claude-mem-lite 2.90.0 → 2.90.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "2.90.0",
+      "version": "2.90.1",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "2.90.0",
+  "version": "2.90.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/cli.mjs

@@ -32,7 +32,10 @@ if (cmd === '--version' || cmd === '-v') {
   // No command: show CLI help if installed, install help if not
   const { existsSync } = await import('fs');
   const { join } = await import('path');
-  const dbPath = join(process.env.HOME || '', '.claude-mem-lite', 'claude-mem-lite.db');
+  // D#29: honor CLAUDE_MEM_DIR so the install-vs-CLI help routing is correct on
+  // relocated installs (matches schema.mjs DB_DIR; HOME fallback when env unset).
+  const dataDir = process.env.CLAUDE_MEM_DIR || join(process.env.HOME || '', '.claude-mem-lite');
+  const dbPath = join(dataDir, 'claude-mem-lite.db');
   if (existsSync(dbPath)) {
     const { run } = await import('./mem-cli.mjs');
     await run(['help']);

package/mem-cli.mjs

@@ -26,7 +26,7 @@ import { cmdAdopt, cmdUnadopt } from './adopt-cli.mjs';
 import { parseIntFlag, isNumericToken } from './lib/cli-flags.mjs';
 import { auditMemdir, memdirPath } from './memdir.mjs';
 import { probeOtherSources as probeIdSources, bucketIdTokens } from './lib/id-routing.mjs';
-import { basename, join } from 'path';
+import { basename, join, sep } from 'path';
 import { readFileSync, existsSync, readdirSync } from 'fs';
 
 // v2.41: shared CLI helpers extracted to cli/common.mjs. Keep this file as the
@@ -2180,7 +2180,7 @@ function cmdRegistry(_memDb, args) {
       for (const r of results) {
         const badge = r.quality_tier === 'installed' ? '[✓]' : r.quality_tier === 'verified' ? '[★]' : '[○]';
         const categoryLabel = r.category ? ` [${r.category}]` : '';
-        const isManaged = r.local_path && r.local_path.includes('/.claude-mem-lite/managed/');
+        const isManaged = r.local_path && r.local_path.includes(join(DB_DIR, 'managed') + sep);
         const portablePath = isManaged && r.local_path.startsWith(home) ? '~' + r.local_path.slice(home.length) : (r.local_path || '');
         let howToUse;
         if (isManaged) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "2.90.0",
+  "version": "2.90.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-importer.mjs

@@ -8,9 +8,12 @@ import { debugLog, isPathConfined } from './utils.mjs';
 import { createHash } from 'crypto';
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { homedir } from 'os';
+import { DB_DIR } from './schema.mjs';
 
-const MANAGED_DIR = join(homedir(), '.claude-mem-lite', 'managed');
+// DATA artifact — managed resources live under the env-aware data dir (DB_DIR),
+// NOT a hardcoded homedir, so GitHub imports land where install.mjs + registry-scanner
+// read them under CLAUDE_MEM_DIR relocation (D#29). Equals homedir when the env is unset.
+const MANAGED_DIR = join(DB_DIR, 'managed');
 
 // ─── Tree Discovery ─────────────────────────────────────────────────────────
 

package/scripts/pre-skill-bridge.js

@@ -11,9 +11,15 @@ import { recordHookError } from '../lib/hook-telemetry.mjs';
 // CLAUDE_MEM_DIR mirrors pre-tool-recall.js — one env var sandboxes everything.
 const DATA_DIR = process.env.CLAUDE_MEM_DIR || join(homedir(), '.claude-mem-lite');
 const RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || join(DATA_DIR, 'runtime');
-const REGISTRY_DB_PATH = join(homedir(), '.claude-mem-lite', 'resource-registry.db');
-const MANAGED_BASE = join(homedir(), '.claude-mem-lite');
-const MANAGED_MARKER = '/.claude-mem-lite/managed/';
+// D#29: all data artifacts follow DATA_DIR (CLAUDE_MEM_DIR-aware), not a hardcoded
+// homedir — previously REGISTRY_DB_PATH/MANAGED_BASE/MARKER pinned homedir while line 12
+// honored the env, so relocated installs opened the wrong DB and the marker never matched
+// the relocated local_path. MANAGED_MARKER is only a coarse LIKE prefilter; the exact
+// MANAGED_BASE prefix check below is the real confinement gate (so LIKE-wildcard chars in
+// a relocated path can at worst over-admit to that gate, never bypass it).
+const REGISTRY_DB_PATH = join(DATA_DIR, 'resource-registry.db');
+const MANAGED_BASE = DATA_DIR;
+const MANAGED_MARKER = join(DATA_DIR, 'managed') + sep;
 
 try {
   // Skip if recursive hook

package/scripts/user-prompt-search.js

@@ -8,7 +8,7 @@ import { sanitizeFtsQuery, relaxFtsQueryToOr, truncate, typeIcon, inferProject,
 import { citeFactorClause } from '../scoring-sql.mjs';
 import { cjkPrecisionOk } from '../nlp.mjs';
 import { writeFileSync, readFileSync, existsSync, renameSync } from 'fs';
-import { join } from 'path';
+import { join, sep } from 'path';
 import Database from 'better-sqlite3';
 import { shouldSkip, computeEffectiveLen, detectIntent, shouldSkipByDedup, extractFiles, extractErrorSignature, DEDUP_STALE_MS, matchRegistrySkillName, detectMemOverride } from './prompt-search-utils.mjs';
 
