npm - claude-mem-lite - Versions diffs - 3.39.1 → 3.40.0 - Mend

claude-mem-lite 3.39.1 → 3.40.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/.claude-plugin/marketplace.json +1 -1
package/.claude-plugin/plugin.json +1 -1
package/claudemd.mjs +4 -1
package/commands/bug.md +6 -3
package/commands/lesson.md +6 -3
package/hook-memory.mjs +1 -0
package/hook-optimize.mjs +17 -5
package/lib/activity.mjs +5 -3
package/lib/cite-back-hint.mjs +5 -2
package/lib/maintain-core.mjs +5 -0
package/lib/save-observation.mjs +4 -1
package/lib/search-core.mjs +23 -5
package/lib/timeline-core.mjs +18 -6
package/mem-cli.mjs +29 -3
package/nlp.mjs +10 -0
package/package.json +1 -1
package/registry-importer.mjs +8 -1
package/registry.mjs +8 -2
package/scripts/prompt-search-utils.mjs +8 -2
package/server.mjs +18 -4
package/source-files.mjs +13 -0

package/.claude-plugin/marketplace.json CHANGED Viewed

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.39.1",
+      "version": "3.40.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.39.1",
+  "version": "3.40.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/claudemd.mjs CHANGED Viewed

@@ -143,7 +143,10 @@ export function writeManaged(cwd, { slug, version, block, doc }) {
     else next = raw + '\n\n' + section + '\n';
     action = 'created';
   } else {
-    next = raw.replace(m[0], section);
+    // Function replacer (not a string): a `$`-sequence in `section` (a future template with
+    // a shell example / regex / `$1`) would otherwise be interpreted as a replacement
+    // back-reference and corrupt the block on every SessionStart refresh. Matches line 153.
+    next = raw.replace(m[0], () => section);
     action = next !== raw ? 'updated' : 'unchanged';
   }
   // H2: collapse any DUPLICATE same-slug blocks (keep the first, drop the rest).

package/commands/bug.md CHANGED Viewed

@@ -43,13 +43,16 @@ Map severity to importance:
 Build the body as `<description>\n\nRepro:\n<repro-steps>` (or just
 `<description>` if `--repro` is absent).
-Run via Bash — the body is the positional content; the description goes in
-`--lesson` so it lands in the high-weight `lesson_learned` field:
+Run via Bash — the full body is the positional content; a distilled description
+goes in `--lesson` so it lands in the high-weight `lesson_learned` field.
+`--lesson` is capped at 500 chars (longer values are rejected), so keep the full
+body in the positional content and trim `--lesson` to the core description if
+longer:
     node ${CLAUDE_PLUGIN_ROOT}/cli.mjs save "<body>" \
       --type bugfix \
       --title "<first 60 chars of description>" \
-      --lesson "<description>" \
+      --lesson "<description, ≤500 chars>" \
       [--files f1,f2,...] \
       --importance <1|2|3>

package/commands/lesson.md CHANGED Viewed

@@ -36,13 +36,16 @@ Don't use for trivial fixes (typos, renames), for rules that belong in memdir
 ## Execution
-Run via Bash — pass the lesson text as the positional content and repeat it in
-`--lesson` so it lands in the high-weight `lesson_learned` field:
+Run via Bash — pass the full lesson text as the positional content, and a
+distilled version in `--lesson` so it lands in the high-weight `lesson_learned`
+field. `--lesson` is capped at 500 chars (longer values are rejected), so for a
+long lesson keep the full text in the positional content and trim `--lesson` to
+the core insight:
     node ${CLAUDE_PLUGIN_ROOT}/cli.mjs save "<full text>" \
       --type discovery \
       --title "<first 60 chars of text>" \
-      --lesson "<full text>" \
+      --lesson "<core insight, ≤500 chars>" \
       [--files f1,f2,...] \
       --importance <1|2|3>

