v0.5.0

Minor release. Adds an optional way to run the nightly dream and weekly maintenance on an Anthropic API key, lets Claude Code cloud sessions feed the dream, and brings every doc back in line with the code.

Upgrade note: :latest was stuck on v0.3.0

On 2026-10-19 the Release workflow was re-run for v0.3.0, v0.3.1 and v0.4.0 at the same time. Every build pushed :latest, and the v0.3.0 build landed last. If you use the default MCP_IMAGE_TAG=latest, you have been running v0.3.0 since then, without the v0.4.0 security and data-integrity fixes. This release moves :latest to v0.5.0. Run docker compose pull && docker compose up -d, or pin MCP_IMAGE_TAG=v0.5.0.

The workflow now adds :latest only for the highest semver tag and runs one release at a time, so re-running an old tag can't roll it back (#49).

What's new

API-key runner for the dream (#45, #46)

Opt-in. The Claude Code scheduled tasks stay the default.

• New graph-dream compose service under the dream profile. It runs the nightly prompt at DREAM_SCHEDULE and the weekly maintenance prompt at DREAM_WEEKLY_SCHEDULE, in DREAM_TZ, through the Messages API. It needs the v0.5.0 image or newer.
• The runner finds pending transcripts itself, so a night with nothing new makes no API call. It pages transcripts through the canonical parser and only sends new messages.
• Cost controls: prompt caching, context editing, a per-run cap (DREAM_MAX_COST_USD, DREAM_WEEKLY_MAX_COST_USD; the model wraps up at 80% and the run stops at 1.5x), and a turn limit.
• File tools are limited to ~/graph-memory (read/write) and ~/.claude/projects (read-only). There is no shell. The key comes from a file and is never logged.
• Optional email through a send-only notify listener (gws-mcp): a summary after every run with its cost and month-to-date spend, the weekly report, and alerts when a run fails or stops early.
• scripts/register-dream-task.ps1 schedules it with Windows Task Scheduler instead of compose.

General task runner (#46)

dist/dream-runner/task.js runs any other scheduled prompt on the same key, with only what its JSON task file grants: file reads under a folder and writes under listed paths, fixed commands with one pattern-checked argument, HTTP to listed URL prefixes (tokens injected by the runner), allowlisted tools from stdio MCP servers, and capped email. scripts/register-api-task.ps1 schedules one.

Cloud sessions feed the dream (#44)

• graph_ingest queue accepts inline content + file_name as well as file_path. Admin tenant only, 2 MB cap, .md/.txt/.json names.
• status returns per-session cursors so a collector only queues what is new.
• New prompts/collect-cloud-sessions.md collects Claude Code cloud and Projects sessions. The nightly dream extracts them as conversation.

Docs (#47, #49)

Every doc was checked against the code and corrected. Among the fixes: MCP_SERVER.md tool count, inputs, outputs and defaults, plus new graph_alias and graph_merge sections; schema docs list 19 node types and 50 edge verbs, the aliases-list model and the real startup schema step; dream and architecture docs use ~/graph-memory paths and document the runner settings; BACKUP.md documents the restore script; TESTING.md and SKILLS.md list everything that exists; TENANT_ID_SOURCE defaults to static.

Other

• plain-tech-docs skill for checking docs for chatbot-sounding prose (#43).
• package.json version now tracks releases (0.5.0).
• Release workflow uses the current docker action majors.

New dependency

@anthropic-ai/sdk, used only by the optional runner. The MCP server itself makes no LLM calls.

Full changelog: v0.4.0...v0.5.0