# v4.5.0 - Automated Scheduling, Security Hardening & Quality Improvements

**Released: March 2, 2026**

## Highlights

### ⏰ Automated Scheduler (HTTP/SSE Only)

New in-process scheduler runs periodic maintenance jobs for long-running HTTP/SSE server processes:

- `--backup-interval <minutes>` — Automated database backups with cleanup
- `--keep-backups <count>` — Max backups to retain (default: 5)
- `--vacuum-interval <minutes>` — Database optimization (`PRAGMA optimize`)
- `--rebuild-index-interval <minutes>` — Full vector index rebuild

Each job is error-isolated. Status visible via `memory://health`.

### 🔒 Security Hardening

Comprehensive security improvements across the entire stack:

- **HTTP Transport** — Rate limiting (100 req/min), CSP headers, Cache-Control, Referrer-Policy, CORS wildcard warning
- **Input Validation** — `entry_type` and `significance_type` now constrained to Zod enums; date format validation via regex
- **Dead Code Wiring** — `sanitizeSearchQuery()` and `assertNoPathTraversal()` now active in code paths
- **Foreign Keys** — `PRAGMA foreign_keys = ON` enforced at database initialization
- **Path Traversal** — `exportToFile()` now protected with `assertNoPathTraversal()`
- **Logger Hardening** — `LOG_LEVEL` validated; `setLevel()` guarded against invalid values
- **Removed dead code** — SQL injection detection functions that provided false sense of security
- **CI** — Blocking `npm audit` and TruffleHog steps; Node.js test matrix aligned to `>=24.0.0`

### ✅ Test Coverage → 92%

Expanded test suite from 549 → 590 tests, raising line coverage from 88.59% → 92.06%:

- SIGINT shutdown handlers for all three transport modes
- Prompt handlers with proper arguments
- `SqliteAdapter` backup edge cases
- GitHub integration error paths

### 📝 Cursor Rule for Session Management

Added `hooks/cursor/memory-journal.mdc` — an `alwaysApply` Cursor rule that instructs agents to read `memory://briefing` at session start and create a retrospective at session end. This is the most reliable mechanism for session behavior in Cursor.

## Added

- **Automated Scheduler** — `Scheduler.ts` module with CLI flags for backup, vacuum, and index rebuild intervals
- **Cursor Rule** — `hooks/cursor/memory-journal.mdc` for reliable session management
- **Cursor `sessionEnd` Hook** — `hooks/cursor/hooks.json` + `session-end.sh` audit script

## Improved

- **Test Coverage** — 88.59% → 92.06% line coverage (549 → 590 tests)
- **Database I/O** — Debounced `scheduleSave()` reduces disk writes on rapid mutations
- **Vector Index Rebuild** — Paginated fetching (200/page) + parallel batch embedding (5 at a time)
- **Server Startup** — Eliminated duplicate `getTools()` call
- **GitHub API** — TTL response cache (5 min) with automatic invalidation on mutations

## Fixed

- **Session Start briefing in Cursor** — Added `user-memory-journal-mcp` server name for Cursor compatibility
- **`deleteOldBackups` Test Isolation** — Fixed flaky test by cleaning up pre-existing backups
- **`share_with_team` Not Setting `isPersonal`** — `create_entry` with `share_with_team: true` now correctly sets `isPersonal: false`
- **Path Traversal Test Assertion** — Updated to assert `PathTraversalError` type
- **Tool Handler Test Fix** — Updated to use valid `entry_type` enum value

## Security

- Wire dead-code security utilities (F-001, F-002)
- HTTP security headers: CSP, Cache-Control, Referrer-Policy (F-003)
- `PRAGMA foreign_keys = ON` (F-005)
- CORS wildcard warning (F-006)
- `entry_type` / `significance_type` enum constraints
- Date format validation on all date string fields
- HTTP rate limiting (100 req/min per IP)
- Remove dead SQL injection detection code
- `exportToFile()` path traversal protection
- `getRawDb()` safety documentation
- Logger `LOG_LEVEL` validation (L1) and `setLevel()` guard (L2)
- CI `security-scan` Node version alignment (L3)

## Changed

- `@types/node`: 25.3.2 → 25.3.3 (patch)
- `globals`: 17.3.0 → 17.4.0 (minor)
- `minimatch` override: 10.2.3 → 10.2.4 (patch)
- `tar` override: 7.5.8 → 7.5.9 (patch)

## Removed

- **Unused `cors` dependency** — CORS handled by custom middleware

## CI/CD

- Removed Dependabot auto-merge workflow
- Trivy Action updated to 0.34.0
- Node.js test matrix aligned: `[24.x, 25.x]`
- Blocking `npm audit` in CI pipeline
- Blocking TruffleHog secret scanning

## Documentation

- Revised `hooks/README.md` with progressive enhancement model
- Updated Session Management in README.md and DOCKER_README.md
- SECURITY.md rewrite for TypeScript era
- Team collaboration in READMEs with wiki links
- Rate limiting documentation

---

```bash
# npm
npm install -g memory-journal-mcp@4.5.0

# Docker
docker pull writenotenow/memory-journal-mcp:v4.5.0
```