package/hook-memory.mjs CHANGED Viewed

@@ -255,6 +255,7 @@ export function searchRelevantMemories(db, userPrompt, project, excludeIds = [])
     try {
       const crossStmt = db.prepare(`
         SELECT o.id, o.type, o.title, o.subtitle, o.narrative, o.importance, o.lesson_learned, o.project,
+               o.created_at_epoch, o.files_modified,
                o.cited_count, o.uncited_streak,
                ${OBS_BM25} as relevance,
                ${noisePenaltyClause('o')} as noise_penalty

package/hook-optimize.mjs CHANGED Viewed

@@ -171,6 +171,10 @@ Give 3-6 aliases: words a user might search for the SAME concept but that are NO
         const safe = scrubRecord('observations', { text: appendedText, search_aliases: searchAliases });
         db.prepare(`UPDATE observations SET search_aliases = ?, text = ? WHERE id = ?`)
           .run(safe.search_aliases, safe.text, cand.id);
+        // Refresh the TF-IDF vector from the just-updated FTS text so the new
+        // aliases reach the vector arm too — the narrow/wide branch rebuilds, this
+        // one must as well. No-ops when the vector arm is off / vocab unbuilt.
+        rebuildVector(db, cand.id, [safe.text]);
         processed++;
         continue;
       }
@@ -278,7 +282,12 @@ export function _normalizeGateOpen(last, now) {
   return now - epoch >= NORMALIZE_INTERVAL_MS;
 }
-export function shouldRunNormalize() {
+export function shouldRunNormalize(project = null) {
+  // The 7-day gate rate-limits the UNSCOPED whole-store normalize. An explicit --project is
+  // targeted work: it must not be blocked by a prior global (or other-project) run, and it
+  // does not advance the shared timer (see executeNormalize). Without this, `optimize --run
+  // --task normalize --project B` returned skipped(gate) for 7 days if ANY project had run.
+  if (project) return true;
   try {
     const last = JSON.parse(readFileSync(NORMALIZE_GATE_FILE, 'utf8'));
     return _normalizeGateOpen(last, Date.now());
@@ -395,7 +404,7 @@ export function applyNormalization(db, groups, { project = null } = {}) {
 }
 export async function executeNormalize(db, force = false, { project } = {}) {
-  if (!force && !shouldRunNormalize()) return { skipped: true, reason: 'gate' };
+  if (!force && !shouldRunNormalize(project)) return { skipped: true, reason: 'gate' };
   const concepts = extractUniqueConcepts(db, 500, { project });
   if (concepts.length < 5) return { skipped: true, reason: 'too few concepts' };
@@ -405,7 +414,10 @@ export async function executeNormalize(db, force = false, { project } = {}) {
   const result = applyNormalization(db, groups, { project });
-  try { writeFileSync(NORMALIZE_GATE_FILE, JSON.stringify({ epoch: Date.now() })); } catch {}
+  // Only the UNSCOPED (whole-store) run advances the shared 7-day gate. A project-scoped run
+  // must not reset the global timer (it never consulted it — shouldRunNormalize(project) is
+  // always open), or one `--project X` run would silently block the next global normalize.
+  if (!project) { try { writeFileSync(NORMALIZE_GATE_FILE, JSON.stringify({ epoch: Date.now() })); } catch { /* best-effort */ } }
   return { processed: result.updated, groups: groups.length };
 }
@@ -833,7 +845,7 @@ export function optimizePreview(db, { project, detail = false } = {}) {
   const reenrichAliases = findReenrichCandidates(db, 5000, { scope: 'aliases', project }).length;
   const concepts = extractUniqueConcepts(db, 500, { project });
-  const normalizeReady = shouldRunNormalize() && concepts.length >= 5;
+  const normalizeReady = shouldRunNormalize(project) && concepts.length >= 5;
   const mergeClusters = findMergeCandidates(db, 50, { project });
   const clusterMerge = mergeClusters.length;
@@ -847,7 +859,7 @@ export function optimizePreview(db, { project, detail = false } = {}) {
     reenrichWide,
     reenrichAliases,
     normalize: normalizeReady ? concepts.length : 0,
-    normalizeGateOpen: shouldRunNormalize(),
+    normalizeGateOpen: shouldRunNormalize(project),
     clusterMerge,
     smartCompress,
     total: reenrich + (normalizeReady ? 1 : 0) + clusterMerge + smartCompress,

