claude-mem-lite 2.93.0 → 2.94.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "2.93.0",
+      "version": "2.94.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "2.93.0",
+  "version": "2.94.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "2.93.0",
+  "version": "2.94.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/secret-scrub.mjs

@@ -61,6 +61,18 @@ export const SECRET_PATTERNS = [
   [/\bnpm_[a-zA-Z0-9]{36,}\b/g, '***'],
   // Stripe keys (sk_live_, rk_live_, pk_live_, sk_test_, pk_test_)
   [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}\b/g, '***'],
+  // SendGrid API keys: SG.<22>.<43> — two dots at fixed offsets make this
+  // structurally unmistakable; near-zero false-positive risk.
+  [/\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, '***'],
+  // Twilio identifiers: Account SID (AC…) + API Key SID (SK…), each = prefix
+  // + exactly 32 hex. The 2-letter prefix + 32-hex shape is specific: an MD5
+  // is 32 hex (no AC/SK prefix → no match) and a 40-hex git SHA has no internal
+  // \b so the trailing \b can't land mid-string. We deliberately do NOT scrub
+  // the bare-hex Twilio *auth token* — see comment block at end re: SHA collision.
+  [/\b(?:AC|SK)[0-9a-f]{32}\b/g, '***'],
+  // Mailgun private API keys: key-<32 hex>. Prefix-anchored for the same reason;
+  // bare 32-hex (no `key-`) is intentionally left alone to avoid hashing FPs.
+  [/\bkey-[0-9a-f]{32}\b/g, '***'],
   // JSON-quoted secrets — error payloads / API responses commonly carry creds
   // as `{"api_key": "..."}`. The base key=value pattern stops at quotes, so
   // these slip through. Match the value-quoted form explicitly. Length floor
@@ -69,6 +81,15 @@ export const SECRET_PATTERNS = [
   // Session cookies in headers / urlencoded bodies (sessionid=, session_id=, JSESSIONID=, PHPSESSID=).
   // 16+ chars filters out short test fixtures like sessionid=abc.
   [/\b((?:session[_-]?id|sessionid|jsessionid|phpsessid)\s*[=:]\s*)[^\s,;'"}\]]{16,}/gi, '$1***'],
+  // ── DELIBERATELY NOT COVERED: bare high-entropy / "raw N-char" tokens ──────
+  // A generic `[A-Fa-f0-9]{40}` / high-entropy regex would scrub this repo's own
+  // legitimate data: 40-hex git SHAs, 32-hex MD5s, 64-hex SHA256s, and stored
+  // `minhash_sig` values. In a hash-heavy codebase the false-positive cost
+  // (silent `***` over real content, lost recall) exceeds the marginal catch —
+  // and an entropy gate doesn't help because git SHAs are themselves high-entropy.
+  // The contextual forms (token=…, Authorization: Bearer …, "api_key":"…") above
+  // already cover the dangerous *labelled* shapes. If you are tempted to add a
+  // bare-token pattern here: don't — anchor it to a provider prefix instead.
 ];
 
 /**

package/synonyms.mjs

@@ -265,6 +265,13 @@ export const CJK_COMPOUNDS = new Set([
   // architecture
   '架构', '设计', '方案', '规划', '文档', '注释', '版本', '分支', '依赖',
   '性能', '安全', '漏洞', '补丁', '系统', '算法',
+  // common task/dev vocab — mined from the zero-dict-keyword prompt slice
+  // (benchmark/cjk-straddle-prevalence.mjs). These ubiquitous words were absent
+  // from the dictionary, so ~15% of real CJK queries fell through to all-bigram
+  // noise. Adding real words is monotonically safe: greedy longest-match only
+  // improves, and real compounds cannot create boundary-straddle bigrams.
+  '工作', '用户', '完成', '计划', '命令', '工具', '插件', '实施', '处理',
+  '清理', '显示', '本地', '改动', '确认', '直接', '开始',
 ]);
 
 // ─── Dispatch Synonyms (unidirectional, broader groupings) ──────────────────