@remnic/core 9.3.621 → 9.3.622

package/dist/lcm/engine.js

@@ -1,16 +1,16 @@
 import {
   LcmEngine,
   extractLcmConfig
-} from "../chunk-QVO4YOB7.js";
+} from "../chunk-D2B22JDF.js";
 import "../chunk-7N4KAIGN.js";
 import "../chunk-TPDBFYEG.js";
 import "../chunk-KCYE2MZM.js";
-import "../chunk-7XYTQGCC.js";
+import "../chunk-MAV46GWQ.js";
 import "../chunk-5VDJMYTF.js";
 import "../chunk-HP5FMB6L.js";
 import "../chunk-4RA3C3EV.js";
 import "../chunk-CI7RKSRE.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-2ODBA7MQ.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/lcm/index.js

@@ -2,7 +2,7 @@ import "../chunk-HHLLAQGZ.js";
 import {
   LcmEngine,
   extractLcmConfig
-} from "../chunk-QVO4YOB7.js";
+} from "../chunk-D2B22JDF.js";
 import {
   LcmDag
 } from "../chunk-7N4KAIGN.js";
@@ -13,7 +13,7 @@ import {
 import {
   ensureLcmStateDir,
   openLcmDatabase
-} from "../chunk-7XYTQGCC.js";
+} from "../chunk-MAV46GWQ.js";
 import {
   LcmSummarizer
 } from "../chunk-5VDJMYTF.js";
@@ -26,7 +26,7 @@ import {
 } from "../chunk-HP5FMB6L.js";
 import "../chunk-4RA3C3EV.js";
 import "../chunk-CI7RKSRE.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-2ODBA7MQ.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/lcm/schema.js

@@ -2,8 +2,8 @@ import {
   applyLcmSchema,
   ensureLcmStateDir,
   openLcmDatabase
-} from "../chunk-7XYTQGCC.js";
-import "../chunk-3HPAPHUK.js";
+} from "../chunk-MAV46GWQ.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-2ODBA7MQ.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/maintenance/memory-governance.js

@@ -7,15 +7,15 @@ import {
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "../chunk-5BTCT236.js";
-import "../chunk-7MLB4NCL.js";
+} from "../chunk-2GRRN7SZ.js";
+import "../chunk-DXBCNDVD.js";
 import "../chunk-5UZXUTVO.js";
 import "../chunk-4H5ZJHEN.js";
 import "../chunk-4R4KTDIE.js";
 import "../chunk-RULE4VG5.js";
 import "../chunk-SCU65EZI.js";
-import "../chunk-KILOTVIF.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-MB5RSUW6.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-CPPS65WS.js";
 import "../chunk-DM2T26WE.js";
 import "../chunk-QSVPYQPG.js";

package/dist/maintenance/rebuild-memory-lifecycle-ledger.js

@@ -1,17 +1,17 @@
 import {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
-} from "../chunk-APRRL26Q.js";
+} from "../chunk-GA3PMY73.js";
 import "../chunk-KJTKLXTH.js";
 import "../chunk-SFQ6QNL7.js";
-import "../chunk-7MLB4NCL.js";
+import "../chunk-DXBCNDVD.js";
 import "../chunk-5UZXUTVO.js";
 import "../chunk-4H5ZJHEN.js";
 import "../chunk-4R4KTDIE.js";
 import "../chunk-RULE4VG5.js";
 import "../chunk-SCU65EZI.js";
-import "../chunk-KILOTVIF.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-MB5RSUW6.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-CPPS65WS.js";
 import "../chunk-DM2T26WE.js";
 import "../chunk-QSVPYQPG.js";

package/dist/maintenance/rebuild-memory-projection.js

@@ -3,19 +3,19 @@ import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "../chunk-B6SU7YSE.js";
+} from "../chunk-LMZ7XQBB.js";
 import "../chunk-KJTKLXTH.js";
 import "../chunk-SFQ6QNL7.js";
 import "../chunk-BEUDU7Y4.js";
-import "../chunk-5BTCT236.js";
-import "../chunk-7MLB4NCL.js";
+import "../chunk-2GRRN7SZ.js";
+import "../chunk-DXBCNDVD.js";
 import "../chunk-5UZXUTVO.js";
 import "../chunk-4H5ZJHEN.js";
 import "../chunk-4R4KTDIE.js";
 import "../chunk-RULE4VG5.js";
 import "../chunk-SCU65EZI.js";
-import "../chunk-KILOTVIF.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-MB5RSUW6.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-CPPS65WS.js";
 import "../chunk-DM2T26WE.js";
 import "../chunk-QSVPYQPG.js";

