@theglitchking/semantic-memory 1.5.0 → 1.5.1

package/.claude-plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Single-plugin marketplace for semantic-memory — the unified memory-layer plugin. v1.1.0 absorbs brain's strengths: AGENTS.md contract artifact, hard-gated verification sessions, multi-agent skill bundler (codex/copilot/pi), and SessionStart drift detection. v1.3 adds confidence decay — age-aware retrieval ranking with verify_note to reset the clock. All backwards-compatible with v1.0.x via deprecation shims.",
-    "version": "1.5.0"
+    "version": "1.5.1"
   },
   "plugins": [
     {
       "name": "semantic-memory",
       "description": "Unified memory-layer plugin for Claude Code. One MCP server, 44 tools across multi-corpus search/read/write/graph/lint/sessions/contract. v1.1.0 adds: AGENTS.md contract artifact, hard-gated verification sessions (session_start/run/finish/status), proposal-mode synthesize_note + synthesize_promote, multi-agent skill bundler (codex/copilot/pi via the new `skills` CLI), and SessionStart drift detection. v1.2 completes the hygiene line: `/healthcheck --fix` auto-remediation, `lint_vault({checks:['code_symbols']})` code-path drift, and a fresh-install CI smoke gate. v1.3 adds confidence decay: age-aware search ranking (0.5^(age/half-life), type-aware, floored, composes with load_priority), a `decay` block surfaced on decayed results, `verify_note` to reset the clock, `evergreen` opt-out, and `decay-config`/`decay-trace` CLI introspection. v1.3.1 adds local-only selection-logging telemetry (which note each search result actually got used), the `decay_candidates` lint, and a `selection-stats` CLI. v1.4.0 is the resident-expert bridge: a learned human→artifact lexicon (`manage_lexicon`) with propose-and-confirm alias capture, verbatim symptom capture + symptom-keyed indexing (terse symptom queries match the note), Tier-1 lexicon query expansion in the hook, archive path-class down-weight, injection hygiene (score-gate + dedup + top-3 + compact instructions), section-targeted `read_note`, and opt-in conditional tool registration. v1.5.0 is the expert-character layer: entity dossiers (`manage_dossier`) — per-component living notes (purpose / failure modes / knobs / incident log / current state) that accrete in place, with two-hop retrieval (utterance→entity→dossier injected first); usage-feedback ranking that boosts repeatedly-cited notes (capped, composes with decay/path-class) plus a `decoys` lint for retrieved-but-never-cited notes (surfaced, never auto-down-ranked); session paging (Stop drafts a durable session digest as a proposal, SessionStart pages in a curated digest instead of a broad sweep); and a speaker profile (`manage_profile`) that models how the human communicates — severity calibration, chronic omissions, verbosity, shorthand — injected at SessionStart. Backwards-compatible with v1.0.x — every previous tool name remains callable through deprecation shims (removed in v2.0.0).",
-      "version": "1.5.0",
+      "version": "1.5.1",
       "author": {
         "name": "TheGlitchKing"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "semantic-memory",
   "description": "Unified memory-layer plugin for Claude Code. One MCP server, multiple typed corpora (vault / code / plans / docs / research / project-map), unified cross-corpus knowledge graph, conditional tool registration, in-process drift detection, and human↔code translation. Rebrand of `semantic-sidekick` at v1.0.0 — see CHANGELOG for migration.",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "author": {
     "name": "TheGlitchKing",
     "email": "theglitchking@users.noreply.github.com"

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to semantic-memory (formerly semantic-sidekick) will be documented here.
 
