claude-mem-lite 3.60.0 → 3.61.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.60.0",
+      "version": "3.61.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.0",
+  "version": "3.61.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/cli/common.mjs

@@ -17,6 +17,36 @@
 export function parseArgs(argv) {
   const positional = [];
   const flags = {};
+  // Canonical flag name for a raw `--key`. Two normalizations, both aimed at the
+  // same failure: a flag nobody reads is DROPPED, and the command then answers the
+  // unfiltered question with no signal.
+  //   1. `_` → `-`: every reader in the codebase spells multi-word flags with a
+  //      hyphen (`flags['include-noise']`), so `--include_noise` was inert.
+  //   2. MCP field name → CLI flag: v3.59.0 taught the CLI to accept MCP names for
+  //      the required values (--content/--query/--ids) so a model can map a tool
+  //      schema onto flags; the FILTER fields were left out, so `--obs_type bugfix`
+  //      returned rows of every type (verified: `search redis --obs_type bugfix`
+  //      surfaced the decision row that `--type bugfix` correctly excluded).
+  // An explicitly-passed canonical flag always wins over its alias.
+  const FLAG_ALIASES = {
+    'obs-type': 'type',
+    'date-from': 'from',
+    'date-to': 'to',
+    'date-since': 'since',
+    'file-path': 'file',
+  };
+  const canonicalFlag = (raw) => {
+    const hyphenated = raw.replace(/_/g, '-');
+    return FLAG_ALIASES[hyphenated] || hyphenated;
+  };
+  const setFlag = (raw, value) => {
+    const key = canonicalFlag(raw);
+    // Alias must not clobber an explicit canonical flag; a repeated canonical flag
+    // keeps last-wins (pre-existing behavior).
+    if (key !== raw.replace(/_/g, '-') && flags[key] !== undefined) return;
+    flags[key] = value;
+  };
+
   let i = 0;
   while (i < argv.length) {
     const arg = argv[i];
@@ -29,17 +59,17 @@ export function parseArgs(argv) {
       // applied — a save landed in the wrong project / type with no error.
       const eq = body.indexOf('=');
       if (eq >= 0) {
-        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        setFlag(body.slice(0, eq), body.slice(eq + 1));
         i++;
         continue;
       }
       const key = body;
       const next = argv[i + 1];
       if (next !== undefined && !next.startsWith('--') && (!next.startsWith('-') || /^-\d/.test(next))) {
-        flags[key] = next;
+        setFlag(key, next);
         i += 2;
       } else {
-        flags[key] = true;
+        setFlag(key, true);
         i++;
       }
     } else if (arg === '-h') {
@@ -141,6 +171,11 @@ export const KNOWN_CLI_FLAGS = new Set([
   'rerank', 'resource-type', 'retain-days', 'retry', 'run', 'run-all', 'scope', 'session-audit',
   'sidechain', 'since', 'sort', 'source', 'status', 'sweep', 'task', 'tech-stack', 'text', 'tier', 'title',
   'to', 'trigger-patterns', 'type', 'use-cases', 'verbose',
+  // Catalogued 2026-08-13 when suggestUnknownFlags started reporting EVERY unknown
+  // flag: these are real, code-read flags that the old edit-distance gate happened to
+  // stay silent about (`adopt --disable/--enable`, `activity --min-importance`,
+  // `save --supersedes`). Verified by running each command and checking for a warning.
+  'disable', 'enable', 'min-importance', 'supersedes',
 ]);
 
 /** Levenshtein distance, early-exit past `max` (cheap enough for a handful of flags). */
@@ -181,7 +216,13 @@ export function suggestUnknownFlags(flags) {
       const d = editDistance(key, known);
       if (d < bestDist) { bestDist = d; best = known; }
     }
-    if (best && bestDist <= 2) result.push({ flag: key, suggestion: best });
+    // Report EVERY unknown flag; the suggestion is a bonus when a near-miss exists.
+    // Previously an unknown flag with no neighbour within distance 2 produced no
+    // output at all — the silent case, and the dangerous one: `--obs_type bugfix`
+    // (distance 4 from `type`) parsed, matched no reader, and the command answered
+    // the unfiltered question. A dropped filter that looks applied is worse than a
+    // typo, because the wider result set reads as the answer.
+    result.push({ flag: key, suggestion: best && bestDist <= 2 ? best : null });
   }
   return result;
 }

package/hook.mjs

@@ -71,7 +71,7 @@ import { buildAndSaveHandoff, detectContinuationIntent, renderHandoffInjection,
 import { checkForUpdate, getCachedUpdateBanner, isUpdateCheckDue } from './hook-update.mjs';
 import { handleLLMOptimize } from './hook-optimize.mjs';
 import { silentAutoAdopt } from './adopt-cli.mjs';
-import { emitV270UpgradeBanner } from './lib/upgrade-banner.mjs';
+import { emitV270UpgradeBanner, hasPreV270Data } from './lib/upgrade-banner.mjs';
 import { loadCiteBackForEpisode, extractCiteBackSignals, buildUnsavedBugfixHint, countUnsavedBugfixShape, buildCiteRecallNudge as libBuildCiteRecallNudge, nextCiteLowStreak } from './lib/cite-back-hint.mjs';
 import { detectUnpersistedDecision } from './lib/persist-reminder.mjs';
 // plugin-cache-guard.mjs loaded dynamically — pre-2.31.2 installs that auto-upgraded
@@ -1389,11 +1389,16 @@ async function handleSessionStart() {
     // deferred_work table (was: high-importance observations in v2.69.x).
     // Idempotent via marker file; subsequent SessionStarts are silent.
     try {
-      // Gate on prior data: a brand-new install never had v2.69.x deferred-block
-      // semantics, so the migration notice is wrong noise (it fired for every
-      // fresh install since v2.70). Only genuine upgraders with observations see it.
-      const obsCount = db.prepare('SELECT COUNT(*) AS c FROM observations WHERE project = ?').get(project)?.c || 0;
-      emitV270UpgradeBanner({ project, runtimeDir: RUNTIME_DIR, hasPriorData: obsCount > 0 });
+      // Gate on prior data OLDER THAN v2.70.0: a brand-new install never had
+      // v2.69.x deferred-block semantics, so the migration notice is wrong noise.
+      // "Any observations at all" still misfired for someone who installed today
+      // and saved a few memories before their first SessionStart — age is what
+      // actually identifies an upgrader (see lib/upgrade-banner.mjs).
+      emitV270UpgradeBanner({
+        project,
+        runtimeDir: RUNTIME_DIR,
+        hasPriorData: hasPreV270Data(db, project),
+      });
     } catch (e) { debugCatch(e, 'session-start-v270-banner'); }
 
