claude-mem-lite 3.60.0 → 3.60.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.60.0",
+      "version": "3.60.1",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.0",
+  "version": "3.60.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/install.mjs

@@ -40,7 +40,7 @@ const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 import { RESOURCE_METADATA } from './install-metadata.mjs';
 import { scanPluginCacheHookPollution } from './plugin-cache-guard.mjs';
 import { SOURCE_FILES, HOOK_SCRIPT_FILES } from './source-files.mjs';
-import { probeBetterSqlite3Binding, ensureBetterSqlite3Working, NATIVE_BINDING_REBUILD_CMD } from './lib/binding-probe.mjs';
+import { probeBetterSqlite3Binding, probeBindingInFreshProcess, ensureBetterSqlite3Working, NATIVE_BINDING_REBUILD_CMD } from './lib/binding-probe.mjs';
 import { clearNativeBindingBreakage, readNativeBindingBreakage } from './lib/native-binding-hint.mjs';
 import { sweepStaleTestFixtures } from './lib/tmp-fixture-sweep.mjs';
 import { acquireLock } from './lib/proc-lock.mjs';
@@ -1396,14 +1396,17 @@ async function doctor() {
     issues++;
   }
 
-  // Dependencies
-  try {
-    const Database = (await import('better-sqlite3')).default;
-    const probe = new Database(':memory:');
-    probe.close();
+  // Dependencies. Out of process: an in-process open of a STALE .node caches a
+  // dead module handle for the rest of doctor and can SIGSEGV on teardown —
+  // truncating the report of the very run the user started because things are
+  // broken. This is also what makes the native-binding check further down
+  // (which reads the same tree) honest rather than answering from a poisoned
+  // process.
+  const depProbe = probeBindingInFreshProcess(bindingHostDir());
+  if (depProbe.ok) {
     ok('better-sqlite3: verified (import + open OK)');
-  } catch (e) {
-    fail(`better-sqlite3: import/init failed (${e.message})`);
+  } else {
+    fail(`better-sqlite3: import/init failed (${String(depProbe.error).split('\n')[0]})`);
     issues++;
   }
 
@@ -1454,7 +1457,9 @@ async function doctor() {
   // right now". A Node upgrade breaks every DB-touching path at once, so this is
   // the single highest-value line in doctor when it fires.
   const breakage = readNativeBindingBreakage(join(MEM_DATA_DIR, 'runtime'));
-  const bindingProbe = await probeBetterSqlite3Binding(bindingHostDir());
+  // Reuses the dependency probe above — same tree, same question, and doctor
+  // should not pay for two child spawns to ask it twice.
+  const bindingProbe = depProbe;
   if (!bindingProbe.ok) {
     fail(`Native DB binding: unusable (${String(bindingProbe.error).split('\n')[0]}) — run \`node ${join(PROJECT_DIR, 'cli.mjs')} rebuild-binding\``);
     issues++;

package/lib/binding-probe.mjs

@@ -70,20 +70,90 @@ export async function probeBetterSqlite3Binding(installDir) {
   }
 }
 
