memory-journal-mcp 6.1.2 → 6.2.1

package/DOCKER_README.md

@@ -1,331 +0,0 @@
-# Memory Journal MCP Server
-
-[![GitHub](https://img.shields.io/badge/GitHub-neverinfamous/memory--journal--mcp-blue?logo=github)](https://github.com/neverinfamous/memory-journal-mcp)
-[![Docker Pulls](https://img.shields.io/docker/pulls/writenotenow/memory-journal-mcp)](https://hub.docker.com/r/writenotenow/memory-journal-mcp)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-![Status](https://img.shields.io/badge/status-Production%2FStable-brightgreen)
-[![npm](https://img.shields.io/npm/v/memory-journal-mcp)](https://www.npmjs.com/package/memory-journal-mcp)
-[![Security](https://img.shields.io/badge/Security-Enhanced-green.svg)](https://github.com/neverinfamous/memory-journal-mcp/blob/main/SECURITY.md)
-[![GitHub Stars](https://img.shields.io/github/stars/neverinfamous/memory-journal-mcp?style=social)](https://github.com/neverinfamous/memory-journal-mcp)
-[![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue.svg)](https://github.com/neverinfamous/memory-journal-mcp)
-![Coverage](https://img.shields.io/badge/Coverage-96.1%25-brightgreen.svg)
-![Tests](https://img.shields.io/badge/Tests-1679_passed-brightgreen.svg)
-![E2E Tests](https://img.shields.io/badge/E2E_Tests-247_passed-brightgreen.svg)
-
-🎯 **AI Context + Project Intelligence:** Bridge disconnected AI sessions with persistent project memory and **automatic session handoff** — with full GitHub workflow integration.
-
-**[GitHub](https://github.com/neverinfamous/memory-journal-mcp)** • **[Wiki](https://github.com/neverinfamous/memory-journal-mcp/wiki)** • **[Changelog](https://github.com/neverinfamous/memory-journal-mcp/blob/main/CHANGELOG.md)** • **[Release Article](https://adamic.tech/articles/memory-journal-mcp-server)**
-
-## 🎯 What This Does
-
-### What Sets Us Apart
-
-**61 MCP Tools** · **16 Workflow Prompts** · **28 Resources** · **10 Tool Groups** · **Code Mode** · **GitHub Integration** (Issues, PRs, Actions, Kanban, Milestones, Insights) · **Team Collaboration** (Shared DB, Vector Search, Cross-Project Insights)
-
-| Feature                        | Description                                                                                                                                                                                                                                                                |
-| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Dynamic Context Management** | AI agents automatically query your project history and create entries at the right moments                                                                                                                                                                                 |
-| **GitHub Integration**         | 16 tools covering Issues, PRs, Actions, Kanban boards, Milestones with completion %, Copilot Reviews, and 14-day repository Insights (stars, clones, views, referrers)                                                                                                     |
-| **Knowledge Graphs**           | 8 relationship types linking specs → implementations → tests → PRs with automatic Mermaid visualization                                                                                                                                                                    |
-| **Triple Search**              | Full-text (FTS5), semantic (AI-powered via `@huggingface/transformers` + `sqlite-vec`), and date-range search in one server                                                                                                                                                |
-| **Code Mode**                  | **Massive Token Savings:** Execute complex, multi-step operations inside a secure JavaScript sandbox — reducing token overhead by up to 90% while exposing all 61 capabilities via `mj.*` API                                                                              |
-| **Configurable Briefing**      | 12 env vars / CLI flags to customize `memory://briefing` — control entry count, team inclusion, issue/PR/workflow detail level, Copilot review aggregation, rules/skills awareness, and workflow summary (`memory://workflows`)                                            |
-| **Session Continuity**         | `/session-summary` captures progress and feeds it into the next session's briefing — context flows seamlessly across disconnected AI threads                                                                                                                               |
