rohitg00/agentmemory v0.9.27

on GitHub

Wave release closing several breaking regressions reported against v0.9.26, plus an agent-scope isolation security fix, an iii version-pin audit fix, and a benchmark scorecard correction. No breaking changes; drop-in upgrade.

Security

• AGENTMEMORY_AGENT_SCOPE=isolated not enforced on mem::search / POST /agentmemory/search / memory_recall / recall_context (#817). PR #654's isolation work covered smart-search, /memories, /observations, and /sessions but missed the BM25-only recall path. An isolated worker booted with AGENT_ID=B could read agent A's memories via the standard MCP memory_recall tool. Fail-closed: if isolated mode is on and no agent id resolves, the call throws rather than dropping the filter.

Fixed

• /graph/query and /graph/stats timed out with "Invocation stopped" on large existing corpora (#814, PR #816). Refactored mem::graph-extract to maintain three side-indexes (graphNameIndex, graphEdgeKey, graphNodeDegree) so every extract path is O(1), never O(n). Hot path reads exclusively from a precomputed top-degree snapshot updated inline on every extract.
• All data lost on agentmemory stop followed by restart (#843). Stop order inverted: worker first with a 5s SIGTERM grace so index flush can land, engine second.
• mem::graph-snapshot-rebuild and mem::graph-reset heartbeat-crashed on legacy >25K-node corpora (#825). Rebuild now refuses pre-flight when no prior snapshot exists. Reset is now enumeration-free: writes empty snapshot with resetAt epoch marker. Future extracts treat any pre-resetAt row as orphan.
• Multi-instance port collisions on one host (#750, PR #815). --port N now drags streams + engine. New --instance N shortcut picks a 100-port block.
• iii console install pulled latest engine instead of the pinned v0.11.2 (audit). Install command now passes VERSION=${IIPINNED_VERSION}. Render path is platform-aware: Windows users get a PowerShell hint.

Added

• POST /agentmemory/graph/snapshot-rebuild (≤25K nodes, force: true to bypass).
• POST /agentmemory/graph/reset enumeration-free clean-restart.
• --instance N CLI flag for multi-daemon (max N=50).
• GraphSnapshot.topDegrees, GraphSnapshot.resetAt, GraphQueryResult.fromSnapshot, GraphQueryResult.warning.

Changed

• REST endpoint count: 126 → 128.
• mem::graph-stats reads exclusively from snapshot.
• mem::graph-query empty-body / nodeType path reads exclusively from snapshot.
• mem::search over-fetch triggers on agentId filter too.

Docs

• Corrected coding-agent-life-v1 P@5 numbers (#796).
• README refresh: stats 174 files / 1,390+ tests / 258 functions; "New in vX.Y.Z" callout removed.
• import-jsonl users warned about Claude Code's cleanupPeriodDays 30-day default.

Full changelog: CHANGELOG.md