gitmem-mcp 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -10,16 +10,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.3] - 2026-02-15
 
 ### Changed
-- **Tool alias consolidation (OD-691)**: Reduced advertised tools from 55 to 20 (free tier). Aliases still work when called directly. Set `GITMEM_FULL_ALIASES=1` to restore all.
-- **Starter scars reduced (OD-684)**: Ship with 3 high-quality starter scars instead of 12. Starter scars deprioritized with 0.7x score multiplier so earned scars outrank them.
-- **Recall similarity threshold (OD-686)**: Weak matches below threshold (0.4 BM25, 0.35 embeddings) are suppressed. Empty results show helpful guidance instead of noise.
-- **Adaptive session closing (OD-685)**: Auto-detects ceremony level (micro/standard/full) based on session activity. Removed hard rejection gate that blocked standard closes on short sessions.
-- **Scar relevance feedback (OD-690)**: Optional `relevance` field (high/low/noise) on `confirm_scars` for recall quality improvement. Defaults derived from decision type.
-- **Pro tier messaging (OD-688)**: Rewritten from agent's perspective with concrete value propositions.
+- **Tool alias consolidation**: Reduced advertised tools from 55 to 20 (free tier). Aliases still work when called directly. Set `GITMEM_FULL_ALIASES=1` to restore all.
+- **Starter scars reduced**: Ship with 3 high-quality starter scars instead of 12. Starter scars deprioritized with 0.7x score multiplier so earned scars outrank them.
+- **Recall similarity threshold**: Weak matches below threshold (0.4 BM25, 0.35 embeddings) are suppressed. Empty results show helpful guidance instead of noise.
+- **Adaptive session closing**: Auto-detects ceremony level (micro/standard/full) based on session activity. Removed hard rejection gate that blocked standard closes on short sessions.
+- **Scar relevance feedback**: Optional `relevance` field (high/low/noise) on `confirm_scars` for recall quality improvement. Defaults derived from decision type.
+- **Pro tier messaging**: Rewritten from agent's perspective with concrete value propositions.
 
 ### Added
-- **Agent briefing (OD-689)**: Generates `.gitmem/agent-briefing.md` at session close with memory state summary for MEMORY.md bridge.
-- **PMEM/GitMem boundary docs (OD-687)**: README section documenting how GitMem complements MEMORY.md/cursorrules.
+- **Agent briefing**: Generates `.gitmem/agent-briefing.md` at session close with memory state summary for MEMORY.md bridge.
+- **PMEM/GitMem boundary docs**: README section documenting how GitMem complements MEMORY.md/cursorrules.
 
 ## [1.0.2] - 2026-02-15
 
@@ -31,12 +31,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.0] - 2026-02-10
 
 ### Added
-- **Hooks plugin bundled**: `gitmem install-hooks` / `uninstall-hooks` CLI commands (OD-605, OD-606)
+- **Hooks plugin bundled**: `gitmem install-hooks` / `uninstall-hooks` CLI commands
 - **CLI `check` command wired**: `gitmem check` now reachable from CLI (was defined but unreachable)
-- **Fresh-install E2E tests**: 16 integration tests covering CLI commands, hooks, and MCP server lifecycle (OD-607)
-- **README rewrite**: External-developer-facing docs with no internal jargon (OD-608)
+- **Fresh-install E2E tests**: 16 integration tests covering CLI commands, hooks, and MCP server lifecycle
+- **README rewrite**: External-developer-facing docs with no internal jargon
 - **CONTRIBUTING.md**: Dev setup, testing tiers, and PR guidelines
-- **First public npm release** (OD-609)
+- **First public npm release**
 
 ### Changed
 - Package name standardized to `gitmem-mcp` for npm
@@ -46,11 +46,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.2.0] - 2026-02-08
 
