memory-journal-mcp 4.3.0 → 4.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (109) hide show
  1. package/.dockerignore +131 -122
  2. package/.gitattributes +29 -0
  3. package/.github/workflows/docker-publish.yml +1 -1
  4. package/.github/workflows/lint-and-test.yml +1 -2
  5. package/.github/workflows/secrets-scanning.yml +0 -1
  6. package/.github/workflows/security-update.yml +6 -6
  7. package/.vscode/settings.json +17 -15
  8. package/CHANGELOG.md +1065 -11
  9. package/DOCKER_README.md +51 -33
  10. package/Dockerfile +14 -12
  11. package/README.md +68 -33
  12. package/SECURITY.md +225 -220
  13. package/dist/cli.js +7 -0
  14. package/dist/cli.js.map +1 -1
  15. package/dist/constants/ServerInstructions.d.ts +1 -1
  16. package/dist/constants/ServerInstructions.d.ts.map +1 -1
  17. package/dist/constants/ServerInstructions.js +70 -26
  18. package/dist/constants/ServerInstructions.js.map +1 -1
  19. package/dist/constants/icons.d.ts +2 -0
  20. package/dist/constants/icons.d.ts.map +1 -1
  21. package/dist/constants/icons.js +6 -0
  22. package/dist/constants/icons.js.map +1 -1
  23. package/dist/database/SqliteAdapter.d.ts +51 -10
  24. package/dist/database/SqliteAdapter.d.ts.map +1 -1
  25. package/dist/database/SqliteAdapter.js +143 -43
  26. package/dist/database/SqliteAdapter.js.map +1 -1
  27. package/dist/filtering/ToolFilter.d.ts +1 -1
  28. package/dist/filtering/ToolFilter.d.ts.map +1 -1
  29. package/dist/filtering/ToolFilter.js +7 -1
  30. package/dist/filtering/ToolFilter.js.map +1 -1
  31. package/dist/github/GitHubIntegration.d.ts +74 -2
  32. package/dist/github/GitHubIntegration.d.ts.map +1 -1
  33. package/dist/github/GitHubIntegration.js +508 -7
  34. package/dist/github/GitHubIntegration.js.map +1 -1
  35. package/dist/handlers/prompts/index.js +1 -0
  36. package/dist/handlers/prompts/index.js.map +1 -1
  37. package/dist/handlers/resources/index.d.ts.map +1 -1
  38. package/dist/handlers/resources/index.js +257 -13
  39. package/dist/handlers/resources/index.js.map +1 -1
  40. package/dist/handlers/tools/index.d.ts.map +1 -1
  41. package/dist/handlers/tools/index.js +595 -8
  42. package/dist/handlers/tools/index.js.map +1 -1
  43. package/dist/server/McpServer.d.ts +2 -0
  44. package/dist/server/McpServer.d.ts.map +1 -1
  45. package/dist/server/McpServer.js +69 -26
  46. package/dist/server/McpServer.js.map +1 -1
  47. package/dist/types/index.d.ts +97 -0
  48. package/dist/types/index.d.ts.map +1 -1
  49. package/dist/types/index.js.map +1 -1
  50. package/dist/utils/logger.d.ts +1 -0
  51. package/dist/utils/logger.d.ts.map +1 -1
  52. package/dist/utils/logger.js +8 -1
  53. package/dist/utils/logger.js.map +1 -1
  54. package/dist/utils/progress-utils.d.ts +18 -3
  55. package/dist/utils/progress-utils.d.ts.map +1 -1
  56. package/dist/utils/progress-utils.js.map +1 -1
  57. package/dist/utils/security-utils.d.ts +91 -0
  58. package/dist/utils/security-utils.d.ts.map +1 -0
  59. package/dist/utils/security-utils.js +184 -0
  60. package/dist/utils/security-utils.js.map +1 -0
  61. package/dist/vector/VectorSearchManager.d.ts +2 -1
  62. package/dist/vector/VectorSearchManager.d.ts.map +1 -1
  63. package/dist/vector/VectorSearchManager.js +100 -34
  64. package/dist/vector/VectorSearchManager.js.map +1 -1
  65. package/docker-compose.yml +46 -37
  66. package/mcp-config-example.json +0 -2
  67. package/package.json +21 -14
  68. package/releases/v4.3.1.md +69 -0
  69. package/releases/v4.4.0.md +120 -0
  70. package/server.json +3 -3
  71. package/src/cli.ts +11 -0
  72. package/src/constants/ServerInstructions.ts +70 -26
  73. package/src/constants/icons.ts +7 -0
  74. package/src/database/SqliteAdapter.ts +165 -44
  75. package/src/filtering/ToolFilter.ts +7 -1
  76. package/src/github/GitHubIntegration.ts +588 -8
  77. package/src/handlers/prompts/index.ts +1 -0
  78. package/src/handlers/resources/index.ts +318 -12
  79. package/src/handlers/tools/index.ts +686 -13
  80. package/src/server/McpServer.ts +79 -37
  81. package/src/types/index.ts +98 -0
  82. package/src/utils/logger.ts +10 -1
  83. package/src/utils/progress-utils.ts +17 -6
  84. package/src/utils/security-utils.ts +205 -0
  85. package/src/vector/VectorSearchManager.ts +110 -39
  86. package/tests/constants/icons.test.ts +102 -0
  87. package/tests/constants/server-instructions.test.ts +549 -0
  88. package/tests/database/sqlite-adapter.bench.ts +63 -0
  89. package/tests/database/sqlite-adapter.test.ts +555 -0
  90. package/tests/filtering/tool-filter.test.ts +266 -0
  91. package/tests/github/github-integration.test.ts +1024 -0
  92. package/tests/handlers/github-resource-handlers.test.ts +473 -0
  93. package/tests/handlers/github-tool-handlers.test.ts +556 -0
  94. package/tests/handlers/prompt-handlers.test.ts +91 -0
  95. package/tests/handlers/resource-handlers.test.ts +339 -0
  96. package/tests/handlers/tool-handlers.test.ts +497 -0
  97. package/tests/handlers/vector-tool-handlers.test.ts +238 -0
  98. package/tests/security/sql-injection.test.ts +347 -0
  99. package/tests/server/mcp-server.bench.ts +55 -0
  100. package/tests/server/mcp-server.test.ts +675 -0
  101. package/tests/utils/logger.test.ts +180 -0
  102. package/tests/utils/mcp-logger.test.ts +212 -0
  103. package/tests/utils/progress-utils.test.ts +156 -0
  104. package/tests/utils/security-utils.test.ts +82 -0
  105. package/tests/vector/vector-search-manager.test.ts +335 -0
  106. package/tests/vector/vector-search.bench.ts +53 -0
  107. package/vitest.config.ts +15 -0
  108. package/.github/workflows/DOCKER_DEPLOYMENT_SETUP.md +0 -387
  109. package/.github/workflows/dependabot-auto-merge.yml +0 -42
package/CHANGELOG.md CHANGED
@@ -1,20 +1,1074 @@
1
1
  # Changelog
2
2
 
3
- The D1 Database Manager changelog is maintained in the project wiki.
3
+ All notable changes to Memory Journal MCP will be documented in this file.
4
4
 
5
- ## 📚 View the Changelog
5
+ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
+ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6
7
 
7
- **Wiki (recommended):** [Changelog](https://github.com/neverinfamous/memory-journal-mcp/wiki/CHANGELOG)
8
+ ## [Unreleased]
8
9
 
9
- **GitHub Repository:** [neverinfamous/memory-journal-mcp](https://github.com/neverinfamous/memory-journal-mcp)
10
+ ## [4.4.0] - 2026-02-27
10
11
 
11
- ---
12
+ ### Added
12
13
 
13
- The wiki changelog includes:
14
+ - **Performance Benchmarking Suite** — Added a `vitest bench` powered benchmarking suite to measure baseline performance for database operations, vector indexing, and tool execution overhead. Included new `"bench"` npm script.
14
15
 
15
- - All version history and release notes
16
- - Detailed feature descriptions
17
- - Bug fixes and improvements
18
- - Breaking changes and migration guides
16
+ - **GitHub Milestones Integration** Full CRUD support for GitHub Milestones
17
+ - 5 new tools: `get_github_milestones`, `get_github_milestone`, `create_github_milestone`, `update_github_milestone`, `delete_github_milestone` (39 total tools)
18
+ - 2 new resources: `memory://github/milestones` (list view) and `memory://milestones/{number}` (detail view) (20 total resources)
19
+ - Session briefing (`memory://briefing`) now includes milestone progress in the user message table
20
+ - GitHub status resource (`memory://github/status`) now includes milestone summary data
21
+ - `create_github_issue_with_entry` now accepts optional `milestone_number` parameter to assign issues to milestones
22
+ - `get_github_issues` and issue resources now include milestone association data
23
+ - New `ICON_MILESTONE` flag icon for milestone tools and resources
24
+ - Milestone tools reference added to `ServerInstructions.ts` for agent guidance
25
+ - **Server Host Bind Parameter** — New `--server-host` CLI option and `MCP_HOST` environment variable for configuring HTTP transport bind address
26
+ - Defaults to `localhost`; set to `0.0.0.0` for container deployments
27
+ - Also reads `HOST` environment variable as fallback
28
+ - CLI flag takes precedence over environment variables
19
29
 
20
- For the latest updates, please refer to the wiki.
30
+ - **Repository Insights/Traffic Tool** New `get_repo_insights` tool and `memory://github/insights` resource for monitoring repository health
31
+ - 1 new tool: `get_repo_insights` (39 total tools, github group: 14 → 15)
32
+ - 1 new resource: `memory://github/insights` — compact summary of stars, forks, and 14-day traffic totals (~150 tokens)
33
+ - **Token-efficient sections parameter**: `stars` (~50 tokens), `traffic` (~100), `referrers` (~100), `paths` (~100), or `all` (~350)
34
+ - Surfaces stars, forks, watchers, clone/view aggregates (14-day rolling), top referrer sources, and popular repository pages
35
+ - Uses extended 10-minute cache TTL (vs 5-minute for other GitHub data) since traffic data changes slowly
36
+ - 4 new `GitHubIntegration` methods: `getRepoStats()`, `getTrafficData()`, `getTopReferrers()`, `getPopularPaths()`
37
+ - New types: `RepoStats`, `TrafficData`, `TrafficReferrer`, `PopularPath`
38
+ - Requires push access to repository for traffic endpoints
39
+
40
+ ### Changed
41
+
42
+ - **Dependency Updates**
43
+ - `@eslint/js`: 9.39.2 → 10.0.1 (major)
44
+ - `@modelcontextprotocol/sdk`: 1.26.0 → 1.27.1 (minor)
45
+ - `@types/node`: 25.2.0 → 25.3.2 (minor)
46
+ - `eslint`: 9.39.2 → 10.0.2 (major)
47
+ - `simple-git`: 3.28.0 → 3.32.3 (minor)
48
+ - `sql.js`: 1.12.0 → 1.14.0 (minor)
49
+ - `typescript-eslint`: 8.54.0 → 8.56.1 (minor)
50
+ - `axios` override: 1.13.2 → 1.13.5 (patch) — fixes GHSA-43fc-jf86-j433 (DoS via `__proto__` key in `parseConfig`)
51
+
52
+ ### Documentation
53
+
54
+ - **Server Instructions Fixes** — Added missing Kanban optional `owner` parameters and the four new Phase 6 GitHub template resources to `ServerInstructions.ts`'s Key Resources table to ensure agents have complete tool/resource context.
