claude-mem-lite 3.56.0 → 3.57.0

package/project-utils.mjs

@@ -1,10 +1,29 @@
 // claude-mem-lite shared project resolution
 // Extracted from server.mjs and mem-cli.mjs to eliminate duplication
 
-import { inferProject } from './utils.mjs';
+import { basename, dirname } from 'path';
+
+// Leaf module: imports nothing from utils.mjs. utils.mjs re-exports this module's
+// symbols as a backward-compat barrel, so importing the barrel back from here
+// would close a cycle (v3.56 P2-9). Keep this file dependency-free of the barrel.
 
 const _cache = new Map();
 
+/**
+ * Infer a sanitized project name from CLAUDE_PROJECT_DIR, PWD, or cwd.
+ * Format: "parent--basename" with non-alphanumeric chars replaced by hyphens.
+ * @returns {string} Sanitized project identifier safe for use in filenames
+ */
+export function inferProject() {
+  const p = process.env.CLAUDE_PROJECT_DIR || process.env.PWD || process.cwd();
+  const base = basename(p);
+  const parent = basename(dirname(p));
+  const raw = parent && parent !== '.' && parent !== '/' ? `${parent}--${base}` : base;
+  // Sanitize to prevent path traversal when used in filenames (ep-<project>.json)
+  // Truncate to 100 chars to avoid exceeding filesystem name limits (255 bytes)
+  return raw.replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 100);
+}
+
 /**
  * Resolve short project name to canonical "parent--base" form.
  * Uses DB suffix match with in-process cache.

package/registry.mjs

@@ -133,6 +133,13 @@ const INVOCATIONS_SCHEMA = `
     ON invocations(created_at);
 `;
 
+// Canonical indexed-column list for resources_fts, in FTS5_SCHEMA order (see the BM25
+// weight note above — order is load-bearing). Drift from this list triggers a rebuild.
+const FTS5_COLUMNS = [
+  'trigger_patterns', 'keywords', 'capability_summary', 'intent_tags',
+  'use_cases', 'domain_tags', 'tech_stack', 'name',
+];
+
 const PREINSTALLED_SCHEMA = `
   CREATE TABLE IF NOT EXISTS preinstalled (
     id            INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -152,6 +159,73 @@ const PREINSTALLED_SCHEMA = `
     ON preinstalled(type, name);
 `;
 
+// ─── Schema version ──────────────────────────────────────────────────────────
+
+// Registry DB schema version. Tracked independently of schema.mjs's
+// CURRENT_SCHEMA_VERSION — resource-registry.db is a separate file with its own
+// migration history. v1 = the shape at the time version tracking was introduced; every
+// pre-existing (un-versioned) registry in the wild ADOPTS v1 on first open, keeping its
+// data. Bump when a migration below changes a layout an older binary would mis-handle.
+export const REGISTRY_SCHEMA_VERSION = 1;
+
+/**
+ * Forward-incompatibility guard, mirroring initSchema's in schema.mjs. If a NEWER
+ * claude-mem-lite wrote this registry, this (older) build re-applying its own migrations
+ * over the newer layout corrupts it silently. Throw instead. MUST run before any DDL so
+ * a newer DB is left untouched.
+ * @param {Database} db
+ */
+function assertRegistryNotNewer(db) {
+  let row;
+  try {
+    row = db.prepare('SELECT version FROM schema_version LIMIT 1').get();
+  } catch {
+    return; // table absent = pre-version DB → adopted (stamped) at the end of init
+  }
+  if (row && typeof row.version === 'number' && row.version > REGISTRY_SCHEMA_VERSION) {
+    throw new Error(
+      `Registry DB schema is v${row.version} but this claude-mem-lite binary supports up to v${REGISTRY_SCHEMA_VERSION}. ` +
+      `A newer version wrote this DB; upgrade claude-mem-lite (npm i -g claude-mem-lite@latest) or point CLAUDE_MEM_DIR to a fresh directory.`
+    );
+  }
+}
+
+/**
+ * Column-drift self-heal for resources_fts. Deliberately NOT routed through the exported
+ * ensureFTS in schema.mjs: that helper creates the index without this one's `tokenize=`
+ * clause, and installs `<table>_ai/_ad/_au` triggers that would double-write alongside
+ * the res_fts_* set here. Its drift check also compares column SETS, while resources_fts
+ * is order-sensitive (registry-retriever's bm25(resources_fts, 3,3,3,2,2,1,1,1) weights
+ * by position). Mirrors ensureEventsFTS in schema.mjs, which exists for the same reason.
+ *
+ * Without this, widening FTS5_SCHEMA leaves existing DBs on the NARROW index while
+ * TRIGGERS_SCHEMA is re-exec'd from the wider list on every open — so every
+ * `INSERT INTO resources` throws "no column named X" and the write is silently lost.
+ * @param {Database} db
+ * @returns {boolean} true if the index was recreated (caller must repopulate it)
+ */
+function ensureResourcesFts(db) {
+  const ftsRow = db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='resources_fts'`).get();
+  let recreated = false;
+  if (ftsRow) {
+    let existingCols = [];
+    try { existingCols = db.prepare(`PRAGMA table_info(resources_fts)`).all().map(c => c.name); }
+    catch { /* unreadable → treat as drifted, recreate */ }
+    // Element-wise so additions, removals AND reordering all count as drift.
+    const drifted = existingCols.length !== FTS5_COLUMNS.length
+      || FTS5_COLUMNS.some((c, i) => existingCols[i] !== c);
+    if (drifted) {
+      db.exec(`DROP TRIGGER IF EXISTS res_fts_insert`);
+      db.exec(`DROP TRIGGER IF EXISTS res_fts_update`);
+      db.exec(`DROP TRIGGER IF EXISTS res_fts_delete`);
+      db.exec(`DROP TABLE IF EXISTS resources_fts`);
+      recreated = true;
+    }
+  }
+  if (!ftsRow || recreated) db.exec(FTS5_SCHEMA);
+  return recreated;
+}
+
 // ─── Initialization ──────────────────────────────────────────────────────────
 
