claude-mem-lite 3.41.0 → 3.42.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.41.0",
+      "version": "3.42.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.41.0",
+  "version": "3.42.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/lib/citation-tracker.mjs

@@ -626,9 +626,10 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
   // cite-rate reads N/2 for a single injected-then-cited obs instead of N/1.
   const updatePromote = db.prepare(`
     UPDATE observations
-       SET importance = MIN(?, importance + 1),
+       SET importance = MIN(?, COALESCE(importance, 1) + 1),
            cited_count = cited_count + 1,
            uncited_streak = 0,
+           demoted_at = NULL,
            last_decided_session_id = ?,
            last_cited_session_id = ?,
            decay_seen_count = decay_seen_count + ?
@@ -655,7 +656,7 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
   `);
   const updateDemote = db.prepare(`
     UPDATE observations
-       SET importance = MAX(?, importance - 1),
+       SET importance = MAX(?, COALESCE(importance, 1) - 1),
            uncited_streak = 0,
            last_decided_session_id = ?,
            demoted_at = ?,

package/lib/import-jsonl.mjs

@@ -147,7 +147,11 @@ export async function importJsonl(db, path, { project }) {
     const mb = (n) => Math.round(n / (1024 * 1024));
     throw new Error(`transcript too large (${mb(st.size)}MB > ${mb(MAX_IMPORT_BYTES)}MB cap); split it (e.g. split -l 50000 into parts) and import the parts`);
   }
-  const lines = readFileSync(path, 'utf8').split('\n');
+  // Strip a leading UTF-8 BOM — Node's utf8 read leaves it on, so line 1 would become
+  // a U+FEFF-prefixed "{...}" and fail JSON.parse (silently dropped as "skipped"). Real CC
+  // are BOM-less, but an editor-touched or re-encoded file can carry one.
+  const rawText = readFileSync(path, 'utf8');
+  const lines = (rawText.charCodeAt(0) === 0xFEFF ? rawText.slice(1) : rawText).split('\n');
   const seenPrompts = new Set();
   const seenObs = new Set();
   // Pre-seed dedup sets from existing rows so a second run on the same file

package/lib/search-core.mjs

@@ -28,6 +28,7 @@ import { sanitizeFtsQuery, relaxFtsQueryToOr, SESS_BM25, DEFAULT_DECAY_HALF_LIFE
 import { cjkPrecisionOk, extractCjkLikePatterns } from '../nlp.mjs';
 import { computeTier } from '../tier.mjs';
 import { countSearchTotal, attachBodyTokens } from '../search-engine.mjs';
+import { notLowSignalTitleClause } from '../scoring-sql.mjs';
 
 /** Sanitize a user query to FTS5 syntax; optionally force OR semantics. */
 export function buildSearchFtsQuery(query, { or = false } = {}) {
@@ -459,6 +460,11 @@ export async function coreRunSearchPipeline(ctx, opts) {
   // ── Type-list fallback (MCP): obs_type set + 0 matches → list recent of that type ──
   if (obsTypeFallback && results.length === 0 && obsType) {
     const typeWheres = ['COALESCE(compressed_into, 0) = 0', 'superseded_at IS NULL', 'type = ?'];
+    // Mirror the FTS path's low-signal filter (buildObsFtsQuery): this fallback is still a
+    // SEARCH surface, so degraded titles ("Modified X", "Error: …") must not lead it —
+    // acute for obs_type='change', the noise band. (The no-query recent-listing in
+    // searchObservationsHybrid deliberately does NOT filter — it mirrors mem_recent.)
+    if (!includeNoise) typeWheres.push(notLowSignalTitleClause(''));
     const typeParams = [obsType];
     if (project) { typeWheres.push('project = ?'); typeParams.push(project); }
     if (epochFrom !== null) { typeWheres.push('created_at_epoch >= ?'); typeParams.push(epochFrom); }

