ariadne

English · Українська

A native, local-first, multilingual memory server for Codex, Claude Code, and any MCP client. Go + Qdrant + bge-m3 — no Docker, no cloud, no API keys.

Purpose-built for private coding-agent memory: a small native appliance rather than a hosted, multi-tenant memory platform. The default path is offline and cross-lingual, with observable retrieval cost and no account dependency.

Project site · Hugging Face Space · Latest release

Built as a replacement for embedded vector-DB memory backends that crash or starve under several concurrent MCP sessions. ariadne is a server: one Qdrant handles concurrent writes natively, so the whole single-writer / lock-starvation class simply doesn't exist.

What's New in v0.8.11

Fixed

• The desktop tray is now truly single-instance. Before creating a status item, Ariadne takes an OS-level lock: non-blocking flock on macOS/Linux and a named mutex on Windows. A duplicate exits cleanly without adding an icon.
• Old launchd jobs no longer multiply after login. The installer reconciles every canonical and versioned tray, maintenance, and Ariadne-owned Qdrant job, then keeps only the canonical labels active.

Added

• History-preserving launchd cleanup. Superseded plist files move to Ariadne's runtime archive instead of being deleted, including the legacy monitor plist.
• Process-level diagnostics. The full-stack doctor now reports the actual tray-process count as well as launchd ownership, so manual duplicates cannot hide behind one service label.

Previously in v0.8.10

v0.8.10 made token attribution auditable with lossless Qdrant pagination, recallable-versus-history coverage, separated measured and estimated provenance, explicit gap classification, and safe opt-in attribution backfill.

Previously in v0.8.9

Fixed

• Qdrant remains available with many concurrent agent sessions. Each MCP process now uses one persistent gRPC connection instead of the client library's implicit pool of three, while the macOS launchd service receives an explicit 8192-file descriptor limit instead of inheriting 256.
• Startup no longer hammers payload-index creation. Ariadne inspects the existing schema and creates only missing indexes. Real storage errors now fail startup instead of being silently ignored.
• Every short-lived client closes cleanly. Hooks, import, install, and maintenance release their Qdrant connection when they finish.

Added

• Descriptor-pressure visibility. ariadnectl status, the tray, and the full-stack doctor report Qdrant's open descriptors and configured limit, with a visible warning before exhaustion.

Previously in v0.8.8

Added

• Fail-closed remote Qdrant authentication. Remote gRPC requires an API key plus TLS; REST requires the same key and HTTPS. Long-running clients retain only a protected key-file path, never the key value. An explicit insecure override remains available for a user-managed SSH or equivalent tunnel.
• Honest retrieval comparison. cmd/eval now calculates deterministic macro Recall, MRR, and nDCG for judged BM25 and learned-sparse runs instead of claiming a SPLADE improvement without corpus evidence.

Changed

• Metrics schema v3 scales without discarding history. Every recall event remains append-only, while an indexed 30-day path and transactional daily rollups make lifetime totals bounded and fast. Existing v2 databases migrate without changing raw rows or totals.
• Collection scans are complete. Memfile reconciliation now pages through every Qdrant point instead of relying on a fixed upper limit.
• Maintenance has a reusable core. Bounded retry/backoff orchestration lives in internal/maintenance; ariadnectl retains its established CLI and activity semantics.

Fixed

• Remote settings survive installation and self-update. macOS, Linux, and Windows launchers propagate the same non-secret Qdrant transport settings; explicit Windows installer arguments still take precedence.
• Repository tooling no longer compiles dependencies from site/node_modules. The site is a separate Go module, and make clean archives generated assets with a recovery manifest instead of deleting them.

Previously in v0.8.7

Fixed

• Tray restart now works under launchd's restricted environment. Ariadne resolves Homebrew from standard macOS locations when brew is absent from launchd's minimal PATH, so both Qdrant and Ollama actually restart.
• Restart always attempts recovery. ariadnectl restart runs the start phase even when stopping one service reports an error, then returns every failure instead of leaving the stack down after a partial stop.
• The completion message survives the tray restart. The verified result is appended before the old tray exits; its launchd replacement displays the final notification and appends a delivered marker.

Added

• Verified service operations. The tray observes Qdrant and Ollama before and after Start, Stop, or Restart, waits for the requested state, verifies PID changes on restart, and refuses to report success while the collection is unhealthy.
• Visible PID and operation diagnostics. Tray rows and ariadnectl status expose service PIDs; structured logs include duration, before/after state, command output, and the exact verification failure.