 /**
@@ -173,6 +247,10 @@ export function ensureRegistryDb(dbPath) {
   db.pragma('synchronous = NORMAL');
   db.pragma('foreign_keys = ON');
 
+  // Before ANY DDL: refuse a registry written by a newer client (see assertRegistryNotNewer).
+  // Close the handle on the way out so the caller isn't left leaking an open file.
+  try { assertRegistryNotNewer(db); } catch (e) { db.close(); throw e; }
+
   db.exec(RESOURCES_SCHEMA);
 
   // Migrate: add missing columns to resources (single PRAGMA call for all)
@@ -243,20 +321,21 @@ export function ensureRegistryDb(dbPath) {
     }
   } catch (e) { debugCatch(e, 'resources-source-check-migration'); }
 
-  // FTS5: create if not exists
-  const hasFts = db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='resources_fts'`).get();
-  if (!hasFts) {
-    db.exec(FTS5_SCHEMA);
-  }
-  // Triggers: always ensure (IF NOT EXISTS) — fixes DBs where FTS5 was created without triggers
+  // FTS5: create if absent, or drop+recreate if the indexed columns have drifted from
+  // FTS5_COLUMNS (a stale narrow index silently kills every resources write — audit P2-6).
+  const ftsRecreated = ensureResourcesFts(db);
+  // Triggers: always ensure (IF NOT EXISTS) — fixes DBs where FTS5 was created without
+  // triggers, and reinstates the set ensureResourcesFts drops on drift.
   db.exec(TRIGGERS_SCHEMA);
 
   // The source-CHECK migration replaced the `resources` content table out from under
   // the external-content FTS index (content=resources), leaving resources_fts stale.
   // Rebuild it so a later DELETE's res_fts_delete trigger doesn't throw "database disk
   // image is malformed" against the mismatched index. Gated on the migration actually
-  // having run so we don't rebuild on every open.
-  if (resourcesRebuilt) {
+  // having run so we don't rebuild on every open. A drift-recreated index needs the same
+  // repopulation for the opposite reason: it starts EMPTY, so rows written before the
+  // drift would be unreachable through search forever.
+  if (resourcesRebuilt || ftsRecreated) {
     try { db.exec("INSERT INTO resources_fts(resources_fts) VALUES('rebuild')"); }
     catch (e) { debugCatch(e, 'resources-fts-rebuild-after-source-check'); }
   }
@@ -352,6 +431,15 @@ export function ensureRegistryDb(dbPath) {
 
   db.exec(PREINSTALLED_SCHEMA);
 