package/lib/activity.mjs CHANGED Viewed

@@ -131,10 +131,12 @@ export function recentEvents(db, { project, type = null, limit = 20 } = {}) {
  * importance>=minImportance) into searchable observations. mem_search / passive
  * injection never read the events table, so explicit /bug /lesson history and
  * high-value auto-captured events were unfindable. Each promoted event is marked
- * (superseded_at_epoch + superseded_by_id → the new obs id) so re-runs are
- * idempotent. The source event row is kept (activity log intact), just retired.
+ * with superseded_at_epoch ONLY (superseded_by_id is a self-FK → events(id), so an
+ * observation id there fails the FK on the real DB — the marker alone gives
+ * idempotency) so re-runs skip it. The source event row is kept (activity log
+ * intact), just retired.
  *
- * @returns {{eligible:number, promoted:number, deduped:number}}
+ * @returns {{eligible:number, promoted:number, deduped:number, skipped:number}}
  */
 export function promoteInsightEvents(db, { project = null, minImportance = 2, execute = false, limit = 5000 } = {}) {
   const projClause = project ? 'AND project = ?' : '';

package/lib/cite-back-hint.mjs CHANGED Viewed

@@ -128,8 +128,11 @@ const ACTIVITY_SAVE_LESSON_RE = /activity\s+save\s+--type\s+(lesson|bugfix)\b/;
 // P2(a): /bug and /lesson were redirected from `activity save` (events) to
 // `cli.mjs save … --lesson` (searchable observations). Recognize that shape too,
 // or the unsaved-bugfix nudge over-fires after an explicit save. Anchored on the
-// mem CLI + the --lesson flag both skills always pass.
-const OBS_INSIGHT_SAVE_RE = /(?:cli\.mjs|claude-mem-lite)['"]?\s+save\b[^\n]*--lesson(?:-learned)?\b/;
+// mem CLI + the --lesson flag both skills always pass. Uses `[\s\S]*?` (not
+// `[^\n]*`) because the skill templates document a multi-line, backslash-
+// continued command — after JSON.parse the command carries real newlines, so the
+// gap between `save` and `--lesson` must be allowed to span them (lazy → nearest).
+const OBS_INSIGHT_SAVE_RE = /(?:cli\.mjs|claude-mem-lite)['"]?\s+save\b[\s\S]*?--lesson(?:-learned)?\b/;
 const MEM_SAVE_TOOL_NAMES = new Set([
   'mem_save',
   'mcp__claude_mem_lite__mem_save',

package/lib/maintain-core.mjs CHANGED Viewed

@@ -397,10 +397,15 @@ export function maintenanceStats(db, { projectFilter, baseParams, staleAge }) {
       -- the scan stat previews what decay will mark idle, and decay protects
       -- injected rows. Omitting it over-counted "stale" by the injected-but-decayed
       -- rows decay never touches (e.g. demote_pinned's output: imp=1 but inj>0).
+      -- lesson_learned guard mirrors decayAndMarkIdle (:188) / cleanupBroken (:153): those
+      -- ops NEVER touch a lesson-bearing row ("lessons never auto-GC"), so the scan preview
+      -- must exclude them too or it over-forecasts "Stale"/"Broken" vs what execute does.
       COALESCE(SUM(CASE WHEN COALESCE(importance, 1) = 1 AND COALESCE(access_count, 0) = 0
                     AND COALESCE(injection_count, 0) = 0
+                    AND (lesson_learned IS NULL OR lesson_learned = '' OR lesson_learned = 'none')
                     AND created_at_epoch < ? THEN 1 ELSE 0 END), 0) as stale,
       COALESCE(SUM(CASE WHEN (title IS NULL OR title = '') AND (narrative IS NULL OR narrative = '')
+                    AND (lesson_learned IS NULL OR lesson_learned = '' OR lesson_learned = 'none')
                THEN 1 ELSE 0 END), 0) as broken,
       COALESCE(SUM(CASE WHEN COALESCE(access_count, 0) > 3 AND COALESCE(importance, 1) < 3
                THEN 1 ELSE 0 END), 0) as boostable,