55
+ - **Testing Prompt Polish** — Fixed minor typos and phase numbering inconsistencies in the comprehensive verification plan (`test-memory-journal-mcp.md`).
56
+ - **AntiGravity IDE Guidance** — Added explicit note in README.md and DOCKER_README.md that AntiGravity does not currently support MCP server instructions, with workaround to manually provide `ServerInstructions.ts` contents
57
+ - **`memory://milestones/{N}` Behavior Clarified** — Updated `test-memory-journal-mcp.md` to accurately document that this resource is designed to return milestone metadata + issue counts + `completionPercentage` + a `hint` to use `get_github_issues` for individual issue details (not full issue arrays)
58
+
59
+ ### Improved
60
+
61
+ - **`get_entry_by_id` Importance Scoring Breakdown** — Tool now returns `importanceBreakdown` alongside the `importance` score, showing weighted component contributions: `significance` (30%), `relationships` (35%), `causal` (20%), `recency` (15%). Gives agents transparency into _why_ an entry scored a given importance level.
62
+ - **`get_cross_project_insights` Inactive Threshold Visibility** — Tool output now includes `inactiveThresholdDays: 7` field, making the hardcoded inactive project classification criteria self-documenting. Previously, consumers saw an empty `inactive_projects` array with no way to know the cutoff.
63
+ - **Database I/O — Debounced Save** — Mutation methods (`createEntry`, `updateEntry`, `deleteEntry`, `linkEntries`, `mergeTags`) now use a 500ms debounced `scheduleSave()` instead of synchronous `save()` on every call, batching rapid writes into a single disk flush. `close()` and `restoreFromFile()` still flush immediately for data safety.
64
+ - **Vector Index Rebuild — Paginated Fetching** — `rebuildIndex()` now uses `getEntriesPage(offset, limit)` with `REBUILD_PAGE_SIZE=200` instead of loading all entries at once via `getRecentEntries(10000)`, reducing peak memory usage for large journals.
65
+ - **Vector Index Rebuild — Parallel Batch Embedding** — Entries are embedded in parallel batches of 5 (`REBUILD_BATCH_SIZE`) via `Promise.all` instead of sequentially, improving rebuild throughput.
66
+ - **Vector Index Rebuild — Sequential Insertion** — Embeddings are generated in parallel batches for throughput, but vectra insertions are sequential to avoid file I/O race conditions. Index is pre-cleaned in bulk to eliminate per-item upsert deletes.
67
+ - **Server Startup — `getTools()` Deduplication** — Eliminated a duplicate `getTools()` call during server startup; tool names for instruction generation are now extracted from the same array used for registration, saving one full tool-construction pass.
68
+ - **GitHub API — TTL Response Cache** — Read methods (`getIssues`, `getIssue`, `getPullRequests`, `getPullRequest`, `getWorkflowRuns`, `getRepoContext`, `getMilestones`, `getMilestone`) now cache responses for 5 minutes. Mutation methods (`createIssue`, `closeIssue`, `createMilestone`, `updateMilestone`, `deleteMilestone`, `moveProjectItem`, `addProjectItem`) automatically invalidate related caches. Public `clearCache()` method available for manual invalidation.
69
+
70
+ ### Fixed
71
+
72
+ - **`memory://instructions` Active Tool Count** — Fixed resource returning `Active Tools (3)` instead of `Active Tools (N)` when no tool filter is configured. The handler incorrectly fell back to a hardcoded 3-tool set (`create_entry`, `search_entries`, `get_recent_entries`) when `filterConfig` is `null`. Now correctly uses `getAllToolNames()` so the count reflects all enabled tools (e.g., `Active Tools (39)`). Added regression test to `resource-handlers.test.ts`.
73
+
74
+ - **`get_github_issue` Missing Milestone Field** — `getIssue()` in `GitHubIntegration.ts` now maps `issue.milestone` from the GitHub API response into the returned `IssueDetails` object. Previously the field was silently excluded, so `get_github_issue` and other callers never reflected milestone assignment even when the issue had one.
75
+ - **`ServerInstructions.ts` Entry Types Corrected** — Updated `## Entry Types` reference list from 7 stale v4-era types (`technical_note`, `progress_update`, `deployment`, etc.) to the full 13 types in the `EntryType` union (`personal_reflection`, `project_decision`, `technical_achievement`, `bug_fix`, `feature_implementation`, `code_review`, `meeting_notes`, `learning`, `research`, `planning`, `retrospective`, `standup`, `other`). The most impactful addition is `planning`, which is the type auto-assigned by `create_github_issue_with_entry` and `close_github_issue_with_entry`. Updated the corresponding test in `server-instructions.test.ts`.
76
+ - **`memory://milestones/{N}` Description Clarified** — Updated resource description to accurately state it returns milestone metadata + issue counts (`openIssues`, `closedIssues`) rather than full issue arrays. Added a `hint` field to the response directing users to the `get_github_issues` tool for individual issue details.
77
+ - **Docker Hub Short Description** — Corrected "HTTPS" → "HTTP/SSE" and formatting in `docker-publish.yml` short-description field
78
+ - **`delete_entry` Permanent Delete of Soft-Deleted Entries** — `delete_entry(id, permanent: true)` now works on previously soft-deleted entries. Added `getEntryByIdIncludeDeleted()` so permanent deletion can find entries regardless of soft-delete state. Previously returned `{ success: false, error: "Entry not found" }` for soft-deleted entries.
79
+ - **`list_tags` Zero-Count Tag Filtering** — `list_tags` tool and `memory://tags` resource no longer return orphan tags with zero usage count, reducing clutter from deleted or merged tags
80
+ - **`delete_entry` Existence Check (P154)** — Tool now pre-checks entry existence before mutation, returning `{ success: false, error: "Entry X not found" }` for nonexistent entries instead of always returning `success: true`
81
+ - **`link_entries` Existence Check (P154)** — Tool now pre-checks both source and target entry existence before creating relationship, returning `{ success: false, message: "Source/Target entry X not found" }` instead of silently creating orphan relationships
82
+ - **`visualize_relationships` Existence Disambiguation (P154)** — When `entry_id` parameter specifies a nonexistent entry, tool now returns `{ message: "Entry X not found" }` instead of the ambiguous `"No entries found with relationships matching your criteria"`
83
+ - **`memory://health` Tool Count** — Health resource now dynamically computes tool count from `TOOL_GROUPS` instead of a hardcoded value. Previously reported 33 tools; now correctly reports 38 after milestone tools were added.
84
+ - **`memory://significant` Importance Sort Correctness** — Fixed resource returning entries sorted by timestamp instead of importance when the database has more than 20 significant entries. Previously, `LIMIT 20` was applied in SQL (`ORDER BY timestamp DESC LIMIT 20`) before the JavaScript importance sort, meaning older but higher-importance entries were excluded before sorting ran. Now all significant entries are fetched, sorted by `importance` descending in JavaScript, then the top 20 are returned. Added regression test verifying sort order across entries with different relationship counts.
85
+
86
+ - **`delete_github_milestone` Structured Error** — Tool now returns `{ success: false, milestoneNumber, message, error }` matching `DeleteMilestoneOutputSchema` when deletion fails. Previously returned only `{ error }` without structured fields.
87
+ - **`JournalEntry` GitHub Metadata** — Entry output now includes 10 GitHub integration fields (`issueNumber`, `issueUrl`, `prNumber`, `prUrl`, `prStatus`, `projectNumber`, `projectOwner`, `workflowRunId`, `workflowName`, `workflowStatus`) in all tool responses. Previously stored in DB but omitted from `create_entry`, `get_entry_by_id`, `get_recent_entries`, and search results.
88
+
89
+ ### CI/CD
90
+
91
+ - **Removed Dependabot Auto-Merge Workflow** — Deleted `dependabot-auto-merge.yml`; dependency PRs now require manual review and merge
92
+ - **Trivy Action Update** — Updated `aquasecurity/trivy-action` 0.33.1 → 0.34.0 in `security-update.yml` (bundles Trivy scanner 0.69.1)
93
+ - **CI Test Matrix Alignment** — Updated Node.js test matrix from `[20.x, 22.x, 25.x]` to `[24.x, 25.x]` to match `engines.node: >=24.0.0`
94
+ - **Blocking npm audit** — Removed `continue-on-error: true` from `npm audit` step in lint-and-test.yml; known vulnerabilities now fail the pipeline
95
+ - **Blocking Secret Scanning** — Removed `continue-on-error: true` from TruffleHog step in secrets-scanning.yml; verified secret leaks now fail the pipeline
96
+
97
+ ### Security
98
+
99
+ - **GHSA-w7fw-mjwx-w883 (qs)** — Updated `qs` 6.14.1 → 6.14.2 to fix low-severity arrayLimit bypass in comma parsing that allows denial of service
100
+ - **CVE-2026-26960 (tar)** — Manually patched npm's bundled `tar` → `7.5.8` in Dockerfile to fix HIGH severity path traversal vulnerability (CVSS 7.1). Also updated npm override.
101
+ - **HTTP Transport Hardening** — Comprehensive security improvements for HTTP mode:
102
+ - **Configurable CORS** — New `--cors-origin` CLI flag and `MCP_CORS_ORIGIN` env var (default: `*`). Previously hardcoded `Access-Control-Allow-Origin: *`.
103
+ - **Request Body Size Limit** — Added 1MB limit to `express.json()` to prevent memory exhaustion DoS attacks
104
+ - **Security Headers** — Added `X-Content-Type-Options: nosniff` and `X-Frame-Options: DENY` on all HTTP responses
105
+ - **Session Timeout** — Stateful HTTP sessions now expire after 30 minutes of inactivity (5-minute sweep interval). Prevents unbounded memory growth from abandoned sessions.
106
+ - **Error Log Token Scrubbing** — Logger now automatically sanitizes `error` context fields to redact GitHub tokens (classic `ghp_`, fine-grained `github_pat_`), Bearer tokens, and Authorization headers before writing to stderr. New `sanitizeErrorForLogging()` in `security-utils.ts`.
107
+ - **SECURITY.md Rewrite** — Complete rewrite for TypeScript era. Removed all outdated Python references. Added documentation for HTTP transport security (CORS, headers, session timeout, body limits), GitHub token handling, and CI/CD security pipeline.
108
+ - **docker-compose.yml Rewrite** — Replaced Python-era configuration with TypeScript commands. Removed SSH/gitconfig root mounts, deprecated `version` key, and `PYTHONPATH`. Added HTTP transport service with resource limits and secure volume mount options.
