claude-mem-lite 3.18.0 → 3.20.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.18.0",
+      "version": "3.20.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.18.0",
+  "version": "3.20.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-optimize.mjs

@@ -467,6 +467,21 @@ Return ONLY valid JSON:
       lesson_learned: lessonLearned,
     });
     db.transaction(() => {
+      // Snapshot the keeper's pre-merge row BEFORE overwriting it, so its original
+      // full text survives as a recoverable compressed_into child (mirroring
+      // compressGroup / recoverChildrenOf). The keeper is the cluster's most-
+      // important member; an in-place overwrite by the LLM's ≤800-char summary
+      // would otherwise destroy its original text irreversibly (HIGH-3 data loss).
+      // Column list is derived from the live schema (minus id/compressed_into) so
+      // it stays correct as migrations add columns; names are internal identifiers.
+      const snapCols = db.prepare(`PRAGMA table_info(observations)`).all()
+        .map(c => c.name).filter(c => c !== 'id' && c !== 'compressed_into');
+      const snapColList = snapCols.join(', ');
+      db.prepare(
+        `INSERT INTO observations (${snapColList}, compressed_into)
+         SELECT ${snapColList}, ? FROM observations WHERE id = ?`
+      ).run(keeper.id, keeper.id);
+
       db.prepare(`
         UPDATE observations SET title=?, narrative=?, concepts=?, facts=?, text=?,
           importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?

package/hook-update.mjs

@@ -387,18 +387,20 @@ export function validateExtractedTarball(sourceDir, expectedVersion, expectedNam
 }
 
 // ── Release signature verification (P1 supply-chain hardening) ──────────────
-// Embedded Ed25519 PUBLIC key (SPKI PEM). EMPTY = unconfigured → verification is
-// INERT and auto-update behaves exactly as before. Activating it is a one-time
-// ops step (no private key ever ships in the repo):
-//   1. Generate a keypair (writes the PRIVATE key to a local file, prints PUBLIC):
-//        node -e "const c=require('crypto');const{publicKey,privateKey}=c.generateKeyPairSync('ed25519');process.stdout.write(publicKey.export({type:'spki',format:'pem'}));require('fs').writeFileSync('release-signing-key.pem',privateKey.export({type:'pkcs8',format:'pem'}))"
-//   2. Paste the printed PUBLIC key between the backticks below.
-//   3. Add the PRIVATE key (release-signing-key.pem contents) as the GitHub
-//      Actions secret RELEASE_SIGNING_KEY, then delete the local file.
-//      NEVER commit the private key.
-// Once a signed release exists, clients verify it; unsigned/older releases still
-// install (opportunistic). Signer: scripts/sign-release.mjs. Core: lib/release-digest.mjs.
-const RELEASE_PUBLIC_KEY = '';
+// Embedded Ed25519 PUBLIC key (SPKI PEM). ACTIVE since v3.20.0 — auto-update now
+// FAILS CLOSED: a release missing valid signature assets is refused (the matching
+// private key is the GitHub Actions secret RELEASE_SIGNING_KEY; signer:
+// scripts/sign-release.mjs; verifier core: lib/release-digest.mjs). The signature
+// over v3.19.0's published manifest was verified against this key end-to-end
+// before activation. The CLAUDE_MEM_SKIP_SIG_VERIFY env escape hatch still forces a
+// skip. To ROTATE: generate a new keypair, set the new private key as the secret
+// and ship one signed release with it BEFORE replacing the key below — embedding a
+// key whose releases are not yet signed bricks auto-update (fail-closed on unsigned).
+// Setting this back to '' reverts to opportunistic (install-unsigned) behavior.
+const RELEASE_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAau5x65mqsYxJU2cO2ORteueK71EuB4aphVZds8FOZKk=
+-----END PUBLIC KEY-----
+`;
 const MANIFEST_ASSET_NAME = 'release-manifest.json';
 const SIGNATURE_ASSET_NAME = 'release-manifest.json.sig';
 

