memory-journal-mcp 6.1.1 → 6.2.1

package/README.md

@@ -10,9 +10,9 @@
 [![MCP Registry](https://img.shields.io/badge/MCP_Registry-Published-green)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.neverinfamous/memory-journal-mcp)
 [![Security](https://img.shields.io/badge/Security-Enhanced-green.svg)](SECURITY.md)
 [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue.svg)](https://github.com/neverinfamous/memory-journal-mcp)
-![Coverage](https://img.shields.io/badge/Coverage-96.1%25-brightgreen.svg)
-![Tests](https://img.shields.io/badge/Tests-1679_passed-brightgreen.svg)
-![E2E Tests](https://img.shields.io/badge/E2E_Tests-247_passed-brightgreen.svg)
+![Coverage](https://img.shields.io/badge/Coverage-96%25-brightgreen.svg)
+![Tests](https://img.shields.io/badge/Tests-1767_passed-brightgreen.svg)
+![E2E Tests](https://img.shields.io/badge/E2E_Tests-377_passed-brightgreen.svg)
 
 🎯 **AI Context + Project Intelligence:** Bridge disconnected AI sessions with persistent project memory and **automatic session handoff** — with full GitHub workflow integration.
 
@@ -27,28 +27,25 @@
 
 ### What Sets Us Apart
 
-**61 MCP Tools** · **16 Workflow Prompts** · **28 Resources** · **10 Tool Groups** · **Code Mode** · **GitHub Integration** (Issues, PRs, Actions, Kanban, Milestones, Insights) · **Team Collaboration** (Shared DB, Vector Search, Cross-Project Insights)
-
-| Feature                        | Description                                                                                                                                                                                                                     |
-| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Dynamic Context Management** | AI agents automatically query your project history and create entries at the right moments — no manual copy-pasting between sessions                                                                                            |
-| **GitHub Integration**         | 16 tools covering Issues, PRs, Actions, Kanban boards, Milestones with completion %, Copilot Reviews, and 14-day repository Insights (stars, clones, views, referrers)                                                          |
-| **Knowledge Graphs**           | 8 relationship types linking specs → implementations → tests → PRs with automatic Mermaid visualization                                                                                                                         |
-| **Triple Search**              | Full-text (FTS5), semantic (AI-powered via `@huggingface/transformers` + `sqlite-vec`), and date-range search in one server                                                                                                     |
-| **Code Mode**                  | **Massive Token Savings:** Execute complex, multi-step operations inside a secure JavaScript sandbox — reducing token overhead by up to 90% while exposing all 61 capabilities via `mj.*` API                                   |
-| **Configurable Briefing**      | 12 env vars / CLI flags to customize `memory://briefing` — control entry count, team inclusion, issue/PR/workflow detail level, Copilot review aggregation, rules/skills awareness, and workflow summary (`memory://workflows`) |
-| **Session Continuity**         | A quick `/session-summary` captures progress and feeds it into the next session's briefing — context flows seamlessly across disconnected AI threads                                                                            |
-| **Reports & Analytics**        | Generate standups, retrospectives, PR summaries, weekly digests, period analyses, and milestone tracking from your journal data                                                                                                 |
-| **Team Collaboration**         | 20 dedicated team tools providing full functionality parity — including CRUD, isolated semantic vector search, relationship graphs, and cross-project insights via a shared database with author attribution                    |
-| **Backup & Restore**           | One-command backup/restore with automated scheduling, retention policies, and auto-backup-on-restore safety net                                                                                                                 |
-| **OAuth 2.1 + Access Control** | Enterprise-ready security with RFC 9728/8414 compliance, granular scopes (`read`, `write`, `admin`), JWT/JWKS validation, and Keycloak-compatible integration                                                                   |
-| **HTTP Streaming Transport**   | Dual-protocol HTTP with Streamable HTTP + Legacy SSE, security headers, rate limiting, CORS, and stateless mode for serverless                                                                                                  |
-| **Production-Ready Security**  | SQL injection prevention, input validation (Zod), path traversal protection, token scrubbing, 7 security headers, server timeouts, and non-root Docker execution                                                                |