-| **Reports & Analytics**        | Generate standups, retrospectives, PR summaries, weekly digests, period analyses, and milestone tracking from your journal data                                                                                                                                            |
-| **Team Collaboration**         | 20 dedicated team tools providing full functionality parity — including CRUD, isolated semantic vector search, relationship graphs, and cross-project insights via a shared database with author attribution                                                               |
-| **Backup & Restore**           | One-command backup/restore with automated scheduling, retention policies, and auto-backup-on-restore safety net                                                                                                                                                            |
-| **OAuth 2.1 + Access Control** | Enterprise-ready security with RFC 9728/8414 compliance, granular scopes (`read`, `write`, `admin`), JWT/JWKS validation, and Keycloak-compatible integration                                                                                                              |
-| **HTTP Streaming Transport**   | Dual-protocol HTTP with Streamable HTTP + Legacy SSE, security headers, rate limiting, CORS, and stateless mode for serverless                                                                                                                                             |
-| **Production-Ready Security**  | SQL injection prevention, input validation, path traversal protection, token scrubbing, security headers, and non-root Docker execution                                                                                                                                    |
-| **Rule & Skill Suggestions**   | Agents offer to codify recurring patterns into reusable rules and skills with your approval                                                                                                                                                                                |
-| **Cross-Agent Memory**         | IDE agents and GitHub Copilot share context through journal entries — Copilot review findings become searchable knowledge, IDE agents proactively apply past patterns ([setup guide](https://github.com/neverinfamous/memory-journal-mcp/blob/main/docs/copilot-setup.md)) |
-
-**[See complete examples & prompts →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Examples)**
-
-## Rule (Add to AGENTS.md, GEMINI.md, etc)
-
-## Session Start
-
-**REQUIRED**: Before processing any user request, read `memory://briefing` and **present the briefing to the user as a two-column markdown table** (Context | Value). Include all available context fields. Omit rows where the data is absent. **[Full example →](https://github.com/neverinfamous/memory-journal-mcp#rule-add-to-agentsmd-geminimd-etc)**
-
----
-
-### Tool Filtering
-
-> [!IMPORTANT]
-> All shortcuts and tool groups include **Code Mode** (`mj_execute_code`) by default for token-efficient operations. To exclude it, add `-codemode` to your filter: `--tool-filter starter,-codemode`
-
-Control which tools are exposed via `MEMORY_JOURNAL_MCP_TOOL_FILTER` (or CLI: `--tool-filter`):
-
-| Filter               | Tools | Use Case                 |
-| -------------------- | ----- | ------------------------ |
-| `full`               | 61    | All tools (default)      |
-| `starter`            | ~11   | Core + search + codemode |
-| `essential`          | ~7    | Minimal footprint        |
-| `readonly`           | ~15   | Disable all mutations    |
-| `-github`            | 45    | Exclude a group          |
-| `-github,-analytics` | 43    | Exclude multiple groups  |
-
-**Filter Syntax:** `shortcut` or `group` or `tool_name` (whitelist mode) · `-group` (disable group) · `-tool` (disable tool) · `+tool` (re-enable after group disable)
-
-**Custom Selection:** List individual tool names to create your own whitelist: `--tool-filter "create_entry,search_entries,semantic_search"`
-
-**Groups:** `core`, `search`, `analytics`, `relationships`, `export`, `admin`, `github`, `backup`, `team`, `codemode`
-
-**[Complete tool filtering guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Tool-Filtering)**
-
-## 📋 Core Capabilities
-