package/hook.mjs

@@ -58,7 +58,7 @@ import {
 } from './lib/citation-tracker.mjs';
 import { extractTailAssistantText, extractStructuredSummary } from './lib/summary-extractor.mjs';
 import { searchRelevantMemories, formatMemoryLine } from './hook-memory.mjs';
-import { recordSkillAdoption } from './registry-recommend.mjs';
+import { recordSkillAdoption, gcOldShadowShards } from './registry-recommend.mjs';
 import { detectMemOverride } from './lib/mem-override.mjs';
 import { buildAndSaveHandoff, detectContinuationIntent, renderHandoffInjection, pickHandoffToInject, extractUnfinishedSummary } from './hook-handoff.mjs';
 import { checkForUpdate, getCachedUpdateBanner, isUpdateCheckDue } from './hook-update.mjs';
@@ -1054,6 +1054,8 @@ async function handleSessionStart() {
   // GC stale per-session cooldown files. Cheap (<5ms typical) and idempotent;
   // moved here from pre-tool-recall.js's hot path.
   gcStalePreRecallCooldowns();
+  // Bound the shadow-recommendation log (daily JSONL shards, no GC at write time).
+  try { gcOldShadowShards(); } catch { /* best-effort, never blocks SessionStart */ }
 
   // Plugin cache self-heal: Claude Code auto-updates the marketplace plugin can
   // re-populate cache/<ver>/hooks/hooks.json, reintroducing duplicate hook

package/lib/activity.mjs

@@ -5,6 +5,7 @@
 // so they don't pollute the L1 system-prompt memory section.
 
 import { sanitizeFtsQuery } from '../utils.mjs';
+import { scrubRecord } from './scrub-record.mjs';
 
 /**
  * Canonical event_type enum — mirrors the events.event_type CHECK constraint.
@@ -48,14 +49,19 @@ export function saveEvent(db, {
   importance = 1,
   created_at_epoch = Date.now(),
 }) {
+  // Scrub secrets at the single write choke-point so BOTH the auto-capture
+  // (persistHaikuSummary event branch, raw Haiku output) and the CLI /bug,/lesson
+  // paths are covered — title/body otherwise land verbatim and are FTS-indexed,
+  // searchable, and exportable (HIGH-2 at-rest leak).
+  const safe = scrubRecord('events', { title, body });
   const info = db.prepare(`
     INSERT INTO events (project, event_type, title, body, file_paths, git_sha, importance, created_at_epoch)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     project,
     event_type,
-    title,
-    body,
+    safe.title,
+    safe.body,
     file_paths ? JSON.stringify(file_paths) : null,
     git_sha,
     importance,

package/lib/scrub-record.mjs

@@ -19,6 +19,11 @@ export const TEXT_FIELDS_BY_TABLE = {
     'title', 'subtitle', 'text', 'narrative',
     'concepts', 'facts', 'lesson_learned', 'search_aliases',
   ],
+  // events: the auto-captured bugfix/lesson/decision path (saveEvent) and the
+  // CLI /bug + /lesson commands both land here. title/body carry LLM output and
+  // user-pasted repro text verbatim, so they must scrub like observations do —
+  // event_type/project/git_sha are enums/identifiers/hash, left untouched.
+  events: ['title', 'body'],
   session_summaries: [
     'request', 'investigated', 'learned',
     'completed', 'next_steps', 'remaining_items', 'notes',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.18.0",
+  "version": "3.20.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-recommend.mjs

@@ -3,7 +3,7 @@
 //
 // Phase-1 invariant: shadow AND live only LOG. Neither emits to stdout nor writes
 // invocations/recommend_count. Live injection is Phase 2. `off` skips all work.
-import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync, appendFileSync } from 'fs';
+import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync, appendFileSync, readdirSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { searchResources, cjkIntentTokens } from './registry-retriever.mjs';
@@ -109,6 +109,31 @@ function appendShadow(row) {
   } catch { /* shadow sink must never crash the hook */ }
 }
 
