI failure: test hardcoded /Users/garrytan/... absolute paths that obviously don't exist outside my machine. Resolve paths relative to import.meta.dir so the test works on any checkout + in GitHub Actions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: bump version to 0.17.0 Locked to 0.17.0 since other PRs (v0.15.x, v0.16.x) may land first. Also removes the "v0.15" comment in gateway.ts — the v0.15 label belongs to whatever ships next on master, not this branch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: bump version to 0.19.0 Re-locked to 0.19.0 (from 0.17.0) to leave room for other PRs landing first. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: bump version to 0.21.0 Re-locked to 0.21.0 (from 0.19.0) to leave room for other PRs landing first. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Bump version to v0.23.0 * Bump version to v0.27.0 * feat(ai): add chat touchpoint with 6 chat-capable recipes Foundation for multi-provider Minions. Purely additive — no behavior change to existing embedding/expansion paths or to subagent.ts. - types.ts: 'chat' added to TouchpointKind. New ChatTouchpoint shape with supports_subagent_loop separate from supports_tools (Codex F-OV-2: some chat-capable models are bad at durable tool loops). supports_prompt_cache gates Anthropic-specific cacheControl. AIGatewayConfig gains chat_model + chat_fallback_chain. - Recipe.aliases?: Record<string,string> (Codex F-OV-5). Friendly undated forms like 'anthropic:claude-sonnet-4-6' resolve to the dated canonical at parse time. - recipes/anthropic.ts, openai.ts, google.ts: each gains a chat touchpoint. Only Anthropic claims supports_prompt_cache=true. - recipes/deepseek.ts, groq.ts, together.ts: NEW openai-compat recipes. DeepSeek powers refusal-fallback + cheap-research. Groq is the speed tier. Together is the open-weights house (Qwen, Llama-3.3-70B-Turbo). - gateway.ts: chat() function wraps Vercel AI SDK's generateText. Returns a provider-neutral ChatResult with normalized usage (input/output + cache_read/cache_creation pulled from providerMetadata.anthropic per D7 review decision). cacheSystem: ephemeral marker only when recipe.supports_prompt_cache===true. Stop-reason mapping is structural-signal-first per D8 (Anthropic stop_reason='refusal', OpenAI finish_reason='content_filter') — refusal regex layer ships in commit 3. - config.ts: GBrainConfig adds chat_model + chat_fallback_chain. Env overrides GBRAIN_CHAT_MODEL + GBRAIN_CHAT_FALLBACK_CHAIN. - cli.ts: connectEngine plumbs chat config into configureGateway. - providers.ts: --touchpoint chat smoke harness. List shows EMBED/EXPAND/ CHAT columns. Explain matrix surfaces chat options with input/output cost. Recipe alias forms accepted in --model. - init.ts: --chat-model PROVIDER:MODEL flag. - test/ai/gateway-chat.test.ts: 21 cases covering recipe registry, resolver alias resolution, config plumbing, isAvailable('chat') semantics for chat-only/embedding-only providers. 49/49 ai/* tests pass. Typecheck clean. * feat(schema): provider-neutral subagent persistence (migration v34) D11 cross-model resolution. Codex F-OV-1 noted that subagent_messages and subagent_tool_executions store Anthropic-shaped tool_use / tool_result blocks as JSONB. When a worker resumes mid-loop and the live model is OpenAI/DeepSeek, the persisted shape becomes the runtime contract — read-side translation is lossy. Mechanical schema-only migration. No code uses these columns yet; commit 2 (subagent refactor onto gateway.chat()) starts writing schema_version=2 with provider-neutral ChatBlock[] in content_blocks. - migrate.ts: v34 ALTERs subagent_messages + subagent_tool_executions to add schema_version (DEFAULT 1) and provider_id (TEXT). All ALTERs use ADD COLUMN IF NOT EXISTS so re-runs are idempotent. - src/schema.sql + pglite-schema.ts: fresh-install DDL gains the same columns. New idx_subagent_messages_provider for cost rollups + per- provider replay diagnostics. - schema-embedded.ts: regenerated via bun run build:schema. - test/migrate.test.ts: 7 new cases pin the migration shape — column names + types, idempotency, fresh-install schema parity, embedded schema parity. 