claude-mem-lite 3.39.2 → 3.40.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.39.2",
+      "version": "3.40.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.39.2",
+  "version": "3.40.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/claudemd.mjs

@@ -143,7 +143,10 @@ export function writeManaged(cwd, { slug, version, block, doc }) {
     else next = raw + '\n\n' + section + '\n';
     action = 'created';
   } else {
-    next = raw.replace(m[0], section);
+    // Function replacer (not a string): a `$`-sequence in `section` (a future template with
+    // a shell example / regex / `$1`) would otherwise be interpreted as a replacement
+    // back-reference and corrupt the block on every SessionStart refresh. Matches line 153.
+    next = raw.replace(m[0], () => section);
     action = next !== raw ? 'updated' : 'unchanged';
   }
   // H2: collapse any DUPLICATE same-slug blocks (keep the first, drop the rest).

package/hook-memory.mjs

@@ -255,6 +255,7 @@ export function searchRelevantMemories(db, userPrompt, project, excludeIds = [])
     try {
       const crossStmt = db.prepare(`
         SELECT o.id, o.type, o.title, o.subtitle, o.narrative, o.importance, o.lesson_learned, o.project,
+               o.created_at_epoch, o.files_modified,
                o.cited_count, o.uncited_streak,
                ${OBS_BM25} as relevance,
                ${noisePenaltyClause('o')} as noise_penalty

package/hook-optimize.mjs

@@ -282,7 +282,12 @@ export function _normalizeGateOpen(last, now) {
   return now - epoch >= NORMALIZE_INTERVAL_MS;
 }
 
-export function shouldRunNormalize() {
+export function shouldRunNormalize(project = null) {
+  // The 7-day gate rate-limits the UNSCOPED whole-store normalize. An explicit --project is
+  // targeted work: it must not be blocked by a prior global (or other-project) run, and it
+  // does not advance the shared timer (see executeNormalize). Without this, `optimize --run
+  // --task normalize --project B` returned skipped(gate) for 7 days if ANY project had run.
+  if (project) return true;
   try {
     const last = JSON.parse(readFileSync(NORMALIZE_GATE_FILE, 'utf8'));
     return _normalizeGateOpen(last, Date.now());
@@ -399,7 +404,7 @@ export function applyNormalization(db, groups, { project = null } = {}) {
 }
 
 export async function executeNormalize(db, force = false, { project } = {}) {
-  if (!force && !shouldRunNormalize()) return { skipped: true, reason: 'gate' };
+  if (!force && !shouldRunNormalize(project)) return { skipped: true, reason: 'gate' };
 
   const concepts = extractUniqueConcepts(db, 500, { project });
   if (concepts.length < 5) return { skipped: true, reason: 'too few concepts' };
@@ -409,7 +414,10 @@ export async function executeNormalize(db, force = false, { project } = {}) {
 
   const result = applyNormalization(db, groups, { project });
 
-  try { writeFileSync(NORMALIZE_GATE_FILE, JSON.stringify({ epoch: Date.now() })); } catch {}
+  // Only the UNSCOPED (whole-store) run advances the shared 7-day gate. A project-scoped run
+  // must not reset the global timer (it never consulted it — shouldRunNormalize(project) is
+  // always open), or one `--project X` run would silently block the next global normalize.
+  if (!project) { try { writeFileSync(NORMALIZE_GATE_FILE, JSON.stringify({ epoch: Date.now() })); } catch { /* best-effort */ } }
 
   return { processed: result.updated, groups: groups.length };
 }
@@ -837,7 +845,7 @@ export function optimizePreview(db, { project, detail = false } = {}) {
   const reenrichAliases = findReenrichCandidates(db, 5000, { scope: 'aliases', project }).length;
 
   const concepts = extractUniqueConcepts(db, 500, { project });
-  const normalizeReady = shouldRunNormalize() && concepts.length >= 5;
+  const normalizeReady = shouldRunNormalize(project) && concepts.length >= 5;
 
   const mergeClusters = findMergeCandidates(db, 50, { project });
   const clusterMerge = mergeClusters.length;
@@ -851,7 +859,7 @@ export function optimizePreview(db, { project, detail = false } = {}) {
     reenrichWide,
     reenrichAliases,
     normalize: normalizeReady ? concepts.length : 0,
-    normalizeGateOpen: shouldRunNormalize(),
+    normalizeGateOpen: shouldRunNormalize(project),
     clusterMerge,
     smartCompress,
     total: reenrich + (normalizeReady ? 1 : 0) + clusterMerge + smartCompress,

