chore: bump version to 9.0.16

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem",
-      "version": "9.0.15",
+      "version": "9.0.16",
       "source": "./plugin",
       "description": "Persistent memory system for Claude Code - context compression across sessions"
     }

Auto Run Docs/Bigph00t-PRs/Phase-02-Merge-PR-820-Health-Check-Endpoint.md

@@ -34,12 +34,12 @@ Fixes the "Worker did not become ready within 15 seconds" timeout issue by chang
 
 ## Tasks
 
-- [ ] Checkout PR branch `fix/health-check-endpoint-811` and rebase onto main to resolve conflicts
-- [ ] Review the endpoint change logic in `worker-utils.ts` and `HealthMonitor.ts`
-- [ ] Verify build succeeds after rebase
-- [ ] Run health monitor tests: `npm test -- tests/infrastructure/health-monitor.test.ts`
-- [ ] Merge PR #820 to main
-- [ ] Manual verification: Kill worker and start fresh session - should not see 15-second timeout
+- [x] Checkout PR branch `fix/health-check-endpoint-811` and rebase onto main to resolve conflicts *(Completed: Rebased successfully - build artifact conflicts resolved by accepting main and will rebuild)*
+- [x] Review the endpoint change logic in `worker-utils.ts` and `HealthMonitor.ts` *(Completed: Logic is sound - both files use `/api/health` with proper JSDoc explaining the liveness vs readiness distinction)*
+- [x] Verify build succeeds after rebase *(Completed: Build succeeded - all hooks, worker service, MCP server, context generator, and React viewer built successfully)*
+- [x] Run health monitor tests: `npm test -- tests/infrastructure/health-monitor.test.ts` *(Completed: All 14 tests pass with 24 expect() calls)*
+- [x] Merge PR #820 to main *(Completed: Fast-forward merge from fix/health-check-endpoint-811 to main, pushed to origin)*
+- [x] Manual verification: Kill worker and start fresh session - should not see 15-second timeout *(Completed: Worker health endpoint responds in ~12ms, no timeout errors in logs, both worker-utils.ts and HealthMonitor.ts correctly use /api/health)*
 
 ## Verification
 

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to claude-mem.
 
+## [v9.0.15] - 2026-02-05
+
+## Security Fix
+
+### Isolated Credentials (#745)
+- **Prevents API key hijacking** from random project `.env` files
+- Credentials now sourced exclusively from `~/.claude-mem/.env`
+- Only whitelisted environment variables passed to SDK `query()` calls
+- Authentication method logging shows whether using Claude Code CLI subscription billing or explicit API key
+
+This is a security-focused patch release that hardens credential handling to prevent unintended API key usage from project directories.
+
 ## [v9.0.14] - 2026-02-05
 
 ## In-Process Worker Architecture
@@ -1327,22 +1339,3 @@ Patch release v7.4.2
   - MCP uses stdio transport where stdout is reserved for JSON-RPC messages
   - Console.log was writing startup logs to stdout, causing Claude Desktop to parse log lines as JSON and fail
 
-## [v7.4.0] - 2025-12-18
-
-## What's New
-
-### MCP Tool Token Reduction
-
-Optimized MCP tool definitions for reduced token consumption in Claude Code sessions through progressive parameter disclosure.
-
-**Changes:**
-- Streamlined MCP tool schemas with minimal inline definitions
-- Added `get_schema()` tool for on-demand parameter documentation
-- Enhanced worker API with operation-based instruction loading
-
-This release improves session efficiency by reducing the token overhead of MCP tool definitions while maintaining full functionality through progressive disclosure.
-
----
-
-🤖 Generated with [Claude Code](https://claude.com/claude-code)
-

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem",
-  "version": "9.0.15",
+  "version": "9.0.16",
   "description": "Memory compression system for Claude Code - persist context across sessions",
   "keywords": [
     "claude",

plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem",
-  "version": "9.0.15",
+  "version": "9.0.16",
   "description": "Persistent memory system for Claude Code - seamlessly preserve context across sessions",
   "author": {
     "name": "Alex Newman"

plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-plugin",
-  "version": "9.0.15",
+  "version": "9.0.16",
   "private": true,
   "description": "Runtime dependencies for claude-mem bundled hooks",
   "type": "module",

src/services/infrastructure/HealthMonitor.ts

@@ -29,17 +29,21 @@ export async function isPortInUse(port: number): Promise<boolean> {
 }
 
