@lh8ppl/claude-memory-kit 0.1.0 → 0.1.2

package/src/frontmatter.mjs

@@ -1,73 +1,73 @@
-// Canonical frontmatter serializer/parser. Single js-yaml-backed pair that
-// every kit module uses to read and write per-fact frontmatter + scratchpad
-// HTML-comment provenance (Layer 3+ will join).
-//
-// Per the Layer-2 review's I2 finding, the previous code had THREE different
-// naive parsers across four modules (split-on-first-colon read; verbatim
-// stringify write). Output and input weren't symmetric: booleans round-tripped
-// as strings, arrays didn't round-trip at all, strings with `:` truncated on
-// read. js-yaml fixes all of these AND lifts the B2 minimum-fix restriction
-// that PR-1 added — values with `\n` / `\r` / `:` are now quoted properly.
-//
-// Public surface:
-//   parse(text) → {frontmatter, body, parseError?}
-//     - text: full file contents (with or without `---` markers)
-//     - returns frontmatter as a typed object (string/number/bool/array/etc.)
-//     - returns body as the markdown after the closing `---\n` (or empty)
-//     - if no frontmatter block: frontmatter is null, body is the full text
-//     - if YAML parse fails: frontmatter is null, parseError carries the message
-//
-//   format({frontmatter, body}) → text
-//     - frontmatter: typed object; key order preserved per insertion
-//     - body: markdown; written verbatim after the closing `---\n`
-//     - if frontmatter is null/empty: just returns body
-//
-// js-yaml schema: CORE_SCHEMA (no implicit timestamp/Date conversion;
-// ISO strings stay as strings). Output uses flowLevel: 1 — top-level
-// mapping is block style; nested arrays render as `[a, b]` (matches the
-// pre-refactor visual format).
-
-import yaml from 'js-yaml';
-
-const DUMP_OPTIONS = Object.freeze({
-  schema: yaml.CORE_SCHEMA,
-  flowLevel: 1,
-  lineWidth: -1, // no line wrapping
-  noRefs: true, // never emit YAML anchors / refs
-  sortKeys: false, // preserve insertion order
-});
-
-const LOAD_OPTIONS = Object.freeze({
-  schema: yaml.CORE_SCHEMA,
-});
-
-export function parse(text) {
-  if (typeof text !== 'string') return { frontmatter: null, body: '' };
-  const m = text.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-  if (!m) return { frontmatter: null, body: text };
-  let frontmatter;
-  try {
-    frontmatter = yaml.load(m[1], LOAD_OPTIONS);
-  } catch (e) {
-    return { frontmatter: null, body: text, parseError: e.message };
-  }
-  if (frontmatter === undefined || frontmatter === null) {
-    return { frontmatter: null, body: m[2] ?? '' };
-  }
-  if (typeof frontmatter !== 'object' || Array.isArray(frontmatter)) {
-    return {
-      frontmatter: null,
-      body: text,
-      parseError: 'frontmatter is not a mapping',
-    };
-  }
-  return { frontmatter, body: m[2] ?? '' };
-}
-
-export function format({ frontmatter, body }) {
-  if (!frontmatter || (typeof frontmatter === 'object' && Object.keys(frontmatter).length === 0)) {
-    return body ?? '';
-  }
-  const yamlBody = yaml.dump(frontmatter, DUMP_OPTIONS);
-  return `---\n${yamlBody}---\n${body ?? ''}`;
-}
+// Canonical frontmatter serializer/parser. Single js-yaml-backed pair that
+// every kit module uses to read and write per-fact frontmatter + scratchpad
+// HTML-comment provenance (Layer 3+ will join).
+//
+// Per the Layer-2 review's I2 finding, the previous code had THREE different
+// naive parsers across four modules (split-on-first-colon read; verbatim
+// stringify write). Output and input weren't symmetric: booleans round-tripped
+// as strings, arrays didn't round-trip at all, strings with `:` truncated on
+// read. js-yaml fixes all of these AND lifts the B2 minimum-fix restriction
+// that PR-1 added — values with `\n` / `\r` / `:` are now quoted properly.
+//
+// Public surface:
+//   parse(text) → {frontmatter, body, parseError?}
+//     - text: full file contents (with or without `---` markers)
+//     - returns frontmatter as a typed object (string/number/bool/array/etc.)
+//     - returns body as the markdown after the closing `---\n` (or empty)
+//     - if no frontmatter block: frontmatter is null, body is the full text
+//     - if YAML parse fails: frontmatter is null, parseError carries the message
+//
+//   format({frontmatter, body}) → text
+//     - frontmatter: typed object; key order preserved per insertion
+//     - body: markdown; written verbatim after the closing `---\n`
+//     - if frontmatter is null/empty: just returns body
+//
+// js-yaml schema: CORE_SCHEMA (no implicit timestamp/Date conversion;
+// ISO strings stay as strings). Output uses flowLevel: 1 — top-level
+// mapping is block style; nested arrays render as `[a, b]` (matches the
+// pre-refactor visual format).
+
+import yaml from 'js-yaml';
+
+const DUMP_OPTIONS = Object.freeze({
+  schema: yaml.CORE_SCHEMA,
+  flowLevel: 1,
+  lineWidth: -1, // no line wrapping
+  noRefs: true, // never emit YAML anchors / refs
+  sortKeys: false, // preserve insertion order
+});
+
+const LOAD_OPTIONS = Object.freeze({
+  schema: yaml.CORE_SCHEMA,
+});
+
+export function parse(text) {
+  if (typeof text !== 'string') return { frontmatter: null, body: '' };
+  const m = text.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  if (!m) return { frontmatter: null, body: text };
+  let frontmatter;
+  try {
+    frontmatter = yaml.load(m[1], LOAD_OPTIONS);
+  } catch (e) {
+    return { frontmatter: null, body: text, parseError: e.message };
+  }
+  if (frontmatter === undefined || frontmatter === null) {
+    return { frontmatter: null, body: m[2] ?? '' };
+  }
+  if (typeof frontmatter !== 'object' || Array.isArray(frontmatter)) {
+    return {
+      frontmatter: null,
+      body: text,
+      parseError: 'frontmatter is not a mapping',
+    };
+  }
+  return { frontmatter, body: m[2] ?? '' };
+}
+
+export function format({ frontmatter, body }) {
+  if (!frontmatter || (typeof frontmatter === 'object' && Object.keys(frontmatter).length === 0)) {
+    return body ?? '';
+  }
+  const yamlBody = yaml.dump(frontmatter, DUMP_OPTIONS);
+  return `---\n${yamlBody}---\n${body ?? ''}`;
+}

