# v5.0.0 — Major Architecture & Security Release

**Release Date:** March 6, 2026

This is a major release featuring a complete architectural overhaul, comprehensive security hardening, a new E2E test suite, redesigned team collaboration, and deterministic error handling across all 42 tools.

## ✨ Highlights

- **Architecture Overhaul** — Tool handler monolith (3,428 lines) split into 12 focused modules. Resource handlers, prompt handlers, types, mutation tools, and HTTP transport all modularized similarly.
- **Team Collaboration Redesign** — Rebuilt from scratch with separate team database (`TEAM_DB_PATH`), author attribution, cross-DB search, and 3 dedicated tools (`team_create_entry`, `team_get_recent`, `team_search`).
- **Deterministic Error Handling** — All 42 tool handlers wrapped with `formatHandlerError()` returning structured `{ success: false, error }` responses. Dual-schema validation pattern ensures Zod errors also produce structured responses.
- **20+ Security Improvements** — Bearer token authentication, HSTS, timing-safe token comparison, shell-free git detection, Docker hardening, CI pipeline action pinning, and more.
- **Playwright E2E Test Suite** — 8 spec files (47 tests) testing HTTP/SSE transport end-to-end: health, protocols, security headers, auth, sessions, tools, resources, stateless mode, and scheduler.
- **Dual HTTP Transport** — Streamable HTTP (`/mcp`) + Legacy SSE (`/sse`) running simultaneously in stateful mode.

## 🆕 Added

- **Playwright E2E Test Suite** — `health.spec.ts`, `protocols.spec.ts`, `security.spec.ts`, `auth.spec.ts`, `sessions.spec.ts`, `tools.spec.ts`, `resources.spec.ts`, `stateless.spec.ts`, `scheduler.spec.ts`
- **Legacy SSE Transport** — `GET /sse` + `POST /messages?sessionId=<id>` for backward-compatible MCP 2024-11-05 clients (stateful mode only)
- **Health Endpoint** — `GET /health` returns `{ status: "healthy", timestamp }`
- **Root Info Endpoint** — `GET /` returns server name, version, endpoints, docs link
- **404 Handler** — Unknown paths return `{ error: "Not found" }`
- **`DB_PATH` Environment Variable** — Database path via env block (precedence: CLI `--db` > `DB_PATH` > `./memory_journal.db`)
- **`--auth-token` CLI Option** — Bearer token authentication for HTTP transport (`MCP_AUTH_TOKEN` env)
- **`Permissions-Policy` Header** — 6th security header: `camera=(), microphone=(), geolocation=()`
- **Team Collaboration** — `TEAM_DB_PATH`, `TEAM_AUTHOR`, `share_with_team`, `memory://team/recent`, `memory://team/statistics`
- Tool count: 39 → 42 · Tool groups: 8 → 9 · Resources: 20 → 22

## 🔒 Security

- **Trigger Name Validation** — `SAFE_IDENTIFIER_RE` regex in `migrateSchema()` prevents SQL injection via crafted trigger names
- **Query Limit Caps** — `.max(500)` on all `limit` parameters (10 schemas)
- **TruffleHog Pinned** — `@main` → `@v3.93.7`
- **Docker Scout Official Action** — Replaces `curl | sh` installer with `docker/scout-action@v1.18.2`
- **Gitleaks Blocking** — Removed `continue-on-error: true`; leaks now fail the workflow
- **Gitleaks Pinned** — `@v2` → `@v2.3.9`
- **Bearer Token Auth** — Optional `--auth-token` with `MCP_AUTH_TOKEN` env support
- **SSE Session Timeout** — Legacy SSE sessions expire after 30 min idle
- **`searchByDateRange` Limit** — `LIMIT 500` prevents unbounded result sets
- **Docker Production-Only Dependencies** — `npm ci --omit=dev` in production image
- **CORS `Authorization` Header** — Added for bearer token support
- **Timing-Safe Auth** — `crypto.timingSafeEqual()` for token comparison
- **HSTS Header** — Conditional `Strict-Transport-Security` behind reverse proxy
- **Docker Compose Hardening** — `read_only: true`, `tmpfs`, generic token placeholder, explicit `NODE_ENV`
- **Shell-Free Git** — `execFileSync('git', [...])` replaces `execSync('git config ...')`

## ⚡ Improved

- **Batch Tag Fetching** — N+1 elimination: `getRecentEntries(50)` reduced from 51 queries to 2
- **Batch Tag Linking** — Single `INSERT OR IGNORE` + `SELECT ... WHERE name IN (...)`
- **Tool Dispatch Cache** — O(1) `Map` lookup instead of rebuilding 42 definitions per call
- **Conditional JOIN in `searchByDateRange`** — Tag tables only JOINed when tag filter provided
- **Consolidated `getStatistics` Queries** — 5 sequential `db.exec()` → 3 with `SUM(CASE ...)`
- **Dual-Schema Validation** — Relaxed schemas for SDK, strict schemas in handlers

## 🐛 Fixed

- **Entry Type Enum** — Added 6 missing types (`technical_note`, `development_note`, `enhancement`, `milestone`, `system_integration_test`, `test_entry`)
- **`get_github_milestones` State Filter** — `state: "all"` no longer silently defaults to `"open"`
- **Legacy Database Migration** — `migrateSchema()` adds missing columns + drops FTS5 triggers
- **`list_tags` Null Count** — `COALESCE(usage_count, 0)` prevents null validation failures
- **Output Schema Error Responses** — All schemas now accept `{ success: false, error }` responses
- **Multi-Session Connect Crash** — Close-before-reconnect pattern for concurrent HTTP sessions
- **Backup Error Path** — Error responses now pass Zod output validation
- **`share_with_team` Not Setting `isPersonal`** — Fixed `create_entry` with `share_with_team: true`
- **Legacy SSE `start()` Redundancy** — Eliminated duplicate `sseTransport.start()` call

## 🔄 Changed

- **HTTP Transport Modularized** — `McpServer.ts` (813 → ~450 lines) → `src/transports/http.ts`
- **`ToolDefinition.handler` Return Type** — `Promise<unknown>` → `unknown` (supports sync+async)
- **Dependency Updates** — `@types/node` 25.3.3→25.3.5, `express-rate-limit` 8.2.1→8.3.0, `sql.js` 1.14.0→1.14.1

## 🗑️ Removed

- Legacy team collaboration system (rebuilt from scratch)
- Tool handler monolith `src/handlers/tools/index.ts` (replaced by 12 modules)
- Unused `cors` and `@types/cors` packages
- Database files reorganized into `data/` directory

## 🔄 CI/CD

- **CodeQL Default Setup Disabled** — Custom workflow is now sole scanner
- **CodeQL `actions` Language** — Added to replace Default Setup coverage
- **Trivy Action** — 0.34.0 → 0.34.1

## 📖 Documentation

- Cursor Rule for session management (`hooks/cursor/memory-journal.mdc`)
- Revised hooks/README.md with progressive enhancement model
- SECURITY.md rewritten for current architecture
- Team collaboration documented in READMEs
- Wiki security page expanded (16-item checklist)

---

**Full Changelog:** [v4.5.0...v5.0.0](https://github.com/neverinfamous/memory-journal-mcp/compare/v4.5.0...v5.0.0)

**Install/Update:**

```bash
npm install -g memory-journal-mcp@5.0.0
# or
docker pull writenotenow/memory-journal-mcp:v5.0.0
```
