gitmem-mcp 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-02-15
+
+### Changed
+- **Tool alias consolidation**: Reduced advertised tools from 55 to 20 (free tier). Aliases still work when called directly. Set `GITMEM_FULL_ALIASES=1` to restore all.
+- **Starter scars reduced**: Ship with 3 high-quality starter scars instead of 12. Starter scars deprioritized with 0.7x score multiplier so earned scars outrank them.
+- **Recall similarity threshold**: Weak matches below threshold (0.4 BM25, 0.35 embeddings) are suppressed. Empty results show helpful guidance instead of noise.
+- **Adaptive session closing**: Auto-detects ceremony level (micro/standard/full) based on session activity. Removed hard rejection gate that blocked standard closes on short sessions.
+- **Scar relevance feedback**: Optional `relevance` field (high/low/noise) on `confirm_scars` for recall quality improvement. Defaults derived from decision type.
+- **Pro tier messaging**: Rewritten from agent's perspective with concrete value propositions.
+
+### Added
+- **Agent briefing**: Generates `.gitmem/agent-briefing.md` at session close with memory state summary for MEMORY.md bridge.
+- **PMEM/GitMem boundary docs**: README section documenting how GitMem complements MEMORY.md/cursorrules.
+
 ## [1.0.2] - 2026-02-15
 
 ### Fixed
@@ -17,12 +31,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.0] - 2026-02-10
 
 ### Added
-- **Hooks plugin bundled**: `gitmem install-hooks` / `uninstall-hooks` CLI commands (OD-605, OD-606)
+- **Hooks plugin bundled**: `gitmem install-hooks` / `uninstall-hooks` CLI commands
 - **CLI `check` command wired**: `gitmem check` now reachable from CLI (was defined but unreachable)
-- **Fresh-install E2E tests**: 16 integration tests covering CLI commands, hooks, and MCP server lifecycle (OD-607)
-- **README rewrite**: External-developer-facing docs with no internal jargon (OD-608)
+- **Fresh-install E2E tests**: 16 integration tests covering CLI commands, hooks, and MCP server lifecycle
+- **README rewrite**: External-developer-facing docs with no internal jargon
 - **CONTRIBUTING.md**: Dev setup, testing tiers, and PR guidelines
-- **First public npm release** (OD-609)
+- **First public npm release**
 
 ### Changed
 - Package name standardized to `gitmem-mcp` for npm
@@ -32,11 +46,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.2.0] - 2026-02-08
 
 ### Added
-- **Full monorepo sync**: Standalone repo is now source of truth (Option A — OD-574, GIT-1)
+- **Full monorepo sync**: Standalone repo is now source of truth
 - **Zod schemas**: 14 schema files for all tool parameter validation (`src/schemas/`)
 - **Diagnostics suite**: Health checks, channel instrumentation, anonymization (`src/diagnostics/`)
 - **Single source of truth constants**: Closing questions defined once (`src/constants/closing-questions.ts`)
-- **Multi-agent tools**: `prepare_context` and `absorb_observations` (GitMem v2 Phase 1-2)
+- **Multi-agent tools**: `prepare_context` and `absorb_observations`
 - **Tool definitions module**: Centralized tool registration (`src/tools/definitions.ts`)
 - **Commands module**: `gitmem check` CLI health diagnostics (`src/commands/check.ts`)
 - **Full test suite**: 354+ unit tests across 20 test files, plus integration, e2e, and performance benchmarks

package/README.md

@@ -5,16 +5,16 @@
 <p align="center">
   <a href="https://www.npmjs.com/package/gitmem-mcp"><img src="https://img.shields.io/npm/v/gitmem-mcp?style=flat-square&color=ed1e25&label=npm" alt="npm version" /></a>
