memory-journal-mcp 4.3.1 → 4.4.0

package/src/server/McpServer.ts

@@ -31,14 +31,22 @@ import { getPrompts, getPrompt } from '../handlers/prompts/index.js'
 import { generateInstructions } from '../constants/ServerInstructions.js'
 import pkg from '../../package.json' with { type: 'json' }
 
+/** Session timeout for stateful HTTP mode (30 minutes) */
+const SESSION_TIMEOUT_MS = 30 * 60 * 1000
+
+/** Session timeout sweep interval (5 minutes) */
+const SESSION_SWEEP_INTERVAL_MS = 5 * 60 * 1000
+
 export interface ServerOptions {
     transport: 'stdio' | 'http'
     port?: number
+    host?: string
     dbPath: string
     toolFilter?: string
     defaultProjectNumber?: number
     autoRebuildIndex?: boolean
     statelessHttp?: boolean
+    corsOrigin?: string
 }
 
 /**
@@ -107,14 +115,13 @@ export async function createServer(options: ServerOptions): Promise<void> {
           }
         : undefined
 
+    // Get all tools once (unfiltered) for both instruction generation and registration
+    const allTools = getTools(db, null, vectorManager, github, { defaultProjectNumber })
+    const allToolNames = new Set(allTools.map((t) => (t as { name: string }).name))
+
     // Generate dynamic instructions based on enabled tools, resources, prompts, and latest entry
     const instructions = generateInstructions(
-        filterConfig?.enabledTools ??
-            new Set(
-                getTools(db, null, vectorManager, github, { defaultProjectNumber }).map(
-                    (t) => (t as { name: string }).name
-                )
-            ),
+        filterConfig?.enabledTools ?? allToolNames,
         resources.map((r) => {
             const res = r as { uri: string; name: string; description?: string }
             return { uri: res.uri, name: res.name, description: res.description }
@@ -140,8 +147,10 @@ export async function createServer(options: ServerOptions): Promise<void> {
         }
     )
 
-    // Get filtered tools and register them dynamically
-    const tools = getTools(db, filterConfig, vectorManager, github, { defaultProjectNumber })
+    // Apply filter to get the set of tools to register
+    const tools = filterConfig
+        ? getTools(db, filterConfig, vectorManager, github, { defaultProjectNumber })
+        : allTools
     for (const tool of tools) {
         const toolDef = tool as {
             name: string
@@ -394,12 +403,21 @@ export async function createServer(options: ServerOptions): Promise<void> {
     } else {
         // HTTP transport with SSE support
         const port = options.port ?? 3000
+        const host = options.host ?? 'localhost'
+        const corsOrigin = options.corsOrigin ?? process.env['MCP_CORS_ORIGIN'] ?? '*'
         const app: Express = express()
 
-        // Manual CORS middleware for browser-based clients (e.g., MCP Inspector)
+        // Security headers middleware
+        app.use((_req: Request, res: Response, next: () => void) => {
+            res.setHeader('X-Content-Type-Options', 'nosniff')
+            res.setHeader('X-Frame-Options', 'DENY')
+            next()
+        })
+
+        // CORS middleware for browser-based clients (e.g., MCP Inspector)
+        // Origin is configurable via --cors-origin flag or MCP_CORS_ORIGIN env var
         app.use((req: Request, res: Response, next: () => void) => {
-            // Set CORS headers on all responses
-            res.setHeader('Access-Control-Allow-Origin', '*')
+            res.setHeader('Access-Control-Allow-Origin', corsOrigin)
             res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS')
             res.setHeader(
                 'Access-Control-Allow-Headers',
@@ -416,22 +434,14 @@ export async function createServer(options: ServerOptions): Promise<void> {
             next()
         })
 
-        // JSON body parser for MCP requests
-        app.use(express.json())
+        // JSON body parser with size limit to prevent memory exhaustion (DoS)
+        app.use(express.json({ limit: '1mb' }))
 
         // Explicit OPTIONS handler for /mcp - MUST be before other /mcp routes
         // Using app.all to intercept before Express 5's auto-OPTIONS
         app.all('/mcp', (req: Request, res: Response, next: () => void) => {
-            // Set CORS headers on ALL responses
-            res.setHeader('Access-Control-Allow-Origin', '*')
-            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS')
-            res.setHeader(
-                'Access-Control-Allow-Headers',
-                'Content-Type, Accept, mcp-session-id, Last-Event-ID, mcp-protocol-version'
-            )
-            res.setHeader('Access-Control-Expose-Headers', 'mcp-session-id')
-
-            // For OPTIONS, respond immediately with CORS headers
+            // CORS headers are already set by the middleware above.
+            // For OPTIONS, respond immediately.
             if (req.method === 'OPTIONS') {
                 res.status(204).end()
                 return
@@ -479,11 +489,12 @@ export async function createServer(options: ServerOptions): Promise<void> {
             })
 