package/lib/save-observation.mjs CHANGED Viewed

@@ -113,7 +113,10 @@ export function saveObservation(db, params) {
     });
     insertObservationFiles(db, savedId, files);
-    insertObservationVector(db, savedId, safeTitle + ' ' + safeContent);
+    // Vector text mirrors the FTS-indexed content (title + content + lesson) so a
+    // lesson-only term isn't invisible to the vector arm (finding #8). Reuses the
+    // same indexText the FTS `text` field is built from.
+    insertObservationVector(db, savedId, indexText);
     return savedId;
   });

package/lib/search-core.mjs CHANGED Viewed

@@ -54,6 +54,27 @@ export function parseDuration(raw) {
   return { ok: true, ms: n * DURATION_UNIT_MS[m[2].toLowerCase()] };
 }
+/**
+ * Parse one from/to bound to epoch ms. A bare `YYYY-MM-DD` is the user's LOCAL
+ * calendar day (created_at_epoch is Date.now() = local wall-clock), so it must be
+ * built in local time — `new Date('YYYY-MM-DD')` parses as UTC midnight and shifts the
+ * boundary by the tz offset (8h for the UTC+8 base), silently dropping early-morning
+ * rows and leaking the next day's early hours. `endOfDay` extends a date-only bound to
+ * 23:59:59.999 local (the inclusive `--to` day). Full ISO 8601 (with time/offset) is
+ * parsed as-is, honoring any explicit zone. Out-of-range date-only strings return NaN so
+ * the caller's isNaN guard rejects them (matches the old UTC parse's strict Invalid Date).
+ */
+function parseCalendarBound(raw, endOfDay) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(raw)) {
+    const [y, m, d] = raw.split('-').map(Number);
+    const dt = endOfDay ? new Date(y, m - 1, d, 23, 59, 59, 999) : new Date(y, m - 1, d, 0, 0, 0, 0);
+    // new Date(2026, 12, 45) silently rolls over; reject so 2026-13-45 fails like before.
+    if (dt.getFullYear() !== y || dt.getMonth() !== m - 1 || dt.getDate() !== d) return NaN;
+    return dt.getTime();
+  }
+  return new Date(raw).getTime();
+}
 /**
  * Parse from/to date bounds to epoch ms. Date-only `to` (YYYY-MM-DD) extends
  * to end-of-day so "to 2026-06-12" includes that day's rows. An optional
@@ -63,11 +84,8 @@ export function parseDuration(raw) {
  *         | { ok: false, bad: 'from'|'to'|'since', value: string }}
  */
 export function parseDateBounds(fromRaw, toRaw, sinceRaw = null, now = Date.now()) {
-  let epochFrom = fromRaw ? new Date(fromRaw).getTime() : null;
-  let epochTo = toRaw ? new Date(toRaw).getTime() : null;
-  if (epochTo !== null && toRaw && /^\d{4}-\d{2}-\d{2}$/.test(toRaw)) {
-    epochTo += 86400000 - 1; // extend to 23:59:59.999
-  }
+  let epochFrom = fromRaw ? parseCalendarBound(fromRaw, false) : null;
+  const epochTo = toRaw ? parseCalendarBound(toRaw, true) : null;
   if (epochFrom !== null && isNaN(epochFrom)) return { ok: false, bad: 'from', value: fromRaw };
   if (epochTo !== null && isNaN(epochTo)) return { ok: false, bad: 'to', value: toRaw };
   if (sinceRaw) {