+  // Stamp the version LAST — only after every table + migration above succeeded. This is
+  // also the ADOPTION path for pre-version DBs: they are stamped in place, never wiped or
+  // refused. Rewritten each open so exactly one row exists and it reflects this build.
+  db.exec('CREATE TABLE IF NOT EXISTS schema_version (version INTEGER NOT NULL)');
+  db.transaction(() => {
+    db.exec('DELETE FROM schema_version');
+    db.prepare('INSERT INTO schema_version (version) VALUES (?)').run(REGISTRY_SCHEMA_VERSION);
+  })();
+
   return db;
 }
 

package/scripts/hook-launcher.mjs

@@ -68,6 +68,38 @@ if (!entryArg) {
 
 const entryAbs = entryArg.startsWith('/') ? entryArg : join(INSTALL_DIR, entryArg);
 
+// Swap barrier. An auto-update / repair renames files into the install dir one at
+// a time — atomic per file, not per file SET — so a hook process that starts
+// mid-swap can resolve its entry from the old version and an import from the new
+// one. hook-update.mjs marks that window; skip the fire instead of importing a
+// mixed module graph. Hooks are best-effort and the swap lasts ~a second, so the
+// next fire runs against a settled install.
+//
+// Stale-guarded on BOTH pid and ts: an updater killed mid-swap leaves the marker
+// behind, and a marker that outlives its writer must never mute hooks permanently.
+// Anything unreadable/torn/expired reads as "no swap" — fail-open, like the rest
+// of this launcher. Inline (not lib/proc-lock.mjs) per the pure-node: charter.
+const SWAP_MARKER = join(RUNTIME_DIR, 'swap-in-progress');
+const SWAP_MAX_MS = 2 * 60 * 1000;
+
+function swapInProgress() {
+  try {
+    const { pid, ts } = JSON.parse(readFileSync(SWAP_MARKER, 'utf8'));
+    if (typeof ts !== 'number' || Date.now() - ts > SWAP_MAX_MS) return false;
+    if (typeof pid !== 'number' || pid <= 0) return false;
+    try {
+      process.kill(pid, 0);   // signal 0 = existence probe
+      return true;
+    } catch (e) {
+      return e.code === 'EPERM';   // alive, owned by another user
+    }
+  } catch {
+    return false;   // no marker / unreadable / torn JSON → not a swap
+  }
+}
+
+if (swapInProgress()) process.exit(0);
+
 async function runEntry({ bustCache = false } = {}) {
   // Mirror direct invocation: process.argv[1] is the entry, [2..] are its args.
   process.argv = [process.argv[0], entryAbs, ...rest];

package/scripts/post-tool-use.sh

@@ -7,6 +7,34 @@
 # Prevent recursive hooks
 [[ -n "$CLAUDE_MEM_HOOK_RUNNING" ]] && exit 0
 
+# Claude Code plugin-disable guard (audit P3-4).
+# install.mjs writes DIRECT hook entries into ~/.claude/settings.json, so disabling the
+# plugin in the Claude UI leaves them firing. hook.mjs exits 0 for that case, but the
+# Read fast-path below never reaches Node: it kept appending to reads-<project>.txt on
+# EVERY Read, while the 24h sweep that reaps those files (sweepOrphanEpisodeFiles, via
+# runSessionStartAutoMaintain) sits behind that same Node-side exit — unbounded growth
+# in runtime/ for a plugin the user believes is off.
+# MUST agree with hook.mjs isPluginExplicitlyDisabled(): same $HOME/.claude/settings.json
+# (NOT CLAUDE_CONFIG_DIR — hook.mjs resolves it via homedir()), same plugin key, and the
+# same fail-open-on-unreadable semantics (its try/catch returns false). Parity pinned by
+# tests/post-tool-use-disabled.test.mjs.
+# Cheap by construction: no `node`, no external command on this ~5ms per-tool-call path.
+# `-r` covers missing/unreadable in one builtin test, and `$(<file)` slurps the whole file
+# for ONE regex — measured +0.4ms/call vs +4.0ms for a `while read` loop over the same
+# 239-line settings.json (bash pays a syscall + a regex per line there).
+# The ERE (not a `==` glob) is what keeps a MINIFIED single-line settings.json from
+# matching `"<key>": true, … "other": false` as a false positive: the pattern is anchored
+# to the key, so only that key's own value can satisfy it.
+# Deliberately NOT applied to the Node handoff at the tail: hook.mjs already self-guards
+# there, so a bash false positive could only lose data, never save work.
+_mem_settings_file="${HOME}/.claude/settings.json"
+_mem_plugin_disabled() {
+  [[ -r "$_mem_settings_file" ]] || return 1
+  local _settings
+  _settings=$(<"$_mem_settings_file")
+  [[ "$_settings" =~ \"claude-mem-lite@sdsrss\"[[:space:]]*:[[:space:]]*false ]]
+}
+
 # Read stdin (tool hook JSON)
 input=$(head -c 262144)
 
