claude-mem-lite 3.47.0 → 3.49.0

package/lib/stats-core.mjs

@@ -0,0 +1,113 @@
+// lib/stats-core.mjs — shared primary stats feed for CLI `stats` and MCP `mem_stats`.
+//
+// Audit 2026-07-17 MED-4: these ~15 COUNT/GROUP-BY queries were hand-copied
+// byte-equivalent between server.mjs (mem_stats) and mem-cli.mjs (cmdStats) — the
+// same twin-drift class the `--quality` sub-report already closed via
+// lib/stats-quality.mjs, and delete orchestration via lib/delete-core.mjs. One
+// computation, two renderers: callers keep their own formatting (MCP text block /
+// CLI console+JSON) plus any surface-only extras (CLI hookErrors24h).
+import { inferProject } from '../utils.mjs';
+import { buildNotLowSignalSql } from './low-signal-patterns.mjs';
+import { TIER_CASE_SQL, tierSqlParams } from '../tier.mjs';
+import { computeNoiseGauge } from './stats-quality.mjs';
+
+/**
+ * Compute the primary stats feed. Row shapes are returned exactly as the twin
+ * blocks produced them ({c}/{t}/{v} single-row objects, arrays for distributions)
+ * so both call sites render with minimal diff.
+ */
+export function computeStatsFeed(db, { project = null, days = 30, now = Date.now() } = {}) {
+  const cutoff = now - days * 86400000;
+  const projectFilter = project ? 'AND project = ?' : '';
+  const baseParams = project ? [project] : [];
+
+  // Total counts (session_summaries, not sdk_sessions — CLI↔MCP aligned)
+  const obsTotal = db.prepare(`SELECT COUNT(*) as c FROM observations WHERE 1=1 ${projectFilter}`).get(...baseParams);
+  const sessTotal = db.prepare(`SELECT COUNT(*) as c FROM session_summaries WHERE 1=1 ${projectFilter}`).get(...baseParams);
+  const promptTotal = project
+    ? db.prepare('SELECT COUNT(*) as c FROM user_prompts p JOIN sdk_sessions s ON p.content_session_id = s.content_session_id WHERE s.project = ?').get(project)
+    : db.prepare('SELECT COUNT(*) as c FROM user_prompts').get();
+
+  // Recent counts
+  const obsRecent = db.prepare(`SELECT COUNT(*) as c FROM observations WHERE created_at_epoch >= ? ${projectFilter}`).get(cutoff, ...baseParams);
+  const sessRecent = db.prepare(`SELECT COUNT(*) as c FROM session_summaries WHERE created_at_epoch >= ? ${projectFilter}`).get(cutoff, ...baseParams);
+
+  // Type distribution (recent)
+  const types = db.prepare(`
+    SELECT type, COUNT(*) as c FROM observations
+    WHERE created_at_epoch >= ? ${projectFilter}
+    GROUP BY type ORDER BY c DESC
+  `).all(cutoff, ...baseParams);
+
+  // Top projects (global view — skipped when filtering by single project)
+  const projects = project ? [] : db.prepare(`
+    SELECT project, COUNT(*) as c FROM observations
+    GROUP BY project ORDER BY c DESC LIMIT 20
+  `).all();
+
+  // Daily activity (last 7 days)
+  const daily = db.prepare(`
+    SELECT date(created_at) as day, COUNT(*) as c FROM observations
+    WHERE created_at_epoch >= ? ${projectFilter}
+    GROUP BY day ORDER BY day DESC LIMIT 7
+  `).all(now - 7 * 86400000, ...baseParams);
+
+  // Data health
+  const tokenEst = db.prepare(`
