claude-mem-lite 3.36.0 → 3.38.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.36.0",
+      "version": "3.38.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.36.0",
+  "version": "3.38.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/haiku-client.mjs

@@ -421,9 +421,12 @@ function callModelCLI(prompt, model, { timeout }) {
     return text ? { text } : null;
   } catch (e) {
     const out = e.stdout?.toString?.()?.trim() || e.output?.[1]?.toString?.()?.trim();
-    if (out && out.startsWith('{') && out.endsWith('}')) {
-      try { JSON.parse(out); return { text: out }; } catch {}
-    }
+    // Salvage a complete JSON payload from partial stdout on timeout. Haiku almost
+    // always wraps JSON in ```json fences (#8605), so a raw brace check rejects a
+    // complete-but-fenced buffer and the already-emitted JSON is discarded.
+    // parseJsonFromLLM strips fences before validating; return the raw text (the
+    // caller re-parses it identically) only when JSON is actually recoverable.
+    if (out && parseJsonFromLLM(out) !== null) return { text: out };
     debugCatch(e, `${model}-cli`);
     return null;
   }
@@ -471,9 +474,11 @@ export function callModelCLIAsync(prompt, model, { timeout }) {
     const timer = setTimeout(() => {
       try { child.kill('SIGKILL'); } catch { /* already gone */ }
       const t = stdout.trim();
-      if (t.startsWith('{') && t.endsWith('}')) {
-        try { JSON.parse(t); done({ text: t }); return; } catch { /* not complete JSON */ }
-      }
+      // Salvage fenced-or-bare JSON from partial stdout (mirrors callModelCLI). A raw
+      // brace check would discard a complete-but-```json-fenced payload (#8605);
+      // parseJsonFromLLM strips fences before validating, and the caller re-parses
+      // the returned text the same way.
+      if (t && parseJsonFromLLM(t) !== null) { done({ text: t }); return; }
       done(null);
     }, timeout);
     child.stdout?.setEncoding('utf8'); // decode multi-byte UTF-8 (CJK) across chunk boundaries
@@ -609,11 +614,12 @@ function callHaikuCLI(prompt, { timeout }) {
     const text = result.trim();
     return text ? { text } : null;
   } catch (e) {
-    // Try to extract partial output on timeout — validate JSON before returning
+    // Try to extract partial output on timeout — validate via parseJsonFromLLM
+    // (strips ```json fences per #8605) before returning. A raw brace check would
+    // discard a complete-but-fenced payload the caller could still parse, throwing
+    // away the JSON Haiku already emitted.
     const out = e.stdout?.toString?.()?.trim() || e.output?.[1]?.toString?.()?.trim();
-    if (out && out.startsWith('{') && out.endsWith('}')) {
-      try { JSON.parse(out); return { text: out }; } catch {}
-    }
+    if (out && parseJsonFromLLM(out) !== null) return { text: out };
     debugCatch(e, 'haiku-cli');
     return null;
   }

package/hook-llm.mjs

@@ -588,6 +588,58 @@ export function buildImmediateObservation(episode) {
   };
 }
 
+// ─── Haiku extraction recovery helpers ──────────────────────────────────────
+
+// Haiku's throwaway lesson sentinels + a min-length floor. A lesson equal to one
+// of these (case-insensitive) or shorter than 12 chars teaches a future session
+// nothing, so it is treated as "no lesson". Single source for the episode gate,
+// the P3 retry check, and the importance=0 discard guard (all three previously
+// duplicated the literal). Every sentinel is <12 chars, so the length floor
+// alone already excludes them — the set guards the exact-match cases.
+const LOW_SIGNAL_LESSON = new Set(['none', '', 'n/a', 'null', 'todo', 'tbd', 'na', '-', 'nothing', 'nil']);
+export function isLowSignalLesson(lesson) {
+  const t = typeof lesson === 'string' ? lesson.trim() : '';
+  return LOW_SIGNAL_LESSON.has(t.toLowerCase()) || t.length < 12;
+}
+
+// Haiku sometimes wraps the observation object in an envelope that
+// parseJsonFromLLM preserves verbatim (it strips ```json fences but does not
+// unwrap structure): a single-element array `[{...}]`, or a single object-valued
+// key such as `{"observation":{...}}`. Peel one such layer so the enrichment
+// fields (title / lesson_learned / narrative / facts) are reachable by the gate
+// in handleLLMEpisode. Returns the inner object, or `parsed` unchanged when it is
+// not a recognized envelope (incl. multi-element arrays — ambiguous, left for the
+// degraded fallback). Only unwraps when there is no usable top-level title, so a
+// legitimate `{title, ...}` observation is never disturbed.
+export function unwrapObservationEnvelope(parsed) {
+  if (Array.isArray(parsed)) {
+    const [only] = parsed;
+    return parsed.length === 1 && only && typeof only === 'object' && !Array.isArray(only) ? only : parsed;
+  }
+  if (parsed && typeof parsed === 'object' && typeof parsed.title !== 'string') {
+    const keys = Object.keys(parsed);
+    if (keys.length === 1) {
+      const inner = parsed[keys[0]];
+      if (inner && typeof inner === 'object' && !Array.isArray(inner)) return inner;
+    }
+  }
+  return parsed;
+}
+
+// True when a parsed Haiku object carries content worth preserving even if its
+// title is unusable: a substantive lesson (not a low-signal sentinel / too short),
+// a non-empty narrative, or >=1 non-empty fact. Gates the title-recovery path in
+// handleLLMEpisode so a genuinely empty parse still falls through to the
+// episode-inferred degraded observation (which classifies type/importance better
+// than a forced 'change' would).
+export function hasEnrichmentContent(parsed) {
+  if (!parsed || typeof parsed !== 'object') return false;
+  if (typeof parsed.lesson_learned === 'string' && !isLowSignalLesson(parsed.lesson_learned)) return true;
+  if (typeof parsed.narrative === 'string' && parsed.narrative.trim().length > 0) return true;
+  if (Array.isArray(parsed.facts) && parsed.facts.some(f => typeof f === 'string' && f.trim().length > 0)) return true;
+  return false;
+}
+
 // ─── Lesson retry prompt (P3) ───────────────────────────────────────────────
 