     // Pre-load TF-IDF vocabulary cache for this session (from DB, ~1ms)

package/install.mjs

@@ -40,7 +40,7 @@ const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 import { RESOURCE_METADATA } from './install-metadata.mjs';
 import { scanPluginCacheHookPollution } from './plugin-cache-guard.mjs';
 import { SOURCE_FILES, HOOK_SCRIPT_FILES } from './source-files.mjs';
-import { probeBetterSqlite3Binding, ensureBetterSqlite3Working, NATIVE_BINDING_REBUILD_CMD } from './lib/binding-probe.mjs';
+import { probeBetterSqlite3Binding, probeBindingInFreshProcess, ensureBetterSqlite3Working, NATIVE_BINDING_REBUILD_CMD } from './lib/binding-probe.mjs';
 import { clearNativeBindingBreakage, readNativeBindingBreakage } from './lib/native-binding-hint.mjs';
 import { sweepStaleTestFixtures } from './lib/tmp-fixture-sweep.mjs';
 import { acquireLock } from './lib/proc-lock.mjs';
@@ -259,6 +259,37 @@ let flags = new Set(process.argv.slice(3));
 
 function log(msg) { console.log(`  ${msg}`); }
 function ok(msg) { console.log(`  ✓ ${msg}`); }
+
+/**
+ * Recursive on-disk size of `dir`, in bytes. Bounded by `maxEntries` so a
+ * surprise-large tree can never turn a progress line into a long stat storm —
+ * returns `{ bytes, truncated }` and callers render truncated sums as "≥ N MB".
+ *
+ * @param {string} dir Directory to measure (missing dir → 0 bytes).
+ * @param {number} [maxEntries=50000] Stat budget.
+ * @returns {{bytes: number, truncated: boolean}}
+ */
+function dirSizeBytes(dir, maxEntries = 50000) {
+  let bytes = 0, seen = 0, truncated = false;
+  const stack = [dir];
+  while (stack.length > 0) {
+    const cur = stack.pop();
+    let entries;
+    try { entries = readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (++seen > maxEntries) { truncated = true; return { bytes, truncated }; }
+      const p = join(cur, e.name);
+      if (e.isDirectory()) stack.push(p);
+      else if (e.isFile()) { try { bytes += statSync(p).size; } catch { /* raced away */ } }
+    }
+  }
+  return { bytes, truncated };
+}
+
+/** Render a byte count as a short human string ("148 MB"). */
+function fmtMB(bytes, truncated = false) {
+  return `${truncated ? '≥' : ''}${Math.round(bytes / 1048576)} MB`;
+}
 function warn(msg) { console.log(`  ⚠ ${msg}`); }
 function fail(msg) { console.log(`  ✗ ${msg}`); }
 
@@ -797,6 +828,23 @@ if (process.env.CLAUDE_MEM_SKIP_REPOS) {
         repos.get(r.repo).push(r);
       }
 
+      // Disclose the cost BEFORE spending it. This step is the single largest
+      // thing `install` does — N shallow git clones over the network, ~150 MB on
+      // disk for the default manifest — and it used to announce itself only after
+      // the fact ("Repos: 15 cloned"). A first-time user on a metered link or a
+      // small disk had no warning and no visible way out; the opt-out existed but
+      // lived only in an env var no output ever mentioned.
+      // Count only repos not already on disk — a re-run/update clones nothing, and
+      // announcing "cloning 15 repos" every time would be false.
+      const repoDirName = (repoUrl) =>
+        repoUrl.split('/').slice(-2).join('-').replace(/[^a-zA-Z0-9._-]/g, '_');
+      const pendingClones = [...repos.keys()]
+        .filter(repoUrl => !existsSync(join(managedDir, 'repos', repoDirName(repoUrl)))).length;
+      if (pendingClones > 0) {
+        log(`Skill/agent registry: cloning ${pendingClones} repo(s) — network + ~150 MB on disk.`);
+        log('  Skip with CLAUDE_MEM_SKIP_REPOS=1 (memory features work without it).');
+      }
+
       let cloned = 0, updated = 0;
       const deadRepos = new Set(); // repos that no longer exist (404)
 
@@ -907,8 +955,10 @@ if (process.env.CLAUDE_MEM_SKIP_REPOS) {
           }
         }
       }
+      const managedSize = dirSizeBytes(managedDir);
       ok(`Repos: ${cloned} cloned, ${updated} updated, ${repos.size - deadRepos.size} active` +
-         (deadRepos.size > 0 ? `, ${deadRepos.size} dead removed` : ''));
+         (deadRepos.size > 0 ? `, ${deadRepos.size} dead removed` : '') +
+         ` (${fmtMB(managedSize.bytes, managedSize.truncated)} in ${managedDir})`);
 
       // 6b. Init registry DB and record preinstalled entries
       const { ensureRegistryDb } = await importFromInstall('registry.mjs');
@@ -1396,14 +1446,17 @@ async function doctor() {
     issues++;
   }
 
-  // Dependencies
-  try {
-    const Database = (await import('better-sqlite3')).default;
-    const probe = new Database(':memory:');
-    probe.close();
+  // Dependencies. Out of process: an in-process open of a STALE .node caches a
+  // dead module handle for the rest of doctor and can SIGSEGV on teardown —
+  // truncating the report of the very run the user started because things are
+  // broken. This is also what makes the native-binding check further down
+  // (which reads the same tree) honest rather than answering from a poisoned
+  // process.
+  const depProbe = probeBindingInFreshProcess(bindingHostDir());
+  if (depProbe.ok) {
     ok('better-sqlite3: verified (import + open OK)');
-  } catch (e) {
-    fail(`better-sqlite3: import/init failed (${e.message})`);
+  } else {
+    fail(`better-sqlite3: import/init failed (${String(depProbe.error).split('\n')[0]})`);
     issues++;
   }
 
@@ -1454,7 +1507,9 @@ async function doctor() {
   // right now". A Node upgrade breaks every DB-touching path at once, so this is
   // the single highest-value line in doctor when it fires.
   const breakage = readNativeBindingBreakage(join(MEM_DATA_DIR, 'runtime'));
-  const bindingProbe = await probeBetterSqlite3Binding(bindingHostDir());
+  // Reuses the dependency probe above — same tree, same question, and doctor
+  // should not pay for two child spawns to ask it twice.
+  const bindingProbe = depProbe;
   if (!bindingProbe.ok) {
     fail(`Native DB binding: unusable (${String(bindingProbe.error).split('\n')[0]}) — run \`node ${join(PROJECT_DIR, 'cli.mjs')} rebuild-binding\``);
     issues++;

package/lib/binding-probe.mjs

@@ -70,20 +70,90 @@ export async function probeBetterSqlite3Binding(installDir) {
   }
 }
 