+    SELECT SUM(LENGTH(COALESCE(title,'')) + LENGTH(COALESCE(narrative,'')) + LENGTH(COALESCE(text,''))) / 4 as t
+    FROM observations WHERE 1=1 ${projectFilter}
+  `).get(...baseParams);
+  const avgImp = db.prepare(`SELECT AVG(COALESCE(importance,1)) as v FROM observations WHERE 1=1 ${projectFilter}`).get(...baseParams);
+
+  const thirtyDaysAgo = now - 30 * 86400000;
+  // v3.23 noise-gauge de-blinding: `<= 1` makes the imp=0 dormant population visible
+  // (decay floor + LLM low-signal filter push ~half the live corpus to 0);
+  // injection_count=0 mirrors decay's NEVER-INJECTED guard so injected-but-decayed
+  // pinned noise isn't miscounted as "never used".
+  const lowVal = db.prepare(`
+    SELECT COUNT(*) as c FROM observations
+    WHERE COALESCE(importance,1) <= 1 AND COALESCE(access_count,0) = 0
+      AND COALESCE(injection_count,0) = 0
+      AND COALESCE(compressed_into, 0) = 0
+      AND created_at_epoch < ? ${projectFilter}
+  `).get(thirtyDaysAgo, ...baseParams);
+  // Low-signal-title population (template / tool-log titles the read-side filter
+  // already excludes). The imp≤1 "Low-value" metric can't see these, so the gauge
+  // under-reports real noise without it. Same source as lib/low-signal-patterns.mjs.
+  const lowSignalTitle = db.prepare(`
+    SELECT COUNT(*) as c FROM observations
+    WHERE NOT ${buildNotLowSignalSql()}
+      AND COALESCE(compressed_into, 0) = 0 ${projectFilter}
+  `).get(...baseParams);
+  // F7: both noise numerators exclude compressed rows → divide by the LIVE count, not
+  // obsTotal (all rows), so a compress-heavy store isn't reported cleaner than it is.
+  const liveTotal = db.prepare(
+    `SELECT COUNT(*) as c FROM observations WHERE COALESCE(compressed_into, 0) = 0 ${projectFilter}`
+  ).get(...baseParams);
+  const { noiseRatio, lowSignalRatio } = computeNoiseGauge({ liveTotal: liveTotal.c, lowValCount: lowVal.c, lowSignalCount: lowSignalTitle.c });
+  const compressedCount = db.prepare(
+    `SELECT COUNT(*) as c FROM observations WHERE compressed_into IS NOT NULL ${projectFilter}`
+  ).get(...baseParams);
+  const supersededOnlyCount = db.prepare(
+    `SELECT COUNT(*) as c FROM observations WHERE superseded_at IS NOT NULL AND compressed_into IS NULL ${projectFilter}`
+  ).get(...baseParams);
+
+  // Tier distribution
+  const tierCtx = { now, currentProject: project || inferProject(), currentSessionId: '' };
+  const tdParams = tierSqlParams(tierCtx);
+  const tierDist = db.prepare(`
+    SELECT tier, COUNT(*) as c FROM (
+      SELECT ${TIER_CASE_SQL} as tier FROM observations
+      WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${projectFilter}
+    ) GROUP BY tier ORDER BY tier
+  `).all(...tdParams, ...baseParams);
+  const tierMap = Object.fromEntries(tierDist.map((r) => [r.tier, r.c]));
+
+  return {
+    obsTotal, sessTotal, promptTotal, obsRecent, sessRecent,
+    types, projects, daily,
+    tokenEst, avgImp, lowVal, lowSignalTitle, liveTotal,
+    noiseRatio, lowSignalRatio, compressedCount, supersededOnlyCount,
+    tierMap,
+  };
+}