package/dist/memory-projection-store.js

@@ -12,8 +12,8 @@ import {
   readProjectedMemoryState,
   readProjectedMemoryTimeline,
   readProjectedNativeKnowledgeChunks
-} from "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+} from "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MEMORY_PROJECTION_SCHEMA_VERSION,

package/dist/namespaces/migrate.js

@@ -2,7 +2,7 @@ import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "../chunk-YEEAADCI.js";
+} from "../chunk-AVHPSLQ2.js";
 import "../chunk-ZJR7VG5L.js";
 import "../chunk-YRMKDTKF.js";
 import "../chunk-JOASJWQR.js";
@@ -13,7 +13,7 @@ import "../chunk-CYEPCZN5.js";
 import "../chunk-DCGT4FPP.js";
 import "../chunk-Q4CAQGKQ.js";
 import "../chunk-CINZGPSJ.js";
-import "../chunk-XQNPGNKK.js";
+import "../chunk-ZUNNG6PC.js";
 import "../chunk-ZFXCQPNO.js";
 import "../chunk-Q6YIJGXJ.js";
 import "../chunk-ORFGK3XI.js";
@@ -24,14 +24,14 @@ import "../chunk-FAV25DUZ.js";
 import "../chunk-3ONXXHQO.js";
 import "../chunk-PVGDJXVK.js";
 import "../chunk-NNVTUXEB.js";
-import "../chunk-7MLB4NCL.js";
+import "../chunk-DXBCNDVD.js";
 import "../chunk-5UZXUTVO.js";
 import "../chunk-4H5ZJHEN.js";
 import "../chunk-4R4KTDIE.js";
 import "../chunk-RULE4VG5.js";
 import "../chunk-SCU65EZI.js";
-import "../chunk-KILOTVIF.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-MB5RSUW6.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-CPPS65WS.js";
 import "../chunk-DM2T26WE.js";
 import "../chunk-QSVPYQPG.js";

package/dist/namespaces/storage.js

@@ -1,15 +1,15 @@
 import {
   NamespaceStorageRouter
-} from "../chunk-XQNPGNKK.js";
+} from "../chunk-ZUNNG6PC.js";
 import "../chunk-ZFXCQPNO.js";
-import "../chunk-7MLB4NCL.js";
+import "../chunk-DXBCNDVD.js";
 import "../chunk-5UZXUTVO.js";
 import "../chunk-4H5ZJHEN.js";
 import "../chunk-4R4KTDIE.js";
 import "../chunk-RULE4VG5.js";
 import "../chunk-SCU65EZI.js";
-import "../chunk-KILOTVIF.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-MB5RSUW6.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-CPPS65WS.js";
 import "../chunk-DM2T26WE.js";
 import "../chunk-QSVPYQPG.js";

package/dist/operator-toolkit.js

@@ -11,8 +11,8 @@ import {
   summarizeMemoryWorthLegacyCounters,
   summarizeObservationThroughput,
   summarizeTierDistribution
-} from "./chunk-HA5SI4GK.js";
-import "./chunk-YEEAADCI.js";
+} from "./chunk-3GM7ZY6H.js";
+import "./chunk-AVHPSLQ2.js";
 import "./chunk-AL4RAJL5.js";
 import "./chunk-YBPYIAA5.js";
 import "./chunk-ZJR7VG5L.js";
@@ -25,7 +25,7 @@ import "./chunk-CYEPCZN5.js";
 import "./chunk-DCGT4FPP.js";
 import "./chunk-Q4CAQGKQ.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-XQNPGNKK.js";
+import "./chunk-ZUNNG6PC.js";
 import "./chunk-ZFXCQPNO.js";
 import "./chunk-Q6YIJGXJ.js";
 import "./chunk-ORFGK3XI.js";
@@ -43,19 +43,19 @@ import "./chunk-5GOMXHLC.js";
 import "./chunk-PHK3HARR.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-PVGDJXVK.js";
-import "./chunk-5BTCT236.js";
+import "./chunk-2GRRN7SZ.js";
 import "./chunk-NNVTUXEB.js";
 import "./chunk-XL7FK7PJ.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
-import "./chunk-7MLB4NCL.js";
+import "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/dist/orchestrator.js

