claude-mem-lite 3.60.1 → 3.61.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.60.1",
+      "version": "3.61.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.1",
+  "version": "3.61.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/cli/common.mjs

@@ -17,6 +17,36 @@
 export function parseArgs(argv) {
   const positional = [];
   const flags = {};
+  // Canonical flag name for a raw `--key`. Two normalizations, both aimed at the
+  // same failure: a flag nobody reads is DROPPED, and the command then answers the
+  // unfiltered question with no signal.
+  //   1. `_` → `-`: every reader in the codebase spells multi-word flags with a
+  //      hyphen (`flags['include-noise']`), so `--include_noise` was inert.
+  //   2. MCP field name → CLI flag: v3.59.0 taught the CLI to accept MCP names for
+  //      the required values (--content/--query/--ids) so a model can map a tool
+  //      schema onto flags; the FILTER fields were left out, so `--obs_type bugfix`
+  //      returned rows of every type (verified: `search redis --obs_type bugfix`
+  //      surfaced the decision row that `--type bugfix` correctly excluded).
+  // An explicitly-passed canonical flag always wins over its alias.
+  const FLAG_ALIASES = {
+    'obs-type': 'type',
+    'date-from': 'from',
+    'date-to': 'to',
+    'date-since': 'since',
+    'file-path': 'file',
+  };
+  const canonicalFlag = (raw) => {
+    const hyphenated = raw.replace(/_/g, '-');
+    return FLAG_ALIASES[hyphenated] || hyphenated;
+  };
+  const setFlag = (raw, value) => {
+    const key = canonicalFlag(raw);
+    // Alias must not clobber an explicit canonical flag; a repeated canonical flag
+    // keeps last-wins (pre-existing behavior).
+    if (key !== raw.replace(/_/g, '-') && flags[key] !== undefined) return;
+    flags[key] = value;
+  };
+
   let i = 0;
   while (i < argv.length) {
     const arg = argv[i];
@@ -29,17 +59,17 @@ export function parseArgs(argv) {
       // applied — a save landed in the wrong project / type with no error.
       const eq = body.indexOf('=');
       if (eq >= 0) {
-        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        setFlag(body.slice(0, eq), body.slice(eq + 1));
         i++;
         continue;
       }
       const key = body;
       const next = argv[i + 1];
       if (next !== undefined && !next.startsWith('--') && (!next.startsWith('-') || /^-\d/.test(next))) {
-        flags[key] = next;
+        setFlag(key, next);
         i += 2;
       } else {
-        flags[key] = true;
+        setFlag(key, true);
         i++;
       }
     } else if (arg === '-h') {
@@ -141,6 +171,11 @@ export const KNOWN_CLI_FLAGS = new Set([
   'rerank', 'resource-type', 'retain-days', 'retry', 'run', 'run-all', 'scope', 'session-audit',
   'sidechain', 'since', 'sort', 'source', 'status', 'sweep', 'task', 'tech-stack', 'text', 'tier', 'title',
   'to', 'trigger-patterns', 'type', 'use-cases', 'verbose',
+  // Catalogued 2026-08-13 when suggestUnknownFlags started reporting EVERY unknown
+  // flag: these are real, code-read flags that the old edit-distance gate happened to
+  // stay silent about (`adopt --disable/--enable`, `activity --min-importance`,
+  // `save --supersedes`). Verified by running each command and checking for a warning.
+  'disable', 'enable', 'min-importance', 'supersedes',
 ]);
 
 /** Levenshtein distance, early-exit past `max` (cheap enough for a handful of flags). */
@@ -181,7 +216,13 @@ export function suggestUnknownFlags(flags) {
       const d = editDistance(key, known);
       if (d < bestDist) { bestDist = d; best = known; }
     }
-    if (best && bestDist <= 2) result.push({ flag: key, suggestion: best });
+    // Report EVERY unknown flag; the suggestion is a bonus when a near-miss exists.
+    // Previously an unknown flag with no neighbour within distance 2 produced no
+    // output at all — the silent case, and the dangerous one: `--obs_type bugfix`
+    // (distance 4 from `type`) parsed, matched no reader, and the command answered
+    // the unfiltered question. A dropped filter that looks applied is worse than a
+    // typo, because the wider result set reads as the answer.
+    result.push({ flag: key, suggestion: best && bestDist <= 2 ? best : null });
   }
   return result;
 }