 ### Added
-- **Full monorepo sync**: Standalone repo is now source of truth (Option A — OD-574, GIT-1)
+- **Full monorepo sync**: Standalone repo is now source of truth
 - **Zod schemas**: 14 schema files for all tool parameter validation (`src/schemas/`)
 - **Diagnostics suite**: Health checks, channel instrumentation, anonymization (`src/diagnostics/`)
 - **Single source of truth constants**: Closing questions defined once (`src/constants/closing-questions.ts`)
-- **Multi-agent tools**: `prepare_context` and `absorb_observations` (GitMem v2 Phase 1-2)
+- **Multi-agent tools**: `prepare_context` and `absorb_observations`
 - **Tool definitions module**: Centralized tool registration (`src/tools/definitions.ts`)
 - **Commands module**: `gitmem check` CLI health diagnostics (`src/commands/check.ts`)
 - **Full test suite**: 354+ unit tests across 20 test files, plus integration, e2e, and performance benchmarks

package/dist/commands/check.d.ts

@@ -8,7 +8,7 @@
  *   npx gitmem check --full    — Full diagnostic (~30s)
  *   npx gitmem check --output report.json
  *
- * Issue: OD-584
+ *
  */
 /**
  * Command options

package/dist/commands/check.js

@@ -8,13 +8,14 @@
  *   npx gitmem check --full    — Full diagnostic (~30s)
  *   npx gitmem check --output report.json
  *
- * Issue: OD-584
+ *
  */
 import { existsSync, mkdirSync, writeFileSync, readdirSync, statSync } from "fs";
 import { join } from "path";
 import { DiagnosticsCollector, runBenchmark, anonymizeSupabaseUrl, anonymizePath, isApiKeyConfigured, getSafeEnvironmentInfo, } from "../diagnostics/index.js";
 import { getCache, CacheService } from "../services/cache.js";
 import { getTier, hasSupabase } from "../services/tier.js";
+import { getGitmemDir } from "../services/gitmem-dir.js";
 // Report version for schema compatibility
 const REPORT_VERSION = "1.0.0";
 /**
@@ -287,7 +288,7 @@ async function runQuickCheck() {
     // Data volume (counts only)
     let dataVolume;
     try {
-        const gitmemDir = join(process.cwd(), ".gitmem");
+        const gitmemDir = getGitmemDir();
         let localCacheFiles = 0;
         let localCacheBytes = 0;
         if (existsSync(gitmemDir)) {
@@ -463,7 +464,7 @@ export async function runCheck(options) {
         dataVolume,
     };
     // Determine output path
-    const gitmemDir = join(process.cwd(), ".gitmem");
+    const gitmemDir = getGitmemDir();
     if (!existsSync(gitmemDir)) {
         mkdirSync(gitmemDir, { recursive: true });
     }

package/dist/diagnostics/anonymizer.d.ts

@@ -14,7 +14,7 @@
  * - Hostnames → excluded
  * - Platform/Node version → included
  *
- * Issue: OD-584
+ *
  */
 /**
  * Anonymize a Supabase URL

package/dist/diagnostics/anonymizer.js

@@ -14,7 +14,7 @@
  * - Hostnames → excluded
  * - Platform/Node version → included
  *
- * Issue: OD-584
+ *
  */
 /**
  * Regex patterns for sensitive data

package/dist/diagnostics/channels.d.ts

@@ -5,7 +5,7 @@
  * When no subscriber is attached, publish() is essentially a no-op.
  *
  * Pattern reference: @ibm/telemetry-js
- * Issue: OD-584
+ *
  */
 import { channel, Channel } from "diagnostics_channel";
 /**

package/dist/diagnostics/channels.js

@@ -5,7 +5,7 @@
  * When no subscriber is attached, publish() is essentially a no-op.
  *
  * Pattern reference: @ibm/telemetry-js
- * Issue: OD-584
+ *
  */
 import { channel } from "diagnostics_channel";
 /**

package/dist/diagnostics/collector.d.ts

@@ -4,7 +4,7 @@
  * Subscribes to diagnostics_channel events and collects metrics
  * during diagnostic pass. Anonymizes data as it's collected.
  *
- * Issue: OD-584
+ *
  */
 /**
  * Collected metrics for a diagnostic run

package/dist/diagnostics/collector.js

@@ -4,7 +4,7 @@
  * Subscribes to diagnostics_channel events and collects metrics
  * during diagnostic pass. Anonymizes data as it's collected.
  *
- * Issue: OD-584
+ *
  */
 import { subscribe, unsubscribe } from "diagnostics_channel";
 import { CHANNEL_NAMES, } from "./channels.js";