@@ -19,6 +47,10 @@ fi
 
 # Read tool: track file path for episode context, then exit (no Node needed)
 if [[ "$tool" == "Read" ]]; then
+  # Disabled plugin → write nothing; nothing would ever sweep the file (see guard above).
+  # 2>/dev/null: a settings.json unlinked between the -r test and the read must stay
+  # silent — Claude Code surfaces hook stderr.
+  _mem_plugin_disabled 2>/dev/null && exit 0
   if [[ "$input" =~ \"file_path\"[[:space:]]*:[[:space:]]*\"([^\"]+)\" ]]; then
     file_path="${BASH_REMATCH[1]}"
     _dir="${CLAUDE_PROJECT_DIR:-$PWD}"
@@ -46,6 +78,13 @@ if [[ "$tool" == "Read" ]]; then
     # bash fast-path wrote to $HOME unconditionally, a relocated install would drop all
     # Read context from episodes AND grow an uncollected reads file in $HOME forever.
     runtime_dir="${CLAUDE_MEM_DIR:-$HOME/.claude-mem-lite}/runtime"
+    # Owner-only (0700 dir / 0600 file): reads-<project>.txt lists captured file
+    # paths, so on a shared host the default umask leaked them to every local user.
+    # umask is a shell builtin — no extra process on this ~5ms per-tool-call path
+    # (a chmod would be a spawn). It only applies at creation; server.mjs
+    # hardenRuntimeFiles() remediates files that predate this fix. Scoped safely:
+    # this branch always exits before the node handoff below.
+    umask 077
     mkdir -p "$runtime_dir" 2>/dev/null
     # Use printf to avoid shell interpretation of special characters in file paths
     printf '%s\n' "$file_path" >> "${runtime_dir}/reads-${project}.txt"

package/search-engine.mjs

@@ -478,12 +478,14 @@ export function searchObservationsHybrid(db, ctx) {
           if (args.importance && (obs.importance ?? 1) < args.importance) continue;
           if (args.branch && obs.branch !== args.branch) continue;
           if (!includeNoise && obs.title && LOW_SIGNAL_TITLE.test(obs.title)) continue;
-          resultMap.set(vr.id, { source: 'obs', id: obs.id, type: obs.type, title: obs.title, subtitle: obs.subtitle, project: obs.project, date: obs.created_at, importance: obs.importance, files_modified: obs.files_modified, lesson_learned: obs.lesson_learned, snippet: '' });
+          resultMap.set(vr.id, { source: 'obs', id: obs.id, type: obs.type, title: obs.title, subtitle: obs.subtitle, project: obs.project, date: obs.created_at, created_at: obs.created_at, created_at_epoch: obs.created_at_epoch, importance: obs.importance, files_modified: obs.files_modified, lesson_learned: obs.lesson_learned, snippet: '' });
         }
       }
+      // The WHOLE obs leg is now on the RRF scale (score = -rrfScore ≈ 1/(60+rank)), not
+      // BM25 — tag every row so cross-source lone-hit banding treats it correctly (P2-12).
       const reordered = rrfRanking
         .filter(rr => resultMap.has(rr.id))
-        .map(rr => ({ ...resultMap.get(rr.id), score: -rr.rrfScore }));
+        .map(rr => ({ ...resultMap.get(rr.id), score: -rr.rrfScore, scoreScale: 'vector' }));
       results.length = 0;
       results.push(...reordered);
     } else {
@@ -496,7 +498,8 @@ export function searchObservationsHybrid(db, ctx) {
         if (args.importance && (obs.importance ?? 1) < args.importance) continue;
         if (args.branch && obs.branch !== args.branch) continue;
         if (!includeNoise && obs.title && LOW_SIGNAL_TITLE.test(obs.title)) continue;
-        results.push({ source: 'obs', id: obs.id, type: obs.type, title: obs.title, subtitle: obs.subtitle, project: obs.project, date: obs.created_at, importance: obs.importance, files_modified: obs.files_modified, lesson_learned: obs.lesson_learned, score: -vr.similarity, snippet: '' });
+        // Raw cosine similarity scale (≈0.1-1), also not BM25-comparable → tag it (P2-12).
+        results.push({ source: 'obs', id: obs.id, type: obs.type, title: obs.title, subtitle: obs.subtitle, project: obs.project, date: obs.created_at, created_at: obs.created_at, created_at_epoch: obs.created_at_epoch, importance: obs.importance, files_modified: obs.files_modified, lesson_learned: obs.lesson_learned, score: -vr.similarity, snippet: '', scoreScale: 'vector' });
       }
     }
   } catch (e) { debugCatch(e, 'searchObservationsHybrid-vector'); }