109
+ - **Dockerfile Version Label** — Updated hardcoded `4.0.0` → `4.3.1` to match actual package version
110
+ - **Dockerfile Healthcheck** — Replaced no-op `console.log` healthcheck with `process.exit(0)` validation. Added documentation for HTTP-mode override using `curl`.
111
+ - **Legacy Cleanup** — Removed leftover Python `__pycache__` directories from `src/` subtree
112
+
113
+ ## [4.3.1] - 2026-02-05
114
+
115
+ ### Changed
116
+
117
+ - **Dependency Updates**
118
+ - `@modelcontextprotocol/sdk`: 1.25.3 → 1.26.0 (minor)
119
+ - `@types/node`: 25.0.10 → 25.2.0 (minor)
120
+ - `commander`: 14.0.2 → 14.0.3 (patch)
121
+ - `globals`: 17.1.0 → 17.3.0 (minor)
122
+
123
+ ### Fixed
124
+
125
+ - **`get_cross_project_insights` Output Schema Validation** — Fixed empty result case returning incomplete object
126
+ - When no projects met minimum entry threshold, handler returned only `message` and `projects`
127
+ - Now returns all required fields: `project_count`, `total_entries`, `inactive_projects`, `time_distribution`
128
+ - Fixes MCP outputSchema validation error when tool returns empty results
129
+
130
+ ### Security
131
+
132
+ - **CVE-2026-24515 (libexpat)** — Explicit libexpat install from Alpine edge fixes CRITICAL severity null pointer dereference vulnerability.
133
+ - **CVE-2026-25210 (libexpat)** — Same patch fixes MEDIUM severity integer overflow information disclosure/data integrity issue.
134
+ - **CVE-2026-23950 + CVE-2026-24842 (tar)** — Manually patched npm's bundled `tar` → `7.5.7` in Dockerfile to fix HIGH severity vulnerabilities (path traversal, CVSS 8.2). Also added npm override for project dependencies.
135
+
136
+ ## [4.3.0] - 2026-01-18
137
+
138
+ ### Added
139
+
140
+ - **Causal Relationship Types** — 3 new relationship types for decision tracing and failure analysis
141
+ - `blocked_by`: Entry was blocked by another (e.g., blocker → resolution)
142
+ - `resolved`: Entry resolved/fixed an issue from another
143
+ - `caused`: Entry caused or led to another outcome
144
+ - Distinct Mermaid arrow styles: `--x` for blocked_by, `==>` for resolved, `-.->` for caused
145
+ - Updated Field Notes with guidance on when to use causal types
146
+
147
+ - **Enhanced Analytics** — `get_statistics` now returns 4 additional metrics for deeper insights
148
+ - `decisionDensity`: Significant entries per period (entries with `significanceType`)
149
+ - `relationshipComplexity`: Total relationships / total entries average
150
+ - `activityTrend`: Period-over-period growth percentage
151
+ - `causalMetrics`: Counts for `blocked_by`, `resolved`, `caused` relationships
152
+
153
+ - **Significance Gradients** — Computed `importance` scores (0.0-1.0) for entries
154
+ - Formula weights: significance type (30%), relationship count (35%), causal relationships (20%), recency (15%)
155
+ - `get_entry_by_id` now returns `importance` field
156
+ - `memory://significant` resource sorts entries by importance (highest first)
157
+
158
+ ### Fixed
159
+
160
+ - **Docker Workflow Duplicate Builds** — Removed `push: tags: ['v*']` trigger that caused duplicate image sets when releasing versions
161
+ - Docker builds now only trigger via `workflow_run` after "Lint and Test" passes
162
+ - Version tags still applied based on `package.json` version
163
+ - Removed obsolete `preflight-check` job
164
+
165
+ ### Improved
166
+
167
+ - **`memory://significant` Secondary Sort** — Entries with equal importance scores are now sorted by timestamp (newest first)
168
+ - Previously, entries with identical importance could appear in non-deterministic order
169
+ - Secondary sort ensures consistent, chronological ordering for ties
170
+ - **`create_entry` Auto-populates `issueUrl`** — When creating an entry with `issue_number` but no `issueUrl`, the URL is now auto-constructed from cached repository info
171
+ - Requires GitHub integration and prior `getRepoInfo()` call (happens naturally during briefing)
172
+ - Eliminates need to manually provide `issueUrl` when linking to issues
173
+ - **Harmonized Graph Arrow Styles** — `memory://graph/recent` now uses the same arrow mappings as `visualize_relationships` tool
174
+ - Added causal relationship types: `blocked_by` (--x), `resolved` (==>), `caused` (-.->)
175
+ - Added missing types: `clarifies` (-.->) and `response_to` (<-->)
176
+ - Standardized `implements` to use `==>` (was `-.->`) for consistency
177
+
178
+ ## [4.2.0] - 2026-01-17
179
+
180
+ ### Added
181
+
182
+ - **HTTP/SSE Transport** — Run the server in HTTP mode for remote access and web-based clients
183
+ - New `--transport http --port 3000` CLI options
184
+ - `POST /mcp` — JSON-RPC requests (initialize, tools/call, resources/read, etc.)
185
+ - `GET /mcp` — SSE stream for server-to-client notifications (supports resumability via `Last-Event-ID`)
186
+ - `DELETE /mcp` — Session termination
187
+ - **Stateful mode** (default): Session management via `mcp-session-id` header
188
+ - **Stateless mode** (`--stateless`): No session management, ideal for serverless deployments
189
+ - Trade-off: Progress notifications and SSE streaming unavailable in stateless mode
190
+ - Uses MCP SDK's `StreamableHTTPServerTransport` with Express
191
+ - New dependencies: `express@^5.1.0`, `@types/express` (devDependency)
192
+ - **New Tool: `cleanup_backups`** — Automatic backup rotation to prune old backups
193
+ - `keep_count` parameter specifies how many recent backups to retain (default: 5)
194
+ - Returns list of deleted filenames and count of kept backups
195
+ - Added to `backup` tool group in ToolFilter
196
+ - **New Tool: `merge_tags`** — Tag normalization for consolidating similar tags
197
+ - Merge duplicate/similar tags (e.g., `phase-2` → `phase2`)
198
+ - Source tag is deleted after merge; target tag created if not exists
199
+ - Updates all entry-tag links and usage counts
200
+ - Added to `admin` tool group in ToolFilter
201
+ - **Tool Count**: 31 → 33 tools (backup: 3 → 4, admin: 4 → 5)
202
+
203
+ ### Improved
204
+
205
+ - **`semantic_search` Hint Enhancement** — Improved feedback when no results found
206
+ - Hint now includes the current `similarity_threshold` value (e.g., "0.3")
207
+ - Suggests lowering threshold (e.g., "Try 0.2 for broader matches.")
208
+ - Helps users understand why queries return empty and how to adjust
209
+ - **`restore_backup` Enhanced Warning** — Improved feedback about reverted changes
210
+ - Warning message now explicitly mentions tag merges, new entries, and relationships are reverted
211
+ - New `revertedChanges` field in output with specific details about reverted data
212
+ - `tagMerges` message now clarifies: "Previously merged tags will reappear as separate tags."
213
+ - Added Field Note in `memory://instructions` documenting restore behavior
214
+ - **`memory://prs/{pr_number}/timeline` Enhancement** — Live PR metadata from GitHub API
215
+ - New `prMetadata` field with title, state, draft, mergedAt, closedAt, author, headBranch, baseBranch
216
+ - New `timelineNote` field with human-readable PR status (e.g., "PR #67 is merged (merged)")
217
+ - Differentiates timeline from simpler `memory://prs/{pr_number}/entries` resource
218
+
219
+ ### Documentation
220
+
221
+ - **`memory://tags` vs `list_tags` Schema** — Documented intentional difference between resource and tool output
222
+ - Resource includes `id`, `name`, `count` (for reference/management use cases)
223
+ - Tool returns only `name`, `count` (optimized for filtering/display)
224
+ - Added to `ServerInstructions.ts` Field Notes section
225
+ - **Tag Naming Conventions** — Added guidance for consistent tag naming patterns
226
+ - Recommends lowercase with dashes (e.g., `bug-fix`, `phase-2`)
227
+ - Documents `merge_tags` tool for consolidating duplicates
228
+ - **`semantic_search` Threshold Guidance** — New Field Note documenting threshold recommendations
229
+ - Default 0.3, broader matches at 0.2-0.25, strict matches at 0.4+
230
+ - Added `similarity_threshold` to tool parameter reference table
231
+
232
+ ### Changed
233
+
234
+ - **`memory://instructions` Default Level** — Changed from `standard` to `full` so agents always receive complete tool parameter reference and field notes (~600 tokens)
235
+ - **Briefing `clientNote`** — Simplified from "If prompts unavailable or Dynamic Context Management behaviors missing..." to clearer "For complete tool reference and field notes, read memory://instructions."
236
+ - **Expanded StructuredContent Coverage** — 7 additional tools now return `structuredContent` with Zod validation
237
+ - `test_simple`, `export_entries`, `rebuild_vector_index`, `add_to_vector_index`
238
+ - `move_kanban_item`, `create_github_issue_with_entry`, `close_github_issue_with_entry`
239
+ - All 33 tools with response data now have formal output schemas
240
+
241
+ ### Fixed
242
+
243
+ - **CI Status "unknown" for Cancelled Workflows** — Fixed `memory://briefing` and `memory://github/status` reporting "unknown" when latest workflow was cancelled
244
+ - Added proper handling for `cancelled` conclusion alongside `success` and `failure`
245
+ - CI status type now includes `passing | failing | pending | cancelled | unknown`
246
+
247
+ ## [4.1.0] - 2026-01-17
248
+
249
+ ### Added
250
+
251
+ - **Auto-rebuild Vector Index on Startup** — New `--auto-rebuild-index` CLI flag and `AUTO_REBUILD_INDEX` env var
252
+ - When enabled, server rebuilds the vector index from all database entries during startup
253
+ - Ensures `memory://health` reports accurate `itemCount` matching `entryCount`
254
+ - Useful for deployments where the in-memory index needs to be synchronized after server restarts
255
+ - **`move_to_done` Option for `close_github_issue_with_entry`** — Automatically move Kanban item to "Done" when closing an issue
256
+ - New `move_to_done` boolean parameter (default: `false`)
257
+ - New `project_number` parameter (uses `DEFAULT_PROJECT_NUMBER` if not specified)
258
+ - Finds the issue on the Kanban board and moves it to the "Done" column
259
+ - Output includes `kanban` field with move result
260
+ - **`autoContext` Field Documentation** — Added "Field Notes" section to server instructions explaining the reserved field
261
+ - **MCP Progress Notifications** — Long-running operations now emit `notifications/progress` for improved user experience
262
+ - **`rebuild_vector_index`**: Reports progress every 10 entries with total count
263
+ - **`restore_backup`**: Reports 3-phase progress (backup → restore → verify)
264
+ - **`export_entries`**: Reports 2-phase progress (fetch → process)
265
+ - Requires client support for `progressToken` in request `_meta` (MCP 2025-11-25)
266
+ - New utility module: `src/utils/progress-utils.ts`
267
+ - **MCP Icons Array Support** — Tools, resources, and prompts now include optional `icons` for visual representation in MCP clients
268
+ - Follows MCP 2025-11-25 specification with `src`, `mimeType`, `sizes` properties
269
+ - **31 tools** with group-based icons (core, search, analytics, github, backup, etc.)