package/lib/maintain-core.mjs

@@ -397,10 +397,15 @@ export function maintenanceStats(db, { projectFilter, baseParams, staleAge }) {
       -- the scan stat previews what decay will mark idle, and decay protects
       -- injected rows. Omitting it over-counted "stale" by the injected-but-decayed
       -- rows decay never touches (e.g. demote_pinned's output: imp=1 but inj>0).
+      -- lesson_learned guard mirrors decayAndMarkIdle (:188) / cleanupBroken (:153): those
+      -- ops NEVER touch a lesson-bearing row ("lessons never auto-GC"), so the scan preview
+      -- must exclude them too or it over-forecasts "Stale"/"Broken" vs what execute does.
       COALESCE(SUM(CASE WHEN COALESCE(importance, 1) = 1 AND COALESCE(access_count, 0) = 0
                     AND COALESCE(injection_count, 0) = 0
+                    AND (lesson_learned IS NULL OR lesson_learned = '' OR lesson_learned = 'none')
                     AND created_at_epoch < ? THEN 1 ELSE 0 END), 0) as stale,
       COALESCE(SUM(CASE WHEN (title IS NULL OR title = '') AND (narrative IS NULL OR narrative = '')
+                    AND (lesson_learned IS NULL OR lesson_learned = '' OR lesson_learned = 'none')
                THEN 1 ELSE 0 END), 0) as broken,
       COALESCE(SUM(CASE WHEN COALESCE(access_count, 0) > 3 AND COALESCE(importance, 1) < 3
                THEN 1 ELSE 0 END), 0) as boostable,

package/lib/search-core.mjs

@@ -54,6 +54,27 @@ export function parseDuration(raw) {
   return { ok: true, ms: n * DURATION_UNIT_MS[m[2].toLowerCase()] };
 }
 
+/**
+ * Parse one from/to bound to epoch ms. A bare `YYYY-MM-DD` is the user's LOCAL
+ * calendar day (created_at_epoch is Date.now() = local wall-clock), so it must be
+ * built in local time — `new Date('YYYY-MM-DD')` parses as UTC midnight and shifts the
+ * boundary by the tz offset (8h for the UTC+8 base), silently dropping early-morning
+ * rows and leaking the next day's early hours. `endOfDay` extends a date-only bound to
+ * 23:59:59.999 local (the inclusive `--to` day). Full ISO 8601 (with time/offset) is
+ * parsed as-is, honoring any explicit zone. Out-of-range date-only strings return NaN so
+ * the caller's isNaN guard rejects them (matches the old UTC parse's strict Invalid Date).
+ */
+function parseCalendarBound(raw, endOfDay) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(raw)) {
+    const [y, m, d] = raw.split('-').map(Number);
+    const dt = endOfDay ? new Date(y, m - 1, d, 23, 59, 59, 999) : new Date(y, m - 1, d, 0, 0, 0, 0);
+    // new Date(2026, 12, 45) silently rolls over; reject so 2026-13-45 fails like before.
+    if (dt.getFullYear() !== y || dt.getMonth() !== m - 1 || dt.getDate() !== d) return NaN;
+    return dt.getTime();
+  }
+  return new Date(raw).getTime();
+}
+
 /**
  * Parse from/to date bounds to epoch ms. Date-only `to` (YYYY-MM-DD) extends
  * to end-of-day so "to 2026-06-12" includes that day's rows. An optional
@@ -63,11 +84,8 @@ export function parseDuration(raw) {
  *         | { ok: false, bad: 'from'|'to'|'since', value: string }}
  */
 export function parseDateBounds(fromRaw, toRaw, sinceRaw = null, now = Date.now()) {
-  let epochFrom = fromRaw ? new Date(fromRaw).getTime() : null;
-  let epochTo = toRaw ? new Date(toRaw).getTime() : null;
-  if (epochTo !== null && toRaw && /^\d{4}-\d{2}-\d{2}$/.test(toRaw)) {
-    epochTo += 86400000 - 1; // extend to 23:59:59.999
-  }
+  let epochFrom = fromRaw ? parseCalendarBound(fromRaw, false) : null;
+  const epochTo = toRaw ? parseCalendarBound(toRaw, true) : null;
   if (epochFrom !== null && isNaN(epochFrom)) return { ok: false, bad: 'from', value: fromRaw };
   if (epochTo !== null && isNaN(epochTo)) return { ok: false, bad: 'to', value: toRaw };
   if (sinceRaw) {

package/lib/timeline-core.mjs

@@ -17,11 +17,11 @@ import { sanitizeFtsQuery } from '../utils.mjs';
 
 const TIMELINE_COLS = 'id, type, title, subtitle, project, created_at, created_at_epoch';
 
