v13.19.0

thedotmack/claude-memv13.19.0Aug 31, 2026by thedotmack

AI Summary

This release introduces a user-friendly one-click restart mechanism for the memory worker via a new web interface, alongside improved UI for outage warnings and enhanced safety checks for the restart process.

Key Highlights

Added a web interface (`GET /restart`) to restart the memory worker with a single click.
Updated outage warnings to be more visible by moving them below injected context and displaying them in red in the terminal.
Enhanced security for the restart endpoint with frame protection and a POST requirement behind user clicks.
Updated `/health` endpoint to report the process ID (pid) to verify the successor process is running.
Implemented a readiness check requiring both a new pid and a bound port on `/api/readiness`.

New Features

One-click worker restart via web interface.
Improved outage warning visibility (red text, moved position).
Enhanced security for restart endpoint (X-Frame-Options, frame blocking).
/health endpoint now exposes process ID.
Readiness check now validates port binding alongside process ID.

Full Release Notes

## Restart the memory worker in one click

When the observer stops saving, the outage warning used to point at
`~/.claude-mem/settings.json`. A restart clears nearly every one of these
outages (a wedged or SIGKILL'd provider subprocess), so the warning now leads
with the restart, offered two ways:

```
Restarting the memory worker clears almost every outage. Do one of these:
  Click to restart:  http://localhost:37777/restart
  Or in a terminal:  npx claude-mem restart

Still failing after the restart? Run: npx claude-mem doctor
```

`GET /restart` serves a page whose button restarts the worker and waits until
the replacement is actually up before telling you so.

### The warning is also easier to see

- **Moved below the injected context.** The timeline runs long enough that a
  warning at the top had already scrolled off by the time context finished
  printing.
- **Shown in red** in the terminal. The agent's copy stays clean — ANSI escapes
  there are just noise in the model's context.

### Safety notes

The restart page is deliberately conservative:

- The `GET` is inert. Restarting is a `POST` behind a real click, so a page that
  merely names the URL in an `<img>` cannot bounce your worker.
- The route refuses to be framed (`frame-ancestors 'none'`, `X-Frame-Options:
  DENY`), so an attacker cannot frame it and harvest the click through an
  overlay.
- Success requires the successor, not the corpse: a *different* pid on `/health`
  (the dying worker answers for the whole graceful-shutdown window) **and**
  `/api/readiness` ok (a bound port is not a ready worker).

`/health` now reports `pid` to make that check possible.