   <a href="https://www.npmjs.com/package/gitmem-mcp"><img src="https://img.shields.io/npm/dm/gitmem-mcp?style=flat-square&color=333333&label=downloads" alt="npm downloads" /></a>
-  <a href="https://github.com/nTEG-dev/gitmem/blob/main/LICENSE"><img src="https://img.shields.io/github/license/nTEG-dev/gitmem?style=flat-square&color=ed1e25" alt="MIT License" /></a>
-  <a href="https://github.com/nTEG-dev/gitmem/actions"><img src="https://img.shields.io/github/actions/workflow/status/nTEG-dev/gitmem/deploy-docs.yml?style=flat-square&color=333333&label=build" alt="Build" /></a>
+  <img src="https://img.shields.io/badge/license-MIT-ed1e25?style=flat-square" alt="MIT License" />
+  <img src="https://img.shields.io/badge/build-passing-333333?style=flat-square" alt="Build" />
   <img src="https://img.shields.io/badge/node-%3E%3D22-ed1e25?style=flat-square" alt="Node.js >= 22" />
 </p>
 
 <p align="center">
-  <a href="https://gitmem.dev/docs"><strong>Documentation</strong></a> &middot;
+  <a href="https://gitmem.ai/docs"><strong>Documentation</strong></a> &middot;
   <a href="https://www.npmjs.com/package/gitmem-mcp"><strong>npm</strong></a> &middot;
-  <a href="https://gitmem.dev/docs/getting-started"><strong>Getting Started</strong></a> &middot;
-  <a href="https://gitmem.dev/docs/tools"><strong>Tool Reference</strong></a>
+  <a href="https://gitmem.ai/docs/getting-started"><strong>Getting Started</strong></a> &middot;
+  <a href="https://gitmem.ai/docs/tools"><strong>Tool Reference</strong></a>
 </p>
 
 ---
@@ -30,7 +30,7 @@ npx gitmem init
 ```
 
 One command. The wizard sets up everything:
-- `.gitmem/` directory with 12 starter scars
+- `.gitmem/` directory with 3 starter scars
 - `.mcp.json` with gitmem server entry
 - `CLAUDE.md` with memory protocol instructions
 - `.claude/settings.json` with tool permissions
@@ -72,7 +72,7 @@ Every scar includes **counter-arguments** — reasons why someone might reasonab
 - **Automatic Recall** — Scars surface before the agent takes similar actions
 - **Session Continuity** — Context, threads, and rapport carry across sessions
 - **Closing Ceremony** — Structured reflection captures what broke, what worked, and what to do differently
-- **23 MCP Tools** — Full toolkit for memory management, search, threads, and multi-agent coordination
+- **20+ MCP Tools** — Full toolkit for memory management, search, threads, and multi-agent coordination
 - **Zero Config** — `npx gitmem init` and you're running
 - **Non-Destructive** — Merges with your existing `.mcp.json`, `CLAUDE.md`, and hooks
 
@@ -114,9 +114,30 @@ Every scar includes **counter-arguments** — reasons why someone might reasonab
 
 ## Pro Tier — Coming Soon
 
-The free tier gives you everything you need for solo projects. **Pro** will add cloud storage (Supabase), semantic vector search, cross-machine sync, team shared memory, and session transcripts.
+| What you get | Why your agent cares |
+|-------------|---------------------|
+| **Semantic search** | Recall returns the *right* scars, not keyword noise |
+| **Session analytics** | Spot patterns in what keeps going wrong |
+| **Sub-agent briefing** | Hand institutional context to sub-agents automatically |
+| **Cloud persistence** | Memory survives machine changes, shareable across team |
+| **A/B testing** | Optimize scar phrasing based on what actually changes behavior |
 
-[Join the mailing list](https://gitmem.dev) to get notified when Pro launches.
+The free tier gives you everything for solo projects. Pro makes recall smarter and memory portable.
+
+[Join the mailing list](https://gitmem.ai) to get notified.