package/mem-cli.mjs

@@ -15,15 +15,18 @@ import { ensureRegistryDb, upsertResource } from './registry.mjs';
 import { searchResources } from './registry-retriever.mjs';
 import { computeFunnel, formatFunnel, computeSweep, formatSweep, DEFAULT_SWEEP_FLOORS, DEFAULT_SWEEP_MARGINS } from './registry-recommend.mjs';
 import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from './lib/compress-core.mjs';
-import { buildNotLowSignalSql } from './lib/low-signal-patterns.mjs';
 import {
   cleanupBroken, decayAndMarkIdle, boostAccessed, demotePinned, mergeDuplicates,
   recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans,
   purgeStale, purgeStalePreview, findDuplicates, maintenanceStats, rebuildVectors, vacuum,
-  recoverChildrenOf, hardDeleteCandidateCount,
+  hardDeleteCandidateCount,
   OP_CAP, STALE_AGE_MS, PINNED_INJ_THRESHOLD,
 } from './lib/maintain-core.mjs';
 import { snapshotDb } from './lib/db-backup.mjs';
+import { deleteObservations } from './lib/delete-core.mjs';
+import { OBS_TYPE_SET } from './lib/obs-types.mjs';
+import { computeStatsFeed } from './lib/stats-core.mjs';
+import { buildLessonNudge } from './lib/save-nudge.mjs';
 import { optimizePreview, optimizeRun } from './hook-optimize.mjs';
 import { buildSessionContextLines } from './hook-context.mjs';
 import { cmdAdopt, cmdUnadopt } from './adopt-cli.mjs';
@@ -41,7 +44,6 @@ import { parseArgs, out, fail, relativeTime, fmtDateShort, parseIdToken, formatP
 import { saveObservation } from './lib/save-observation.mjs';
 import { rebuildObservationDerived, normalizeScope } from './lib/observation-write.mjs';
 import { EXPORT_COLUMNS_SQL } from './lib/export-columns.mjs';
-import { computeNoiseGauge } from './lib/stats-quality.mjs';
 import { recallByFile } from './lib/recall-core.mjs';
 import { resolveAnchorToken, formatAnchorError, resolveQueryAnchor, fetchRecentTimeline, fetchTimelineWindow } from './lib/timeline-core.mjs';
 import { buildSearchFtsQuery, parseDateBounds, parseDuration, coreRunSearchPipeline } from './lib/search-core.mjs';
@@ -71,7 +73,7 @@ async function cmdSearch(db, args, { llm } = {}) {
 
   const limit = parseIntFlag(flags.limit, { name: '--limit', defaultValue: 20, max: 1000 });
   const type = flags.type || null;
-  const validObsTypes = new Set(['decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change']);
+  const validObsTypes = OBS_TYPE_SET;
   if (type && !validObsTypes.has(type)) {
     fail(`[mem] Invalid --type "${type}". Valid: ${[...validObsTypes].join(', ')}`);
     return;
@@ -368,7 +370,7 @@ function cmdRecent(db, args) {
   // try this for "show recent bugfixes". Mirror cmdSearch's enum validation.
   const type = flags.type || null;
   if (type) {
-    const validObsTypes = new Set(['decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change']);
+    const validObsTypes = OBS_TYPE_SET;
     if (!validObsTypes.has(type)) {
       fail(`[mem] Invalid --type "${type}". Valid: ${[...validObsTypes].join(', ')}`);
       return;
@@ -802,7 +804,7 @@ function cmdSave(db, args) {
   if (rejectBareStringFlags(flags, ['title', 'files', 'lesson', 'lesson-learned', 'project', 'type'])) return;
 
   const type = flags.type || 'discovery';
-  const validTypes = new Set(['decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change']);
+  const validTypes = OBS_TYPE_SET;
   if (!validTypes.has(type)) {
     fail(`[mem] Invalid type "${type}". Valid: ${[...validTypes].join(', ')}`);
     return;
@@ -911,7 +913,7 @@ function cmdSave(db, args) {
   const supersededNote = result.supersededIds && result.supersededIds.length > 0
     ? ` Superseded: ${result.supersededIds.map(i => `#${i}`).join(', ')}.`
     : '';
-  out(`[mem] Saved #${result.id} [${result.type}] "${truncate(result.title, 80)}" (project: ${result.project})${lessonNote}${closedNote}${supersededNote}`);
+  out(`[mem] Saved #${result.id} [${result.type}] "${truncate(result.title, 80)}" (project: ${result.project})${lessonNote}${closedNote}${supersededNote}${buildLessonNudge({ type: result.type, id: result.id, lessonCaptured: result.lessonCaptured, surface: 'cli' })}`);
 }
 
 // ─── cmdDefer (sub-dispatch: add | list | drop) ──────────────────────────────
@@ -1111,98 +1113,12 @@ async function cmdStats(db, args) {
     return;
   }
 