-| **Structured Error Handling**  | Every tool returns rich `{success, error, code, category, suggestion, recoverable}` responses — no raw exceptions. Agents get error classification, actionable remediation hints, and recoverability signals                    |
-| **Rule & Skill Suggestions**   | Agents offer to codify your recurring patterns into reusable rules and skills with your approval                                                                                                                                |
-| **Cross-Agent Memory**         | IDE agents and GitHub Copilot share context through journal entries — Copilot review findings become searchable knowledge, and IDE agents proactively apply past patterns ([setup guide](docs/copilot-setup.md))                |
-| **Strict TypeScript**          | 100% type-safe codebase with strict mode, typed error classes, and no `eslint-disable` pragmas                                                                                                                                  |
-| **MCP 2025-03-26 Compliant**   | Full protocol support with tool safety annotations, resource priorities, and progress notifications                                                                                                                             |
+**61 MCP Tools** · **16 Workflow Prompts** · **28 Resources** · **10 Tool Groups** · **Code Mode** · **GitHub Commander** (Issue Triage, PR Review, Milestone Sprints, Security/Quality/Perf Audits) · **GitHub Integration** (Issues, PRs, Actions, Kanban, Milestones, Insights) · **Team Collaboration** (Shared DB, Vector Search, Cross-Project Insights)
+
+| Feature                       | Description                                                                                                                                                    |
+| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Session Intelligence**      | Agents auto-query project history, create entries at checkpoints, and hand off context between sessions via `/session-summary`                                 |
+| **GitHub Integration**        | 16 tools for Issues, PRs, Actions, Kanban, Milestones (%), Copilot Reviews, and 14-day Insights                                                                |
+| **Knowledge Graphs**          | 8 relationship types linking specs → implementations → tests → PRs with Mermaid visualization                                                                  |
+| **Triple Search**             | Full-text (FTS5), semantic (`@huggingface/transformers` + `sqlite-vec`), and date-range search                                                                 |
+| **Code Mode**                 | Execute multi-step operations in a secure sandbox — up to 90% token savings via `mj.*` API                                                                     |
+| **Configurable Briefing**     | 12 env vars / CLI flags control `memory://briefing` content — entries, team, GitHub detail, skills awareness                                                   |
+| **Reports & Analytics**       | Standups, retrospectives, PR summaries, digests, period analyses, and milestone tracking                                                                       |
+| **Team Collaboration**        | 20 tools with full parity — CRUD, vector search, relationship graphs, cross-project insights, author attribution                                               |
+| **Backup & Restore**          | One-command backup/restore with automated scheduling, retention policies, and safety-net auto-backups                                                          |
+| **Security & Transport**      | OAuth 2.1 (RFC 9728/8414, JWT/JWKS, scopes), Streamable HTTP + SSE, rate limiting, CORS, SQL injection prevention, non-root Docker                             |
+| **Structured Error Handling** | Every tool returns `{success, error, code, category, suggestion, recoverable}` — agents get classification, remediation hints, and recoverability signals      |
+| **Agent Collaboration**       | IDE agents and Copilot share context; review findings become searchable knowledge; agents suggest reusable rules and skills ([setup](docs/copilot-setup.md))   |
+| **Strict TypeScript**         | 100% type-safe with strict mode, typed error classes, and no `eslint-disable` pragmas                                                                          |
+| **MCP 2025-03-26 Compliant**  | Tool safety annotations, resource priorities, and progress notifications                                                                                       |
+| **GitHub Commander**          | Skills for issue triage, PR reviews, sprint milestones, and security/quality/performance audits with journal trails ([docs](skills/github-commander/SKILL.md)) |
 