-### 🛠️ **61 MCP Tools** (10 Groups)
-
-| Group           | Tools | Description                                                                                                         |
-| --------------- | ----- | ------------------------------------------------------------------------------------------------------------------- |
-| `codemode`      | 1     | Code Mode (sandboxed code execution) 🌟 **Recommended**                                                             |
-| `core`          | 6     | Entry CRUD, tags, test                                                                                              |
-| `search`        | 4     | Text search, date range, semantic, vector stats                                                                     |
-| `analytics`     | 2     | Statistics, cross-project insights                                                                                  |
-| `relationships` | 2     | Link entries, visualize graphs                                                                                      |
-| `export`        | 1     | JSON/Markdown export                                                                                                |
-| `admin`         | 5     | Update, delete, rebuild/add to vector index, merge tags                                                             |
-| `github`        | 16    | Issues, PRs, context, Kanban, **Milestones**, **Insights**, **issue lifecycle**, **Copilot Reviews**                |
-| `backup`        | 4     | Backup, list, restore, cleanup                                                                                      |
-| `team`          | 20    | CRUD, search, stats, relationships, export, backup, vector search, cross-project insights (requires `TEAM_DB_PATH`) |
-
-**[Complete tools reference →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Tools)**
-
-### 🎯 **16 Workflow Prompts**
-
-Standups, retrospectives, PR summaries, weekly digests, period analysis, milestone tracking, context bundles, session summaries, and more. **[Complete prompts guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Prompts)**
-
-### 📡 **28 Resources** (20 Static + 8 Template)
-
-20 static resources (`memory://briefing`, `memory://workflows`, `memory://rules`, `memory://health`, `memory://help`, `memory://help/gotchas`, GitHub status/insights, team stats, and more) plus 8 template resources for project timelines, issue/PR entries, Kanban boards, milestone details, and per-group help. **[Resources documentation →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Resources)**
-
-## 🚀 Quick Start (2 Minutes)
-
-**Prerequisites:** Docker installed and running · ~250MB disk space · **[Full Installation Guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Installation)**
-
-### 1. Pull the Image
-
-```bash
-docker pull writenotenow/memory-journal-mcp:latest
-```
-
-### 2. Create Data Directory
-
-```bash
-mkdir data
-```
-
-### 3. Add to MCP Config
-
-Add this to your `~/.cursor/mcp.json`, Claude Desktop config, or equivalent:
-
-```json
-{
-  "mcpServers": {
-    "memory-journal-mcp": {
-      "command": "docker",
-      "args": [
-        "run",
-        "--rm",
-        "-i",
-        "-v",
-        "./data:/app/data",
-        "-e",
-        "GITHUB_TOKEN",
-        "-e",
-        "GITHUB_REPO_PATH=/app/repo",
-        "-v",
-        "/path/to/your/repo:/app/repo:ro",
-        "writenotenow/memory-journal-mcp:latest"
-      ],
-      "env": {
-        "GITHUB_TOKEN": "ghp_your_token_here"
-      }
-    }
-  }
-}
-```
-
-**Variants** (modify the config above):
-
-| Variant                 | Change                                                                                  |
-| ----------------------- | --------------------------------------------------------------------------------------- |
-| **Minimal (no GitHub)** | Remove the `-e GITHUB_TOKEN`, `-e GITHUB_REPO_PATH`, repo volume mount, and `env` block |
-| **Team collaboration**  | Add `-e`, `"TEAM_DB_PATH=/app/data/team.db"` to `args`                                  |
-| **Code Mode only**      | Add `"--tool-filter"`, `"codemode"` to `args` (single tool, all capabilities)           |
-
-| **Briefing config** | Add `-e`, `"BRIEFING_ENTRY_COUNT=5"` to `args` (see env var table below) |
-| **Local build** | Replace `writenotenow/memory-journal-mcp:latest` with your local image name |
-
-### 4. Restart & Journal!
-
-Restart Cursor or your MCP client and start journaling!