package/lib/timeline-core.mjs CHANGED Viewed

@@ -17,11 +17,11 @@ import { sanitizeFtsQuery } from '../utils.mjs';
 const TIMELINE_COLS = 'id, type, title, subtitle, project, created_at, created_at_epoch';
-/** Nearest non-compressed observation to `epoch` (optionally project-scoped). */
+/** Nearest live (non-compressed, non-superseded) observation to `epoch`. */
 function nearestObservation(db, epoch, project) {
   return db.prepare(`
     SELECT id FROM observations
-    WHERE COALESCE(compressed_into, 0) = 0 ${project ? 'AND project = ?' : ''}
+    WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${project ? 'AND project = ?' : ''}
     ORDER BY ABS(created_at_epoch - ?) ASC LIMIT 1
   `).get(...(project ? [project, epoch] : [epoch]));
 }
@@ -56,7 +56,7 @@ export function resolveAnchorToken(db, rawAnchor, { project = null } = {}) {
   // Bare "#N" or "N" — observation first. Route compressed obs to its live
   // parent so the window (which filters compressed) isn't shown around a dead
   // record; negative sentinels (-1 dropped, -2 pending purge) have no parent.
-  const obsRow = db.prepare('SELECT compressed_into FROM observations WHERE id = ?').get(parsed.id);
+  const obsRow = db.prepare('SELECT compressed_into, superseded_at, superseded_by FROM observations WHERE id = ?').get(parsed.id);
   if (obsRow) {
     const ci = obsRow.compressed_into;
     if (ci && ci > 0) {
@@ -65,6 +65,16 @@ export function resolveAnchorToken(db, rawAnchor, { project = null } = {}) {
     if (ci && ci < 0) {
       return { ok: false, error: { code: 'compressed-pruned', id: parsed.id } };
     }
+    // Superseded obs → hop to its live successor, mirroring compressed→parent. A
+    // superseded row is dropped from every other read path (and from the before/after
+    // window legs below), so anchoring ON it would surface a dead record. superseded_by
+    // is polymorphic: a numeric obs id for explicit supersession (save-observation), or a
+    // string marker ('auto-dedup'/'auto-dedup-fuzzy') for hook auto-dedup — only the
+    // numeric case has a successor to redirect to, so guard on `typeof … number` (not
+    // `> 0`, which a string sentinel would silently pass as NaN→false anyway but reads wrong).
+    if (obsRow.superseded_at !== null && typeof obsRow.superseded_by === 'number' && obsRow.superseded_by > 0) {
+      return { ok: true, anchorId: obsRow.superseded_by, anchorNote: `(anchored to #${obsRow.superseded_by}, #${parsed.id} was superseded by it)` };
+    }
     return { ok: true, anchorId: parsed.id, anchorNote: null };
   }
@@ -138,10 +148,12 @@ export function resolveQueryAnchor(db, queryStr, { project = null } = {}) {
   };
 }
-/** No-anchor fallback: most recent non-compressed observations, newest first. */
+/** No-anchor fallback: most recent live (non-compressed, non-superseded) obs, newest first. */
 export function fetchRecentTimeline(db, { project = null, limit }) {
-  const compressedFilter = 'COALESCE(compressed_into, 0) = 0';
-  const where = project ? `WHERE ${compressedFilter} AND project = ?` : `WHERE ${compressedFilter}`;
+  // superseded_at IS NULL mirrors the before/after window legs (fetchTimelineWindow) and
+  // every other read path — a superseded row must not lead the "most recent" timeline.
+  const liveFilter = 'COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL';
+  const where = project ? `WHERE ${liveFilter} AND project = ?` : `WHERE ${liveFilter}`;
   const params = project ? [project, limit] : [limit];
   return db.prepare(`
     SELECT ${TIMELINE_COLS}