-  const projectFilter = project ? 'AND project = ?' : '';
-  const baseParams = project ? [project] : [];
-
   const now = Date.now();
-  const cutoff = now - days * 86400000;
-
-  // Total counts (aligned with MCP mem_stats: use session_summaries, not sdk_sessions)
-  const obsTotal = db.prepare(
-    `SELECT COUNT(*) as c FROM observations WHERE 1=1 ${projectFilter}`
-  ).get(...baseParams);
-  const sessTotal = db.prepare(
-    `SELECT COUNT(*) as c FROM session_summaries WHERE 1=1 ${projectFilter}`
-  ).get(...baseParams);
-  const promptTotal = project
-    ? db.prepare('SELECT COUNT(*) as c FROM user_prompts p JOIN sdk_sessions s ON p.content_session_id = s.content_session_id WHERE s.project = ?').get(project)
-    : db.prepare('SELECT COUNT(*) as c FROM user_prompts').get();
-
-  // Recent counts
-  const obsRecent = db.prepare(
-    `SELECT COUNT(*) as c FROM observations WHERE created_at_epoch >= ? ${projectFilter}`
-  ).get(cutoff, ...baseParams);
-  const sessRecent = db.prepare(
-    `SELECT COUNT(*) as c FROM session_summaries WHERE created_at_epoch >= ? ${projectFilter}`
-  ).get(cutoff, ...baseParams);
-
-  // Type distribution (recent)
-  const types = db.prepare(`
-    SELECT type, COUNT(*) as c FROM observations
-    WHERE created_at_epoch >= ? ${projectFilter}
-    GROUP BY type ORDER BY c DESC
-  `).all(cutoff, ...baseParams);
-
-  // Top projects (global view — skipped when filtering by single project; aligned with MCP)
-  const projects = project ? [] : db.prepare(`
-    SELECT project, COUNT(*) as c FROM observations
-    GROUP BY project ORDER BY c DESC LIMIT 20
-  `).all();
-
-  // Daily activity (last 7 days; aligned with MCP mem_stats)
-  const daily = db.prepare(`
-    SELECT date(created_at) as day, COUNT(*) as c FROM observations
-    WHERE created_at_epoch >= ? ${projectFilter}
-    GROUP BY day ORDER BY day DESC LIMIT 7
-  `).all(now - 7 * 86400000, ...baseParams);
-
-  // Data health (aligned with MCP mem_stats)
-  const tokenEst = db.prepare(`
-    SELECT SUM(LENGTH(COALESCE(title,'')) + LENGTH(COALESCE(narrative,'')) + LENGTH(COALESCE(text,''))) / 4 as t
-    FROM observations WHERE 1=1 ${projectFilter}
-  `).get(...baseParams);
-  const avgImp = db.prepare(
-    `SELECT AVG(COALESCE(importance,1)) as v FROM observations WHERE 1=1 ${projectFilter}`
-  ).get(...baseParams);
-  const thirtyDaysAgo = now - 30 * 86400000;
-  // v3.23 noise-gauge de-blinding: the prior `importance = 1` predicate was
-  // structurally blind to imp=0 — decay's floor + the LLM low-signal filter push
-  // dormant rows to 0, which on a real store is ~half the live corpus. The gauge
-  // therefore reported "0.0% noise" while the store was dormant-heavy. `<= 1` makes
-  // imp=0 visible; injection_count=0 mirrors decay's NEVER-INJECTED guard so an
-  // injected-but-decayed row (pinned noise, tracked separately) is not miscounted
-  // as "never used".
-  const lowVal = db.prepare(`
-    SELECT COUNT(*) as c FROM observations
-    WHERE COALESCE(importance,1) <= 1 AND COALESCE(access_count,0) = 0
-      AND COALESCE(injection_count,0) = 0
-      AND COALESCE(compressed_into, 0) = 0
-      AND created_at_epoch < ? ${projectFilter}
-  `).get(thirtyDaysAgo, ...baseParams);
-  // Low-signal-title population: template / tool-log titles (Modified, Worked on,
-  // Error while working, Error:, node/npm/npx …) that the retrieval layer already
-  // filters out by default. The imp=1 "Low-value" metric above structurally can't
-  // see these — they often carry inflated importance and recent access — so the
-  // health gauge under-reports real noise without this line. Same LOW_SIGNAL
-  // pattern source as the read-side filter (lib/low-signal-patterns.mjs).
-  const lowSignalTitle = db.prepare(`
-    SELECT COUNT(*) as c FROM observations
-    WHERE NOT ${buildNotLowSignalSql()}
-      AND COALESCE(compressed_into, 0) = 0 ${projectFilter}
-  `).get(...baseParams);
-  // F7: both noise numerators exclude compressed rows → divide by the LIVE count, not
-  // obsTotal (all rows), so a compress-heavy store isn't reported cleaner than it is.
-  // Shared with the MCP mem_stats gauge via computeNoiseGauge (lib/stats-quality.mjs).
-  const liveTotal = db.prepare(
-    `SELECT COUNT(*) as c FROM observations WHERE COALESCE(compressed_into, 0) = 0 ${projectFilter}`
-  ).get(...baseParams);
-  const { noiseRatio, lowSignalRatio } = computeNoiseGauge({ liveTotal: liveTotal.c, lowValCount: lowVal.c, lowSignalCount: lowSignalTitle.c });
-  const compressedCount = db.prepare(
-    `SELECT COUNT(*) as c FROM observations WHERE compressed_into IS NOT NULL ${projectFilter}`
-  ).get(...baseParams);
-  const supersededOnlyCount = db.prepare(
-    `SELECT COUNT(*) as c FROM observations WHERE superseded_at IS NOT NULL AND compressed_into IS NULL ${projectFilter}`
-  ).get(...baseParams);
+  const {
+    obsTotal, sessTotal, promptTotal, obsRecent, sessRecent,
+    types, projects, daily, tokenEst, avgImp, lowVal, lowSignalTitle,
+    noiseRatio, lowSignalRatio, compressedCount, supersededOnlyCount, tierMap,
+  } = computeStatsFeed(db, { project, days, now });
 
