Package-facing patch bump so 13.24.17 ships #4026/#3575 (health probe deadline cap), #3445 (desktop-bundled Codex CLI on macOS), and #4027 (register memory_session_id, do not re-register). Rebuilds plugin bundles so the injected version matches.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Package-facing patch bump so 13.24.15 ships #3727 / #3706 (daemon no longer inherits user project cwd). Rebuilds plugin bundles so the injected version matches.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Package-facing patch bump so 13.24.14 ships the commits now on main after v13.24.13. Rebuilds plugin bundles so the injected version matches.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Pin shell-quote to 1.9.0 in the plugin manifest, lockfile, root
devDependency, and build-hooks generator so a normal build cannot
regenerate the CVE-affected ^1.8.3 range.
Rebase of #3646.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Package-facing patch bump so 13.24.13 ships the commits now on main after v13.24.12. Rebuilds plugin bundles so the injected version matches.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Package-facing security patch for the #3861 / #3985 credential-leak fixes
(unauthenticated /api/settings redaction, MCP workspace containment, host
bind tightening). Publish-ready; do not npm publish from this PR.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* docs(ccs-align): Phase 3 verify/sign-off — mark Phases 0-2 shipped, honest 'what this is not', worker-lag ops MISS
Phase 3 closes the plan loop with no new runtime surface:
- SKILL.md: heading + status now reflect Phases 0-2 shipped (#3934/#3935/#3936)
and Phase 3 = verify/sign-off; add explicit 'What this is NOT' (no compiler,
no brainbeat product, no attention trough, no Focus/mouth, no second LFG
writer, no history rewrite); record running-worker 13.24.1 vs repo version lag
as an ops MISS to roll up (worker restart is a hard forbid for this seat).
- plan: status PLAN ONLY -> PASSED & SHIPPING (Phases 0-2 merged; Phase 3 verify).
Defaults table and history preserved.
- Address the human as Alex.
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* chore: bump version to 13.24.5
PATCH bump for CCS Align Phase 3 sign-off (D10 — skill + plan ship, no
product claim). CHANGELOG.md left untouched (generated).
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* feat(ccs-align): Phase 2 rules alignment — house → project → seat conflict walk
Walk house → project → seat layers, detect four conflict classes
(SHADOW_HOUSE, DENY_ALLOW, DRIFT, CLOCK_HEADER), emit an append-only
rules-report.md, and optionally apply SHADOW_HOUSE leaf patches
when CLAUDE_MEM_CCS_ALIGN_PATCH_SHADOWS=true.
- CcsAlignRulesWalker.ts: cascade rules checklist (not a parser),
layer walk with MISS recording, conflict detection, atomic report
append, gated shadow patch with forbidden-target guards
- 26 tests covering all four conflict classes, patch on/off,
standing/always/never safety, MISS on absent paths, append-only
report, edge cases
- SKILL.md updated with Phase 2 docs, conflict table, programmatic
usage, cadence note (every 6th hour), and verification greps
Implements plans/2026-09-09-ccs-align.md §2.1–2.3.
No Focus, no attention trough, no .cas compiler, no history deletes.
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* chore: bump version to 13.24.4
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Phase 1 of the CCS Align plan of record (plans/2026-09-09-ccs-align.md §1.1–1.4):
Exclude marks filter the *compiled* middle cache — the diary / SQLite stay
authoritative. A mark records observation ids and tool-use ids; the
grab→append→replace pipeline drops marked records so they never appear in
the compiled middle.jsonl. Unmarking + rebuild restores them from the diary
on the next pull. DELETE /api/observation/:id remains FORBIDDEN.
Implements:
- ExcludeMark type + exclude-marks.json schema (v:1)
- readExcludeMarks / writeExcludeMarks / addExcludeMark / removeExcludeMark
- buildExcludeSet for the atomic pipeline
- appendMiddleCacheRecordsAtomic now filters by exclude set
- landObservationsInMiddleCache loads marks and applies them
- rebuildMiddleCache for unmark+rebuild path
- Skill updated for Phase 1: exclude-marks section, layer-4 get_tool_uses
warning (mark-time only), viewer isolation, unmark+rebuild, purge tools
- 11 new Phase 1 tests: mark drop, diary present, tool ids never in
middle.jsonl, viewer isolation, unmark+rebuild, exclude-marks round-trip,
buildExcludeSet, secure-isolation reason, corrupt marks fail-closed,
marked ids skipped on ingest
Hard forbids verified:
- No DELETE /api/observation (compile-time omit, not tombstone)
- No LFG/Orifice [awareness] writes
- No profile.md touch
- No sixth processAgentResponse consumer
- No CHANGELOG hand-edit
- No 'Az' in user-facing strings
PATCH bump: 13.24.2 → 13.24.3
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* feat(ccs-align): seat-owned middle cache helper + settings (Phase 0)
Copy the #3931 atomic append primitive (appendAwarenessLineAtomic /
awarenessLineBody / formatAwarenessLine) into a seat helper with the three
locked Phase 0 changes: tag [ccs-align], seat-owned path root
~/.claude-mem/ccs-align/<viewerId>/, and a middle.jsonl store. Grab -> append
-> replace is atomic (temp + renameSync), deduped by observation id and by
date-excluded body. Path safety refuses profile.md, agents/**/memory/log, and
any write outside the seat root; the lander never throws into the caller.
