Skip to content

Mooncite 4.0.2

Choose a tag to compare

View all tags
@WhenMoon-afk WhenMoon-afk released this 18 Aug 07:45
· 8 commits to main since this release
v4.0.2
fea0283

Summary

Mooncite 4.0.2 fixes secure activation when a user's XDG base directory is group-writable but protected by an owner-private ancestor.

What changed

  • Accepted group-writable XDG base directories only when an earlier owner-private ancestor prevents pathname replacement.
  • Validated the complete owner and permission chain from filesystem root to each installation, state, and source-configuration path.
  • Rejected untrusted ancestor owners and non-sticky shared writable ancestors.
  • Kept installation, package, state, marker, registration-journal, and configuration targets private.

User impact

Users whose securely confined XDG directories were incorrectly rejected by 4.0.1 can install Mooncite normally with this release. Unsafe path chains remain rejected.

Install this tagged release

npx --yes github:WhenMoon-afk/claude-memory-mcp#v4.0.2 install

Verification

The Linux typecheck, 31-test suite, build, and isolated packed-install smoke passed for this tag. Version 4.0.3 later added clean MCP shutdown and stale-lock recovery.

Assets 2
Loading