+
+## GitMem + MEMORY.md
+
+Your AI agent likely has its own memory file (MEMORY.md, .cursorrules, etc.). Here's how they work together:
+
+| | MEMORY.md | GitMem |
+|---|-----------|--------|
+| **Loaded** | Every turn (system prompt) | On-demand (tool calls) |
+| **Best for** | Preferences, shortcuts, quick reference | Earned lessons, unfinished work, decisions |
+| **Updates** | Agent writes directly | Session lifecycle (close ceremony) |
+| **Example** | "User prefers terse output" | "Always validate UUID before DB lookup" |
+
+**Tip:** Include `.gitmem/agent-briefing.md` in your MEMORY.md for a lightweight bridge between the two systems.
 
 ## Development
 

package/dist/commands/check.d.ts

@@ -8,7 +8,7 @@
  *   npx gitmem check --full    — Full diagnostic (~30s)
  *   npx gitmem check --output report.json
  *
- * Issue: OD-584
+ *
  */
 /**
  * Command options

package/dist/commands/check.js

@@ -8,13 +8,14 @@
  *   npx gitmem check --full    — Full diagnostic (~30s)
  *   npx gitmem check --output report.json
  *
- * Issue: OD-584
+ *
  */
 import { existsSync, mkdirSync, writeFileSync, readdirSync, statSync } from "fs";
 import { join } from "path";
 import { DiagnosticsCollector, runBenchmark, anonymizeSupabaseUrl, anonymizePath, isApiKeyConfigured, getSafeEnvironmentInfo, } from "../diagnostics/index.js";
 import { getCache, CacheService } from "../services/cache.js";
 import { getTier, hasSupabase } from "../services/tier.js";
+import { getGitmemDir } from "../services/gitmem-dir.js";
 // Report version for schema compatibility
 const REPORT_VERSION = "1.0.0";
 /**
@@ -287,7 +288,7 @@ async function runQuickCheck() {
     // Data volume (counts only)
     let dataVolume;
     try {
-        const gitmemDir = join(process.cwd(), ".gitmem");
+        const gitmemDir = getGitmemDir();
         let localCacheFiles = 0;
         let localCacheBytes = 0;
         if (existsSync(gitmemDir)) {
@@ -463,7 +464,7 @@ export async function runCheck(options) {
         dataVolume,
     };
     // Determine output path
-    const gitmemDir = join(process.cwd(), ".gitmem");
+    const gitmemDir = getGitmemDir();
     if (!existsSync(gitmemDir)) {
         mkdirSync(gitmemDir, { recursive: true });
     }

package/dist/diagnostics/anonymizer.d.ts

@@ -14,7 +14,7 @@
  * - Hostnames → excluded
  * - Platform/Node version → included
  *
- * Issue: OD-584
+ *
  */
 /**
  * Anonymize a Supabase URL

package/dist/diagnostics/anonymizer.js

@@ -14,7 +14,7 @@
  * - Hostnames → excluded
  * - Platform/Node version → included
  *
- * Issue: OD-584
+ *
  */
 /**
  * Regex patterns for sensitive data

package/dist/diagnostics/channels.d.ts

@@ -5,7 +5,7 @@
  * When no subscriber is attached, publish() is essentially a no-op.
  *
  * Pattern reference: @ibm/telemetry-js
- * Issue: OD-584
+ *
  */
 import { channel, Channel } from "diagnostics_channel";
 /**

package/dist/diagnostics/channels.js

@@ -5,7 +5,7 @@
  * When no subscriber is attached, publish() is essentially a no-op.
  *
  * Pattern reference: @ibm/telemetry-js
- * Issue: OD-584
+ *
  */
 import { channel } from "diagnostics_channel";
 /**

package/dist/diagnostics/collector.d.ts

@@ -4,7 +4,7 @@
  * Subscribes to diagnostics_channel events and collects metrics
  * during diagnostic pass. Anonymizes data as it's collected.