-
-| Environment Variable              | Description                                                                                       |
-| --------------------------------- | ------------------------------------------------------------------------------------------------- |
-| `DB_PATH`                         | Database location (default: `/app/data/memory_journal.db` in Docker)                              |
-| `TEAM_DB_PATH`                    | Team database file location (CLI: `--team-db`)                                                    |
-| `TEAM_AUTHOR`                     | Override author name for team entries (default: `git config user.name`)                           |
-| `GITHUB_TOKEN`                    | GitHub personal access token for API access                                                       |
-| `GITHUB_REPO_PATH`                | Path to git repo inside container (mount your repo)                                               |
-| `DEFAULT_PROJECT_NUMBER`          | Default GitHub Project number for auto-assignment when creating issues                            |
-| `AUTO_REBUILD_INDEX`              | Set to `true` to rebuild vector index on server startup                                           |
-| `MCP_HOST`                        | Server bind host (`0.0.0.0` for containers, default: `localhost`)                                 |
-| `MCP_AUTH_TOKEN`                  | Bearer token for HTTP transport authentication (CLI: `--auth-token`)                              |
-| `MCP_ENABLE_HSTS`                 | Enable HSTS security header on HTTP responses (CLI: `--enable-hsts`; default: `false`)            |
-| `OAUTH_ENABLED`                   | Set to `true` to enable OAuth 2.1 authentication (HTTP only)                                      |
-| `OAUTH_ISSUER`                    | OAuth issuer URL (e.g., `https://auth.example.com/realms/mcp`)                                    |
-| `OAUTH_AUDIENCE`                  | Expected JWT audience claim                                                                       |
-| `OAUTH_JWKS_URI`                  | JWKS endpoint for token signature verification                                                    |
-| `BRIEFING_ENTRY_COUNT`            | Journal entries in briefing (CLI: `--briefing-entries`; default: `3`)                             |
-| `BRIEFING_INCLUDE_TEAM`           | Include team DB entries in briefing (`true`/`false`; default: `false`)                            |
-| `BRIEFING_ISSUE_COUNT`            | Issues to list in briefing; `0` = count only (default: `0`)                                       |
-| `BRIEFING_PR_COUNT`               | PRs to list in briefing; `0` = count only (default: `0`)                                          |
-| `BRIEFING_PR_STATUS`              | Show PR status breakdown (open/merged/closed; default: `false`)                                   |
-| `BRIEFING_WORKFLOW_COUNT`         | Workflow runs to list in briefing; `0` = status only (default: `0`)                               |
-| `BRIEFING_WORKFLOW_STATUS`        | Show workflow status breakdown in briefing (default: `false`)                                     |
-| `BRIEFING_COPILOT_REVIEWS`        | Aggregate Copilot review state in briefing (default: `false`)                                     |
-| `RULES_FILE_PATH`                 | Path to user rules file for agent awareness (CLI: `--rules-file`)                                 |
-| `SKILLS_DIR_PATH`                 | Path to skills directory for agent awareness (CLI: `--skills-dir`)                                |
-| `MEMORY_JOURNAL_WORKFLOW_SUMMARY` | Free-text workflow summary for `memory://workflows` (CLI: `--workflow-summary`)                   |
-| `INSTRUCTION_LEVEL`               | Briefing depth: `essential`, `standard`, `full` (CLI: `--instruction-level`; default: `standard`) |
-
-**Without `GITHUB_REPO_PATH`**: Explicitly provide `owner` and `repo` when calling GitHub tools.
-
-**Fallback:** With `GITHUB_REPO_PATH` set, tools auto-detect `owner`/`repo` from git config. Without it, provide `owner` and `repo` args explicitly. Mount read-only: `-v /path/to/repo:/app/repo:ro`.
-
-### 🔄 Session Management
-
-1. **Session start** → agent reads `memory://briefing` and shows project context
-2. **Session summary** → use `/session-summary` to capture progress and next-session context
-3. Next session's briefing includes the previous summary — context flows seamlessly
-
-### HTTP/SSE Transport (Remote Access)
-
-For remote access, web-based clients, or HTTP-compatible MCP hosts:
-
-**Stateful Mode (default):**
-
-```bash
-docker run --rm -p 3000:3000 \
-  -v ./data:/app/data \
-  writenotenow/memory-journal-mcp:latest \
-  --transport http --port 3000 --server-host 0.0.0.0
-```
-
-**Stateless Mode (serverless):**
-
-```bash
-docker run --rm -p 3000:3000 \
-  -v ./data:/app/data \
-  writenotenow/memory-journal-mcp:latest \
-  --transport http --port 3000 --server-host 0.0.0.0 --stateless
-```
-
-**Endpoints:**
-
-| Endpoint                                    | Description                                      | Mode     |
-| ------------------------------------------- | ------------------------------------------------ | -------- |
-| `GET /`                                     | Server info and available endpoints              | Both     |
-| `POST /mcp`                                 | JSON-RPC requests (initialize, tools/call, etc.) | Both     |
-| `GET /mcp`                                  | SSE stream for server-to-client notifications    | Stateful |
-| `DELETE /mcp`                               | Session termination                              | Stateful |
-| `GET /sse`                                  | Legacy SSE connection (MCP 2024-11-05)           | Stateful |
-| `POST /messages`                            | Legacy SSE message endpoint                      | Stateful |
-| `GET /health`                               | Health check (`{ status, timestamp }`)           | Both     |
-| `GET /.well-known/oauth-protected-resource` | RFC 9728 Protected Resource Metadata             | Both     |
-
-**Session Management:** In stateful mode, include the `mcp-session-id` header (returned from initialization) in subsequent requests.
