syzsunshine219 · Oct 27, 2026 · Oct 19, 2026 · Oct 19, 2026 · Oct 20, 2026 · Oct 21, 2026
@@ -0,0 +1,27 @@
+# Memmy v1.2.401
+
+## Highlights
+
+- Fixed macOS in-app updates being rejected during CPU architecture validation.
+- Host-managed Agent file tools now use approvals for file access and keep runtime state separate from unapproved projects.
+- Corrected the seven-day skill-use metric to count recalls and invocations of activated skills instead of recently updated skill records.
+
+## Agent and Desktop improvements
+
+- Hide pagination controls when the User Memories list is empty.
+- Fixed packaged Memory startup by including the `ignore` dependency.
+- Updated Electron and SQLite runtime dependencies, aligned Memory packaging with SQLite 13 N-API prebuilds, and pinned standalone builds to Node.js 24.22.1.
+- Retry transient HTTP 503 responses while the Linux systemd Gateway is starting.
+- Improve Windows installer build reliability with prepared native dependencies, isolated edition outputs, and bounded recovery for transient signing and file-lock errors.
+- Preserve the Developer ID requirement when staging macOS updates and compare update version characters consistently.
+- Apply managed approvals to directory traversal, file search, edits, and PDF/DOCX text reads; prevent project-controlled bootstrap files and plugins from being read before approval.
+
+## Upgrade notes
+
+- Applications embedding the Agent in managed mode must migrate to `AGENT_MANAGED_EXECUTION_REQUIRED`, `AGENT_RUNTIME_TOKEN`, and `AGENT_MACOS_SANDBOX`, the `x-agent-runtime-token` request header, and the `managed_execution` request field. The former `MEMMATE_*` settings, header, and `memmate_permission` field are no longer recognized.
+- Managed integrations must use `authorize_read_path` for descendant-path authorization and the health fields `permissionProtocol`, `managedExecutionProtocol`, `managedExecutionRequired`, and `macosSandbox`. Update the embedding application together with the Agent and verify the protocol before rollout. Standalone Agent operation does not require these managed integration settings.
+- The Linux CLI installer requires Node.js 22.23.4+ within 22.x, 24.22.1+ within 24.x, or 26.12.1+ within 26.x. Other major versions are rejected.
+
+- Memmy Desktop and Agent are version `1.2.401`; the bundled Memory service, viewer, and CLI remain independently versioned at `2.1.7`.
+- The skill-use total reports usage events, not the number of distinct skills. Updating a skill without recalling or invoking it no longer increases this total.
+- Installation, in-place upgrade, signed-package validation, and publication remain separate release checks.
@@ -61,7 +61,7 @@ jobs:
           ref: ${{ github.event_name == 'release' && format('refs/tags/{0}', github.event.release.tag_name) || github.sha }}
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
           cache: npm
       - uses: actions/setup-go@v5
         with:
@@ -124,7 +124,7 @@ jobs:
           path: release-assets
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 22.23.4
       - name: Install twice and exercise the CLI
         env:
           VERSION: ${{ needs.build.outputs.version }}

@@ -14,7 +14,7 @@
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
-    "test": "npm run typecheck && vitest run tests/desktop-runtime-manifest.test.ts tests/language.test.ts tests/model-catalog-resolver.test.ts tests/model-thinking-levels.test.ts",
+    "test": "npm run typecheck && vitest run --silent=true tests/desktop-runtime-manifest.test.ts tests/language.test.ts tests/model-catalog-resolver.test.ts tests/model-thinking-levels.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {

@@ -17,7 +17,7 @@
     "build": "npm run build -w @memmy/knowledge && npm run build -w @memmy/agent-source-core && npm run build -w @memmy/migrations && npm run build -w @memmy/local-api-contracts && node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node -e \"const fs=require('node:fs'); fs.cpSync('src/infrastructure/app-state-store/migrations', 'dist/src/infrastructure/app-state-store/migrations', { recursive: true }); fs.cpSync('src/infrastructure/agent-source-store/migrations', 'dist/src/infrastructure/agent-source-store/migrations', { recursive: true }); fs.cpSync('src/infrastructure/idempotency-store/migrations', 'dist/src/infrastructure/idempotency-store/migrations', { recursive: true }); if (fs.existsSync('src/adapters/outbound/agent-adapter/plugins')) fs.cpSync('src/adapters/outbound/agent-adapter/plugins', 'dist/src/adapters/outbound/agent-adapter/plugins', { recursive: true });\" && npm run workspace-bridge:build:dist",
     "lint": "eslint \"src/**/*.ts\" \"vitest.config.ts\"",
     "typecheck": "npm run build -w @memmy/knowledge && npm run build -w @memmy/agent-source-core && npm run build -w @memmy/migrations && npm run build -w @memmy/local-api-contracts && tsc -p tsconfig.json --noEmit",
-    "test": "npm run build -w @memmy/knowledge && npm run build -w @memmy/agent-source-core && npm run build -w @memmy/migrations && npm run build -w @memmy/local-api-contracts && npm run workspace-bridge:build && vitest run",
+    "test": "npm run build -w @memmy/knowledge && npm run build -w @memmy/agent-source-core && npm run build -w @memmy/migrations && npm run build -w @memmy/local-api-contracts && npm run workspace-bridge:build && vitest run --reporter=dot --silent=true",
     "test:agent-adapter:coverage": "npm run build -w @memmy/local-api-contracts && vitest run src/adapters/outbound/agent-adapter/tests --coverage",
     "db:migrate": "tsx src/infrastructure/app-state-store/cli/migrate.ts"
   },

@@ -1,2 +1,2 @@
 /** Generated from the root package.json by scripts/sync-project-version.mjs. */
-export const MEMMY_VERSION = "1.2.4";
+export const MEMMY_VERSION = "1.2.401";
@@ -11,6 +11,7 @@ describe("project version", () => {
     );
 
     expect(MEMMY_VERSION).toBe(rootManifest.version);
+    expect(MEMMY_VERSION).toBe("1.2.401");
     expect(MEMMY_VERSION).toMatch(/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/);
     expect(readFileSync(resolve(repoRoot, "App/backend/src/project-version.ts"), "utf8"))
       .toContain(`MEMMY_VERSION = ${JSON.stringify(rootManifest.version)}`);

@@ -7,7 +7,7 @@
     "dev": "vite",
     "build": "npm run build -w @memmy/knowledge && npm run build -w @memmy/desktop-interface && tsc -p tsconfig.json --noEmit && vite build",
     "typecheck": "npm run build -w @memmy/knowledge && npm run build -w @memmy/desktop-interface && tsc -p tsconfig.json --noEmit",
-    "test": "npm run build -w @memmy/knowledge && npm run build -w @memmy/desktop-interface && vitest run"
+    "test": "npm run build -w @memmy/knowledge && npm run build -w @memmy/desktop-interface && vitest run --reporter=dot --silent=true"
   },
   "dependencies": {
     "@memmy/desktop-interface": "0.0.0",

@@ -89,18 +89,9 @@ export function openUpdateUrlInBrowser(downloadUrl: string): void {
   window.open(downloadUrl, "_blank", "noopener,noreferrer");
 }
 
-/** Compares numeric version segments. */
+/** Match Desktop's character ordering, including release suffixes. */
 export function compareUpdateVersions(left: string, right: string): number {
-  const leftParts = extractUpdateVersionSegments(left);
-  const rightParts = extractUpdateVersionSegments(right);
-  const length = Math.max(leftParts.length, rightParts.length);
-  for (let index = 0; index < length; index += 1) {
-    const diff = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
-    if (diff !== 0) {
-      return diff;
-    }
-  }
-  return 0;
+  return left === right ? 0 : left < right ? -1 : 1;
 }
 
 function resolveBrowserUpdateEdition(): "cn" | "intl" {
@@ -176,10 +167,6 @@ function buildBrowserUpdateDownloadKeys(): string[] {
   return [resolveBrowserUpdatePlatformType()];
 }
 