 /**
@@ -712,14 +764,36 @@ ${actionList}`;
       releaseLLMSlot();
     }
 
-    // Require a STRING title: a truthy non-string (LLM returned title as an array/number/
-    // object) would pass a bare `parsed.title` check, then crash truncate() downstream,
-    // aborting the worker before tmpFile cleanup (leak) and leaving the obs degraded.
-    if (parsed && typeof parsed.title === 'string' && parsed.title) {
+    // Recover from common Haiku envelope shapes before the title gate: a single-
+    // element array `[{...}]` or a single object-valued wrapper key
+    // `{"observation":{...}}`. parseJsonFromLLM strips fences but does NOT peel
+    // these, so the payload (title AND lesson) sits one level down. See
+    // unwrapObservationEnvelope.
+    if (parsed && typeof parsed === 'object') parsed = unwrapObservationEnvelope(parsed);
+
+    // Enter enrichment whenever Haiku returned a usable object — even if its TITLE
+    // is missing/empty/non-string. The gate was previously `typeof parsed.title ===
+    // 'string' && parsed.title` (guarding a truncate() crash on non-string titles),
+    // so a valid extraction with a bad title silently discarded Haiku's
+    // lesson_learned / narrative / facts: `obs` stayed undefined and control fell to
+    // the degraded fallback. Now, when there is substantive content but no usable
+    // title, degrade ONLY the title (buildDegradedTitle) and keep the lesson. A parse
+    // with neither a usable title nor content still falls through to
+    // buildImmediateObservation, which infers type/importance from the episode.
+    const titleUsable = parsed && typeof parsed.title === 'string' && !!parsed.title;
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed) && (titleUsable || hasEnrichmentContent(parsed))) {
+      // Synthesize a rule-based title when Haiku's is unusable (crash-safe, and the
+      // lesson survives). Only the title degrades; every other field is kept.
+      if (!titleUsable) parsed.title = buildDegradedTitle(episode);
       // Normalize narrative to a string too — same non-string crash risk in truncate().
       if (typeof parsed.narrative !== 'string') parsed.narrative = '';
-      // Discard if LLM judges observation has no learning value
-      if (parsed.importance === 0 || parsed.importance === '0') {
+      const rawLesson = typeof parsed.lesson_learned === 'string' ? parsed.lesson_learned.trim() : '';
+      // Discard if LLM judges observation has no learning value — UNLESS it co-emitted
+      // a substantive lesson. importance=0 + a real lesson is contradictory (Haiku
+      // flags "zero value" yet still teaches something); the lesson is the
+      // higher-value signal, so keep the row (importance clamps to >=1 downstream)
+      // rather than deleting it. Only the genuinely empty case is dropped.
+      if ((parsed.importance === 0 || parsed.importance === '0') && isLowSignalLesson(rawLesson)) {
         debugLog('DEBUG', 'llm-episode', `Discarded low-value observation: ${parsed.title}`);
         // If pre-saved, delete it too
         if (episode.savedId) {
@@ -740,9 +814,7 @@ ${actionList}`;
       // When filtered, downgrade importance to 0 so rule-based fallback in
       // hook.mjs:saveObservation writes the obs but hook queries (which all
       // require importance >= 1) ignore it.
-      const rawLesson = typeof parsed.lesson_learned === 'string' ? parsed.lesson_learned.trim() : '';
-      const lowSignalLesson = new Set(['none', '', 'n/a', 'null', 'todo', 'tbd', 'na', '-', 'nothing', 'nil']);
-      const isLessonLowSignal = lowSignalLesson.has(rawLesson.toLowerCase()) || rawLesson.length < 12;
+      const isLessonLowSignal = isLowSignalLesson(rawLesson);
       let lessonLearned = isLessonLowSignal ? null : rawLesson.slice(0, 500);
 
       // P3: for bugfix/decision, retry once with a lesson-focused prompt.
@@ -768,7 +840,7 @@ ${actionList}`;
           if (retryRaw) {
             const retry = parseJsonFromLLM(retryRaw);
             const retryLesson = typeof retry?.lesson === 'string' ? retry.lesson.trim() : '';
-            const retryIsLow = lowSignalLesson.has(retryLesson.toLowerCase()) || retryLesson.length < 12;
+            const retryIsLow = isLowSignalLesson(retryLesson);
             if (!retryIsLow) {
               lessonLearned = retryLesson.slice(0, 500);
               retryRecovered = true;
@@ -1044,7 +1116,28 @@ ${obsList}`;
       releaseLLMSlot();
     }
 