   // Hook self-observation: count PreToolUse / Skill-bridge script failures
   // recorded in the last 24h. Surfaces silent breakage (DB corruption,
@@ -1210,17 +1126,6 @@ async function cmdStats(db, args) {
   // failure mode that left code-graph's matcher bug undetected for 10 sessions.
   const hookErrors24h = countRecentHookErrors(join(DB_DIR, 'runtime'), now - 86400000);
 
-  // Tier distribution (aligned with MCP mem_stats)
-  const tierCtx = { now, currentProject: project || inferProject(), currentSessionId: '' };
-  const tdParams = tierSqlParams(tierCtx);
-  const tierDist = db.prepare(`
-    SELECT tier, COUNT(*) as c FROM (
-      SELECT ${TIER_CASE_SQL} as tier FROM observations
-      WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${projectFilter}
-    ) GROUP BY tier ORDER BY tier
-  `).all(...tdParams, ...baseParams);
-  const tierMap = Object.fromEntries(tierDist.map(r => [r.tier, r.c]));
-
   if (jsonOutput) {
     out(JSON.stringify({
       project,
@@ -1508,43 +1413,13 @@ function cmdDelete(db, args) {
     return;
   }
 
-  // Snapshot before the irreversible hard-delete so a wrong-id delete has a pre-image,
-  // matching the maintain purge/cleanup hard-delete paths (audit MED-2). Best-effort
-  // (never throws, skips :memory:); rows here are confirmed + non-empty, so the delete
-  // always removes something worth backing up. Must run OUTSIDE the transaction (VACUUM).
-  snapshotDb(db, { tag: 'pre-delete' });
-
-  // Transaction: clean up related_ids references + delete (aligned with MCP mem_delete)
-  const deletedIds = new Set(ids);
-  const deleteTx = db.transaction(() => {
-    const likeConditions = ids.map(() => `related_ids LIKE ?`).join(' OR ');
-    const likeParams = ids.map(id => `%${id}%`);
-    const referencing = db.prepare(`
-      SELECT id, related_ids FROM observations
-      WHERE related_ids IS NOT NULL AND related_ids != '[]' AND (${likeConditions})
-    `).all(...likeParams);
-    for (const r of referencing) {
-      let refIds;
-      try { refIds = JSON.parse(r.related_ids); } catch { continue; }
-      if (!Array.isArray(refIds)) continue;
-      const filtered = refIds.filter(id => !deletedIds.has(id));
-      if (filtered.length !== refIds.length) {
-        db.prepare('UPDATE observations SET related_ids = ? WHERE id = ?').run(JSON.stringify(filtered), r.id);
-      }
-    }
-    // Resurface any rows merged/compressed INTO the doomed keepers before deleting,
-    // else they dangle behind a missing parent (compressed_into has no FK) — invisible
-    // to every COALESCE(compressed_into,0)=0 view and unrecoverable. Same guard the
-    // maintain hard-delete paths use (recoverChildrenOf); the interactive delete path
-    // was missing it. Returned in the result so the user sees the recovery count.
-    const recovered = recoverChildrenOf(db, ids);
-    const deleted = db.prepare(`DELETE FROM observations WHERE id IN (${placeholders})`).run(...ids);
-    return { changes: deleted.changes, recovered };
-  });
-  const result = deleteTx();
+  // Full delete orchestration (snapshot + related_ids cleanup + child recovery + delete
+  // transaction) lives in lib/delete-core.mjs — single source of truth shared with the MCP
+  // mem_delete path (was inlined here + kept in sync by parity comments, the #1 drift risk).
+  const result = deleteObservations(db, ids);
   const missing = ids.filter(id => !rows.some(r => r.id === id));
-  const recoveredNote = result.recovered > 0 ? ` Recovered ${result.recovered} merged/compressed child observation(s) to live.` : '';
-  out(`[mem] Deleted ${result.changes} observation(s).${recoveredNote}${missing.length > 0 ? ` Note: ID(s) ${missing.join(', ')} not found.` : ''}`);
+  const recoveredNote = result.recoveredChildren > 0 ? ` Recovered ${result.recoveredChildren} merged/compressed child observation(s) to live.` : '';
+  out(`[mem] Deleted ${result.deleted} observation(s).${recoveredNote}${missing.length > 0 ? ` Note: ID(s) ${missing.join(', ')} not found.` : ''}`);
 }
 
