@remnic/core 9.3.621 → 9.3.623

package/dist/semantic-chunking.js

@@ -6,8 +6,8 @@ import {
   movingAverage,
   semanticChunkContent,
   stddev
-} from "./chunk-WCYKT2DE.js";
-import "./chunk-4WMCPJWX.js";
+} from "./chunk-P4BC54KI.js";
+import "./chunk-UQ7RN5HK.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_SEMANTIC_CHUNKING_CONFIG,

package/dist/semantic-consolidation.js

@@ -7,24 +7,24 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-DEPRLVLK.js";
-import "./chunk-C6C7XVKG.js";
-import "./chunk-JFEKNTX7.js";
+} from "./chunk-QFQQFX2H.js";
+import "./chunk-UGEBPVNI.js";
+import "./chunk-LN4YGHTM.js";
 import {
   resolveExtensionsRoot
 } from "./chunk-JLNBQWZ2.js";
 import "./chunk-3UXOZBHV.js";
-import "./chunk-7MLB4NCL.js";
+import "./chunk-PJGB7XRR.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-4H5ZJHEN.js";
+import "./chunk-J6A3CX5N.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
-import "./chunk-QSVPYQPG.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FVQJYWH7.js";
 import {
   CONSOLIDATION_OPERATORS,

package/dist/semantic-rule-promotion.js

@@ -1,18 +1,18 @@
 import {
   promoteSemanticRuleFromMemory,
   setSemanticRulePromotionTestHooks
-} from "./chunk-CIOMS6DI.js";
-import "./chunk-7MLB4NCL.js";
+} from "./chunk-ZZPIJPPD.js";
+import "./chunk-PJGB7XRR.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-4H5ZJHEN.js";
+import "./chunk-J6A3CX5N.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
-import "./chunk-QSVPYQPG.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FVQJYWH7.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ALEPI75L.js";

package/dist/semantic-rule-verifier.js

@@ -1,17 +1,17 @@
 import {
   searchVerifiedSemanticRules
-} from "./chunk-PP2JH3GP.js";
-import "./chunk-7MLB4NCL.js";
+} from "./chunk-2UFQYU5F.js";
+import "./chunk-PJGB7XRR.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-4H5ZJHEN.js";
+import "./chunk-J6A3CX5N.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
-import "./chunk-QSVPYQPG.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FVQJYWH7.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ALEPI75L.js";

package/dist/source-attribution.js

@@ -10,7 +10,7 @@ import {
   parseCitation,
   stripCitation,
   stripCitationForTemplate
-} from "./chunk-4H5ZJHEN.js";
+} from "./chunk-J6A3CX5N.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CITATION_UNKNOWN,

package/dist/storage.js

@@ -8,17 +8,17 @@ import {
   normalizeEntityName,
   parseEntityFile,
   serializeEntityFile
-} from "./chunk-7MLB4NCL.js";
+} from "./chunk-PJGB7XRR.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-4H5ZJHEN.js";
+import "./chunk-J6A3CX5N.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
-import "./chunk-QSVPYQPG.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FVQJYWH7.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ALEPI75L.js";

package/dist/summarizer.js

@@ -1,15 +1,15 @@
 import {
   HourlySummarizer
-} from "./chunk-XAZOWLW4.js";
+} from "./chunk-3VONWEQB.js";
 import "./chunk-XJNBEDFE.js";
 import "./chunk-XZ4WBBB5.js";
 import "./chunk-77NAFXUD.js";
 import "./chunk-FF4KLI5W.js";
-import "./chunk-DEVUWMME.js";
+import "./chunk-KGIGRNR6.js";
 import "./chunk-B5XMS73R.js";
 import "./chunk-7SI52C65.js";
 import "./chunk-L2EXJQJP.js";
-import "./chunk-UZB5KHKX.js";
+import "./chunk-RGMVMVMF.js";
 import "./chunk-RK6F44Y6.js";
 import "./chunk-NNVTUXEB.js";
 import "./chunk-EYIEWJNI.js";

package/dist/temporal-supersession.js

@@ -6,7 +6,7 @@ import {
   shouldFilterSupersededFromRecall,
   shouldSupersedeExisting,
   supersessionKeysForFact
-} from "./chunk-K5O2QY6T.js";
+} from "./chunk-YTWNKQ2G.js";
 import "./chunk-MDYG7VI7.js";
 import "./chunk-2ODBA7MQ.js";
 import "./chunk-PZ5AY32C.js";

package/dist/transfer/export-sqlite.js

@@ -1,8 +1,8 @@
 import {
   exportSqlite
-} from "../chunk-S53OYO3F.js";
+} from "../chunk-7VFZTJ7K.js";
 import "../chunk-Z734BLO3.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-UI3NYK34.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";

package/dist/transfer/import-sqlite.js

@@ -1,9 +1,9 @@
 import {
   importSqlite
-} from "../chunk-4RR6ROTB.js";
+} from "../chunk-AGNBY3VG.js";
 import "../chunk-Z734BLO3.js";
 import "../chunk-G4IAEX6D.js";
-import "../chunk-3HPAPHUK.js";
+import "../chunk-6KYMPV2O.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/transfer/types.d.ts