-/** Nearest non-compressed observation to `epoch` (optionally project-scoped). */
+/** Nearest live (non-compressed, non-superseded) observation to `epoch`. */
 function nearestObservation(db, epoch, project) {
   return db.prepare(`
     SELECT id FROM observations
-    WHERE COALESCE(compressed_into, 0) = 0 ${project ? 'AND project = ?' : ''}
+    WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${project ? 'AND project = ?' : ''}
     ORDER BY ABS(created_at_epoch - ?) ASC LIMIT 1
   `).get(...(project ? [project, epoch] : [epoch]));
 }
@@ -56,7 +56,7 @@ export function resolveAnchorToken(db, rawAnchor, { project = null } = {}) {
   // Bare "#N" or "N" — observation first. Route compressed obs to its live
   // parent so the window (which filters compressed) isn't shown around a dead
   // record; negative sentinels (-1 dropped, -2 pending purge) have no parent.
-  const obsRow = db.prepare('SELECT compressed_into FROM observations WHERE id = ?').get(parsed.id);
+  const obsRow = db.prepare('SELECT compressed_into, superseded_at, superseded_by FROM observations WHERE id = ?').get(parsed.id);
   if (obsRow) {
     const ci = obsRow.compressed_into;
     if (ci && ci > 0) {
@@ -65,6 +65,16 @@ export function resolveAnchorToken(db, rawAnchor, { project = null } = {}) {
     if (ci && ci < 0) {
       return { ok: false, error: { code: 'compressed-pruned', id: parsed.id } };
     }
+    // Superseded obs → hop to its live successor, mirroring compressed→parent. A
+    // superseded row is dropped from every other read path (and from the before/after
+    // window legs below), so anchoring ON it would surface a dead record. superseded_by
+    // is polymorphic: a numeric obs id for explicit supersession (save-observation), or a
+    // string marker ('auto-dedup'/'auto-dedup-fuzzy') for hook auto-dedup — only the
+    // numeric case has a successor to redirect to, so guard on `typeof … number` (not
+    // `> 0`, which a string sentinel would silently pass as NaN→false anyway but reads wrong).
+    if (obsRow.superseded_at !== null && typeof obsRow.superseded_by === 'number' && obsRow.superseded_by > 0) {
+      return { ok: true, anchorId: obsRow.superseded_by, anchorNote: `(anchored to #${obsRow.superseded_by}, #${parsed.id} was superseded by it)` };
+    }
     return { ok: true, anchorId: parsed.id, anchorNote: null };
   }
 
@@ -138,10 +148,12 @@ export function resolveQueryAnchor(db, queryStr, { project = null } = {}) {
   };
 }
 
-/** No-anchor fallback: most recent non-compressed observations, newest first. */
+/** No-anchor fallback: most recent live (non-compressed, non-superseded) obs, newest first. */
 export function fetchRecentTimeline(db, { project = null, limit }) {
-  const compressedFilter = 'COALESCE(compressed_into, 0) = 0';
-  const where = project ? `WHERE ${compressedFilter} AND project = ?` : `WHERE ${compressedFilter}`;
+  // superseded_at IS NULL mirrors the before/after window legs (fetchTimelineWindow) and
+  // every other read path — a superseded row must not lead the "most recent" timeline.
+  const liveFilter = 'COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL';
+  const where = project ? `WHERE ${liveFilter} AND project = ?` : `WHERE ${liveFilter}`;
   const params = project ? [project, limit] : [limit];
   return db.prepare(`
     SELECT ${TIMELINE_COLS}

