Commit graph

5 commits

Author SHA1 Message Date
Sam Valladares
0e9b260518 chore: remove 3,091 LOC of orphan code + fix ghost env-var docs
Some checks are pending
CI / Test (macos-latest) (push) Waiting to run
CI / Test (ubuntu-latest) (push) Waiting to run
CI / Release Build (aarch64-apple-darwin) (push) Blocked by required conditions
CI / Release Build (x86_64-unknown-linux-gnu) (push) Blocked by required conditions
CI / Release Build (x86_64-apple-darwin) (push) Blocked by required conditions
Test Suite / Unit Tests (push) Waiting to run
Test Suite / MCP E2E Tests (push) Waiting to run
Test Suite / User Journey Tests (push) Blocked by required conditions
Test Suite / Dashboard Build (push) Waiting to run
Test Suite / Code Coverage (push) Waiting to run
Nine tool modules in crates/vestige-mcp/src/tools/ had zero callers after
the v2.0.x unification work shipped *_unified + maintenance::* replacements.
They'd been #[allow(dead_code)]-papered over and forgotten. Verified each
module independently: grep for tools::<name>::, string dispatch in server.rs,
cross-crate usage — all nine returned zero external callers.

Removed modules (all superseded):
  checkpoint (364 LOC) — no callers anywhere
  codebase (298) — superseded by codebase_unified
  consolidate (36) — superseded by maintenance::execute_consolidate
  ingest (456) — superseded by smart_ingest
  intentions (1,093) — superseded by intention_unified
  knowledge (106) — no callers anywhere
  recall (403) — superseded by search_unified
  search (184) — superseded by search_unified
  stats (132) — superseded by maintenance::execute_system_status

Also removed:
  - EmotionCategory::base_arousal (10 LOC, zero callers)

Kept (still string-dispatched from server.rs):
  - context, feedback, memory_states, review, tagging

Doc fixes (ghost env vars that were documented but zero Rust source reads):
  - docs/CONFIGURATION.md — dropped VESTIGE_DATA_DIR, VESTIGE_LOG_LEVEL rows
    (neither is read anywhere; --data-dir CLI flag + RUST_LOG are the real
    mechanisms). Added the full real env-var table.
  - packages/vestige-mcp-npm/README.md — same two ghost rows dropped
  - docs/VESTIGE_STATE_AND_PLAN.md:399 — dropped VESTIGE_DATA_DIR row
  - docs/VESTIGE_STATE_AND_PLAN.md:709 — typo VESTIGE_API_KEY
    -> VESTIGE_AUTH_TOKEN (matches shipping convention), "open if unset"
    -> "auto-generated if unset" to match actual behavior

Verified post-cleanup:
  - cargo check --workspace       clean
  - cargo clippy --workspace -D warnings  clean
  - cargo test --workspace        1,223 passing / 0 failed
  - cargo build --release -p vestige-mcp  clean

Net: -3,091 LOC (14 files), zero behavior change, zero regressions.
2026-04-23 03:18:53 -05:00
Sam Valladares
c6090dc2ba fix: v2.0.1 release — fix broken installs, CI, security, and docs
Critical fixes:
- npm postinstall.js: BINARY_VERSION '1.1.3' → '2.0.1' (every install was 404ing)
- npm package name: corrected error messages to 'vestige-mcp-server'
- README: npm install command pointed to wrong package
- MSRV: bumped from 1.85 to 1.91 (uses floor_char_boundary from 1.91)
- CI: removed stale 'develop' branch from test.yml triggers

Security hardening:
- CSP: restricted connect-src from wildcard 'ws: wss:' to localhost-only
- Added X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy headers
- Added frame-ancestors 'none', base-uri 'self', form-action 'self' to CSP
- Capped retention_distribution endpoint from 10k to 1k nodes
- Added debug logging for WebSocket connections without Origin header

Maintenance:
- All clippy warnings fixed (58 total: redundant closures, collapsible ifs, no-op casts)
- All versions harmonized to 2.0.1 across Cargo.toml and package.json
- CLAUDE.md updated to match v2.0.1 (21 tools, 29 modules, 1238 tests)
- docs/CLAUDE-SETUP.md updated deprecated function names
- License corrected to AGPL-3.0-only in root package.json

1,238 tests passing, 0 clippy warnings.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-01 20:20:14 -06:00
Sam Valladares
ed6aeadb70 feat: add MCPB bundle and fix npm package distribution
Two distribution methods now available:

1. npm (for Claude Code / developers):
   npm install -g vestige-mcp-server
   claude mcp add vestige vestige-mcp -s user

2. MCPB (for Claude Desktop / one-click install):
   Download vestige-1.1.0.mcpb from releases, double-click

Changes:
- Renamed npm package to vestige-mcp-server (vestige-mcp was taken)
- Fixed postinstall to download binaries from GitHub releases
- Added vestige-mcpb package with manifest and build script
- Uploaded .mcpb bundle to v1.1.0 release

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-27 00:15:17 -06:00
Sam Valladares
1e06344319 fix(npm): download binaries during postinstall
The npm package was missing the actual binary download step - users got
wrapper scripts pointing to non-existent binaries.

Changes:
- postinstall.js now downloads correct binary from GitHub releases
- Added vestige.js wrapper for CLI binary
- Exposed both vestige-mcp and vestige commands in package.json
- Updated README with troubleshooting, storage info, CLI docs
- Added .gitignore for downloaded binaries

Fixes fresh install issues where Claude Desktop couldn't attach and
vestige CLI wasn't found.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 23:48:23 -06:00
Sam Valladares
f9c60eb5a7 Initial commit: Vestige v1.0.0 - Cognitive memory MCP server
FSRS-6 spaced repetition, spreading activation, synaptic tagging,
hippocampal indexing, and 130 years of memory research.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 01:31:03 -06:00