+/**
+ * Prune shadow-log daily shards older than `retainDays`. appendShadow writes one
+ * YYYY-MM-DD.jsonl per day with no GC, so a long-lived install grows the dir
+ * unbounded (audit: shadow log non-bounded). Shard date is read from the filename
+ * (ISO dates sort lexicographically = chronologically). 90d keeps a full quarter
+ * for recommend-stats --days while bounding the dir to ~90 sub-MB files.
+ * Best-effort, never throws — called from the SessionStart GC sweep.
+ * @returns {number} shards removed
+ */
+export function gcOldShadowShards(retainDays = 90) {
+  try {
+    const dir = shadowDir();
+    if (!existsSync(dir)) return 0;
+    const cutoff = new Date(Date.now() - retainDays * 86_400_000).toISOString().slice(0, 10);
+    let removed = 0;
+    for (const name of readdirSync(dir)) {
+      const m = /^(\d{4}-\d{2}-\d{2})\.jsonl$/.exec(name);
+      if (m && m[1] < cutoff) {
+        try { unlinkSync(join(dir, name)); removed++; } catch { /* per-entry, silent */ }
+      }
+    }
+    return removed;
+  } catch { return 0; }
+}
+
 export function logShadowReco(project, rec) { appendShadow({ ts: new Date().toISOString(), kind: 'reco', project, ...rec }); }
 export function logShadowAdoption(project, rec) { appendShadow({ ts: new Date().toISOString(), kind: 'adopt', project, ...rec }); }
 

package/registry.mjs

@@ -165,7 +165,10 @@ export function ensureRegistryDb(dbPath) {
 
   const db = new Database(dbPath);
   db.pragma('journal_mode = WAL');
-  db.pragma('busy_timeout = 3000');
+  // 5000ms to match the main DB: registry writes (install indexing rewriting
+  // resources + resources_fts) race shadow-recommend writes + mem_registry reads
+  // on the same file; 3000ms was insufficient under that concurrency (schema.mjs).
+  db.pragma('busy_timeout = 5000');
   db.pragma('synchronous = NORMAL');
   db.pragma('foreign_keys = ON');
 

package/schema.mjs

@@ -918,7 +918,7 @@ export function ensureDb() {
  * @returns {{rebuilt: string[], errors: string[]}} Results per FTS table
  */
 export function rebuildFTS(db) {
-  const FTS_TABLES = ['observations_fts', 'session_summaries_fts', 'user_prompts_fts'];
+  const FTS_TABLES = ['observations_fts', 'session_summaries_fts', 'user_prompts_fts', 'events_fts'];
   const idRe = /^[a-z][a-z0-9_]*$/;
   const rebuilt = [];
   const errors = [];
@@ -942,7 +942,7 @@ export function rebuildFTS(db) {
  * @returns {{healthy: boolean, details: string[]}}
  */
 export function checkFTSIntegrity(db) {
-  const FTS_TABLES = ['observations_fts', 'session_summaries_fts', 'user_prompts_fts'];
+  const FTS_TABLES = ['observations_fts', 'session_summaries_fts', 'user_prompts_fts', 'events_fts'];
   const idRe = /^[a-z][a-z0-9_]*$/;
   const details = [];
   let healthy = true;