270
+ - **15 resources** with context-appropriate icons (briefing, recent, graph, health, github, etc.)
271
+ - **15 prompts** with message bubble icon
272
+ - Uses SVG data URIs for self-contained distribution (no external dependencies)
273
+ - New type: `McpIcon` in `src/types/index.ts`
274
+ - New module: `src/constants/icons.ts` with centralized icon definitions
275
+ - **Expanded StructuredContent Coverage** — Extended Zod output schemas from 5 to 24 tools
276
+ - **17 new output schemas** defined in `src/handlers/tools/index.ts`
277
+ - **Phase 1 (Core Read)**: `SemanticSearchOutputSchema`, `TagsListOutputSchema`, `VectorStatsOutputSchema`, `VisualizationOutputSchema`, `CrossProjectInsightsOutputSchema`
278
+ - **Phase 2 (Mutations)**: `CreateEntryOutputSchema`, `UpdateEntryOutputSchema`, `DeleteEntryOutputSchema`, `LinkEntriesOutputSchema`
279
+ - **Phase 3 (GitHub)**: `GitHubIssuesListOutputSchema`, `GitHubIssueResultOutputSchema`, `GitHubPRsListOutputSchema`, `GitHubPRResultOutputSchema`, `GitHubContextOutputSchema`, `KanbanBoardOutputSchema`
280
+ - **Phase 4 (Backup)**: `BackupResultOutputSchema`, `BackupsListOutputSchema`, `RestoreResultOutputSchema`
281
+ - Clients supporting `structuredContent` receive validated JSON for programmatic consumption
282
+ - **`semantic_search` Hint Control** — New `hint_on_empty` parameter (default: `true`) to control hint display
283
+ - When `false`, suppresses hints about empty results or index status
284
+ - Useful for programmatic consumers that handle empty results differently
285
+ - **PR Resource Empty Hints** — `memory://prs/{pr_number}/entries` and `memory://prs/{pr_number}/timeline` now include a `hint` field when no entries are linked
286
+ - Hint: "No journal entries linked to this PR. Use create_entry with pr_number to link entries."
287
+
288
+ ### Documentation
289
+
290
+ - **GitHub Fallback Behavior** — Documented in both `README.md` and `DOCKER_README.md`
291
+ - Explains what happens when GitHub tools cannot auto-detect repository information
292
+ - Shows example `requiresUserInput: true` response when `owner` and `repo` parameters are needed
293
+
294
+ ### Known Limitations
295
+
296
+ - **Icons not visible in protocol output** — MCP SDK v1.25.2 has `icons` in type definitions but `registerTool()`, `registerResource()`, and `registerPrompt()` don't pass icons through to protocol responses. Server-side implementation is correct and future-ready; will work when SDK adds proper passthrough.
297
+
298
+ ### Fixed
299
+
300
+ - **`list_tags` Output Schema Validation** — Fixed tool returning `usageCount` instead of `count` required by `TagsListOutputSchema`
301
+ - Handler now maps database `usageCount` field to schema-expected `count` field
302
+ - Fixes "expected number for tags[*].count, received undefined" validation error
303
+ - **`semantic_search` Misleading Hint** — Fixed hint always showing "No entries in vector index" even when index had items
304
+ - Now checks actual index stats to determine if index is truly empty
305
+ - Shows appropriate hint: "No entries matched your query above the similarity threshold" when items exist but don't match
306
+ - **`getRecentEntries` Deterministic Ordering** — Added secondary sort by ID for consistent results
307
+ - Entries with identical timestamps now sorted by `id DESC` for deterministic ordering
308
+ - Prevents non-reproducible results when entries share timestamps
309
+ - **GHSA-73rr-hh4g-fpgx (diff DoS)** — Manually patched npm's bundled `diff@8.0.2` → `8.0.3` in Dockerfile
310
+ - npm team hasn't released fix yet, so we patch it directly via `npm pack` + replace
311
+ - **CVE-2026-23745 (tar)** — Manually patched npm's bundled `tar@7.5.2` → `7.5.3` in Dockerfile
312
+ - Addresses high-severity vulnerability (CVSS 8.2) in npm's bundled tar package
313
+ - **`memory://health` Vector Index Field Name** — Aligned `indexedEntries` → `itemCount` for consistency with `get_vector_index_stats` tool
314
+ - **`memory://tags` Field Naming** — Mapped `usageCount` → `count` for consistency with `list_tags` tool output
315
+ - **`create_github_issue_with_entry` Default Status** — Issues added to projects now default to "Backlog" column when `initial_status` is not specified
316
+ - **`delete_entry` Vector Index Cleanup** — Deleting entries now removes them from the vector index, preventing orphaned index entries and `itemCount` discrepancy between vector index and database
317
+ - **`memory://instructions` Query Parameter Documentation** — Removed misleading description about query parameter support (`?level=essential|standard|full`) since MCP SDK performs exact URI matching at the SDK level before invoking handlers
318
+ - **Docker Security Gate** — Restructured workflow to scan BEFORE push:
319
+ - `security-scan` now runs FIRST (before any images are pushed)
320
+ - `build-platform` only runs after security scan passes
321
+ - Uses `--only-fixed` to block only on fixable CVEs
322
+ - Unfixable upstream CVEs (Alpine zlib, busybox) do not block deploys
323
+ - **Docker Build Optimization** — Comprehensive `.dockerignore` rewrite reducing build context by ~200MB:
324
+ - Added `node_modules/` (~195MB) — reinstalled in builder stage
325
+ - Added `mcp-publisher.exe` (6.3MB) — local publishing tool
326
+ - Added dev tooling files (`.prettierrc`, `eslint.config.js`, etc.)
327
+ - Added `releases/` directory and security scanning configs
328
+ - Organized into logical sections with clear documentation
329
+
330
+ ## [4.0.0] - 2026-01-16
331
+
332
+ ### Added
333
+
334
+ - **GitHub Issue Lifecycle Tools** — Integrated issue management with automatic journal entries
335
+ - **`create_github_issue_with_entry`**: Creates GitHub issue AND linked journal entry
336
+ - **New**: `initial_status` parameter to set Kanban column (e.g., "Backlog", "Ready")
337
+ - **`close_github_issue_with_entry`**: Closes issue AND creates resolution entry with significance
338
+ - Auto-detects owner/repo from git context
339
+ - Custom entry content optional with sensible auto-generated defaults
340
+ - **New `GitHubIntegration` Methods**: `createIssue()`, `closeIssue()` for Octokit operations
341
+ - **Tool Count**: 29 → 31 tools (github group: 7 → 9)
342
+ - **New Prompt: `confirm-briefing`** — Session context acknowledgment for users
343
+ - Generates formatted acknowledgment message showing what context the agent received
344
+ - Displays journal stats, latest entries preview, and behavioral guidance
345
+ - Helps users understand what context the AI agent has before continuing
346
+ - **Briefing Resource Enhancement** — `memory://briefing` now includes:
347
+ - `userMessage`: Pre-formatted context summary for agents to show users
348
+ - `autoRead` and `sessionInit` annotations: Hints for clients that support auto-subscribe behavior
349
+ - `templateResources`: Array of 6 template resource URIs (projects, issues, PRs, kanban) for full discoverability
350
+ - Enhanced description: "AUTO-READ AT SESSION START" for discoverability
351
+ - `clientNote`: Pointer to `memory://instructions` for clients that don't auto-inject ServerInstructions
352
+ - **New `memory://instructions` Resource** — Universal access to full server behavioral guidance
353
+ - Exposes the same instructions that `ServerInstructions.ts` provides to auto-inject clients
354
+ - Enables AntiGravity and other clients to access Dynamic Context Management patterns
355
+ - Resource count: 17 → 18 resources (12 static + 6 template)
356
+ - **structuredContent Text Fallback** — Tools with `outputSchema` now return both:
357
+ - `structuredContent`: Validated JSON for clients that support it (Cursor, Claude Desktop)
358
+ - `content`: Formatted JSON text for clients that don't (AntiGravity)
359
+ - Fixes "tool call completed" display issue in AntiGravity for 5 tools
360
+ - **Session Start Guidance** — Enhanced `ServerInstructions.ts` with acknowledgment step
361
+ - Step 1: Read `memory://briefing` for project context
362
+ - Step 2: **Show the `userMessage` to the user**
363
+ - Step 3: Proceed with user's request
364
+ - **Prompt Count** — 14 → 15 prompts (added `confirm-briefing`)
365
+ - **MCP 2025-11-25 Resource Annotations** — Added `lastModified` (ISO 8601 timestamp) to key dynamic resources
366
+ - Compact behavioral guidance (when to create/search entries)
367
+ - Latest 3 entries preview with truncated content
368
+ - GitHub status summary (repo, branch, CI, open issues/PRs)
369
+ - Quick access links to related resources
370
+ - Priority 1.0 (highest) — designed to be read first at session start
371
+ - Optimized for clients that don't auto-inject server instructions (Antigravity, VSCode, etc.)