  *
- * Issue: OD-584
+ *
  */
 /**
  * Collected metrics for a diagnostic run

package/dist/diagnostics/collector.js

@@ -4,7 +4,7 @@
  * Subscribes to diagnostics_channel events and collects metrics
  * during diagnostic pass. Anonymizes data as it's collected.
  *
- * Issue: OD-584
+ *
  */
 import { subscribe, unsubscribe } from "diagnostics_channel";
 import { CHANNEL_NAMES, } from "./channels.js";

package/dist/diagnostics/index.d.ts

@@ -20,7 +20,7 @@
  *   // ... run operations ...
  *   const metrics = collector.stop();
  *
- * Issue: OD-584
+ *
  */
 export { diagnostics, CHANNEL_NAMES, channel, type ToolCallEvent, type CacheEvent, type DbQueryEvent, type EmbeddingCallEvent, type ErrorEvent, } from "./channels.js";
 export { DiagnosticsCollector, getCollector, resetCollector, runBenchmark, percentile, type DiagnosticMetrics, type DiagnosticReport, type HealthCheckResult, type BenchmarkResult, } from "./collector.js";

package/dist/diagnostics/index.js

@@ -20,7 +20,7 @@
  *   // ... run operations ...
  *   const metrics = collector.stop();
  *
- * Issue: OD-584
+ *
  */
 // Channel definitions and publisher
 export { diagnostics, CHANNEL_NAMES, channel, } from "./channels.js";

package/dist/hooks/quick-retrieve.js

@@ -21,6 +21,7 @@ import { getStorage } from "../services/storage.js";
 import { hasSupabase } from "../services/tier.js";
 import { isLocalSearchReady, localScarSearch } from "../services/local-vector-search.js";
 import { bm25Search } from "../services/bm25.js";
+import { getGitmemDir } from "../services/gitmem-dir.js";
 import { formatCompact } from "./format-utils.js";
 /**
  * Perform a quick scar search optimized for hook invocation.
@@ -72,7 +73,7 @@ export async function quickRetrieve(prompt, retrievalLevel, options = {}) {
  * Uses BM25 ranking with field boosting (title 3x, keywords 2x, description 1x).
  */
 function searchDiskCache(query, k) {
-    const cachePath = path.join(process.cwd(), ".gitmem", "cache", "hook-scars.json");
+    const cachePath = path.join(getGitmemDir(), "cache", "hook-scars.json");
     if (!fs.existsSync(cachePath)) {
         return [];
     }

package/dist/schemas/active-sessions.d.ts

@@ -1,25 +1,25 @@
 /**
- * Zod schemas for active-sessions.json registry (GIT-19)
+ * Zod schemas for active-sessions.json registry
  *
  * Validates data read from disk — defensive parsing of potentially corrupted JSON.
  */
 import { z } from "zod";
 export declare const ActiveSessionEntrySchema: z.ZodObject<{
     session_id: z.ZodString;
-    agent: z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>;
+    agent: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>;
     started_at: z.ZodString;
     hostname: z.ZodString;
     pid: z.ZodNumber;
     project: z.ZodDefault<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     project: string;
-    agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+    agent: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown";
     session_id: string;
     started_at: string;
     hostname: string;
     pid: number;
 }, {
-    agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+    agent: string;
     session_id: string;
     started_at: string;
     hostname: string;
@@ -29,20 +29,20 @@ export declare const ActiveSessionEntrySchema: z.ZodObject<{
 export declare const ActiveSessionsRegistrySchema: z.ZodObject<{
     sessions: z.ZodArray<z.ZodObject<{
         session_id: z.ZodString;
-        agent: z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>;
+        agent: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>;
         started_at: z.ZodString;
         hostname: z.ZodString;
         pid: z.ZodNumber;
         project: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         project: string;
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown";
         session_id: string;
         started_at: string;
         hostname: string;
         pid: number;
     }, {
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: string;
         session_id: string;
         started_at: string;
         hostname: string;
@@ -52,7 +52,7 @@ export declare const ActiveSessionsRegistrySchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     sessions: {
         project: string;
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown";
         session_id: string;
         started_at: string;
         hostname: string;
@@ -60,7 +60,7 @@ export declare const ActiveSessionsRegistrySchema: z.ZodObject<{
     }[];
 }, {
     sessions: {
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: string;
         session_id: string;
         started_at: string;
         hostname: string;

package/dist/schemas/active-sessions.js

@@ -1,5 +1,5 @@
 /**
- * Zod schemas for active-sessions.json registry (GIT-19)
+ * Zod schemas for active-sessions.json registry
  *
  * Validates data read from disk — defensive parsing of potentially corrupted JSON.