package/secret-scrub.mjs

@@ -60,8 +60,10 @@ export const SECRET_PATTERNS = [
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [/((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  // AWS access keys (AKIA...)
-  [/\bAKIA[A-Z0-9]{16}\b/g, '***'],
+  // AWS access keys: AKIA (long-term) + ASIA (STS temp) + AROA (role) + AIDA
+  // (user) + ANPA/ANVA/AGPA (other principal types). All share the 4-letter
+  // prefix + exactly 16 base32 chars shape — specific enough for near-zero FP.
+  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}\b/g, '***'],
   // OpenAI / Anthropic keys (sk-...) — specific prefixes have lower length threshold
   [/\bsk-(?:proj|ant|ant-api\d{2})-[a-zA-Z0-9_-]{8,}\b/g, '***'],
   [/\bsk-[a-zA-Z0-9_-]{20,}\b/g, '***'],
@@ -74,8 +76,10 @@ export const SECRET_PATTERNS = [
   [/\bxox[bpas]-[a-zA-Z0-9-]{10,}\b/g, '***'],
   // JWT tokens (eyJ...eyJ...)
   [/\beyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g, '***'],
-  // PEM private key blocks
-  [/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g, '***PEM_KEY***'],
+  // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
+  // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
+  // alternation missed; the block delimiters make FP impossible.
+  [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g, '***PEM_KEY***'],
   // Long hex strings in assignments (e.g. SECRET_KEY=abc123def456...)
   [/(\b(?:key|secret|token|hash)\s*[=:]\s*)[0-9a-f]{32,}\b/gi, '$1***'],
   // Google Cloud API keys (AIza...)
@@ -84,8 +88,9 @@ export const SECRET_PATTERNS = [
   [/(Authorization:\s*Bearer\s+)[^\s,;'"}\]]+/gi, '$1***'],
   // Supabase / generic long base64 keys (40+ chars, common in env vars)
   [/(\b(?:SUPABASE_KEY|SUPABASE_ANON_KEY|SUPABASE_SERVICE_ROLE_KEY|DATABASE_URL|REDIS_URL)\s*[=:]\s*)[^\s,;'"}\]]+/gi, '$1***'],
-  // Basic auth in URLs (https://user:password@host)
-  [/https?:\/\/[^@/\s]+:[^@/\s]+@/gi, 'https://***:***@'],
+  // Basic auth in URLs (https://user:password@host). ftp/ftps added — file-drop
+  // creds are a common leak shape the https-only form missed.
+  [/(https?|ftps?):\/\/[^@/\s]+:[^@/\s]+@/gi, '$1://***:***@'],
   // Database connection strings (postgres, mysql, mongodb, redis, amqp)
   [/\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s,;'"}\]]+/gi, '$1://***'],
   // npm tokens (npm_...)
@@ -109,6 +114,13 @@ export const SECRET_PATTERNS = [
   // these slip through. Match the value-quoted form explicitly. Length floor
   // (6) avoids tripping on intentional placeholder shorts ("...", "secret").
   [/("(?:password|passwd|token|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|access[_-]?token|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer|refresh[_-]?token|session[_-]?id|sessionid)"\s*:\s*")[^"]{6,}(")/gi, '$1***$2'],
+  // JSON keys with vendor PREFIX/SUFFIX around the core credential noun —
+  // `"x_api_key"`, `"aws_secret_access_key"`, `"my_password"`, `"gh_token"`.
+  // The exact-name list above misses these. Anchored to the credential nouns
+  // (password|secret|api_key|auth_token|access_token|private_key) so a benign
+  // `"token_count"` value (numeric, <6 non-quote chars after scrub) and prose
+  // keys stay low-FP; over-scrub is the safe direction for at-rest memory.
+  [/("\w*(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*"\s*:\s*")[^"]{6,}(")/gi, '$1***$2'],
   // Session cookies in headers / urlencoded bodies (sessionid=, session_id=, JSESSIONID=, PHPSESSID=).
   // 16+ chars filters out short test fixtures like sessionid=abc.
   [/\b((?:session[_-]?id|sessionid|jsessionid|phpsessid)\s*[=:]\s*)[^\s,;'"}\]]{16,}/gi, '$1***'],

package/server.mjs

@@ -98,7 +98,7 @@ function getRegistryDb() {
   if (registryDb) return registryDb;
   try {
     registryDb = ensureRegistryDb(REGISTRY_DB_PATH);
-    registryDb.pragma('busy_timeout = 3000');
+    registryDb.pragma('busy_timeout = 5000'); // match main DB + ensureRegistryDb (was 3000, overriding it back down)
   } catch (e) {
     debugLog('WARN', 'server', `Registry DB not available: ${e.message}`);
   }