             // Start HTTP server
-            const httpServer = app.listen(port, () => {
+            const httpServer = app.listen(port, host, () => {
                 logger.info('MCP server started on HTTP (stateless)', {
                     module: 'McpServer',
                     port,
-                    endpoint: `http://localhost:${port}/mcp`,
+                    host,
+                    endpoint: `http://${host}:${port}/mcp`,
                 })
             })
 
@@ -521,8 +532,37 @@ export async function createServer(options: ServerOptions): Promise<void> {
             // === STATEFUL MODE ===
             // Session-based transport with SSE support for notifications
 
-            // Session transport storage
+            // Session transport storage with last-activity timestamps
             const transports = new Map<string, StreamableHTTPServerTransport>()
+            const sessionLastActivity = new Map<string, number>()
+
+            /** Update the last-activity timestamp for a session */
+            const touchSession = (sid: string): void => {
+                sessionLastActivity.set(sid, Date.now())
+            }
+
+            /** Sweep expired sessions (called periodically) */
+            const sweepExpiredSessions = (): void => {
+                const now = Date.now()
+                for (const [sid, lastActivity] of sessionLastActivity) {
+                    if (now - lastActivity > SESSION_TIMEOUT_MS && transports.has(sid)) {
+                        logger.info('Expiring idle HTTP session', {
+                            module: 'McpServer',
+                            sessionId: sid,
+                            idleMinutes: Math.round((now - lastActivity) / 60_000),
+                        })
+                        const t = transports.get(sid)
+                        if (t) {
+                            void t.close()
+                        }
+                        transports.delete(sid)
+                        sessionLastActivity.delete(sid)
+                    }
+                }
+            }
+
+            // Start session timeout sweep (runs every 5 minutes)
+            const sessionSweepTimer = setInterval(sweepExpiredSessions, SESSION_SWEEP_INTERVAL_MS)
 
             // POST /mcp - Handle JSON-RPC requests
             app.post('/mcp', (req: Request, res: Response): void => {
@@ -533,7 +573,8 @@ export async function createServer(options: ServerOptions): Promise<void> {
                         let httpTransport: StreamableHTTPServerTransport | undefined
 
                         if (sessionId && transports.has(sessionId)) {
-                            // Reuse existing transport
+                            // Reuse existing transport and refresh session activity
+                            touchSession(sessionId)
                             httpTransport = transports.get(sessionId)
                         } else if (sessionId === undefined && isInitializeRequest(req.body)) {
                             // New initialization request - create transport
@@ -545,6 +586,7 @@ export async function createServer(options: ServerOptions): Promise<void> {
                                         sessionId: sid,
                                     })
                                     transports.set(sid, newTransport)
+                                    touchSession(sid)
                                 },
                             })
 
@@ -557,6 +599,7 @@ export async function createServer(options: ServerOptions): Promise<void> {
                                         sessionId: sid,
                                     })
                                     transports.delete(sid)
+                                    sessionLastActivity.delete(sid)
                                 }
                             }
 
@@ -614,6 +657,9 @@ export async function createServer(options: ServerOptions): Promise<void> {
                     return
                 }
 
+                // Refresh session activity on SSE reconnect
+                touchSession(sessionId)
+
                 const lastEventId = req.headers['last-event-id']
                 if (lastEventId !== undefined) {
                     logger.debug('Client reconnecting with Last-Event-ID', {
@@ -656,11 +702,12 @@ export async function createServer(options: ServerOptions): Promise<void> {
             })
 
             // Start HTTP server
-            const httpServer = app.listen(port, () => {
+            const httpServer = app.listen(port, host, () => {
                 logger.info('MCP server started on HTTP (stateful)', {
                     module: 'McpServer',
                     port,
-                    endpoint: `http://localhost:${port}/mcp`,
+                    host,
+                    endpoint: `http://${host}:${port}/mcp`,
                 })
             })
 
@@ -689,6 +736,8 @@ export async function createServer(options: ServerOptions): Promise<void> {
                         }
                     }
                     transports.clear()
+                    sessionLastActivity.clear()
+                    clearInterval(sessionSweepTimer)
 
                     httpServer.close()
                     db.close()
@@ -697,14 +746,7 @@ export async function createServer(options: ServerOptions): Promise<void> {
                 })()
             })
 