+/**
+ * Probe the binding from a FRESH child process.
+ *
+ * Why this exists: better-sqlite3 dlopen's its .node lazily and Node caches the
+ * module handle process-wide, so a process that has already touched a STALE
+ * binary can never load its replacement — the retry dies with "Module did not
+ * self-register" (and, under scripts/setup.sh's probe, a segfault on the way
+ * out). Verifying a freshly rebuilt binding therefore has to happen somewhere
+ * that never saw the old one. Same constraint healAndReexec re-execs for.
+ *
+ * Synchronous (spawnSync) to match the surrounding execSync rebuild — this runs
+ * in installers and hook-adjacent scripts, never on a request path.
+ *
+ * @param {string} installDir Directory containing node_modules/better-sqlite3
+ * @param {{timeoutMs?: number}} [opts]
+ * @returns {{ok: true} | {ok: false, error: string}}
+ */
+export function probeBindingInFreshProcess(installDir, { timeoutMs = 30_000 } = {}) {
+  // The child catches and prints the MESSAGE on its own stdout. Two reasons it
+  // is not just an uncaught throw read off stderr: an uncaught exception's first
+  // stderr line is the stack HEADER (`node:internal/modules/cjs/loader:1520`),
+  // not the diagnostic — and this string is the highest-value line `doctor`
+  // prints — and any node warning emitted before the throw would land on stderr
+  // first and hijack it. The child's stdout is captured by spawnSync and never
+  // inherited, so writing there cannot reach a hook's JSON envelope.
+  // installDir is interpolated as a JSON string literal, so a path containing
+  // quotes/backslashes cannot break out of the script.
+  const script =
+    'try {'
+    + 'const { createRequire } = require("node:module");'
+    + `const D = createRequire(${JSON.stringify(join(installDir, 'package.json'))})("better-sqlite3");`
+    + 'new D(":memory:").close();'
+    + '} catch (e) { process.stdout.write(String((e && e.message) || e)); process.exit(1); }';
+  const r = spawnSync(process.execPath, ['-e', script], { stdio: 'pipe', timeout: timeoutMs });
+  // BEFORE the status check: spawnSync's `timeout` is SIGTERM-then-wait, not a
+  // deadline, so a child that survives the signal can still exit 0 while
+  // r.error is ETIMEDOUT. Reading status alone would call that healthy.
+  if (r.error) return { ok: false, error: r.error.message };
+  if (r.status === 0) return { ok: true };
+  // Fallbacks cover the paths where the catch never ran: a native crash (the
+  // SIGSEGV above) or a failure to spawn at all — both leave stdout empty.
+  const printed = String(r.stdout || '').trim();
+  const stderrLine = String(r.stderr || '').split('\n').map((l) => l.trim()).find(Boolean);
+  return {
+    ok: false,
+    error: printed
+      || stderrLine
+      || `binding probe exited ${r.status ?? `on signal ${r.signal}`}`,
+  };
+}
+
 /**
  * Verify better-sqlite3 binding works in `installDir`; if not, run
  * `npm rebuild better-sqlite3` and re-probe. Returns
  * { ok: true, action: 'verified' | 'rebuilt' } on success or
- * { ok: false, error } if rebuild can't fix it. The `probe` and `rebuild`
- * deps are injectable so this can be unit-tested without a real npm
+ * { ok: false, error } if rebuild can't fix it. The `probe`, `verify` and
+ * `rebuild` deps are injectable so this can be unit-tested without a real npm
  * subprocess.
  *
  * @param {string} installDir Directory containing node_modules/better-sqlite3
- * @param {{probe?: () => Promise<{ok: boolean, error?: string}>, rebuild?: () => Promise<void>, exec?: (cmd: string, opts: object) => void}} [deps]
+ * @param {{probe?: () => Promise<{ok: boolean, error?: string}>, verify?: () => Promise<{ok: boolean, error?: string}> | {ok: boolean, error?: string}, rebuild?: () => Promise<void>, exec?: (cmd: string, opts: object) => void}} [deps]
  * @returns {Promise<{ok: true, action: 'verified' | 'rebuilt'} | {ok: false, error: string}>}
  */
 export async function ensureBetterSqlite3Working(installDir, deps = {}) {
-  const probe = deps.probe || (() => probeBetterSqlite3Binding(installDir));
+  // BOTH probes run out of process by default, because a probe must never
+  // poison the process that has to act on its answer. Loading a stale .node
+  // caches a dead module handle process-wide (and can SIGSEGV on teardown), so
+  // an in-process probe→rebuild→re-probe cycle always ends in "Module did not
+  // self-register" — reporting a SUCCESSFUL rebuild as a failure. Measured
+  // 2026-08-13 on a real ABI 127-under-137 tree: this function returned
+  // {ok:false} while the rebuilt .node loaded fine in a fresh process. Every
+  // caller keyed state on that lie — setup.sh wrote .deps-broken over a healthy
+  // install, install.mjs::rebuildBinding skipped clearNativeBindingBreakage so
+  // the launcher re-spawned npm every 6h forever, and `rebuild-binding` exited 1.
+  //
+  // Isolating only the SECOND probe is not enough: scripts/launch.mjs imports
+  // the MCP server into this very process right after a successful rebuild, so a
+  // first probe that dlopened the stale binary would hand the server the dead
+  // handle. Cost is one ~40ms spawn on a path that already runs npm.
+  //
+  // `deps.probe` alone still drives BOTH probes: injected-stub tests keep their
+  // existing semantics.
+  const probe = deps.probe || (() => probeBindingInFreshProcess(installDir));
+  const verify = deps.verify || deps.probe || (() => probeBindingInFreshProcess(installDir));
   // Bounded by default: a node-gyp fallback that stalls (no compiler, a hung
   // registry fetch) must not hang the caller forever — the CLI blocks a user at
   // the terminal, and scripts/setup.sh passes an even tighter 20s cap because it
@@ -117,7 +187,7 @@ export async function ensureBetterSqlite3Working(installDir, deps = {}) {
     return { ok: false, error: `rebuild failed: ${e.message}` };
   }
 
-  const second = await probe();
+  const second = await verify();
   if (second.ok) return { ok: true, action: 'rebuilt' };
 
   return { ok: false, error: second.error || first.error };

package/lib/upgrade-banner.mjs

@@ -7,6 +7,37 @@
 import { writeFileSync, existsSync } from 'fs';
 import { join } from 'path';
 
