This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+5 more
Affected surfaces
Summary
AI summaryUpdates sas, url, and v0.1.0 across a mixed release.
Full changelog
Highlights
Two laptops on a LAN now pair and sync with no hosted infrastructure. Turns the v0.0.7 cryptographic claims into a tangible cross-machine experience.
// Device A
import { Mneme } from '@mneme/sdk'
import { serveForPairing, WebSocketSyncServer } from '@mneme/sync-websocket'
const alice = await Mneme.open({ passphrase: '...' })
await serveForPairing(alice, {
onUrlReady: (url) => console.log(`Pair to ${url}`),
onSasReady: async (sas) => await userConfirms(sas), // your UI
})
const server = new WebSocketSyncServer({ mneme: alice, allowedOwnerId: 'pedro' })
server.start()
// Device B
import { Mneme } from '@mneme/sdk'
import { pairOverWebSocket, WebSocketSyncPeer } from '@mneme/sync-websocket'
const { mneme: bob, recoveryPhrase } = await pairOverWebSocket({
url: 'ws://192.168.1.10:7078',
passphrase: 'bob-passphrase',
path: '/path/b.sqlite',
onSasReady: async (sas) => await userConfirms(sas),
})
console.log('SAVE THIS:', recoveryPhrase)
await bob.sync(new WebSocketSyncPeer({ url: 'ws://192.168.1.10:7077' }))
- New package:
@mneme/sync-websocketv0.0.1 —Bun.servefor the server, nativeWebSocketfor the client - JSON envelopes with request-id correlation — inspectable with
wscat - Optional
allowedOwnerIdon the server pins requests to one owner - Both pairing sides drive SAS verification via
onSasReadycallbacks — either rejecting aborts cleanly - ADR 0010 captures the design with the full security-vs-scope tradeoff
⚠️ No authentication in v0.0.8
The server accepts any WebSocket connection. Use only on loopback or a network you control. Bearer-token auth lands with hosted Mneme Cloud (v0.1.0). The crypto story still holds — records are signed encrypted blobs to any non-pairing observer, and pairing's SAS gives independent MITM protection — but server-side resource abuse is possible on shared networks.
What's in the repo today
packages/protocolv0.0.1 — open spec typespackages/sdkv0.0.7 — encryption + recovery + signing + sync + pairingpackages/embedder-localv0.0.1 — on-device embeddingspackages/sync-websocketv0.0.1 — WebSocket transportapps/mcp-serverv0.0.1 — Claude Code-installable MCP servertests/conformancev0.0.1 — cross-implementation suitedecisions/— 10 ADRs
Try it
git clone https://github.com/ppserapiao/mneme
cd mneme
bun install
bun test # 118 pass, 2 skip
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Mneme
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]