feat: migrate Codex REST to official SDK v5

[Dhravya]

Migrate document capture, profiles, search, the raw recall path, the status probe, and retained library helpers to exact-pinned supermemory@5.0.1. Requests use the SDK's actual positional namespace/body/options contract, preserve source headers/custom prefixes/auth, normalize object facts and system timestamps, and keep the existing namespace strings, session IDs, metadata, fan-out, merge/dedup, local floor/caps, approvals, and hook budgets.

Capture continues to POST new deltas to the same session document ID, never PATCH the last delta over canonical content. A valid ID and nonfailed v5 acceptance status are required before advancing the cursor. Processing stays memory/dynamic; acceptance isn't processing completion or exactly-once billing proof.

Compatibility and distribution

• Hosted root URL equivalents default to v5. Genuine custom REST URLs default to the exact-pinned official SDK4 compatibility path; SUPERMEMORY_API_VERSION/apiVersion explicitly select v5 or legacy. There is no failed-request version fallback, hosted rerouting, data backfill, namespace move, or persisted-file conversion.
• Legacy display-name/account-session/exact-content forget operations remain against the configured REST server; no destructive semantic substitute is invented. Forget rejects a negative acknowledgement. REST, MCP, and browser-auth routing stay independent, and user MCP env/approval fields remain intact.
• Rebuilt the npm/standalone CommonJS artifacts with the SDK included. Add SDK licenses to the package and installed script directory; the installer's only change is that license copy, which combines cleanly with the separate fix: handle spaces and shell quotes in installed hook paths #67 quoting work.
• Align package/npm lock to 1.0.20 because published npm is already 1.0.19 while main is 1.0.18. Update both locks and add release notes. The publisher skips a second patch bump when the pushed range already changed the version; ordinary changes still bump the next patch. Runner/auth permissions are unchanged.

Verification and limits

npm ci, typecheck, build, 70 unchanged tests, syntax/diff checks, and clean rebuild byte comparison pass. Git fixture tests use GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null to prevent the sandbox's remote rewrite from changing expected namespace hashes. No test files are added or modified.

Scratch-only probes cover 270 real requests to credential-free local HTTP sinks across Node 24.18.0 and actual Node 18.0.0: v5/legacy routes and bodies, prefix/auth/source, namespace encoding/filter fan-out, profile/search normalization, append-intent IDs, failed/malformed/lost-response acceptance, aborts and no hook retries, retained cursors and later recovery, raw-reader parity, status, and installed hooks without any node_modules. Cold npm installation with production dependencies also resolves both exact SDK pins. Config/key/URL precedence and normalized hosted identity pass 21 probes; original config/credentials/legacy cursor fixture bytes survive reads and the tested install. Publisher simulations keep this release at 1.0.20 and advance an ordinary next release to 1.0.21.

The deep library exports remain callable, but stock SDK5 unbounded requests have different retry statuses/backoff from SDK4: a local 409 fixture sends once on v5 versus three attempts on legacy. Installed automatic hooks already disable retries and retain the cursor on 409; documented explicit operations use the unchanged MCP proxy. This is not a full retry-parity claim for unknown external deep-import consumers.

No hosted memory API calls, live credentials, user devices, backend data changes, merge, tag, or publish. Historical backend data/key resolution, semantic ranking, delayed extraction, namespace isolation, server storage upgrades/rollback, exact-content deletion on a v5-only server, and exactly-once append/billing behavior remain unverified. The separated profile-query search uses the guide's explicit legacy defaults, not a claim that undocumented historical profile defaults have been measured.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	supermemory@​5.0.1

View full report