package/mem-cli.mjs

@@ -1569,7 +1569,10 @@ function cmdUpdate(db, args) {
     updates.push('lesson_learned = ?');
     params.push(scrubSecrets(rawLesson));
   }
-  if (flags.concepts !== undefined) { updates.push('concepts = ?'); params.push(flags.concepts); }
+  // Scrub like the sibling text fields above (title/narrative/lesson) and the MCP twin
+  // mem_update — concepts is a scrub-target + FTS-indexed column, so a raw secret here
+  // lands searchable + exportable (rebuildObservationDerived folds it into `text`).
+  if (flags.concepts !== undefined) { updates.push('concepts = ?'); params.push(scrubSecrets(flags.concepts)); }
 
   if (updates.length === 0) {
     fail('[mem] No fields to update. Use --title, --type, --importance, --lesson/--lesson-learned, --narrative, --concepts');
@@ -1769,8 +1772,16 @@ function cmdRestore(db, argv) {
       // Re-apply the fields saveObservation zeros/derives so the backup is faithful.
       // search_aliases is its own FTS5 column, so this UPDATE re-syncs the index
       // (via the observations FTS triggers) and restored aliases stay searchable.
+      // Scrub the FTS-indexed text fields on the way in — the sibling ingest paths
+      // (import-jsonl, compress-core) scrub as defense-in-depth, and restore is the only
+      // rewrite path that skipped it. A backup made before a SECRET_PATTERNS entry existed
+      // would otherwise re-index an old secret in facts/concepts even though narrative
+      // (routed through saveObservation) gets re-scrubbed. files_read/branch are
+      // paths/identifiers, not scrub-target text — left as-is.
       signalUpdate.run(
-        r.subtitle || '', r.concepts || '', r.facts || '', r.search_aliases ?? null, r.files_read || '[]', r.branch ?? null,
+        scrubSecrets(r.subtitle || ''), scrubSecrets(r.concepts || ''), scrubSecrets(r.facts || ''),
+        r.search_aliases === null || r.search_aliases === undefined ? null : scrubSecrets(r.search_aliases),
+        r.files_read || '[]', r.branch ?? null,
         num(r.access_count), num(r.cited_count), num(r.uncited_streak), num(r.injection_count),
         num(r.decay_seen_count), r.last_accessed_at ?? null,
         res.id,
@@ -2239,7 +2250,22 @@ function cmdRegistry(_memDb, args) {
       const name = flags.name;
       const resourceType = flags['resource-type'];
       if (!name || !resourceType) { fail('[mem] Usage: claude-mem-lite registry import --name N --resource-type skill|agent [--invocation-name I] [--capability-summary S]'); return; }
-      const fields = { name, type: resourceType, status: 'active', source: flags.source || 'user' };
+      // Validate --source against its CHECK enum (parity with memRegistrySchema.source on MCP):
+      // an invalid value otherwise reaches the INSERT and throws a raw SqliteError stacktrace
+      // (the dispatcher's catch only special-cases SQLITE_BUSY/LOCKED).
+      if (flags.source && !new Set(['preinstalled', 'user', 'github']).has(flags.source)) {
+        fail(`[mem] Invalid --source "${flags.source}". Valid: preinstalled, user, github`);
+        return;
+      }
+      // Preserve provenance on a metadata-only re-import: default source to 'user' only for
+      // a genuinely NEW resource. Re-importing an existing github/preinstalled row without
+      // --source must not flip it to 'user' (which also mis-grants the user-source rank boost).
+      let source = flags.source;
+      if (!source) {
+        const existing = rdb.prepare('SELECT source FROM resources WHERE type = ? AND name = ?').get(resourceType, name);
+        source = existing ? existing.source : 'user';
+      }
+      const fields = { name, type: resourceType, status: 'active', source };
       for (const f of ['repo-url', 'local-path', 'invocation-name', 'intent-tags', 'domain-tags', 'trigger-patterns', 'capability-summary', 'keywords', 'tech-stack', 'use-cases']) {
         const camel = f.replace(/-([a-z])/g, (_, c) => '_' + c);
         fields[camel] = flags[f] || '';