+/**
+ * Probe the binding from a FRESH child process.
+ *
+ * Why this exists: better-sqlite3 dlopen's its .node lazily and Node caches the
+ * module handle process-wide, so a process that has already touched a STALE
+ * binary can never load its replacement — the retry dies with "Module did not
+ * self-register" (and, under scripts/setup.sh's probe, a segfault on the way
+ * out). Verifying a freshly rebuilt binding therefore has to happen somewhere
+ * that never saw the old one. Same constraint healAndReexec re-execs for.
+ *
+ * Synchronous (spawnSync) to match the surrounding execSync rebuild — this runs
+ * in installers and hook-adjacent scripts, never on a request path.
+ *
+ * @param {string} installDir Directory containing node_modules/better-sqlite3
+ * @param {{timeoutMs?: number}} [opts]
+ * @returns {{ok: true} | {ok: false, error: string}}
+ */
+export function probeBindingInFreshProcess(installDir, { timeoutMs = 30_000 } = {}) {
+  // The child catches and prints the MESSAGE on its own stdout. Two reasons it
+  // is not just an uncaught throw read off stderr: an uncaught exception's first
+  // stderr line is the stack HEADER (`node:internal/modules/cjs/loader:1520`),
+  // not the diagnostic — and this string is the highest-value line `doctor`
+  // prints — and any node warning emitted before the throw would land on stderr
+  // first and hijack it. The child's stdout is captured by spawnSync and never
+  // inherited, so writing there cannot reach a hook's JSON envelope.
+  // installDir is interpolated as a JSON string literal, so a path containing
+  // quotes/backslashes cannot break out of the script.
+  const script =
+    'try {'
+    + 'const { createRequire } = require("node:module");'
+    + `const D = createRequire(${JSON.stringify(join(installDir, 'package.json'))})("better-sqlite3");`
+    + 'new D(":memory:").close();'
+    + '} catch (e) { process.stdout.write(String((e && e.message) || e)); process.exit(1); }';
+  const r = spawnSync(process.execPath, ['-e', script], { stdio: 'pipe', timeout: timeoutMs });
+  // BEFORE the status check: spawnSync's `timeout` is SIGTERM-then-wait, not a
+  // deadline, so a child that survives the signal can still exit 0 while
+  // r.error is ETIMEDOUT. Reading status alone would call that healthy.
+  if (r.error) return { ok: false, error: r.error.message };
+  if (r.status === 0) return { ok: true };
+  // Fallbacks cover the paths where the catch never ran: a native crash (the
+  // SIGSEGV above) or a failure to spawn at all — both leave stdout empty.
+  const printed = String(r.stdout || '').trim();
+  const stderrLine = String(r.stderr || '').split('\n').map((l) => l.trim()).find(Boolean);
+  return {
+    ok: false,
+    error: printed
+      || stderrLine
+      || `binding probe exited ${r.status ?? `on signal ${r.signal}`}`,
+  };
+}
+
 /**
  * Verify better-sqlite3 binding works in `installDir`; if not, run
  * `npm rebuild better-sqlite3` and re-probe. Returns
  * { ok: true, action: 'verified' | 'rebuilt' } on success or
- * { ok: false, error } if rebuild can't fix it. The `probe` and `rebuild`
- * deps are injectable so this can be unit-tested without a real npm
+ * { ok: false, error } if rebuild can't fix it. The `probe`, `verify` and
+ * `rebuild` deps are injectable so this can be unit-tested without a real npm
  * subprocess.
  *
  * @param {string} installDir Directory containing node_modules/better-sqlite3
- * @param {{probe?: () => Promise<{ok: boolean, error?: string}>, rebuild?: () => Promise<void>, exec?: (cmd: string, opts: object) => void}} [deps]
+ * @param {{probe?: () => Promise<{ok: boolean, error?: string}>, verify?: () => Promise<{ok: boolean, error?: string}> | {ok: boolean, error?: string}, rebuild?: () => Promise<void>, exec?: (cmd: string, opts: object) => void}} [deps]
  * @returns {Promise<{ok: true, action: 'verified' | 'rebuilt'} | {ok: false, error: string}>}
  */
 export async function ensureBetterSqlite3Working(installDir, deps = {}) {
-  const probe = deps.probe || (() => probeBetterSqlite3Binding(installDir));
+  // BOTH probes run out of process by default, because a probe must never
+  // poison the process that has to act on its answer. Loading a stale .node
+  // caches a dead module handle process-wide (and can SIGSEGV on teardown), so
+  // an in-process probe→rebuild→re-probe cycle always ends in "Module did not
+  // self-register" — reporting a SUCCESSFUL rebuild as a failure. Measured
+  // 2026-08-13 on a real ABI 127-under-137 tree: this function returned
+  // {ok:false} while the rebuilt .node loaded fine in a fresh process. Every
+  // caller keyed state on that lie — setup.sh wrote .deps-broken over a healthy
+  // install, install.mjs::rebuildBinding skipped clearNativeBindingBreakage so
+  // the launcher re-spawned npm every 6h forever, and `rebuild-binding` exited 1.
+  //
+  // Isolating only the SECOND probe is not enough: scripts/launch.mjs imports
+  // the MCP server into this very process right after a successful rebuild, so a
+  // first probe that dlopened the stale binary would hand the server the dead
+  // handle. Cost is one ~40ms spawn on a path that already runs npm.
+  //
+  // `deps.probe` alone still drives BOTH probes: injected-stub tests keep their
+  // existing semantics.
+  const probe = deps.probe || (() => probeBindingInFreshProcess(installDir));
+  const verify = deps.verify || deps.probe || (() => probeBindingInFreshProcess(installDir));
   // Bounded by default: a node-gyp fallback that stalls (no compiler, a hung
   // registry fetch) must not hang the caller forever — the CLI blocks a user at
   // the terminal, and scripts/setup.sh passes an even tighter 20s cap because it
@@ -117,7 +187,7 @@ export async function ensureBetterSqlite3Working(installDir, deps = {}) {
     return { ok: false, error: `rebuild failed: ${e.message}` };
   }
 