-    if (llmParsed && llmParsed.request) {
+    // Coerce a prose field to a string before scrub/bind. Haiku sometimes returns a LIST for
+    // completed/next_steps/remaining_items; binding a non-string straight to SQL throws
+    // ("Too many parameter values") out of this try/finally and drops the WHOLE summary incl.
+    // lessons + key_decisions. Join array items; non-strings → ''. (lessons/key_decisions are
+    // JSON.stringify'd separately below.)
+    const asText = v => Array.isArray(v)
+      ? v.filter(x => typeof x === 'string' && x.trim()).join('; ')
+      : (typeof v === 'string' ? v : '');
+
+    // Persist when ANY meaningful field is present — not just `request`. Gating on `request`
+    // alone dropped the whole INSERT/UPDATE (losing the session's highest-value fields:
+    // lessons + key_decisions) whenever Haiku returned an empty request string but a rich
+    // `{completed, lessons, key_decisions}` — a common degraded shape. Downstream tolerates an
+    // empty request: INSERT writes '' and the UPDATE COALESCE(NULLIF(?, ''), request) preserves
+    // the prior value. Use asText in the gate so a non-string / empty-array field can't falsely
+    // trigger it.
+    const hasSummaryContent = llmParsed && (
+      asText(llmParsed.request) || asText(llmParsed.completed) || asText(llmParsed.remaining_items) || asText(llmParsed.next_steps) ||
+      (Array.isArray(llmParsed.lessons) && llmParsed.lessons.length > 0) ||
+      (Array.isArray(llmParsed.key_decisions) && llmParsed.key_decisions.length > 0)
+    );
+    if (hasSummaryContent) {
       const now = new Date();
       const lessonsJson = Array.isArray(llmParsed.lessons) && llmParsed.lessons.length > 0
         ? JSON.stringify(llmParsed.lessons) : null;
@@ -1072,12 +1165,12 @@ ${obsList}`;
         // pre-scrub remains safer in principle but would diverge from the
         // merged INSERT contract.
         const safe = scrubRecord('session_summaries', {
-          request: llmParsed.request || '',
-          investigated: llmParsed.investigated || '',
-          learned: llmParsed.learned || '',
-          completed: llmParsed.completed || '',
-          next_steps: llmParsed.next_steps || '',
-          remaining_items: llmParsed.remaining_items || '',
+          request: asText(llmParsed.request),
+          investigated: asText(llmParsed.investigated),
+          learned: asText(llmParsed.learned),
+          completed: asText(llmParsed.completed),
+          next_steps: asText(llmParsed.next_steps),
+          remaining_items: asText(llmParsed.remaining_items),
           lessons: lessonsJson,
           key_decisions: decisionsJson,
         });
@@ -1105,12 +1198,12 @@ ${obsList}`;
         );
       } else {
         const safe = scrubRecord('session_summaries', {
-          request: llmParsed.request || '',
-          investigated: llmParsed.investigated || '',
-          learned: llmParsed.learned || '',
-          completed: llmParsed.completed || '',
-          next_steps: llmParsed.next_steps || '',
-          remaining_items: llmParsed.remaining_items || '',
+          request: asText(llmParsed.request),
+          investigated: asText(llmParsed.investigated),
+          learned: asText(llmParsed.learned),
+          completed: asText(llmParsed.completed),
+          next_steps: asText(llmParsed.next_steps),
+          remaining_items: asText(llmParsed.remaining_items),
           lessons: lessonsJson,
           key_decisions: decisionsJson,
         });

package/hook-optimize.mjs

@@ -81,7 +81,7 @@ export function findReenrichCandidates(db, limit = 10, { scope = 'narrow', proje
   const projectClause = project ? 'AND project = ?' : '';
   if (scope === 'wide') {
     const stmt = db.prepare(`
-      SELECT id, title, narrative, type, subtitle, concepts, facts, project
+      SELECT id, title, narrative, type, subtitle, concepts, facts, search_aliases, project
       FROM observations
       WHERE COALESCE(compressed_into, 0) = 0
         AND superseded_at IS NULL
@@ -140,7 +140,13 @@ search_aliases: 2-6 alternative search terms (include CJK if applicable).`;
       const parsed = await callModelJSON(prompt, 'haiku', { timeout: 15000, maxTokens: 500 });
       if (!parsed || !parsed.title) { skipped++; continue; }
 
