claude-mem-lite 3.28.0 → 3.28.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.28.0",
+      "version": "3.28.2",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.28.0",
+  "version": "3.28.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/format-utils.mjs

@@ -24,12 +24,21 @@ export function truncate(str, max = 80) {
   return str.slice(0, end) + '\u2026';
 }
 
-// The block delimiters claude-mem-lite wraps injected context in. Any user-derived text
-// (observation title / lesson, handoff body) that contains one of these LITERALLY would
-// prematurely open or close the block it lands in, and the model then reads the rest as
-// undelimited context. Reachable by editing files that contain these tokens \u2014 e.g.
-// developing claude-mem-lite itself, where source/observations carry the delimiter names.
-const CONTEXT_DELIMITER_RE = /<\/?(?:claude-mem-context|memory-context|session-handoff)>/gi;
+// Two delimiter classes are defanged here:
+//   1. The blocks claude-mem-lite wraps injected context in (claude-mem-context /
+//      memory-context / session-handoff). User-derived text containing one LITERALLY
+//      would prematurely open/close the block it lands in, spilling the rest as
+//      undelimited context.
+//   2. Harness-authority tags the runtime injects (system-reminder / task-notification).
+//      Memory replays arbitrary captured text \u2014 file contents, tool output, web pages \u2014
+//      so a poisoned observation carrying a literal <system-reminder>\u2026</system-reminder>
+//      would smuggle a forged privileged-channel instruction into the model's context.
+//      It can't escape its wrapper (class 1 closers are defanged), but a nested forged
+//      authority tag is still an indirect-prompt-injection vector; strip the brackets so
+//      it reads as inert text. Other tags (<other-tag>) are deliberately left intact.
+// Reachable by editing files that contain these tokens \u2014 e.g. developing claude-mem-lite
+// itself, where source/observations carry the delimiter names.
+const CONTEXT_DELIMITER_RE = /<\/?(?:claude-mem-context|memory-context|session-handoff|system-reminder|task-notification)>/gi;
 
 /**
  * Defang the literal context-block delimiter tags in user-derived text. Strips just the

package/hook-llm.mjs

@@ -5,7 +5,7 @@ import { basename } from 'path';
 import { existsSync, readFileSync, unlinkSync, readdirSync } from 'fs';
 import {
   jaccardSimilarity, truncate, clampImportance, computeRuleImportance,
-  inferProject, parseJsonFromLLM,
+  inferProject, parseJsonFromLLM, scrubSecrets,
   computeMinHash, estimateJaccardFromMinHash, cjkBigrams, EDIT_TOOLS, LOW_SIGNAL_TITLE, debugCatch, debugLog, OBS_BM25,
   getCurrentBranch, notLowSignalTitleClause,
 } from './utils.mjs';
@@ -784,9 +784,13 @@ ${actionList}`;
 
       obs = {
         type: validTypes.has(parsed.type) ? parsed.type : 'change',
-        title: truncate(parsed.title, 120),
+        // Scrub BEFORE truncate: a secret Haiku regurgitated verbatim (the very
+        // case the downstream scrubRecord guards against) could straddle the
+        // 120/500-char cut, leaving a head the value-length-gated scrub regex no
+        // longer matches. Slicing scrubbed text keeps the boundary leak-free.
+        title: truncate(scrubSecrets(parsed.title || ''), 120),
         subtitle: fileList,
-        narrative: truncate(parsed.narrative || '', 500),
+        narrative: truncate(scrubSecrets(parsed.narrative || ''), 500),
         concepts: Array.isArray(parsed.concepts) ? parsed.concepts.slice(0, 10) : [],
         facts: Array.isArray(parsed.facts) ? parsed.facts.slice(0, 10) : [],
         files: episodeFiles,
@@ -881,9 +885,12 @@ ${actionList}`;
         // INSERT path. type is an enum, importance is numeric, files_read is a
         // JSON array (already scrubbed upstream), minhash_sig is hash bytes.
         const safe = scrubRecord('observations', {
-          title: truncate(obs.title, 120),
+          // Scrub BEFORE truncate (see first-pass note above): the truncate
+          // boundary must land on already-scrubbed text or a straddling secret
+          // leaks its head past the value-length-gated regex.
+          title: truncate(scrubSecrets(obs.title || ''), 120),
           subtitle: obs.subtitle || '',
-          narrative: truncate(obs.narrative || '', 500),
+          narrative: truncate(scrubSecrets(obs.narrative || ''), 500),
           concepts: conceptsText,
           facts: factsText,
           text: textField,