372
+ - **MCP 2025-11-25 Tool `outputSchema`** — Structured output validation for high-value tools
373
+ - Tools return `structuredContent` (validated against schema) instead of raw text `content`
374
+ - **5 tools with `outputSchema`**: `get_recent_entries`, `search_entries`, `search_by_date_range`, `get_entry_by_id`, `get_statistics`
375
+ - New Zod schemas: `EntryOutputSchema`, `EntriesListOutputSchema`, `RelationshipOutputSchema`, `EntryByIdOutputSchema`, `StatisticsOutputSchema`
376
+ - SDK validates output at runtime — ensures response matches declared schema
377
+
378
+ ### Changed
379
+
380
+ - **Resource Handler Architecture** — Added `ResourceResult` interface for typed resource responses with annotations
381
+ - Handlers can now return `{ data, annotations: { lastModified } }` structure
382
+ - Backward compatible: existing handlers returning raw data still work
383
+ - **Confirmed OpenWorldHint Compliance** — All 7 GitHub tools already have `openWorldHint: true` annotation
384
+ - **Tiered Server Instructions** — `generateInstructions()` now supports `level` parameter
385
+ - `essential` (~200 tokens): Core behavioral guidance only
386
+ - `standard` (~400 tokens): + GitHub integration patterns (default)
387
+ - `full` (~600 tokens): + tool/resource/prompt listings
388
+ - **Resource Count** — 16 → 17 → 18 resources (added `memory://briefing`, then `memory://instructions`)
389
+ - **Node.js 24 LTS Engines Alignment** — Updated `package.json` engines field to match Dockerfile baseline
390
+ - `engines.node`: >=18.0.0 → >=24.0.0 (Dockerfile already using `node:24-alpine`)
391
+ - **Enhanced AI Agent Behavioral Guidance** — Added new `Behavioral Guidance` section to `ServerInstructions.ts`
392
+ - **When to Query Project Context** — Encourages agents to fetch `memory://recent` or use `semantic_search` at conversation start; includes time awareness via `memory://health`
393
+ - **When to Create Entries** — Clear triggers for documenting implementations, decisions, bug fixes, and milestones
394
+ - **Building the Knowledge Graph** — Guidance on using `link_entries` to connect related work
395
+ - **GitHub Integration Workflows** — Guidance on linking entries to Issues/PRs, documenting GitHub activity, and Kanban patterns
396
+ - **Initial Context Strategy** — Guidance on dynamically choosing context based on user prompt
397
+ - **Initial Briefing Optimization** — Server instructions now include latest entry snapshot for immediate context
398
+ - **New `memory://github/status` Resource** — Compact GitHub overview with progressive disclosure (CI status, commit SHA, issue/PR numbers, Kanban summary)
399
+ - **Optimized `get-context-bundle` Prompt** — Now uses compact entry summaries (~85% token reduction) instead of full content
400
+ - **ServerInstructions Token Optimization** — Reduced BASE_INSTRUCTIONS by ~53% (207→97 lines) with client-agnostic server naming
401
+ - **Dynamic Context Management Documentation** — Promoted new feature in README.md and DOCKER_README.md Key Benefits
402
+ - **Wiki Documentation Updates** — Added Dynamic Context Management to Home.md, Quick-Start.md, Architecture.md, Tools.md, Installation.md
403
+ - **Client Compatibility Notes** — Documented AntiGravity IDE limitations in README.md, DOCKER_README.md, and Installation.md
404
+ - ServerInstructions not injected: AntiGravity does not call `getServerInstructions()`
405
+ - Resource hints not honored: `autoRead`/`sessionInit` annotations ignored
406
+ - Workaround: Manual briefing read or user rules
407
+ - **Dependency Updates**
408
+ - `@types/node`: 25.0.8 → 25.0.9
409
+ - `vectra`: 0.11.1 → 0.12.3 (unpinned, packaging bug fixed)
410
+
411
+ ### Documentation
412
+
413
+ - **GitHub Management Capabilities** — Added hybrid workflow documentation explaining MCP + gh CLI approach
414
+ - New section in `README.md` and `DOCKER_README.md` with capability matrix
415
+ - Enhanced `Git-Integration.md` wiki page with comprehensive capability table
416
+ - Includes example issue lifecycle workflow demonstrating journal linking with gh CLI operations
417
+
418
+ ### Fixed
419
+
420
+ - **Trivy Security Scan Workflow** — Fixed workflow that hadn't run since September 2025
421
+ - Updated `aquasecurity/trivy-action` from unstable `@master` to stable `@0.33.1`
422
+ - Added `push` trigger on `main` branch for Dockerfile/package changes to ensure regular scans
423
+ - Added `pull_request` trigger for security validation before merging
424
+ - **Dependabot Label Configuration** — Created missing `npm` label in GitHub repository. Dependabot requires labels to exist before it can apply them to pull requests.
425
+ - **Vectra Type Definitions** — Now unpinned in v3.1.6. Previously pinned to v0.11.1 due to a packaging bug in v0.12.x where TypeScript type definitions (`.d.ts` files) were not included in the published npm package.
426
+ - **Docker Latest Tag** — Fixed `latest` tag not being applied on `workflow_run` triggered builds. Two issues were fixed: (1) The `{{is_default_branch}}` template doesn't evaluate correctly for `workflow_run` events - replaced with explicit branch detection. (2) The `security-scan` and `merge-and-push` jobs were being skipped due to cascading skip behavior from the skipped `preflight-check` job - added `always()` with explicit success checks for direct dependencies.
427
+ - **Semantic Search Timing** — Fixed race condition where search returned 0 results immediately after rebuild. Previous attempt using 100ms delay was insufficient; now using explicit index synchronization to ensure vectra's internal state is refreshed.
428
+ - **Auto-Indexing** — Fixed missing auto-indexing for `create_entry`, `create_entry_minimal`, and `update_entry` tools. New and updated entries are now immediately available for semantic search without requiring a full index rebuild.
429
+ - **CI Status Discrepancy** — Aligned `memory://github/status` logic with `memory://briefing` to use the latest _completed_ run for status determination. Previous logic incorrectly reported "failing" if _any_ of the last 5 runs failed, causing confusion when the latest run was passing.
430
+ - **GitHub Actions Resource** — `memory://actions/recent` now fetches live workflow runs from GitHub API and presents them as virtual journal entries, aligning with the graph view.
431
+ - **Project Board Automation** — `create_github_issue_with_entry` now accepts `project_number` to automatically add the created issue to a GitHub Project v2 Kanban board.
432
+ - **Search Filter Accuracy** — Fixed `search_entries` ignoring filters when `query` is empty. Now correctly filters by `issue_number`, `pr_number`, etc.
433
+ - **Default Project Number** — Added `--default-project` CLI option and `DEFAULT_PROJECT_NUMBER` environment variable to auto-add issues to a specific project if no `project_number` is provided.
434
+ - **Documentation Updates** — Updated README and DOCKER_README to document default project configuration and correct `mcp-config-example.json`.
435
+ - **`export_entries` Limit Parameter** — Added missing `limit` parameter to `export_entries` tool. Previously always exported 100 entries; now respects the `limit` parameter (default: 100).
436
+ - **`get_statistics` GroupBy Visibility** — Added `groupBy` field to statistics output so callers can verify which grouping was applied.
437
+ - **Entry Output Schema Completeness** — Added missing GitHub metadata fields to `EntryOutputSchema`: `projectOwner`, `issueUrl`, `prUrl`, `prStatus`, `workflowName`, `workflowStatus`.
438
+ - **Vector Index Stats Inconsistency** — Fixed `memory://health` reporting 0 indexed entries after `rebuild_vector_index`. Changed `getStats()` to use vectra's `getIndexStats()` API which explicitly loads from disk for authoritative stats.
439
+
440
+ ### Documentation
441
+
442
+ - **GitHub Management Capabilities** — Added hybrid workflow documentation explaining MCP + gh CLI approach
443
+ - New section in `README.md` and `DOCKER_README.md` with capability matrix
444
+ - Enhanced `Git-Integration.md` wiki page with comprehensive capability table
445
+ - Includes example issue lifecycle workflow demonstrating journal linking with gh CLI operations
446
+ - **`get_github_context` Clarification** — Updated description to clarify it only returns **open** items (closed items excluded).
447
+ - **`move_kanban_item` Case Sensitivity** — Documented that status matching is case-insensitive and to use exact status names from `get_kanban_board`.
448
+ - **Virtual Entry IDs** — Documented in Resources.md that `memory://actions/recent` returns virtual entries with negative IDs (negated workflow run IDs) to distinguish from database entries.
449
+ - **Resource Annotations Note** — Added note in Resources.md that MCP 2025-11-25 annotations (e.g., `lastModified`) may not be visible in all clients due to SDK/client limitations.
450
+
451
+ ## [3.1.5] - 2026-01-11
452
+
453
+ ### Security
454
+
455
+ - **Remove protobufjs CLI** — Eliminates CVE-2019-10790 (taffydb), CVE-2025-54798 (tmp), CVE-2025-5889 (brace-expansion). CLI folder not needed at runtime.
456
+
457
+ ## [3.1.4] - 2026-01-11
458
+
459
+ ### Fixed
460
+
461
+ - **Docker npm Upgrade** — Added `npm install -g npm@latest` to production stage (was only in builder stage). Fixes CVE-2025-64756 (glob) and CVE-2025-64118 (tar) in final Docker image.
462
+
463
+ ## [3.1.3] - 2026-01-11
464
+
465
+ ### Security
466
+
467
+ - **Docker CVE Fixes** — Active remediation for 7 CVEs:
468
+ - npm global upgrade fixes CVE-2025-64756 (glob) and CVE-2025-64118 (tar)
469
+ - Alpine edge for curl fixes CVE-2025-14524, CVE-2025-14819, CVE-2025-14017
470
+ - protobufjs cli cleanup fixes CVE-2025-54798 (tmp) and CVE-2025-5889 (brace-expansion)
471
+ - **Reduced CVE Allowlist** — Only truly unfixable CVEs remain (zlib with no upstream fix, taffydb unmaintained)
472
+
473
+ ## [3.1.2] - 2026-01-11
474
+
475
+ ### Fixed
476
+
477
+ - **CI Build Pipeline** — Added `.npmrc` with `legacy-peer-deps=true` to resolve `npm ci` failures from optional peer dependency conflicts (vectra's zod@^3.23.8 vs zod@^4.x)
478
+ - **Docker Workflow Gating** — Added `preflight-check` job to docker-publish.yml; tag pushes now run lint/typecheck/build before Docker deployment
479
+
480
+ ## [3.1.1] - 2026-01-11
481
+
482
+ ### Security
483
+
484
+ - **Docker Image Security** — Added `apk upgrade --no-cache` to builder stage for latest security patches
485
+ - Fixes CVE-2026-22184 (zlib critical)
486
+ - Fixes CVE-2025-14524, CVE-2025-14819, CVE-2025-14017 (curl)
487
+ - **NPM Dependency Override** — Added `glob@^11.1.0` override to fix CVE-2025-64756 (ReDoS)
488
+
489
+ ### Fixed
490
+
491
+ - **CI Build** — Regenerated `package-lock.json` to fix lock file desync with MCP SDK peer dependencies
492
+
493
+ ## [3.1.0] - 2026-01-11
494
+
495
+ ### Added
496
+
497
+ - **GitHub Projects v2 Kanban Support** — View and manage GitHub Project boards directly from AI agents
498
+ - **New Tool: `get_kanban_board`** — Fetch project items grouped by Status columns (Backlog, Ready, In progress, In review, Done)
499
+ - **New Tool: `move_kanban_item`** — Move items between status columns using GraphQL mutations
500
+ - **New Resource: `memory://kanban/{project_number}`** — JSON board data with items grouped by status
501
+ - **New Resource: `memory://kanban/{project_number}/diagram`** — Mermaid visualization of Kanban board
502
+ - **Multi-level project discovery** — Searches user → repository → organization level projects automatically
503
+ - **Dynamic status columns** — Supports any Status field configuration per project
504
+ - **Server Instructions** — Usage instructions are now automatically provided to AI agents via the MCP protocol's `instructions` capability during server initialization. See [`src/constants/ServerInstructions.ts`](https://github.com/neverinfamous/memory-journal-mcp/blob/main/src/constants/ServerInstructions.ts).