package/hook.mjs

@@ -71,7 +71,7 @@ import { buildAndSaveHandoff, detectContinuationIntent, renderHandoffInjection,
 import { checkForUpdate, getCachedUpdateBanner, isUpdateCheckDue } from './hook-update.mjs';
 import { handleLLMOptimize } from './hook-optimize.mjs';
 import { silentAutoAdopt } from './adopt-cli.mjs';
-import { emitV270UpgradeBanner } from './lib/upgrade-banner.mjs';
+import { emitV270UpgradeBanner, hasPreV270Data } from './lib/upgrade-banner.mjs';
 import { loadCiteBackForEpisode, extractCiteBackSignals, buildUnsavedBugfixHint, countUnsavedBugfixShape, buildCiteRecallNudge as libBuildCiteRecallNudge, nextCiteLowStreak } from './lib/cite-back-hint.mjs';
 import { detectUnpersistedDecision } from './lib/persist-reminder.mjs';
 // plugin-cache-guard.mjs loaded dynamically — pre-2.31.2 installs that auto-upgraded
@@ -1389,11 +1389,16 @@ async function handleSessionStart() {
     // deferred_work table (was: high-importance observations in v2.69.x).
     // Idempotent via marker file; subsequent SessionStarts are silent.
     try {
-      // Gate on prior data: a brand-new install never had v2.69.x deferred-block
-      // semantics, so the migration notice is wrong noise (it fired for every
-      // fresh install since v2.70). Only genuine upgraders with observations see it.
-      const obsCount = db.prepare('SELECT COUNT(*) AS c FROM observations WHERE project = ?').get(project)?.c || 0;
-      emitV270UpgradeBanner({ project, runtimeDir: RUNTIME_DIR, hasPriorData: obsCount > 0 });
+      // Gate on prior data OLDER THAN v2.70.0: a brand-new install never had
+      // v2.69.x deferred-block semantics, so the migration notice is wrong noise.
+      // "Any observations at all" still misfired for someone who installed today
+      // and saved a few memories before their first SessionStart — age is what
+      // actually identifies an upgrader (see lib/upgrade-banner.mjs).
+      emitV270UpgradeBanner({
+        project,
+        runtimeDir: RUNTIME_DIR,
+        hasPriorData: hasPreV270Data(db, project),
+      });
     } catch (e) { debugCatch(e, 'session-start-v270-banner'); }
 
     // Pre-load TF-IDF vocabulary cache for this session (from DB, ~1ms)

package/install.mjs

@@ -259,6 +259,37 @@ let flags = new Set(process.argv.slice(3));
 
 function log(msg) { console.log(`  ${msg}`); }
 function ok(msg) { console.log(`  ✓ ${msg}`); }
+
+/**
+ * Recursive on-disk size of `dir`, in bytes. Bounded by `maxEntries` so a
+ * surprise-large tree can never turn a progress line into a long stat storm —
+ * returns `{ bytes, truncated }` and callers render truncated sums as "≥ N MB".
+ *
+ * @param {string} dir Directory to measure (missing dir → 0 bytes).
+ * @param {number} [maxEntries=50000] Stat budget.
+ * @returns {{bytes: number, truncated: boolean}}
+ */
+function dirSizeBytes(dir, maxEntries = 50000) {
+  let bytes = 0, seen = 0, truncated = false;
+  const stack = [dir];
+  while (stack.length > 0) {
+    const cur = stack.pop();
+    let entries;
+    try { entries = readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (++seen > maxEntries) { truncated = true; return { bytes, truncated }; }
+      const p = join(cur, e.name);
+      if (e.isDirectory()) stack.push(p);
+      else if (e.isFile()) { try { bytes += statSync(p).size; } catch { /* raced away */ } }
+    }
+  }
+  return { bytes, truncated };
+}
+
+/** Render a byte count as a short human string ("148 MB"). */
+function fmtMB(bytes, truncated = false) {
+  return `${truncated ? '≥' : ''}${Math.round(bytes / 1048576)} MB`;
+}
 function warn(msg) { console.log(`  ⚠ ${msg}`); }
 function fail(msg) { console.log(`  ✗ ${msg}`); }
 