-function extractUpdateVersionSegments(version: string): number[] {
-  return (version.match(/\d+/gu) ?? []).map((part) => Number(part));
-}
-
 function readUpdateManifestString(value: unknown, key: string): string | null {
   if (!isUpdateManifestRecord(value)) {
     return null;

@@ -56,8 +56,25 @@ describe("browser update fallback", () => {
       currentVersion: "1.4.2",
       latestVersion: "1.4.2"
     });
-    expect(compareUpdateVersions("1.10.0", "1.9.9")).toBeGreaterThan(0);
+    expect(compareUpdateVersions("1.10.0", "1.9.9")).toBeLessThan(0);
     expect(() => parseBrowserUpdateManifest({ code: 500, data: {} }, "1.4.2"))
       .toThrow("update manifest response code is not ok");
   });
+
+  it.each([
+    ["1.2.4", "1.2.401"],
+    ["1.2.401", "1.2.402"],
+    ["1.2.402", "1.2.5"],
+    ["1.2.5", "1.2.6"],
+    ["1.2.6", "1.3.0"],
+    ["1.2.10", "1.2.9"],
+  ])("offers %s to %s without offering the reverse update", (current, latest) => {
+    expect(parseBrowserUpdateManifest({ code: 0, data: { version: latest } }, current).status).toBe("available");
+    expect(parseBrowserUpdateManifest({ code: 0, data: { version: current } }, latest).status).toBe("latest");
+  });
+
+  it("uses character ordering for the minimum supported version", () => {
+    expect(parseBrowserUpdateManifest({ code: 0, data: { version: "1.2.6", minSupportedVersion: "1.2.5" } }, "1.2.401"))
+      .toMatchObject({ status: "available", force: true });
+  });
 });
@@ -1500,7 +1500,7 @@ export const zhCNMessages = {
   "memory.analytics.toolAverageLatency": "工具平均耗时",
   "memory.analytics.toolP95Latency": "工具 P95 耗时",
   "memory.analytics.recallEvents": "{count} 次召回事件",
-  "memory.analytics.recentlyUsedSkills": "近 7 天使用 {count} 个技能",
+  "memory.analytics.recentlyUsedSkills": "近 7 天使用技能 {count} 次",
   "memory.analytics.toolAverageLatencyHint": "按全部工具调用统计",
   "memory.analytics.slowCallWatch": "用于观察慢调用",
   "memory.analytics.activeMemories": "活跃记忆",
@@ -3728,7 +3728,7 @@ export const enUSMessages: Record<keyof typeof zhCNMessages, string> = {
   "memory.analytics.toolAverageLatency": "Avg tool latency",
   "memory.analytics.toolP95Latency": "P95 tool latency",
   "memory.analytics.recallEvents": "{count} recall events",
-  "memory.analytics.recentlyUsedSkills": "{count} skills used in the last 7 days",
+  "memory.analytics.recentlyUsedSkills": "{count} skill uses in the last 7 days",
   "memory.analytics.toolAverageLatencyHint": "Across all tool calls",
   "memory.analytics.slowCallWatch": "Slow-call watch",
   "memory.analytics.activeMemories": "Active memories",

@@ -25,6 +25,7 @@ describe("AnalyticsSubPage", () => {
     expect(html).toContain('data-icon="bar-chart-3"');
     expect(html).toContain("平均召回得分");
     expect(html).toContain("活跃技能数量");
+    expect(html).toContain("近 7 天使用技能 18 次");
     expect(html).toContain("工具平均耗时");
     expect(html).toContain("工具 P95 耗时");
     expect(html).toContain("repeat(auto-fit, minmax(min(100%, 144px), 1fr))");

@@ -21,6 +21,23 @@ describe("UserMemoriesSubPage interaction", () => {
     container.remove();
   });
 
+  it("does not render pagination when there are no user memories", async () => {
+    const client = createMemoryRuntimeClientStub({
+      listPanelItems: vi.fn(async () => panelItemsOutput([]))
+    });
+
+    await act(async () => {
+      root.render(
+        <I18nProvider language="zh-CN">
+          <UserMemoriesSubPage client={client} />
+        </I18nProvider>
+      );
+    });
+
+    expect(container.textContent).toContain("暂无用户记忆");
+    expect(container.querySelector(".memory-pagination")).toBeNull();
+  });
+
   it("loads the UserMemory layer and deletes the selected record", async () => {
     const item = {
       id: "user_memory_1",