505
+ - **Comprehensive AI Agent Instructions** — Rewritten `ServerInstructions.ts` with:
506
+ - Explicit MCP access patterns (`CallMcpTool`, `ListMcpResources`, `FetchMcpResource`)
507
+ - Tool parameter reference tables for all 29 tools
508
+ - Default GitHub Projects v2 status column documentation
509
+ - Guidance for finding correct project by `projectTitle`
510
+
511
+ ### Fixed
512
+
513
+ - **Dependabot Configuration** — Migrated from deprecated `pip` ecosystem to `npm` ecosystem
514
+ - **Root Cause**: The v3.0.0 TypeScript rewrite removed all Python dependency files, but Dependabot was still configured for `pip`
515
+ - **Symptom**: Dependabot security scans failed with `dependency_file_not_found: / not found`
516
+ - **Resolution**: Replaced `pip` ecosystem with `npm` ecosystem and updated dependency groups to match TypeScript/Node.js packages (MCP SDK, Zod, sql.js, vectra, build tools, linting)
517
+
518
+ ### Changed
519
+
520
+ - **Docker Base Image** — Upgraded from `node:22-alpine` to `node:24-alpine` (Active LTS)
521
+ - Node.js 24 is the current Active LTS release (support through April 2028)
522
+ - Node.js 25 was skipped as it's a non-LTS "Current" release (EOL June 2026)
523
+ - **Dependency Updates**
524
+ - `@modelcontextprotocol/sdk` 1.25.1 → 1.25.2 (patch)
525
+ - `@octokit/rest` 21.1.1 → 22.0.1 (major)
526
+ - `globals` 16.5.0 → 17.0.0 (major)
527
+ - `typescript-eslint` 8.50.1 → 8.52.0 (minor)
528
+ - `vectra` 0.9.0 → 0.11.1 (minor) — Updated `queryItems` call to new API signature with BM25 hybrid search support
529
+ - `zod` 4.2.1 → 4.3.5 (minor)
530
+
531
+ ## [3.0.0] - 2025-12-28
532
+
533
+ ### 🎉 Complete TypeScript Rewrite
534
+
535
+ This release is a **complete ground-up rewrite in TypeScript**, delivering a pure JavaScript stack with zero native dependencies. The Python codebase is deprecated and archived in `archive/python-v2`.
536
+
537
+ ### Added - Backup & Restore Tools
538
+
539
+ - **New Tool Group: `backup`** - Never lose your journal data again
540
+ - `backup_journal` - Create timestamped database backups with custom naming
541
+ - `list_backups` - List all available backup files with metadata
542
+ - `restore_backup` - Restore from any backup (auto-creates safety backup before restore)
543
+
544
+ ### Added - Server Health Resource
545
+
546
+ - **New Resource: `memory://health`** - Comprehensive server diagnostics
547
+ - Database stats: path, size, entry count, relationship count, tag count
548
+ - Backup info: directory, count, last backup details
549
+ - Vector index: availability, indexed entries, model name
550
+ - Tool filter: active status, enabled/total counts
551
+
552
+ ### Added - Tool Annotations (MCP 2025-11-25)
553
+
554
+ - All **29 tools** now include behavioral hints for AI safety:
555
+ - `readOnlyHint` - Indicates read-only operations
556
+ - `destructiveHint` - Warns of data modification
557
+ - `idempotentHint` - Safe to retry
558
+ - `openWorldHint` - External service calls (GitHub)
559
+
560
+ ### Added - Dynamic Structured Logging
561
+
562
+ - **RFC 5424 severity levels** - emergency, alert, critical, error, warning, notice, info, debug
563
+ - **Module-prefixed codes** - Operation-specific like `DB_CONNECT`, `VECTOR_SEARCH`
564
+ - **Centralized logger** - All output to stderr (stdout reserved for MCP protocol)
565
+ - **Debug mode** - Enable with `DEBUG=true` environment variable
566
+
567
+ ### Changed - Technology Stack
568
+
569
+ - **Language**: Python → TypeScript (Node.js 18+)
570
+ - **Database**: Python sqlite3 → sql.js (pure JavaScript)
571
+ - **Vector Search**: FAISS + sentence-transformers → vectra + @xenova/transformers
572
+ - **Distribution**: PyPI → npm
573
+ - **Installation**: `pip install memory-journal-mcp` → `npm install -g memory-journal-mcp`
574
+
575
+ ### Changed - CI/CD Modernization
576
+
577
+ - **Native ARM64 Builds** - No more slow QEMU emulation
578
+ - **NPM Publishing** - Replaces PyPI distribution
579
+ - **CodeQL Analysis** - JavaScript/TypeScript static security analysis
580
+ - **Docker Scout** - Container vulnerability scanning with blocking gates
581
+ - **Dependabot Auto-Merge** - Automatic patch/minor updates
582
+
583
+ ### Capabilities Summary
584
+
585
+ | Category | Count | Notes |
586
+ | --------------- | ----- | ---------------------------------------------------------------------- |
587
+ | **Tools** | 29 | +2 Kanban tools (get_kanban_board, move_kanban_item) |
588
+ | **Tool Groups** | 8 | core, search, analytics, relationships, export, admin, github, backup |
589
+ | **Prompts** | 14 | Unchanged from v2.x |
590
+ | **Resources** | 16 | +2 Kanban resources (memory://kanban/{n}, memory://kanban/{n}/diagram) |
591
+
592
+ ### Migration from v2.x
593
+
594
+ **Breaking change:** Installation now via npm:
595
+
596
+ ```bash
597
+ # Old (Python)
598
+ pip install memory-journal-mcp
599
+
600
+ # New (TypeScript)
601
+ npm install -g memory-journal-mcp
602
+ ```
603
+
604
+ **Database compatibility:** ✅ Existing databases work without migration!
605
+
606
+ ### Security
607
+
608
+ - **Input validation** - Zod schemas for all tool parameters
609
+ - **Path traversal protection** - Backup filename validation
610
+ - **SQL injection prevention** - Parameterized queries throughout
611
+ - **Content size limits** - Configurable per field
612
+
613
+ ## [2.2.0] - 2025-12-08
614
+
615
+ ### Added - Tool Filtering for Token Efficiency
616
+
617
+ - **Tool Filtering** - Selectively enable/disable tools via `MEMORY_JOURNAL_MCP_TOOL_FILTER` environment variable
618
+ - **Up to 69% token reduction** - Disable unused tools to save context window space
619
+ - **7 tool groups**: `core` (5), `search` (2), `analytics` (2), `relationships` (2), `export` (1), `admin` (2), `test` (2)
620
+ - **Filter syntax**: `-group` to disable group, `-tool` to disable specific tool, `+tool` to re-enable
621
+ - **Left-to-right processing**: Rules applied in order for precise control
622
+ - **Useful for MCP clients with tool limits** (e.g., Windsurf's 100-tool limit)
623
+ - **Default behavior**: All 16 tools enabled (backward compatible)
624
+ - **Token savings by configuration**:
625
+ - Production (`-test`): ~12% reduction (14 tools)
626
+ - Read-only (`-admin`): ~15% reduction (14 tools)
627
+ - Lightweight (core only): **~69% reduction** (5 tools)
628
+ - **New module**: `src/tool_filtering.py` with complete filtering logic
629
+ - **Comprehensive tests**: `tests/test_tool_filtering.py` with 100% coverage
630
+ - **Documentation**: New wiki page [Tool-Filtering](Tool-Filtering) with detailed examples
631
+
632
+ ### Improved - Dark Mode Visualization
633
+
634
+ - **Actions Visual Graph** (`memory://graph/actions`) - Improved color scheme for dark mode readability
635
+ - Medium-saturated fill colors with better contrast
636
+ - Black text on colored backgrounds for legibility
637
+ - Darker stroke/border colors for node definition
638
+ - Compact class-based Mermaid styling for smaller output
639
+ - Streamlined footer (single line vs multi-line legend)
640
+
641
+ ### Changed
642
+
643
+ - **Server integration** - `handle_list_tools()` and `handle_call_tool()` now respect filtering configuration
644
+ - **Error handling** - Disabled tools return clear error message when called
645
+ - **Constants** - Actions graph colors moved to `src/constants.py` for easy customization
646
+
647
+ ### Documentation
648
+
649
+ - Updated [README.md](https://github.com/neverinfamous/memory-journal-mcp#tool-filtering-optional) with tool filtering section and token savings
650
+ - Updated [DOCKER_README.md](https://github.com/neverinfamous/memory-journal-mcp/blob/main/DOCKER_README.md#tool-filtering) with Docker-specific examples
651
+ - Updated `mcp-config-example.json` with environment variable example
652
+ - New wiki page: [Tool-Filtering.md](Tool-Filtering) with comprehensive guide
653
+
654
+ ### Technical Details
655
+
656
+ - **Environment variable**: `MEMORY_JOURNAL_MCP_TOOL_FILTER` - comma-separated filter rules
657
+ - **Caching**: Uses `@lru_cache(maxsize=1)` for performance
658
+ - **Logging**: Info/warning messages logged to stderr for debugging
659
+ - **Type safety**: Maintains Pyright strict compliance
660
+
661
+ ## [2.1.0] - 2025-11-26
662
+
663
+ ### Added - Actions Visual Graph Resource
664
+
665
+ - **New Resource: `memory://graph/actions`** - CI/CD narrative visualization
666
+ - Generates Mermaid diagrams showing workflow runs, failures, investigation entries, and deployments
667
+ - **Narrative flow**: `Commit → Workflow Run → Failure → Investigation Entry → Fix Commit → Success → Deployment`
668
+ - **Node types**: Commits (hexagon), PRs (stadium), Workflow runs (rectangle), Failed jobs (parallelogram), Journal entries, Deployments
669
+ - **Query parameters**: `?branch=X&workflow=Y&limit=15` for filtering
670
+ - Identifies "fix patterns" - when failed workflows are followed by successful ones
671
+ - Links journal entries to workflow run investigations
672
+ - Color-coded styling: green (success), red (failure), yellow (pending), blue (entries)
673
+
674
+ ### Fixed - Pyright Strict Type Compliance
675
+
676
+ - **700+ type issues fixed** - Complete Pyright strict mode compliance achieved
677
+ - **All exclusions removed** from `pyrightconfig.json`:
678
+ - Removed `reportMissingTypeStubs` exclusion
679
+ - Removed `reportUnknownVariableType` exclusion
680
+ - Removed `reportUnknownMemberType` exclusion
681
+ - Removed `reportUnknownArgumentType` exclusion
682
+ - Removed `reportUnknownParameterType` exclusion
683
+ - Removed `reportUnknownLambdaType` exclusion
684
+ - **Type safety badge now accurate** - `[![Type Safety](https://img.shields.io/badge/Pyright-Strict-blue.svg)]` reflects true strict compliance
685
+ - All `Any` types replaced with proper TypedDicts and explicit annotations
686
+ - Improved code maintainability and IDE support through complete type coverage
687
+
688
+ ### Added - GitHub Actions Failure Summarizer Prompt
689
+
690
+ - **New Prompt: `actions-failure-digest`** - Comprehensive GitHub Actions failure analysis
691
+ - Generates digest of recent CI/CD failures with root cause analysis
692
+ - **Failing Jobs Summary** - Lists failed workflows, jobs, and specific failed steps
693
+ - **Linked Journal Entries** - Finds entries connected to affected commits/PRs
694
+ - **Recent Code/PR Changes** - Context from current branch and associated PRs
695
+ - **Previous Similar Failures** - Semantic search for recurring patterns
696
+ - **Possible Root Causes** - AI-assisted analysis of failure patterns
697
+ - **Next Steps** - Actionable recommendations for resolution
698
+ - Optional filters: `branch`, `workflow_name`, `pr_number`, `days_back`, `limit`
699
+ - Leverages existing semantic search, clustering, and relationship enumeration
700
+ - **New API Helper Function**: `get_workflow_run_jobs()` - Fetch job-level details for workflow runs
701
+ - **New API Helper Function**: `get_failed_workflow_runs()` - Convenience function for fetching recent failures
702
+
703
+ ### Added - GitHub Actions Resources
704
+
705
+ - **4 New MCP Resources for CI/CD Visibility** - Expose GitHub Actions as first-class resources
706
+ - `memory://actions/recent` - Recent workflow runs with filtering (JSON)
707
+ - Query params: `?branch=X&workflow=Y&commit=SHA&pr=N&limit=10`
708
+ - Returns: CI status, run list, related journal entries
709