@@ -797,6 +828,23 @@ if (process.env.CLAUDE_MEM_SKIP_REPOS) {
         repos.get(r.repo).push(r);
       }
 
+      // Disclose the cost BEFORE spending it. This step is the single largest
+      // thing `install` does — N shallow git clones over the network, ~150 MB on
+      // disk for the default manifest — and it used to announce itself only after
+      // the fact ("Repos: 15 cloned"). A first-time user on a metered link or a
+      // small disk had no warning and no visible way out; the opt-out existed but
+      // lived only in an env var no output ever mentioned.
+      // Count only repos not already on disk — a re-run/update clones nothing, and
+      // announcing "cloning 15 repos" every time would be false.
+      const repoDirName = (repoUrl) =>
+        repoUrl.split('/').slice(-2).join('-').replace(/[^a-zA-Z0-9._-]/g, '_');
+      const pendingClones = [...repos.keys()]
+        .filter(repoUrl => !existsSync(join(managedDir, 'repos', repoDirName(repoUrl)))).length;
+      if (pendingClones > 0) {
+        log(`Skill/agent registry: cloning ${pendingClones} repo(s) — network + ~150 MB on disk.`);
+        log('  Skip with CLAUDE_MEM_SKIP_REPOS=1 (memory features work without it).');
+      }
+
       let cloned = 0, updated = 0;
       const deadRepos = new Set(); // repos that no longer exist (404)
 
@@ -907,8 +955,10 @@ if (process.env.CLAUDE_MEM_SKIP_REPOS) {
           }
         }
       }
+      const managedSize = dirSizeBytes(managedDir);
       ok(`Repos: ${cloned} cloned, ${updated} updated, ${repos.size - deadRepos.size} active` +
-         (deadRepos.size > 0 ? `, ${deadRepos.size} dead removed` : ''));
+         (deadRepos.size > 0 ? `, ${deadRepos.size} dead removed` : '') +
+         ` (${fmtMB(managedSize.bytes, managedSize.truncated)} in ${managedDir})`);
 
       // 6b. Init registry DB and record preinstalled entries
       const { ensureRegistryDb } = await importFromInstall('registry.mjs');

package/lib/upgrade-banner.mjs

@@ -7,6 +7,37 @@
 import { writeFileSync, existsSync } from 'fs';
 import { join } from 'path';
 
+// v2.70.0 shipped 2026-05-10 (CHANGELOG "v2.70.0 — first-class deferred work").
+// Only observations that already existed then could have been rendered under the
+// v2.69.x deferred-block semantics this banner describes.
+export const V270_RELEASE_EPOCH = Date.UTC(2026, 4, 10);
+
+/**
+ * True when the project holds observations old enough to have lived under the
+ * v2.69.x deferred-block semantics.
+ *
+ * The original guard was `any observations at all`, which still fires for someone
+ * who installed today and saved a few memories before their first SessionStart —
+ * they get a migration notice about a release 40+ versions back, ending in "Pin to
+ * 2.69.x to revert" (advice that would downgrade them past every feature they just
+ * installed). Age is the property that actually distinguishes an upgrader.
+ *
+ * @param {object} db Open better-sqlite3 handle.
+ * @param {string} project Project name.
+ * @returns {boolean} false on any query failure — suppressing a stale banner is the
+ *   safe direction (§ fail-quiet: a missed notice costs less than a wrong one).
+ */
+export function hasPreV270Data(db, project) {
+  try {
+    const row = db.prepare(
+      'SELECT 1 AS hit FROM observations WHERE project = ? AND created_at_epoch < ? LIMIT 1'
+    ).get(project, V270_RELEASE_EPOCH);
+    return !!row;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * One-shot stderr banner on first SessionStart after v2.70.0 upgrade.
  * Notifies users that the `### Deferred Work` block now reads from the

package/mem-cli.mjs

@@ -3192,7 +3192,9 @@ export async function run(argv) {
   // when a flag looks like a misspelling of a real one; stdout + exit code stay untouched,
   // so JSON/text consumers are unaffected. Mirrors the unknown-COMMAND suggester in cli.mjs.
   for (const { flag, suggestion } of suggestUnknownFlags(parseArgs(cmdArgs).flags)) {
-    process.stderr.write(`[mem] Unknown flag --${flag}; did you mean --${suggestion}?\n`);
+    process.stderr.write(suggestion
+      ? `[mem] Unknown flag --${flag}; did you mean --${suggestion}?\n`
+      : `[mem] Unknown flag --${flag} — ignored (it filtered nothing). Run "claude-mem-lite help" for this command's flags.\n`);
   }
 