+## [1.5.1] - 2026-07-12 — Dependency audit hardening (supply chain)
+
+Patch release: clears the transitive `npm audit` findings surfaced after upgrading from the 1.2.x line, with **no runtime or API change**. Every advisory was unreachable in practice — this is a local **stdio** MCP server plus hook scripts processing the user's **own** files: the `hono`/`express-rate-limit`/`ip-address`/`qs`/`fast-uri` cluster is the MCP SDK's HTTP-server transport, which this plugin never instantiates (stdio only); `protobufjs`/`@xmldom/xmldom` are the local embedding runtime; `js-yaml`/`brace-expansion` parse your own notes/globs.
+
+### Changed
+
+- **`overrides` block pins patched, SAME-MAJOR transitive versions** — `protobufjs 7.6.5`, `@protobufjs/utf8 1.1.2`, `@xmldom/xmldom 0.9.10`, `brace-expansion 5.0.7`, `qs 6.15.3`, `ip-address 10.2.0`, `express-rate-limit 8.5.2`, `hono 4.12.29`, `@hono/node-server 1.19.14`. No breaking bumps. `js-yaml` (3.15.0) and `fast-uri` (3.1.3) resolve to their patched in-range versions on a fresh install — no override needed.
+- **Result: `npm audit --omit=dev` (the production tree consumers install) = 0 vulnerabilities.** The one remaining full-audit item (`esbuild`, low) is a dev-only tsup/vitest tool whose advisory is a *Windows dev server* file-read — it never ships in the package (`files` excludes it) and never runs in a consumer.
+
+### Notes for consumers
+
+npm ignores a **dependency's** `overrides` in downstream installs — only the *root* project's overrides apply. So a project that gates CI on `npm audit` after installing this plugin should either run `npm audit fix` (all fixes are in-range, non-breaking, no `--force`) or mirror the `overrides` block above. `js-yaml` and `fast-uri` are deliberately **not** force-bumped to their next majors: doing so breaks `gray-matter` frontmatter parsing and `ajv`/MCP tool-input validation (empirically — forcing the majors failed 76 tests), and the DoS vectors require attacker-controlled input this plugin never accepts.
+
+### Tests
+
+- Full suite **418 green** with the pinned overrides; `npm run build` clean; production audit 0.
+
 ## [1.5.0] - 2026-07-11 — Expert-character layer (v1.5.0: Phases 8–11)
 
 Where v1.4.0 taught the plugin *how this human talks about the system*, v1.5.0 gives it the other two traits of a resident expert: it organizes memory by **component** (not by file) and **learns from its own usage**. Tool surface 42 → 44 (`manage_dossier`, `manage_profile`; read-only unchanged at 21). Additive throughout; `usage_boost.enabled: false` reproduces byte-identical pre-v1.5 ranking.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theglitchking/semantic-memory",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Unified memory-layer plugin for Claude Code. One MCP server, multiple typed corpora (vault, code, plans, docs, research, project-map), unified cross-corpus knowledge graph, conditional tool registration, in-process drift detection, and human↔code translation. Rebrand of @theglitchking/semantic-sidekick at v1.0 — see CHANGELOG for migration.",
   "type": "module",
   "main": "./dist/core/index.js",
@@ -95,5 +95,19 @@
     "tsup": "^8.5.1",
     "typescript": "^6.0.2",
     "vitest": "^4.1.2"
+  },
+  "comments": {
+    "overrides": "Pin patched versions of transitive deps to keep this package's supply chain clean (v1.5.1). All are same-MAJOR bumps — no breaking changes. NOTE: npm ignores a dependency's overrides in downstream installs, so consuming projects that gate CI on `npm audit` should mirror this block or run `npm audit fix`. Every advisory here is unreachable in practice: this is a local stdio MCP server + hook scripts processing the user's own files — the hono/express-rate-limit/ip-address/qs cluster is the MCP SDK's HTTP transport, which this plugin never instantiates (stdio only). js-yaml (gray-matter) and fast-uri (ajv) are deliberately NOT overridden: their only fixes are MAJOR bumps that would break frontmatter parsing / MCP tool-input validation, and the DoS vectors require attacker-controlled input this plugin never accepts."
+  },
+  "overrides": {
+    "protobufjs": "7.6.5",
+    "@protobufjs/utf8": "1.1.2",
+    "@xmldom/xmldom": "0.9.10",
+    "brace-expansion": "5.0.7",
+    "qs": "6.15.3",
+    "ip-address": "10.2.0",
+    "express-rate-limit": "8.5.2",
+    "hono": "4.12.29",
+    "@hono/node-server": "1.19.14"
   }
 }