package/dist/diagnostics/index.d.ts

@@ -20,7 +20,7 @@
  *   // ... run operations ...
  *   const metrics = collector.stop();
  *
- * Issue: OD-584
+ *
  */
 export { diagnostics, CHANNEL_NAMES, channel, type ToolCallEvent, type CacheEvent, type DbQueryEvent, type EmbeddingCallEvent, type ErrorEvent, } from "./channels.js";
 export { DiagnosticsCollector, getCollector, resetCollector, runBenchmark, percentile, type DiagnosticMetrics, type DiagnosticReport, type HealthCheckResult, type BenchmarkResult, } from "./collector.js";

package/dist/diagnostics/index.js

@@ -20,7 +20,7 @@
  *   // ... run operations ...
  *   const metrics = collector.stop();
  *
- * Issue: OD-584
+ *
  */
 // Channel definitions and publisher
 export { diagnostics, CHANNEL_NAMES, channel, } from "./channels.js";

package/dist/hooks/quick-retrieve.js

@@ -21,6 +21,7 @@ import { getStorage } from "../services/storage.js";
 import { hasSupabase } from "../services/tier.js";
 import { isLocalSearchReady, localScarSearch } from "../services/local-vector-search.js";
 import { bm25Search } from "../services/bm25.js";
+import { getGitmemDir } from "../services/gitmem-dir.js";
 import { formatCompact } from "./format-utils.js";
 /**
  * Perform a quick scar search optimized for hook invocation.
@@ -72,7 +73,7 @@ export async function quickRetrieve(prompt, retrievalLevel, options = {}) {
  * Uses BM25 ranking with field boosting (title 3x, keywords 2x, description 1x).
  */
 function searchDiskCache(query, k) {
-    const cachePath = path.join(process.cwd(), ".gitmem", "cache", "hook-scars.json");
+    const cachePath = path.join(getGitmemDir(), "cache", "hook-scars.json");
     if (!fs.existsSync(cachePath)) {
         return [];
     }

package/dist/schemas/active-sessions.d.ts

@@ -1,25 +1,25 @@
 /**
- * Zod schemas for active-sessions.json registry (GIT-19)
+ * Zod schemas for active-sessions.json registry
  *
  * Validates data read from disk — defensive parsing of potentially corrupted JSON.
  */
 import { z } from "zod";
 export declare const ActiveSessionEntrySchema: z.ZodObject<{
     session_id: z.ZodString;
-    agent: z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>;
+    agent: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>;
     started_at: z.ZodString;
     hostname: z.ZodString;
     pid: z.ZodNumber;
     project: z.ZodDefault<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     project: string;
-    agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+    agent: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown";
     session_id: string;
     started_at: string;
     hostname: string;
     pid: number;
 }, {
-    agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+    agent: string;
     session_id: string;
     started_at: string;
     hostname: string;
@@ -29,20 +29,20 @@ export declare const ActiveSessionEntrySchema: z.ZodObject<{
 export declare const ActiveSessionsRegistrySchema: z.ZodObject<{
     sessions: z.ZodArray<z.ZodObject<{
         session_id: z.ZodString;
-        agent: z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>;
+        agent: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>;
         started_at: z.ZodString;
         hostname: z.ZodString;
         pid: z.ZodNumber;
         project: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         project: string;
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown";
         session_id: string;
         started_at: string;
         hostname: string;
         pid: number;
     }, {
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: string;
         session_id: string;
         started_at: string;
         hostname: string;
@@ -52,7 +52,7 @@ export declare const ActiveSessionsRegistrySchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     sessions: {
         project: string;
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown";
         session_id: string;
         started_at: string;
         hostname: string;
@@ -60,7 +60,7 @@ export declare const ActiveSessionsRegistrySchema: z.ZodObject<{
     }[];
 }, {
     sessions: {
-        agent: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown";
+        agent: string;
         session_id: string;
         started_at: string;
         hostname: string;

package/dist/schemas/active-sessions.js

@@ -1,5 +1,5 @@
 /**
- * Zod schemas for active-sessions.json registry (GIT-19)
+ * Zod schemas for active-sessions.json registry
  *
  * Validates data read from disk — defensive parsing of potentially corrupted JSON.
  */