package/mem-cli.mjs

@@ -1538,7 +1538,15 @@ function cmdUpdate(db, args) {
     }
     updates.push('title = ?'); params.push(scrubSecrets(flags.title));
   }
-  if (flags.narrative !== undefined) { updates.push('narrative = ?'); params.push(scrubSecrets(flags.narrative)); }
+  if (flags.narrative !== undefined) {
+    // Reject empty (mirror --title): an explicit '' would blank the narrative
+    // irrecoverably (update takes no snapshot). Omit the flag to leave it unchanged.
+    if (typeof flags.narrative === 'string' && flags.narrative.trim() === '') {
+      fail('[mem] --narrative cannot be empty. Omit the flag to leave it unchanged.');
+      return;
+    }
+    updates.push('narrative = ?'); params.push(scrubSecrets(flags.narrative));
+  }
   if (flags.type) {
     const validTypes = new Set(['decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change']);
     if (!validTypes.has(flags.type)) {
@@ -1566,13 +1574,23 @@ function cmdUpdate(db, args) {
       fail(`[mem] --lesson too long (${rawLesson.length} chars, max 500).`);
       return;
     }
+    if (typeof rawLesson === 'string' && rawLesson.trim() === '') {
+      fail('[mem] --lesson cannot be empty. Omit the flag to leave it unchanged.');
+      return;
+    }
     updates.push('lesson_learned = ?');
     params.push(scrubSecrets(rawLesson));
   }
   // Scrub like the sibling text fields above (title/narrative/lesson) and the MCP twin
   // mem_update — concepts is a scrub-target + FTS-indexed column, so a raw secret here
   // lands searchable + exportable (rebuildObservationDerived folds it into `text`).
-  if (flags.concepts !== undefined) { updates.push('concepts = ?'); params.push(scrubSecrets(flags.concepts)); }
+  if (flags.concepts !== undefined) {
+    if (typeof flags.concepts === 'string' && flags.concepts.trim() === '') {
+      fail('[mem] --concepts cannot be empty. Omit the flag to leave it unchanged.');
+      return;
+    }
+    updates.push('concepts = ?'); params.push(scrubSecrets(flags.concepts));
+  }
 
   if (updates.length === 0) {
     fail('[mem] No fields to update. Use --title, --type, --importance, --lesson/--lesson-learned, --narrative, --concepts');
@@ -1664,7 +1682,7 @@ function cmdExport(db, args) {
   // id + memory_session_id are informational (restore remaps id and buckets under
   // a restore session).
   const rows = db.prepare(`
-    SELECT id, memory_session_id, project, type, title, subtitle, narrative, concepts, facts,
+    SELECT id, memory_session_id, project, type, title, subtitle, narrative, text, concepts, facts,
            files_read, files_modified, lesson_learned, search_aliases, importance, branch,
            access_count, cited_count, uncited_streak, injection_count, decay_seen_count,
            last_accessed_at, created_at, created_at_epoch
@@ -1740,6 +1758,7 @@ function cmdRestore(db, argv) {
 