package/mem-cli.mjs CHANGED Viewed

@@ -1569,7 +1569,10 @@ function cmdUpdate(db, args) {
     updates.push('lesson_learned = ?');
     params.push(scrubSecrets(rawLesson));
   }
-  if (flags.concepts !== undefined) { updates.push('concepts = ?'); params.push(flags.concepts); }
+  // Scrub like the sibling text fields above (title/narrative/lesson) and the MCP twin
+  // mem_update — concepts is a scrub-target + FTS-indexed column, so a raw secret here
+  // lands searchable + exportable (rebuildObservationDerived folds it into `text`).
+  if (flags.concepts !== undefined) { updates.push('concepts = ?'); params.push(scrubSecrets(flags.concepts)); }
   if (updates.length === 0) {
     fail('[mem] No fields to update. Use --title, --type, --importance, --lesson/--lesson-learned, --narrative, --concepts');
@@ -1769,8 +1772,16 @@ function cmdRestore(db, argv) {
       // Re-apply the fields saveObservation zeros/derives so the backup is faithful.
       // search_aliases is its own FTS5 column, so this UPDATE re-syncs the index
       // (via the observations FTS triggers) and restored aliases stay searchable.
+      // Scrub the FTS-indexed text fields on the way in — the sibling ingest paths
+      // (import-jsonl, compress-core) scrub as defense-in-depth, and restore is the only
+      // rewrite path that skipped it. A backup made before a SECRET_PATTERNS entry existed
+      // would otherwise re-index an old secret in facts/concepts even though narrative
+      // (routed through saveObservation) gets re-scrubbed. files_read/branch are
+      // paths/identifiers, not scrub-target text — left as-is.
       signalUpdate.run(
-        r.subtitle || '', r.concepts || '', r.facts || '', r.search_aliases ?? null, r.files_read || '[]', r.branch ?? null,
+        scrubSecrets(r.subtitle || ''), scrubSecrets(r.concepts || ''), scrubSecrets(r.facts || ''),
+        r.search_aliases === null || r.search_aliases === undefined ? null : scrubSecrets(r.search_aliases),
+        r.files_read || '[]', r.branch ?? null,
         num(r.access_count), num(r.cited_count), num(r.uncited_streak), num(r.injection_count),
         num(r.decay_seen_count), r.last_accessed_at ?? null,
         res.id,
@@ -2239,7 +2250,22 @@ function cmdRegistry(_memDb, args) {
       const name = flags.name;
       const resourceType = flags['resource-type'];
       if (!name || !resourceType) { fail('[mem] Usage: claude-mem-lite registry import --name N --resource-type skill|agent [--invocation-name I] [--capability-summary S]'); return; }
-      const fields = { name, type: resourceType, status: 'active', source: flags.source || 'user' };
+      // Validate --source against its CHECK enum (parity with memRegistrySchema.source on MCP):
+      // an invalid value otherwise reaches the INSERT and throws a raw SqliteError stacktrace
+      // (the dispatcher's catch only special-cases SQLITE_BUSY/LOCKED).
+      if (flags.source && !new Set(['preinstalled', 'user', 'github']).has(flags.source)) {
+        fail(`[mem] Invalid --source "${flags.source}". Valid: preinstalled, user, github`);
+        return;
+      }
+      // Preserve provenance on a metadata-only re-import: default source to 'user' only for
+      // a genuinely NEW resource. Re-importing an existing github/preinstalled row without
+      // --source must not flip it to 'user' (which also mis-grants the user-source rank boost).
+      let source = flags.source;
+      if (!source) {
+        const existing = rdb.prepare('SELECT source FROM resources WHERE type = ? AND name = ?').get(resourceType, name);
+        source = existing ? existing.source : 'user';
+      }
+      const fields = { name, type: resourceType, status: 'active', source };
       for (const f of ['repo-url', 'local-path', 'invocation-name', 'intent-tags', 'domain-tags', 'trigger-patterns', 'capability-summary', 'keywords', 'tech-stack', 'use-cases']) {
         const camel = f.replace(/-([a-z])/g, (_, c) => '_' + c);
         fields[camel] = flags[f] || '';

package/nlp.mjs CHANGED Viewed

@@ -314,6 +314,16 @@ export function sanitizeFtsQuery(query) {
             if (bg && !isCjkNoiseBigram(bg) && !matched.has(bg)) expandedTokens.push(bg);
           }
         }
+        // Preserve embedded Latin/English identifiers glued into the CJK token — e.g. the
+        // "redis" in "redis缓存问题". extractCjkKeywords + cjkBigrams only see CJK runs, so
+        // without this the Latin anchor (often the single most precise term — a proper noun
+        // like redis/grafana/oauth with no CJK synonym) was dropped, zeroing recall on
+        // whitespace-free mixed-script prompts. Mirrors registry-retriever.mjs's embedded-
+        // English extraction. Lowercased for parity with the write-path unicode61 folding.
+        for (const en of (remainder.match(/[a-zA-Z]{2,}/g) || [])) {
+          const low = en.toLowerCase();
+          if (!FTS_STOP_WORDS.has(low) && !expandedTokens.includes(low)) expandedTokens.push(low);
+        }
         continue;
       }
       // No dictionary word matched. For a PURE-CJK run, pushing the whole