package/dist/schemas/common.d.ts

@@ -7,11 +7,8 @@ import { z } from "zod";
  */
 export declare const ProjectSchema: z.ZodDefault<z.ZodString>;
 export type Project = string;
-/**
- * Agent identity enum
- */
-export declare const AgentIdentitySchema: z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>;
-export type AgentIdentity = z.infer<typeof AgentIdentitySchema>;
+export declare const AgentIdentitySchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>;
+export type AgentIdentity = "cli" | "desktop" | "autonomous" | "local" | "cloud" | "Unknown";
 /**
  * Learning type enum (scar, win, pattern)
  */

package/dist/schemas/common.js

@@ -9,14 +9,20 @@ export const ProjectSchema = z.string().default("default");
 /**
  * Agent identity enum
  */
-export const AgentIdentitySchema = z.enum([
-    "CLI",
-    "DAC",
-    "CODA-1",
-    "Brain_Local",
-    "Brain_Cloud",
-    "Unknown",
+const LEGACY_AGENT_MAP = {
+    "CLI": "cli",
+    "DAC": "desktop",
+    "CODA-1": "autonomous",
+    "Brain_Local": "local",
+    "Brain_Cloud": "cloud",
+};
+const VALID_AGENTS = new Set([
+    "cli", "desktop", "autonomous", "local", "cloud", "Unknown",
+    "CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud",
 ]);
+export const AgentIdentitySchema = z.string()
+    .refine((val) => VALID_AGENTS.has(val), { message: "Invalid agent identity" })
+    .transform((val) => (LEGACY_AGENT_MAP[val] || val));
 /**
  * Learning type enum (scar, win, pattern)
  */

package/dist/schemas/create-learning.js

@@ -25,7 +25,7 @@ export const CreateLearningParamsSchema = z
     keywords: z.array(z.string()).optional(),
     source_linear_issue: z.string().optional(),
     project: ProjectSchema.optional(),
-    // OD-508: LLM-cooperative enforcement fields
+    // LLM-cooperative enforcement fields
     why_this_matters: z.string().optional(),
     action_protocol: z.array(z.string()).optional(),
     self_check_criteria: z.array(z.string()).optional(),

package/dist/schemas/session-close.d.ts

@@ -41,7 +41,7 @@ export declare const ClosingReflectionSchema: z.ZodObject<{
 }>;
 export type ClosingReflection = z.infer<typeof ClosingReflectionSchema>;
 /**
- * Task completion proof schema (OD-491)
+ * Task completion proof schema
  */
 export declare const TaskCompletionSchema: z.ZodObject<{
     questions_displayed_at: z.ZodEffects<z.ZodString, string, string>;
@@ -124,11 +124,8 @@ export declare const ScarUsageEntrySchema: z.ZodObject<{
     variant_id?: string | undefined;
 }>;
 export type ScarUsageEntry = z.infer<typeof ScarUsageEntrySchema>;
-/**
- * Session close parameters schema
- */
 export declare const SessionCloseParamsSchema: z.ZodObject<{
-    session_id: z.ZodString;
+    session_id: z.ZodEffects<z.ZodString, string, string>;
     close_type: z.ZodEnum<["standard", "quick", "autonomous", "retroactive"]>;
     task_completion: z.ZodOptional<z.ZodObject<{
         questions_displayed_at: z.ZodEffects<z.ZodString, string, string>;
@@ -270,10 +267,10 @@ export declare const SessionCloseParamsSchema: z.ZodObject<{
         variant_id?: string | undefined;
     }>, "many">>;
     capture_transcript: z.ZodOptional<z.ZodBoolean>;
-    transcript_path: z.ZodOptional<z.ZodString>;
+    transcript_path: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
     session_id: string;
-    close_type: "standard" | "quick" | "autonomous" | "retroactive";
+    close_type: "autonomous" | "standard" | "quick" | "retroactive";
     decisions?: {
         title: string;
         decision: string;
@@ -330,7 +327,7 @@ export declare const SessionCloseParamsSchema: z.ZodObject<{
     capture_transcript?: boolean | undefined;
 }, {
     session_id: string;
-    close_type: "standard" | "quick" | "autonomous" | "retroactive";
+    close_type: "autonomous" | "standard" | "quick" | "retroactive";
     decisions?: {
         title: string;
         decision: string;