@@ -439,10 +439,18 @@ function loadManagedSkillNames() {
     const rdb = new Database(REGISTRY_DB_PATH, { readonly: true });
     rdb.pragma('busy_timeout = 500');
     try {
+      // D#29: derive the managed marker from the env-aware data dir, not a hardcoded
+      // homedir literal — under CLAUDE_MEM_DIR relocation the stored local_path lives at
+      // DB_DIR/managed, so the old literal matched nothing and dropped every managed skill
+      // from injection. Coarse LIKE prefilter; resource names are re-validated downstream.
+      // D#29: derive the managed marker from the env-aware data dir, not a hardcoded
+      // homedir literal — under CLAUDE_MEM_DIR relocation the stored local_path lives at
+      // DB_DIR/managed, so the old literal matched nothing and dropped every managed skill
+      // from injection. Coarse LIKE prefilter; resource names are re-validated downstream.
       const rows = rdb.prepare(`
         SELECT name FROM resources
-        WHERE status = 'active' AND local_path LIKE '%/.claude-mem-lite/managed/%'
-      `).all();
+        WHERE status = 'active' AND local_path LIKE ?
+      `).all(`%${join(DB_DIR, 'managed') + sep}%`);
       return new Set(rows.map(r => r.name.toLowerCase()));
     } finally { rdb.close(); }
   } catch { return new Set(); }

package/server.mjs

@@ -8,7 +8,7 @@ import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { truncate, typeIcon, sanitizeFtsQuery, relaxFtsQueryToOr, inferProject, scrubSecrets, cjkBigrams, fmtDate, debugLog, debugCatch, SESS_BM25, DEFAULT_DECAY_HALF_LIFE_MS, isPathConfined, notLowSignalTitleClause } from './utils.mjs';
 import { extractCjkLikePatterns, cjkPrecisionOk } from './nlp.mjs';
 import { resolveProject as _resolveProjectShared } from './project-utils.mjs';
-import { ensureDb, DB_PATH, REGISTRY_DB_PATH } from './schema.mjs';
+import { ensureDb, DB_PATH, DB_DIR, REGISTRY_DB_PATH } from './schema.mjs';
 import { reRankWithContext, markSuperseded, autoBoostIfNeeded, runIdleCleanup, buildServerInstructions } from './server-internals.mjs';
 import { searchObservationsHybrid, findFtsAnchor } from './search-engine.mjs';
 import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from './lib/compress-core.mjs';
@@ -30,7 +30,7 @@ function descriptionOf(name) {
   return d;
 }
 import { optimizePreview, optimizeRun } from './hook-optimize.mjs';
-import { basename, join } from 'path';
+import { basename, join, sep } from 'path';
 import { homedir } from 'os';
 import { ensureRegistryDb, upsertResource } from './registry.mjs';
 import { searchResources } from './registry-retriever.mjs';
@@ -1506,7 +1506,7 @@ server.registerTool(
       const lines = results.map(r => {
         const qualityBadge = r.quality_tier === 'installed' ? '[✓]' : r.quality_tier === 'verified' ? '[★]' : '[○]';
         const categoryLabel = r.category ? ` [${r.category}]` : '';
-        const isManaged = r.local_path && r.local_path.includes('/.claude-mem-lite/managed/');
+        const isManaged = r.local_path && r.local_path.includes(join(DB_DIR, 'managed') + sep);
         const portablePath = isManaged ? toPortable(r.local_path) : '';
         let howToUse;
         if (isManaged) {
@@ -1651,7 +1651,9 @@ server.registerTool(
       if (!row.local_path) {
         return { content: [{ type: 'text', text: `No local_path for ${args.name}` }], isError: true };
       }
-      const enrichBase = join(homedir(), '.claude-mem-lite');
+      // Confine to the env-aware data dir (managed/ relocates with CLAUDE_MEM_DIR, D#29);
+      // === homedir when the env is unset, so non-relocated confinement is unchanged.
+      const enrichBase = DB_DIR;
       if (!isPathConfined(row.local_path, enrichBase)) {
         return { content: [{ type: 'text', text: `Access denied: path outside managed directory` }], isError: true };
       }
@@ -1719,8 +1721,10 @@ server.registerTool(
       }
     }
 
-    // 4. Path confinement check — prevent reading arbitrary files via crafted local_path
-    const managedBase = join(homedir(), '.claude-mem-lite');
+    // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
+    // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
+    // equals homedir when unset, so this does not weaken the non-relocated confinement.
+    const managedBase = DB_DIR;
     if (skillPath && !isPathConfined(skillPath, managedBase)) {
       return { content: [{ type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` }], isError: true };
     }