-
-- **OAuth 2.1** — RFC 9728/8414, JWT/JWKS, granular scopes (opt-in via `--oauth-enabled`)
-- **7 Security Headers** — CSP, HSTS (opt-in), X-Frame-Options, and more
-- **Rate Limiting** — 100 req/min per IP · **CORS** — configurable multi-origin (exact-match) · **1MB body limit**
-- **Server Timeouts** — Request (120s), keep-alive (65s), headers (66s) · **404 handler** · **Cross-protocol guard**
-- **Build Provenance** · **SBOM** · **Supply Chain Attestations** · **Non-root execution**
-
-| Mode                      | Progress Notifications | Legacy SSE | Serverless |
-| ------------------------- | ---------------------- | ---------- | ---------- |
-| Stateful (default)        | ✅ Yes                 | ✅ Yes     | ⚠️ Complex |
-| Stateless (`--stateless`) | ❌ No                  | ❌ No      | ✅ Native  |
-
-#### Automated Scheduling (HTTP Only)
-
-Enable periodic maintenance jobs for long-running containers. These jobs run in-process on `setInterval` — no external cron needed.
-
-> **Note:** These flags only work with HTTP/SSE transport. Stdio sessions (IDE integrations) are short-lived — use `backup_journal` and `cleanup_backups` tools manually instead.
-
-```bash
-docker run --rm -p 3000:3000 \
-  -v ./data:/app/data \
-  writenotenow/memory-journal-mcp:latest \
-  --transport http --port 3000 --server-host 0.0.0.0 \
-  --backup-interval 60 --keep-backups 10 \
-  --vacuum-interval 1440 \
-  --rebuild-index-interval 720
-```
-
-| Flag                             | Default | Description                                                          |
-| -------------------------------- | ------- | -------------------------------------------------------------------- |
-| `--backup-interval <min>`        | 0 (off) | Create timestamped database backups and prune old ones automatically |
-| `--keep-backups <count>`         | 5       | Max backups retained during automated cleanup                        |
-| `--vacuum-interval <min>`        | 0 (off) | Run `PRAGMA optimize` and flush database to disk                     |
-| `--rebuild-index-interval <min>` | 0 (off) | Full vector index rebuild to maintain semantic search quality        |
-
-Each job is error-isolated — a failure in one job won't affect the others. Scheduler status (last run, result, next run) is visible via `memory://health`.
-
-## 🔐 OAuth 2.1 Authentication
-
-For production deployments, enable OAuth 2.1 on the HTTP transport:
-
-| Component                   | Status | Description                                      |
-| --------------------------- | ------ | ------------------------------------------------ |
-| Protected Resource Metadata | ✅     | RFC 9728 `/.well-known/oauth-protected-resource` |
-| Auth Server Discovery       | ✅     | RFC 8414 metadata discovery with caching         |
-| Token Validation            | ✅     | JWT validation with JWKS support                 |
-| Scope Enforcement           | ✅     | Granular `read`, `write`, `admin` scopes         |
-| HTTP Transport              | ✅     | Streamable HTTP with OAuth middleware            |
-
-**Scopes:** `read` (core, search, analytics, relationships, export) · `write` (github, team + read) · `admin` (admin, backup, codemode + all)
-
-```bash
-docker run --rm -p 3000:3000 \
-  -v ./data:/app/data \
-  -e OAUTH_ENABLED=true \
-  -e OAUTH_ISSUER=https://auth.example.com/realms/mcp \
-  -e OAUTH_AUDIENCE=memory-journal-mcp \
-  writenotenow/memory-journal-mcp:latest \
-  --transport http --port 3000 --server-host 0.0.0.0
-```
-
-> **Note:** OAuth is opt-in. When not enabled, the server falls back to simple token authentication via `MCP_AUTH_TOKEN`, or runs without authentication.