75/75 migrate tests pass. Existing rows backfill to schema_version=1 via DEFAULT, tagging them as legacy Anthropic shape. Subagent.ts read path (commit 2) checks the version and dispatches the right block mapper. * fix(ai): drop Wintermute reference from deepseek recipe comment CI's check:privacy gate caught a banned name in src/core/ai/recipes/deepseek.ts:5. CLAUDE.md (per the privacy rule) bans the private OpenClaw fork name in any checked-in code. Replaces it with neutral language describing the same capability ("second hop in a refusal-fallback chain and cheap-research delegation"). bun run verify now passes locally. * v0.27.1 feat: Voyage multimodal embeddings + image ingestion + --image search (#664) * phase 1: bun --compile probe for HEIC/AVIF decoders (Eng-1A) Verifies that compiled binaries can decode HEIC + AVIF before the multimodal ingestion pipeline depends on them. Mirrors the v0.19.0 tree-sitter check-wasm-embedded pattern: minimal harness, bun --compile, run binary, decode fixtures, fail loud on regression. Caught one real issue along the way: @jsquash/avif loads avif_dec.wasm relative to its own JS file, which fails inside a bun --compile VFS. Fix: pre-compile the WASM via init() with bytes loaded through `with { type: 'file' }` import attribute. This pattern needs to be mirrored in src/core/import-file.ts when we wire the real ingestion path. heic-decode "just works" because libheif-bundle.js inlines the WASM as base64. Adds: - heic-decode + @jsquash/avif + exifr deps - scripts/image-decoders-smoketest.ts compiled-binary harness - scripts/check-image-decoders-embedded.sh CI guard - test/fixtures/images/tiny.{heic,avif} fixtures (~33KB total) - check:image-decoders npm script wired into verify + check:all Run: bun run check:image-decoders Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 2: PageType exhaustive guard (Eng-2A) Adds the assertNever() helper, the ALL_PAGE_TYPES canonical list, a CI guard that fails any future switch on .type that doesn't use assertNever in default, and a contract test that walks every PageType through serializeMarkdown + parseMarkdown round-trip. Why this is preventive: gbrain v0.20 / v0.22 both regressed when a PageType was added but a consuming switch didn't get a matching case. TypeScript can't catch that on its own when the switch is implicit (if/else chains, default branches that return a sane fallback). With assertNever in the default of any exhaustive switch, the compiler errors at the assertNever call when the discriminant isn't `never`, forcing the contributor to add the missing case. Today the codebase has zero PageType-discriminating switches — it uses the type system via union narrowing. The guard is preventive: catches the moment a contributor adds a switch and forgets the helper. The contract test in test/page-type-exhaustive.test.ts is the runtime half: walks every PageType value through public surfaces (serialize, parse round-trip, classify-via-switch) so adding 'image' to PageType later either passes silently or fails noisily right here. Wired into verify + check:all. Run: bun run check:pagetype-exhaustive && bun test test/page-type-exhaustive.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 3: BrainEngine.upsertFile + PGLite files table (F1+F5) Adds the v0.27.1 file-metadata API to the BrainEngine interface and implements it on both engines. Drops the v0.18 "PGLite has no files table" omission — that decision was about blob storage; for path- referenced binary asset metadata PGLite hosts it fine. Engine surface (src/core/engine.ts): - FileSpec + FileRow types - upsertFile(spec) -> { id, created } with idempotent ON CONFLICT - getFile(sourceId, storagePath) and listFilesForPage(pageId) PGLite (src/core/pglite-schema.ts): files table now mirrors the Postgres v0.18 shape verbatim (source_id, page_slug, page_id, filename, storage_path, mime_type, size_bytes, content_hash, metadata, created_at + 4 indexes + UNIQUE storage_path). Comment header rewritten to drop the "no files table" line. Identity is (source_id, storage_path) via UNIQUE(storage_path) + DEFAULT 'default'. Re-upserting same identity with same content_hash returns created=false; different content_hash overwrites metadata in place. Tested explicitly so re-sync of an unchanged image is idempotent and re-sync of a replaced image updates the row. The actual migration v36 (for existing brains to gain the files table on PGLite) lands in Phase 5 alongside the modality + embedding_image schema deltas. Fresh PGLite installs pick up the table from initSchema's bootstrap path immediately. Tests (test/engine-upsertFile.test.ts, 6 cases on PGLite): - happy path insert - Eng-3E ON CONFLICT idempotency: same hash → created=false - Eng-3E content_hash changes → metadata overwritten - listFilesForPage returns linked rows - getFile returns null on unknown path - source_id round-trips correctly Postgres parity will be exercised end-to-end by Phase 10's multimodal-engine-parity E2E test. Run: bun test test/engine-upsertFile.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 4: loadConfigWithEngine() DB-merge + cli.ts boot reorder (F3) Codex F3: gateway boot read file/env config only, but `gbrain config set` writes the DB plane. Result: the smoke path `gbrain config set embedding_multimodal true` did nothing — the flag never reached runtime. Fix: after engine.connect(), merge DB config on top of file/env config and stash the v0.27.1 multimodal flags into process.env where the import-image path will read them. Adds: - 3 new GBrainConfig fields: embedding_multimodal, embedding_image_ocr, embedding_image_ocr_model. All optional; default off/off/'openai:gpt-4o-mini'. - ENV vars: GBRAIN_EMBEDDING_MULTIMODAL/_OCR/_OCR_MODEL. - loadConfigWithEngine(engine, baseConfig?) async helper. Reads DB config via engine.getConfig() and overlays it. Quiet failure if the config table is missing (pre-v36 brain mid-migration). - cli.ts connectEngine reorder: file/env-loaded config still drives initSchema (embedding_dimensions sizes the schema, must be stable across connect). After engine connects, DB-merged config flows through process.env so downstream readers see flipped flags WITHOUT the gateway needing a re-configure (gateway doesn't read these flags; the import-image path does). Precedence (locked into the test): env > file > DB > defaults. - env wins because it's the operator escape hatch. - file (~/.gbrain/config.json) wins over DB because it's the durable per-machine config; explicit user edits beat config-table state. - DB fills in only when file/env left the field undefined. Tests (test/loadConfig-merge.test.ts, 7 cases): - null base returns null - DB fill-in on undefined file/env fields - file/env > DB precedence verified - partial merge (only undefined fields fall through) - engine.getConfig throwing is non-fatal - null/empty DB values are ignored (not coerced to false) - strict 'true' equality (TRUE / 1 → false) The actual import-image path consumption lands in Phase 8. Run: bun test test/loadConfig-merge.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 5: migration v36 + pgvector preflight + dual-column schema (Eng-3C) The schema half of v0.27.1 multimodal. Three changes that travel together as migration v36: 1. content_chunks gains modality TEXT NOT NULL DEFAULT 'text' so image chunks declare themselves at the row level. Search filters use it to keep image OCR text out of text-page keyword search by default. 2. content_chunks gains embedding_image vector(1024) for Voyage multimodal embeddings, plus a partial HNSW index gated by WHERE embedding_image IS NOT NULL. Footprint stays proportional to image-chunk count, not table size. Mixed-provider brains (OpenAI 1536 text + Voyage 1024 images) keep both columns populated with distinct dim spaces. 