package/nlp.mjs

@@ -314,6 +314,16 @@ export function sanitizeFtsQuery(query) {
             if (bg && !isCjkNoiseBigram(bg) && !matched.has(bg)) expandedTokens.push(bg);
           }
         }
+        // Preserve embedded Latin/English identifiers glued into the CJK token — e.g. the
+        // "redis" in "redis缓存问题". extractCjkKeywords + cjkBigrams only see CJK runs, so
+        // without this the Latin anchor (often the single most precise term — a proper noun
+        // like redis/grafana/oauth with no CJK synonym) was dropped, zeroing recall on
+        // whitespace-free mixed-script prompts. Mirrors registry-retriever.mjs's embedded-
+        // English extraction. Lowercased for parity with the write-path unicode61 folding.
+        for (const en of (remainder.match(/[a-zA-Z]{2,}/g) || [])) {
+          const low = en.toLowerCase();
+          if (!FTS_STOP_WORDS.has(low) && !expandedTokens.includes(low)) expandedTokens.push(low);
+        }
         continue;
       }
       // No dictionary word matched. For a PURE-CJK run, pushing the whole

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.39.2",
+  "version": "3.40.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-importer.mjs

@@ -233,7 +233,7 @@ export async function importFromGitHub(db, url, opts = {}) {
   // 1. Parse GitHub URL
   const parsed = parseGitHubUrl(url);
   if (!parsed) throw new Error('Invalid GitHub URL');
-  const { owner, repo, branch, path: pathFilter } = parsed;
+  const { owner, repo, branch: parsedBranch, path: pathFilter } = parsed;
 
   // 2. Fetch repo metadata (stars, forks, updated_at)
   const repoResp = await fetchFn(buildRepoUrl(owner, repo), { headers });
@@ -247,6 +247,13 @@ export async function importFromGitHub(db, url, opts = {}) {
   const repoForks = repoMeta.forks_count || 0;
   const repoUpdatedAt = repoMeta.updated_at || null;
 
+  // parseGitHubUrl defaults branch to 'main' when the URL omits `/tree/<branch>`. Prefer the
+  // repo's ACTUAL default branch in that case: a repo defaulting to master/develop/trunk
+  // otherwise 404s on a non-existent 'main' (GitHub does not redirect a missing ref), failing
+  // a URL that opens fine in the browser. An explicit `/tree/<branch>` in the URL still wins.
+  const branchExplicit = /\/tree\//.test(url.split(/[?#]/)[0]);
+  const branch = branchExplicit ? parsedBranch : (repoMeta.default_branch || parsedBranch);
+
   // 3. Fetch file tree via GitHub API (recursive)
   const treeResp = await fetchFn(buildTreeUrl(owner, repo, branch), { headers });
   if (!treeResp.ok) {

package/registry.mjs

@@ -368,9 +368,15 @@ const UPSERT_SQL = `
     indexed_at, updated_at)
   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
   ON CONFLICT(type, name) DO UPDATE SET
-    status=excluded.status, source=excluded.source, repo_url=excluded.repo_url,
+    status=excluded.status, source=excluded.source,
+    -- Preserve-on-empty (mirror the FTS text columns below): a PARTIAL re-upsert defaults
+    -- repo_url/local_path to null/'' in the caller (import is the only edit path). Clobbering
+    -- them ORPHANS the resource — mem_use/enrich read local_path (NOT NULL, so '' passes the
+    -- constraint and silently breaks reads), and the scanner needs local_path to disable it.
+    repo_url=CASE WHEN excluded.repo_url != '' THEN excluded.repo_url ELSE repo_url END,
     repo_stars=CASE WHEN excluded.repo_stars > 0 THEN excluded.repo_stars ELSE repo_stars END,
-    local_path=excluded.local_path, file_hash=excluded.file_hash,
+    local_path=CASE WHEN excluded.local_path != '' THEN excluded.local_path ELSE local_path END,
+    file_hash=excluded.file_hash,
     invocation_name=CASE WHEN excluded.invocation_name != '' THEN excluded.invocation_name ELSE invocation_name END,
     -- Preserve-on-empty (mirror repo_stars/invocation_name above): a PARTIAL re-upsert --
     -- e.g. "registry import --name X --capability-summary ...", where mem-cli defaults every