@@ -126,10 +126,12 @@ export function UserMemoriesSubPage(props: UserMemoriesSubPageProps) {
               </button>
             ))}
           </div>
-          <MemoryPagination
-            data={state.data}
-            onPageChange={(nextPage) => void refresh(nextPage)}
-          />
+          {state.data.items.length > 0 ? (
+            <MemoryPagination
+              data={state.data}
+              onPageChange={(nextPage) => void refresh(nextPage)}
+            />
+          ) : null}
         </>
       ) : null}
 

@@ -140,16 +140,29 @@ describe("BYOK displayed, tested and saved credentials", () => {
       input.dispatchEvent(new Event("input", { bubbles: true }));
     });
   }
+  async function saveAndWait(button: HTMLButtonElement, navigates = false) {
+    const saveIndex = server.saveCatalog.mock.results.length;
+    const writes = server.write.mock.calls.length;
+    const dispatchIndex = mocks.dispatch.mock.calls.length;
+    await click(button);
+    await vi.waitFor(() => expect(server.saveCatalog.mock.results.length).toBeGreaterThan(saveIndex));
+    // A new preset is created before its assignment is saved. Wait for this
+    // complete catalog mutation, rather than the first backend write or an old navigation.
+    await act(async () => { await server.saveCatalog.mock.results[saveIndex]!.value; });
+    expect(server.write.mock.calls.length).toBeGreaterThan(writes);
+    if (navigates) {
+      await vi.waitFor(() => expect(mocks.dispatch.mock.calls.slice(dispatchIndex).map(([action]) => action))
+        .toContainEqual(expect.objectContaining({ type: "navigation/changed" })));
+    }
+  }
+  async function saveOnboarding() { await saveAndWait(next(), true); }
   async function testAndSave(scenario: Scenario) {
     const count = server.probe.mock.calls.length;
     await click(test(scenario.index));
     await vi.waitFor(() => expect(server.probe).toHaveBeenCalledTimes(count + 1));
     await vi.waitFor(() => expect(test(scenario.index).textContent).toBe("apiKey.testSuccess"));
     const tested = server.probe.mock.calls.at(-1)![0];
-    const writes = server.write.mock.calls.length;
-    await click(next());
-    await vi.waitFor(() => expect(server.write.mock.calls.length).toBeGreaterThan(writes));
-    await vi.waitFor(() => expect(mocks.dispatch).toHaveBeenCalledWith(expect.objectContaining({ type: "navigation/changed" })));
+    await saveOnboarding();
     expect(await server.key(scenario.role)).toBe(tested.apiKey);
     return tested;
   }
@@ -250,8 +263,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
   it.each([0, 1])("role %i: enabling reuse saves the inherited credential instead of the independent credential", async (index) => {
     await render(<ModelPage />);
     await click([...container.querySelectorAll<HTMLButtonElement>('button[role="checkbox"]')][index]!);
-    await click(next());
-    await vi.waitFor(() => expect(mocks.dispatch).toHaveBeenCalledWith(expect.objectContaining({ type: "navigation/changed" })));
+    await saveOnboarding();
     expect(await server.key(index === 0 ? "memory_summary" : "memory_evolution")).toBe(index === 0 ? "sk-team-1111" : "sk-personal-1111");
   });
 