-  const second = await probe();
+  const second = await verify();
   if (second.ok) return { ok: true, action: 'rebuilt' };
 
   return { ok: false, error: second.error || first.error };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.0",
+  "version": "3.60.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.60.0",
+      "version": "3.60.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.0",
+  "version": "3.60.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -158,6 +158,7 @@
     "scripts/pre-agent-inject.js",
     "scripts/prompt-search-utils.mjs",
     "scripts/hook-launcher.mjs",
+    "scripts/binding-probe-cli.mjs",
     ".mcp.json",
     ".claude-plugin/plugin.json",
     ".claude-plugin/marketplace.json",

package/scripts/binding-probe-cli.mjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+// scripts/binding-probe-cli.mjs — SessionStart native-binding probe + bounded heal.
+//
+// Contract with scripts/setup.sh: exit 0 = binding usable NOW, non-zero = not.
+// Everything human-readable goes to stderr — SessionStart stdout is a JSON
+// envelope Claude Code parses, so this must never write there.
+//
+// Extracted (v3.60.1) from an inline `node --input-type=module -e '…'` string
+// inside setup.sh. Two load-bearing reasons, both observed rather than assumed:
+//   • That form CRASHED. The -e process SIGSEGV'd during exit after a
+//     verified-good rebuild (Node v24.18, ~50% of runs, no fatal-error report
+//     produced), so a SUCCESSFUL heal exited 139 and setup.sh wrote
+//     .deps-broken over a healthy install. install.mjs::rebuildBinding doing
+//     the same work as a normal module never reproduced it.
+//   • It could not contain an apostrophe. The script was interpolated into a
+//     single-quoted bash string, so a single `don't` in a comment truncated the
+//     shell command — a footgun that fired during development of this fix.
+//
+// Rebuilds are bounded to 20s because setup.sh runs under the SessionStart hook
+// cap (hooks/hooks.json timeout 30): letting the hook SIGKILL a mid-flight
+// node-gyp would leave a partial .node with no flag written. On lock-miss or
+// timeout, mark broken and defer to the MCP launch path (no cap, same lock).
+
+import { execSync, spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ROOT = process.env.PROBE_ROOT || join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// Fallback for a half-installed tree where lib/ helpers are absent: a bare
+// probe with no rebuild. A WORKING binding must still be able to clear the
+// broken flag, and a helperless broken tree is repaired by the hook-launcher
+// path instead. Out of process like every other probe here — loading a stale
+// .node caches a dead module handle for the rest of THIS process.
+function bareProbe(root) {
+  const script =
+    'try {'
+    + 'const { createRequire } = require("node:module");'
+    + `const D = createRequire(${JSON.stringify(join(root, 'package.json'))})("better-sqlite3");`
+    + 'new D(":memory:").close();'
+    + '} catch (e) { process.stdout.write(String((e && e.message) || e)); process.exit(1); }';
+  const r = spawnSync(process.execPath, ['-e', script], { stdio: 'pipe', timeout: 8000 });
+  if (!r.error && r.status === 0) return true;
+  // Say WHY. The inline predecessor printed the cause here; dropping it left the
+  // user with setup.sh's generic "binding unusable" and nothing to act on.
+  const why = String(r.stdout || '').trim().split('\n')[0]
+    || (r.error && r.error.message)
+    || `probe exited ${r.status ?? `on signal ${r.signal}`}`;
+  process.stderr.write(`[claude-mem-lite] binding probe: ${why}\n`);
+  return false;
+}
+
+let helpers = null;
+try {
+  const [probeMod, lockMod, dirMod] = await Promise.all(
+    ['binding-probe.mjs', 'proc-lock.mjs', 'resolve-data-dir.mjs']