-      if (parsed.importance === 0 || parsed.importance === '0') {
+      // Auto-hide on importance:0 targets fully-degraded NARROW rows (this branch predates
+      // the wide-scope widening). A wide candidate has a substantive narrative (>100 chars)
+      // and a real bugfix/feature/decision type by construction, and COMPRESSED_AUTO(-1) is
+      // reachable by no auto-recovery pass — so one Haiku "importance 0" misjudgment would
+      // hide a real observation until manual surgery. In wide scope, fall through and let
+      // clampImportance floor it to 1 (kept visible, low-ranked) instead of hiding.
+      if ((parsed.importance === 0 || parsed.importance === '0') && scope !== 'wide') {
         db.prepare(`UPDATE observations SET compressed_into = ${COMPRESSED_AUTO}, optimized_at = ? WHERE id = ?`)
           .run(Date.now(), cand.id);
         processed++;
@@ -150,8 +156,14 @@ search_aliases: 2-6 alternative search terms (include CJK if applicable).`;
       const type = validTypes.has(parsed.type) ? parsed.type : cand.type || 'change';
       const concepts = Array.isArray(parsed.concepts) ? parsed.concepts.slice(0, 10) : [];
       const facts = Array.isArray(parsed.facts) ? parsed.facts.slice(0, 10) : [];
-      const conceptsText = concepts.join(' ');
-      const factsText = facts.join(' ');
+      // Preserve-on-empty: wide-scope candidates can already carry concepts/facts/aliases
+      // (findReenrichCandidates requires only lesson_learned empty), so a partial re-enrich
+      // that returns a lesson but omits/empties these must NOT wipe them — the same UPDATE
+      // sets optimized_at, locking the row out of any future re-enrich (:88), so the loss is
+      // permanent. Keep the candidate's existing value when the LLM returned nothing. (Narrow
+      // candidates are all-null on these by their WHERE, so cand.* is falsy → no-op there.)
+      const conceptsText = concepts.length ? concepts.join(' ') : (cand.concepts || '');
+      const factsText = facts.length ? facts.join(' ') : (cand.facts || '');
       // Scrub BEFORE truncate so a secret straddling the cut can't leave a sub-6-char
       // head that scrubSecrets's value-length floor no longer matches (the scrubRecord
       // below would then miss it too). Mirrors the hook-llm save-path fix.
@@ -159,8 +171,8 @@ search_aliases: 2-6 alternative search terms (include CJK if applicable).`;
         && parsed.lesson_learned.toLowerCase() !== 'none'
         && parsed.lesson_learned.trim().length > 0
         ? scrubSecrets(parsed.lesson_learned).slice(0, 500) : null;
-      const searchAliases = Array.isArray(parsed.search_aliases)
-        ? parsed.search_aliases.slice(0, 6).join(' ') : null;
+      const searchAliases = Array.isArray(parsed.search_aliases) && parsed.search_aliases.length
+        ? parsed.search_aliases.slice(0, 6).join(' ') : (cand.search_aliases || null);
       const title = truncate(scrubSecrets(parsed.title || ''), 120);
       const narrative = truncate(scrubSecrets(parsed.narrative || cand.narrative || ''), 500);
       const importance = clampImportance(parsed.importance);
@@ -361,9 +373,10 @@ export function findMergeCandidates(db, maxClusters = 5, { project } = {}) {
   const cutoff = Date.now() - MERGE_TIME_WINDOW_MS;
   const projectClause = project ? 'AND project = ?' : '';
   const stmt = db.prepare(`
-    SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig
+    SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig, lesson_learned
     FROM observations
     WHERE COALESCE(compressed_into, 0) = 0
+      AND superseded_at IS NULL
       AND optimized_at IS NULL
       AND title IS NOT NULL AND title != ''
       AND created_at_epoch > ?
@@ -453,9 +466,25 @@ Return ONLY valid JSON:
     // already-scrubbed text so a straddling secret can't leak a sub-floor head.
     const title = truncate(scrubSecrets(parsed.merged_title || ''), 120);
     const narrative = truncate(scrubSecrets(parsed.merged_narrative || ''), 800);
-    const lessonLearned = typeof parsed.merged_lesson === 'string'
+    // Preserve-on-empty. The merge overwrites the keeper in place and hides every non-keeper
+    // member (compressed_into=keeper.id), so if the LLM returns merged_lesson:null (the prompt
+    // at :429 explicitly permits it) every cluster lesson would leave all live surfaces at once
+    // with no auto-recovery — the keeper snapshot and hidden members sit at compressed_into>0,
+    // which recoverBuriedLessons (compressed_into=0 only) skips. So use the LLM's synthesized
+    // lesson when non-empty, else fall back to the union of the members' own non-empty lessons.
+    // findMergeCandidates filters superseded_at IS NULL, so the union pulls only LIVE members
+    // (a tombstoned/retired lesson can't resurrect onto the keeper). The union is scrubbed then
+    // capped at 500 chars like a single lesson, so an unusually long union may truncate trailing
+    // members — still strictly better than the prior unconditional null (partial > total loss).
+    let lessonLearned = typeof parsed.merged_lesson === 'string'
       && parsed.merged_lesson.trim().length > 0
       ? scrubSecrets(parsed.merged_lesson).slice(0, 500) : null;
+    if (!lessonLearned) {
+      const memberLessons = [...new Set(cluster
+        .map(o => (o.lesson_learned || '').trim())
+        .filter(l => l && l.toLowerCase() !== 'none'))];
+      if (memberLessons.length) lessonLearned = scrubSecrets(memberLessons.join(' — ')).slice(0, 500);
+    }
 
     const bigramText = cjkBigrams((title || '') + ' ' + (narrative || ''));
     const textField = [conceptsText, factsText, bigramText].filter(Boolean).join(' ');

package/hook.mjs

@@ -124,7 +124,13 @@ for (const sig of ['SIGTERM', 'SIGINT']) {
           // ep-flush-* file is written here: it would have NO consumer AND would make
           // every later handleLLMSummary poll the full CLAUDE_MEM_FLUSH_TIMEOUT (~15s)
           // waiting for a file that only the 24h orphan-sweep ever removes.
-          saveEpisodeImmediate(ep);
+          // Split by CC session first (v3.35.2 parity): the normal flush and the Stop
+          // lock-contended fallback both planEpisodeFlush, but this crash path flushed the
+          // WHOLE buffer as one observation, co-attributing two interleaved same-project
+          // sessions into one garbled row. planEpisodeFlush returns [ep] by reference when
+          // there is ≤1 CC session (the common case → identical to before), else one sub
+          // per session. Pure/sync → safe inside the signal handler.
+          for (const sub of planEpisodeFlush(ep)) saveEpisodeImmediate(sub);
           try { unlinkSync(join(RUNTIME_DIR, `ep-${inferProject()}.json`)); } catch {}
         }
       } catch {}

package/lib/citation-tracker.mjs

@@ -525,7 +525,7 @@ export function computeCitationAdoption(db, project) {
  * decide cited vs uncited and mutate importance/streak/cited_count per spec.
  *
  * - cited: importance += 1 (cap 3), cited_count += 1, streak = 0.
- * - uncited: streak += 1; if it reaches 3, importance -= 1 (floor 0), streak = 0.
+ * - uncited: streak += 1; if it reaches 3, importance -= 1 (floor 1, IMPORTANCE_FLOOR), streak = 0.
  * - per-(session, obs) idempotent via last_decided_session_id; re-running for
  *   the same session is a no-op (Stop hook may fire more than once).
  * - cross-project IDs are silently ignored by the WHERE clause.
@@ -568,18 +568,27 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
   const suppressDemotion = adoption.seen >= ADOPTION_MIN_SEEN && adoption.rate < adoptionThreshold;
 