package/src/index-rebuild.mjs

@@ -367,14 +367,36 @@ export function reindexBoot({ projectRoot, userDir, db, now }) {
 
   for (const source of sources) {
     filesScanned++;
-    const content = readFileSync(source.path, 'utf8');
-    const sha1 = sha1OfContent(content);
     const relPath = relativeSource(source.path, { projectRoot, userDir });
     const existing = db
-      .prepare('SELECT sha1 FROM files WHERE path = ?')
+      .prepare('SELECT mtime, sha1 FROM files WHERE path = ?')
       .get(relPath);
+    // Fast path: if the file's mtime matches the checkpoint, the content is
+    // unchanged — skip the read + sha1 entirely. This realizes design §9.2's
+    // "mtime+sha1 diff" intent (the prior impl sha1'd every file on every
+    // call) and is what makes reindexBoot cheap enough to run before every
+    // `cmk search` (finding #0) even as the memory corpus grows.
+    let mtime = null;
+    try {
+      mtime = Math.floor(statSync(source.path).mtimeMs);
+    } catch {
+      // stat failed (file vanished mid-walk); fall through to the read,
+      // which surfaces the error naturally.
+    }
+    if (existing && mtime !== null && existing.mtime === mtime) {
+      continue; // unchanged (mtime match — no read needed)
+    }
+    // Caveat: a content change that PRESERVES the old mtime (e.g. a restore
+    // tool that sets --times) is missed until the next real change or a
+    // `reindex --full`. Negligible in practice — the kit always writes a
+    // fresh mtime after the indexed one — and standard for mtime-based diffs.
+    //
+    // mtime differs (or no checkpoint) — confirm via sha1 so a mere mtime
+    // touch (content identical) doesn't trigger a needless reindex.
+    const content = readFileSync(source.path, 'utf8');
+    const sha1 = sha1OfContent(content);
     if (existing && existing.sha1 === sha1) {
-      continue; // unchanged
+      continue; // content unchanged despite mtime touch
     }
     const n = txn(source);
     filesReindexed++;

package/src/inject-context.mjs

@@ -84,17 +84,20 @@ const TIER_BUDGETS = Object.freeze({
 });
 