-            // Keep process alive with a heartbeat timer
-            // setInterval keeps the event loop active and prevents exit
-            setInterval(
-                () => {
-                    // Heartbeat - keeps event loop active
-                },
-                1000 * 60 * 60
-            ) // 1 hour interval (just needs to exist)
+            // sessionSweepTimer keeps the event loop active (no additional heartbeat needed)
         }
     }
 }

package/src/types/index.ts

@@ -266,6 +266,17 @@ export interface JournalEntry {
     autoContext: string | null
     deletedAt: string | null
     tags: string[]
+    // GitHub integration fields
+    projectNumber?: number | null
+    projectOwner?: string | null
+    issueNumber?: number | null
+    issueUrl?: string | null
+    prNumber?: number | null
+    prUrl?: string | null
+    prStatus?: string | null
+    workflowRunId?: number | null
+    workflowName?: string | null
+    workflowStatus?: string | null
 }
 
 /**
@@ -298,6 +309,30 @@ export interface Embedding {
     modelName: string
 }
 
+/**
+ * Importance scoring breakdown showing weighted component contributions
+ */
+export interface ImportanceBreakdown {
+    /** Significance type contribution (weight: 0.30) */
+    significance: number
+    /** Relationship count contribution (weight: 0.35) */
+    relationships: number
+    /** Causal relationship contribution (weight: 0.20) */
+    causal: number
+    /** Recency decay contribution (weight: 0.15) */
+    recency: number
+}
+
+/**
+ * Importance calculation result with total score and component breakdown
+ */
+export interface ImportanceResult {
+    /** Total importance score (0.0-1.0) */
+    score: number
+    /** Weighted component contributions */
+    breakdown: ImportanceBreakdown
+}
+
 // ============================================================================
 // GitHub Integration Types
 // ============================================================================
@@ -320,6 +355,7 @@ export interface GitHubIssue {
     title: string
     url: string
     state: 'OPEN' | 'CLOSED'
+    milestone?: { number: number; title: string } | null
 }
 
 /**
@@ -332,6 +368,23 @@ export interface GitHubPullRequest {
     state: 'OPEN' | 'CLOSED' | 'MERGED'
 }
 
+/**
+ * GitHub milestone information
+ */
+export interface GitHubMilestone {
+    number: number
+    title: string
+    description: string | null
+    state: 'open' | 'closed'
+    url: string
+    dueOn: string | null
+    openIssues: number
+    closedIssues: number
+    createdAt: string
+    updatedAt: string
+    creator: string | null
+}
+
 /**
  * GitHub workflow run information
  */
@@ -359,6 +412,51 @@ export interface ProjectContext {
     issues: GitHubIssue[]
     pullRequests: GitHubPullRequest[]
     workflowRuns: GitHubWorkflowRun[]
+    milestones: GitHubMilestone[]
+}
+
+// ============================================================================
+// Repository Insights/Traffic Types
+// ============================================================================
+
+/**
+ * Repository statistics (stars, forks, watchers)
+ */
+export interface RepoStats {
+    stars: number
+    forks: number
+    watchers: number
+    openIssues: number
+    size: number // KB
+    defaultBranch: string
+}
+
+/**
+ * Aggregated traffic data (14-day rolling)
+ */
+export interface TrafficData {
+    clones: { total: number; unique: number; dailyAvg: number }
+    views: { total: number; unique: number; dailyAvg: number }
+    period: string // e.g. "14 days"
+}
+
+/**
+ * Traffic referrer source
+ */
+export interface TrafficReferrer {
+    referrer: string
+    count: number
+    uniques: number
+}
+
+/**
+ * Popular repository path
+ */
+export interface PopularPath {
+    path: string
+    title: string
+    count: number
+    uniques: number
 }
 
 // ============================================================================

package/src/utils/logger.ts

@@ -3,8 +3,11 @@
  *
  * Centralized logging to stderr only (stdout reserved for MCP protocol).
  * Follows RFC 5424 severity levels.
+ * Automatically sanitizes error fields to prevent token leakage.
  */
 
+import { sanitizeErrorForLogging } from './security-utils.js'
+
 type LogLevel = 'debug' | 'info' | 'notice' | 'warning' | 'error' | 'critical'
 
 interface LogContext {
@@ -57,7 +60,13 @@ class Logger {
     private log(level: LogLevel, message: string, context?: LogContext): void {
         if (!this.shouldLog(level)) return
 