  */

package/dist/schemas/common.d.ts

@@ -7,11 +7,8 @@ import { z } from "zod";
  */
 export declare const ProjectSchema: z.ZodDefault<z.ZodString>;
 export type Project = string;
-/**
- * Agent identity enum
- */
-export declare const AgentIdentitySchema: z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>;
-export type AgentIdentity = z.infer<typeof AgentIdentitySchema>;
+export declare const AgentIdentitySchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>;
+export type AgentIdentity = "cli" | "desktop" | "autonomous" | "local" | "cloud" | "Unknown";
 /**
  * Learning type enum (scar, win, pattern)
  */

package/dist/schemas/common.js

@@ -9,14 +9,20 @@ export const ProjectSchema = z.string().default("default");
 /**
  * Agent identity enum
  */
-export const AgentIdentitySchema = z.enum([
-    "CLI",
-    "DAC",
-    "CODA-1",
-    "Brain_Local",
-    "Brain_Cloud",
-    "Unknown",
+const LEGACY_AGENT_MAP = {
+    "CLI": "cli",
+    "DAC": "desktop",
+    "CODA-1": "autonomous",
+    "Brain_Local": "local",
+    "Brain_Cloud": "cloud",
+};
+const VALID_AGENTS = new Set([
+    "cli", "desktop", "autonomous", "local", "cloud", "Unknown",
+    "CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud",
 ]);
+export const AgentIdentitySchema = z.string()
+    .refine((val) => VALID_AGENTS.has(val), { message: "Invalid agent identity" })
+    .transform((val) => (LEGACY_AGENT_MAP[val] || val));
 /**
  * Learning type enum (scar, win, pattern)
  */

package/dist/schemas/create-learning.d.ts

@@ -37,8 +37,8 @@ export declare const CreateLearningParamsSchema: z.ZodEffects<z.ZodObject<{
     why_this_matters?: string | undefined;
     action_protocol?: string[] | undefined;
     self_check_criteria?: string[] | undefined;
-    source_linear_issue?: string | undefined;
     domain?: string[] | undefined;
+    source_linear_issue?: string | undefined;
     scar_type?: string | undefined;
     problem_context?: string | undefined;
     solution_approach?: string | undefined;
@@ -54,8 +54,8 @@ export declare const CreateLearningParamsSchema: z.ZodEffects<z.ZodObject<{
     why_this_matters?: string | undefined;
     action_protocol?: string[] | undefined;
     self_check_criteria?: string[] | undefined;
-    source_linear_issue?: string | undefined;
     domain?: string[] | undefined;
+    source_linear_issue?: string | undefined;
     scar_type?: string | undefined;
     problem_context?: string | undefined;
     solution_approach?: string | undefined;
@@ -71,8 +71,8 @@ export declare const CreateLearningParamsSchema: z.ZodEffects<z.ZodObject<{
     why_this_matters?: string | undefined;
     action_protocol?: string[] | undefined;
     self_check_criteria?: string[] | undefined;
-    source_linear_issue?: string | undefined;
     domain?: string[] | undefined;
+    source_linear_issue?: string | undefined;
     scar_type?: string | undefined;
     problem_context?: string | undefined;
     solution_approach?: string | undefined;
@@ -88,8 +88,8 @@ export declare const CreateLearningParamsSchema: z.ZodEffects<z.ZodObject<{
     why_this_matters?: string | undefined;
     action_protocol?: string[] | undefined;
     self_check_criteria?: string[] | undefined;
-    source_linear_issue?: string | undefined;
     domain?: string[] | undefined;
+    source_linear_issue?: string | undefined;
     scar_type?: string | undefined;
     problem_context?: string | undefined;
     solution_approach?: string | undefined;

package/dist/schemas/create-learning.js

@@ -25,7 +25,7 @@ export const CreateLearningParamsSchema = z