   // adopt / unadopt do pure filesystem work on ~/.claude/projects/<encoded>/memory/ —

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.1",
+  "version": "3.61.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.60.1",
+      "version": "3.61.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.60.1",
+  "version": "3.61.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/user-prompt-search.js

@@ -114,6 +114,60 @@ const OR_TOP_BM25_FLOOR = TOP_REL_FLOOR === 0
   ? 0
   : Number(process.env.CLAUDE_MEM_UPS_OR_BM25_MIN || 30);
 
+// ─── Corpus-size normalization of the absolute floors (v3.60.2) ─────────────
+//
+// Both floors above are ABSOLUTE magnitudes, but the quantity they gate is not
+// scale-free: FTS5 bm25 carries an IDF term ≈ ln(N/df), so the SAME hit scores
+// higher on a bigger index. Measured on one fixed query + one fixed target row,
+// padding the corpus with distinct filler (2026-08-13 dogfood):
+//
+//   totalObs   10     40     100    300
+//   top|bm25|  10.0   18.6   24.2   30.7      ← same row, same query
+//
+// The floors were calibrated at `projects--mem, 584 obs` (CHANGELOG v2.43.x /
+// v2.34.3). Comparing a log-N quantity against that constant therefore does not
+// mean "weak match" on a small index — it means "small index". A brand-new
+// install measured 0/8 injections on a realistic first-day corpus (10 memories,
+// 8 recall questions whose correct target ranked #1 in 4/5 scored cases): every
+// one was dropped by the OR floor at |bm25| 3.8–15.2 < 30. The plugin is inert
+// during exactly the window where a new user decides whether it earns its keep.
+//
+// Fix: scale both floors by ln(N+1)/ln(N_REF+1), capped at 1.0 — the same log
+// shape the IDF term has, so the SIGNAL↔NOISE separation the maintainer measured
+// (signal ≥41, noise ≤22 at N_REF) is preserved proportionally at any N. At
+// N ≥ N_REF the factor is exactly 1.0, so every established install keeps
+// byte-identical behavior; only genuinely-new installs relax.
+//
+// N counts the WHOLE observations table, not the project: FTS5 computes IDF over
+// the entire index and `o.project = ?` is a post-MATCH filter. Verified — a
+// 2-row project on a 302-row install scores 31.5, matching the 300-row global
+// baseline, not the 10-row one. So a new project on an established install is
+// (correctly) unaffected by this ramp.
+const FLOOR_REF_CORPUS = Number(process.env.CLAUDE_MEM_UPS_FLOOR_REF_CORPUS || 584);
+
+/**
+ * Scale factor in (0, 1] for the absolute score floors, by total corpus size.
+ *
+ * Short-circuits with a bounded probe: if a row exists at offset N_REF-1 the
+ * corpus is at or above the reference and the factor is 1.0 — no COUNT scan on
+ * the large corpora where the answer is always 1.0 anyway.
+ *
+ * @param {object} db Open better-sqlite3 handle.
+ * @returns {number} Multiplier for TOP_REL_FLOOR / OR_TOP_BM25_FLOOR.
+ */
+export function corpusFloorScale(db) {
+  if (FLOOR_REF_CORPUS <= 1) return 1;
+  try {
+    const atRef = db.prepare('SELECT 1 FROM observations LIMIT 1 OFFSET ?').get(FLOOR_REF_CORPUS - 1);
+    if (atRef) return 1;
+    const { c = 0 } = db.prepare('SELECT count(*) AS c FROM observations').get() || {};
+    return Math.min(1, Math.log(c + 1) / Math.log(FLOOR_REF_CORPUS + 1));
+  } catch {
+    // Any probe failure → behave exactly as before the ramp existed.
+    return 1;
+  }
+}
+
 function isFollowUpSession() {
   try {
     const raw = readFileSync(INJECTED_IDS_FILE, 'utf8');
@@ -735,9 +789,14 @@ async function main() {
       // is a precision signal and routinely produces legitimate AND hits
       // below raw |bm25|=20 that we do not want to drop (see GOOD-narrow
       // probe). Skip gate when OR_TOP_BM25_FLOOR is set to 0 (test hook).
-      if (ftsMode === 'OR' && OR_TOP_BM25_FLOOR > 0 && ftsRows.length > 0) {
+      // Both absolute floors are normalized by corpus size (corpusFloorScale) —
+      // factor 1.0 for any install at/above the calibration corpus, so this is a
+      // no-op for established users and a proportional relaxation for new ones.
+      const floorScale = corpusFloorScale(db);
+      const orFloor = OR_TOP_BM25_FLOOR * floorScale;
+      if (ftsMode === 'OR' && orFloor > 0 && ftsRows.length > 0) {
         const topBm25 = Math.abs(ftsRows[0].bm25_raw || 0);
-        if (topBm25 < OR_TOP_BM25_FLOOR) ftsRows = [];
+        if (topBm25 < orFloor) ftsRows = [];
       }
 