 // Per-tier reading plan. The hook reads the scratchpads allowed at that
-// tier (per SCRATCHPADS_BY_TIER) plus the tier's INDEX file, plus — for
-// the project tier — the most recent rolling-window day file.
+// tier (per SCRATCHPADS_BY_TIER) plus — for the project tier — the most
+// recent rolling-window day file.
+//
+// INDEX.md is deliberately NOT in the snapshot (#R, 2026-05-30). It is a
+// pointer/reference doc that self-declares "NOT auto-loaded at session
+// start" in its own template body — injecting it both violated that
+// contract and pushed ~2 KB of reference prose into Claude's context,
+// crowding out real facts. It stays on disk for lookup via `cmk search` /
+// the granular archive; it is not session-start content.
 function plannedFilesForTier(tier, tierRoot) {
   const files = [];
   for (const name of SCRATCHPADS_BY_TIER[tier]) {
     files.push(join(tierRoot, name));
   }
-  // INDEX: P/L use memory/INDEX.md; U uses fragments/INDEX.md (per
-  // resolveFactDir asymmetry in tier-paths.mjs).
-  const indexDir = tier === 'U' ? 'fragments' : 'memory';
-  files.push(join(tierRoot, indexDir, 'INDEX.md'));
   if (tier === 'P') {
     const sessionsDir = join(tierRoot, 'sessions');
     const latest = latestDaySession(sessionsDir);
@@ -138,10 +141,145 @@ function tierDirExists(tier, tierRoot) {
   return existsSync(tierRoot) && statSync(tierRoot).isDirectory();
 }
 