package/hook-optimize.mjs

@@ -7,7 +7,7 @@ import { join } from 'path';
 import {
   truncate, debugLog, debugCatch, COMPRESSED_AUTO,
   computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity, clampImportance, cjkBigrams,
-  notLowSignalTitleClause,
+  notLowSignalTitleClause, scrubSecrets,
 } from './utils.mjs';
 import { callModelJSON } from './haiku-client.mjs';
 import { acquireLLMSlot, releaseLLMSlot } from './hook-semaphore.mjs';
@@ -152,14 +152,17 @@ search_aliases: 2-6 alternative search terms (include CJK if applicable).`;
       const facts = Array.isArray(parsed.facts) ? parsed.facts.slice(0, 10) : [];
       const conceptsText = concepts.join(' ');
       const factsText = facts.join(' ');
+      // Scrub BEFORE truncate so a secret straddling the cut can't leave a sub-6-char
+      // head that scrubSecrets's value-length floor no longer matches (the scrubRecord
+      // below would then miss it too). Mirrors the hook-llm save-path fix.
       const lessonLearned = typeof parsed.lesson_learned === 'string'
         && parsed.lesson_learned.toLowerCase() !== 'none'
         && parsed.lesson_learned.trim().length > 0
-        ? parsed.lesson_learned.slice(0, 500) : null;
+        ? scrubSecrets(parsed.lesson_learned).slice(0, 500) : null;
       const searchAliases = Array.isArray(parsed.search_aliases)
         ? parsed.search_aliases.slice(0, 6).join(' ') : null;
-      const title = truncate(parsed.title, 120);
-      const narrative = truncate(parsed.narrative || cand.narrative || '', 500);
+      const title = truncate(scrubSecrets(parsed.title || ''), 120);
+      const narrative = truncate(scrubSecrets(parsed.narrative || cand.narrative || ''), 500);
       const importance = clampImportance(parsed.importance);
 
       const bigramText = cjkBigrams((title || '') + ' ' + (narrative || ''));
@@ -446,11 +449,13 @@ Return ONLY valid JSON:
     const facts = Array.isArray(parsed.merged_facts) ? parsed.merged_facts.slice(0, 10) : [];
     const conceptsText = concepts.join(' ');
     const factsText = facts.join(' ');
-    const title = truncate(parsed.merged_title, 120);
-    const narrative = truncate(parsed.merged_narrative || '', 800);
+    // Scrub BEFORE truncate (see re-enrich note): keep the boundary cut on
+    // already-scrubbed text so a straddling secret can't leak a sub-floor head.
+    const title = truncate(scrubSecrets(parsed.merged_title || ''), 120);
+    const narrative = truncate(scrubSecrets(parsed.merged_narrative || ''), 800);
     const lessonLearned = typeof parsed.merged_lesson === 'string'
       && parsed.merged_lesson.trim().length > 0
-      ? parsed.merged_lesson.slice(0, 500) : null;
+      ? scrubSecrets(parsed.merged_lesson).slice(0, 500) : null;
 
     const bigramText = cjkBigrams((title || '') + ' ' + (narrative || ''));
     const textField = [conceptsText, factsText, bigramText].filter(Boolean).join(' ');
@@ -633,8 +638,9 @@ JSON: {"title":"descriptive summary ≤120 chars","narrative":"comprehensive sum
     const parsed = await callModelJSON(prompt, 'sonnet', { timeout: 20000, maxTokens: 1000 });
     if (!parsed || !parsed.title) return { compressed: false };
 