package/dist/schemas/session-close.js

@@ -22,7 +22,7 @@ export const ClosingReflectionSchema = z.object({
     rapport_notes: z.string().optional(),
 });
 /**
- * Task completion proof schema (OD-491)
+ * Task completion proof schema
  */
 export const TaskCompletionSchema = z.object({
     questions_displayed_at: ISOTimestampSchema,
@@ -59,8 +59,12 @@ export const ScarUsageEntrySchema = z.object({
 /**
  * Session close parameters schema
  */
+// Session ID must be UUID or 8-char hex short-ID (no path traversal)
+const SessionIdSchema = z.string().min(1, "session_id is required").refine((val) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(val) || /^[0-9a-f]{8}$/i.test(val), { message: "session_id must be a UUID or 8-char hex short-ID" });
+// Transcript path must not contain path traversal sequences
+const SafeTranscriptPathSchema = z.string().refine((val) => !val.includes("..") && !val.includes("\0"), { message: "transcript_path must not contain path traversal sequences" });
 export const SessionCloseParamsSchema = z.object({
-    session_id: z.string().min(1, "session_id is required"),
+    session_id: SessionIdSchema,
     close_type: CloseTypeSchema,
     task_completion: TaskCompletionSchema.optional(),
     closing_reflection: ClosingReflectionSchema.optional(),
@@ -73,7 +77,7 @@ export const SessionCloseParamsSchema = z.object({
     ceremony_duration_ms: z.number().nonnegative().optional(),
     scars_to_record: z.array(ScarUsageEntrySchema).optional(),
     capture_transcript: z.boolean().optional(),
-    transcript_path: z.string().optional(),
+    transcript_path: SafeTranscriptPathSchema.optional(),
 });
 /**
  * Validate session_close params with close type specific rules

package/dist/schemas/session-start.d.ts

@@ -9,19 +9,19 @@ import { z } from "zod";
  * and use defaults for project.
  */
 export declare const SessionStartParamsSchema: z.ZodObject<{
-    agent_identity: z.ZodOptional<z.ZodEnum<["CLI", "DAC", "CODA-1", "Brain_Local", "Brain_Cloud", "Unknown"]>>;
+    agent_identity: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown", string>>;
     linear_issue: z.ZodOptional<z.ZodString>;
     issue_title: z.ZodOptional<z.ZodString>;
     issue_description: z.ZodOptional<z.ZodString>;
     issue_labels: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     project: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-    /** OD-558: Force overwrite of existing active session */
+    /** Force overwrite of existing active session */
     force: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     project?: string | undefined;
     linear_issue?: string | undefined;
     force?: boolean | undefined;
-    agent_identity?: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown" | undefined;
+    agent_identity?: "local" | "cli" | "desktop" | "autonomous" | "cloud" | "Unknown" | undefined;
     issue_title?: string | undefined;
     issue_description?: string | undefined;
     issue_labels?: string[] | undefined;
@@ -29,7 +29,7 @@ export declare const SessionStartParamsSchema: z.ZodObject<{
     project?: string | undefined;
     linear_issue?: string | undefined;
     force?: boolean | undefined;
-    agent_identity?: "CLI" | "DAC" | "CODA-1" | "Brain_Local" | "Brain_Cloud" | "Unknown" | undefined;
+    agent_identity?: string | undefined;
     issue_title?: string | undefined;
     issue_description?: string | undefined;
     issue_labels?: string[] | undefined;

package/dist/schemas/session-start.js

@@ -16,7 +16,7 @@ export const SessionStartParamsSchema = z.object({
     issue_description: z.string().optional(),
     issue_labels: z.array(z.string()).optional(),
     project: ProjectSchema.optional(),
-    /** OD-558: Force overwrite of existing active session */
+    /** Force overwrite of existing active session */
     force: z.boolean().optional(),
 });
 /**