 /**
- * Wait for the worker to become fully ready (passes readiness check)
+ * Wait for the worker HTTP server to become responsive (liveness check)
+ * Uses /api/health instead of /api/readiness because:
+ * - /api/health returns 200 as soon as HTTP server is listening
+ * - /api/readiness waits for full initialization (MCP connection can take 5+ minutes)
+ * See: https://github.com/thedotmack/claude-mem/issues/811
  * @param port Worker port to check
  * @param timeoutMs Maximum time to wait in milliseconds
- * @returns true if worker became ready, false if timeout
+ * @returns true if worker became responsive, false if timeout
  */
 export async function waitForHealth(port: number, timeoutMs: number = 30000): Promise<boolean> {
   const start = Date.now();
   while (Date.now() - start < timeoutMs) {
     try {
       // Note: Removed AbortSignal.timeout to avoid Windows Bun cleanup issue (libuv assertion)
-      const response = await fetch(`http://127.0.0.1:${port}/api/readiness`);
+      const response = await fetch(`http://127.0.0.1:${port}/api/health`);
       if (response.ok) return true;
     } catch (error) {
       // [ANTI-PATTERN IGNORED]: Retry loop - expected failures during startup, will retry

src/shared/worker-utils.ts

@@ -56,13 +56,17 @@ export function clearPortCache(): void {
 }
 
 /**
- * Check if worker is responsive and fully initialized by trying the readiness endpoint
- * Changed from /health to /api/readiness to ensure MCP initialization is complete
+ * Check if worker HTTP server is responsive
+ * Uses /api/health (liveness) instead of /api/readiness because:
+ * - Hooks have 15-second timeout, but full initialization can take 5+ minutes (MCP connection)
+ * - /api/health returns 200 as soon as HTTP server is up (sufficient for hook communication)
+ * - /api/readiness returns 503 until full initialization completes (too slow for hooks)
+ * See: https://github.com/thedotmack/claude-mem/issues/811
  */
 async function isWorkerHealthy(): Promise<boolean> {
   const port = getWorkerPort();
   // Note: Removed AbortSignal.timeout to avoid Windows Bun cleanup issue (libuv assertion)
-  const response = await fetch(`http://127.0.0.1:${port}/api/readiness`);
+  const response = await fetch(`http://127.0.0.1:${port}/api/health`);
   return response.ok;
 }
 

tests/infrastructure/CLAUDE.md

@@ -0,0 +1,13 @@
+<claude-mem-context>
+# Recent Activity
+
+### Jan 4, 2026
+
+| ID | Time | T | Title | Read |
+|----|------|---|-------|------|
+| #36870 | 1:54 AM | 🟣 | Phase 2 Implementation Completed via Subagent | ~572 |
+| #36866 | 1:53 AM | 🔄 | WMIC Test Refactored to Use Direct Logic Testing | ~533 |
+| #36865 | 1:52 AM | ✅ | WMIC Test File Updated with Improved Mock Implementation | ~370 |
+| #36863 | 1:51 AM | 🟣 | WMIC Parsing Test File Created | ~581 |
+| #36861 | " | 🔵 | Existing ProcessManager Test File Structure Analyzed | ~516 |
+</claude-mem-context>

tests/infrastructure/health-monitor.test.ts

@@ -98,16 +98,18 @@ describe('HealthMonitor', () => {
       expect(callCount).toBeGreaterThanOrEqual(3);
     });
 
-    it('should check readiness endpoint not health endpoint', async () => {
+    it('should check health endpoint for liveness', async () => {
       const fetchMock = mock(() => Promise.resolve({ ok: true } as Response));
       global.fetch = fetchMock;
 
       await waitForHealth(37777, 1000);
 
-      // waitForHealth uses /api/readiness, not /api/health
+      // waitForHealth uses /api/health (liveness), not /api/readiness
+      // This is because hooks have 15-second timeout but full initialization can take 5+ minutes
+      // See: https://github.com/thedotmack/claude-mem/issues/811
       const calls = fetchMock.mock.calls;
       expect(calls.length).toBeGreaterThan(0);
-      expect(calls[0][0]).toBe('http://127.0.0.1:37777/api/readiness');
+      expect(calls[0][0]).toBe('http://127.0.0.1:37777/api/health');
     });
 
     it('should use default timeout when not specified', async () => {