claude-mem-lite 3.63.0 → 3.65.0

package/lib/inject-search-core.mjs

@@ -0,0 +1,87 @@
+// lib/inject-search-core.mjs — the retrieval-side shared core (P2-11, audit
+// 2026-08-14; second cut D#123, 2026-08-16). Shared home for the three SQL
+// atoms that kept drifting across hand-copied twins — first on the five
+// injection-side surfaces, then extended across the remaining read surfaces
+// (hook-context / hook-handoff / hook-optimize / mem-cli / search-scoring /
+// tfidf / deep-search / recall-core / recent-core / timeline-core / stats-core /
+// search-core incl. its sessions+events decay arms / maintain-core; the ledger
+// test enforces the full list). Deliberate compressed-only singles (maintain
+// UPDATE guards, stats noise-gauge counts, export tombstone toggles, session-own
+// history) stay inline — see the ledger test's non-member notes:
+//
+//   * live-row filter        — the compressed+superseded pair whose omission was
+//                              the superseded-invariant's recurring reopening
+//                              (7th occurrence fixed in v3.63 H-1, write-side)
+//   * clamped recency decay  — the MAX(0,…) age clamp (audit M-1: a far-future
+//                              created_at from restore/import-jsonl EXP-overflowed
+//                              and pinned that row #1; the fix reached
+//                              search-engine but not the UPS/error-recall twins)
+//   * injection relevance    — the full multiplicative chain incl. cite/noise
+//                              behavior factors (audit M-3: wired on every auto
+//                              surface, missing from the explicit-surface score)
+//
+// Each surface keeps its own deliberate pipeline composition (BM25-sort + JS
+// scoring vs SQL full chain vs file-keyed sort — see #8786: per-surface
+// asymmetries stay explicit); only the ATOMS are shared.
+// tests/inject-search-core.test.mjs holds the ledger: consumer files must
+// compose these builders, never re-inline copies (and the decay shape may not
+// be hand-rolled anywhere, benchmark included).
+//
+// Lives under lib/ (not scripts/) so hook.mjs can statically import it without
+// colliding with the installExtractedRelease scripts-dir rename (same constraint
+// as lib/mem-override.mjs). Dependency-light by design: pre-tool-recall's
+// standalone fast-path (#8447) already imports scoring-sql.mjs.
+
+import {
+  OBS_BM25, TYPE_DECAY_CASE, TYPE_QUALITY_CASE,
+  noisePenaltyClause, citeFactorClause,
+} from '../scoring-sql.mjs';
+
+/**
+ * Live-row filter: rows a model-facing retrieval surface may return. Excludes
+ * compression tombstones (positive keeper ids AND -2 pending-purge) and
+ * superseded rows (a retracted lesson must never outrank its correction).
+ * @param {string} [alias='o'] table alias; '' for unqualified single-table queries
+ * @returns {string} SQL boolean expression (no leading AND)
+ */
+export function liveObsFilterSql(alias = 'o') {
+  const a = alias ? `${alias}.` : '';
+  return `COALESCE(${a}compressed_into, 0) = 0 AND ${a}superseded_at IS NULL`;
+}
+
+/**
+ * Clamped recency-decay factor: (1 + EXP(-ln2 · age / halfLife)), age >= 0.
+ * The MAX(0,…) clamp is the M-1 fix — restore/import-jsonl accept arbitrary
+ * epochs, and an unclamped future timestamp makes the exponent large-positive →
+ * EXP overflows to +Infinity → that row sorts #1 for every query (and its score
+ * serializes as null). A future row reads as age 0 = max finite recency instead.
+ * Binds one `?` placeholder: the caller passes `now` (epoch ms) at that position.
+ * @param {object} opts
+ * @param {string} opts.tsExpr - SQL expression for the row's reference timestamp
+ *   (e.g. 'o.created_at_epoch', or the created/last-accessed MAX search-engine uses)
+ * @param {string} [opts.halfLifeSql=TYPE_DECAY_CASE] - SQL expression for the
+ *   half-life in ms (constant or per-type CASE; TYPE_DECAY_CASE assumes alias 'o')
+ * @returns {string} SQL numeric expression (parenthesized)
+ */
+export function recencyDecaySql({ tsExpr, halfLifeSql = TYPE_DECAY_CASE }) {
+  return `(1.0 + EXP(-0.693 * MAX(0, ? - ${tsExpr}) / ${halfLifeSql}))`;
+}
+
+/**
+ * Injection relevance: the full multiplicative chain the prompt-time injection
+ * surface (UPS searchByFts) ranks by — BM25 × clamped type-decay × type-quality
+ * × importance × noise penalty × cite factor. Alias is fixed to 'o' because
+ * TYPE_DECAY_CASE / TYPE_QUALITY_CASE bake that alias in.
+ * Binds one `?` placeholder (the decay `now`), first in parameter order.
+ * @param {string} [alias='o'] must be 'o'
+ * @returns {string} SQL numeric expression
+ */
+export function injectionRelevanceSql(alias = 'o') {
+  if (alias !== 'o') throw new Error('injectionRelevanceSql: alias must be "o" (TYPE_*_CASE bake it in)');
+  return `${OBS_BM25}
+             * ${recencyDecaySql({ tsExpr: 'o.created_at_epoch' })}
+             * ${TYPE_QUALITY_CASE}
+             * (0.5 + 0.5 * COALESCE(o.importance, 1))
+             * ${noisePenaltyClause('o')}
+             * ${citeFactorClause('o')}`;
+}