package/search-scoring.mjs

@@ -149,36 +149,57 @@ export const PRF_STOP_WORDS = new Set([
  * @returns {string[]} Array of discriminative terms for query expansion
  */
 export function extractPRFTerms(results, ftsQuery, limit = 3) {
-  // Extract query tokens for exclusion (stemmed to match FTS5 porter tokenizer)
+  // Query tokens to exclude from expansion — stemmed so morphological variants of a
+  // query term (e.g. "authenticate" when the user searched "authentication") are also
+  // excluded, not just the exact surface form.
   const queryTokens = new Set(
     ftsQuery.replace(/["()]/g, ' ').split(/\s+/)
       .map(t => porterStem(t.toLowerCase()))
       .filter(t => t.length > 1 && t !== 'or' && t !== 'and')
   );
 
-  // Count term frequencies across top results' full text (stemmed)
-  const termFreq = {};
+  // Bucket morphological variants by porter STEM so "cache"/"caching"/"cached" jointly
+  // clear the ">= 2 docs" discriminativeness bar. But the SELECTED term must be a SURFACE
+  // form: the emitted terms are fed back into `observations_fts MATCH` (search-engine.mjs),
+  // and that index uses FTS5's DEFAULT unicode61 tokenizer — NO stemming (verified: MATCH
+  // "cach" returns zero rows, only "caching"/"cache" match). Emitting a bare stem would
+  // silently match nothing and kill expansion recall. Track each stem's surface forms with
+  // their occurrence counts and emit the most frequent (best-matchable) surface.
+  const stemDocCount = {};      // stem -> # of top docs it appears in (the >=2 bar)
+  const stemSurfaces = {};      // stem -> Map(surface -> total occurrences)
   const docCount = Math.min(results.length, 8);
   for (let i = 0; i < docCount; i++) {
     const r = results[i];
     const text = ((r.title || '') + ' ' + (r.narrative || '')).toLowerCase();
-    const tokens = text.replace(/[^a-z0-9_-]/g, ' ').split(/\s+/)
-      .map(t => porterStem(t))
-      .filter(t => t.length >= 3 && !PRF_STOP_WORDS.has(t) && !queryTokens.has(t));
-    const seen = new Set();
-    for (const t of tokens) {
-      if (seen.has(t)) continue;
-      seen.add(t);
-      termFreq[t] = (termFreq[t] || 0) + 1;
+    const surfaces = text.replace(/[^a-z0-9_-]/g, ' ').split(/\s+/).filter(t => t.length >= 3);
+    const docStems = new Set();
+    for (const surface of surfaces) {
+      // Stop-word filter at BOTH surface and stem level: PRF_STOP_WORDS lists surface
+      // inflections ("changed"/"updated"/"files") whose porter stem ("chang"/"updat") is
+      // not itself listed, so a stem-only check would let the surface through to emission.
+      if (PRF_STOP_WORDS.has(surface)) continue;
+      const stem = porterStem(surface);
+      if (stem.length < 3 || PRF_STOP_WORDS.has(stem) || queryTokens.has(stem)) continue;
+      const sm = (stemSurfaces[stem] ||= new Map());
+      sm.set(surface, (sm.get(surface) || 0) + 1);
+      docStems.add(stem);
     }
+    for (const stem of docStems) stemDocCount[stem] = (stemDocCount[stem] || 0) + 1;
   }
 