 // ─── Update ──────────────────────────────────────────────────────────────────
@@ -1599,7 +1474,7 @@ function cmdUpdate(db, args) {
     updates.push('narrative = ?'); params.push(scrubSecrets(flags.narrative));
   }
   if (flags.type) {
-    const validTypes = new Set(['decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change']);
+    const validTypes = OBS_TYPE_SET;
     if (!validTypes.has(flags.type)) {
       fail(`[mem] Invalid type "${flags.type}". Valid: ${[...validTypes].join(', ')}`);
       return;
@@ -1683,7 +1558,7 @@ function cmdExport(db, args) {
   if (flags.type) {
     // Reject unknown types — silently returning [] for `--type bogus` looked like a
     // legitimate empty filter result, hiding the typo. Mirrors cmdSearch / cmdSave / cmdUpdate.
-    const validObsTypes = new Set(['decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change']);
+    const validObsTypes = OBS_TYPE_SET;
     if (!validObsTypes.has(flags.type)) {
       fail(`[mem] Invalid --type "${flags.type}". Valid: ${[...validObsTypes].join(', ')}`);
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.47.0",
+  "version": "3.49.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -90,6 +90,11 @@
     "lib/rrf.mjs",
     "lib/compress-core.mjs",
     "lib/db-backup.mjs",
+    "lib/delete-core.mjs",
+    "lib/events-injection.mjs",
+    "lib/stats-core.mjs",
+    "lib/obs-types.mjs",
+    "lib/save-nudge.mjs",
     "lib/maintain-core.mjs",
     "lib/dedup-constants.mjs",
     "lib/deferred-work.mjs",

package/registry.mjs

@@ -376,7 +376,7 @@ const UPSERT_SQL = `
     repo_url=CASE WHEN excluded.repo_url != '' THEN excluded.repo_url ELSE repo_url END,
     repo_stars=CASE WHEN excluded.repo_stars > 0 THEN excluded.repo_stars ELSE repo_stars END,
     local_path=CASE WHEN excluded.local_path != '' THEN excluded.local_path ELSE local_path END,
-    file_hash=excluded.file_hash,
+    file_hash=CASE WHEN excluded.file_hash IS NOT NULL AND excluded.file_hash != '' THEN excluded.file_hash ELSE file_hash END,
     invocation_name=CASE WHEN excluded.invocation_name != '' THEN excluded.invocation_name ELSE invocation_name END,
     -- Preserve-on-empty (mirror repo_stars/invocation_name above): a PARTIAL re-upsert --
     -- e.g. "registry import --name X --capability-summary ...", where mem-cli defaults every

package/schema.mjs

@@ -176,7 +176,7 @@ const CORE_SCHEMA = `
     memory_session_id TEXT NOT NULL,
     project TEXT NOT NULL,
     text TEXT,
-    type TEXT NOT NULL CHECK(type IN ('decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change')),
+    type TEXT NOT NULL CHECK(type IN ('decision', 'bugfix', 'feature', 'refactor', 'discovery', 'change')), -- keep in sync with lib/obs-types.mjs OBS_TYPES (locked by tests/obs-types-invariant.test.mjs)
     title TEXT,
     subtitle TEXT,
     facts TEXT,

package/scripts/pre-tool-recall.js

@@ -15,6 +15,7 @@ import { fileIntelFor } from '../lib/file-intel.mjs';
 import { shouldWarnReread, buildRereadWarning, readFileMeta } from '../lib/reread-guard.mjs';
 import { recordMetric } from '../lib/metrics.mjs';
 import { presentIdents } from '../lib/lesson-idents.mjs';
+import { neutralizeContextDelimiters } from '../format-utils.mjs';
 