+// The all-zero sha1 is the kit's template-seed sentinel: every scaffolded
+// placeholder bullet (in machine-paths/overrides/SOUL/USER/HABITS/LESSONS)
+// carries `sha1: 0000…0000` + `at: 2020-01-01T…`. A real captured fact
+// always has a real content sha1. We use this to distinguish "scaffolding
+// the user never replaced" from "a fact worth injecting".
+const SEED_SHA1_RE = /sha1:\s*0{40}/;
+
+// All HTML-comment handling below uses STRING SCANNING (indexOf/startsWith),
+// never a regex tag-filter. Regex-based HTML-comment stripping is fragile by
+// nature (it can't see newlines, leaves partial `<!--`, etc. — flagged by
+// CodeQL's js/bad-tag-filter). String scanning is both more robust and not a
+// tag-filter, so it sidesteps that whole class.
+
+// True if `line`, ignoring surrounding whitespace, is exactly one self-
+// contained HTML comment (`<!-- … -->`) — e.g. a per-bullet provenance line.
+function isCommentOnlyLine(line) {
+  if (typeof line !== 'string') return false;
+  const t = line.trim();
+  return t.startsWith('<!--') && t.endsWith('-->') && t.length >= 7;
+}
+
+// Remove every self-contained `<!-- … -->` span WITHIN a single line, by
+// scanning for delimiter pairs. An unterminated `<!--` (no `-->` on this
+// line) is left in place for the multi-line state machine to handle.
+function stripInlineComments(line) {
+  let out = '';
+  let i = 0;
+  for (;;) {
+    const open = line.indexOf('<!--', i);
+    if (open === -1) return out + line.slice(i);
+    const close = line.indexOf('-->', open + 4);
+    if (close === -1) return out + line.slice(i); // unterminated; leave it
+    out += line.slice(i, open);
+    i = close + 3;
+  }
+}
+
+// Is `bulletLine` a placeholder/seed bullet that should NOT be injected?
+// Primary signal: a following provenance comment carrying the all-zero seed
+// sha1 (every scaffolded template bullet has it; a real captured fact never
+// does). Secondary: the `(example)` marker — but ONLY in the template's
+// exact `(P-XXXXXXXX) (example) …` shape (right after the citation id), so a
+// real fact whose text merely mentions "(example)" is not mis-dropped.
+function isSeedBullet(bulletLine, nextLine) {
+  if (/^\s*-\s+\([PUL]-[A-Za-z0-9]{8}\)\s+\(example\)/.test(bulletLine)) {
+    return true;
+  }
+  const prov = isCommentOnlyLine(nextLine) ? nextLine : '';
+  return SEED_SHA1_RE.test(prov);
+}
+
+// Remove HTML comments robustly, including the kit templates' multi-line
+// format-explanation headers that ILLUSTRATIVELY embed a single-line
+// `<!-- source… -->` example inside the outer `<!-- … -->` block (a naive
+// "first <!-- to first -->" pass closes on that inner `-->` and orphans the
+// tail). We strip inline comments first (killing the nested one) and only
+// then walk the now-cleanly-delimited multi-line blocks. All string-scan.
+function stripHtmlComments(text) {
+  // Pass 1 — remove every self-contained `<!-- … -->` on a single line.
+  const lines = text.split('\n').map(stripInlineComments);
+  // Pass 2 — remove multi-line blocks (each now free of any inner `-->`).
+  const out = [];
+  let inBlock = false;
+  for (let line of lines) {
+    if (inBlock) {
+      const close = line.indexOf('-->');
+      if (close === -1) continue; // still inside the block; drop the line
+      inBlock = false;
+      line = line.slice(close + 3);
+    }
+    const open = line.indexOf('<!--');
+    if (open !== -1) {
+      inBlock = true;
+      line = line.slice(0, open);
+    }
+    if (line.trim() !== '' || out.length === 0 || out[out.length - 1] !== '') {
+      out.push(line.replace(/[ \t]+$/, ''));
+    }
+  }
+  return out.join('\n');
+}
+
+// Clean a scratchpad body for INJECTION (not for on-disk storage — the
+// files keep their human-editing headers). Self-test finding #R: the raw
+// bodies are ~70% template-comment noise + placeholder seed bullets that
+// bury (and crowd out) the real captured facts, so the model concludes
+// "no real facts populated yet". This strips:
+//   1. placeholder seed bullets (all-zero sha1 / `(example)`) + their
+//      provenance comment line, and
+//   2. ALL remaining `<!-- -->` comments (multi-line format-explanation
+//      headers AND per-bullet provenance — the fact text + its `(P-…)`
+//      citation id carry everything the model needs to read & cite).
+// Whitespace is normalized so stripped regions don't leave holes.
+//
+// Known limitation (rare): a captured fact whose TEXT contains a literal
+// `<!--`/`-->` (e.g. a note about HTML/templating) has that fragment
+// stripped from the INJECTED view. The on-disk fact and the search index
+// are unaffected — only the session-start snapshot loses the literal
+// comment markers. Accepted as a rare edge vs. the cost of distinguishing
+// real comments from comment-shaped fact text.
+function cleanScratchpadBody(body) {
+  // Normalize CRLF so user-edited (Windows) scratchpads don't leave stray
+  // \r after comment/seed stripping.
+  const lines = body.replace(/\r\n/g, '\n').split('\n');
+  const kept = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (
+      /^\s*-\s/.test(line) &&
+      ID_TOKEN_RE.test(line) &&
+      isSeedBullet(line, lines[i + 1])
+    ) {
+      if (isCommentOnlyLine(lines[i + 1])) i++;
+      continue;
+    }
+    kept.push(line);
+  }
+  // Step 2 — strip all remaining comments (format headers + real-bullet
+  // provenance), then normalize whitespace.
+  return stripHtmlComments(kept.join('\n'))
+    .replace(/\n{3,}/g, '\n\n')
+    .replace(/^\n+|\n+$/g, '');
+}
+
+// After cleaning, does a body carry any real content — i.e. a non-blank
+// line that isn't a markdown heading? A body of only headings (every
+// bullet was a stripped seed) is pure scaffolding and must NOT contribute
+// a tier block (otherwise the model sees an empty "## …" skeleton).
+function hasRealContent(cleaned) {
+  return cleaned
+    .split('\n')
+    .some((l) => l.trim() !== '' && !/^#{1,6}\s/.test(l));
+}
+
 // Read the snapshot-eligible content for one tier as a single string. If
-// no tier files exist (or the tier dir itself is absent), returns ''. The
-// per-file content is wrapped in a fenced header so the snapshot is
-// self-describing to whoever reads Claude's context window.
+// no tier files exist (or the tier dir itself is absent), returns ''. Each
+// file body is cleaned for injection (see cleanScratchpadBody); files that
+// reduce to scaffolding-only contribute nothing, and a tier whose every
+// file is scaffolding-only is excluded entirely (no header, no skeleton).
 function readTierBlock(tier, tierRoot) {
   if (!tierDirExists(tier, tierRoot)) return '';
   const sections = [];
@@ -154,7 +292,9 @@ function readTierBlock(tier, tierRoot) {
       continue;
     }
     if (body.trim() === '') continue;
-    sections.push(body);
+    const cleaned = cleanScratchpadBody(body);
+    if (!hasRealContent(cleaned)) continue;
+    sections.push(cleaned);
   }
   if (sections.length === 0) return '';
   const header = `<!-- cmk: ${TIER_LABELS[tier]} tier (${tier}) -->`;