   const selectStmt = db.prepare(
-    'SELECT id, importance, uncited_streak, last_decided_session_id FROM observations WHERE id = ? AND project = ?'
+    // superseded_at IS NULL: mirror computeCitationAdoption + the 4 injection SELECTs so a
+    // row superseded mid-session (injected live, then auto-dedup supersedes it before this
+    // decay resolves) is not decayed/streaked/mutated — defense-in-depth parity.
+    'SELECT id, importance, uncited_streak, last_decided_session_id, last_cited_session_id FROM observations WHERE id = ? AND project = ? AND superseded_at IS NULL'
   );
   // decay_seen_count (v34) bumps on every resolution branch — gives
   // citation-stats a denominator that's same-source as cited_count, so the
   // ratio actually means "cite-rate" instead of mixing decay + UserPromptSubmit.
+  // Promote also stamps last_cited_session_id (v41 promote-idempotency key) so a
+  // same-session re-fire is a no-op. decay_seen_count is bumped by a PARAM, not a
+  // literal +1: a FIRST resolution counts the obs into the denominator (1); a
+  // cross-turn LATE upgrade of an already-resolved obs must NOT re-count it (0), else
+  // cite-rate reads N/2 for a single injected-then-cited obs instead of N/1.
   const updatePromote = db.prepare(`
     UPDATE observations
        SET importance = MIN(?, importance + 1),
            cited_count = cited_count + 1,
            uncited_streak = 0,
            last_decided_session_id = ?,
-           decay_seen_count = decay_seen_count + 1
+           last_cited_session_id = ?,
+           decay_seen_count = decay_seen_count + ?
      WHERE id = ?
   `);
   const updateStreakOnly = db.prepare(`
@@ -616,12 +625,28 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
     for (const id of injected) {
       const row = selectStmt.get(id, project);
       if (!row) continue; // cross-project or deleted
-      if (row.last_decided_session_id === sessionId) continue; // idempotent skip
-      touched++;
+      const decidedThisSession = row.last_decided_session_id === sessionId;
+
       if (cited.has(id)) {
-        updatePromote.run(IMPORTANCE_CAP, sessionId, id);
+        // Promote path — idempotent on last_cited_session_id, NOT last_decided. This is
+        // what lets a citation in a LATER turn upgrade an obs this session already
+        // resolved as uncited: the contract is "cite NEXT time you produce user-visible
+        // text," which may be several turns after injection. A promote resets
+        // uncited_streak and lifts importance, so a same-session demotion that fired at
+        // an earlier turn is naturally undone. Re-firing after the promote is a no-op.
+        if (row.last_cited_session_id === sessionId) continue; // already promoted this session
+        // touched/decay_seen only on the FIRST resolution — a late upgrade re-decides an
+        // obs already in the injected denominator, so re-counting it would inflate both
+        // decay_seen_count and the funnel's injected_n (cite-rate would read N/2, not N/1).
+        const firstResolution = !decidedThisSession;
+        updatePromote.run(IMPORTANCE_CAP, sessionId, sessionId, firstResolution ? 1 : 0, id);
         promoted++;
+        if (firstResolution) touched++;
       } else {
+        // Uncited path — idempotent on last_decided_session_id (unchanged): don't
+        // re-streak an obs already resolved this session.
+        if (decidedThisSession) continue;
+        touched++;
         const nextStreak = (row.uncited_streak || 0) + 1;
         // Demote only when the streak is up AND the project has demonstrably
         // adopted citations. A non-adopting project advances the streak (idempotent
@@ -646,9 +671,11 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
  * R1 — persist one accumulating per-session row of the invocation→cite funnel.
  * Fed by applyCitationDecay's return: `injectedDelta` = obs RESOLVED this Stop
  * (touched), `citedDelta` = obs CITED this Stop (promoted). Idempotent against
- * Stop multi-fire by construction — a re-fired Stop re-resolves nothing (touched
- * is 0 for already-decided obs), so the no-op gate below skips it. A later turn
- * that resolves NEW injections accumulates onto the same (project, session) row.
+ * Stop multi-fire by construction — a pure re-fire re-resolves nothing (touched=0
+ * AND promoted=0), so the (0,0) gate below skips it. A later turn that resolves NEW
+ * injections (touched>0) OR lands a cross-turn LATE citation (touched=0, promoted>0)
+ * accumulates onto the same (project, session) row — the numerator must accrue even
+ * when the denominator doesn't, so the gate skips only when BOTH deltas are 0.
  *
  * Unlike the per-obs cited_count/decay_seen_count counters (lifetime-cumulative,
  * session breakdown lost), this preserves the per-session series that
@@ -664,8 +691,13 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
 export function recordCitationFunnel(db, project, sessionId, injectedDelta, citedDelta) {
   if (!db || !project || !sessionId) return;
   const inj = Number(injectedDelta) || 0;
-  if (inj <= 0) return; // nothing resolved this run → no row noise
   const cited = Math.max(0, Number(citedDelta) || 0);
+  // Skip only when BOTH deltas are 0: a pure cross-turn late upgrade contributes
+  // injectedDelta=0 (the obs was already counted at its first resolution) but
+  // citedDelta>0, and that numerator must still fold onto the existing session row
+  // (a late upgrade always has a prior first-resolution row). Pre-v41 the `inj<=0`
+  // gate silently dropped it, under-counting cites in the funnel.
+  if (inj <= 0 && cited <= 0) return; // nothing resolved this run → no row noise
   try {
     db.prepare(`
       INSERT INTO citation_log (project, memory_session_id, resolved_at, injected_n, cited_n)

