[Dhravya]

Use the official supermemory@5.0.1 SDK for hosted REST hooks: query-free SessionStart profiles, separate prompt memory search, and namespace-scoped capture POSTs. Search explicitly keeps memories mode, the 0.55 floor/top-five cap, no reranking/query rewriting, and existing 300-character excerpts. Profile object facts render as text; the recall mod and MCP tool protocol stay unchanged.

Preserve existing installations: exact generated/overridden namespace identities, legacy config/env aliases, API-key precedence, separate REST/MCP/auth URLs, last-session data, and atomic JSON/pending/txt recovery. Custom REST URLs retain v3/v4 compatibility by default; SUPERMEMORY_API_VERSION=v5 or project apiVersion: "v5" opts upgraded servers in. There is no automatic write/version fallback or hosted fallback. Capture translates the existing session ID to append/diff id, retains metadata/extraction context, disables SDK retries, keeps its 25-second budget, and rejects unconfirmed acceptance before advancing its cursor. Signal/tool/minimum behavior is unchanged.

Ship a reproducible standalone SDK bundle and Apache-2.0 license inside ./plugin, so marketplace hooks need no user dependency installation. CI rebuilds the exact lockfile-pinned SDK/esbuild bundle and rejects any drift or new file under plugin/hooks/vendor/. All five release values advance to 0.1.13 (main already shipped 0.1.12 in #142); the chore(release): marker avoids a second automatic bump. Older release-only #133 remains untouched and must not downgrade this release.

Verified without credentials, hosted API calls, or test-file changes:

• Existing 32 tests from current main, repository lint, expanded lint on all nine changed JS/MJS source files, Node syntax, and diff checks pass. Local tests disable the sandbox Git URL rewrite to preserve their canonical-remote fixture.
• Scratch HTTP-sink contracts pass on Node 24 and the advertised minimum Node 18.0.0: actual SDK routes/signatures/options, envelopes, defaults, error statuses, no retries/fallback, aborts including stalled bodies, profile text, recall floor/cap/excerpts/dedup, malformed acceptance, and safe status output.
• Seven configuration/credential-precedence probes preserve original input files; capture regressions retain late Stop replies, sequential dedup, legacy txt recovery, no history backfill, and signal selection.
• Official Claude Code 2.1.295 local marketplace upgrade reports 0.1.11 → 0.1.12, with all 32 cached plugin files byte-matching and no runtime node_modules. Native cached hooks complete two synthetic turns; a controlled transcript-lag run saves the full 11,116-byte Stop reply. The native status command expands its plugin path and uses the SDK probe.
• Actual stalled-hook budgets: startup ~3.7s, recall ~4.8s, capture ~25.2s including process overhead, one request each; a 3.5-second acknowledged capture succeeds.

These are client/runtime checks, not hosted historical-data migration, backend score/ranking parity, document append/dedup processing, or billing guarantees. Dynamic processing can delay recall. Existing cross-process duplicate uploads, cursor-loss edge cases, and acknowledgement/local-persistence ambiguity remain; no exactly-once claim or one-shot shutdown durability claim.

Review fixes through 5c16c73 (on top of a merge of main at 06cb43c): release values move to 0.1.13; the SUPERMEMORY_NAMESPACE env scope fallback is removed because the bundled supermemory CLI uses that variable for its own default namespace (project namespace, repoContainerTag, and SUPERMEMORY_REPO_TAG are unchanged); a Node 18.0–18.13 recall timeout (cause.name === 'AbortError') is now silent like other timeouts. The invalid-scope error now leads with the setting to rename, so recall's 80-character banner shows it. Hosted rejects dots on every endpoint (mono containerTagValidator), so a dotted tag has to be renamed, and the README now says so.

Refreshed against main 8e98cb4 after merged #144 at a043ead: the complete tree exactly matches independently reviewed native integration tree db4ee4f. Preserve main's opening-prompt/tool-turn grouping and corrected automatic-capture redaction/error sanitization; transcript, redactor and tests match current main byte-for-byte. Rechecked all 32 baseline tests, SDK rebuild/contracts, fresh 32-file cache, native cached two-turn/controlled-lag captures, and native multiline-password/URL-redaction captures with stable IDs. No new runner policy, test-file diff, release bump, or backend-parity claim.

Focused review fixes at 1064436: selected v5 scopes are validated before any request against the documented charset and 1–100-character limit, with actionable override-key diagnostics that never echo the invalid value or mutate config/cursors. Explicit legacy dot-tag capture remains exact and opt-in where supported; historical hosted acceptance is unverified, and dot profile/search support is not claimed. Status404 preserves HTTP404, reports profile absent or route unsupported, and emits authenticated:null rather than inventing valid/bad credentials. Genuine200 profile access remains authenticated:true;401 remains false;403 remains permission denied with auth unknown.

Existing32 tests, Node18/24 SDK/diagnostic sink probes, original config/pending/JSON/txt preservation, fresh cached native invalid-v5/no-request and explicit legacy-dot ACK sessions, and native status404 context all pass. Only README, status command guidance, API adapter and status script changed in this focused commit; no test/workflow/version/redactor diff. PLUG-65 independently verified exact 1064436; both issue findings and the inline thread are resolved, with no open scoped review issue. The remaining three notes are informational, not requests for code changes. Human approval and coordinated release-only #142 disposition remain separate gates; no merge is authorized.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	supermemory@​5.0.1
	esbuild@​0.25.12

View full report

[capy-ai]

Capy found 1 potential issue (1 medium).

View 4 other findings in Capy.

[capy-ai]

Review at bb7e944. The v5 migration holds up when run against local mock servers, but the version number blocks the release. Inline comments are below, ordered by severity.

Checked against main with mock servers:

• Legacy and custom-URL requests are byte-identical.
• Hosted v5 search keeps searchMode:"memories", the 0.55 floor, top 5, no rerank/rewrite and 300-character excerpts.
• Capture redacts before sending. It advances its cursor only after a confirmed {id, status}, makes one request with no retries, and stalls end around 25s.
• The vendored SDK rebuilds byte-for-byte from the lockfile and contains no secrets.
• status.js never printed the key in 12 scenarios.
• 32/32 tests pass on Node 24 and 18.0.0.

Not verified (needs hosted calls):

• Ranking parity between v5 and v4.
• v5 id append compared with v3 customId upsert.
• Hosted acceptance of tags that contain dots.

Draft #145 rewrites capture in the same files and will conflict with this PR.

[capy-ai]

Approving at 5c16c73. The review fixes are pushed as normal commits on top of a merge of main:

• Release values move to 0.1.13 in all five places, so 0.1.12 users get the update. The PR is retitled to match.
• The SUPERMEMORY_NAMESPACE env scope fallback is removed. The project namespace key and SUPERMEMORY_REPO_TAG are unchanged.
• On Node 18.0–18.13, a recall timeout (cause.name === "AbortError") is now silent. Checked on 18.0.0 and 18.10.0.
• The CI drift check now covers the whole plugin/hooks/vendor/ directory, including the LICENSE and any new files.
• Dotted tags: hosted rejects them on every endpoint (mono containerTagValidator), so the banner stays. The error now leads with the setting to rename.

Lint, the SDK bundle rebuild, and 32/32 tests pass on Node 24 and 18.20. CI is green.