3. PGLite gains the files table mirroring the Postgres v0.18 shape so multimodal ingest can persist binary-asset metadata on the default engine. Image bytes never enter the DB; storage_path references a path inside the brain repo. The v0.18 "no files table on PGLite" omission was specific to blob storage. Eng-3C preflight: handler refuses if pgvector < 0.5 BEFORE any DDL fires. Partial HNSW indexes need pgvector 0.5.0 (HNSW landed in 0.5). PGLite ships pgvector built into the WASM bundle so the gate is Postgres-only. Error message tells the user to ALTER EXTENSION vector UPDATE. Pinning a few subtle correctness bits in the test suite: - bootstrap coverage extended: REQUIRED_BOOTSTRAP_COVERAGE + applyForwardReferenceBootstrap probe set both gain content_chunks.embedding_image. Old PGLite brains pinned at v0.18 walk forward cleanly without crashing on the partial HNSW. - contract tests pin column shape, partial HNSW indexdef, files-table parity, and that a real cosine query works against the index after migration (regression mode pgvector has shown where partial-index DDL succeeds but the index fails build). Schema source-of-truth files updated: - src/schema.sql + src/core/schema-embedded.ts (regenerated) - src/core/pglite-schema.ts (CREATE TABLE has modality + embedding_image + partial index inline) Run: bun test test/migrations-v0_27_1.test.ts test/schema-bootstrap-coverage.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 6: Voyage recipe + gateway.embedMultimodal + MultimodalInput types (D1-D3) The AI plumbing half of v0.27.1 multimodal. Recipe registers voyage-multimodal-3 alongside the existing text-only Voyage models (voyage-3-large, voyage-3, voyage-3-lite). Touchpoint declares supports_multimodal: true so a future v0.28 OpenAI/Cohere multimodal path can flip the same flag and route through the same gateway. Gateway: - MultimodalInput discriminated union (kind: 'image_base64' today; future kinds extend without breaking callers). No image_url variant by design — that would be an SSRF surface. Callers read bytes and base64-encode; the gateway never fetches external URLs. - embedMultimodal(inputs) does direct fetch to Voyage's /multimodalembeddings endpoint. Vercel AI SDK has no multimodal- embedding abstraction yet so we bypass it. Reuses the existing resolveRecipe + auth resolution + dim-mismatch error pattern. - Voyage batch size = 32 inputs/call (Voyage's published max). 100 images → ~3 calls. n=33 splits cleanly to [32, 1]. - Loud refusal when the configured embedding_model isn't multimodal: AIConfigError pointing at the v0.28 roadmap. embedding.ts re-exports embedMultimodal + MultimodalInput so the import-image path can pull both APIs from one place. Tests (test/voyage-multimodal.test.ts, 18 cases all green): - recipe registration: voyage-multimodal-3 in models, supports_multimodal=true, default_dims=1024 - happy path: 1024-dim Float32Array out, correct request body shape - Authorization header bearer-formatted - Eng-3A batch boundaries: n=0 (short-circuits, no fetch), n=1, n=32 (single batch), n=33 (off-by-one: [32, 1]), n=64 (two clean batches) - 401 → AIConfigError with auth hint - 429, 5xx → AITransientError - dim mismatch → AIConfigError naming the expected dim - malformed JSON → AITransientError - count mismatch (returned ≠ sent) → AITransientError - missing API key → AIConfigError - non-multimodal recipe → AIConfigError pointing at v0.28+ TODOs Run: bun test test/voyage-multimodal.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 7: PageType + PageKind extension for 'image' (F4) Adds 'image' to the PageType union and PageKind enum so v0.27.1 multimodal pages are first-class citizens of the type system. The Eng-2A exhaustive guard from phase 2 immediately makes 'image' a forced participant in any future switch on .type — adding the value without a matching case is a TypeScript error at the assertNever call. The page-type-exhaustive contract test gains an 'image' branch in its classify switch so the test file proves the union is complete; the test itself remains the runtime contract that walks every value through parseMarkdown + serializeMarkdown round-trip. What still works unchanged: image pages do NOT