package/mem-cli.mjs

@@ -605,21 +605,17 @@ function cmdTimeline(db, args) {
   // (nlp.mjs string ops on a boolean). No sensible default for a search anchor — reject
   // cleanly (#8470). (`--project` bare is absorbed by resolveProject's non-string guard.)
   if (rejectBareStringFlags(flags, ['query'])) return;
-  // parseInt('-5') === -5 is truthy, so `|| 5` doesn't rescue negative input.
-  // Match cmdSearch's warn-then-default pattern for consistency across CLI flags.
-  const parseWindow = (label, raw) => {
-    if (raw === undefined) return 5;
-    const n = parseInt(raw, 10);
-    // isNumericToken first: "2abc"→2 / "1e2"→1 are non-negative integers the bare check
-    // accepted silently; reject garbage tokens like the negative path already does.
-    if (!isNumericToken(raw) || !Number.isInteger(n) || n < 0) {
-      process.stderr.write(`[mem] Invalid --${label} "${raw}" (must be a non-negative integer); using default 5\n`);
-      return 5;
-    }
-    return n;
-  };
-  const before = parseWindow('before', flags.before);
-  const after = parseWindow('after', flags.after);
+  // Route --before/--after through the shared bounded parser, range [0,50] (mirrors MCP
+  // mem_timeline's before/after .min(0).max(50)). NOTE this is parseIntFlag's reject-to-default
+  // convention, NOT a clamp: an out-of-range value (e.g. `--before 100`) warns to stderr and
+  // falls back to the default 5 — same as recent/search/recall, so the behavior is consistent
+  // across the CLI (the user sees the valid range and can retry). The point is the UPPER bound:
+  // the old hand-rolled validator had none, so `--before 999999999` flowed straight into
+  // `LIMIT before+after+1` / the window fetch as a raw SQL LIMIT (whole-table dump) — the
+  // #8802 uncapped-LIMIT footgun. min:0 keeps a 0 window legal; parseIntFlag preserves the
+  // warn-then-default garbage handling (float truncation + "2abc"/"1e2" rejection).
+  const before = parseIntFlag(flags.before, { name: '--before', defaultValue: 5, min: 0, max: 50 });
+  const after = parseIntFlag(flags.after, { name: '--after', defaultValue: 5, min: 0, max: 50 });
   const project = flags.project ? resolveProject(db, flags.project) : null;
   const jsonOutput = flags.json === true || flags.json === 'true';
 
@@ -1795,8 +1791,13 @@ function cmdCompress(db, args) {
     // isNumericToken (not bare parseInt) so "1e5"→1 and "30x"→30 are rejected rather than
     // silently mis-parsed into a far-too-broad cutoff — parity with recent/search/maintain.
     const parsed = Number(flags['age-days']);
-    if (!isNumericToken(flags['age-days']) || !Number.isInteger(parsed) || parsed < 1) {
-      fail(`[mem] Invalid --age-days "${flags['age-days']}". Must be a positive integer.`);
+    // [30,365] floor/ceil = parity with mem_compress (tool-schemas memCompressSchema
+    // .min(30).max(365)). The CLI previously accepted any positive int, so `--age-days 1`
+    // compressed day-old rows while the MCP description claimed the CLI "rejects <30 anyway"
+    // — a false parity claim (the candidate gate is the real data guard, but the age floor
+    // should match the tool the description promises equivalence with).
+    if (!isNumericToken(flags['age-days']) || !Number.isInteger(parsed) || parsed < 30 || parsed > 365) {
+      fail(`[mem] Invalid --age-days "${flags['age-days']}". Must be an integer between 30 and 365 (parity with mem_compress).`);
       return;
     }
     ageDays = parsed;

package/nlp.mjs

@@ -151,10 +151,14 @@ export function extractCjkLikePatterns(query) {
 /**
  * Post-FTS precision filter for CJK queries.
  *
- * Background: FTS5 unicode61 tokenizer splits every CJK character into its
- * own token. An application-layer bigram query like "我是" then reduces to
- * (我 AND 是) at match time — matching any document that happens to contain
- * both chars anywhere, which is extremely permissive in Chinese prose.
+ * Background: this build's FTS5 unicode61 tokenizer indexes an entire CJK run
+ * as ONE token (it does NOT split each CJK character). CJK text is made
+ * searchable by the write path, which stores the content plus its space-
+ * separated overlapping bigrams; a query is likewise reduced to bigrams. An
+ * application-layer bigram query therefore matches via those stored bigrams,
+ * and after the AND→OR fallback (relaxFtsQueryToOr) any document sharing even a
+ * single query bigram becomes a hit — extremely permissive in Chinese prose,
+ * where common bigrams recur across unrelated topics.
  *
  * Precision check: given the raw query and a candidate result's full text,
  * require that at least `threshold` fraction of the query's CJK bigrams
@@ -276,6 +280,15 @@ export function sanitizeFtsQuery(query) {
       t && !/^-+$/.test(t) && !FTS5_KEYWORDS.has(t.toUpperCase()) && !/^NEAR(\/\d*)?$/i.test(t)
       // Skip single ASCII-letter tokens — too noisy for FTS5 (CJK single chars handled separately below)
       && !(t.length === 1 && /^[a-zA-Z]$/.test(t))
+      // Drop tokens with NO index-able character — emoji 💥, symbols ★☆✦, pure
+      // punctuation. unicode61 strips those at index time, so ftsToken would phrase-quote
+      // such a token ("💥") into a REQUIRED AND term that can never match → strict FTS
+      // returns 0 (and a lone-emoji query has no OR recovery). Gate on any Unicode LETTER
+      // or NUMBER (\p{L}/\p{N}), NOT an ASCII+Han allowlist: unicode61 indexes every
+      // script's letters (Cyrillic / Greek / kana / Hangul / Thai / accented Latin …), so
+      // an allowlist silently killed search for all non-Latin/non-Han scripts (round-5
+      // review catch). Letters are kept; only true symbols/emoji/punctuation are dropped.
+      && /[\p{L}\p{N}]/u.test(t)
     );
   // Filter stop words (but keep all if filtering would empty the query)
   const filtered = tokens.filter(t => !FTS_STOP_WORDS.has(t.toLowerCase()));
@@ -303,6 +316,25 @@ export function sanitizeFtsQuery(query) {
         }
         continue;
       }
+      // No dictionary word matched. For a PURE-CJK run, pushing the whole
+      // unsegmented token creates a required AND term that matches neither the
+      // stored full-run token nor its overlapping bigrams: the write path stores
+      // content + space-separated bigrams, so a run like "同义词扩展" is indexed
+      // only as the longer whole-run token AND as 同义/义词/词扩/扩展 — never as
+      // "同义词扩展" itself. The strict AND is thus unsatisfiable (strict FTS = 0);
+      // only relaxFtsQueryToOr in the callers salvaged recall. Emit the non-noise
+      // bigrams the index actually holds instead. Mixed-script tokens (latin+CJK,
+      // e.g. "xyzAbc不存在") stay whole — the latin portion is a literal anchor and
+      // bigramming the CJK suffix over-recalls (mirrors the bigram guard below).
+      if (!/[A-Za-z0-9]/.test(t)) {
+        const fallbackBigrams = cjkBigrams(t)
+          .split(' ')
+          .filter(bg => bg && !isCjkNoiseBigram(bg));
+        if (fallbackBigrams.length > 0) {
+          expandedTokens.push(...fallbackBigrams);
+          continue;
+        }
+      }
     }
     expandedTokens.push(t);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.36.0",
+  "version": "3.38.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/schema.mjs