       // v2.34.3: top-|rel| sanity gate. Per-row filtering above leaves noise
@@ -746,7 +805,7 @@ async function main() {
       // whole FTS set — noise prompts should produce no FTS injection.
       // Query orders by `relevance` ASC; negative values → ftsRows[0] has the
       // largest magnitude (strongest match) in this scoring expression.
-      if (ftsRows.length > 0 && Math.abs(ftsRows[0].relevance) < TOP_REL_FLOOR) {
+      if (ftsRows.length > 0 && Math.abs(ftsRows[0].relevance) < TOP_REL_FLOOR * floorScale) {
         ftsRows = [];
       }
 

package/secret-scrub.mjs

@@ -30,8 +30,18 @@ export const SECRET_PATTERNS = [
   // value is covered (the hex-only assignment pattern below misses non-hex values).
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
   [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
-  //   1b. `:` separator → keep the prose lookbehind ("the token: alice" is prose):
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  //   1b. `:` separator, PASSWORD nouns → always scrub. The prose lookbehind below
+  //       was originally applied to the whole noun class, which meant any credential
+  //       noun preceded by an English word escaped — so a session narrative like
+  //       "deployed to staging, the db password: hunter2correct" persisted the
+  //       password in plaintext and re-injected it into every later context block
+  //       (R5 dogfood, 2026-08-13). Unlike `token`/`bearer`/`secret`, the pinned
+  //       prose set (#8283) contains no `password|passwd|passphrase` case: writing
+  //       "<word> password: <6+ chars>" names a credential, it is not conversational
+  //       usage. Letter-glued non-keywords (`mypassword:`) still miss via `(?:\b|_)`.
+  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  //   1c. `:` separator, prose-ambiguous nouns → keep the lookbehind ("the token: alice"):
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
   // access_token / refresh_token are the canonical OAuth2 field names — they were
   // missing from this KV list (drift vs the JSON list below). `(?:\b|_)` for the same
   // underscore-prefix reason.
@@ -61,7 +71,8 @@ export const SECRET_PATTERNS = [
   //       (mirrors the unquoted 1a/1b split — a quoted value doesn't turn `:` prose
   //       into config, but `<word> password="x"` is still a leak):
   [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [/((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],

package/server.mjs

@@ -28,6 +28,7 @@ import { TIER_CASE_SQL, tierSqlParams } from './tier.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
 import { buildLessonNudge } from './lib/save-nudge.mjs';
 import { formatObsFieldValue } from './cli/common.mjs';
+import { neutralizeContextDelimiters } from './format-utils.mjs';
 import { memSearchSchema, memRecentSchema, memTimelineSchema, memGetSchema, memDeleteSchema, memSaveSchema, memStatsSchema, memCompressSchema, memMaintainSchema, memOptimizeSchema, memUpdateSchema, memExportSchema, memRecallSchema, memFtsCheckSchema, memRegistrySchema, memBrowseSchema, memUseSchema, memDeferSchema, memDeferListSchema, memDeferDropSchema, tools as TOOL_DEFS } from './tool-schemas.mjs';
 