     keywords: z.array(z.string()).optional(),
     source_linear_issue: z.string().optional(),
     project: ProjectSchema.optional(),
-    // OD-508: LLM-cooperative enforcement fields
+    // LLM-cooperative enforcement fields
     why_this_matters: z.string().optional(),
     action_protocol: z.array(z.string()).optional(),
     self_check_criteria: z.array(z.string()).optional(),

package/dist/schemas/session-close.d.ts

@@ -41,7 +41,7 @@ export declare const ClosingReflectionSchema: z.ZodObject<{
 }>;
 export type ClosingReflection = z.infer<typeof ClosingReflectionSchema>;
 /**
- * Task completion proof schema (OD-491)
+ * Task completion proof schema
  */
 export declare const TaskCompletionSchema: z.ZodObject<{
     questions_displayed_at: z.ZodEffects<z.ZodString, string, string>;
@@ -124,11 +124,8 @@ export declare const ScarUsageEntrySchema: z.ZodObject<{
     variant_id?: string | undefined;
 }>;
 export type ScarUsageEntry = z.infer<typeof ScarUsageEntrySchema>;
-/**
- * Session close parameters schema
- */
 export declare const SessionCloseParamsSchema: z.ZodObject<{
-    session_id: z.ZodString;
+    session_id: z.ZodEffects<z.ZodString, string, string>;
     close_type: z.ZodEnum<["standard", "quick", "autonomous", "retroactive"]>;
     task_completion: z.ZodOptional<z.ZodObject<{
         questions_displayed_at: z.ZodEffects<z.ZodString, string, string>;
@@ -270,10 +267,10 @@ export declare const SessionCloseParamsSchema: z.ZodObject<{
         variant_id?: string | undefined;
     }>, "many">>;
     capture_transcript: z.ZodOptional<z.ZodBoolean>;
-    transcript_path: z.ZodOptional<z.ZodString>;
+    transcript_path: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
     session_id: string;
-    close_type: "standard" | "quick" | "autonomous" | "retroactive";
+    close_type: "autonomous" | "standard" | "quick" | "retroactive";
     decisions?: {
         title: string;
         decision: string;
@@ -330,7 +327,7 @@ export declare const SessionCloseParamsSchema: z.ZodObject<{
     capture_transcript?: boolean | undefined;
 }, {
     session_id: string;
-    close_type: "standard" | "quick" | "autonomous" | "retroactive";
+    close_type: "autonomous" | "standard" | "quick" | "retroactive";
     decisions?: {
         title: string;
         decision: string;

package/dist/schemas/session-close.js

@@ -22,7 +22,7 @@ export const ClosingReflectionSchema = z.object({
     rapport_notes: z.string().optional(),
 });
 /**
- * Task completion proof schema (OD-491)
+ * Task completion proof schema
  */
 export const TaskCompletionSchema = z.object({
     questions_displayed_at: ISOTimestampSchema,
@@ -59,8 +59,12 @@ export const ScarUsageEntrySchema = z.object({
 /**
  * Session close parameters schema
  */
+// Session ID must be UUID or 8-char hex short-ID (no path traversal)
+const SessionIdSchema = z.string().min(1, "session_id is required").refine((val) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(val) || /^[0-9a-f]{8}$/i.test(val), { message: "session_id must be a UUID or 8-char hex short-ID" });
+// Transcript path must not contain path traversal sequences
+const SafeTranscriptPathSchema = z.string().refine((val) => !val.includes("..") && !val.includes("\0"), { message: "transcript_path must not contain path traversal sequences" });
 export const SessionCloseParamsSchema = z.object({
-    session_id: z.string().min(1, "session_id is required"),
+    session_id: SessionIdSchema,
     close_type: CloseTypeSchema,
     task_completion: TaskCompletionSchema.optional(),