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.39.1",
+  "version": "3.40.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-importer.mjs CHANGED Viewed

@@ -233,7 +233,7 @@ export async function importFromGitHub(db, url, opts = {}) {
   // 1. Parse GitHub URL
   const parsed = parseGitHubUrl(url);
   if (!parsed) throw new Error('Invalid GitHub URL');
-  const { owner, repo, branch, path: pathFilter } = parsed;
+  const { owner, repo, branch: parsedBranch, path: pathFilter } = parsed;
   // 2. Fetch repo metadata (stars, forks, updated_at)
   const repoResp = await fetchFn(buildRepoUrl(owner, repo), { headers });
@@ -247,6 +247,13 @@ export async function importFromGitHub(db, url, opts = {}) {
   const repoForks = repoMeta.forks_count || 0;
   const repoUpdatedAt = repoMeta.updated_at || null;
+  // parseGitHubUrl defaults branch to 'main' when the URL omits `/tree/<branch>`. Prefer the
+  // repo's ACTUAL default branch in that case: a repo defaulting to master/develop/trunk
+  // otherwise 404s on a non-existent 'main' (GitHub does not redirect a missing ref), failing
+  // a URL that opens fine in the browser. An explicit `/tree/<branch>` in the URL still wins.
+  const branchExplicit = /\/tree\//.test(url.split(/[?#]/)[0]);
+  const branch = branchExplicit ? parsedBranch : (repoMeta.default_branch || parsedBranch);
   // 3. Fetch file tree via GitHub API (recursive)
   const treeResp = await fetchFn(buildTreeUrl(owner, repo, branch), { headers });
   if (!treeResp.ok) {

package/registry.mjs CHANGED Viewed

@@ -368,9 +368,15 @@ const UPSERT_SQL = `
     indexed_at, updated_at)
   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
   ON CONFLICT(type, name) DO UPDATE SET
-    status=excluded.status, source=excluded.source, repo_url=excluded.repo_url,
+    status=excluded.status, source=excluded.source,
+    -- Preserve-on-empty (mirror the FTS text columns below): a PARTIAL re-upsert defaults
+    -- repo_url/local_path to null/'' in the caller (import is the only edit path). Clobbering
+    -- them ORPHANS the resource — mem_use/enrich read local_path (NOT NULL, so '' passes the
+    -- constraint and silently breaks reads), and the scanner needs local_path to disable it.
+    repo_url=CASE WHEN excluded.repo_url != '' THEN excluded.repo_url ELSE repo_url END,
     repo_stars=CASE WHEN excluded.repo_stars > 0 THEN excluded.repo_stars ELSE repo_stars END,
-    local_path=excluded.local_path, file_hash=excluded.file_hash,
+    local_path=CASE WHEN excluded.local_path != '' THEN excluded.local_path ELSE local_path END,
+    file_hash=excluded.file_hash,
     invocation_name=CASE WHEN excluded.invocation_name != '' THEN excluded.invocation_name ELSE invocation_name END,
     -- Preserve-on-empty (mirror repo_stars/invocation_name above): a PARTIAL re-upsert --
     -- e.g. "registry import --name X --capability-summary ...", where mem-cli defaults every

package/scripts/prompt-search-utils.mjs CHANGED Viewed

@@ -164,8 +164,14 @@ export function shouldSkipByDedup(newIds, injectedFile) {
     if (count >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;
-    const prevSet = new Set(prevIds);
-    const overlapCount = newIds.filter(id => prevSet.has(id)).length;
+    // Normalize both sides to strings before comparing: UPS writes obs ids as numbers
+    // (rows.map(r => r.id)) while pre-tool-recall's mergeCrossHookInjected writes them as
+    // strings (.map(String)), and both hooks SHARE this file. Without normalization
+    // Set.has(8829) misses "8829" → cross-hook dedup never fires and the same lesson
+    // double-injects within the window. (pre-tool-recall's readCrossHookInjected already
+    // String-normalizes; this brings the UPS-side reader in line.)
+    const prevSet = new Set(prevIds.map(String));
+    const overlapCount = newIds.filter(id => prevSet.has(String(id))).length;
     return overlapCount / newIds.length >= 0.8;
   } catch { return false; }
 }

