Tooling for AI-assisted development, in one workspace.

What’s new

0.60.0· 2026-10-10

• Breaking trusty-search start no longer accepts --port or --no-http. Both were ignored since the socket-only daemon (#9214); clap now rejects either as an unknown argument and exits 2. A launchd or systemd unit that still passes one fails to start: run trusty-search service install to regenerate a launchd unit, or delete the flag from a systemd ExecStart= line (#9536).
• Breaking TRUSTY_SEARCH_NO_HTTP is no longer read, and the deprecation warnings for all three inputs are gone (#9536).
• Added project-map.toml, the canonical project-to-index map, next to indexes.toml (refs #9169). The first boot with no map pins each project to the index search.project.resolve returns today and parks nothing; indexes.toml and projects.json are not changed. After that, search.project.resolve answers from the map and reports pinned_by. A map that cannot be parsed, has a newer schema or cannot be read fails closed: search.project.resolve and search.project.map return an internal error naming the file and the remedy, and the file is never rewritten. A resolve by an exact index id still works. New socket methods search.project.map, search.project.park, search.project.unpark and search.project.pin, and the CLI trusty-search project map|park|unpark|pin|rebuild-map. rebuild-map moves the old file to project-map.toml.corrupt-<unix> first. Only a worktree, an orphaned root or a same-root sibling can be parked; a second main checkout is refused. A parked index keeps its corpus and its registration, is not loaded at boot, watched, reindexed or searched by search.query.all, and is listed by search.indexes.list with parked: true. Prune, the boot orphan heal, the boot relocation salvage, the boot same-root dedup and the runtime orphan reaper never touch it, and none of them changes a registration while the map cannot be read. A search or reindex naming it answers -32009 with data {parked, canonical_index_id, key}; canonical_index_id is the project's live index under the map, never a parked or unregistered id. Parking a pinned index drops its pin, and search.project.park lists the dropped pins in unpinned. Deleting an index drops its park row and pins, so an index created again at the same root is not parked; a delete while the map cannot be read is refused with 500 project_map_unreadable. Unpark clears the row, reloads the index and queues a reindex. A new index for a project with no pin gets a create pin.

All changes →

What’s new

0.35.0· 2026-10-12

• Breaking Picks up palace format 2 from trusty-common: the daemon migrates each format-1 palace to format 2 at startup, a format-0 palace is refused FormatTooOld, and a migrated palace is refused by trusty-memory 0.33.x. doctor reports a format-1 palace as needing migration. Rollback: restore the backup, delete index.usearch.redb, run palace_reembed with dry_run: false (0.33.0 defaults it to true, which re-embeds nothing). trusty-memory 0.32.0 and 0.32.1 already refuse a format-2 palace; binaries older than 0.32.0 have no format gate and must not open one (#9275).
• Added trusty_memory::engine re-exports the memory storage engine (trusty_common::memory_core) under every feature set, including --no-default-features. Each item has the same type through both paths, so a consumer can switch its imports to trusty_memory::engine now (#9270).
• Added palace_verify_embedded answers chunk_check, chunk_check_error, embedder_ready, and embedder_state (ready, warming or failed) with embedder_error naming a failed startup warm-up, so a caller can tell a warm-up in progress from one that failed (#9275).

All changes →

What’s new

1.8.2· 2026-10-10

• Added tm memory rename <old> <new> [--replace-empty]: move a trusty-memory palace to a new id over the daemon socket. It checks the daemon protocol first, reports a daemon that predates palace_rename, and prints the daemon's reason for a refusal (#9544).
• Fixed tm secrets set no longer hangs on a stuck paste tool or runs one found through PATH. It runs pbpaste, wl-paste, xclip or xsel only from fixed system directories, kills the tool and its whole process group after 5 seconds, and refuses clipboard text over 1 MiB. A timeout or oversize is an error and stores nothing; when no tool is found, the error names the directories searched and points to --value - (#7524).
• Changed tm doctor's tcp_listeners row cites #9214 instead of #6285 when it warns about a trusty-search TCP listener. It still warns rather than fails, because a trusty-search older than 0.59.0 binds 7878. The scripts/check_no_tcp_listeners.sh allowlist keeps only the serve --with-http and bind_with_auto_port source sites for trusty-search.

All changes →

What’s new

0.12.7· 2026-10-10

• Breaking TrustySearchClient::new takes the trusty-search socket path instead of an HTTP base URL; TrustySearchClient::from_env builds one at the standard path (#9214).
• Breaking TrustySearchClient::base_url() is removed; socket_path() names the socket the client calls (#9214).
• Breaking The --search-url flag and the TRUSTY_SEARCH_URL environment variable are removed. trusty-analyze reaches trusty-search only over its Unix socket, with no TCP fallback (#9214).

All changes →

What’s new

0.38.5· 2026-10-10

• Fixed Spec-docs discovery now reports unavailable, naming the index, when that index is listed without a root_path; it used to drop every absolute search hit silently and look as if it had found nothing (refs #9593)

All changes →