package/scripts/prompt-search-utils.mjs

@@ -164,8 +164,14 @@ export function shouldSkipByDedup(newIds, injectedFile) {
     if (count >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;
-    const prevSet = new Set(prevIds);
-    const overlapCount = newIds.filter(id => prevSet.has(id)).length;
+    // Normalize both sides to strings before comparing: UPS writes obs ids as numbers
+    // (rows.map(r => r.id)) while pre-tool-recall's mergeCrossHookInjected writes them as
+    // strings (.map(String)), and both hooks SHARE this file. Without normalization
+    // Set.has(8829) misses "8829" → cross-hook dedup never fires and the same lesson
+    // double-injects within the window. (pre-tool-recall's readCrossHookInjected already
+    // String-normalizes; this brings the UPS-side reader in line.)
+    const prevSet = new Set(prevIds.map(String));
+    const overlapCount = newIds.filter(id => prevSet.has(String(id))).length;
     return overlapCount / newIds.length >= 0.8;
   } catch { return false; }
 }

package/server.mjs

@@ -286,9 +286,15 @@ async function runSearchPipeline(db, args, { llm, rerankLlm } = {}) {
     return { ...formatSearchOutput([], args, ftsQuery, 0), escalated: false, results: [], total: 0, variants: null };
   }
 
-  // obs_type ⇒ observations-only; deep is observations-only too (deepSearch fuses
-  // hybrid-obs lists). args.type is the source filter (observations|sessions|prompts).
-  const effectiveType = deepMode === 'deep' ? 'observations' : (args.type || (args.obs_type ? 'observations' : undefined));
+  // obs_type/importance/branch/tier ⇒ observations-only; deep is observations-only too
+  // (deepSearch fuses hybrid-obs lists). args.type is the source filter
+  // (observations|sessions|prompts). Forcing obs-only for the obs-exclusive fields
+  // matches the CLI (mem-cli.mjs:177): session/prompt tables have no importance/branch/tier
+  // column, so without the force those legs return UNFILTERED and leak rows that can't be
+  // scoped to the filter (branch/importance/tier previously leaked cross-source on MCP).
+  const effectiveType = deepMode === 'deep'
+    ? 'observations'
+    : (args.type || ((args.obs_type || args.importance || args.branch || args.tier) ? 'observations' : undefined));
 
   const r = await coreRunSearchPipeline(
     {
@@ -1402,7 +1408,15 @@ server.registerTool(
       }
       const IMPORT_STRING_FIELDS = ['repo_url', 'local_path', 'invocation_name', 'intent_tags',
         'domain_tags', 'trigger_patterns', 'capability_summary', 'keywords', 'tech_stack', 'use_cases'];
-      const fields = { name: args.name, type: args.resource_type, status: 'active', source: args.source || 'user' };
+      // Preserve provenance on a metadata-only re-import (parity with cmdRegistry): default
+      // source to 'user' only for a NEW resource — a partial re-upsert of an existing
+      // github/preinstalled row without `source` must not flip it to 'user'.
+      let source = args.source;
+      if (!source) {
+        const existing = rdb.prepare('SELECT source FROM resources WHERE type = ? AND name = ?').get(args.resource_type, args.name);
+        source = existing ? existing.source : 'user';
+      }
+      const fields = { name: args.name, type: args.resource_type, status: 'active', source };
       for (const f of IMPORT_STRING_FIELDS) fields[f] = args[f] || '';
       const id = upsertResource(rdb, fields);
       return { content: [{ type: 'text', text: `Imported: ${args.resource_type}:${args.name} (id=${id})` }] };

package/source-files.mjs

@@ -198,3 +198,16 @@ export const HOOK_SCRIPT_FILES = [
   // through this wrapper so any partial-install drift heals automatically.
   'hook-launcher.mjs',
 ];
+
+// The complete set of files the release signature MUST cover: every runtime .mjs
+// (SOURCE_FILES) PLUS the executable hook scripts (copyReleaseIntoStaging installs these
+// into the live dir and they run on every hook fire). HOOK_SCRIPT_FILES were historically
+// NOT in the signed manifest, so an attacker able to PUBLISH a release — but without the
+// signing key — could swap a hook script (e.g. post-tool-use.sh / hook-launcher.mjs) while
+// every SOURCE_FILES hash still matched, and fail-closed verification would still pass →
+// RCE on the next hook fire. Keys are ROOT-relative, matching the extracted-tarball layout
+// that verifyReleaseFiles hashes against.
+export const RELEASE_SIGNED_FILES = [
+  ...SOURCE_FILES,
+  ...HOOK_SCRIPT_FILES.map(name => `scripts/${name}`),
+];