+      .map((f) => import(pathToFileURL(join(ROOT, 'lib', f)).href)),
+  );
+  helpers = { ...probeMod, ...lockMod, ...dirMod };
+} catch {
+  process.exit(bareProbe(ROOT) ? 0 : 1);
+}
+
+// Probe first — read-only, no lock needed. A healthy binding exits here.
+// Bounded like every other step: the whole script runs under the SessionStart
+// hook cap (hooks/hooks.json timeout 30) and an unbounded probe would spend the
+// entire budget before the rebuild it exists to trigger.
+const first = helpers.probeBindingInFreshProcess(ROOT, { timeoutMs: 8000 });
+if (first.ok) process.exit(0);
+
+// Broken: rebuild ONLY under the shared install.lock. A second MCP launch or an
+// install.mjs repair rebuilding the same node_modules concurrently can tear the
+// .node mid-compile.
+let lockPath;
+try {
+  lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock');
+} catch (e) {
+  // resolveDataDir THROWS on a non-absolute CLAUDE_MEM_DIR. Unhandled, that
+  // prints an 8-line rejection stack onto SessionStart stderr; one line is enough.
+  process.stderr.write(`[claude-mem-lite] binding probe: ${e.message}\n`);
+  process.exit(1);
+}
+const release = helpers.acquireLock(lockPath);
+if (!release) {
+  const firstLine = String(first.error).split('\n')[0];
+  process.stderr.write(
+    `[claude-mem-lite] binding probe: ${firstLine} (another install/repair in flight — deferring heal)\n`,
+  );
+  process.exit(1);
+}
+
+let result;
+try {
+  result = await helpers.ensureBetterSqlite3Working(ROOT, {
+    // Reuse the probe we already paid for. Without this, ensure() spawns its own
+    // default first probe — a second identical child on the critical path, under
+    // a hook cap, to re-learn what `first` already says.
+    probe: () => first,
+    exec: (cmd, opts) => execSync(cmd, { ...opts, timeout: 20000 }),
+    verify: () => helpers.probeBindingInFreshProcess(ROOT, { timeoutMs: 8000 }),
+  });
+} finally {
+  // process.exit skips finally blocks — every exit below this point, so the
+  // lock is always released.
+  release();
+}
+
+if (!result.ok) {
+  process.stderr.write(`[claude-mem-lite] binding probe: ${result.error}\n`);
+  process.exit(1);
+}
+if (result.action === 'rebuilt') {
+  process.stderr.write('[claude-mem-lite] rebuilt better-sqlite3 binding for current Node ABI\n');
+}
+process.exit(0);

package/scripts/launch.mjs

@@ -36,7 +36,7 @@ if (!existsSync(join(ROOT, 'node_modules', 'better-sqlite3'))) {
 // intact but the .node binary stale → server FATALs with "Could not locate
 // the bindings file" on first DB open. Probe + auto-rebuild before launching.
 try {
-  const { ensureBetterSqlite3Working, probeBetterSqlite3Binding } = await import('../lib/binding-probe.mjs');
+  const { ensureBetterSqlite3Working, probeBindingInFreshProcess } = await import('../lib/binding-probe.mjs');
   // The rebuild inside ensureBetterSqlite3Working mutates node_modules — the
   // same write class as install/repair/update, and this was the ONE rebuild
   // path outside the shared install.lock: a second MCP launch or a concurrent
@@ -56,7 +56,11 @@ try {
     if (release) {
       verify = await ensureBetterSqlite3Working(ROOT);
     } else {
-      const probe = await probeBetterSqlite3Binding(ROOT);
+      // Out of process, like the rebuild-capable branch above: this process goes
+      // on to import the MCP server, and a stale .node loaded here would leave a
+      // dead module handle cached for it. Also keeps the exit(1) guidance below
+      // reachable — an in-process load of a stale binding can SIGSEGV instead.
+      const probe = probeBindingInFreshProcess(ROOT);
       verify = probe.ok
         ? { ok: true, action: 'verified' }
         : { ok: false, error: `${probe.error} (another install/repair holds the lock — not rebuilding concurrently; reconnect with /mcp once it finishes)` };