 // CLAUDE_MEM_DIR matches schema.mjs / main CLI — one env var sandboxes the
 // whole system. CLAUDE_MEM_DB_PATH / CLAUDE_MEM_RUNTIME_DIR remain as
@@ -519,7 +520,14 @@ try {
       // when the model misreads passive lesson context as a closing note.
       lines.push(`[mem] PreToolUse recall — system-injected context, continue your planned action:`);
     }
-    if (fileIntelLine) lines.push(fileIntelLine);
+    // MED-1 (full audit 2026-07-16): defang the injection-block delimiters in
+    // all DB/file-derived text before it enters additionalContext (which CC wraps
+    // in <system-reminder>). Stored text is raw — a lesson/title/summary carrying
+    // a literal </system-reminder> or forged <invoke ...> would break the wrapper
+    // and inject a privileged instruction. Mirrors formatErrorRecallHints, which
+    // already applies the same guard on the parallel error-recall surface. The
+    // `#id [type]` prefix is agent-generated (numeric id + type enum) — no defang.
+    if (fileIntelLine) lines.push(neutralizeContextDelimiters(fileIntelLine));
     if (hasLessons) {
       lines.push(`[mem] Lessons for ${fname}:`);
       for (const r of allRows) {
@@ -527,12 +535,12 @@ try {
           const lesson = r.lesson_learned.length > LESSON_MAX
             ? r.lesson_learned.slice(0, LESSON_MAX - 3) + '...'
             : r.lesson_learned;
-          lines.push(`  #${r.id} [${r.type}] ${lesson}`);
+          lines.push(`  #${r.id} [${r.type}] ${neutralizeContextDelimiters(lesson)}`);
         } else {
           const title = (r.title || '').length > LESSON_MAX
             ? r.title.slice(0, LESSON_MAX - 3) + '...'
             : (r.title || '');
-          lines.push(`  #${r.id} [${r.type}] ${title}`);
+          lines.push(`  #${r.id} [${r.type}] ${neutralizeContextDelimiters(title)}`);
         }
       }
       // v2.98 salience: Edit/Write is the action point — close the block with an
@@ -544,7 +552,7 @@ try {
         const changeText = [toolInput?.old_string, toolInput?.new_string, toolInput?.content]
           .filter(Boolean).join('\n');
         const bridged = await bridgeTopLesson(allRows, changeText);
-        if (bridged) lines.push(`[mem] ⚠ #${bridged.id} → this edit must: ${bridged.check}. Confirm your new code satisfies it.`);
+        if (bridged) lines.push(`[mem] ⚠ #${bridged.id} → this edit must: ${neutralizeContextDelimiters(bridged.check)}. Confirm your new code satisfies it.`);
         else lines.push(`[mem] ⚠ Before this edit: ${ACTIVE_DIRECTIVE}`);
       }
     } else if (!isRead && process.env.CLAUDE_MEM_PRETOOL_NUDGE === '1') {

package/scripts/user-prompt-search.js

@@ -787,8 +787,11 @@ async function main() {
       if (matched) {
         const cooldown = getSkillCooldown();
         if (!cooldown[matched]) {
+          // Registry skill names come from third-party repos (tools/adopt import) — an
+          // untrusted boundary like every other DB-derived string on this surface.
+          const safeName = neutralizeContextDelimiters(matched);
           process.stdout.write(
-            `\n[mem] Skill "${matched}" may apply — invoke via SkillTool or run: claude-mem-lite registry show ${matched}\n`
+            `\n[mem] Skill "${safeName}" may apply — invoke via SkillTool or run: claude-mem-lite registry show ${safeName}\n`
           );
           setSkillCooldown(matched);
         }