 ---
 
@@ -117,11 +114,17 @@ flowchart TB
 
 ---
 
-## Rule (Add to AGENTS.md, GEMINI.md, etc)
+## Suggested Rule (Add to AGENTS.md, GEMINI.md, etc)
 
-## Session Start
+**PERFORM AT START OF CHATS**: Read `memory://briefing`, present as two-column markdown table (Context | Value). Include all available fields; omit absent rows.
 
-**REQUIRED**: Before processing any user request, read `memory://briefing` and **present the briefing to the user as a two-column markdown table** (Context | Value). Include all available context fields. Omit rows where the data is absent. **[Full example →](https://github.com/neverinfamous/memory-journal-mcp#rule-add-to-agentsmd-geminimd-etc)**
+**CREATE JOURNAL ENTRIES** at natural checkpoints:
+
+- After pushing to main (`milestone` or `technical_note`, tag with version)
+- After significant design decisions or learnings (`project_decision`)
+- After resolving non-trivial bugs (`bug_fix`, link to issue number)
+
+**SUGGEST CREATING OR IMPROVING RULES AND SKILLS** as you notice workflow opportunities.
 
 ---
 
@@ -424,6 +427,9 @@ The GitHub tools (`get_github_issues`, `get_github_prs`, etc.) auto-detect the r
 | `AUTO_REBUILD_INDEX`              | Set to `true` to rebuild vector index on server startup                                           |
 | `MCP_HOST`                        | Server bind host (`0.0.0.0` for containers, default: `localhost`)                                 |
 | `MCP_AUTH_TOKEN`                  | Bearer token for HTTP transport authentication (CLI: `--auth-token`)                              |
+| `MCP_CORS_ORIGIN`                 | Allowed CORS origins for HTTP transport, comma-separated (default: `*`)                           |
+| `MCP_RATE_LIMIT_MAX`              | Max requests per minute per client IP, HTTP only (default: `100`)                                 |
+| `LOG_LEVEL`                       | Log verbosity: `error`, `warn`, `info`, `debug` (default: `info`; CLI: `--log-level`)             |
 | `MCP_ENABLE_HSTS`                 | Enable HSTS security header on HTTP responses (CLI: `--enable-hsts`; default: `false`)            |
 | `OAUTH_ENABLED`                   | Set to `true` to enable OAuth 2.1 authentication (HTTP only)                                      |
 | `OAUTH_ISSUER`                    | OAuth issuer URL (e.g., `https://auth.example.com/realms/mcp`)                                    |
@@ -441,6 +447,16 @@ The GitHub tools (`get_github_issues`, `get_github_prs`, etc.) auto-detect the r
 | `SKILLS_DIR_PATH`                 | Path to skills directory for agent awareness (CLI: `--skills-dir`)                                |
 | `MEMORY_JOURNAL_WORKFLOW_SUMMARY` | Free-text workflow summary for `memory://workflows` (CLI: `--workflow-summary`)                   |
 | `INSTRUCTION_LEVEL`               | Briefing depth: `essential`, `standard`, `full` (CLI: `--instruction-level`; default: `standard`) |
+| `PROJECT_LINT_CMD`                | Project lint command for GitHub Commander validation gates (default: `npm run lint`)              |
+| `PROJECT_TYPECHECK_CMD`           | Project typecheck command (default: `npm run typecheck`; empty = skip)                            |
+| `PROJECT_BUILD_CMD`               | Project build command (default: `npm run build`; empty = skip)                                    |
+| `PROJECT_TEST_CMD`                | Project test command (default: `npm run test`)                                                    |
+| `PROJECT_E2E_CMD`                 | Project E2E test command (default: empty = skip)                                                  |
+| `PROJECT_PACKAGE_MANAGER`         | Package manager override: `npm`, `yarn`, `pnpm`, `bun` (default: auto-detect from lockfile)       |
+| `PROJECT_HAS_DOCKERFILE`          | Enable Docker audit steps (default: auto-detect)                                                  |
+| `COMMANDER_HITL_FILE_THRESHOLD`   | Human-in-the-loop checkpoint if changes touch > N files (default: `10`)                           |
+| `COMMANDER_SECURITY_TOOLS`        | Override security tool auto-detection (comma-separated; default: auto-detect)                     |
+| `COMMANDER_BRANCH_PREFIX`         | Branch naming prefix for PRs (default: `fix`)                                                     |
 
 **Without `GITHUB_REPO_PATH`**: You'll need to explicitly provide `owner` and `repo` parameters when calling GitHub tools.
 