package/scripts/setup.sh

@@ -136,65 +136,38 @@ fi
 #     stat, a new plugin-cache version dir (fresh node_modules) re-probes, and
 #     a Node upgrade (new ABI) re-probes. While broken, every SessionStart
 #     retries the rebuild until it heals.
-# shellcheck disable=SC2016  # node script single-quoted on purpose; ROOT passed via env, not shell expansion
+# Delegates to scripts/binding-probe-cli.mjs — a real module file, NOT an inline
+# `node -e` string. That inline form SIGSEGV'd during exit after a verified-good
+# rebuild (Node v24.18, ~50% of runs), so a successful heal returned 139 and this
+# branch recorded .deps-broken over a healthy install; it also could not contain
+# an apostrophe without truncating the shell command. See that file's header.
+# Contract: exit 0 = binding usable now.
 probe_binding() {
-  PROBE_ROOT="$ROOT" node --input-type=module -e '
-    // NOTE: this whole script sits in a single-quoted bash string — no
-    // apostrophes anywhere in it.
-    const { pathToFileURL } = await import("node:url");
-    const { join } = await import("node:path");
-    const root = process.env.PROBE_ROOT;
-    const libUrl = (f) => pathToFileURL(join(root, "lib", f)).href;
-    let helpers = null;
-    try {
-      const [probeMod, lockMod, dirMod] = await Promise.all(
-        ["binding-probe.mjs", "proc-lock.mjs", "resolve-data-dir.mjs"].map((f) => import(libUrl(f))));
-      helpers = { ...probeMod, ...lockMod, ...dirMod };
-    } catch {
-      // Probe helpers missing (half-installed tree) — fall back to a bare
-      // probe with no rebuild: a WORKING binding must still clear the flag,
-      // and a helperless broken tree is repaired by the hook-launcher path.
-      const { createRequire } = await import("node:module");
-      try {
-        const D = createRequire(join(root, "package.json"))("better-sqlite3");
-        new D(":memory:").close();
-        process.exit(0);
-      } catch (e) {
-        process.stderr.write(`[claude-mem-lite] binding probe: ${e.message}\n`);
-        process.exit(1);
-      }
-    }
-    // Probe first — read-only, no lock needed. Healthy binding exits here.
-    const first = await helpers.probeBetterSqlite3Binding(root);
-    if (first.ok) process.exit(0);
-    // Broken: rebuild ONLY under the shared install.lock (a second MCP launch
-    // or install.mjs repair rebuilding the same node_modules concurrently can
-    // tear the .node), and with the exec bounded to 20s — this script runs
-    // under the SessionStart hook cap (hooks.json timeout 30), and letting the
-    // hook SIGKILL a mid-flight node-gyp leaves a partial .node with no flag
-    // written. On lock-miss or timeout: mark broken and defer the heal to the
-    // MCP launch path (no hook cap, same lock).
-    const lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), "runtime", "install.lock");
-    const release = helpers.acquireLock(lockPath);
-    if (!release) {
-      const firstLine = String(first.error).split("\n")[0];
-      process.stderr.write(`[claude-mem-lite] binding probe: ${firstLine} (another install/repair in flight — deferring heal)\n`);
-      process.exit(1);
-    }
-    let r;
-    try {
-      const { execSync } = await import("node:child_process");
-      r = await helpers.ensureBetterSqlite3Working(root, {
-        exec: (cmd, opts) => execSync(cmd, { ...opts, timeout: 20000 }),
-      });
-    } finally {
-      // process.exit skips finally blocks — exits live BELOW this so the
-      // lock is always released.
-      release();
-    }
-    if (!r.ok) { process.stderr.write(`[claude-mem-lite] binding probe: ${r.error}\n`); process.exit(1); }
-    if (r.action === "rebuilt") process.stderr.write("[claude-mem-lite] rebuilt better-sqlite3 binding for current Node ABI\n");
-  '
+  # Absent on a truncated tree: without this guard node prints a full
+  # MODULE_NOT_FOUND stack onto SessionStart stderr on every marker-miss.
+  [[ -f "$ROOT/scripts/binding-probe-cli.mjs" ]] || return 1
+  # stdout muted: this child runs `npm rebuild`, and SessionStart stdout is a
+  # JSON envelope Claude Code parses. Nothing writes there today (verified) —
+  # this keeps a future non-piped exec from being able to.
+  PROBE_ROOT="$ROOT" node "$ROOT/scripts/binding-probe-cli.mjs" >/dev/null
+}
+
+# Ground truth about the binding, independent of how the healer above exited.
+# Belt-and-braces: moving the probe out of the inline `node -e` string removed
+# the observed SIGSEGV, but the healer's exit code is a PROXY for the question
+# that actually matters, and a proxy can lie again (a future crash, a partial
+# state, a kill at the hook cap). So ask the real question in a fresh process:
+# can we open a DB right now? A false .deps-broken here is not cosmetic — it
+# renders a "hooks degraded" banner into the user's session over a healthy
+# install. Costs one ~50ms spawn, and only off the marker fast-path.
+# shellcheck disable=SC2016  # node script single-quoted on purpose; ROOT passed via env, not shell expansion
+binding_usable() {
+  VERIFY_ROOT="$ROOT" node -e '
+    const { createRequire } = require("node:module");
+    const { join } = require("node:path");
+    const D = createRequire(join(process.env.VERIFY_ROOT, "package.json"))("better-sqlite3");
+    new D(":memory:").close();
+  ' >/dev/null 2>&1
 }
 