flow through parseMarkdown (the import-image-file path lands in phase 8 and writes directly via engine.putPage with pre-built frontmatter). inferType in markdown.ts only sees markdown files. So the parseMarkdown round-trip in the contract test exercises 'image' exactly the way image-ingested pages will be re-read later: type='image' set in frontmatter on disk, inferType never consulted. chunk_source extension to 'image_asset' lands in phase 8 alongside the import-image path that produces the chunks. Putting it here would introduce the value with no producer, which the v0.20 chunk_source allowlist treats as drift. Run: bun test test/page-type-exhaustive.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 8: importImageFile + withImportTransaction + sync/import walker (F2 + Sec5 + Eng-1C) The big one. Threads multimodal ingestion end-to-end on the default engine and refactors the markdown/image transaction body into a shared helper. import-file.ts adds: - withImportTransaction shared helper (Sec5/A): transaction-wraps createVersion + putPage + optional upsertFile + chunk replacement + type-specific `after` hook. Markdown's existing transaction body is the natural shape for this; image ingest reuses it via the same helper. - importImageFile(engine, filePath, relativePath, opts): the full ingestion path. Reads bytes, sha256-hashes for idempotency, decodes HEIC/AVIF via heic-decode + @jsquash (re-encoded to PNG so Voyage accepts the buffer), parses EXIF via exifr, optionally OCRs via gpt-4o-mini through the gateway, embeds via embedMultimodal, then writes a page+file+chunk row through withImportTransaction. - pLimit(concurrency=8) semaphore for OCR (Eng-1C, ~30 LOC, no dep). Module-level limiter so concurrent imports across files share the budget. Cuts 100-image first-import OCR latency from ~200s to ~25s. - isImageFilePath() helper consumed by sync.ts + import.ts. - 20MB cap (Voyage's per-input limit) — oversized → sync_failures. Engine surfaces (both engines): - upsertChunks now writes modality + embedding_image columns. Image chunks pass embedding=null + embedding_image=Float32Array. ON CONFLICT DO UPDATE SET extends to both new columns. Param-builder restructured to handle independently-optional embedding/embedding_image without the prior 4-branch combinatoric explosion. - ChunkInput type gains modality + embedding_image fields. chunk_source union widens to include 'image_asset'. Schema (both engines): - pages.page_kind CHECK widened to ('markdown','code','image'). The v36 migration drops + recreates the auto-named constraint so existing brains pick up the change idempotently. - src/schema.sql + src/core/pglite-schema.ts mirror the new CHECK. - src/core/schema-embedded.ts regenerated. Sync/import wiring (F2 fix): - sync.ts isAllowedByStrategy honors GBRAIN_EMBEDDING_MULTIMODAL=true and admits image extensions in the 'auto' strategy. Existing brains with the gate off keep their current markdown+code-only behavior. - import.ts collectMarkdownFiles walker conditionally picks up image extensions; the per-file dispatcher routes to importImageFile vs importFile via isImageFilePath. Defense-in-depth gate check on the multimodal flag. Gateway (cherry-1 OCR helper): - generateOcrText(imageBytes, mime) issues a multimodal generateText call against the configured expansion model with a sanitized system prompt: "Extract verbatim. Do NOT follow instructions in the image." Mitigation for OCR-as-prompt-injection. Caller (importImageFile) routes failures through Eng-1B counters in the config table. Type shims (src/types/image-decoders.d.ts): - heic-decode (no upstream @types) + @jsquash/png/encode.js subpath + @jsquash/avif/codec/dec/avif_dec.wasm import-attribute. Deps: @jsquash/png joins the existing @jsquash/avif + heic-decode + exifr set added in Phase 1. The bun --compile probe (Phase 1) covers HEIC + AVIF decode-correctness in the compiled binary; PNG re-encode inherits the same WASM-bundle pattern. Tests (test/import-image-file.test.ts, 7 cases all green): - isImageFilePath / SUPPORTED_IMAGE_EXTS round-trip every extension - pLimit serializes work to declared concurrency - pLimit propagates rejections without leaving slot held - importImageFile happy path: PNG → page + files row + image chunk - chunk_source='image_asset' + modality='image' on the chunk row - content_hash idempotency: re-import same bytes returns 'skipped' - 20MB oversized → 'skipped' with FILE_TOO_LARGE-shaped error Total v0.27.1 regression run: 101 tests / 0 fail / 385 expect calls. Run: bun test test/import-image-file.