+// v2.70.0 shipped 2026-05-10 (CHANGELOG "v2.70.0 — first-class deferred work").
+// Only observations that already existed then could have been rendered under the
+// v2.69.x deferred-block semantics this banner describes.
+export const V270_RELEASE_EPOCH = Date.UTC(2026, 4, 10);
+
+/**
+ * True when the project holds observations old enough to have lived under the
+ * v2.69.x deferred-block semantics.
+ *
+ * The original guard was `any observations at all`, which still fires for someone
+ * who installed today and saved a few memories before their first SessionStart —
+ * they get a migration notice about a release 40+ versions back, ending in "Pin to
+ * 2.69.x to revert" (advice that would downgrade them past every feature they just
+ * installed). Age is the property that actually distinguishes an upgrader.
+ *
+ * @param {object} db Open better-sqlite3 handle.
+ * @param {string} project Project name.
+ * @returns {boolean} false on any query failure — suppressing a stale banner is the
+ *   safe direction (§ fail-quiet: a missed notice costs less than a wrong one).
+ */
+export function hasPreV270Data(db, project) {
+  try {
+    const row = db.prepare(
+      'SELECT 1 AS hit FROM observations WHERE project = ? AND created_at_epoch < ? LIMIT 1'
+    ).get(project, V270_RELEASE_EPOCH);
+    return !!row;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * One-shot stderr banner on first SessionStart after v2.70.0 upgrade.
  * Notifies users that the `### Deferred Work` block now reads from the

package/mem-cli.mjs

@@ -3192,7 +3192,9 @@ export async function run(argv) {
   // when a flag looks like a misspelling of a real one; stdout + exit code stay untouched,
   // so JSON/text consumers are unaffected. Mirrors the unknown-COMMAND suggester in cli.mjs.
   for (const { flag, suggestion } of suggestUnknownFlags(parseArgs(cmdArgs).flags)) {
-    process.stderr.write(`[mem] Unknown flag --${flag}; did you mean --${suggestion}?\n`);
+    process.stderr.write(suggestion
+      ? `[mem] Unknown flag --${flag}; did you mean --${suggestion}?\n`
+      : `[mem] Unknown flag --${flag} — ignored (it filtered nothing). Run "claude-mem-lite help" for this command's flags.\n`);
   }
 
   // adopt / unadopt do pure filesystem work on ~/.claude/projects/<encoded>/memory/ —

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.0",
+  "version": "3.61.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.60.0",
+      "version": "3.61.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.0",
+  "version": "3.61.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -158,6 +158,7 @@
     "scripts/pre-agent-inject.js",
     "scripts/prompt-search-utils.mjs",
     "scripts/hook-launcher.mjs",
+    "scripts/binding-probe-cli.mjs",
     ".mcp.json",
     ".claude-plugin/plugin.json",
     ".claude-plugin/marketplace.json",

package/scripts/binding-probe-cli.mjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+// scripts/binding-probe-cli.mjs — SessionStart native-binding probe + bounded heal.
+//
+// Contract with scripts/setup.sh: exit 0 = binding usable NOW, non-zero = not.
+// Everything human-readable goes to stderr — SessionStart stdout is a JSON
+// envelope Claude Code parses, so this must never write there.
+//
+// Extracted (v3.60.1) from an inline `node --input-type=module -e '…'` string
+// inside setup.sh. Two load-bearing reasons, both observed rather than assumed:
+//   • That form CRASHED. The -e process SIGSEGV'd during exit after a
+//     verified-good rebuild (Node v24.18, ~50% of runs, no fatal-error report
+//     produced), so a SUCCESSFUL heal exited 139 and setup.sh wrote
+//     .deps-broken over a healthy install. install.mjs::rebuildBinding doing
+//     the same work as a normal module never reproduced it.
+//   • It could not contain an apostrophe. The script was interpolated into a
+//     single-quoted bash string, so a single `don't` in a comment truncated the
+//     shell command — a footgun that fired during development of this fix.
+//
+// Rebuilds are bounded to 20s because setup.sh runs under the SessionStart hook
+// cap (hooks/hooks.json timeout 30): letting the hook SIGKILL a mid-flight
+// node-gyp would leave a partial .node with no flag written. On lock-miss or
+// timeout, mark broken and defer to the MCP launch path (no cap, same lock).
+
+import { execSync, spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ROOT = process.env.PROBE_ROOT || join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// Fallback for a half-installed tree where lib/ helpers are absent: a bare
+// probe with no rebuild. A WORKING binding must still be able to clear the
+// broken flag, and a helperless broken tree is repaired by the hook-launcher
+// path instead. Out of process like every other probe here — loading a stale
+// .node caches a dead module handle for the rest of THIS process.
+function bareProbe(root) {
+  const script =
+    'try {'
+    + 'const { createRequire } = require("node:module");'
+    + `const D = createRequire(${JSON.stringify(join(root, 'package.json'))})("better-sqlite3");`
+    + 'new D(":memory:").close();'
+    + '} catch (e) { process.stdout.write(String((e && e.message) || e)); process.exit(1); }';
+  const r = spawnSync(process.execPath, ['-e', script], { stdio: 'pipe', timeout: 8000 });
+  if (!r.error && r.status === 0) return true;
+  // Say WHY. The inline predecessor printed the cause here; dropping it left the
+  // user with setup.sh's generic "binding unusable" and nothing to act on.
+  const why = String(r.stdout || '').trim().split('\n')[0]
+    || (r.error && r.error.message)
+    || `probe exited ${r.status ?? `on signal ${r.signal}`}`;
+  process.stderr.write(`[claude-mem-lite] binding probe: ${why}\n`);
+  return false;
+}
+
+let helpers = null;
+try {
+  const [probeMod, lockMod, dirMod] = await Promise.all(
+    ['binding-probe.mjs', 'proc-lock.mjs', 'resolve-data-dir.mjs']
+      .map((f) => import(pathToFileURL(join(ROOT, 'lib', f)).href)),
+  );
+  helpers = { ...probeMod, ...lockMod, ...dirMod };
+} catch {
+  process.exit(bareProbe(ROOT) ? 0 : 1);
+}
+
+// Probe first — read-only, no lock needed. A healthy binding exits here.
+// Bounded like every other step: the whole script runs under the SessionStart
+// hook cap (hooks/hooks.json timeout 30) and an unbounded probe would spend the
+// entire budget before the rebuild it exists to trigger.
+const first = helpers.probeBindingInFreshProcess(ROOT, { timeoutMs: 8000 });
+if (first.ok) process.exit(0);
+
+// Broken: rebuild ONLY under the shared install.lock. A second MCP launch or an
+// install.mjs repair rebuilding the same node_modules concurrently can tear the
+// .node mid-compile.
+let lockPath;
+try {
+  lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock');
+} catch (e) {
+  // resolveDataDir THROWS on a non-absolute CLAUDE_MEM_DIR. Unhandled, that
+  // prints an 8-line rejection stack onto SessionStart stderr; one line is enough.
+  process.stderr.write(`[claude-mem-lite] binding probe: ${e.message}\n`);
+  process.exit(1);
+}
+const release = helpers.acquireLock(lockPath);
+if (!release) {
+  const firstLine = String(first.error).split('\n')[0];
+  process.stderr.write(
+    `[claude-mem-lite] binding probe: ${firstLine} (another install/repair in flight — deferring heal)\n`,
+  );
+  process.exit(1);
+}
+
+let result;
+try {
+  result = await helpers.ensureBetterSqlite3Working(ROOT, {
+    // Reuse the probe we already paid for. Without this, ensure() spawns its own
+    // default first probe — a second identical child on the critical path, under
+    // a hook cap, to re-learn what `first` already says.
+    probe: () => first,
+    exec: (cmd, opts) => execSync(cmd, { ...opts, timeout: 20000 }),
+    verify: () => helpers.probeBindingInFreshProcess(ROOT, { timeoutMs: 8000 }),
+  });
+} finally {
+  // process.exit skips finally blocks — every exit below this point, so the
+  // lock is always released.
+  release();
+}
+
+if (!result.ok) {
+  process.stderr.write(`[claude-mem-lite] binding probe: ${result.error}\n`);
+  process.exit(1);
+}
+if (result.action === 'rebuilt') {
+  process.stderr.write('[claude-mem-lite] rebuilt better-sqlite3 binding for current Node ABI\n');
+}
+process.exit(0);