-
-## 🔧 Configuration
-
-### GitHub Management Capabilities
-
-16 GitHub tools covering issues, PRs, Kanban boards, milestones (with completion %), repository insights, Copilot reviews, and issue lifecycle with journal linking. Standard mutations (create/close issues, merge PRs) are handled by agents via `gh` CLI. **[Complete GitHub integration guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Git-Integration)**
-
-## 🏗️ Build from Source
-
-```bash
-git clone https://github.com/neverinfamous/memory-journal-mcp.git
-cd memory-journal-mcp
-docker build -f Dockerfile -t memory-journal-mcp-local .
-```
-
-Then use `memory-journal-mcp-local` as the image name in your MCP config (see Quick Start above).
-
-## 📚 Documentation & Resources
-
-- **[GitHub Wiki](https://github.com/neverinfamous/memory-journal-mcp/wiki)** - Complete documentation
-- **[Copilot Setup Guide](https://github.com/neverinfamous/memory-journal-mcp/blob/main/docs/copilot-setup.md)** - Cross-agent memory bridge between IDE agents and GitHub Copilot
-- **[npm Package](https://www.npmjs.com/package/memory-journal-mcp)** - Node.js distribution
-- **[Issues](https://github.com/neverinfamous/memory-journal-mcp/issues)** - Bug reports & feature requests
-
-## 📄 License
-
-MIT License - See [LICENSE](https://github.com/neverinfamous/memory-journal-mcp/blob/main/LICENSE)
-
-_Migrating from v2.x?_ Your existing database is fully compatible.

package/Dockerfile

@@ -1,128 +0,0 @@
-# Memory Journal MCP Server - TypeScript Version
-# Multi-stage build for optimized production image
-FROM node:24-alpine AS builder
-
-WORKDIR /app
-
-# Install build dependencies and upgrade packages for security
-# Use Alpine edge for latest security patches (curl CVE-2025-14524, zlib CVE-2026-27171, etc.)
-RUN apk add --no-cache python3 make g++ && \
-    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main curl zlib && \
-    apk upgrade --no-cache
-
-# Upgrade npm globally to get fixed versions of bundled packages
-# Fixes CVE-2025-64756 (glob), CVE-2025-64118 (tar)
-RUN npm install -g npm@latest --force && npm cache clean --force
-
-# Fix GHSA-73rr-hh4g-fpgx: Manually update npm's bundled diff@8.0.2 to 8.0.3
-# npm hasn't released a version with diff@8.0.3 yet, so we patch it directly
-RUN cd /usr/local/lib/node_modules/npm && \
-    npm pack diff@8.0.3 && \
-    rm -rf node_modules/diff && \
-    tar -xzf diff-8.0.3.tgz && \
-    mv package node_modules/diff && \
-    rm diff-8.0.3.tgz
-
-# Fix CVE-2026-23950, CVE-2026-24842, CVE-2026-26960, GHSA-qffp-2rhf-9h96: Manually update npm's bundled tar to 7.5.11
-RUN cd /usr/local/lib/node_modules/npm && \
-    npm pack tar@7.5.11 && \
-    rm -rf node_modules/tar && \
-    tar -xzf tar-7.5.11.tgz && \
-    mv package node_modules/tar && \
-    rm tar-7.5.11.tgz
-
-# Fix CVE-2026-27903, CVE-2026-27904: Manually update npm's bundled minimatch to 10.2.4
-RUN cd /usr/local/lib/node_modules/npm && \
-    npm pack minimatch@10.2.4 && \
-    rm -rf node_modules/minimatch && \
-    tar -xzf minimatch-10.2.4.tgz && \
-    mv package node_modules/minimatch && \
-    rm minimatch-10.2.4.tgz
-
-# Copy package files first for better layer caching
-COPY package*.json .npmrc ./
-
-# Install all dependencies (including devDependencies for build)
-# The .npmrc has legacy-peer-deps=true to handle zod peer conflicts
-RUN npm ci
-
-# Remove protobufjs CLI entirely - not needed at runtime
-# Eliminates CVE-2019-10790 (taffydb), CVE-2025-54798 (tmp), CVE-2025-5889 (brace-expansion)
-RUN rm -rf node_modules/protobufjs/cli
-
-# Copy source code
-COPY tsconfig.json tsup.config.ts ./
-COPY src/ ./src/
-
-# Build TypeScript
-RUN npm run build
-
-# Install production-only dependencies in a separate directory for clean copy
-RUN mkdir /app/prod_modules && \
-    cp package*.json .npmrc /app/prod_modules/ && \
-    cd /app/prod_modules && \
-    npm ci --omit=dev && \
-    rm -rf node_modules/protobufjs/cli && \
-    npm cache clean --force
-
-# Strip unnecessary ONNX runtime binaries from production dependencies:
-# - Remove onnxruntime-web entirely (browser-only, not needed in Node.js)
-# - Remove non-Linux platform binaries from onnxruntime-node (darwin, win32)
-RUN rm -rf /app/prod_modules/node_modules/onnxruntime-web \
-           /app/prod_modules/node_modules/.onnxruntime-node-* \
-           /app/prod_modules/node_modules/onnxruntime-node/bin/napi-v3/darwin \
-           /app/prod_modules/node_modules/onnxruntime-node/bin/napi-v3/win32
-
-# Production stage
-FROM node:24-alpine
-
-WORKDIR /app
-
-# Install runtime dependencies with security fixes
-# Use Alpine edge for curl with CVE fixes
-# Explicit libexpat upgrade for CVE-2026-24515 (CRITICAL) and CVE-2026-25210 (MEDIUM)
-# Explicit zlib upgrade for CVE-2026-27171 (MEDIUM)
-RUN apk add --no-cache git ca-certificates && \
-    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main curl libexpat zlib && \
-    apk upgrade --no-cache && \
-    rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
-
-# Copy built artifacts and production dependencies from builder
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/prod_modules/node_modules ./node_modules
-COPY package*.json ./
-COPY LICENSE ./
-
-# Create data directory for SQLite database with proper permissions
-RUN mkdir -p /app/data && chmod 700 /app/data
-
-# Create non-root user for security
-RUN addgroup -g 1001 -S appgroup && \
-    adduser -u 1001 -S appuser -G appgroup && \
-    chown -R appuser:appgroup /app
-
-# Set environment variables
-ENV NODE_ENV=production
-ENV DB_PATH=/app/data/memory_journal.db
-
-# Switch to non-root user
-USER appuser
-
-# Health check — validates Node.js runtime is responsive (sufficient for stdio mode,
-# which is the default transport). For HTTP mode, override in docker-compose.yml with:
-#   healthcheck:
-#     test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
-#     interval: 30s
-#     timeout: 10s
-#     retries: 3
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD node -e "process.exit(0)" || exit 1
-
-# Run the MCP server
-ENTRYPOINT ["node", "dist/cli.js"]
-
-# Labels for Docker Hub
-LABEL maintainer="Adamic.tech"
-LABEL description="Memory Journal MCP Server - Project context management for AI-assisted development"
-LABEL org.opencontainers.image.source="https://github.com/neverinfamous/memory-journal-mcp"
-LABEL io.modelcontextprotocol.server.name="io.github.neverinfamous/memory-journal-mcp"