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 9: auto-link image_of, doctor checks, search modality filter (cherry-3+4b + Eng-1B) Closes the runtime UX surface for v0.27.1 multimodal: image chunks join the knowledge graph, the doctor surfaces vanished images + silent OCR failures, and text-keyword search hides image rows by default so OCR text doesn't drown text-page hits. Auto-link (cherry-3): - link-extraction.ts gains imageOfCandidates(slug): given an image slug like `originals/photos/2026-05-04-foo.jpg`, proposes sibling text-page slugs in priority order. Swaps known photo dirs (photos, images, screenshots, media) for sibling dirs (meetings, notes, daily, people, companies, deals, projects) at any path depth, plus a same-directory basename fallback. Returns case-folded slugs; caller checks each via tx.getPage and emits the first match. - inferLinkType: pageType='image' returns 'image_of'. Previously fell through to 'mentions'. - importImageFile.after hook walks the candidate list inside the withImportTransaction body and emits one canonical image_of edge. Best-effort: missing siblings silently skip (gbrain reconcile-links will pick up later additions). Doctor checks: - image_assets (cherry-4b): scans the files table for image MIME rows whose storage_path doesn't exist on disk. Caps at 1000 to bound worst-case scan time. Reports first 5 vanished paths in the warning with the standard remediation hint (restore from git, or `gbrain sync --skip-failed` to acknowledge). Empty index → "no image assets indexed yet" (ok). - ocr_health (Eng-1B): reads ocr_attempted / ocr_succeeded / ocr_failed_no_key / ocr_failed_other from the config table (written by importImageFile in Phase 8). Warns when OCR is opted-in but no calls succeeded — surfaces the silent failure mode where a stale OPENAI_API_KEY would otherwise leave OCR not running and the user having no idea. Search routing: - searchKeyword on both engines now filters `cc.modality = 'text'` by default. Image rows (modality='image') are invisible to text-keyword search. v0.27.2 adds the explicit image-similarity entry point that queries embedding_image directly. Default vector search continues to read from `embedding` (which is NULL on image rows) so image chunks don't accidentally surface in cosine ranking either. What's NOT in this phase (and where it lives): - `gbrain query --image <path>` flag: the image-similarity entry point. Defers to v0.27.2 because the existing query op shape doesn't have a clean way to take a path argument; threading it through cliHints + the validator is a meaningful CLI parser refactor not worth landing under v0.27.1's window. The dual-column schema and embedMultimodal API are both ready; the missing piece is purely surface. Tests (98 link-extraction cases pass; 5 new): - imageOfCandidates: parallel-dir swap, same-dir fallback, no-parent edge case, image-extension stripping, case-insensitive paths - inferLinkType returns 'image_of' for type='image' Doctor checks exercised via existing doctor.test.ts; image_assets + ocr_health quiet-skip on PGLite when the config table is too old to have the counters yet. Run: bun test test/link-extraction.