package/dist/{chunk-X4SWFATC.js → chunk-BI4ZNSKA.js}

@@ -455,7 +455,7 @@ var CreateEntrySchema = z.object({
   share_with_team: z.boolean().optional().default(false)
 });
 var CreateEntrySchemaMcp = z.object({
-  content: z.string(),
+  content: z.string().optional(),
   entry_type: z.string().optional().default("personal_reflection"),
   tags: z.array(z.string()).optional().default([]),
   is_personal: z.boolean().optional().default(true),
@@ -478,7 +478,7 @@ var GetEntryByIdSchema = z.object({
   include_relationships: z.boolean().optional().default(true)
 });
 var GetEntryByIdSchemaMcp = z.object({
-  entry_id: relaxedNumber(),
+  entry_id: relaxedNumber().optional(),
   include_relationships: z.boolean().optional().default(true)
 });
 var GetRecentEntriesSchema = z.object({
@@ -493,7 +493,7 @@ var CreateEntryMinimalSchema = z.object({
   content: z.string().min(1).max(MAX_CONTENT_LENGTH)
 });
 var CreateEntryMinimalSchemaMcp = z.object({
-  content: z.string()
+  content: z.string().optional()
 });
 var TestSimpleSchema = z.object({
   message: z.string().optional().default("Hello")
@@ -1680,7 +1680,7 @@ var UpdateEntrySchema = z.object({
   tags: z.array(z.string()).optional()
 });
 var UpdateEntrySchemaMcp = z.object({
-  entry_id: relaxedNumber(),
+  entry_id: relaxedNumber().optional(),
   content: z.string().optional(),
   entry_type: z.string().optional(),
   is_personal: z.boolean().optional(),
@@ -1691,7 +1691,7 @@ var DeleteEntrySchema = z.object({
   permanent: z.boolean().optional().default(false)
 });
 var DeleteEntrySchemaMcp = z.object({
-  entry_id: relaxedNumber(),
+  entry_id: relaxedNumber().optional(),
   permanent: z.boolean().optional().default(false)
 });
 var UpdateEntryOutputSchema = z.object({
@@ -1806,8 +1806,8 @@ function getAdminTools(context) {
       description: 'Merge one tag into another to consolidate similar tags (e.g., merge "phase-2" into "phase2"). The source tag is deleted after merge.',
       group: "admin",
       inputSchema: z.object({
-        source_tag: z.string().min(1).describe("Tag to merge from (will be deleted)"),
-        target_tag: z.string().min(1).describe("Tag to merge into (will be created if not exists)")
+        source_tag: z.string().optional().describe("Tag to merge from (will be deleted)"),
+        target_tag: z.string().optional().describe("Tag to merge into (will be created if not exists)")
       }),
       outputSchema: MergeTagsOutputSchema,
       annotations: { readOnlyHint: false, idempotentHint: false, openWorldHint: false },
@@ -1908,7 +1908,7 @@ function getAdminTools(context) {
       title: "Add Entry to Vector Index",
       description: "Add a specific entry to the semantic search vector index",
       group: "admin",
-      inputSchema: z.object({ entry_id: relaxedNumber() }),
+      inputSchema: z.object({ entry_id: relaxedNumber().optional() }),
       outputSchema: AddToVectorIndexOutputSchema,
       annotations: { readOnlyHint: false, idempotentHint: true, openWorldHint: false },
       handler: async (params) => {
@@ -2708,7 +2708,7 @@ function getGitHubIssueTools(context) {
       description: "Create a GitHub issue AND automatically create a linked journal entry documenting the issue creation.",
       group: "github",
       inputSchema: z.object({
-        title: z.string().min(1).describe("Issue title"),
+        title: z.string().optional().describe("Issue title"),
         body: z.string().optional().describe("Issue body/description"),
         labels: z.array(z.string()).optional().describe("Labels to apply"),
         assignees: z.array(z.string()).optional().describe("Users to assign"),
@@ -3240,7 +3240,7 @@ function getGitHubMilestoneTools(context) {
       description: "Create a new GitHub milestone for tracking progress toward a project goal.",
       group: "github",
       inputSchema: z.object({
-        title: z.string().min(1).describe("Milestone title"),
+        title: z.string().optional().describe("Milestone title"),
         description: z.string().optional().describe("Milestone description"),
         due_on: z.string().optional().describe("Due date in YYYY-MM-DD format (optional)"),
         owner: z.string().optional().describe("LEAVE EMPTY to auto-detect"),
@@ -3656,7 +3656,7 @@ function getBackupTools(context) {
       group: "backup",
       inputSchema: z.object({
         filename: z.string().describe("Backup filename to restore from (e.g., backup_2025-01-01.db)"),
-        confirm: z.boolean().describe("Must be set to true to confirm the restore operation")
+        confirm: z.boolean().optional().describe("Must be set to true to confirm the restore operation")
       }),
       outputSchema: RestoreResultOutputSchema,
       annotations: {
@@ -3669,7 +3669,7 @@ function getBackupTools(context) {
         try {
           const input = z.object({
             filename: z.string(),
-            confirm: z.boolean()
+            confirm: z.boolean().optional()
           }).parse(params);
           if (!input.confirm) {
             return {
@@ -3678,7 +3678,7 @@ function getBackupTools(context) {