@@ -89,13 +89,28 @@ export const CODE_DIR = join(homedir(), '.claude-mem-lite');
 // failure leaves the marker unset and retries on the next open. New TABLE via
 // CORE_SCHEMA on the forced pass; LATEST_MIGRATION_COLUMN unchanged (no new
 // column) — same pattern as v35/v36/v38.
-export const CURRENT_SCHEMA_VERSION = 39;
+// v40 (round-5 audit HIGH): forces one migration pass so the now column-aware ensureFTS
+// widens any STALE FTS table on existing DBs. Early-adopter stores created before a column
+// was added to an FTS list (session_summaries_fts predates `remaining_items`, v2.2.0) carried
+// a narrow FTS table forever — the old ensureFTS only created a table when absent, never
+// widened it — while its triggers were rebuilt with the current wider column list, so every
+// session_summaries UPDATE threw "no column named remaining_items" and was silently swallowed
+// (Haiku summary enrichment lost every session). Pure index reheal (no data migration, no
+// column drop); idempotent. New behavior via the forced pass; LATEST_MIGRATION_COLUMN
+// unchanged (no new column) — same pattern as v35/v36/v38/v39.
+// v41 (cross-turn late-citation): adds observations.last_cited_session_id (additive,
+// nullable) — the promote idempotency key, split from last_decided_session_id so a
+// citation landing in a LATER turn of the same session can still upgrade a
+// previously-uncited obs (see applyCitationDecay). REAL new column, so unlike v38-v40
+// this DOES advance LATEST_MIGRATION_COLUMN (→ observations.last_cited_session_id);
+// existing DBs reach the ALTER because version 40 != 41 falls through the fast-path.
+export const CURRENT_SCHEMA_VERSION = 41;
 
 // Sentinel column for the LATEST migration set. The fast-path uses this to
 // self-heal half-migrated DBs — schema_version bumped but column ALTERs rolled
 // back (observed once in dev during v2.74.0). Update both the column AND
 // (if needed) the table when adding a new migration batch.
-const LATEST_MIGRATION_COLUMN = { table: 'user_prompts', column: 'cc_session_id' };
+const LATEST_MIGRATION_COLUMN = { table: 'observations', column: 'last_cited_session_id' };
 
 function hasLatestMigrationColumn(db) {
   try {
@@ -255,6 +270,14 @@ const MIGRATIONS = [
   // legacy rows + non-CC/no-stdin invocations read back NULL and the handoff falls
   // back to its legacy unfiltered query.
   'ALTER TABLE user_prompts ADD COLUMN cc_session_id TEXT DEFAULT NULL',
+  // v41 (cross-turn late-citation): promote-idempotency key, split from
+  // last_decided_session_id. applyCitationDecay guards the cited/promote branch on
+  // THIS column so a citation in a LATER turn of the same session can still upgrade a
+  // previously-uncited obs; the uncited/streak branch stays guarded on
+  // last_decided_session_id (so it never double-streaks within a session). Nullable:
+  // legacy rows read NULL and behave exactly as before until their first same-session
+  // late cite.
+  'ALTER TABLE observations ADD COLUMN last_cited_session_id TEXT DEFAULT NULL',
 ];
 
 /**
@@ -981,8 +1004,32 @@ export function ensureFTS(db, ftsName, tableName, columns) {
   const newVals = columns.map(c => `new.${c}`).join(', ');
   const oldVals = columns.map(c => `old.${c}`).join(', ');
 
-  const ftsExists = db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name=?`).get(ftsName);
-  if (!ftsExists) {
+  // Column-aware (re)creation. An existing FTS table is never silently reused when its
+  // indexed-column set has drifted from `columns`. Root cause of a silent-write bug class:
+  // a DB created before a column was added to an FTS list (session_summaries_fts predates
+  // `remaining_items`, added v2.2.0) kept the OLD narrow table forever, because ensureFTS
+  // only created the table when it was absent. The triggers below, however, are rebuilt
+  // from the CURRENT (wider) column list, so every UPDATE fired a trigger that INSERTed
+  // into a column the stale FTS table lacked and threw "no column named <X>", silently
+  // failing the write (session-summary Haiku enrichment was discarded every session for the
+  // early-adopter cohort, and the new column stayed unindexed). On drift, drop the triggers +
+  // table and fall through to CREATE + repopulate. Generalizes the one-off observations_fts
+  // guard in ensureDb so ALL three ensureFTS-managed tables self-heal on any column addition.
+  const ftsRow = db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name=?`).get(ftsName);
+  let recreated = false;
+  if (ftsRow) {
+    let existingCols = [];
+    try { existingCols = db.prepare(`PRAGMA table_info(${ftsName})`).all().map(c => c.name); } catch { /* unreadable → treat as drifted, recreate */ }
+    const drifted = existingCols.length !== columns.length || columns.some(c => !existingCols.includes(c));
+    if (drifted) {
+      db.exec(`DROP TRIGGER IF EXISTS ${tableName}_ai`);
+      db.exec(`DROP TRIGGER IF EXISTS ${tableName}_ad`);
+      db.exec(`DROP TRIGGER IF EXISTS ${tableName}_au`);
+      db.exec(`DROP TABLE IF EXISTS ${ftsName}`);
+      recreated = true;
+    }
+  }
+  if (!ftsRow || recreated) {
     db.exec(`CREATE VIRTUAL TABLE ${ftsName} USING fts5(${colList}, content='${tableName}', content_rowid='id')`);
   }
 