Adds CLAUDE_MEM_CCS_ALIGN_{ENABLED,VIEWER_IDS,TRIGGER_TYPES,PATCH_SHADOWS}
defaults (needle types copied from the Grok list per D6).
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* docs(skill): add ccs-align SKILL.md with hourly Worker Watch runbook
Phase 0 breathing slice: resolve worker port (timeline-report snippet),
prefer GET /api/health, pull search -> timeline -> get_observations, land
observations in the seat middle cache, update cursor.json. Documents the
Appendix A hourly cycle, settings, hard forbids, and later-phase stubs.
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* test(ccs-align): middle-cache format/needle/append/dedupe/path-safety
Copies the #3931 pusher test patterns: [ccs-align] format + 500-char
truncate, needle match, atomic append, id/body dedupe across days, path
safety (never profile.md / agents/memory/log / outside root), never-throw,
D2 append-only fallback, and cursor.json round-trip.
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* chore: bump version to 13.24.2 (PATCH — CCS Align Phase 0 code ships)
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
* chore: sync marketplace.json + plugin/package.json to 13.24.2
Version Consistency CI flagged .claude-plugin/marketplace.json still at
13.24.1 after the 13.24.2 bump. sync-plugin-manifests.js does not stamp
marketplace.json or plugin/package.json, so bring both source files in line
with root package.json. The worker-service.cjs stamp is regenerated by
'npm run build' in CI before the test runs.
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Patch release so marketplace and npm installs actually pick up the rebuilt
plugin bundles from #3878. 13.24.0 shipped manifests that claimed 13.24.0
while plugin/scripts/*.cjs still carried 13.23.1 bytes; the artifacts were
corrected in place, but existing 13.24.0 installs have no version change to
trigger an upgrade. 13.24.1 gives them one.
Version bumped across all 11 manifests and the README badge, then
regenerated via `npm run build-and-sync`. All four .cjs bundles are
byte-identical to 13.24.0 after normalizing the version string -- no source
changed since 4da9ffc6, so this is a pure version delta.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fu9bpdG4AWZNq3m8zkUkYg
Catch GitHub up to the already-published npm 13.24.0. Updates every version
manifest and adds the 13.24.0 changelog for PR #3842.
Co-authored-by: Alex Newman <thedotmack@users.noreply.github.com>
Minor rather than patch: adds the user-facing setting
CLAUDE_MEM_OBSERVER_MAX_CONVERSATION_CHARS and changes observer prompt content
(the <session_so_far> seed block), on top of the cost fixes.
Rebuilds the shipped plugin/scripts bundles so the released plugin actually
carries the observer changes, matching the previous bump commit's shape.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ERvWLxiY96C7pJrx7hPjh8
Windows users cannot build and test claude-mem from source. `npm install`
and `npm run build` already work on native Windows (windows.yml proves it
on every PR), but every step after them is bash-only:
- sync-marketplace.cjs shelled out to the rsync binary, which does not
exist on Windows and is not installed by anything in this repo. Git for
Windows does not bundle it.
- build-and-sync used `cd ~/.claude/plugins/...`, and the sync script's
own execSync calls passed `~` paths to the shell. `~` is bash-only home
expansion.
- worker:logs / worker:tail used `tail` and `date +%Y-%m-%d`.
Replaces rsync with scripts/mirror-dir.cjs, a stdlib-only mirror that
reproduces `rsync -a --delete --exclude=...`: the same pattern syntax
(anchored `/x`, dir-only `x/`, basename-at-any-depth, `*` / `**` / `?`),
the same size+mtime quick check, and crucially the same receiver-side
protection, so `--delete` still refuses to remove excluded paths like the
marketplace's .git and node_modules. Verified byte-identical against real
rsync over the whole repo tree (1125 entries: paths, types, sizes, modes,
mtimes, content hashes, symlink targets) and again after planting stale
and protected files in both destinations.
Home-relative paths now go through os.homedir() and cwd instead of the
shell. worker:logs becomes scripts/worker-logs.cjs, which also fixes the
pre-existing `tail -f 50` typo in worker:tail.
Windows CI now runs the real sync script against a scratch USERPROFILE
and asserts the --delete semantics, runs the mirror tests, and exercises
the log tail - the sync path was previously untested on Windows, which is
how this shipped in the first place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Alex Newman