chore: prepare 0.9.28 release

AGENTS.md

@@ -115,7 +115,7 @@ Hook scripts in `src/hooks/` are standalone Node.js scripts (no iii-sdk import).
 - Test files go in `test/` with `.test.ts` extension
 - Follow existing patterns in `test/crystallize.test.ts` for function tests
 
-## Current Stats (v0.9.27)
+## Current Stats (v0.9.28)
 
 - 61 MCP tools (8 visible by default, `AGENTMEMORY_TOOLS=all` for all)
 - 134 REST endpoints

CHANGELOG.md

@@ -10,6 +10,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Remote text embeddings now require an explicit `EMBEDDING_PROVIDER` opt-in. Generic provider keys such as `GEMINI_API_KEY`, `OPENAI_API_KEY`, `VOYAGE_API_KEY`, `COHERE_API_KEY`, or `OPENROUTER_API_KEY` no longer enable embeddings by themselves. Existing key-only installs that want vector search must set `EMBEDDING_PROVIDER=gemini|openai|voyage|cohere|openrouter`, or `EMBEDDING_PROVIDER=local` for on-device embeddings.
 
+### Fixed
+
+- **The next npm package metadata no longer auto-installs Anthropic packages** ([#171](https://github.com/wbugitlab1/agentmemory/issues/171)). The source fix that removed `@anthropic-ai/sdk` and moved `@anthropic-ai/claude-agent-sdk` to an optional peer is carried forward into the next patch release so normal `npm install @agentmemory/agentmemory@latest` users do not receive Anthropic dependencies unless they explicitly opt into the Claude Agent SDK fallback.
+
 ## [0.9.27] — 2026-06-07
 
 Wave release closing several breaking regressions reported against v0.9.26, plus an agent-scope isolation security fix, an iii version-pin audit fix, and a benchmark scorecard correction. No breaking changes; drop-in upgrade.

README.md

@@ -872,7 +872,7 @@ npx -y @agentmemory/mcp
 <h2 id="deploy">Deploy</h2>
 
 Managed-host templates and setup guides run the shared
-`ghcr.io/wbugitlab1/agentmemory:0.9.27` image, built from the canonical
+`ghcr.io/wbugitlab1/agentmemory:0.9.28` image, built from the canonical
 `deploy/Dockerfile` after npm publication succeeds. Persistent storage
 mounts at `/data`; the first-boot entrypoint overwrites the
 npm-bundled iii config (which binds `127.0.0.1`) with a deploy-tuned

deploy/Dockerfile

@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 

deploy/README.md

@@ -3,7 +3,7 @@
 Stand up agentmemory on managed infrastructure without rolling your own
 Docker host, or bring the same runtime model to Kubernetes with Helm.
 The managed-platform templates run the shared
-`ghcr.io/wbugitlab1/agentmemory:0.9.27` image built from
+`ghcr.io/wbugitlab1/agentmemory:0.9.28` image built from
 `deploy/Dockerfile` after npm publication succeeds. Storage mounts at
 `/data`; an HMAC secret is generated by the first-boot entrypoint and
 persisted to the volume. The entrypoint overwrites the npm-bundled iii
@@ -56,7 +56,7 @@ before exec'ing the agentmemory CLI.
 - Pick **Kubernetes / Helm** if you already operate a cluster and want
   a chart-managed Deployment, PVC, Service, optional Ingress, and
   NetworkPolicy. The chart defaults to
-  `ghcr.io/wbugitlab1/agentmemory:0.9.27`; override
+  `ghcr.io/wbugitlab1/agentmemory:0.9.28`; override
   `image.repository` only for a private fork image.
 
 All deployments give you the same agentmemory API at the same port

deploy/coolify/Dockerfile

@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 

deploy/coolify/README.md

@@ -5,7 +5,7 @@ Heroku/Render alternative that you run on your own VPS. This template
 deploys agentmemory as a Coolify *Application* backed by a Docker
 Compose stack — Coolify handles TLS termination, persistent volume
 provisioning, log aggregation, and the deploy webhook for you. The
-compose file pulls `ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+compose file pulls `ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 
 ## What you get
 

deploy/coolify/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   agentmemory:
-    image: ghcr.io/wbugitlab1/agentmemory:0.9.27
+    image: ghcr.io/wbugitlab1/agentmemory:0.9.28
     restart: unless-stopped
     environment:
       SERVICE_FQDN_AGENTMEMORY_3111: ${SERVICE_FQDN_AGENTMEMORY_3111}

deploy/fly/Dockerfile

@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 

deploy/fly/README.md

@@ -4,7 +4,7 @@ This template runs agentmemory on a single fly.io machine with a 1 GB
 persistent volume mounted at `/data`. The HMAC secret is generated on
 first boot and persisted to the volume. Retrieve it through `fly ssh`;
 the secret value is not printed to deploy logs. The default Fly config
-deploys `ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+deploys `ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 
 ## What you get
 

deploy/fly/fly.toml

@@ -12,7 +12,7 @@ app = "agentmemory"
 primary_region = "iad"
 