-        const formatted = this.formatMessage(level, message, context)
+        // Sanitize error fields to prevent token leakage in logs
+        let sanitizedContext = context
+        if (context?.['error'] != null && typeof context['error'] === 'string') {
+            sanitizedContext = { ...context, error: sanitizeErrorForLogging(context['error']) }
+        }
+
+        const formatted = this.formatMessage(level, message, sanitizedContext)
 
         // Always write to stderr (stdout is reserved for MCP protocol)
         console.error(formatted)

package/src/utils/security-utils.ts

@@ -168,3 +168,38 @@ export function assertNoPathTraversal(filename: string): void {
         throw new PathTraversalError(filename)
     }
 }
+
+// ============================================================================
+// Error Message Sanitization
+// ============================================================================
+
+/**
+ * Patterns that may contain sensitive tokens in error messages.
+ * Used to scrub error output before logging.
+ */
+const TOKEN_PATTERNS = [
+    // GitHub personal access tokens (classic and fine-grained)
+    /ghp_[A-Za-z0-9_]{36,}/g,
+    /github_pat_[A-Za-z0-9_]{82,}/g,
+    // Authorization headers in error dumps
+    /Authorization:\s*(?:token|Bearer)\s+\S+/gi,
+    // Generic Bearer tokens
+    /Bearer\s+[A-Za-z0-9._\-~+/]+=*/gi,
+] as const
+
+/**
+ * Sanitizes an error message by replacing any detected tokens with '[REDACTED]'.
+ * This is a defense-in-depth measure for error logging paths.
+ *
+ * @param message - The error message to sanitize
+ * @returns The sanitized message with tokens replaced
+ */
+export function sanitizeErrorForLogging(message: string): string {
+    let sanitized = message
+    for (const pattern of TOKEN_PATTERNS) {
+        // Reset lastIndex for global regex patterns
+        pattern.lastIndex = 0
+        sanitized = sanitized.replace(pattern, '[REDACTED]')
+    }
+    return sanitized
+}

package/src/vector/VectorSearchManager.ts

@@ -20,6 +20,12 @@ const DEFAULT_MODEL = 'Xenova/all-MiniLM-L6-v2'
 /** Embedding dimensions for all-MiniLM-L6-v2 */
 const EMBEDDING_DIMENSIONS = 384
 
+/** Number of entries to embed concurrently during rebuild */
+const REBUILD_BATCH_SIZE = 5
+
+/** Number of entries to fetch per page during rebuild */
+const REBUILD_PAGE_SIZE = 200
+
 /** Search result with similarity score */
 export interface SemanticSearchResult {
     entryId: number
@@ -225,7 +231,8 @@ export class VectorSearchManager {
     }
 
     /**
-     * Rebuild index from database entries
+     * Rebuild index from database entries.
+     * Uses paginated fetching and parallel batch embedding for performance.
      * @param db - Database adapter
      * @param progress - Optional progress context for notifications
      */
@@ -240,66 +247,130 @@ export class VectorSearchManager {
 
         logger.info('Rebuilding vector index from database...', { module: 'VectorSearch' })
 
-        // Step 1: Get all entries from database
-        const entries = db.getRecentEntries(10000) // Get up to 10k entries
-        const dbIds = new Set(entries.map((e) => String(e.id)))
+        // Step 1: Get total entry count and build ID set for orphan detection
+        const totalEntries = db.getActiveEntryCount()
+        const dbIds = new Set<string>()
+
+        // Collect all active entry IDs via pagination (avoids loading all content at once)
+        for (let offset = 0; offset < totalEntries; offset += REBUILD_PAGE_SIZE) {
+            const page = db.getEntriesPage(offset, REBUILD_PAGE_SIZE)
+            for (const entry of page) {
+                dbIds.add(String(entry.id))
+            }
+        }
+
+        // Step 2: Clean up existing index items
+        // If the index is corrupted (e.g., from a process kill), recreate it
+        try {
+            const indexItems = await this.index.listItems()
+            let orphansRemoved = 0
+            for (const item of indexItems) {
+                if (!dbIds.has(item.id)) {
+                    try {
+                        await this.index.deleteItem(item.id)
+                        orphansRemoved++
+                    } catch {
+                        // Ignore errors during cleanup
+                    }
+                }
+            }
+            if (orphansRemoved > 0) {
+                logger.info(`Cleaned up ${String(orphansRemoved)} orphaned vector entries`, {
+                    module: 'VectorSearch',
+                })
+            }
 