+ - `memory://actions/workflows/{workflow_name}/timeline` - Workflow-specific timeline (Markdown)
710
+ - Blends: workflow runs, journal entries, PR events
711
+ - `memory://actions/branches/{branch}/timeline` - Branch CI timeline (Markdown)
712
+ - Blends: workflow runs, journal entries, PR lifecycle events
713
+ - `memory://actions/commits/{sha}/timeline` - Commit-specific timeline (Markdown)
714
+ - Blends: workflow runs for commit, related journal entries
715
+ - **New API Helper Functions** (in `src/github/api.py`):
716
+ - `get_workflow_runs_by_name()` - Filter runs by workflow name (case-insensitive)
717
+ - `get_unique_workflow_names()` - Extract unique workflow names from recent runs
718
+ - **Enhanced Resource URI Parsing** - Support for query parameters and new action patterns
719
+
720
+ ### Added - GitHub Actions Integration (Phase 1)
721
+
722
+ - **GitHub Actions Workflow Runs Support** - Foundation layer for CI/CD integration
723
+ - Link journal entries to workflow runs via `workflow_run_id`, `workflow_name`, `workflow_status` parameters
724
+ - Automatic CI status detection in context bundle (`passing`, `failing`, `pending`, `unknown`)
725
+ - Search and filter entries by workflow run ID
726
+ - Database migration adds `workflow_run_id`, `workflow_name`, `workflow_status` columns with index
727
+ - **Enhanced Context Capture** - Project context now includes:
728
+ - Up to 5 recent workflow runs for current branch
729
+ - Overall CI status computed from latest workflow runs
730
+ - Automatic caching (5 min TTL) for workflow run data
731
+ - **New API Functions** (in `src/github/api.py`):
732
+ - `get_repo_workflow_runs()` - Fetch workflow runs with caching, branch/status filters
733
+ - `get_workflow_run_details()` - Get detailed workflow run information
734
+ - `get_workflow_runs_for_commit()` - Find runs for a specific commit SHA
735
+ - `get_workflow_runs_for_pr()` - Find runs associated with a PR
736
+ - `compute_ci_status()` - Compute overall CI status from workflow runs
737
+ - All functions include `gh` CLI fallbacks
738
+ - **Enhanced Search Capabilities**
739
+ - `search_entries` tool: New filter for `workflow_run_id`
740
+ - `search_by_date_range` tool: New filter for `workflow_run_id`
741
+ - Find all journal entries related to specific workflow runs
742
+ - **Enhanced Entry Display**
743
+ - `get_entry_by_id` now shows linked workflow runs with name and status
744
+ - Entry creation confirms workflow linkage (e.g., "Linked to: Workflow Run #12345 (CI Tests) [completed]")
745
+ - **New TypedDict Model**: `GitHubWorkflowRunDict` for type-safe workflow run data
746
+
747
+ ### Added - GitHub Issues & Pull Requests Integration
748
+
749
+ - **GitHub Issues Support** - Complete integration with GitHub Issues
750
+ - Auto-link entries to issues via branch name detection (patterns: `issue-123`, `#123`, `feature/issue-456`)
751
+ - Manual issue linking via `issue_number` and `issue_url` parameters
752
+ - Issue context automatically captured from GitHub API (open issues for current repo)
753
+ - Search and filter entries by issue number
754
+ - Database migration adds `issue_number` and `issue_url` columns
755
+ - **GitHub Pull Requests Support** - Full PR integration with auto-detection
756
+ - Auto-detect current PR from branch (finds matching head branch)
757
+ - Manual PR linking via `pr_number`, `pr_url`, and `pr_status` parameters
758
+ - PR status tracking (draft, open, merged, closed)
759
+ - PR context automatically captured including linked issues, reviewers, and stats
760
+ - Search and filter entries by PR number and status
761
+ - Database migration adds `pr_number`, `pr_url`, `pr_status` columns
762
+ - **Enhanced Context Capture** - Project context now includes:
763
+ - Up to 10 recent open issues from current repository
764
+ - Up to 5 recent open PRs from current repository
765
+ - Current PR detection based on active branch
766
+ - Automatic caching (15 min TTL) to minimize API calls
767
+ - **Enhanced Search Capabilities**
768
+ - `search_entries` tool: New filters for `issue_number`, `pr_number`, `pr_status`
769
+ - `search_by_date_range` tool: New filters for `issue_number`, `pr_number`
770
+ - Find all journal entries related to specific issues or PRs
771
+ - **Enhanced Entry Display**
772
+ - `get_entry_by_id` now shows linked issues and PRs with URLs
773
+ - Entry creation confirms GitHub linkage (e.g., "Linked to: Issue #123, PR #456 (open)")
774
+
775
+ ### Fixed
776
+
777
+ - **Missing GitHub Issues Implementation** - Fixed incomplete `github_issues` field in models
778
+ - Was referenced in `ContextData` but never populated
779
+ - Now fully implemented with API functions, caching, and context integration
780
+
781
+ ### Technical Details
782
+
783
+ - **New API Functions** (in `src/github/api.py`):
784
+ - `get_repo_issues()` - Fetch repository issues with caching
785
+ - `get_issue_details()` - Get detailed issue information
786
+ - `get_repo_pull_requests()` - Fetch repository PRs with caching
787
+ - `get_pr_details()` - Get detailed PR information including stats
788
+ - `get_pr_from_branch()` - Find PR by head branch name
789
+ - `_parse_linked_issues()` - Extract issue references from PR bodies
790
+ - All functions include `gh` CLI fallbacks for environments without `requests` library
791
+ - **Database Schema Changes**:
792
+ - Added `issue_number`, `issue_url` columns to `memory_journal` table
793
+ - Added `pr_number`, `pr_url`, `pr_status` columns to `memory_journal` table
794
+ - Created indexes for efficient filtering: `idx_memory_journal_issue_number`, `idx_memory_journal_pr_number`
795
+ - Automatic migrations run on server startup
796
+ - **New Models** (in `src/models.py`):
797
+ - `GitHubIssueDict` - Type definition for issue data
798
+ - `GitHubPullRequestDict` - Type definition for PR data with review stats
799
+ - Updated `EntryDict` with issue and PR fields
800
+ - Updated `ContextData` with `github_issues`, `current_pr`, `github_pull_requests` fields
801
+ - **Branch Name Patterns** - Auto-detection supports:
802
+ - `issue-123`, `issue/123`, `fix/issue-456`
803
+ - `#123` (shorthand)
804
+ - `/123-` or `/123/` patterns
805
+ - **Backward Compatibility** - All new fields are optional; existing databases migrate seamlessly
806
+
807
+ ## [2.0.1] - 2025-10-28
808
+
809
+ ### Fixed - Windows Platform Support
810
+
811
+ - **Git subprocess hang fix** - All Git operations now work reliably on Windows
812
+ - Migrated all `subprocess.run()` calls to `Popen()` with `stdin=subprocess.DEVNULL`
813
+ - Prevents stdin inheritance from MCP server's stdio channel
814
+ - Eliminates deadlocks/hangs when running Git commands
815
+ - Affected files: `database/context.py`, `github/integration.py`
816
+ - **Working directory detection** - Server now reliably detects Git context
817
+ - Added `os.chdir(project_root)` on server startup
818
+ - Server automatically changes to project root directory
819
+ - Resolves "Not a Git repository" errors
820
+ - Recommendation: Add `"cwd"` parameter to MCP configuration
821
+
822
+ ### Changed - GitHub Projects v2 Migration
823
+
824
+ - **GraphQL API migration** - Migrated from deprecated REST API to GraphQL
825
+ - Old REST API endpoints return HTTP 410 Gone (deprecated)
826
+ - New GraphQL API (`projectsV2` query) for Projects v2
827
+ - **New module**: `github/graphql.py` with GraphQL query definitions
828
+ - **Token requirement**: `read:project` or `project` scope now required
829
+ - Supports both user and organization projects
830
+ - Returns same data structure for backward compatibility
831
+ - **Enhanced debugging** - Added comprehensive debug logging throughout Git and GitHub operations
832
+ - Tracks subprocess execution times
833
+ - Logs API call results
834
+ - Helps diagnose configuration issues
835
+
836
+ ### Documentation
837
+
838
+ - Updated Configuration.md with Windows-specific troubleshooting
839
+ - Updated GitHub-Projects-Integration.md with GraphQL migration notes
840
+ - Updated Architecture.md with v2.0.1 technical improvements
841
+ - Added token scope requirements and MCP configuration examples
842
+
843
+ ## [2.0.0] - 2025-10-28
844
+
845
+ ### Added - Git-Based Team Collaboration
846
+
847
+ - **Team Collaboration Feature** - Share journal entries with your team via Git while maintaining privacy
848
+ - **Two-database architecture**: Personal DB (local) + Team DB (Git-tracked)
849
+ - **Explicit opt-in sharing**: `share_with_team` parameter on entry creation
850
+ - **Privacy-first design**: All entries private by default, sharing requires explicit consent
851
+ - **New database file**: `.memory-journal-team.db` (Git-tracked for team synchronization)
852
+ - **New database column**: `share_with_team` (integer, default 0) in `memory_journal` table
853
+ - **Automatic schema migration**: Existing databases updated automatically
854
+ - **New Module**: `src/database/team_db.py` - TeamDatabaseManager class
855
+ - Copy entries to team database
856
+ - Query team entries with filters (tags, date range, entry type)
857
+ - Git status checking for synchronization
858
+ - Entry count and statistics
859
+ - **Enhanced Search**: All search operations automatically query both personal and team databases
860
+ - `search_entries` - Returns combined results with team indicator (👥)
861
+ - `search_by_date_range` - Includes team entries in date-based queries
862
+ - Results show source (personal vs team) for clarity
863
+ - **New Resource**: `memory://team/recent` - Access recent team-shared entries
864
+ - Returns JSON with team entry count and formatted entries
865
+ - Marked with `source: team_shared` for identification
866
+ - **Enhanced Tool**: `create_entry` gains `share_with_team` parameter
867
+ - Set to `true` to copy entry to team database
868
+ - Confirmation message shows sharing status
869
+ - Preserves all entry data (tags, significance, relationships, GitHub Projects)
870
+
871
+ ### Changed - Major Refactoring
872
+
873
+ - **Complete Internal Architecture Refactoring** - Transformed from monolithic codebase to modular architecture
874
+ - **96% reduction** in main file size (4,093 lines → 175 lines)
875
+ - **30 focused modules** organized into logical layers (~150-300 lines each)
876
+ - **Clear separation of concerns** - Database, GitHub, MCP handlers isolated
877
+ - **Module structure**:
878
+ - `server.py` (175 lines) - Entry point & MCP protocol dispatchers
879
+ - `database/` (4 modules) - MemoryJournalDB, operations, context management, team_db
880
+ - `github/` (3 modules) - Integration, caching, API operations
881
+ - `handlers/` (20 modules) - MCP tools, prompts, resources
882
+ - Core utilities - constants, exceptions, utils, vector_search
883
+ - **Design patterns implemented**:
884
+ - Dispatcher pattern for MCP protocol routing
885
+ - Dependency injection for component initialization
886
+ - Module-level state for handler dependencies
887
+ - **Benefits**:
888
+ - 10x improvement in code maintainability
889
+ - Independent, testable components
890
+ - Self-documenting structure
891
+ - Easier debugging and optimization
892
+ - Foundation for rapid feature development
893
+
894
+ ### Added
895
+
896
+ - **Custom exception classes** - Centralized error handling with specific exception types
897
+ - **Constants module** - All configuration and magic values extracted (including team DB path)
898
+ - **Utilities module** - Common functions deduplicated (FTS5 escaping, Mermaid sanitization, etc.)