-    const title = truncate(parsed.title, 120);
-    const narrative = truncate(parsed.narrative || '', 800);
+    // Scrub BEFORE truncate (see re-enrich note): boundary cut on scrubbed text.
+    const title = truncate(scrubSecrets(parsed.title || ''), 120);
+    const narrative = truncate(scrubSecrets(parsed.narrative || ''), 800);
     const concepts = Array.isArray(parsed.concepts) ? parsed.concepts.slice(0, 10) : [];
     const facts = Array.isArray(parsed.facts) ? parsed.facts.slice(0, 10) : [];
     const conceptsText = concepts.join(' ');
@@ -642,7 +648,7 @@ JSON: {"title":"descriptive summary ≤120 chars","narrative":"comprehensive sum
     const lessonLearned = typeof parsed.lesson_learned === 'string'
       && parsed.lesson_learned.toLowerCase() !== 'none'
       && parsed.lesson_learned.trim().length > 0
-      ? parsed.lesson_learned.slice(0, 500) : null;
+      ? scrubSecrets(parsed.lesson_learned).slice(0, 500) : null;
     const searchAliases = Array.isArray(parsed.search_aliases)
       ? parsed.search_aliases.slice(0, 6).join(' ') : null;
 

package/hook.mjs

@@ -1346,7 +1346,11 @@ async function handleUserPrompt() {
       VALUES (?, ?, ?, ?, ?, ?)
     `).run(
       sessionId,
-      scrubSecrets(promptText.slice(0, 10000)),
+      // Scrub BEFORE the 10k slice: a secret straddling char 10000 would otherwise
+      // be cut to a sub-6-char head that scrubSecrets's value-length floor no longer
+      // matches, persisting a partial secret into prompt_text (later re-emitted at
+      // server.mjs prompt_text + mem-cli recent). Scrubbing full text first is leak-free.
+      scrubSecrets(promptText).slice(0, 10000),
       promptNumber,
       ccSessionId,
       now.toISOString(), now.getTime()

package/lib/rrf.mjs

@@ -24,8 +24,15 @@ export function rrfAccumulate(rankedLists, k = 60) {
   const scores = new Map();
   for (const list of rankedLists) {
     if (!Array.isArray(list)) continue;
+    // A list is the accumulation unit: an id repeated within ONE list contributes a
+    // single best-rank term, not one per occurrence. Without this, a list carrying a
+    // duplicate id (e.g. a future caller that concatenates sub-result sets without
+    // dedup) would inflate that id to a fake cross-ranker-consensus score.
+    const seenInList = new Set();
     list.forEach((r, i) => {
       if (!r || r.id === undefined || r.id === null) return;
+      if (seenInList.has(r.id)) return;
+      seenInList.add(r.id);
       const add = 1 / (k + i + 1);
       const prev = scores.get(r.id);
       if (prev) {

package/lib/save-observation.mjs

@@ -47,7 +47,6 @@ export function saveObservation(db, params) {
   if (typeof content !== 'string' || content.trim().length === 0) {
     throw new Error('mem_save: content is empty or whitespace-only');
   }
-  const rawTitle = params.title || content.slice(0, 100);
   const importance = params.importance ?? 2;
   const files = Array.isArray(params.files)
     ? params.files.filter((f) => typeof f === 'string' && f.length > 0)
@@ -59,6 +58,11 @@ export function saveObservation(db, params) {
   // Scrub secrets BEFORE dedup so the comparison runs on the same form that
   // gets persisted (otherwise a token+placeholder pair could dedup-miss).
   const safeContent = scrubSecrets(content);
+  // Derive the title from ALREADY-SCRUBBED content, then scrub again: slicing
+  // raw content first could cut a secret value mid-token at the 100-char
+  // boundary, leaving a head the value-length-gated scrub regex no longer
+  // matches — so the title kept a partial secret while the narrative was clean.
+  const rawTitle = params.title || safeContent.slice(0, 100);
   const safeTitle = scrubSecrets(rawTitle);
   const safeLesson = rawLesson ? scrubSecrets(rawLesson) : null;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.28.0",
+  "version": "3.28.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",