@@ -27,22 +27,22 @@ import {
   sanitizeSessionKeyForFilename,
   shouldFilterLifecycleRecallCandidate,
   summarizeGraphShadowComparison
-} from "./chunk-O3U5BPUP.js";
+} from "./chunk-EDP57PFC.js";
 import "./chunk-5RIRL3XL.js";
 import "./chunk-4HFJQCJZ.js";
 import "./chunk-6BDVBBBY.js";
 import "./chunk-HHLLAQGZ.js";
-import "./chunk-QVO4YOB7.js";
+import "./chunk-D2B22JDF.js";
 import "./chunk-7N4KAIGN.js";
 import "./chunk-TPDBFYEG.js";
 import "./chunk-KCYE2MZM.js";
-import "./chunk-7XYTQGCC.js";
+import "./chunk-MAV46GWQ.js";
 import "./chunk-5VDJMYTF.js";
 import "./chunk-UWK5OXUJ.js";
 import "./chunk-TECVW3JP.js";
 import "./chunk-T2PO5MUF.js";
 import "./chunk-HP5FMB6L.js";
-import "./chunk-GLPBYIXN.js";
+import "./chunk-UK727RHF.js";
 import "./chunk-DRD2Q7HQ.js";
 import "./chunk-LXOM6IQU.js";
 import "./chunk-S75M5ZRK.js";
@@ -83,7 +83,7 @@ import "./chunk-54V4BZWP.js";
 import "./chunk-XZ4WBBB5.js";
 import "./chunk-77NAFXUD.js";
 import "./chunk-DB5A3NHS.js";
-import "./chunk-IEUU7O4F.js";
+import "./chunk-LANHQ7EN.js";
 import "./chunk-6NKAQ74D.js";
 import "./chunk-OAZ5MFUB.js";
 import "./chunk-PYPOFEMK.js";
@@ -94,17 +94,17 @@ import "./chunk-6HEM6HTQ.js";
 import "./chunk-XCAZF7KQ.js";
 import "./chunk-3PG3H5TD.js";
 import "./chunk-OD4FM2U7.js";
-import "./chunk-DEPRLVLK.js";
-import "./chunk-C6C7XVKG.js";
+import "./chunk-ZNCDQZIS.js";
+import "./chunk-4MHHUPNH.js";
 import "./chunk-JFEKNTX7.js";
 import "./chunk-JLNBQWZ2.js";
 import "./chunk-2PRQG7PV.js";
 import "./chunk-X6IRLNOO.js";
 import "./chunk-2F6NP3NT.js";
 import "./chunk-TERNBNJB.js";
-import "./chunk-QPD426WT.js";
+import "./chunk-CCNZM5UM.js";
 import "./chunk-W4RVMTHR.js";
-import "./chunk-PP2JH3GP.js";
+import "./chunk-YPNGPHNZ.js";
 import "./chunk-ZRWB5D4H.js";
 import "./chunk-A6D7A2FW.js";
 import "./chunk-FF4KLI5W.js";
@@ -119,7 +119,7 @@ import "./chunk-CYEPCZN5.js";
 import "./chunk-DCGT4FPP.js";
 import "./chunk-Q4CAQGKQ.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-XQNPGNKK.js";
+import "./chunk-ZUNNG6PC.js";
 import "./chunk-ZFXCQPNO.js";
 import "./chunk-Q6YIJGXJ.js";
 import "./chunk-ORFGK3XI.js";
@@ -171,14 +171,14 @@ import "./chunk-IMA6GU4Y.js";
 import "./chunk-XL7FK7PJ.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
-import "./chunk-7MLB4NCL.js";
+import "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/dist/runtime/better-sqlite.d.ts

@@ -4,5 +4,6 @@ type BetterSqlite3Database = BetterSqlite3.Database;
 type BetterSqlite3Ctor = typeof BetterSqlite3;
 declare function openBetterSqlite3(file: string, options?: ConstructorParameters<BetterSqlite3Ctor>[1]): BetterSqlite3Database;
 declare function isLikelyBetterSqlite3NativeBindingError(error: unknown): boolean;
+declare function displayErrorDetail(error: unknown): string;
 