package/scripts/launch.mjs

@@ -36,7 +36,7 @@ if (!existsSync(join(ROOT, 'node_modules', 'better-sqlite3'))) {
 // intact but the .node binary stale → server FATALs with "Could not locate
 // the bindings file" on first DB open. Probe + auto-rebuild before launching.
 try {
-  const { ensureBetterSqlite3Working, probeBetterSqlite3Binding } = await import('../lib/binding-probe.mjs');
+  const { ensureBetterSqlite3Working, probeBindingInFreshProcess } = await import('../lib/binding-probe.mjs');
   // The rebuild inside ensureBetterSqlite3Working mutates node_modules — the
   // same write class as install/repair/update, and this was the ONE rebuild
   // path outside the shared install.lock: a second MCP launch or a concurrent
@@ -56,7 +56,11 @@ try {
     if (release) {
       verify = await ensureBetterSqlite3Working(ROOT);
     } else {
-      const probe = await probeBetterSqlite3Binding(ROOT);
+      // Out of process, like the rebuild-capable branch above: this process goes
+      // on to import the MCP server, and a stale .node loaded here would leave a
+      // dead module handle cached for it. Also keeps the exit(1) guidance below
+      // reachable — an in-process load of a stale binding can SIGSEGV instead.
+      const probe = probeBindingInFreshProcess(ROOT);
       verify = probe.ok
         ? { ok: true, action: 'verified' }
         : { ok: false, error: `${probe.error} (another install/repair holds the lock — not rebuilding concurrently; reconnect with /mcp once it finishes)` };

package/scripts/setup.sh

@@ -136,65 +136,38 @@ fi
 #     stat, a new plugin-cache version dir (fresh node_modules) re-probes, and
 #     a Node upgrade (new ABI) re-probes. While broken, every SessionStart
 #     retries the rebuild until it heals.
-# shellcheck disable=SC2016  # node script single-quoted on purpose; ROOT passed via env, not shell expansion
+# Delegates to scripts/binding-probe-cli.mjs — a real module file, NOT an inline
+# `node -e` string. That inline form SIGSEGV'd during exit after a verified-good
+# rebuild (Node v24.18, ~50% of runs), so a successful heal returned 139 and this
+# branch recorded .deps-broken over a healthy install; it also could not contain
+# an apostrophe without truncating the shell command. See that file's header.
+# Contract: exit 0 = binding usable now.
 probe_binding() {
-  PROBE_ROOT="$ROOT" node --input-type=module -e '
-    // NOTE: this whole script sits in a single-quoted bash string — no
-    // apostrophes anywhere in it.
-    const { pathToFileURL } = await import("node:url");
-    const { join } = await import("node:path");
-    const root = process.env.PROBE_ROOT;
-    const libUrl = (f) => pathToFileURL(join(root, "lib", f)).href;
-    let helpers = null;
-    try {
-      const [probeMod, lockMod, dirMod] = await Promise.all(
-        ["binding-probe.mjs", "proc-lock.mjs", "resolve-data-dir.mjs"].map((f) => import(libUrl(f))));
-      helpers = { ...probeMod, ...lockMod, ...dirMod };
-    } catch {
-      // Probe helpers missing (half-installed tree) — fall back to a bare
-      // probe with no rebuild: a WORKING binding must still clear the flag,
-      // and a helperless broken tree is repaired by the hook-launcher path.
-      const { createRequire } = await import("node:module");
-      try {
-        const D = createRequire(join(root, "package.json"))("better-sqlite3");
-        new D(":memory:").close();
-        process.exit(0);
-      } catch (e) {
-        process.stderr.write(`[claude-mem-lite] binding probe: ${e.message}\n`);
-        process.exit(1);
-      }
-    }
-    // Probe first — read-only, no lock needed. Healthy binding exits here.
-    const first = await helpers.probeBetterSqlite3Binding(root);
-    if (first.ok) process.exit(0);
-    // Broken: rebuild ONLY under the shared install.lock (a second MCP launch
-    // or install.mjs repair rebuilding the same node_modules concurrently can
-    // tear the .node), and with the exec bounded to 20s — this script runs
-    // under the SessionStart hook cap (hooks.json timeout 30), and letting the
-    // hook SIGKILL a mid-flight node-gyp leaves a partial .node with no flag
-    // written. On lock-miss or timeout: mark broken and defer the heal to the
-    // MCP launch path (no hook cap, same lock).
-    const lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), "runtime", "install.lock");
-    const release = helpers.acquireLock(lockPath);
-    if (!release) {
-      const firstLine = String(first.error).split("\n")[0];
-      process.stderr.write(`[claude-mem-lite] binding probe: ${firstLine} (another install/repair in flight — deferring heal)\n`);
-      process.exit(1);
-    }
-    let r;
-    try {
-      const { execSync } = await import("node:child_process");
-      r = await helpers.ensureBetterSqlite3Working(root, {
-        exec: (cmd, opts) => execSync(cmd, { ...opts, timeout: 20000 }),
-      });
-    } finally {
-      // process.exit skips finally blocks — exits live BELOW this so the
-      // lock is always released.
-      release();
-    }
-    if (!r.ok) { process.stderr.write(`[claude-mem-lite] binding probe: ${r.error}\n`); process.exit(1); }
-    if (r.action === "rebuilt") process.stderr.write("[claude-mem-lite] rebuilt better-sqlite3 binding for current Node ABI\n");
-  '
+  # Absent on a truncated tree: without this guard node prints a full
+  # MODULE_NOT_FOUND stack onto SessionStart stderr on every marker-miss.
+  [[ -f "$ROOT/scripts/binding-probe-cli.mjs" ]] || return 1
+  # stdout muted: this child runs `npm rebuild`, and SessionStart stdout is a
+  # JSON envelope Claude Code parses. Nothing writes there today (verified) —
+  # this keeps a future non-piped exec from being able to.
+  PROBE_ROOT="$ROOT" node "$ROOT/scripts/binding-probe-cli.mjs" >/dev/null
+}
+
+# Ground truth about the binding, independent of how the healer above exited.
+# Belt-and-braces: moving the probe out of the inline `node -e` string removed
+# the observed SIGSEGV, but the healer's exit code is a PROXY for the question
+# that actually matters, and a proxy can lie again (a future crash, a partial
+# state, a kill at the hook cap). So ask the real question in a fresh process:
+# can we open a DB right now? A false .deps-broken here is not cosmetic — it
+# renders a "hooks degraded" banner into the user's session over a healthy
+# install. Costs one ~50ms spawn, and only off the marker fast-path.
+# shellcheck disable=SC2016  # node script single-quoted on purpose; ROOT passed via env, not shell expansion
+binding_usable() {
+  VERIFY_ROOT="$ROOT" node -e '
+    const { createRequire } = require("node:module");
+    const { join } = require("node:path");
+    const D = createRequire(join(process.env.VERIFY_ROOT, "package.json"))("better-sqlite3");
+    new D(":memory:").close();
+  ' >/dev/null 2>&1
 }
 