Changed

• Conflicting controls are locked during service work. Start, Stop, Restart, maintenance, update, backup, and export cannot overlap while a service action is in progress.
• Platform command errors keep their useful output. macOS, Linux, and Windows service-control failures now preserve stderr/stdout for diagnosis.

Previously in v0.8.6

Fixed

• Tray restarts are reliable on macOS. A launchd-managed tray now asks its supervisor for one clean replacement instead of racing a second menu-bar process and occasionally leaving no icon.
• Service failures are reported honestly. start, stop, and restart propagate platform errors to the CLI and tray instead of displaying success.
• Claude upgrades no longer leave stale integration files. The installer validates and refreshes the shipped skill plus exact hook paths, matchers, and timeouts.

Added

• Persistent recall across Claude context transitions. Auto-recall now runs for startup, resume, clear, compact, and fork, and injects an explicit reminder to save durable decisions, gotchas, and verified outcomes immediately.

Changed

• Approval is always a deliberate click. System warnings contain only Approve and Deny; neither is default or focused, and Return/Enter or Escape cannot decide or dismiss the request.
• Hook installation is update-aware. Existing Ariadne hooks are updated in place while unrelated Claude hooks are preserved.

Previously in v0.8.5

The macOS approval warning comes to the foreground. The native dialog activates before it is displayed, so an access request cannot sit unnoticed behind the active coding window. Activation changes visibility, never authority.

Hugging Face publishing is valid. The Space metadata stays within the Hub's 60-character short_description limit.

Previously in v0.8.4

Approval requests now interrupt visibly. A new cross-wing or protected- resource request opens a system warning dialog immediately instead of relying on the tray badge and desktop notification alone. The dialog shows the bounded scope and purpose with Approve, Deny, and a safe-default Later action. Closing it, pressing Escape, or choosing Later grants nothing; a pending request is shown again after one minute. The tray queue remains available as a fallback and audit view.

The prompt uses the native macOS warning dialog, Windows system popup, or an available KDialog/Zenity provider on Linux. Only an explicit Approve/Deny writes the append-only decision record.

Previously in v0.8.3

Cross-project memory with a real human gate. all_wings: true now creates a pending request instead of searching. The Ariadne tray displays its active wing, purpose, and bounded query; only an Approve click issues a 15-minute grant scoped to that MCP client session, active wing, and collection. The client then retries with approval_id. Exact-ID cross-wing recall follows the same path.

Local context stays dominant. After approval, external candidates receive a 0.70 origin weight and normally occupy at most two of five results. Responses label local versus cross-wing origins and disclose the applied weight. The weight is applied after authorization and is never treated as permission.

Credentials require a second, one-time approval. credential_access creates an independent tray request for one exact source wing, target wing, credential name/path, and purpose. Approval expires after five minutes and is consumed once. Ariadne never reads or returns the value; requests, decisions, and consumptions remain as separate append-only audit records.

Previously in v0.8.2

Project isolation is now default-deny. Semantic memory_recall requires a project wing; searching every project needs the explicit all_wings: true opt-in intended for a user-requested cross-project audit. Session hooks resolve the nearest repository root and may use a stable .ariadne-wing marker, so a nested working directory cannot silently become a new namespace. The shared Codex and Claude Code skill also treats the active workspace as the filesystem boundary: a readable sibling project is not permission to borrow its .env, credentials, endpoints, or configuration.

Credential material is blocked and quarantinable. MCP saves and the store reject high-confidence private keys, credential URIs, known token formats, and explicit secret assignments. Import and hook capture redact detected values, consolidation validates output again, and recall excludes quarantined records with defensive redaction on exact-ID output. ariadnectl quarantine-secrets performs a metadata-only dry-run by default; --apply preserves the original payload, vector, and previous status while removing the record from normal recall. --apply --reconcile can restore the previous status after detector refinement without erasing the quarantine audit trail.

Previously in v0.8.1

One service owner, visible health. Ariadne detects duplicate macOS Qdrant jobs before they can hide behind a green HTTP health check. ariadnectl normalizes start, stop, and installer ownership to one canonical job while retaining old plist files and every byte of memory history. The expanded doctor resolves the active immutable runtime, checks both Codex and Claude MCP paths, reports maintenance and launchd state, exposes attribution coverage, and warns about runaway logs.

Maintenance that distinguishes retry from review. Each captured session is curated atomically before same-day outputs are coalesced and deduplicated. An independent local quality pass rejects memories that fuse unrelated concerns, then gives invalid model output one focused repair pass. Transient network and Ollama failures still receive bounded backoff; det