This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Summary
AI summaryUpdates Highlights, Validation Triple-restart soak, and https://claude.com/claude-code across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
First‑run settings bootstrap directs notices to stderr, preventing corrupted JSON output on fresh installs. First‑run settings bootstrap directs notices to stderr, preventing corrupted JSON output on fresh installs. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
`worker-service restart` now validates pid change and version match via `/api/health`, exiting 1 on failure. `worker-service restart` now validates pid change and version match via `/api/health`, exiting 1 on failure. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
Unified Bun resolver eliminates kill‑then‑cannot‑respawn path, ensuring consistent restart behavior. Unified Bun resolver eliminates kill‑then‑cannot‑respawn path, ensuring consistent restart behavior. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
Self-replacing worker spawns successor immediately on port free, eliminating coexistence and race conditions. Self-replacing worker spawns successor immediately on port free, eliminating coexistence and race conditions. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
MCP server prefers marketplace worker script over stale plugin‑cache copies, reducing mis‑spawn risk. MCP server prefers marketplace worker script over stale plugin‑cache copies, reducing mis‑spawn risk. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
Build chain removed duplicate cache mirror and HTTP restart trigger, enforcing single verified CLI path for `build-and-sync` restarts. Build chain removed duplicate cache mirror and HTTP restart trigger, enforcing single verified CLI path for `build-and-sync` restarts. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
Test suite isolated from real `~/.claude-mem`, eliminating sentinel‑PID and corrupt‑JSON pollution of production state. Test suite isolated from real `~/.claude-mem`, eliminating sentinel‑PID and corrupt‑JSON pollution of production state. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
`worker-service restart` polls `/api/health` to verify pid change and version match before succeeding. `worker-service restart` polls `/api/health` to verify pid change and version match before succeeding. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Medium |
`wx` lockfile serializes all external spawn paths, avoiding collisions and race conditions. `wx` lockfile serializes all external spawn paths, avoiding collisions and race conditions. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Refactor | Low |
PID file is demoted to diagnostic use; liveness determined by port + health endpoint. PID file is demoted to diagnostic use; liveness determined by port + health endpoint. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Refactor | Low |
Unified Bun resolvers eliminate the kill‑then‑cannot‑respawn failure mode. Unified Bun resolvers eliminate the kill‑then‑cannot‑respawn failure mode. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
Full changelog
Worker restart: single source of truth (#2894)
This release rearchitects worker lifecycle management to eliminate the restart races behind version-recycle ping-pong storms, EADDRINUSE failures, and "healthy worker reports as not running" lies.
Highlights
- Self-replacing worker — on restart, the dying worker spawns its own successor the moment its port frees. Old and new workers never coexist, and nothing external races to spawn into the gap. Hooks wait for the successor and lazy-spawn only as a fallback, at most one recycle per hook event.
- Restarts prove themselves —
worker-service restartnow polls/api/healthuntil the pid changes AND the version matches the new build, printsWorker restart verified (pid, version), and exits 1 on failure instead of reporting success over a dead or stale worker. The daemon's generic start-failure path also exits 1 now. - One spawn gate — a
wx-flag lockfile (spawn.lock, 60s mtime staleness, owner-checked release) serializes every external spawn path: hook lazy-spawn, MCP server, and the CLI restart fallback. Lock losers wait for the winner's worker instead of colliding. The two divergent Bun resolvers are unified (closing the kill-then-can't-respawn path), and the MCP server now prefers the marketplace worker script over stale plugin-cache copies. - PID file demoted to diagnostics — liveness truth is the port +
/api/health. Every PID-file deletion is owner-guarded, so a dying worker can never clobber its successor's file;statusreports pid/version/uptime/workerPath from health alone and survives PID-file deletion. - First-run fix — settings bootstrap notices now go to stderr, never stdout: the very first hook invocation on a fresh install no longer emits corrupted JSON to the hook framework.
- Build chain hardened — the dev sync-script's installed-version cache mirror (which wrote new code into old version dirs, manufacturing permanent version disagreement) and its duplicate HTTP restart trigger are deleted;
build-and-syncrestarts through one verified CLI path. - Test hygiene — the test suite can no longer touch the real
~/.claude-mem(a preload tripwire isolates every run), ending sentinel-PID and corrupt-JSON pollution of production state.
Validation
Triple-restart soak (3× consecutive verified restarts, zero duplicate/EADDRINUSE events), plus a live re-creation of the original stale-launcher bug under concurrent session crossfire: one recycle per stale instance, convergence in 16 seconds, zero ping-pong over an 8.5-minute watch. 2,247 tests pass.
🤖 Generated with Claude Code
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-mem
A Claude Code plugin that automatically captures everything Claude does during your coding sessions, compresses it with AI (using Claude's agent-sdk), and injects relevant context back into future sessions.
Related context
Related tools
Earlier breaking changes
- v13.11.0 Retires the standalone `cloud-sync.mjs` daemon.
Beta — feedback welcome: [email protected]