   const dupCheck = db.prepare('SELECT id FROM observations WHERE project = ? AND title = ? AND created_at_epoch = ? LIMIT 1');
   const signalUpdate = db.prepare(`UPDATE observations SET
+      text = COALESCE(?, text),
       subtitle = ?, concepts = ?, facts = ?, search_aliases = ?, files_read = ?, branch = COALESCE(?, branch),
       access_count = ?, cited_count = ?, uncited_streak = ?, injection_count = ?,
       decay_seen_count = ?, last_accessed_at = ?
@@ -1770,15 +1789,20 @@ function cmdRestore(db, argv) {
       });
       if (res.kind !== 'saved') { skipped++; continue; } // saveObservation Jaccard dedup
       // Re-apply the fields saveObservation zeros/derives so the backup is faithful.
-      // search_aliases is its own FTS5 column, so this UPDATE re-syncs the index
-      // (via the observations FTS triggers) and restored aliases stay searchable.
-      // Scrub the FTS-indexed text fields on the way in — the sibling ingest paths
-      // (import-jsonl, compress-core) scrub as defense-in-depth, and restore is the only
-      // rewrite path that skipped it. A backup made before a SECRET_PATTERNS entry existed
-      // would otherwise re-index an old secret in facts/concepts even though narrative
-      // (routed through saveObservation) gets re-scrubbed. files_read/branch are
-      // paths/identifiers, not scrub-target text — left as-is.
+      // `text` is the observation BODY and its own FTS5 column — import-jsonl / cold-start
+      // rows keep the body there with an empty narrative, so saveObservation (content =
+      // narrative || title) would collapse it to the bare title. COALESCE re-applies the
+      // exported body (NULL when absent → keep saveObservation's derived text, so old
+      // backups without the column degrade gracefully). search_aliases is its own FTS5
+      // column too, so this UPDATE re-syncs the index (via the observations FTS triggers)
+      // and restored body/aliases stay searchable. Scrub the FTS-indexed text fields on
+      // the way in — the sibling ingest paths (import-jsonl, compress-core) scrub as
+      // defense-in-depth, and restore is the only rewrite path that skipped it. A backup
+      // made before a SECRET_PATTERNS entry existed would otherwise re-index an old secret
+      // in text/facts/concepts. files_read/branch are paths/identifiers, not scrub-target
+      // text — left as-is.
       signalUpdate.run(
+        r.text ? scrubSecrets(r.text) : null,
         scrubSecrets(r.subtitle || ''), scrubSecrets(r.concepts || ''), scrubSecrets(r.facts || ''),
         r.search_aliases === null || r.search_aliases === undefined ? null : scrubSecrets(r.search_aliases),
         r.files_read || '[]', r.branch ?? null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.41.0",
+  "version": "3.42.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry.mjs

@@ -390,11 +390,16 @@ const UPSERT_SQL = `
     capability_summary=CASE WHEN excluded.capability_summary != '' THEN excluded.capability_summary ELSE capability_summary END,
     input_type=CASE WHEN excluded.input_type != '' THEN excluded.input_type ELSE input_type END,
     output_type=CASE WHEN excluded.output_type != '' THEN excluded.output_type ELSE output_type END,
-    prerequisites=excluded.prerequisites,
+    -- Preserve-on-empty (same class as the FTS text columns above): a partial re-import
+    -- omits prerequisites/complexity, so upsertResource supplies their DEFAULTS ('{}' /
+    -- 'intermediate'). No CLI flag sets these (only a full re-index does), so treating the
+    -- default as the "absent" sentinel is safe: a real re-index sends non-default values,
+    -- which still overwrite; a metadata edit sends the default, which now preserves.
+    prerequisites=CASE WHEN excluded.prerequisites NOT IN ('', '{}') THEN excluded.prerequisites ELSE prerequisites END,
     keywords=CASE WHEN excluded.keywords != '' THEN excluded.keywords ELSE keywords END,
     tech_stack=CASE WHEN excluded.tech_stack != '' THEN excluded.tech_stack ELSE tech_stack END,
     use_cases=CASE WHEN excluded.use_cases != '' THEN excluded.use_cases ELSE use_cases END,
-    complexity=excluded.complexity,
+    complexity=CASE WHEN excluded.complexity NOT IN ('', 'intermediate') THEN excluded.complexity ELSE complexity END,
     indexed_at=excluded.indexed_at, updated_at=datetime('now')
 `;
 

package/search-engine.mjs

@@ -27,13 +27,13 @@ const FULL_SCORE = `${OBS_BM25}
   * (CASE WHEN ? IS NOT NULL AND o.project = ? THEN 2.0 ELSE 1.0 END)
   * (0.5 + 0.5 * COALESCE(o.importance, 1))
   * (1.0 + 0.1 * LN(1 + COALESCE(o.access_count, 0)))
-  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL))`;
+  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL AND o.lesson_learned NOT IN ('', 'none')))`;
 
 const SIMPLE_SCORE = `${OBS_BM25}
   * (1.0 + EXP(-0.693 * MAX(0, ? - MAX(o.created_at_epoch, COALESCE(o.last_accessed_at, o.created_at_epoch))) / ${TYPE_DECAY_CASE}))
   * ${TYPE_QUALITY_CASE}
   * (0.5 + 0.5 * COALESCE(o.importance, 1))
-  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL))`;
+  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL AND o.lesson_learned NOT IN ('', 'none')))`;
 