 // Lookup helper: all user-facing tool descriptions live in tool-schemas.mjs
@@ -157,14 +158,76 @@ const server = new McpServer(
 let lastMcpRequestTime = Date.now();
 let idleCleanupRan = false;
 
-function safeHandler(fn) {
+/**
+ * Defang structural context delimiters in every text block of a tools/call result.
+ *
+ * A tools/call payload IS model context — unlike CLI stdout there is no human between
+ * the DB row and the transcript. Observations are stored raw on purpose (defense lives
+ * at the injection boundary, not at save), and every HOOK surface already neutralizes
+ * before writing to the model (buildSessionContextLines / formatMemoryLine /
+ * formatErrorRecallHints / renderHandoffFromRow / pre-tool-recall). The MCP read tools
+ * were the one model-facing family left raw, so a memory carrying a forged
+ * `<system-reminder>` replayed verbatim into a mem_search result — reinstating exactly
+ * the channel the hook-side defang closes. Applied at the single handler chokepoint so
+ * a newly registered tool is covered by construction (§9 parallel-path completeness).
+ *
+ * Error payloads go through it too: `err.message` can echo caller-supplied text.
+ *
+ * @param {object} result Tool result ({ content: [{type,text}], … }).
+ * @returns {object} Same shape with text blocks neutralized.
+ */
+/**
+ * Fold CLI-flag aliases onto their canonical MCP field names.
+ *
+ * The schemas declare both spellings (see tool-schemas.mjs); this is where the alias
+ * actually takes effect. Canonical wins when both are present — an explicit canonical
+ * value is the more specific intent, and silently letting an alias override it would
+ * reintroduce the same class of surprise the aliases exist to remove.
+ *
+ * @param {object} args Raw validated tool arguments.
+ * @param {Record<string,string>} pairs alias → canonical field name.
+ * @returns {object} New args object (never mutates the caller's).
+ */
+function applyArgAliases(args, pairs) {
+  if (!args || typeof args !== 'object') return args;
+  let next = args;
+  for (const [alias, canonical] of Object.entries(pairs)) {
+    if (next[alias] !== undefined && next[canonical] === undefined) {
+      if (next === args) next = { ...args };
+      next[canonical] = next[alias];
+    }
+  }
+  return next;
+}
+
+function defangResult(result) {
+  if (!result || !Array.isArray(result.content)) return result;
+  return {
+    ...result,
+    content: result.content.map(c =>
+      c && c.type === 'text' && typeof c.text === 'string'
+        ? { ...c, text: neutralizeContextDelimiters(c.text) }
+        : c
+    ),
+  };
+}
+
+/**
+ * @param {Function} fn Tool handler.
+ * @param {object} [opts]
+ * @param {boolean} [opts.verbatim=false] Skip the defang pass. Only for payloads that
+ *   must round-trip byte-exact — `mem_export` feeds `restore`, so neutralizing it would
+ *   silently corrupt backups of any memory that legitimately discusses these tags.
+ */
+function safeHandler(fn, { verbatim = false } = {}) {
   return async (args, extra) => {
     try {
       lastMcpRequestTime = Date.now();
       idleCleanupRan = false;
-      return await fn(args, extra);
+      const result = await fn(args, extra);
+      return verbatim ? result : defangResult(result);
     } catch (err) {
-      return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+      return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
     }
   };
 }
@@ -258,6 +321,10 @@ export async function handleSearchForTest(db, args, { llm, rerankLlm } = {}) {
 
 async function runSearchPipeline(db, args, { llm, rerankLlm } = {}) {
   if (args.project) args = { ...args, project: _resolveProjectShared(db, args.project) };
+  // CLI-flag aliases: --source/--from/--to/--since. Folded before any read of the
+  // canonical names below, so every downstream filter sees them.
+  args = applyArgAliases(args, { source: 'type', from: 'date_from', to: 'date_to', since: 'date_since' });
+
   const limit = args.limit ?? 20;
   const offset = args.offset ?? 0;
   // args.or: force OR from the start (CLI `search --or` parity). The default path
@@ -390,6 +457,8 @@ export async function handleRecentForTest(db, args) {
 }
 