-        // Step 2: Clean up orphaned entries from the index
-        // These are vector entries for database records that were permanently deleted
-        const indexItems = await this.index.listItems()
-        let orphansRemoved = 0
-        for (const item of indexItems) {
-            if (!dbIds.has(item.id)) {
+            // Step 3: Delete all remaining items to prepare for clean re-index
+            // This avoids the double-delete overhead of calling addEntry (upsert) per item
+            const remainingItems = await this.index.listItems()
+            for (const item of remainingItems) {
                 try {
                     await this.index.deleteItem(item.id)
-                    orphansRemoved++
                 } catch {
-                    // Ignore errors during cleanup
+                    // Ignore
                 }
             }
-        }
-        if (orphansRemoved > 0) {
-            logger.info(`Cleaned up ${String(orphansRemoved)} orphaned vector entries`, {
+        } catch (indexError) {
+            // Index files are corrupted — recreate from scratch
+            logger.warning('Vector index corrupted, recreating...', {
                 module: 'VectorSearch',
+                error: indexError instanceof Error ? indexError.message : String(indexError),
             })
+            // Delete and recreate the vectra index directory
+            if (fs.existsSync(this.indexPath)) {
+                fs.rmSync(this.indexPath, { recursive: true, force: true })
+                fs.mkdirSync(this.indexPath, { recursive: true })
+            }
+            this.index = new LocalIndex(this.indexPath)
+            await this.index.createIndex()
+            logger.info('Recreated vector index after corruption', { module: 'VectorSearch' })
         }
 
-        // Step 3: Re-index all current entries
-        const total = entries.length
-
-        // Send initial progress
-        await sendProgress(progress, 0, total, 'Starting vector index rebuild...')
+        // Step 4: Re-index all entries using paginated fetch
+        // Embeddings are generated in parallel batches (CPU-bound, safe),
+        // but vectra insertions are sequential (file I/O, not concurrency-safe)
+        await sendProgress(progress, 0, totalEntries, 'Starting vector index rebuild...')
 
         let indexed = 0
-        for (const entry of entries) {
-            // Delete existing item first to avoid "already exists" error
-            try {
-                await this.index.deleteItem(String(entry.id))
-            } catch {
-                // Item may not exist, ignore
-            }
+        for (let offset = 0; offset < totalEntries; offset += REBUILD_PAGE_SIZE) {
+            const page = db.getEntriesPage(offset, REBUILD_PAGE_SIZE)
+
+            // Generate embeddings in parallel batches
+            for (let i = 0; i < page.length; i += REBUILD_BATCH_SIZE) {
+                const batch = page.slice(i, i + REBUILD_BATCH_SIZE)
+
+                // Parallel embedding generation
+                const embeddings = await Promise.all(
+                    batch.map(async (entry) => {
+                        try {
+                            return { entry, embedding: await this.generateEmbedding(entry.content) }
+                        } catch {
+                            return { entry, embedding: null }
+                        }
+                    })
+                )
 
-            const success = await this.addEntry(entry.id, entry.content)
-            if (success) indexed++
+                // Sequential vectra insertion (file I/O not concurrency-safe)
+                for (const { entry, embedding } of embeddings) {
+                    if (embedding !== null) {
+                        try {
+                            await this.index.insertItem({
+                                id: String(entry.id),
+                                vector: embedding,
+                                metadata: {
+                                    entryId: entry.id,
+                                    contentPreview: entry.content.slice(0, 100),
+                                },
+                            })
+                            indexed++
+                        } catch (error) {
+                            logger.error('Failed to insert entry into vector index', {
+                                module: 'VectorSearch',
+                                entityId: entry.id,
+                                error: error instanceof Error ? error.message : String(error),
+                            })
+                        }
+                    }
+                }
 
-            // Report progress every 10 entries to avoid flooding
-            if (indexed % 10 === 0 || indexed === total) {
-                await sendProgress(
-                    progress,
-                    indexed,
-                    total,
-                    `Indexed ${String(indexed)} of ${String(total)} entries`
-                )
+                // Report progress every 10 entries to avoid flooding
+                if (indexed % 10 === 0 || indexed === totalEntries) {
+                    await sendProgress(
+                        progress,
+                        indexed,
+                        totalEntries,
+                        `Indexed ${String(indexed)} of ${String(totalEntries)} entries`
+                    )
+                }
             }
         }
 
         // Force index to refresh by re-listing items
         // This ensures the internal query structures are updated and ready for search
-        // The 100ms delay was insufficient because it didn't refresh the internal state
         await this.index.listItems()
 
         // Final progress
-        await sendProgress(progress, indexed, total, 'Vector index rebuild complete')
+        await sendProgress(progress, indexed, totalEntries, 'Vector index rebuild complete')
 
         logger.info(`Rebuilt vector index with ${String(indexed)} entries`, {
             module: 'VectorSearch',