 export function buildObsFtsQuery(scoring, { multiplier, withSnippet, withOffset, includeNoise } = {}) {
   const scoreExpr = scoring === 'full' ? FULL_SCORE : SIMPLE_SCORE;

package/secret-scrub.mjs

@@ -44,6 +44,11 @@ export const SECRET_PATTERNS = [
   // low-FP decision that `topsecret=` / `access_token_count:` are non-credentials
   // (#8283 + utils.test.mjs:1089-1100); bare `pwd` is omitted so `PWD=` (a path) survives.
   [/((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)\s*[=:]\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  // Space-separated credential CLI flag: `--password <value>` (long-form). The KV
+  // patterns above require `=`/`:`; the shell long-flag form uses a space. Long-form
+  // only — `-p`/`-u` short flags collide with unit/user/update flags (too FP-risky).
+  // `(?!-)` stops it eating a following `--flag` when --password has no value.
+  [/(--(?:password|passwd)[=\s]+)(?!-)[^\s'"]{6,}/gi, '$1***'],
   // Bare-key QUOTED values — `api_key="..."`, `password: '...'`. The unquoted KV
   // patterns above stop at `'`/`"` (excluded from their value class), so a quoted
   // value matched 0 chars and slipped through. Consumes the opening quote, the value,
@@ -68,35 +73,46 @@ export const SECRET_PATTERNS = [
   [/\bsk-(?:proj|ant|ant-api\d{2})-[a-zA-Z0-9_-]{8,}\b/g, '***'],
   [/\bsk-[a-zA-Z0-9_-]{20,}\b/g, '***'],
   // GitHub tokens (ghp_, gho_, github_pat_)
-  [/\b(?:ghp_|gho_|ghs_|ghr_)[a-zA-Z0-9_]{30,}\b/g, '***'],
+  [/\b(?:ghp_|gho_|ghs_|ghr_|ghu_)[a-zA-Z0-9_]{30,}\b/g, '***'],
   [/\bgithub_pat_[a-zA-Z0-9_]{22,}\b/g, '***'],
   // GitLab tokens (glpat-)
   [/\bglpat-[a-zA-Z0-9_-]{20,}\b/g, '***'],
-  // Slack tokens (xox[bpas]-)
-  [/\bxox[bpas]-[a-zA-Z0-9-]{10,}\b/g, '***'],
+  // Slack tokens (xox[bpasr]-, xapp-, xoxe-)
+  [/\b(?:xox[bpasr]|xapp|xoxe)-[a-zA-Z0-9-]{10,}\b/g, '***'],
+  // Slack incoming-webhook URL — the path after /services/ is the shared secret.
+  [/(https:\/\/hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g, '$1***'],
   // JWT tokens (eyJ...eyJ...)
   [/\beyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g, '***'],
   // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
   // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
   // alternation missed; the block delimiters make FP impossible.
   [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g, '***PEM_KEY***'],
-  // Long hex strings in assignments (e.g. SECRET_KEY=abc123def456...)
-  [/(\b(?:key|secret|token|hash)\s*[=:]\s*)[0-9a-f]{32,}\b/gi, '$1***'],
+  // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
+  // `hash` deliberately excluded: `hash: <40hex>` / `hash=<md5>` are git SHAs and
+  // checksums (real, preserved data in this hash-heavy repo), not credentials.
+  [/(\b(?:key|secret|token)\s*[=:]\s*)[0-9a-f]{32,}\b/gi, '$1***'],
   // Google Cloud API keys (AIza...)
   [/\bAIza[A-Za-z0-9_-]{35}\b/g, '***'],
-  // Generic Bearer tokens in Authorization headers
-  [/(Authorization:\s*Bearer\s+)[^\s,;'"}\]]+/gi, '$1***'],
+  // Authorization header credentials — Bearer (opaque), Basic (base64 user:pass),
+  // and GitHub's `token` scheme all carry secrets after the scheme word.
+  [/(Authorization:\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi, '$1***'],
   // Supabase / generic long base64 keys (40+ chars, common in env vars)
   [/(\b(?:SUPABASE_KEY|SUPABASE_ANON_KEY|SUPABASE_SERVICE_ROLE_KEY|DATABASE_URL|REDIS_URL)\s*[=:]\s*)[^\s,;'"}\]]+/gi, '$1***'],
   // Basic auth in URLs (https://user:password@host). ftp/ftps added — file-drop
-  // creds are a common leak shape the https-only form missed.
-  [/(https?|ftps?):\/\/[^@/\s]+:[^@/\s]+@/gi, '$1://***:***@'],
-  // Database connection strings (postgres, mysql, mongodb, redis, amqp)
-  [/\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s,;'"}\]]+/gi, '$1://***'],
+  // creds are a common leak shape the https-only form missed. The userinfo run
+  // EXCLUDES `:` (`[^@/\s:]+`) so the two runs can't overlap on a colon — the
+  // overlapping form caused O(n²) catastrophic backtracking on a colon-heavy
+  // non-terminating input (an availability DoS on the synchronous prompt path).
+  [/(https?|ftps?):\/\/[^@/\s:]+:[^@/\s]+@/gi, '$1://***:***@'],
+  // Database connection strings (postgres, mysql, mariadb, mssql, mongodb, redis,
+  // amqp) incl. their TLS/alias variants (rediss/amqps/mssql/sqlserver) — managed
+  // cloud DBs almost always use the TLS scheme, which the base-only list leaked.
+  [/\b(postgres(?:ql)?|mysql|mariadb|mssql|sqlserver|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s,;'"}\]]+/gi, '$1://***'],
   // npm tokens (npm_...)
   [/\bnpm_[a-zA-Z0-9]{36,}\b/g, '***'],
-  // Stripe keys (sk_live_, rk_live_, pk_live_, sk_test_, pk_test_)
+  // Stripe keys (sk_live_, rk_live_, pk_live_, sk_test_, pk_test_) + webhook signing secret (whsec_)
   [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}\b/g, '***'],
+  [/\bwhsec_[a-zA-Z0-9]{20,}\b/g, '***'],
   // SendGrid API keys: SG.<22>.<43> — two dots at fixed offsets make this
   // structurally unmistakable; near-zero false-positive risk.
   [/\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, '***'],