899
+ - **Enhanced documentation** - REFACTORING_SUMMARY.md with complete architecture analysis
900
+ - **Team Collaboration Wiki Page** - Comprehensive guide to Git-based entry sharing
901
+
902
+ ### Performance
903
+
904
+ - ✅ **No degradation** - All async operations preserved
905
+ - ✅ **Same startup time** - 2-3 seconds maintained
906
+ - ✅ **Same operation speed** - No overhead from modularization
907
+
908
+ ### Compatibility
909
+
910
+ - ✅ **100% backward compatible** - Zero breaking changes
911
+ - ✅ **API unchanged** - All 16 tools, 10 prompts, 4 resources work identically
912
+ - ✅ **Database schema** - No changes required
913
+ - ✅ **Environment variables** - Same configuration
914
+ - ✅ **Seamless upgrade** - Simply update and restart
915
+
916
+ ### Documentation
917
+
918
+ - Updated Architecture Wiki with complete v2.0.0 module documentation
919
+ - Updated Performance Wiki with refactoring analysis
920
+ - Added REFACTORING_SUMMARY.md with detailed technical breakdown
921
+ - Updated all README files with v2.0.0 highlights
922
+
923
+ ## [1.2.2] - 2025-10-26
924
+
925
+ ### Security
926
+
927
+ - **URL Parsing Vulnerability Fix (CodeQL #110, #111)** - Fixed incomplete URL substring sanitization in GitHub remote URL parsing
928
+ - **Impact**: Prevented potential URL spoofing attacks where malicious URLs could bypass GitHub hostname checks
929
+ - **Root Cause**: Used substring checks (`'github.com' in url`) instead of proper URL parsing
930
+ - **Fix**: Implemented proper `urllib.parse.urlparse()` validation with exact hostname matching
931
+ - **Details**:
932
+ - SSH URLs: Explicit prefix validation with `startswith('git@github.com:')`
933
+ - HTTPS/HTTP URLs: Parse with `urlparse()` and verify `hostname == 'github.com'`
934
+ - Prevents bypasses like `http://evil.com/github.com/fake` or `http://github.com.evil.com/fake`
935
+ - **Severity**: Medium (limited to Git remote URL parsing in local repository context)
936
+ - **Reference**: [CWE-20: Improper Input Validation](https://cwe.mitre.org/data/definitions/20.html)
937
+
938
+ ## [1.2.1] - 2025-10-26
939
+
940
+ ### Fixed
941
+
942
+ - **Semantic search initialization** - Resolved async/lazy loading race condition that could cause semantic_search to hang on first use
943
+ - Moved ML dependency imports to module-level initialization
944
+ - Eliminated async lock deadlock during model loading
945
+ - First semantic search call now completes in <1 second (previously could timeout)
946
+ - **Thread pool optimization** - Increased worker count from 2 to 4 to prevent contention during ML model loading
947
+
948
+ ### Changed
949
+
950
+ - Improved initialization progress messages with step-by-step feedback (Step X/3)
951
+ - Added explicit stderr flushing for real-time progress updates
952
+
953
+ ## [1.2.0] - 2025-10-26
954
+
955
+ ### Added - Phase 3: Organization Support
956
+
957
+ - **Organization-Level GitHub Projects** - Full support for org-level projects alongside user projects
958
+ - Automatic owner detection (user vs organization)
959
+ - Dual project lookup showing both user and org projects
960
+ - Separate `GITHUB_ORG_TOKEN` support for org-specific permissions
961
+ - All Phase 2 analytics work with org projects
962
+ - **Enhanced Phase 2 Features for Organizations**
963
+ - Cross-project insights spanning user and org projects
964
+ - Status summaries for org project teams
965
+ - Milestone tracking with org-level milestones
966
+ - Smart caching (80%+ API reduction, 24hr owner type cache)
967
+
968
+ ### Added - Phase 2: Advanced Project Analytics
969
+
970
+ - **New Tool:** `get_cross_project_insights` - Multi-project analysis and pattern detection
971
+ - **New Prompts:**
972
+ - `project-status-summary` - Comprehensive GitHub Project status reports
973
+ - `project-milestone-tracker` - Milestone progress with velocity tracking
974
+ - **New Resource:** `memory://projects/{number}/timeline` - Live activity feed combining journal + GitHub events
975
+ - **Enhanced:** `get_statistics` with `project_breakdown` parameter for per-project metrics
976
+ - **Smart Caching System** - GitHub API response caching with configurable TTLs (1hr projects, 15min items)
977
+
978
+ ### Added - Phase 1: GitHub Projects Integration
979
+
980
+ - **GitHub Projects Support** - Connect journal entries with GitHub Projects (user & org)
981
+ - Entry creation with `project_number`, `project_item_id`, `github_project_url` parameters
982
+ - Automatic project detection from repository context
983
+ - Search and filter entries by project
984
+ - Project context in context bundles
985
+ - **New Database Columns:** `project_number`, `project_item_id`, `github_project_url`
986
+ - **Graceful Degradation:** Works without GitHub token (project features disabled)
987
+
988
+ ### Fixed
989
+
990
+ - **FTS5 Search Query Escaping** - Special characters (hyphens, dots, colons) in search queries now handled correctly
991
+ - Organization names like "my-company" now searchable
992
+ - Version numbers like "v1.2.0" work properly
993
+ - Implemented `escape_fts5_query()` function with quote wrapping
994
+
995
+ ## [1.1.3] - 2025-10-04
996
+
997
+ ### Fixed
998
+
999
+ - **Migration Logic** - Fixed schema migration check to properly handle fresh database installations
1000
+
1001
+ ## [1.1.2] - 2025-10-04
1002
+
1003
+ ### Security
1004
+
1005
+ - **CVE-2025-8869** - Mitigated pip symbolic link vulnerability by upgrading to pip >=25.0
1006
+
1007
+ ## [1.1.1] - 2025-10-04
1008
+
1009
+ ### Fixed
1010
+
1011
+ - **F-String Syntax** - Fixed Python syntax error preventing builds on clean environments
1012
+
1013
+ ## [1.1.0] - 2025-10-04
1014
+
1015
+ ### Added
1016
+
1017
+ - **Entry Relationships** - Link entries with typed relationships (references, implements, clarifies, evolves_from, response_to)
1018
+ - **New Tool:** `link_entries` - Create relationships between entries
1019
+ - **New Tool:** `visualize_relationships` - Generate Mermaid diagrams of entry connections
1020
+ - **New Resource:** `memory://graph/recent` - Live relationship graph visualization
1021
+ - **New Prompts:** `find-related`, `get-context-bundle`
1022
+ - **Soft Delete** - Entries can be soft-deleted and recovered
1023
+ - **Database Schema Enhancements** - `relationships` table, `deleted_at` column
1024
+
1025
+ ### Fixed
1026
+
1027
+ - **Database Locking** - Eliminated race conditions in concurrent tag updates
1028
+ - **Thread Safety** - Single-connection transactions prevent conflicts
1029
+
1030
+ ### Changed
1031
+
1032
+ - **Performance:** 10x faster startup (14s → 2-3s) through lazy loading of ML dependencies
1033
+ - **Optimized Database:** Removed expensive PRAGMA operations from startup
1034
+
1035
+ ### Documentation
1036
+
1037
+ - Created comprehensive GitHub Wiki (17 pages)
1038
+ - Enhanced README with feature overview
1039
+ - Added Docker Hub README
1040
+
1041
+ ## [1.0.2] - 2025-09-15
1042
+
1043
+ ### Initial Beta Release
1044
+
1045
+ - 13 MCP tools for journal management
1046
+ - Triple search system (FTS5, date range, semantic)
1047
+ - 6 workflow prompts
1048
+ - 2 MCP resources
1049
+ - Git and GitHub CLI integration
1050
+ - SQLite FTS5 full-text search
1051
+ - Optional FAISS semantic search
1052
+
1053
+ [Unreleased]: https://github.com/neverinfamous/memory-journal-mcp/compare/v4.1.0...HEAD
1054
+ [4.1.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v4.0.0...v4.1.0
1055
+ [4.0.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.1.5...v4.0.0
1056
+ [3.1.5]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.1.4...v3.1.5
1057
+ [3.1.4]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.1.3...v3.1.4
1058
+ [3.1.3]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.1.2...v3.1.3
1059
+ [3.1.2]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.1.1...v3.1.2
1060
+ [3.1.1]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.1.0...v3.1.1
1061
+ [3.1.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v3.0.0...v3.1.0
1062
+ [3.0.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v2.2.0...v3.0.0
1063
+ [2.2.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v2.1.0...v2.2.0
1064
+ [2.1.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v2.0.1...v2.1.0
1065
+ [2.0.1]: https://github.com/neverinfamous/memory-journal-mcp/compare/v2.0.0...v2.0.1
1066
+ [2.0.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.2.2...v2.0.0
1067
+ [1.2.2]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.2.1...v1.2.2
1068
+ [1.2.1]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.2.0...v1.2.1
1069
+ [1.2.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.1.3...v1.2.0
1070
+ [1.1.3]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.1.2...v1.1.3
1071
+ [1.1.2]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.1.1...v1.1.2
1072
+ [1.1.1]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.1.0...v1.1.1
1073
+ [1.1.0]: https://github.com/neverinfamous/memory-journal-mcp/compare/v1.0.2...v1.1.0
1074
+ [1.0.2]: https://github.com/neverinfamous/memory-journal-mcp/releases/tag/v1.0.2