 if [[ -d "$ROOT/node_modules/better-sqlite3" ]]; then
@@ -202,7 +175,7 @@ if [[ -d "$ROOT/node_modules/better-sqlite3" ]]; then
   BINDING_MARKER="$ROOT/node_modules/.mem-binding-ok-$NODE_ABI"
   if [[ -f "$BINDING_MARKER" ]]; then
     mark_deps_ok
-  elif probe_binding; then
+  elif probe_binding || binding_usable; then
     rm -f "$ROOT/node_modules/.mem-binding-ok-"* 2>/dev/null || true
     touch "$BINDING_MARKER" 2>/dev/null || true
     mark_deps_ok

package/scripts/user-prompt-search.js

@@ -114,6 +114,60 @@ const OR_TOP_BM25_FLOOR = TOP_REL_FLOOR === 0
   ? 0
   : Number(process.env.CLAUDE_MEM_UPS_OR_BM25_MIN || 30);
 
+// ─── Corpus-size normalization of the absolute floors (v3.60.2) ─────────────
+//
+// Both floors above are ABSOLUTE magnitudes, but the quantity they gate is not
+// scale-free: FTS5 bm25 carries an IDF term ≈ ln(N/df), so the SAME hit scores
+// higher on a bigger index. Measured on one fixed query + one fixed target row,
+// padding the corpus with distinct filler (2026-08-13 dogfood):
+//
+//   totalObs   10     40     100    300
+//   top|bm25|  10.0   18.6   24.2   30.7      ← same row, same query
+//
+// The floors were calibrated at `projects--mem, 584 obs` (CHANGELOG v2.43.x /
+// v2.34.3). Comparing a log-N quantity against that constant therefore does not
+// mean "weak match" on a small index — it means "small index". A brand-new
+// install measured 0/8 injections on a realistic first-day corpus (10 memories,
+// 8 recall questions whose correct target ranked #1 in 4/5 scored cases): every
+// one was dropped by the OR floor at |bm25| 3.8–15.2 < 30. The plugin is inert
+// during exactly the window where a new user decides whether it earns its keep.
+//
+// Fix: scale both floors by ln(N+1)/ln(N_REF+1), capped at 1.0 — the same log
+// shape the IDF term has, so the SIGNAL↔NOISE separation the maintainer measured
+// (signal ≥41, noise ≤22 at N_REF) is preserved proportionally at any N. At
+// N ≥ N_REF the factor is exactly 1.0, so every established install keeps
+// byte-identical behavior; only genuinely-new installs relax.
+//
+// N counts the WHOLE observations table, not the project: FTS5 computes IDF over
+// the entire index and `o.project = ?` is a post-MATCH filter. Verified — a
+// 2-row project on a 302-row install scores 31.5, matching the 300-row global
+// baseline, not the 10-row one. So a new project on an established install is
+// (correctly) unaffected by this ramp.
+const FLOOR_REF_CORPUS = Number(process.env.CLAUDE_MEM_UPS_FLOOR_REF_CORPUS || 584);
+
+/**
+ * Scale factor in (0, 1] for the absolute score floors, by total corpus size.
+ *
+ * Short-circuits with a bounded probe: if a row exists at offset N_REF-1 the
+ * corpus is at or above the reference and the factor is 1.0 — no COUNT scan on
+ * the large corpora where the answer is always 1.0 anyway.
+ *
+ * @param {object} db Open better-sqlite3 handle.
+ * @returns {number} Multiplier for TOP_REL_FLOOR / OR_TOP_BM25_FLOOR.
+ */
+export function corpusFloorScale(db) {
+  if (FLOOR_REF_CORPUS <= 1) return 1;
+  try {
+    const atRef = db.prepare('SELECT 1 FROM observations LIMIT 1 OFFSET ?').get(FLOOR_REF_CORPUS - 1);
+    if (atRef) return 1;
+    const { c = 0 } = db.prepare('SELECT count(*) AS c FROM observations').get() || {};
+    return Math.min(1, Math.log(c + 1) / Math.log(FLOOR_REF_CORPUS + 1));
+  } catch {
+    // Any probe failure → behave exactly as before the ramp existed.
+    return 1;
+  }
+}
+
 function isFollowUpSession() {
   try {
     const raw = readFileSync(INJECTED_IDS_FILE, 'utf8');
@@ -735,9 +789,14 @@ async function main() {
       // is a precision signal and routinely produces legitimate AND hits
       // below raw |bm25|=20 that we do not want to drop (see GOOD-narrow
       // probe). Skip gate when OR_TOP_BM25_FLOOR is set to 0 (test hook).
-      if (ftsMode === 'OR' && OR_TOP_BM25_FLOOR > 0 && ftsRows.length > 0) {
+      // Both absolute floors are normalized by corpus size (corpusFloorScale) —
+      // factor 1.0 for any install at/above the calibration corpus, so this is a
+      // no-op for established users and a proportional relaxation for new ones.
+      const floorScale = corpusFloorScale(db);
+      const orFloor = OR_TOP_BM25_FLOOR * floorScale;
+      if (ftsMode === 'OR' && orFloor > 0 && ftsRows.length > 0) {
         const topBm25 = Math.abs(ftsRows[0].bm25_raw || 0);
-        if (topBm25 < OR_TOP_BM25_FLOOR) ftsRows = [];
+        if (topBm25 < orFloor) ftsRows = [];
       }
 