     closing_reflection: ClosingReflectionSchema.optional(),
@@ -73,7 +77,7 @@ export const SessionCloseParamsSchema = z.object({
     ceremony_duration_ms: z.number().nonnegative().optional(),
     scars_to_record: z.array(ScarUsageEntrySchema).optional(),
     capture_transcript: z.boolean().optional(),
-    transcript_path: z.string().optional(),
+    transcript_path: SafeTranscriptPathSchema.optional(),
 });
 /**
  * Validate session_close params with close type specific rules

package/dist/schemas/session-start.d.ts

@@ -9,19 +9,19 @@ import { z } from "zod";
  * and use defaults for project.
  */
 export declare const SessionStartParamsSchema: z.ZodObject<{
-    agent_identity: z.ZodOptional<z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>>;
+    agent_identity: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>>;
     linear_issue: z.ZodOptional<z.ZodString>;
     issue_title: z.ZodOptional<z.ZodString>;
     issue_description: z.ZodOptional<z.ZodString>;
     issue_labels: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     project: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-    /** OD-558: Force overwrite of existing active session */
+    /** Force overwrite of existing active session */
     force: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     project?: string | undefined;
     linear_issue?: string | undefined;
     force?: boolean | undefined;
-    agent_identity?: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown" | undefined;
+    agent_identity?: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown" | undefined;
     issue_title?: string | undefined;
     issue_description?: string | undefined;
     issue_labels?: string[] | undefined;
@@ -29,7 +29,7 @@ export declare const SessionStartParamsSchema: z.ZodObject<{
     project?: string | undefined;
     linear_issue?: string | undefined;
     force?: boolean | undefined;
-    agent_identity?: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown" | undefined;
+    agent_identity?: string | undefined;
     issue_title?: string | undefined;
     issue_description?: string | undefined;
     issue_labels?: string[] | undefined;

package/dist/schemas/session-start.js

@@ -16,7 +16,7 @@ export const SessionStartParamsSchema = z.object({
     issue_description: z.string().optional(),
     issue_labels: z.array(z.string()).optional(),
     project: ProjectSchema.optional(),
-    /** OD-558: Force overwrite of existing active session */
+    /** Force overwrite of existing active session */
     force: z.boolean().optional(),
 });
 /**

package/dist/schemas/thread.d.ts

@@ -1,5 +1,5 @@
 /**
- * Zod schemas for thread lifecycle tools (OD-thread-lifecycle)
+ * Zod schemas for thread lifecycle tools
  */
 import { z } from "zod";
 /**

package/dist/schemas/thread.js

@@ -1,5 +1,5 @@
 /**
- * Zod schemas for thread lifecycle tools (OD-thread-lifecycle)
+ * Zod schemas for thread lifecycle tools
  */
 import { z } from "zod";
 import { ProjectSchema } from "./common.js";

package/dist/server.d.ts

@@ -12,8 +12,8 @@ export declare function createServer(): Server;
 /**
  * Run the server with stdio transport
  *
- * OD-473: Initializes local vector search in background for fast startup.
- * OD-489: Uses direct Supabase queries to get embeddings for local cache.
+ * Initializes local vector search in background for fast startup.
+ * Uses direct Supabase queries to get embeddings for local cache.
  *
  * Server starts immediately; cache loads in background.
  * First few queries may use Supabase fallback until cache is ready.