-export { type BetterSqlite3Database, isLikelyBetterSqlite3NativeBindingError, openBetterSqlite3 };
+export { type BetterSqlite3Database, displayErrorDetail, isLikelyBetterSqlite3NativeBindingError, openBetterSqlite3 };

package/dist/runtime/better-sqlite.js

@@ -1,9 +1,11 @@
 import {
+  displayErrorDetail,
   isLikelyBetterSqlite3NativeBindingError,
   openBetterSqlite3
-} from "../chunk-3HPAPHUK.js";
+} from "../chunk-6KYMPV2O.js";
 import "../chunk-PZ5AY32C.js";
 export {
+  displayErrorDetail,
   isLikelyBetterSqlite3NativeBindingError,
   openBetterSqlite3
 };

package/dist/semantic-consolidation.js

@@ -7,21 +7,21 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-DEPRLVLK.js";
-import "./chunk-C6C7XVKG.js";
+} from "./chunk-ZNCDQZIS.js";
+import "./chunk-4MHHUPNH.js";
 import "./chunk-JFEKNTX7.js";
 import {
   resolveExtensionsRoot
 } from "./chunk-JLNBQWZ2.js";
 import "./chunk-3UXOZBHV.js";
-import "./chunk-7MLB4NCL.js";
+import "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/dist/semantic-rule-promotion.js

@@ -1,15 +1,15 @@
 import {
   promoteSemanticRuleFromMemory,
   setSemanticRulePromotionTestHooks
-} from "./chunk-CIOMS6DI.js";
-import "./chunk-7MLB4NCL.js";
+} from "./chunk-UCGCSZP2.js";
+import "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/dist/semantic-rule-verifier.js

@@ -1,14 +1,14 @@
 import {
   searchVerifiedSemanticRules
-} from "./chunk-PP2JH3GP.js";
-import "./chunk-7MLB4NCL.js";
+} from "./chunk-YPNGPHNZ.js";
+import "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/dist/storage.js

@@ -8,14 +8,14 @@ import {
   normalizeEntityName,
   parseEntityFile,
   serializeEntityFile
-} from "./chunk-7MLB4NCL.js";
+} from "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/dist/transfer/export-sqlite.js

@@ -1,8 +1,8 @@
 import {
   exportSqlite
-} from "../chunk-S53OYO3F.js";
+} from "../chunk-7VFZTJ7K.js";
 import "../chunk-Z734BLO3.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-UI3NYK34.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";

package/dist/transfer/import-sqlite.js

@@ -1,9 +1,9 @@
 import {
   importSqlite
-} from "../chunk-4RR6ROTB.js";
+} from "../chunk-AGNBY3VG.js";
 import "../chunk-Z734BLO3.js";
 import "../chunk-G4IAEX6D.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/verified-recall.js

@@ -1,15 +1,15 @@
 import {
   searchVerifiedEpisodes
-} from "./chunk-QPD426WT.js";
+} from "./chunk-CCNZM5UM.js";
 import "./chunk-HQ6NIBL6.js";
-import "./chunk-7MLB4NCL.js";
+import "./chunk-DXBCNDVD.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-4H5ZJHEN.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.3.621",
+  "version": "9.3.622",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",

package/src/runtime/better-sqlite.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import {
+  displayErrorDetail,
   isLikelyBetterSqlite3NativeBindingError,
   openBetterSqlite3,
 } from "./better-sqlite.js";
@@ -21,6 +22,34 @@ test("isLikelyBetterSqlite3NativeBindingError recognizes missing and mismatched
   assert.equal(isLikelyBetterSqlite3NativeBindingError(new Error("SQLITE_BUSY: database is locked")), false);
 });
 
+test("displayErrorDetail surfaces only error class + code, never the raw message (CodeQL js/stack-trace-exposure)", () => {
+  // MODULE_NOT_FOUND messages embed an absolute "Require stack:" path block.
+  const moduleNotFound = Object.assign(
+    new Error("Cannot find module 'better-sqlite3'\nRequire stack:\n- /home/app/node_modules/x/index.js"),
+    { code: "MODULE_NOT_FOUND" },
+  );
+  const d1 = displayErrorDetail(moduleNotFound);
+  assert.equal(d1, "Error (MODULE_NOT_FOUND)");
+  assert.ok(!d1.includes("/home/app") && !d1.includes("Require stack"));
+
+  // Native loader failures can embed an absolute path (even with spaces) in the
+  // message; we never surface it.
+  const dlopen = Object.assign(
+    new Error("/Users/Jane Doe/app/node_modules/better-sqlite3/build/Release/better_sqlite3.node: file too short"),
+    { code: "ERR_DLOPEN_FAILED" },
+  );
+  const d2 = displayErrorDetail(dlopen);
+  assert.equal(d2, "Error (ERR_DLOPEN_FAILED)");
+  assert.ok(!d2.includes("/Users/Jane Doe") && !d2.includes(".node"));
+
+  // No code → class name only. error.stack is never read.
+  const noCode = new Error("boom");
+  noCode.stack = "boom\n    at /home/app/secret.js:1:1";
+  assert.equal(displayErrorDetail(noCode), "Error");
+
+  assert.equal(displayErrorDetail("not an error"), "");
+});
+
 test("openBetterSqlite3 can open an in-memory database after install verification", () => {
   const db = openBetterSqlite3(":memory:");
   try {

package/src/runtime/better-sqlite.ts

@@ -41,8 +41,19 @@ function requireBetterSqlite3Ctor(require: RuntimeRequire): BetterSqlite3Ctor {
   return ctor;
 }
 