@@ -1008,4 +1055,15 @@ export function ensureFTS(db, ftsName, tableName, columns) {
       INSERT INTO ${ftsName}(rowid, ${colList}) VALUES (new.id, ${newVals});
     END;
   `);
+
+  // Repopulate a freshly (re)created external-content FTS index from its content table.
+  // An empty index otherwise returns 0 rows until each row is next written — and unlike
+  // observations_fts (rebuilt via the obsFtsRecreated flag in ensureDb), session_summaries_fts
+  // and user_prompts_fts have no other rebuild path, so a widened table must repopulate here.
+  if (recreated) {
+    try {
+      const cnt = db.prepare(`SELECT COUNT(*) AS c FROM ${tableName}`).get();
+      if (cnt.c > 0) db.exec(`INSERT INTO ${ftsName}(${ftsName}) VALUES('rebuild')`);
+    } catch { /* non-critical — index repopulates lazily on next write */ }
+  }
 }

package/secret-scrub.mjs

@@ -29,9 +29,9 @@ export const SECRET_PATTERNS = [
   // excludes "Marker token: …". `secret` added so a bare SECRET=… with a mixed-alnum
   // value is covered (the hex-only assignment pattern below misses non-hex values).
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
-  [/((?:\b|_)(?:password|passwd|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
   //   1b. `:` separator → keep the prose lookbehind ("the token: alice" is prose):
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
   // access_token / refresh_token are the canonical OAuth2 field names — they were
   // missing from this KV list (drift vs the JSON list below). `(?:\b|_)` for the same
   // underscore-prefix reason.
@@ -55,8 +55,8 @@ export const SECRET_PATTERNS = [
   //   (a) bare credential nouns: `=` always scrubs; `:` keeps the prose lookbehind
   //       (mirrors the unquoted 1a/1b split — a quoted value doesn't turn `:` prose
   //       into config, but `<word> password="x"` is still a leak):
-  [/((?:\b|_)(?:password|passwd|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [/((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
@@ -121,6 +121,19 @@ export const SECRET_PATTERNS = [
   // `"token_count"` value (numeric, <6 non-quote chars after scrub) and prose
   // keys stay low-FP; over-scrub is the safe direction for at-rest memory.
   [/("\w*(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*"\s*:\s*")[^"]{6,}(")/gi, '$1***$2'],
+  // Quoted-KEY credential values — Python dict reprs `{'api_key': '...'}`, single-quoted
+  // JS/JSON, and any mixed quoting. The quoted-VALUE patterns above match an UNQUOTED key
+  // (the key's closing quote sits between the key name and the `[=:]`, so `keyword\s*[=:]`
+  // never fires); the JSON patterns require BOTH key and value DOUBLE-quoted. So a single-
+  // quoted or mixed-quoted pair — the most common at-rest shape for opaque app secrets in
+  // stored LLM output / error payloads / code snippets — slipped through unredacted (#8805
+  // sibling). A quoted key is unambiguous config/data, so — like the JSON patterns — no prose
+  // guard is needed. Key quote and value quote are matched independently (`['"]` each); the
+  // value's close is a backref (\2) to its own opening quote. Same credential-noun set as the
+  // vendor-prefix JSON pattern above (bare `token`/`bearer` deliberately excluded to avoid
+  // `'token_count': 123456`); `passphrase` added here too (double-quoted JSON passphrase is
+  // subsumed by this pattern since `['"]` matches `"`). Over-scrub is the safe direction.
+  [/(['"]\w*(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*['"]\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
   // Session cookies in headers / urlencoded bodies (sessionid=, session_id=, JSESSIONID=, PHPSESSID=).
   // 16+ chars filters out short test fixtures like sessionid=abc.
   [/\b((?:session[_-]?id|sessionid|jsessionid|phpsessid)\s*[=:]\s*)[^\s,;'"}\]]{16,}/gi, '$1***'],

package/utils.mjs

@@ -309,7 +309,11 @@ function firstBalancedJsonObject(text) {
 export function parseJsonFromLLM(text) {
   if (!text) return null;
   try { return JSON.parse(text); } catch {}
-  const fenced = text.match(/```(?:json)?\s*([\s\S]*?)\s*```/);
+  // No `\s*` around the lazy capture: `\s*([\s\S]*?)\s*` catastrophically backtracks
+  // (O(n²)) on a fence + long whitespace + no closing fence — a ~5KB partial buffer hung
+  // the CLI-timeout salvage path for 10+s (round-5 review). `([\s\S]*?)```` is a single
+  // O(n) lazy scan; JSON.parse tolerates the surrounding whitespace the trim used to strip.
+  const fenced = text.match(/```(?:json)?([\s\S]*?)```/);
   if (fenced) try { return JSON.parse(fenced[1]); } catch {}
   // First balanced object — survives unfenced output wrapped in brace-containing prose.
   const balanced = firstBalancedJsonObject(text);