@@ -348,8 +360,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     await vi.waitFor(() => expect(container.textContent).toContain("assignment-write-failed"));
     expect(mocks.dispatch).not.toHaveBeenCalled();
     const endpointsAfterCreate = (await server.read()).catalog!.providers.flatMap((provider) => provider.endpoints).length;
-    await click(next());
-    await vi.waitFor(() => expect(mocks.dispatch).toHaveBeenCalledWith(expect.objectContaining({ type: "navigation/changed" })));
+    await saveOnboarding();
     expect(await server.key("agent")).toBe("sk-retry-1111");
     expect((await server.read()).catalog!.providers.flatMap((provider) => provider.endpoints)).toHaveLength(endpointsAfterCreate);
   });
@@ -396,8 +407,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     await vi.waitFor(() => expect(document.body.textContent).toContain("settings.modelWorkspace.testSuccess"));
     expect(server.probe.mock.calls.at(-1)![0]).toMatchObject({ apiKey: scenario.expected, apiBase: "https://changed.example/v2" });
     expect(settingsSave().disabled).toBe(false);
-    await click(settingsSave());
-    await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
+    await saveAndWait(settingsSave());
     await vi.waitFor(async () => {
       const config = await server.read();
       expect(config.catalog!.providers.flatMap((p) => p.endpoints).find((e) => e.endpointId === oldId)?.apiBase).toBe("https://changed.example/v2");
@@ -429,8 +439,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     await vi.waitFor(() => expect(server.probe.mock.calls.length).toBeGreaterThan(beforeTest4));
     await vi.waitFor(() => expect(document.body.textContent).toContain("settings.modelWorkspace.testSuccess"));
     expect(server.probe.mock.calls.at(-1)![0]).toMatchObject({ apiKey: "sk-personal-1111", modelId: "changed-model", apiBase: "https://provider.example/v1" });
-    await click(settingsSave());
-    await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
+    await saveAndWait(settingsSave());
     expect(await server.key("agent")).toBe("sk-personal-1111");
   });
 
@@ -534,9 +543,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     expect(test(scenario.index).textContent).toBe("apiKey.testSuccess");
     expect(next().disabled).toBe(false);
     expect(server.write).not.toHaveBeenCalled();
-    await click(next());
-    await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
-    await vi.waitFor(() => expect(mocks.dispatch).toHaveBeenCalledWith(expect.objectContaining({ type: "navigation/changed" })));
+    await saveOnboarding();
     expect(await server.key(scenario.role)).toBe("sk-after-reentry-9999");
   });
 
@@ -557,8 +564,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     expect(test(scenario.index).textContent).toBe("apiKey.testSuccess");
     await finishOld(false);
     expect(test(scenario.index).textContent).toBe("apiKey.testSuccess");
-    await click(next());
-    await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
+    await saveOnboarding();
     expect(await server.key(scenario.role)).toBe("sk-new-onboarding-9999");
   });
 
@@ -599,8 +605,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
       await testAndSave(scenario);
     } else {
       expect(test(scenario.index).textContent).toBe("apiKey.testSuccess");
-      await click(next());
-      await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
+      await saveOnboarding();
     }
     expect(await server.key(scenario.role)).toBe(order === "return-to-original" ? scenario.expected : "sk-new-onboarding-9999");
   });
@@ -701,8 +706,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     await finish();
     expect(test(index).textContent).toBe("apiKey.testSuccess");
     expect(next().disabled).toBe(false);
-    await click(next());
-    await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
+    await saveOnboarding();
   });
 
   it.each([0, 1])("role %i: editing the other independent card leaves this request valid", async (index) => {
@@ -740,8 +744,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     }
     expect(test(1).textContent).toBe("apiKey.testSuccess");
     expect(next().disabled).toBe(false);
-    await click(next());
-    await vi.waitFor(() => expect(server.write).toHaveBeenCalled());
+    await saveOnboarding();
     expect(await server.key("memory_evolution")).toBe("sk-team-1111");
   });
 
@@ -764,8 +767,7 @@ describe("BYOK displayed, tested and saved credentials", () => {
     await render(<ModelPage />);
     await click(container.querySelectorAll<HTMLButtonElement>('button[role="checkbox"]')[0]!);
     await click(container.querySelectorAll<HTMLButtonElement>('button[role="checkbox"]')[1]!);
-    await click(next());
-    await vi.waitFor(() => expect(mocks.dispatch).toHaveBeenCalledWith(expect.objectContaining({ type: "navigation/changed" })));
+    await saveOnboarding();
     expect(await server.key("memory_evolution")).toBe("sk-personal-1111");
     expect(await server.key("memory_summary")).toBe("sk-personal-1111");
     await render(null);