snipara-companion 3.5.2 → 3.5.3

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Release notes for `snipara-companion`, newest first.
 
+## New In 3.5.3
+
+- Propagates the configured Companion `sessionId` as
+  `X-Snipara-Session-Id` on Hosted MCP calls.
+- Labels supported retrieval calls as `snipara-companion` while preserving an
+  explicit caller-provided client label and correlation context.
+- Keeps correlation telemetry-only and project-scoped; authentication and
+  ranking promotion remain separate contracts.
+
 ## New In 3.5.2
 
 - Replaces the retired Windsurf preset with Kimi Code CLI across setup,

package/README.md

@@ -60,6 +60,10 @@ same value as `correlation_context.session_id` on retrieval tools.
 
 The identifier is opaque, project-scoped telemetry. It does not grant access or
 change authorization, and explicit per-call correlation remains authoritative.
+Companion also forwards its configured `sessionId` automatically on every
+Hosted MCP call and labels supported retrieval traffic as
+`snipara-companion`, unless the caller supplied an explicit client label. This
+improves join coverage without inventing a second server-side identity.
 
 Example output excerpt:
 

package/dist/index.js

@@ -522,6 +522,27 @@ function readGitRemote(cwd) {
 }
 
 // src/api/client.ts
+var CORRELATED_RETRIEVAL_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "snipara_context_query",
+  "snipara_ask",
+  "snipara_search",
+  "snipara_recall",
+  "snipara_get_chunk",
+  "rlm_context_query",
+  "rlm_ask",
+  "rlm_search",
+  "rlm_recall",
+  "rlm_get_chunk"
+]);
+function withCompanionRetrievalClient(toolName, args) {
+  if (!CORRELATED_RETRIEVAL_TOOL_NAMES.has(toolName) || args.client !== void 0) {
+    return args;
+  }
+  return {
+    ...args,
+    client: "snipara-companion"
+  };
+}
 function getSniparaTokenStorePath() {
   return path3.join(os2.homedir(), ".snipara", "tokens.json");
 }
@@ -743,7 +764,7 @@ var RLMClient = class {
       method: "tools/call",
       params: {
         name: toolName,
-        arguments: args
+        arguments: withCompanionRetrievalClient(toolName, args)
       }
     };
     const controller = new AbortController();
@@ -754,7 +775,8 @@ var RLMClient = class {
         {
           method: "POST",
           headers: {
-            "Content-Type": "application/json"
+            "Content-Type": "application/json",
+            ...this.config.sessionId ? { "X-Snipara-Session-Id": this.config.sessionId } : {}
           },
           body: JSON.stringify(payload),
           signal: controller.signal

package/docs/FULL_REFERENCE.md

@@ -913,6 +913,12 @@ headers, pass the same value as `correlation_context.session_id` on
 `snipara_context_query`, `snipara_recall`, `snipara_search`, `snipara_ask`, and
 `snipara_get_chunk`.
 
+Companion's own Hosted MCP client always forwards the configured workspace
+`sessionId` as `X-Snipara-Session-Id`. For the five correlated retrieval tools,
+it also supplies `client: "snipara-companion"` when the caller did not provide a
+client label. The session value is telemetry-only: it never authenticates the
+request, changes project scope, or overrides explicit per-call correlation.
+
 OpenClaw hooks remain separate:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snipara-companion",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "description": "Local-first CLI that asks your repo what breaks before an AI coding agent edits it.",
   "main": "dist/index.js",
   "bin": {