@@ -313,13 +313,13 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         peerProfiles: boolean;
     }>;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: string;
     includes: {
         procedural: boolean;
         taxonomy: boolean;
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
+    schemaVersion: string;
     id: string;
     description: string;
     version: string;
@@ -334,13 +334,13 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         directAnswerEnabled: boolean;
     };
 }, {
-    schemaVersion: string;
     includes: {
         procedural: boolean;
         taxonomy: boolean;
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
+    schemaVersion: string;
     id: string;
     description: string;
     version: string;
@@ -464,13 +464,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             peerProfiles: boolean;
         }>;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         description: string;
         version: string;
@@ -485,13 +485,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             directAnswerEnabled: boolean;
         };
     }, {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         description: string;
         version: string;
@@ -518,13 +518,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
     pluginVersion: string;
     includesTranscripts: boolean;
     capsule: {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         description: string;
         version: string;
@@ -551,13 +551,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
     pluginVersion: string;
     includesTranscripts: boolean;
     capsule: {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         description: string;
         version: string;
@@ -683,13 +683,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 peerProfiles: boolean;
             }>;
         }, "strip", z.ZodTypeAny, {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             description: string;
             version: string;
@@ -704,13 +704,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         }, {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             description: string;
             version: string;
@@ -737,13 +737,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             description: string;
             version: string;
@@ -770,13 +770,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             description: string;
             version: string;
@@ -815,13 +815,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             description: string;
             version: string;
@@ -854,13 +854,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             description: string;
             version: string;

package/dist/verified-recall.js

@@ -1,18 +1,18 @@
 import {
   searchVerifiedEpisodes
-} from "./chunk-QPD426WT.js";
+} from "./chunk-R3OQGYOU.js";
 import "./chunk-HQ6NIBL6.js";
-import "./chunk-7MLB4NCL.js";
+import "./chunk-PJGB7XRR.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-4H5ZJHEN.js";
+import "./chunk-J6A3CX5N.js";
 import "./chunk-4R4KTDIE.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-KILOTVIF.js";
-import "./chunk-3HPAPHUK.js";
+import "./chunk-MB5RSUW6.js";
+import "./chunk-6KYMPV2O.js";
 import "./chunk-CPPS65WS.js";
 import "./chunk-DM2T26WE.js";
-import "./chunk-QSVPYQPG.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FVQJYWH7.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ALEPI75L.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.3.621",
+  "version": "9.3.623",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",

package/src/chunking.ts

@@ -50,32 +50,47 @@ function estimateTokens(text: string): number {
  * Handles common abbreviations and edge cases.
  */
 function splitSentences(text: string): string[] {
-  // Split on sentence-ending punctuation followed by whitespace or end of string
-  // Preserve the punctuation with the sentence
+  // Split on sentence-ending punctuation (. ! ?) that is followed by whitespace
+  // or end of string; the punctuation stays with the sentence.
+  //
+  // Implemented as a single linear scan rather than a regex. Every regex form of
+  // this split is either polynomial (CodeQL js/polynomial-redos) or — once
+  // bounded/anchored to satisfy CodeQL — mishandles long runs or non-boundary
+  // punctuation (a global match silently drops a skipped prefix; a sticky match
+  // stops at the first interior `.` that is not a real boundary, e.g. "v1.2.3"
+  // or "example.com", emitting the whole document as one chunk). A character
+  // scan is O(n), allocation-free, drops nothing, and treats interior
+  // punctuation correctly. Normal prose splits identically to the previous
+  // /[^.!?]*[.!?]+(?:\s+|$)/g form.
   const sentences: string[] = [];
-
-  // Regex to match sentence boundaries
-  // Match: period/exclamation/question followed by space or end, but not abbreviations
-  const sentenceRegex = /[^.!?]*[.!?]+(?:\s+|$)/g;
-
-  let match: RegExpExecArray | null;
-  let lastIndex = 0;
-
-  while ((match = sentenceRegex.exec(text)) !== null) {
-    sentences.push(match[0].trim());
-    lastIndex = sentenceRegex.lastIndex;
-  }
-
-  // Handle remaining text without sentence-ending punctuation
-  if (lastIndex < text.length) {
-    const remaining = text.slice(lastIndex).trim();
-    if (remaining) {
-      sentences.push(remaining);
+  let start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (ch !== "." && ch !== "!" && ch !== "?") continue;
+    // Consume a run of terminators (e.g. "?!", "...").
+    let end = i;
+    while (end + 1 < text.length) {
+      const n = text[end + 1];
+      if (n !== "." && n !== "!" && n !== "?") break;
+      end++;
+    }
+    const after = text[end + 1];
+    // A real boundary only if the terminator run ends the string or is followed
+    // by whitespace. Interior punctuation (no following whitespace) is left in
+    // place and the scan continues.
+    if (after === undefined || /\s/.test(after)) {
+      const sentence = text.slice(start, end + 1).trim();
+      if (sentence.length > 0) sentences.push(sentence);
+      start = end + 1;
     }
+    i = end;
   }
-
-  // Filter out empty sentences
-  return sentences.filter((s) => s.length > 0);
+  // Trailing text without a closing terminator.
+  if (start < text.length) {
+    const remaining = text.slice(start).trim();
+    if (remaining.length > 0) sentences.push(remaining);
+  }
+  return sentences;
 }
 
