fix: security, config merge, docs accuracy, license (v0.9.5)

- Fix timing leak in safeCompare (pad to equal length)
- Fix loadConfig shallow merge → deepMerge for env overrides
- Fix PLUGIN_VERSION to match package version
- Fix README: Node.js >= 20, remove speculative models, add cortex_relations
- Add MIT LICENSE file
- Update CHANGELOG with dates and v0.9.3 entry
- Bump cortex-bridge to v0.6.2

Author: rikouu

CHANGELOG.md

@@ -1,6 +1,16 @@
 # Changelog
 
-## v0.9.4
+## v0.9.5 — 2026-03-21
+
+### Fixes
+- **Timing leak in safeCompare**: Pad both strings to equal length before constant-time comparison, preventing length-based timing attacks.
+- **Deep merge for env overrides in loadConfig**: Use `deepMerge` instead of shallow spread so env var overrides (e.g. `CORTEX_DB_PATH`) don't clobber nested file config.
+- **PLUGIN_VERSION**: Corrected cortex-bridge version from 0.5.1 to 0.6.1.
+- **README accuracy**: Fixed Node.js requirement (≥ 20), removed speculative model names, added `cortex_relations` to MCP tools table, fixed `pnpm start` → `pnpm dev`.
+- **CHANGELOG**: Added missing v0.9.3 entry and dates.
+- **LICENSE**: Added MIT license file.
+
+## v0.9.4 — 2026-03-15
 
 ### Features
 - **Multi-agent tool isolation**: Bridge tools (`cortex_recall`, `cortex_remember`, `cortex_ingest`) now accept an optional `agent_id` parameter, enabling per-request agent switching in multi-agent orchestrators.
@@ -14,15 +24,19 @@
 ### Fixes
 - Fixed version display endpoint to return correct version string.
 
-## v0.9.2
+## v0.9.3 — 2026-03-10
+
+- Bump cortex-bridge to v0.6.1 for npm publish.
+
+## v0.9.2 — 2026-03-08
 
 - Use `config.storage.dbPath` instead of non-existent `config.dataDir` in `backupDb()`.
 
-## v0.9.1
+## v0.9.1 — 2026-03-05
 
 - Bump `@cortexmem/mcp` to 0.1.2 with auth-token support.
 
-## v0.9.0
+## v0.9.0 — 2026-03-01
 
 - Broaden fast channel coverage for diverse users.
 - Comprehensive fast channel and prompt audit.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rigouu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -248,7 +248,7 @@ git clone https://github.com/rikouu/cortex.git
 cd cortex
 pnpm install
 pnpm build        # Build server + dashboard
-pnpm start        # → http://localhost:21100
+pnpm dev          # → http://localhost:21100
 ```
 
 **Development mode** (for contributors):
@@ -261,7 +261,7 @@ cd packages/dashboard && pnpm dev  # → http://localhost:5173
 
 > ⚠️ In dev mode, visiting `http://localhost:21100` in browser will show a 404 — that's normal. The Dashboard dev server runs on a separate port.
 
-**Requirements:** Node.js ≥ 18, pnpm ≥ 8
+**Requirements:** Node.js ≥ 20, pnpm ≥ 8
 
 </details>
 
@@ -535,6 +535,7 @@ curl -X POST http://localhost:21100/api/v1/ingest \
 |---|---|
 | `cortex_recall` | Search memories with priority injection |
 | `cortex_remember` | Store a specific memory |
+| `cortex_relations` | List entity relationships from memory |
 | `cortex_forget` | Remove or correct a memory |
 | `cortex_search_debug` | Debug search scoring |
 | `cortex_stats` | Memory statistics |
@@ -547,10 +548,10 @@ curl -X POST http://localhost:21100/api/v1/ingest \
 
 | Provider | Recommended Models | Notes |
 |---|---|---|
-| **OpenAI** | gpt-4o-mini, gpt-5.2 | Default. Best cost/quality |
+| **OpenAI** | gpt-4o-mini, gpt-4o | Default. Best cost/quality |
 | **Anthropic** | claude-haiku-4-5, claude-sonnet-4-6 | Highest extraction quality |
 | **Google Gemini** | gemini-2.5-flash | Free tier on AI Studio |
-| **DeepSeek** | deepseek-chat, deepseek-v4 | Cheapest option |
+| **DeepSeek** | deepseek-chat | Cheapest option |
 | **DashScope** | qwen-plus, qwen-turbo | 通义千问, OpenAI-compatible |
 | **Ollama** | qwen2.5, llama3.2 | Fully local, zero cost |
 | **OpenRouter** | Any of 100+ models | Unified gateway |

package.json

@@ -1,7 +1,7 @@
 {
   "name": "cortex",
   "private": true,
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Cortex - Universal AI Agent Memory Service",
   "scripts": {
     "dev": "pnpm --filter @cortex/server dev",

packages/cortex-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexmem/openclaw",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/cortex-bridge/src/index.ts

@@ -9,7 +9,7 @@
  */
 
 // ── Plugin version ──────────────────────────────────────
-const PLUGIN_VERSION = '0.5.1';
+const PLUGIN_VERSION = '0.6.2';
 
 // ── Timeouts ────────────────────────────────────────────
 const RECALL_TIMEOUT = 8000;

packages/server/src/api/security.ts

@@ -7,8 +7,12 @@ const log = createLogger('security');
 
 /** Timing-safe string comparison to prevent timing attacks */
 function safeCompare(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  const maxLen = Math.max(a.length, b.length);
+  const bufA = Buffer.alloc(maxLen, 0);
+  const bufB = Buffer.alloc(maxLen, 0);
+  Buffer.from(a).copy(bufA);
+  Buffer.from(b).copy(bufB);
+  return a.length === b.length && timingSafeEqual(bufA, bufB);
 }
 
 /** Check if the active token comes from env var (immutable from Dashboard) */

packages/server/src/utils/config.ts

@@ -191,7 +191,7 @@ export function loadConfig(overrides?: Partial<CortexConfig>): CortexConfig {
   }
 
   // 3. Merge and validate
-  const merged = { ...fileConfig, ...envOverrides, ...overrides };
+  const merged = deepMerge(deepMerge(fileConfig, envOverrides), overrides || {});
   _config = CortexConfigSchema.parse(merged);
   return _config;
 }