-  // Select terms appearing in >= 2 top docs (discriminative, not noise)
-  return Object.entries(termFreq)
+  // Select stems appearing in >= 2 top docs (discriminative, not noise), emitting the
+  // most frequent surface form of each so the term actually matches the unstemmed index.
+  return Object.entries(stemDocCount)
     .filter(([, count]) => count >= 2)
     .sort((a, b) => b[1] - a[1])
     .slice(0, limit)
-    .map(([term]) => term);
+    .map(([stem]) => {
+      let best = null, bestN = -1;
+      for (const [surface, n] of stemSurfaces[stem]) {
+        if (n > bestN) { best = surface; bestN = n; }
+      }
+      return best;
+    });
 }
 
 // ─── Concept Co-occurrence Query Expansion ─────────────────────────────────

package/server.mjs

@@ -48,6 +48,7 @@ import { saveObservation } from './lib/save-observation.mjs';
 import { rebuildObservationDerived } from './lib/observation-write.mjs';
 import { EXPORT_COLUMNS_SQL } from './lib/export-columns.mjs';
 import { recallByFile } from './lib/recall-core.mjs';
+import { fetchRecent } from './lib/recent-core.mjs';
 import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
   insertDeferred, listOpenWithOrdinal, dropDeferred,
@@ -65,7 +66,7 @@ const { version: PKG_VERSION } = require('./package.json');
 
 // ─── Database ───────────────────────────────────────────────────────────────
 
-import { rmSync, existsSync, readFileSync, appendFileSync, mkdirSync } from 'fs';
+import { rmSync, existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync, readdirSync, chmodSync } from 'fs';
 
 let db;
 try {
@@ -404,27 +405,19 @@ async function runRecent(db, args) {
   const limit = args.limit ?? 10;
   const project = args.project || inferProject();
 
-  const params = [];
-  const wheres = ['COALESCE(compressed_into, 0) = 0', 'superseded_at IS NULL'];
-  if (project) { wheres.push('project = ?'); params.push(project); }
-  // obs_type: observation-type filter (CLI `recent --type` parity). The zod enum
-  // already rejected an invalid value before the handler ran.
-  if (args.obs_type) { wheres.push('type = ?'); params.push(args.obs_type); }
   // date_since: relative lower bound on created_at (CLI `recent --since` parity).
+  // Parsed here rather than in the core because the surfaces reject a bad duration
+  // in their own dialect — MCP throws, CLI fail()s.
+  let since = null;
   if (args.date_since !== undefined) {
     const d = parseDuration(args.date_since);
     if (!d.ok) throw new Error(`Invalid date_since: "${args.date_since}" (use <N><unit>, e.g. 7d, 24h, 90m, 2w)`);
-    wheres.push('created_at_epoch >= ?'); params.push(Date.now() - d.ms);
+    since = Date.now() - d.ms;
   }
-  params.push(limit);
 
-  const rows = db.prepare(`
-    SELECT id, type, title, subtitle, project, created_at, created_at_epoch
-    FROM observations
-    WHERE ${wheres.join(' AND ')}
-    ORDER BY created_at_epoch DESC
-    LIMIT ?
-  `).all(...params);
+  // Shared core with CLI `recent`: live-rows filter + ordering (lib/recent-core.mjs).
+  // obs_type is already enum-validated by zod before the handler runs.
+  const rows = fetchRecent(db, { project, type: args.obs_type || null, since, limit });
 
   if (rows.length === 0) {
     return { content: [{ type: 'text', text: `No recent observations${project ? ` (${project})` : ''}.` }] };
@@ -745,6 +738,34 @@ server.registerTool(
 