 async function runRecent(db, args) {
+  // CLI-flag aliases: `recent --type` is the OBSERVATION type here, `--since` the window.
+  args = applyArgAliases(args, { type: 'obs_type', since: 'date_since' });
   if (args.project) args = { ...args, project: _resolveProjectShared(db, args.project) };
   const limit = args.limit ?? 10;
   const project = args.project || inferProject();
@@ -1674,7 +1743,9 @@ server.registerTool(
     description: descriptionOf('mem_export'),
     inputSchema: memExportSchema,
   },
-  safeHandler(async (args) => runExport(db, args))
+  // verbatim: the export payload feeds `restore` — defanging it would silently
+  // rewrite backed-up rows whose text legitimately contains these tags.
+  safeHandler(async (args) => runExport(db, args), { verbatim: true })
 );
 
 // ─── Tool: mem_recall ────────────────────────────────────────────────────────

package/tool-schemas.mjs

@@ -100,6 +100,17 @@ export const memSearchSchema = {
   or: coerceBool.optional().describe('Force OR semantics between query terms from the start (default: AND with automatic OR-fallback when AND returns 0). Aligns with CLI --or.'),
   deep: coerceBool.optional().describe('Tri-state LLM multi-query/HyDE deep search (observations-only). true=force; false=never; omit=AUTO (default ON for mem_search): a normal search that returns weak/few results auto-escalates with ONE Haiku call (query rewritten to keyword/concept/HyDE variants, RRF-fused). Set CLAUDE_MEM_AUTO_DEEP=0 to disable AUTO. Passive recall stays single-query.'),
   rerank: coerceBool.optional().describe('Opt-in: LLM-rerank the deep-search candidates for ranking precision (one extra Haiku call, ~1.4s). Requires deep=true (no effect on AUTO/normal). Reserve for hard, ranking-sensitive queries where the right memory is likely retrieved but mis-ranked — skip for routine search. Default off.'),
+  // ── CLI-flag aliases (v3.60.2) ──────────────────────────────────────────────
+  // A property the schema doesn't declare is STRIPPED by the validator, so a caller
+  // using the CLI vocabulary (`--source` / `--from` / `--to` / `--since`) previously
+  // got the UNFILTERED answer with nothing marking the filter as dropped — a wider
+  // result set that reads as filtered. Declaring the aliases makes the filter apply;
+  // the canonical name wins when both are supplied. Mirror of v3.59.0, which taught
+  // the CLI to accept MCP field names.
+  source: z.enum(['observations', 'sessions', 'prompts', 'events']).optional().describe('Alias for `type` (CLI `search --source`). Note: CLI `--type` is the OBSERVATION type — that is `obs_type` here.'),
+  from: z.string().optional().describe('Alias for `date_from` (CLI `search --from`)'),
+  to: z.string().optional().describe('Alias for `date_to` (CLI `search --to`)'),
+  since: z.string().optional().describe('Alias for `date_since` (CLI `search --since`)'),
 };
 
 export const memRecentSchema = {
@@ -107,6 +118,11 @@ export const memRecentSchema = {
   project: z.string().optional().describe('Filter by project (default: inferred from CWD)'),
   obs_type: OBS_TYPE_ENUM.optional().describe('Filter observation type (e.g. bugfix, decision) — CLI `recent --type` parity'),
   date_since: z.string().optional().describe('Relative lower bound from now: 7d/24h/90m/2w/30s. Only items newer than the window (pair with a high limit for "everything since X")'),
+  // CLI-flag aliases — see the note on memSearchSchema. `recent --type` IS the
+  // observation type here (unlike `search --type`, which the CLI spells `--source`),
+  // so `type` maps to obs_type on this tool.
+  type: OBS_TYPE_ENUM.optional().describe('Alias for `obs_type` (CLI `recent --type`)'),
+  since: z.string().optional().describe('Alias for `date_since` (CLI `recent --since`)'),
 };
 
 // Anchor accepts plain int, "123" string-int, or prefixed token from search output: