Starstruk Logo MarkStarstruk

v12.3.7

thedotmack/claude-memv12.3.7Apr 20, 2026by thedotmack

AI Summary

This release removes bearer token authentication from the worker API and drops the unused platform_source query-time filter from the context injection pipeline, replacing the auth with a simple in-memory rate limiter as a compensating control.

Key Highlights

  • Dropped bearer-token auth from worker API (localhost-only with CORS restrictions)
  • Removed platform_source query-time filter from ContextBuilder, ObservationCompiler, SearchRoutes, and related components
  • Added in-memory rate limiter (300 req/min) as replacement for auth
  • Rate limiter normalizes IPv4-mapped IPv6 and emits Retry-After on 429
  • Cleaned up auth-token.ts and related Authorization header code

Breaking Changes

  • Bearer token authentication removed from worker API - clients using Authorization header will need to update
  • platform_source query filter removed from context injection pipeline

New Features

  • In-memory rate limiter (300 requests/minute) as lightweight security control
  • IPv4-mapped IPv6 normalization in rate limiter
  • Retry-After header on 429 responses
  • Size-guarded prune that never runs on localhost

Full Release Notes

## What's Changed

**Refactor: remove bearer auth and platform_source context filter** (#2081)

- Drop bearer-token auth from the worker API. Worker binds localhost-only and CORS restricts origins to localhost — the token added friction for every internal client (hooks, CLI, viewer, sync script) with no real security benefit for single-user local deployments.
- Drop the unused `platform_source` query-time filter from the `/api/context/inject` pipeline (ContextBuilder, ObservationCompiler, SearchRoutes, context handler, transcripts processor). The DB column stays — only the WHERE-clause filter and its plumbing are removed.
- Replace the removed auth with a simple in-memory rate limiter (300 req/min) as a lightweight compensating control. Limiter normalises IPv4-mapped IPv6, emits `Retry-After` on 429, and has a size-guarded prune that never runs on localhost.

## Cleanup

- Deleted `src/shared/auth-token.ts` and all its dependents (`worker-utils.ts` Authorization header, `ViewerRoutes.ts` token injection, CORS `allowedHeaders: ['Authorization']`, `sync-marketplace.cjs` admin restart header).
- Stopped tracking `.docker-blowout-data/claude-mem.db` and added the directory to `.gitignore`.

## Full Changelog
https://github.com/thedotmack/claude-mem/compare/v12.3.6...v12.3.7