package/src/install.mjs

@@ -43,6 +43,8 @@ import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { injectClaudeMdBlock } from './claude-md.mjs';
+import { writeKitHooks } from './settings-hooks.mjs';
+import { appendAuditEntry, nowIso, REASON_CODES } from './audit-log.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const CLI_SRC_DIR = dirname(__filename);
@@ -295,7 +297,53 @@ export async function install(options = {}) {
     });
   }
 
-  return { projectRoot, userTier, created, skipped, gitignore, claudeMd, errors };
+  // Hook wiring — Task 49. This is what makes `npm install -g
+  // @lh8ppl/claude-memory-kit` + `cmk install` a COMPLETE entry point
+  // (no separate `/plugin install` step needed). Writes the npm-route
+  // hooks block (PATH-resolved bare bin names, shell form) into
+  // <projectRoot>/.claude/settings.json via the shared writeKitHooks
+  // boundary — same boundary `cmk repair --hooks` uses, so install and
+  // repair never drift. Idempotent: a re-run with already-canonical
+  // hooks is a no-op. Opt out with {noHooks:true} (CLI: --no-hooks) for
+  // scaffold-only installs.
+  let hooks = { action: 'skipped', path: join(projectRoot, '.claude', 'settings.json') };
+  if (!options.noHooks) {
+    const settingsPath = join(projectRoot, '.claude', 'settings.json');
+    const r = writeKitHooks(settingsPath);
+    if (r.error) {
+      errors.push({ path: settingsPath, error: r.error });
+      hooks = { action: 'error', path: settingsPath, error: r.error };
+    } else {
+      hooks = {
+        action: r.changed ? 'wired' : 'unchanged',
+        path: settingsPath,
+        events: r.events,
+      };
+      // Door-4 audit entry — install wires user-visible Claude Code
+      // config; a "cmk install changed my settings.json" report needs a
+      // trail. Emitted ONLY when something actually changed: a no-op
+      // re-install has nothing to audit, and emitting on no-op would make
+      // the append-only audit.log grow on every run, breaking install's
+      // idempotency guarantee (re-run = byte-identical project tree).
+      // Best-effort: never block install on an audit-log failure.
+      if (r.changed) {
+        try {
+          appendAuditEntry(join(projectRoot, 'context'), {
+            ts: nowIso(),
+            action: 'install',
+            tier: 'P',
+            id: 'P-NSTLHKWR', // synthetic stable id for install-hooks events (base32 alphabet)
+            reasonCode: REASON_CODES.INSTALL_HOOKS_WIRED,
+            extra: { settingsPath, events: r.events },
+          });
+        } catch {
+          // best-effort
+        }
+      }
+    }
+  }
+
+  return { projectRoot, userTier, created, skipped, gitignore, claudeMd, hooks, errors };
 }
 