package/tool-schemas.mjs

@@ -237,13 +237,15 @@ export const memUpdateSchema = {
   // CLI parity (cmdUpdate): empty/whitespace title would render as `(untitled)`
   // in every listing — reject here like the CLI does, instead of persisting it.
   title: z.string().refine(s => s.trim() !== '', 'title cannot be empty').optional().describe('New title'),
-  narrative: z.string().optional().describe('New narrative/content'),
+  // Reject empty content fields (parity with `title` above + cmdUpdate): an explicit
+  // '' would blank narrative/lesson/concepts irrecoverably (mem_update takes no snapshot).
+  narrative: z.string().refine(s => s.trim() !== '', 'narrative cannot be empty').optional().describe('New narrative/content'),
   type: OBS_TYPE_ENUM.optional().describe('New observation type'),
   importance: coerceInt.pipe(z.number().int().min(1).max(3)).optional().describe('New importance (1-3)'),
   // 500-char cap mirrors memSaveSchema + cmdUpdate — update was the one path
   // that let overlong lessons leak into the DB via MCP.
-  lesson_learned: z.string().max(500).optional().describe('Add or update lesson learned'),
-  concepts: z.string().optional().describe('Space-separated concept tags'),
+  lesson_learned: z.string().max(500).refine(s => s.trim() !== '', 'lesson_learned cannot be empty').optional().describe('Add or update lesson learned'),
+  concepts: z.string().refine(s => s.trim() !== '', 'concepts cannot be empty').optional().describe('Space-separated concept tags'),
 };
 
 export const memExportSchema = {