 [build]
-  image = "ghcr.io/wbugitlab1/agentmemory:0.9.27"
+  image = "ghcr.io/wbugitlab1/agentmemory:0.9.28"
 
 [[mounts]]
   source = "agentmemory_data"

deploy/helm/agentmemory/Chart.yaml

@@ -3,7 +3,7 @@ name: agentmemory
 description: Kubernetes Helm chart for agentmemory
 type: application
 version: 0.1.0
-appVersion: "0.9.27"
+appVersion: "0.9.28"
 home: https://github.com/wbugitlab1/agentmemory
 sources:
   - https://github.com/wbugitlab1/agentmemory

deploy/helm/agentmemory/README.md

@@ -2,13 +2,13 @@
 
 This chart deploys agentmemory on Kubernetes with the same single-container model used by the Fly, Railway, Render, and Coolify templates.
 
-By default the chart uses `ghcr.io/wbugitlab1/agentmemory:0.9.27`, the same image as the managed-platform templates. Override `image.repository` only when your cluster should pull a private fork image.
+By default the chart uses `ghcr.io/wbugitlab1/agentmemory:0.9.28`, the same image as the managed-platform templates. Override `image.repository` only when your cluster should pull a private fork image.
 
 ## Prerequisites
 
 - Helm 3
 - Kubernetes cluster with `ReadWriteOnce` persistent volume support
-- Access to pull `ghcr.io/wbugitlab1/agentmemory:0.9.27`, or a private image you set in `image.repository`
+- Access to pull `ghcr.io/wbugitlab1/agentmemory:0.9.28`, or a private image you set in `image.repository`
 
 ## Install
 
@@ -126,7 +126,7 @@ Keep a separate backup of the PVC before destructive cluster or storage operatio
 | --- | --- | --- |
 | `replicaCount` | `1` | Must remain `1`; file-backed SQLite state supports one writer. |
 | `image.repository` | `ghcr.io/wbugitlab1/agentmemory` | Image repository; override for private fork images. |
-| `image.tag` | `0.9.27` | Agentmemory image tag. |
+| `image.tag` | `0.9.28` | Agentmemory image tag. |
 | `service.port` | `3111` | REST API Service port. |
 | `persistence.enabled` | `true` | Create a PVC for `/data`. |
 | `persistence.mountPath` | `/data` | Must remain `/data`; deploy images and iii config use this directory. |

deploy/helm/agentmemory/values.yaml

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: "ghcr.io/wbugitlab1/agentmemory"
-  tag: "0.9.27"
+  tag: "0.9.28"
   pullPolicy: IfNotPresent
   pullSecrets: []
 

deploy/railway/Dockerfile

@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 

deploy/railway/README.md

@@ -4,7 +4,7 @@ This template runs agentmemory on a single Railway service with a
 persistent volume mounted at `/data`. The HMAC secret is generated on
 first boot and persisted to the volume. Retrieve it through Railway
 shell access; the secret value is not printed to deploy logs. Use the
-published `ghcr.io/wbugitlab1/agentmemory:0.9.27` image as the service
+published `ghcr.io/wbugitlab1/agentmemory:0.9.28` image as the service
 source.
 
 ## What you get
@@ -23,7 +23,7 @@ source.
 ## Deploy via Railway dashboard
 
 1. Create a service from the image
-   `ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+   `ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 2. Set the **Config-as-Code Path** under the service Settings to
    `deploy/railway/railway.json` if the service is linked to the fork
    repository for deploy settings.

deploy/render/Dockerfile

@@ -4,7 +4,7 @@ FROM iiidev/iii:${III_VERSION} AS iii-image
 
 FROM node:22-slim
 
-ARG AGENTMEMORY_VERSION=0.9.27
+ARG AGENTMEMORY_VERSION=0.9.28
 ARG III_VERSION=0.11.2
 ARG III_SDK_VERSION=0.11.2
 

deploy/render/README.md

@@ -4,7 +4,7 @@ This template runs agentmemory on a single Render Web Service with a
 persistent disk mounted at `/data`. The HMAC secret is generated on
 first boot and persisted to the disk. Retrieve it through Render SSH;
 the secret value is not printed to deploy logs. The Blueprint pulls
-`ghcr.io/wbugitlab1/agentmemory:0.9.27`.
+`ghcr.io/wbugitlab1/agentmemory:0.9.28`.
 
 ## What you get
 

deploy/render/render.yaml

@@ -4,7 +4,7 @@ services:
     runtime: image
     plan: starter
     image:
-      url: ghcr.io/wbugitlab1/agentmemory:0.9.27
+      url: ghcr.io/wbugitlab1/agentmemory:0.9.28
     healthCheckPath: /agentmemory/livez
     autoDeploy: false
     disk: