v0.9.30

One breaking change: the REST API now requires auth by default. Everything bundled (CLI, viewer, hooks, MCP, `connect` configs) reads the generated secret on its own, so only hand-written requests to `:3111` need `Authorization: Bearer $(cat ~/.agentmemory/secret)`. Stores load unchanged; one-time migrations run by themselves on first start.

## Breaking
- Auth on by default: secret generated into `~/.agentmemory/secret` when `AGENTMEMORY_SECRET` is unset (#1462)
- Writes need `Content-Type: application/json`; a present `Origin` must be loopback, the viewer, or in `VIEWER_ALLOWED_ORIGINS` (#1462)
- Import and export paths confined to the data dir, `~/.agentmemory`, or `AGENTMEMORY_IMPORT_ROOT` (#1462)
- iii engine 0.22.1; keep the `iii-` prefixed builtin worker names in custom configs (#1396, #1397)

## Added
- Durable capture: event ids, a persistent capture inbox, retries, dead letters, and an offline hook spool while the server is down; `agentmemory capture --drain` (#1460, #1468)
- Vector pending log: vectors survive a force-kill, backfill resumes across restarts (#1467)
- `GET /agentmemory/status` and a viewer Health tab; viewer rebuilt around one snapshot plus live stream events, 12 tabs (#1408, #1433, #1407)
- Opt-in Redis backend: `AGENTMEMORY_STATE_BACKEND=redis` (#1425)
- Graph compaction, monthly audit scopes, bucketed vector index, stale session sweep (#1454, #1419, #1416, #1453)
- Capture filters: `AGENTMEMORY_CAPTURE_ALLOW` / `DENY` / `OUTPUT_MAX`, `AGENTMEMORY_PRE_COMPACT_BUDGET` (#1452)
- OpenCode 2 support in the OpenCode plugin (#1476, #1451)
- Codex plugin bundles a stdio bridge to the daemon (#1459)
- `agentmemory console`, `--instance N` for side-by-side daemons (#1397, #892)
- Release gate that installs the packed tarballs and runs capture and recovery against them (#1463)
- README in 32 languages (#1479)

## Fixed
- Repeated identical prompts are kept; Cursor prompts are stored once (#1468, #1470)
- Graph provenance bounded to 32 observation ids per node and edge, stopping crash loops during search (#1454)
- Memories and vectors written just before `agentmemory stop` survive the restart (#1449)
- Forget and governance deletes report only real deletions; export returns 413 instead of 200 when oversized (#1449, #1422)
- Lost updates when several agents share one daemon (#1421)
- `OPENAI_EMBEDDING_API_KEY` honored; SessionStart context reaches hosts that expect structured hook output (#1472)

## Security
- Request hardening, scrubbing on every write, engine download verified against pinned SHA-256 (#1462, #1461)

## Changed
- Audit, memories, export, session/end and patterns response shapes; see the CHANGELOG for the full list (#1419, #1433, #1422, #1252, #1424)

## Contributors
Thanks to @david-waltermire, @a652, @cbsincool, @dmazhukov and @Tyxiel for the merged PRs, and to @DaveCole, @Srinath279, @joyjit and @cristianbdev, whose earlier work is carried into this release.

**Full changelog**: https://github.com/rohitg00/agentmemory/compare/v0.9.29...v0.9.30