       // v2.34.3: top-|rel| sanity gate. Per-row filtering above leaves noise
@@ -746,7 +805,7 @@ async function main() {
       // whole FTS set — noise prompts should produce no FTS injection.
       // Query orders by `relevance` ASC; negative values → ftsRows[0] has the
       // largest magnitude (strongest match) in this scoring expression.
-      if (ftsRows.length > 0 && Math.abs(ftsRows[0].relevance) < TOP_REL_FLOOR) {
+      if (ftsRows.length > 0 && Math.abs(ftsRows[0].relevance) < TOP_REL_FLOOR * floorScale) {
         ftsRows = [];
       }
 

package/secret-scrub.mjs

@@ -30,8 +30,18 @@ export const SECRET_PATTERNS = [
   // value is covered (the hex-only assignment pattern below misses non-hex values).
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
   [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
-  //   1b. `:` separator → keep the prose lookbehind ("the token: alice" is prose):
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  //   1b. `:` separator, PASSWORD nouns → always scrub. The prose lookbehind below
+  //       was originally applied to the whole noun class, which meant any credential
+  //       noun preceded by an English word escaped — so a session narrative like
+  //       "deployed to staging, the db password: hunter2correct" persisted the
+  //       password in plaintext and re-injected it into every later context block
+  //       (R5 dogfood, 2026-08-13). Unlike `token`/`bearer`/`secret`, the pinned
+  //       prose set (#8283) contains no `password|passwd|passphrase` case: writing
+  //       "<word> password: <6+ chars>" names a credential, it is not conversational
+  //       usage. Letter-glued non-keywords (`mypassword:`) still miss via `(?:\b|_)`.
+  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  //   1c. `:` separator, prose-ambiguous nouns → keep the lookbehind ("the token: alice"):
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
   // access_token / refresh_token are the canonical OAuth2 field names — they were
   // missing from this KV list (drift vs the JSON list below). `(?:\b|_)` for the same
   // underscore-prefix reason.
@@ -61,7 +71,8 @@ export const SECRET_PATTERNS = [
   //       (mirrors the unquoted 1a/1b split — a quoted value doesn't turn `:` prose
   //       into config, but `<word> password="x"` is still a leak):
   [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [/((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],

package/server.mjs

@@ -28,6 +28,7 @@ import { TIER_CASE_SQL, tierSqlParams } from './tier.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
 import { buildLessonNudge } from './lib/save-nudge.mjs';
 import { formatObsFieldValue } from './cli/common.mjs';
+import { neutralizeContextDelimiters } from './format-utils.mjs';
 import { memSearchSchema, memRecentSchema, memTimelineSchema, memGetSchema, memDeleteSchema, memSaveSchema, memStatsSchema, memCompressSchema, memMaintainSchema, memOptimizeSchema, memUpdateSchema, memExportSchema, memRecallSchema, memFtsCheckSchema, memRegistrySchema, memBrowseSchema, memUseSchema, memDeferSchema, memDeferListSchema, memDeferDropSchema, tools as TOOL_DEFS } from './tool-schemas.mjs';
 
 // Lookup helper: all user-facing tool descriptions live in tool-schemas.mjs
@@ -157,14 +158,76 @@ const server = new McpServer(
 let lastMcpRequestTime = Date.now();
 let idleCleanupRan = false;
 
-function safeHandler(fn) {
+/**
+ * Defang structural context delimiters in every text block of a tools/call result.
+ *
+ * A tools/call payload IS model context — unlike CLI stdout there is no human between
+ * the DB row and the transcript. Observations are stored raw on purpose (defense lives
+ * at the injection boundary, not at save), and every HOOK surface already neutralizes
+ * before writing to the model (buildSessionContextLines / formatMemoryLine /
+ * formatErrorRecallHints / renderHandoffFromRow / pre-tool-recall). The MCP read tools
+ * were the one model-facing family left raw, so a memory carrying a forged
+ * `<system-reminder>` replayed verbatim into a mem_search result — reinstating exactly
+ * the channel the hook-side defang closes. Applied at the single handler chokepoint so
+ * a newly registered tool is covered by construction (§9 parallel-path completeness).
+ *
+ * Error payloads go through it too: `err.message` can echo caller-supplied text.
+ *
+ * @param {object} result Tool result ({ content: [{type,text}], … }).
+ * @returns {object} Same shape with text blocks neutralized.
+ */
+/**
+ * Fold CLI-flag aliases onto their canonical MCP field names.
+ *
+ * The schemas declare both spellings (see tool-schemas.mjs); this is where the alias
+ * actually takes effect. Canonical wins when both are present — an explicit canonical
+ * value is the more specific intent, and silently letting an alias override it would
+ * reintroduce the same class of surprise the aliases exist to remove.
+ *
+ * @param {object} args Raw validated tool arguments.
+ * @param {Record<string,string>} pairs alias → canonical field name.
+ * @returns {object} New args object (never mutates the caller's).
+ */
+function applyArgAliases(args, pairs) {
+  if (!args || typeof args !== 'object') return args;
+  let next = args;
+  for (const [alias, canonical] of Object.entries(pairs)) {
+    if (next[alias] !== undefined && next[canonical] === undefined) {
+      if (next === args) next = { ...args };
+      next[canonical] = next[alias];
+    }
+  }
+  return next;
+}
+
+function defangResult(result) {
+  if (!result || !Array.isArray(result.content)) return result;
+  return {
+    ...result,
+    content: result.content.map(c =>
+      c && c.type === 'text' && typeof c.text === 'string'
+        ? { ...c, text: neutralizeContextDelimiters(c.text) }
+        : c
+    ),
+  };
+}
+
+/**
+ * @param {Function} fn Tool handler.
+ * @param {object} [opts]
+ * @param {boolean} [opts.verbatim=false] Skip the defang pass. Only for payloads that
+ *   must round-trip byte-exact — `mem_export` feeds `restore`, so neutralizing it would
+ *   silently corrupt backups of any memory that legitimately discusses these tags.
+ */
+function safeHandler(fn, { verbatim = false } = {}) {
   return async (args, extra) => {
     try {
       lastMcpRequestTime = Date.now();
       idleCleanupRan = false;
-      return await fn(args, extra);
+      const result = await fn(args, extra);
+      return verbatim ? result : defangResult(result);
     } catch (err) {
-      return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+      return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
     }
   };
 }
@@ -258,6 +321,10 @@ export async function handleSearchForTest(db, args, { llm, rerankLlm } = {}) {
 
 async function runSearchPipeline(db, args, { llm, rerankLlm } = {}) {
   if (args.project) args = { ...args, project: _resolveProjectShared(db, args.project) };
+  // CLI-flag aliases: --source/--from/--to/--since. Folded before any read of the
+  // canonical names below, so every downstream filter sees them.
+  args = applyArgAliases(args, { source: 'type', from: 'date_from', to: 'date_to', since: 'date_since' });
+
   const limit = args.limit ?? 20;
   const offset = args.offset ?? 0;
   // args.or: force OR from the start (CLI `search --or` parity). The default path
@@ -390,6 +457,8 @@ export async function handleRecentForTest(db, args) {
 }
 
 async function runRecent(db, args) {
+  // CLI-flag aliases: `recent --type` is the OBSERVATION type here, `--since` the window.
+  args = applyArgAliases(args, { type: 'obs_type', since: 'date_since' });
   if (args.project) args = { ...args, project: _resolveProjectShared(db, args.project) };
   const limit = args.limit ?? 10;
   const project = args.project || inferProject();
@@ -1674,7 +1743,9 @@ server.registerTool(
     description: descriptionOf('mem_export'),
     inputSchema: memExportSchema,
   },
-  safeHandler(async (args) => runExport(db, args))
+  // verbatim: the export payload feeds `restore` — defanging it would silently
+  // rewrite backed-up rows whose text legitimately contains these tags.
+  safeHandler(async (args) => runExport(db, args), { verbatim: true })
 );
 
 // ─── Tool: mem_recall ────────────────────────────────────────────────────────

package/source-files.mjs

@@ -250,6 +250,9 @@ export const HOOK_SCRIPT_FILES = [
 //     as the MCP server. v3.42 audit HIGH-1.
 //   - setup.sh: run on plugin SessionStart via hooks.json. Signed for defense-in-depth
 //     (no tarball→executed-path propagation today, but it ships in files[] and is executed).
+//   - binding-probe-cli.mjs: setup.sh spawns it on every SessionStart that misses the ABI
+//     marker, and it runs `npm rebuild` — an unsigned copy would be arbitrary code executed
+//     at session start with a build step attached. Same class as setup.sh itself.
 // These ship via package.json files[] directly, not via HOOK_SCRIPT_FILES' copy path, so
 // listing them here changes ONLY what is signed/verified, not what install materializes.
 // Module-internal (spread into RELEASE_SIGNED_FILES below); not exported — no external
@@ -258,6 +261,7 @@ const LAUNCHER_SCRIPT_FILES = [
   'launch.mjs',
   'launch-preflight.mjs',
   'setup.sh',
+  'binding-probe-cli.mjs',
 ];
 
 // The complete set of files the release signature MUST cover: every runtime .mjs

package/tool-schemas.mjs

@@ -100,6 +100,17 @@ export const memSearchSchema = {
   or: coerceBool.optional().describe('Force OR semantics between query terms from the start (default: AND with automatic OR-fallback when AND returns 0). Aligns with CLI --or.'),
   deep: coerceBool.optional().describe('Tri-state LLM multi-query/HyDE deep search (observations-only). true=force; false=never; omit=AUTO (default ON for mem_search): a normal search that returns weak/few results auto-escalates with ONE Haiku call (query rewritten to keyword/concept/HyDE variants, RRF-fused). Set CLAUDE_MEM_AUTO_DEEP=0 to disable AUTO. Passive recall stays single-query.'),
   rerank: coerceBool.optional().describe('Opt-in: LLM-rerank the deep-search candidates for ranking precision (one extra Haiku call, ~1.4s). Requires deep=true (no effect on AUTO/normal). Reserve for hard, ranking-sensitive queries where the right memory is likely retrieved but mis-ranked — skip for routine search. Default off.'),
+  // ── CLI-flag aliases (v3.60.2) ──────────────────────────────────────────────
+  // A property the schema doesn't declare is STRIPPED by the validator, so a caller
+  // using the CLI vocabulary (`--source` / `--from` / `--to` / `--since`) previously
+  // got the UNFILTERED answer with nothing marking the filter as dropped — a wider
+  // result set that reads as filtered. Declaring the aliases makes the filter apply;
+  // the canonical name wins when both are supplied. Mirror of v3.59.0, which taught
+  // the CLI to accept MCP field names.
+  source: z.enum(['observations', 'sessions', 'prompts', 'events']).optional().describe('Alias for `type` (CLI `search --source`). Note: CLI `--type` is the OBSERVATION type — that is `obs_type` here.'),
+  from: z.string().optional().describe('Alias for `date_from` (CLI `search --from`)'),
+  to: z.string().optional().describe('Alias for `date_to` (CLI `search --to`)'),
+  since: z.string().optional().describe('Alias for `date_since` (CLI `search --since`)'),
 };
 
 export const memRecentSchema = {
@@ -107,6 +118,11 @@ export const memRecentSchema = {
   project: z.string().optional().describe('Filter by project (default: inferred from CWD)'),
   obs_type: OBS_TYPE_ENUM.optional().describe('Filter observation type (e.g. bugfix, decision) — CLI `recent --type` parity'),
   date_since: z.string().optional().describe('Relative lower bound from now: 7d/24h/90m/2w/30s. Only items newer than the window (pair with a high limit for "everything since X")'),
+  // CLI-flag aliases — see the note on memSearchSchema. `recent --type` IS the
+  // observation type here (unlike `search --type`, which the CLI spells `--source`),
+  // so `type` maps to obs_type on this tool.
+  type: OBS_TYPE_ENUM.optional().describe('Alias for `obs_type` (CLI `recent --type`)'),
+  since: z.string().optional().describe('Alias for `date_since` (CLI `recent --since`)'),
 };
 
 // Anchor accepts plain int, "123" string-int, or prefixed token from search output: