What's new since v1.0.6
Features
- Session lifecycle hooks (session-start / session-end): Claude Code auto-injects memories at start, summarizes on end via ~/.claude/settings.json hooks
- Generic MCP adapter base class; existing adapters refactored onto it
- projectId derivation: basename + SHA-256(normalized path).slice(0,8), Windows/UNC normalization, SESSIONMEM_PROJECT_ID env override
- injectionCap config key: sessionmem config set injectionCap <100-10000>
- listMemories pagination: optional limit (default 200, max 1000), response includes total
- Lossless export/import: exportMemories/getMemory/storeMemory return full content, no 2000-char truncation
- ingestSessionEvents dedup: INSERT OR IGNORE + unique index (migration 009)
- FTS5 recency filter fix: corrected datetime format mismatch
- Re-embed on redact: redactExisting re-embeds after content scrub
- Atomic policy config writes: temp-file + renameSync
- Error hardening: fs paths no longer leaked to MCP clients
- Startup injection sanitization: control chars stripped, kind validated against allow-list
- Extended redaction: Stripe live keys and npm tokens, bounded quantifiers (no ReDoS)
Security hardening (21-round audit)
- sessionId/memoryId/originProjectId capped at 200 chars
- ingestSessionEvents array capped at 500 events
- sourceAdapter validated against control-char regex
- fetch_memories query bounded min(1)/max(1000)
- Semgrep path-traversal false positives suppressed inline
CI / deps
- actions/checkout v7, actions/setup-node v6, typescript-eslint 8.61.1
- workflow_dispatch with OTP input for npm 2FA
- Trivy v0.36.0
Tests
- 449 tests, 85 test files (+13 new)
- Integration: Claude Code hook install/uninstall, FTS fallback union
- Unit: session-start/end, projectId, ingestSessionEvents cap+idempotency, listMemories pagination, full-content export round-trip, Stripe/npm redaction
Upgrade
npm install -g sessionmem@1.1.2
sessionmem install claude-code # re-run to add session hooks