package/server.mjs CHANGED Viewed

@@ -286,9 +286,15 @@ async function runSearchPipeline(db, args, { llm, rerankLlm } = {}) {
     return { ...formatSearchOutput([], args, ftsQuery, 0), escalated: false, results: [], total: 0, variants: null };
   }
-  // obs_type ⇒ observations-only; deep is observations-only too (deepSearch fuses
-  // hybrid-obs lists). args.type is the source filter (observations|sessions|prompts).
-  const effectiveType = deepMode === 'deep' ? 'observations' : (args.type || (args.obs_type ? 'observations' : undefined));
+  // obs_type/importance/branch/tier ⇒ observations-only; deep is observations-only too
+  // (deepSearch fuses hybrid-obs lists). args.type is the source filter
+  // (observations|sessions|prompts). Forcing obs-only for the obs-exclusive fields
+  // matches the CLI (mem-cli.mjs:177): session/prompt tables have no importance/branch/tier
+  // column, so without the force those legs return UNFILTERED and leak rows that can't be
+  // scoped to the filter (branch/importance/tier previously leaked cross-source on MCP).
+  const effectiveType = deepMode === 'deep'
+    ? 'observations'
+    : (args.type || ((args.obs_type || args.importance || args.branch || args.tier) ? 'observations' : undefined));
   const r = await coreRunSearchPipeline(
     {
@@ -1402,7 +1408,15 @@ server.registerTool(
       }
       const IMPORT_STRING_FIELDS = ['repo_url', 'local_path', 'invocation_name', 'intent_tags',
         'domain_tags', 'trigger_patterns', 'capability_summary', 'keywords', 'tech_stack', 'use_cases'];
-      const fields = { name: args.name, type: args.resource_type, status: 'active', source: args.source || 'user' };
+      // Preserve provenance on a metadata-only re-import (parity with cmdRegistry): default
+      // source to 'user' only for a NEW resource — a partial re-upsert of an existing
+      // github/preinstalled row without `source` must not flip it to 'user'.
+      let source = args.source;
+      if (!source) {
+        const existing = rdb.prepare('SELECT source FROM resources WHERE type = ? AND name = ?').get(args.resource_type, args.name);
+        source = existing ? existing.source : 'user';
+      }
+      const fields = { name: args.name, type: args.resource_type, status: 'active', source };
       for (const f of IMPORT_STRING_FIELDS) fields[f] = args[f] || '';
       const id = upsertResource(rdb, fields);
       return { content: [{ type: 'text', text: `Imported: ${args.resource_type}:${args.name} (id=${id})` }] };

package/source-files.mjs CHANGED Viewed

@@ -198,3 +198,16 @@ export const HOOK_SCRIPT_FILES = [
   // through this wrapper so any partial-install drift heals automatically.
   'hook-launcher.mjs',
 ];
+// The complete set of files the release signature MUST cover: every runtime .mjs
+// (SOURCE_FILES) PLUS the executable hook scripts (copyReleaseIntoStaging installs these
+// into the live dir and they run on every hook fire). HOOK_SCRIPT_FILES were historically
+// NOT in the signed manifest, so an attacker able to PUBLISH a release — but without the
+// signing key — could swap a hook script (e.g. post-tool-use.sh / hook-launcher.mjs) while
+// every SOURCE_FILES hash still matched, and fail-closed verification would still pass →
+// RCE on the next hook fire. Keys are ROOT-relative, matching the extracted-tarball layout
+// that verifyReleaseFiles hashes against.
+export const RELEASE_SIGNED_FILES = [
+  ...SOURCE_FILES,
+  ...HOOK_SCRIPT_FILES.map(name => `scripts/${name}`),
+];