 /**

package/src/coding/review-context.ts

@@ -142,7 +142,13 @@ export function parseTouchedFiles(diff: string | null | undefined): string[] {
     // everything after the first whitespace in a quoted path.
     const headerPrefix = line.match(/^(?:---|\+\+\+)[ \t]+/);
     if (headerPrefix) {
-      const tail = line.slice(headerPrefix[0].length).replace(/[ \t]+$/, "");
+      // Linear trailing space/tab trim instead of /[ \t]+$/, whose anchored
+      // quantifier backtracks polynomially on a long diff line (CodeQL
+      // js/polynomial-redos).
+      const sliced = line.slice(headerPrefix[0].length);
+      let tailEnd = sliced.length;
+      while (tailEnd > 0 && (sliced[tailEnd - 1] === " " || sliced[tailEnd - 1] === "\t")) tailEnd--;
+      const tail = sliced.slice(0, tailEnd);
       const raw = extractSingleDiffPathToken(tail);
       if (raw) {
         const stripped = stripDiffPathPrefix(raw);

package/src/connectors/codex-materialize.ts

@@ -550,7 +550,12 @@ export function renderMemorySummary(ctx: SummaryRenderContext): string {
     lines.push("");
   }
 
-  const full = lines.join("\n").replace(/\n+$/u, "\n");
+  // Collapse trailing newlines to one without the anchored /\n+$/ quantifier,
+  // which backtracks polynomially (CodeQL js/polynomial-redos).
+  const joined = lines.join("\n");
+  let joinedEnd = joined.length;
+  while (joinedEnd > 0 && joined[joinedEnd - 1] === "\n") joinedEnd--;
+  const full = joinedEnd === joined.length ? joined : `${joined.slice(0, joinedEnd)}\n`;
   return truncateToTokenBudget(full, ctx.maxTokens);
 }
 

package/src/explicit-capture.ts

@@ -40,8 +40,13 @@ export type ValidExplicitCapture = {
 export type ExplicitCaptureSource = "memory_store" | "memory_capture" | "suggestion_submit" | "inline";
 type ExplicitCaptureValidationMode = "legacy_tool" | "strict_explicit";
 
-const INLINE_NOTE_RE = /<memory_note>\s*([\s\S]*?)\s*<\/memory_note>/gi;
-const INLINE_NOTE_MARKUP_RE = /<memory_note>\s*[\s\S]*?\s*<\/memory_note>/i;
+// Bounded body {0,100000} instead of an unbounded lazy *? so scanning for the
+// closing tag cannot backtrack polynomially on unterminated <memory_note>
+// markup in hostile turn text (CodeQL js/polynomial-redos). 100 000 chars far
+// exceeds any real inline note, so matching is behavior-preserving; the outer
+// \s* groups were also dropped (body absorbs whitespace; captures are trimmed).
+const INLINE_NOTE_RE = /<memory_note>([\s\S]{0,100000}?)<\/memory_note>/gi;
+const INLINE_NOTE_MARKUP_RE = /<memory_note>[\s\S]{0,100000}?<\/memory_note>/i;
 const INLINE_ALLOWED_CATEGORIES = new Set<MemoryCategory>([
   "fact",
   "preference",

package/src/identity-continuity.ts

@@ -200,7 +200,13 @@ function splitLoopMarkdown(raw: string | null): { header: string; sections: Mark
   let current: MarkdownSection | null = null;
 
   for (const line of lines) {
-    const sectionMatch = line.match(/^##\s+(.+?)\s*$/);
+    // /^##\s(.+)$/ + the trim below is exactly equivalent to the original
+    // /^##\s+(.+?)\s*$/ (same match/no-match and same trimmed title across all
+    // inputs, including "## " → no-match and "##  " → empty title) but has no
+    // adjacent overlapping quantifiers, so it cannot backtrack polynomially
+    // (CodeQL js/polynomial-redos). \s matches a single fixed-width char and
+    // .+ runs greedily to the line end — no \s+/.* overlap.
+    const sectionMatch = line.match(/^##\s(.+)$/);
     if (sectionMatch) {
       if (current) sections.push({ title: current.title, body: current.body.trimEnd() });
       current = { title: sectionMatch[1].trim(), body: "" };