package/dist/schemas/thread.d.ts

@@ -1,5 +1,5 @@
 /**
- * Zod schemas for thread lifecycle tools (OD-thread-lifecycle)
+ * Zod schemas for thread lifecycle tools
  */
 import { z } from "zod";
 /**

package/dist/schemas/thread.js

@@ -1,5 +1,5 @@
 /**
- * Zod schemas for thread lifecycle tools (OD-thread-lifecycle)
+ * Zod schemas for thread lifecycle tools
  */
 import { z } from "zod";
 import { ProjectSchema } from "./common.js";

package/dist/server.d.ts

@@ -12,8 +12,8 @@ export declare function createServer(): Server;
 /**
  * Run the server with stdio transport
  *
- * OD-473: Initializes local vector search in background for fast startup.
- * OD-489: Uses direct Supabase queries to get embeddings for local cache.
+ * Initializes local vector search in background for fast startup.
+ * Uses direct Supabase queries to get embeddings for local cache.
  *
  * Server starts immediately; cache loads in background.
  * First few queries may use Supabase fallback until cache is ready.

package/dist/server.js

@@ -43,7 +43,7 @@ import { validateToolArgs } from "./schemas/registry.js";
 export function createServer() {
     const server = new Server({
         name: "gitmem-mcp",
-        version: "0.1.0",
+        version: "1.0.3",
     }, {
         capabilities: {
             tools: {},
@@ -207,6 +207,7 @@ export function createServer() {
                         { alias: "gitmem-r", full: "recall", description: "Check scars before taking action" },
                         { alias: "gitmem-cs", full: "confirm_scars", description: "Confirm recalled scars (APPLYING/N_A/REFUTED)" },
                         { alias: "gitmem-ss", full: "session_start", description: "Initialize session with context" },
+                        { alias: "gitmem-sr", full: "session_refresh", description: "Refresh context for active session" },
                         { alias: "gitmem-sc", full: "session_close", description: "Close session with compliance validation" },
                         { alias: "gitmem-cl", full: "create_learning", description: "Create scar/win/pattern entry" },
                         { alias: "gitmem-cd", full: "create_decision", description: "Log architectural/operational decision" },
@@ -223,6 +224,7 @@ export function createServer() {
                         { alias: "gitmem-cleanup", full: "cleanup_threads", description: "Triage threads by lifecycle health" },
                         { alias: "gitmem-health", full: "health", description: "Show write health for fire-and-forget operations" },
                         { alias: "gitmem-al", full: "archive_learning", description: "Archive a scar/win/pattern (is_active=false)" },
+                        { alias: "gitmem-graph", full: "graph_traverse", description: "Traverse knowledge graph over institutional memory" },
                     ];
                     if (hasBatchOperations()) {
                         commands.push({ alias: "gitmem-rsb", full: "record_scar_usage_batch", description: "Track multiple scars (batch)" });
@@ -233,10 +235,12 @@ export function createServer() {
                     if (hasCacheManagement()) {
                         commands.push({ alias: "gitmem-cache-status", full: "cache_status", description: "Show cache status" }, { alias: "gitmem-cache-health", full: "cache_health", description: "Compare local vs remote" }, { alias: "gitmem-cache-flush", full: "cache_flush", description: "Force reload from Supabase" });
                     }
+                    // Filter to only show commands whose canonical tool is actually registered
+                    const visibleCommands = commands.filter(c => registeredToolNames.has(c.full));
                     // Build command table for display
-                    const cmdLines = commands.map(c => `  ${c.alias.padEnd(22)} ${c.description}`).join("\n");
+                    const cmdLines = visibleCommands.map(c => `  ${c.alias.padEnd(22)} ${c.description}`).join("\n");
                     const display = [
-                        `gitmem v0.1.0 · ${tier} · ${registeredTools.length} tools · ${hasSupabase() ? "supabase" : "local (.gitmem/)"}`,
+                        `gitmem v1.0.3 · ${tier} · ${registeredTools.length} tools · ${hasSupabase() ? "supabase" : "local (.gitmem/)"}`,
                         "Memory that compounds.",
                         "",
                         cmdLines,
@@ -248,11 +252,11 @@ export function createServer() {
                         "Tool results are collapsed in the CLI — the user cannot see them unless you echo them.",
                     ].join("\n");
                     result = {
-                        version: "0.1.0",
+                        version: "1.0.3",
                         tier,
                         tools_registered: registeredTools.length,
                         storage: hasSupabase() ? "supabase" : "local (.gitmem/)",
-                        commands,
+                        commands: visibleCommands,
                         display,
                     };
                     break;
@@ -277,7 +281,7 @@ export function createServer() {
                 case "gm-graph":
                     result = await graphTraverse(toolArgs);
                     break;
-                // Cache management tools (OD-473)
+                // Cache management tools
                 case "gitmem-cache-status":
                 case "gm-cache-s":
                     result = getCacheStatus(toolArgs.project || getProject() || "default");
@@ -319,12 +323,19 @@ export function createServer() {
             };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
+            const rawMessage = error instanceof Error ? error.message : String(error);
+            // Redact internal details: file paths, SQL errors, stack traces
+            const safeMessage = rawMessage
+                .replace(/\/[^\s:]+/g, "[path]") // redact file paths
+                .replace(/\b\d{5}\b/g, "[code]") // redact PG error codes
+                .replace(/at\s+\S+\s+\(.+\)/g, "") // strip stack frames
+                .slice(0, 200); // cap length
+            console.error(`[server] Tool error:`, rawMessage);
             return {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ error: message }),
+                        text: JSON.stringify({ error: safeMessage }),
                     },
                 ],
                 isError: true,
@@ -336,8 +347,8 @@ export function createServer() {
 /**
  * Run the server with stdio transport
  *
- * OD-473: Initializes local vector search in background for fast startup.
- * OD-489: Uses direct Supabase queries to get embeddings for local cache.
+ * Initializes local vector search in background for fast startup.
+ * Uses direct Supabase queries to get embeddings for local cache.
  *
  * Server starts immediately; cache loads in background.
  * First few queries may use Supabase fallback until cache is ready.