               code: "VALIDATION_ERROR",
               category: "validation",
               suggestion: "Set confirm: true to proceed with restore",
-              recoverable: false
+              recoverable: true
             };
           }
           const progressServer = progress?.server;
@@ -3800,7 +3800,7 @@ var TeamCreateEntrySchema = z.object({
   author: z.string().optional()
 });
 var TeamCreateEntrySchemaMcp = z.object({
-  content: z.string().min(1).max(MAX_CONTENT_LENGTH),
+  content: z.string().optional(),
   entry_type: z.string().optional().default("personal_reflection"),
   tags: z.array(z.string()).optional().default([]),
   significance_type: z.string().optional(),
@@ -3834,7 +3834,7 @@ var TeamGetEntryByIdSchema = z.object({
   include_relationships: z.boolean().optional().default(true)
 });
 var TeamGetEntryByIdSchemaMcp = z.object({
-  entry_id: relaxedNumber(),
+  entry_id: relaxedNumber().optional(),
   include_relationships: z.boolean().optional().default(true)
 });
 var TeamSearchByDateRangeSchema = z.object({
@@ -3845,8 +3845,8 @@ var TeamSearchByDateRangeSchema = z.object({
   limit: z.number().max(500).optional().default(50)
 });
 var TeamSearchByDateRangeSchemaMcp = z.object({
-  start_date: z.string().describe("Start date (YYYY-MM-DD)"),
-  end_date: z.string().describe("End date (YYYY-MM-DD)"),
+  start_date: z.string().optional().describe("Start date (YYYY-MM-DD)"),
+  end_date: z.string().optional().describe("End date (YYYY-MM-DD)"),
   entry_type: z.string().optional(),
   tags: z.array(z.string()).optional(),
   limit: relaxedNumber().optional().default(50)
@@ -3858,7 +3858,7 @@ var TeamUpdateEntrySchema = z.object({
   tags: z.array(z.string()).optional()
 });
 var TeamUpdateEntrySchemaMcp = z.object({
-  entry_id: relaxedNumber(),
+  entry_id: relaxedNumber().optional(),
   content: z.string().optional(),
   entry_type: z.string().optional(),
   tags: z.array(z.string()).optional()
@@ -3867,12 +3867,16 @@ var TeamDeleteEntrySchema = z.object({
   entry_id: z.number()
 });
 var TeamDeleteEntrySchemaMcp = z.object({
-  entry_id: relaxedNumber()
+  entry_id: relaxedNumber().optional()
 });
 var TeamMergeTagsSchema = z.object({
   source_tag: z.string().min(1),
   target_tag: z.string().min(1)
 });
+var TeamMergeTagsSchemaMcp = z.object({
+  source_tag: z.string().optional(),
+  target_tag: z.string().optional()
+});
 var TeamGetStatisticsSchema = z.object({
   group_by: z.enum(["day", "week", "month"]).optional().default("week")
 });
@@ -3895,8 +3899,8 @@ var TeamLinkEntriesSchema = z.object({
   description: z.string().optional()
 });
 var TeamLinkEntriesSchemaMcp = z.object({
-  from_entry_id: relaxedNumber(),
-  to_entry_id: relaxedNumber(),
+  from_entry_id: relaxedNumber().optional(),
+  to_entry_id: relaxedNumber().optional(),
   relationship_type: z.string().optional().default("references"),
   description: z.string().optional()
 });
@@ -4039,7 +4043,7 @@ var TeamSemanticSearchSchema = z.object({
   hint_on_empty: z.boolean().optional().default(true).describe("Include hint when no results found (default: true)")
 });
 var TeamSemanticSearchSchemaMcp = z.object({
-  query: z.string(),
+  query: z.string().optional(),
   limit: relaxedNumber().optional().default(10),
   similarity_threshold: relaxedNumber().optional().default(0.25),
   hint_on_empty: z.boolean().optional().default(true).describe("Include hint when no results found (default: true)")
@@ -4048,7 +4052,7 @@ var TeamAddToVectorIndexSchema = z.object({
   entry_id: z.number()
 });
 var TeamAddToVectorIndexSchemaMcp = z.object({
-  entry_id: relaxedNumber()
+  entry_id: relaxedNumber().optional()
 });
 var TeamSemanticEntryOutputSchema = TeamEntryOutputSchema.extend({
   similarity: z.number()
@@ -4469,7 +4473,7 @@ function getTeamAdminTools(context) {
       title: "Merge Team Tags",
       description: "Merge a source tag into a target tag in the team database. All entries with the source tag will be re-tagged with the target tag. Requires TEAM_DB_PATH.",
       group: "team",
-      inputSchema: TeamMergeTagsSchema,
+      inputSchema: TeamMergeTagsSchemaMcp,
       outputSchema: TeamMergeTagsOutputSchema,
       annotations: { readOnlyHint: false, idempotentHint: false, openWorldHint: false },
       handler: (params) => {
@@ -4704,6 +4708,16 @@ function getTeamRelationshipTools(context) {
             return { ...TEAM_DB_ERROR_RESPONSE };
           }
           const { from_entry_id, to_entry_id, relationship_type, description } = TeamLinkEntriesSchema.parse(params);
+          if (from_entry_id === to_entry_id) {
+            return {
+              success: false,
+              error: "Cannot link an entry to itself",
+              code: "VALIDATION_ERROR",
+              category: "validation",
+              suggestion: "Choose a different target entry to create a meaningful relationship",
+              recoverable: true
+            };
+          }
           const fromEntry = teamDb.getEntryById(from_entry_id);
           if (!fromEntry) {
             return {