+// Raw, unredacted message — used ONLY for internal classification (detecting a
+// native-binding mismatch). Never returned to a user-facing surface, because it
+// can contain absolute paths. Native-binding markers (better_sqlite3.node,
+// NODE_MODULE_VERSION, "was compiled against a different Node.js version") live
+// in error.message, so message text is sufficient and we never read .stack.
+function rawErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error ?? "");
+}
+
 export function isLikelyBetterSqlite3NativeBindingError(error: unknown): boolean {
-  const detail = errorDetail(error);
+  // Classify on the RAW message so redaction can't strip detection markers
+  // (e.g. the path containing "better_sqlite3.node").
+  const detail = rawErrorMessage(error);
   return (
     detail.includes("Could not locate the bindings file") ||
     detail.includes("better_sqlite3.node") ||
@@ -53,7 +64,7 @@ export function isLikelyBetterSqlite3NativeBindingError(error: unknown): boolean
 }
 
 function unavailableError(error: unknown): Error {
-  const detail = errorDetail(error);
+  const detail = displayErrorDetail(error);
   const nativeBindingHint = isLikelyBetterSqlite3NativeBindingError(error)
     ? " This usually means the better-sqlite3 native binding was not compiled for this Node.js/platform combination. " +
       "Run `node scripts/ensure-better-sqlite3.mjs` from the Remnic install directory, or run " +
@@ -67,10 +78,21 @@ function unavailableError(error: unknown): Error {
   );
 }
 
-function errorDetail(error: unknown): string {
-  if (error instanceof Error) {
-    const stack = error.stack && error.stack !== error.message ? `\n${error.stack}` : "";
-    return `${error.message}${stack}`;
-  }
-  return String(error ?? "");
+// Sanitized, user-facing error detail. This string becomes the message of the
+// Error thrown by unavailableError(), which propagates to user-facing surfaces
+// (HTTP error bodies, MCP tool errors — access-http.ts / access-mcp.ts return
+// err.message). We must not leak server internals (CodeQL js/stack-trace-exposure):
+//   - error.stack is never read.
+// We deliberately surface only the error's class name and Node error code —
+// never the raw message. Node module-load failures embed absolute server paths
+// directly in error.message (the "Require stack:" block, and unquoted native
+// loader paths that may even contain spaces), which no regex can redact
+// reliably. The error code (MODULE_NOT_FOUND, ERR_DLOPEN_FAILED, …) is a stable,
+// path-free identifier that, together with the native-binding hint, is enough
+// for a user to act on. The full original error stays on the `cause` chain and
+// is logged with its stack elsewhere.
+export function displayErrorDetail(error: unknown): string {
+  if (!(error instanceof Error)) return "";
+  const code = (error as NodeJS.ErrnoException).code;
+  return typeof code === "string" && code.length > 0 ? `${error.name} (${code})` : error.name;
 }