package/dist/services/active-sessions.js

@@ -13,7 +13,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
-import { getGitmemDir, getSessionPath } from "./gitmem-dir.js";
+import { getGitmemDir, getSessionPath, sanitizePathComponent } from "./gitmem-dir.js";
 import { ActiveSessionsRegistrySchema } from "../schemas/active-sessions.js";
 import { withLockSync } from "./file-lock.js";
 const REGISTRY_FILENAME = "active-sessions.json";
@@ -276,6 +276,7 @@ function pruneOrphanedDirs(gitmemDir, registry) {
  */
 function cleanupSessionDir(gitmemDir, sessionId) {
     try {
+        sanitizePathComponent(sessionId, "sessionId");
         const sessionDir = path.join(gitmemDir, "sessions", sessionId);
         if (fs.existsSync(sessionDir)) {
             fs.rmSync(sessionDir, { recursive: true, force: true });
@@ -328,7 +329,7 @@ export function migrateFromLegacy() {
             // 2. Create registry with single entry
             const entry = {
                 session_id: old.session_id,
-                agent: old.agent || "CLI",
+                agent: old.agent || "cli",
                 started_at: old.started_at || new Date().toISOString(),
                 hostname: old.hostname || os.hostname(),
                 pid: old.pid || process.pid,

package/dist/services/agent-briefing.d.ts

@@ -1,5 +1,5 @@
 /**
- * Agent Briefing Generator (OD-689)
+ * Agent Briefing Generator
  *
  * Generates `.gitmem/agent-briefing.md` at session close with a
  * compact summary of memory state. Designed for inclusion in

package/dist/services/agent-briefing.js

@@ -1,5 +1,5 @@
 /**
- * Agent Briefing Generator (OD-689)
+ * Agent Briefing Generator
  *
  * Generates `.gitmem/agent-briefing.md` at session close with a
  * compact summary of memory state. Designed for inclusion in

package/dist/services/agent-detection.d.ts

@@ -18,6 +18,7 @@ import type { AgentIdentity, DetectedEnvironment } from "../types/index.js";
  * Detect the current agent identity based on environment
  */
 export declare function detectAgent(): DetectedEnvironment;
+export declare function normalizeAgent(input: string): AgentIdentity;
 /**
  * Get just the agent identity (convenience function)
  */