 /**

package/src/mcp-server.mjs

@@ -34,6 +34,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { z } from 'zod';
 import { resolve as resolvePath, isAbsolute } from 'node:path';
 import { openIndexDb } from './index-db.mjs';
+import { reindexBoot } from './index-rebuild.mjs';
 import { search, SEARCH_MODES } from './search.mjs';
 import { memoryWrite } from './memory-write.mjs';
 import { ID_PATTERN, resolveTierRoot } from './tier-paths.mjs';
@@ -451,6 +452,22 @@ export function buildMcpServer({ projectRoot, userDir, db, semanticBackend }) {
  */
 export async function runMcpServer({ projectRoot, userDir, db: dbOverride, semanticBackend } = {}) {
   const db = dbOverride ?? openIndexDb({ projectRoot });
+  // Refresh the index at server startup so mk_search sees facts already on
+  // disk — same fresh-install gap as `cmk search` (self-test finding #0):
+  // nothing reindexes for a just-installed project, so without this the
+  // model's first mk_search returns empty for facts sitting in the
+  // scratchpads. Incremental (mtime/sha1 diff) + best-effort; in-session
+  // freshness for facts written AFTER startup is the runtime watcher's job
+  // (future). The in-process buildMcpServer tests bypass this path.
+  if (projectRoot) {
+    try {
+      reindexBoot({ projectRoot, userDir, db });
+    } catch (err) {
+      process.stderr.write(
+        `cmk-mcp-server: startup index refresh failed: ${err?.message ?? err}\n`,
+      );
+    }
+  }
   const server = buildMcpServer({ projectRoot, userDir, db, semanticBackend });
   const transport = new StdioServerTransport();
 

package/src/memory-write.mjs

@@ -57,6 +57,7 @@ import { appendScratchpadBullet } from './scratchpad.mjs';
 import { parseBulletProvenance } from './provenance.mjs';
 import { checkPoisonGuard, logPoisonGuardRejection } from './poison-guard.mjs';
 import { detectConflicts, writeConflictEntry } from './conflict-queue.mjs';
+import { sanitizeHomePaths } from './sanitize.mjs';
 
 const VALID_ACTIONS = new Set(['add', 'replace', 'remove']);
 
@@ -252,8 +253,20 @@ function doAdd(opts) {
   if (errors.length > 0) {
     return errorResult({ category: ERROR_CATEGORIES.SCHEMA, errors });
   }
+  // Privacy (write-path fix #1): abstract home-dir paths to `~` for
+  // committed/shared tiers (P/U) BEFORE the bullet is screened, conflict-
+  // checked, dedup-keyed, and written — so a captured fact never ships the
+  // local username and stays portable. Local tier (L) keeps machine paths
+  // verbatim (its purpose). Everything downstream uses `addOpts`.
+  const sanitizedText =
+    opts.tier === 'P' || opts.tier === 'U'
+      ? sanitizeHomePaths(opts.text)
+      : opts.text;
+  const addOpts =
+    sanitizedText === opts.text ? opts : { ...opts, text: sanitizedText };
+
   const poisonResult = runPoisonGuard({
-    text: opts.text,
+    text: addOpts.text,
     projectRoot: opts.projectRoot,
     source: opts.source,
     sessionId: opts.sessionId,
@@ -276,7 +289,7 @@ function doAdd(opts) {
     userDir: opts.userDir,
   });
   const conflict = detectConflicts({
-    newText: opts.text,
+    newText: addOpts.text,
     newTrust,
     scratchpadPath,
     sectionTitle: opts.section,
@@ -296,14 +309,14 @@ function doAdd(opts) {
     // appendScratchpadBullet would have used, then route to the queue.
     // (Task 25b fix: generateId is positional `(tier, text)`, not
     // named-args — Task 25 originally called it as an object.)
-    const proposedId = generateId(opts.tier, opts.text);
+    const proposedId = generateId(addOpts.tier, addOpts.text);
     const ts = opts.now ?? nowIso();
     return writeConflictEntry({
       tier: opts.tier,
       projectRoot: opts.projectRoot,
       userDir: opts.userDir,
       newId: proposedId,
-      newText: opts.text,
+      newText: addOpts.text,
       newTrust,
       existingId: conflict.existingId,
       existingText: conflict.existingText,
@@ -313,7 +326,7 @@ function doAdd(opts) {
       detectedAt: ts,
     });
   }
-  return appendBulletGuarded(opts);
+  return appendBulletGuarded(addOpts);
 }
 
 function appendBulletGuarded(opts) {