package/dist/chunk-3HPAPHUK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/runtime/better-sqlite.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport type BetterSqlite3 from \"better-sqlite3\";\n\nexport type BetterSqlite3Database = BetterSqlite3.Database;\ntype BetterSqlite3Ctor = typeof BetterSqlite3;\ntype RuntimeRequire = ReturnType<typeof createRequire>;\n\nlet cachedCtor: BetterSqlite3Ctor | null = null;\n\nfunction loadBetterSqlite3(): BetterSqlite3Ctor {\n  if (cachedCtor) return cachedCtor;\n\n  const require = createRequire(import.meta.url);\n\n  try {\n    cachedCtor = requireBetterSqlite3Ctor(require);\n    return cachedCtor;\n  } catch (error) {\n    throw unavailableError(error);\n  }\n}\n\nexport function openBetterSqlite3(\n  file: string,\n  options?: ConstructorParameters<BetterSqlite3Ctor>[1],\n): BetterSqlite3Database {\n  const Database = loadBetterSqlite3();\n  return new Database(file, options);\n}\n\nfunction requireBetterSqlite3Ctor(require: RuntimeRequire): BetterSqlite3Ctor {\n  const loaded = require(\"better-sqlite3\") as\n    | BetterSqlite3Ctor\n    | { default?: BetterSqlite3Ctor };\n  const ctor = typeof loaded === \"function\" ? loaded : loaded.default;\n\n  if (typeof ctor !== \"function\") {\n    throw new Error(\"module did not export a constructor\");\n  }\n\n  return ctor;\n}\n\nexport function isLikelyBetterSqlite3NativeBindingError(error: unknown): boolean {\n  const detail = errorDetail(error);\n  return (\n    detail.includes(\"Could not locate the bindings file\") ||\n    detail.includes(\"better_sqlite3.node\") ||\n    (detail.includes(\"node-v\") && detail.includes(\"better-sqlite3\")) ||\n    (detail.includes(\"NODE_MODULE_VERSION\") && detail.includes(\"better-sqlite3\")) ||\n    detail.includes(\"was compiled against a different Node.js version\")\n  );\n}\n\nfunction unavailableError(error: unknown): Error {\n  const detail = errorDetail(error);\n  const nativeBindingHint = isLikelyBetterSqlite3NativeBindingError(error)\n    ? \" This usually means the better-sqlite3 native binding was not compiled for this Node.js/platform combination. \" +\n      \"Run `node scripts/ensure-better-sqlite3.mjs` from the Remnic install directory, or run \" +\n      \"`npx node-gyp rebuild --directory=node_modules/better-sqlite3` if the verification script is unavailable.\"\n    : \"\";\n  return new Error(\n    \"better-sqlite3 is unavailable. Remnic attempted to load the native SQLite binding and could not.\" +\n      nativeBindingHint +\n      (detail ? ` Original error: ${detail}` : \"\"),\n    { cause: error instanceof Error ? error : undefined },\n  );\n}\n\nfunction errorDetail(error: unknown): string {\n  if (error instanceof Error) {\n    const stack = error.stack && error.stack !== error.message ? `\\n${error.stack}` : \"\";\n    return `${error.message}${stack}`;\n  }\n  return String(error ?? \"\");\n}\n"],"mappings":";AAAA,SAAS,qBAAqB;AAO9B,IAAI,aAAuC;AAE3C,SAAS,oBAAuC;AAC9C,MAAI,WAAY,QAAO;AAEvB,QAAMA,WAAU,cAAc,YAAY,GAAG;AAE7C,MAAI;AACF,iBAAa,yBAAyBA,QAAO;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,iBAAiB,KAAK;AAAA,EAC9B;AACF;AAEO,SAAS,kBACd,MACA,SACuB;AACvB,QAAM,WAAW,kBAAkB;AACnC,SAAO,IAAI,SAAS,MAAM,OAAO;AACnC;AAEA,SAAS,yBAAyBA,UAA4C;AAC5E,QAAM,SAASA,SAAQ,gBAAgB;AAGvC,QAAM,OAAO,OAAO,WAAW,aAAa,SAAS,OAAO;AAE5D,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,SAAO;AACT;AAEO,SAAS,wCAAwC,OAAyB;AAC/E,QAAM,SAAS,YAAY,KAAK;AAChC,SACE,OAAO,SAAS,oCAAoC,KACpD,OAAO,SAAS,qBAAqB,KACpC,OAAO,SAAS,QAAQ,KAAK,OAAO,SAAS,gBAAgB,KAC7D,OAAO,SAAS,qBAAqB,KAAK,OAAO,SAAS,gBAAgB,KAC3E,OAAO,SAAS,kDAAkD;AAEtE;AAEA,SAAS,iBAAiB,OAAuB;AAC/C,QAAM,SAAS,YAAY,KAAK;AAChC,QAAM,oBAAoB,wCAAwC,KAAK,IACnE,mTAGA;AACJ,SAAO,IAAI;AAAA,IACT,qGACE,qBACC,SAAS,oBAAoB,MAAM,KAAK;AAAA,IAC3C,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAU;AAAA,EACtD;AACF;AAEA,SAAS,YAAY,OAAwB;AAC3C,MAAI,iBAAiB,OAAO;AAC1B,UAAM,QAAQ,MAAM,SAAS,MAAM,UAAU,MAAM,UAAU;AAAA,EAAK,MAAM,KAAK,KAAK;AAClF,WAAO,GAAG,MAAM,OAAO,GAAG,KAAK;AAAA,EACjC;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;","names":["require"]}