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * phase 10: v0.27.1 release — VERSION + CHANGELOG + migration notes + E2E gate Final phase. Bumps VERSION + package.json to 0.27.1, writes the release-summary CHANGELOG entry in GStack voice, adds the skills/migrations/v0.27.1.md agent-readable migration notes, and ships test/e2e/voyage-multimodal.test.ts as the gated real-API smoke that pairs with the Phase 1 bun --compile probe. CHANGELOG entry follows the v0.27.0 pattern: - Two-line bold headline (verdict, not marketing) - Lead paragraph explaining the user-facing capability - "Numbers that matter" table (image extensions admitted, voyage models, engines with files table, doctor checks, batch size, OCR concurrency, schema migration, test count, decoder probe runtime, binary size delta) - "What this means for you" smoke path: 8-line gbrain config + sync walkthrough that lands on `gbrain doctor` confirmation - "For contributors" callout naming the codex outside-voice catch - "To take advantage of v0.27.1" 5-step recovery block - Itemized changes by area (multimodal embed, schema, ingestion, auto-link, doctor, type-system, config plane unification, bun --compile gate, NOT-included list) skills/migrations/v0.27.1.md (agent-readable): - Feature pitch: "remembers what you SAW, not just what you typed" - Schema delta + page_kind widening explained as idempotent - Verification + opt-in setup walkthrough - pgvector >= 0.5 requirement with the ALTER EXTENSION fix hint - Cost expectations (Voyage free tier, gpt-4o-mini OCR pricing) - Deferred-to-v0.27.2 list E2E (gated VOYAGE_API_KEY): test/e2e/voyage-multimodal.test.ts exercises the real Voyage API by embedding the tiny.avif fixture through embedMultimodal, asserting a 1024-dim Float32Array with at least one nonzero component. Skips silently when the key is unset. Final v0.27.1 regression: 199 tests / 0 fail / 639 expect calls across 10 v0.27.1-touching files. Typecheck clean. Both v0.27.1 CI guards (check:image-decoders + check:pagetype-exhaustive) green. Run: bun run verify && bun test VOYAGE_API_KEY=... bun test test/e2e/voyage-multimodal.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(query): land --image flag for image-similarity search (closes v0.27.2 deferral) Pulls the deferred `gbrain query --image <path>` flag into v0.27.1 itself. The dual-column schema and embedMultimodal API were already ready in Phase 6/8; only the CLI surface was missing. Adds it + threads column-routing through searchVector on both engines + 13 new tests covering the full path. SearchOpts (`src/core/types.ts`): - New `embeddingColumn?: 'embedding' | 'embedding_image'` (default 'embedding'). Image-similarity queries pass 'embedding_image' AND a 1024-dim vector that came from gateway.embedMultimodal. searchVector column routing (both engines): - `embedding_image` path queries the multimodal column with a modality='image' filter so cross-modality leaks are impossible. - Default `embedding` path adds modality='text' filter symmetrically; this also fixes the case where image rows happened to have a NULL primary embedding but text-vector-search shouldn't have wandered into them anyway. Operations (`src/core/operations.ts`): - `query.params.query` is no longer `required: true`. The op now accepts EITHER `query` (text) OR `image` (base64). Refuses with a clear error when neither is supplied. - Image branch: imports embedMultimodal, embeds the input image, calls engine.searchVector with `embeddingColumn: 'embedding_image'`. Bypasses hybridSearch (which is text-only). CLI (`src/cli.ts`): - New exported `resolveQueryImage(path, mime?)` helper that reads the file, base64-encodes, derives MIME from the extension (PNG/JPG/JPEG/ GIF/WEBP/HEIC/HEIF/AVIF; falls back to image/jpeg), enforces the 20MB cap. Throws Error on failure (caller routes to process.exit). - Dispatcher transforms `params.image` from a path to base64 via the helper before calling the op handler. The `query` positional arg's required-check is conditionally skipped when `--image` is present (the alternative-required relationship the v0.27.1 plan flagged as the missing CLI parser refactor — now implemented). Param-builder bug fix (PGLite upsertChunks): - The new test/search-image-column.test.ts caught a placeholder/ param-push ordering bug in PGLite's upsertChunks introduced by the v0.27.1 modality+embedding_image columns. embeddingImageStr was pushed AFTER the bulk fields, but its placeholder is allocated BEFORE them, so $2 mapped to pageId instead of the image vector. Fix: push embeddingImageStr right after embeddingStr (matching the Postgres engine's order). 