 // ─── Tool: mem_save ─────────────────────────────────────────────────────────
 
+// Sanity ceilings on the free-text fields that reach unbounded TEXT columns. zod
+// validates TYPES; before this, `title` had no size bound at all
+// (`z.string().optional()`), so one runaway summarizer write stored a multi-KB title
+// verbatim and every later FTS rebuild, minhash and vector recompute paid for that row
+// forever. Truncate rather than reject: rejection would be a breaking contract change
+// on a published MCP tool, and a caller that over-writes still wants its memory saved.
+//
+// Numbers: `title` at 500 is ~5× the longest form any read path renders (titles are
+// truncate()'d to 80–100 chars on display) and 5× saveObservation's own
+// content.slice(0, 100) fallback — generous headroom, still a bound. `content` (50000)
+// and `lesson_learned` (500) mirror the zod maxima already published in
+// tool-schemas.mjs, so the advertised contract is not narrowed; applying them here
+// converts a hard zod REJECT into graceful truncation for any caller that reaches this
+// path without schema validation.
+export const SAVE_TEXT_LIMITS = { content: 50000, title: 500, lesson_learned: 500 };
+
+/**
+ * Cap one free-text field at `limit`, marking the loss in-band so the truncation is
+ * visible in the stored row (a silently shortened memory is worse than a marked one).
+ * The marker names the ORIGINAL length, and the result never exceeds `limit`.
+ * Non-strings (absent optional fields) pass through untouched.
+ */
+export function clampSaveText(value, limit) {
+  if (typeof value !== 'string' || value.length <= limit) return value;
+  const marker = ` … [truncated from ${value.length} chars]`;
+  return value.slice(0, Math.max(0, limit - marker.length)) + marker;
+}
+
 server.registerTool(
   'mem_save',
   {
@@ -760,13 +781,15 @@ server.registerTool(
     try {
       result = db.transaction(() => {
         const r = saveObservation(db, {
-          content: args.content,
-          title: args.title,
+          // Size ceiling applied here rather than in lib/save-observation.mjs so the
+          // shared pipeline keeps its "caller validates" contract (see its header).
+          content: clampSaveText(args.content, SAVE_TEXT_LIMITS.content),
+          title: clampSaveText(args.title, SAVE_TEXT_LIMITS.title),
           type: args.type || 'discovery',
           importance: args.importance,
           project,
           files: args.files || [],
-          lesson_learned: args.lesson_learned,
+          lesson_learned: clampSaveText(args.lesson_learned, SAVE_TEXT_LIMITS.lesson_learned),
           supersedes: args.supersedes,
         });
         if (r.kind === 'duplicate') return r; // dedup short-circuits BEFORE resolver — replay is idempotent
@@ -1890,6 +1913,69 @@ process.on('SIGTERM', () => shutdown(0));
 process.on('uncaughtException', (err) => { debugCatch(err, 'uncaughtException'); shutdown(1); });
 process.on('unhandledRejection', (err) => { debugCatch(err, 'unhandledRejection'); shutdown(1); });
 
+// ─── Runtime Dir Retention + Permissions ────────────────────────────────────
+
+/** Spawn-log retention window — same 14 days as every sibling JSONL sink. */
+export const SPAWN_LOG_RETENTION_MS = 14 * 24 * 60 * 60 * 1000;
+/** Hard ceiling for pathological spawn churn inside the retention window. */
+export const SPAWN_LOG_MAX_LINES = 2000;
+
+/**
+ * Trim mcp-spawns.log to the retention window. The sibling sinks (lib/metrics,
+ * lib/err-sampler, lib/hook-telemetry) shard per day and unlink old shards; this
+ * sink is one flat file at a documented path, so the same 14-day window is applied
+ * line-wise instead. Records without a parseable `ts` are dropped — the log is
+ * append-only JSONL, so a malformed line is truncated telemetry, not data.
+ * Only rewrites when something actually expires. Never throws.
+ *
+ * @param {string} path   Absolute path to mcp-spawns.log
+ * @param {number} [nowMs]
+ * @returns {number} lines removed
+ */
+export function pruneSpawnLog(path, nowMs = Date.now()) {
+  try {
+    if (!existsSync(path)) return 0;
+    const lines = readFileSync(path, 'utf8').split('\n').filter(Boolean);
+    // ISO-8601 sorts lexically = chronologically, so no Date.parse per line
+    // (same trick as hook-telemetry.countRecentHookErrors).
+    const cutoffIso = new Date(nowMs - SPAWN_LOG_RETENTION_MS).toISOString();
+    let kept = lines.filter((l) => {
+      try {
+        const { ts } = JSON.parse(l);
+        return typeof ts === 'string' && ts >= cutoffIso;
+      } catch { return false; }
+    });
+    if (kept.length > SPAWN_LOG_MAX_LINES) kept = kept.slice(-SPAWN_LOG_MAX_LINES);
+    if (kept.length === lines.length) return 0;
+    writeFileSync(path, kept.length ? kept.join('\n') + '\n' : '', { mode: 0o600 });
+    return lines.length - kept.length;
+  } catch { return 0; }
+}
+
+/**
+ * Restrict the runtime dir and its files to owner-only. Directory 0700 is the
+ * load-bearing part (without +x another local user cannot traverse in); the
+ * per-file 0600 is defense in depth and remediates files created before this fix.
+ * Subdirectories are skipped — they are created with `{mode: 0o700}` by their own
+ * sinks. Symlinks are skipped (Dirent.isFile() is false) so this never chmods
+ * through to a target outside the runtime dir. Idempotent, never throws.
+ *
+ * @param {string} dir  Absolute path to RUNTIME_DIR
+ * @returns {number} files chmod'ed
+ */
+export function hardenRuntimeFiles(dir) {
+  try {
+    if (!existsSync(dir)) return 0;
+    chmodSync(dir, 0o700);
+    let touched = 0;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      try { chmodSync(join(dir, entry.name), 0o600); touched++; } catch { /* per-entry, silent */ }
+    }
+    return touched;
+  } catch { return 0; }
+}
+
 // ─── Start Server ───────────────────────────────────────────────────────────
 