package/src/json-extract.ts

@@ -10,7 +10,10 @@
  */
 
 export function stripCodeFences(text: string): string {
-  return text.replace(/```(?:json)?\s*([\s\S]*?)```/gi, (_m, inner) => String(inner).trim());
+  // Drop the leading \s* before the lazy body: it overlapped the body and caused
+  // polynomial backtracking on unterminated fences (CodeQL js/polynomial-redos).
+  // inner is trimmed, so captured content is identical.
+  return text.replace(/```(?:json)?([\s\S]*?)```/gi, (_m, inner) => String(inner).trim());
 }
 
 export function extractJsonCandidates(text: string): string[] {

package/src/orchestrator.ts

@@ -943,7 +943,11 @@ export function formatCompressionGuidelinesForRecall(
 ): string | null {
   if (typeof raw !== "string" || raw.trim().length === 0) return null;
   const sectionMatch = raw.match(
-    /## Suggested Guidelines\s*\n([\s\S]*?)(?:\n##\s+|\s*$)/i,
+    // End the section at `\n## ` or end-of-string. Plain $ (not \s*$): the
+    // \s* branch overlapped the lazy body and backtracked polynomially
+    // (CodeQL js/polynomial-redos). Captured lines are trimmed/filtered below,
+    // so trailing whitespace handling is unchanged.
+    /## Suggested Guidelines\s*\n([\s\S]*?)(?:\n##\s+|$)/i,
   );
   if (!sectionMatch) return null;
 

package/src/peers/profile-reasoner.ts

@@ -262,7 +262,10 @@ export function parsePeerProfileReasonerResponse(
 ): PeerProfileReasonerProposal[] {
   if (typeof raw !== "string" || raw.trim() === "") return [];
   const trimmed = raw.trim();
-  const fenced = /^```(?:json)?\s*([\s\S]*?)```\s*$/u.exec(trimmed);
+  // Dropped the \s* groups around the lazy body (they overlapped it and
+  // backtracked polynomially — CodeQL js/polynomial-redos). Input is already
+  // trimmed and fenced[1] is trimmed below, so matches are identical.
+  const fenced = /^```(?:json)?([\s\S]*?)```$/u.exec(trimmed);
   const payload = fenced ? fenced[1].trim() : trimmed;
   let parsed: unknown;
   try {

package/src/runtime/better-sqlite.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import {
+  displayErrorDetail,
   isLikelyBetterSqlite3NativeBindingError,
   openBetterSqlite3,
 } from "./better-sqlite.js";
@@ -21,6 +22,34 @@ test("isLikelyBetterSqlite3NativeBindingError recognizes missing and mismatched
   assert.equal(isLikelyBetterSqlite3NativeBindingError(new Error("SQLITE_BUSY: database is locked")), false);
 });
 
+test("displayErrorDetail surfaces only error class + code, never the raw message (CodeQL js/stack-trace-exposure)", () => {
+  // MODULE_NOT_FOUND messages embed an absolute "Require stack:" path block.
+  const moduleNotFound = Object.assign(
+    new Error("Cannot find module 'better-sqlite3'\nRequire stack:\n- /home/app/node_modules/x/index.js"),
+    { code: "MODULE_NOT_FOUND" },
+  );
+  const d1 = displayErrorDetail(moduleNotFound);
+  assert.equal(d1, "Error (MODULE_NOT_FOUND)");
+  assert.ok(!d1.includes("/home/app") && !d1.includes("Require stack"));
+
+  // Native loader failures can embed an absolute path (even with spaces) in the
+  // message; we never surface it.
+  const dlopen = Object.assign(
+    new Error("/Users/Jane Doe/app/node_modules/better-sqlite3/build/Release/better_sqlite3.node: file too short"),
+    { code: "ERR_DLOPEN_FAILED" },
+  );
+  const d2 = displayErrorDetail(dlopen);
+  assert.equal(d2, "Error (ERR_DLOPEN_FAILED)");
+  assert.ok(!d2.includes("/Users/Jane Doe") && !d2.includes(".node"));
+
+  // No code → class name only. error.stack is never read.
+  const noCode = new Error("boom");
+  noCode.stack = "boom\n    at /home/app/secret.js:1:1";
+  assert.equal(displayErrorDetail(noCode), "Error");
+
+  assert.equal(displayErrorDetail("not an error"), "");
+});
+
 test("openBetterSqlite3 can open an in-memory database after install verification", () => {
   const db = openBetterSqlite3(":memory:");
   try {