 if [[ -d "$ROOT/node_modules/better-sqlite3" ]]; then
@@ -202,7 +175,7 @@ if [[ -d "$ROOT/node_modules/better-sqlite3" ]]; then
   BINDING_MARKER="$ROOT/node_modules/.mem-binding-ok-$NODE_ABI"
   if [[ -f "$BINDING_MARKER" ]]; then
     mark_deps_ok
-  elif probe_binding; then
+  elif probe_binding || binding_usable; then
     rm -f "$ROOT/node_modules/.mem-binding-ok-"* 2>/dev/null || true
     touch "$BINDING_MARKER" 2>/dev/null || true
     mark_deps_ok

package/source-files.mjs

@@ -250,6 +250,9 @@ export const HOOK_SCRIPT_FILES = [
 //     as the MCP server. v3.42 audit HIGH-1.
 //   - setup.sh: run on plugin SessionStart via hooks.json. Signed for defense-in-depth
 //     (no tarball→executed-path propagation today, but it ships in files[] and is executed).
+//   - binding-probe-cli.mjs: setup.sh spawns it on every SessionStart that misses the ABI
+//     marker, and it runs `npm rebuild` — an unsigned copy would be arbitrary code executed
+//     at session start with a build step attached. Same class as setup.sh itself.
 // These ship via package.json files[] directly, not via HOOK_SCRIPT_FILES' copy path, so
 // listing them here changes ONLY what is signed/verified, not what install materializes.
 // Module-internal (spread into RELEASE_SIGNED_FILES below); not exported — no external
@@ -258,6 +261,7 @@ const LAUNCHER_SCRIPT_FILES = [
   'launch.mjs',
   'launch-preflight.mjs',
   'setup.sh',
+  'binding-probe-cli.mjs',
 ];
 
 // The complete set of files the release signature MUST cover: every runtime .mjs