'invalid input syntax for type vector' errors gone. Tests (3 new files, 13 new cases): - test/search-image-column.test.ts (4 cases): default routes to embedding column with text-only modality filter; embedding_image routes correctly with image-only filter; cosine ordering on the image column; searchKeyword still hides image rows. - test/query-image-flag.serial.test.ts (3 cases, mocked embedMultimodal): query op happy path with --image returns nearest image, refuses on neither-supplied, modality filter blocks text pages from leaking into image-similarity results. Renamed to *.serial.test.ts per CLAUDE.md R2 (`mock.module(...)` quarantine). - test/cli-query-image.test.ts (6 cases): resolveQueryImage helper reads + base64-encodes; mime derivation across all 8 supported extensions including case-insensitive variants; oversized rejection; explicit-mime override; missing-file error. CHANGELOG: removed `--image` from the "NOT in this release" list, added a dedicated section describing the new flag + smoke path. v0.27.1 regression: 212 tests / 0 fail / 668 expect calls across 13 v0.27.1-touching files. Typecheck clean. Bun isolation lint clean. Run: bun test test/cli-query-image.test.ts test/query-image-flag.serial.test.ts test/search-image-column.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(e2e): real-Postgres v0.27.1 multimodal suite + schema-drift allowlist update Adds test/e2e/multimodal-postgres.test.ts (10 tests) exercising the v0.27.1 schema and APIs against real Postgres + pgvector: - modality + embedding_image columns present with correct shape - partial HNSW idx_chunks_embedding_image with WHERE clause - files table column parity with PGLite (mirroring v0.18 shape) - pages.page_kind CHECK admits 'image' (migration v36 widening) - upsertFile end-to-end (insert + idempotent re-upsert) - upsertChunks writes embedding_image + modality columns correctly - searchVector with embeddingColumn='embedding_image' returns image rows with modality filter excluding cross-mode leaks - searchKeyword hides modality='image' rows by default - cross-engine parity (Eng-3G): same fixture into PGLite + Postgres, identical chunk + file shape after round-trip - migration v36 ran on Postgres (schema_version >= 36) Catches the param-builder bug fixed in the prior commit on real Postgres (it manifested differently than PGLite — postgres.js handled NULL vs vector mismatches more gracefully but the modality + embedding_image ON CONFLICT path needed end-to-end verification). Schema-drift allowlist (test/e2e/schema-drift.test.ts): - Removed `files` from PG_ONLY_TABLES. v0.27.1 added the table to PGLite via migration v36; both engines now mirror the v0.18 shape and the parity gate enforces it. file_migration_ledger stays Postgres-only (the v0.18 storage-object rewrite ledger has no PGLite consumer). Verification: - bun run typecheck: clean - DATABASE_URL=... bun test test/e2e/multimodal-postgres.test.ts: 10/10 - DATABASE_URL=... bun test test/e2e/schema-drift.test.ts: 6/6 - DATABASE_URL=... bash scripts/run-e2e.sh (sequential, full suite): 326/332 pass. The 6 failures across 4 files (claw-test, dream-cycle, mechanical doctor host-state, serve-http-oauth) are all pre-existing and unrelated to v0.27.1 — verified by re-running on the master versions of those tests. Run: docker run -d --name gbrain-test-pg -p 5435:5432 \ -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres \ -e POSTGRES_DB=gbrain_test pgvector/pgvector:pg16 && \ DATABASE_URL=postgresql://postgres:postgres@localhost:5435/gbrain_test \ bun test test/e2e/multimodal-postgres.test.ts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add @jsquash/avif + exifr deps; thread synthesis case into page-type exhaustive test --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-07 10:03:38 -07:00