 // Spawn telemetry — appends one JSON line per process start so we can diagnose
@@ -1898,14 +1984,13 @@ process.on('unhandledRejection', (err) => { debugCatch(err, 'unhandledRejection'
 // the same ppid is the smoking gun. Never throws — telemetry must not block
 // startup. Disable with MEM_DISABLE_SPAWN_LOG=1.
 //
-// File mode: no explicit chmod. Payload is `{ts, pid, ppid, argv1, version}` —
-// no secrets, no project content. Pre-v2.79.1 passed `{mode: 0o600}` to
-// appendFileSync but that only applies on file creation (umask-default after
-// the first append), so the "0600" claim was misleading honesty-wise. Honest
-// comment > misleading code.
+// File mode: `{mode: 0o600}` on appendFileSync only applies on file creation
+// (umask-default after the first append) — pre-v2.79.1 relied on it alone, so
+// the "0600" claim was misleading. hardenRuntimeFiles below sets the mode for
+// real, on every start, including logs created before this fix.
 if (process.env.MEM_DISABLE_SPAWN_LOG !== '1') {
   try {
-    if (!existsSync(RUNTIME_DIR)) mkdirSync(RUNTIME_DIR, { recursive: true });
+    if (!existsSync(RUNTIME_DIR)) mkdirSync(RUNTIME_DIR, { recursive: true, mode: 0o700 });
     const line = JSON.stringify({
       ts: new Date().toISOString(),
       pid: process.pid,
@@ -1913,9 +1998,20 @@ if (process.env.MEM_DISABLE_SPAWN_LOG !== '1') {
       argv1: process.argv[1] || '',
       version: PKG_VERSION,
     }) + '\n';
-    appendFileSync(join(RUNTIME_DIR, 'mcp-spawns.log'), line);
+    const spawnLog = join(RUNTIME_DIR, 'mcp-spawns.log');
+    appendFileSync(spawnLog, line, { mode: 0o600 });
+    // Lazy GC on append, mirroring lib/hook-telemetry.pruneOldShards. Single-file
+    // sink (not day-sharded) so retention is applied line-wise instead.
+    pruneSpawnLog(spawnLog);
   } catch { /* never block startup on telemetry failure */ }
 }
 
+// Owner-only for the whole runtime dir. Sibling aux files carry captured file
+// paths (reads-<project>.txt) and scrubbed activity (ep-<project>.json), but were
+// written at the default umask (0644) while the DB itself is 0600 / DB_DIR 0700
+// (schema.mjs). The hooks that create them set the mode at creation; this sweep
+// is what remediates files already on disk from before the fix.
+hardenRuntimeFiles(RUNTIME_DIR);
+
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/source-files.mjs

@@ -136,6 +136,10 @@ export const SOURCE_FILES = [
   // `timeline`/`search` and mem_timeline/mem_search on auto-update.
   'lib/timeline-core.mjs',
   'lib/search-core.mjs',
+  // Shared `recent` core (live-row filter + ORDER BY created_at DESC LIMIT).
+  // Statically imported by mem-cli.mjs AND server.mjs — same single-source pattern;
+  // missing it from the manifest would break `recent` and mem_recent on auto-update.
+  'lib/recent-core.mjs',
   // Reciprocal Rank Fusion core (D#42 single source-of-truth); transitively
   // reached via tfidf.mjs (rrfMerge) and deep-search.mjs (rrfFuseN).
   'lib/rrf.mjs',