package/lib/injected-ids.mjs

@@ -0,0 +1,49 @@
+// lib/injected-ids.mjs — file-name derivation for the cross-hook injected-ids
+// dedup marker. Single source of truth for user-prompt-search.js (writer),
+// pre-tool-recall.js (read/merge), and hook.mjs (path-A reader): all three must
+// derive the same name or cross-hook dedup silently goes blind.
+//
+// D#120: M-6 session-keyed the marker's PAYLOAD but kept ONE file per project,
+// so two concurrent CC windows full-replaced each other's marker — no dedup
+// between them and `count` reset on every alternation (MAX_SESSION_INJECTIONS
+// unreachable). One file per SESSION instead, mirroring
+// pre-recall-cooldown-<session>.json in the same runtime dir. GC: session-start
+// sweep in hook.mjs (24h mtime, same policy as the cooldown files).
+//
+// Lives under lib/ (not scripts/) so hook.mjs can statically import it without
+// colliding with the scripts/ directory rename in installExtractedRelease —
+// same constraint as lib/mem-override.mjs.
+
+/**
+ * Runtime-dir FILE NAME for the injected-ids marker (no directory component).
+ * No sessionId → legacy project-keyed name (env-less harnesses, old callers).
+ * @param {string} project - inferProject() value (already filename-safe)
+ * @param {string} [sessionId] - CC session id
+ * @returns {string}
+ */
+export function injectedIdsFileName(project, sessionId) {
+  const base = `.claude-mem-injected-${project}`;
+  if (!sessionId) return base;
+  const safe = String(sessionId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 64);
+  return `${base}-${safe}`;
+}
+
+/**
+ * Runtime-dir FILE NAME for the SessionStart Key Context marker: the obs ids
+ * ACTUALLY rendered into the <claude-mem-context> File Lessons / Key Context
+ * sections (empty under quiet/adopted). handleUserPrompt reads it as its
+ * exclude-set — D#123 review C-1: excluding the injector's QUERY result instead
+ * of what was really shown suppressed <memory-context> injection outright on
+ * quiet/adopted projects, where Key Context never renders at all.
+ * Session-lifetime validity (no time window): the SessionStart block stays in
+ * context for the whole session. Swept with the same 24h GC as the marker above.
+ * @param {string} project - inferProject() value (already filename-safe)
+ * @param {string} [sessionId] - CC session id
+ * @returns {string}
+ */
+export function keyContextIdsFileName(project, sessionId) {
+  const base = `.claude-mem-keyctx-${project}`;
+  if (!sessionId) return base;
+  const safe = String(sessionId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 64);
+  return `${base}-${safe}`;
+}

package/lib/maintain-core.mjs

@@ -15,6 +15,7 @@
 import { COMPRESSED_PENDING_PURGE, computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity } from '../utils.mjs';
 import { rebuildVocabulary, computeVector, _resetVocabCache, vectorsEnabled, vecTextForRow } from '../tfidf.mjs';
 import { DEDUP_JACCARD_THRESHOLD, MINHASH_PRE_THRESHOLD as MINHASH_PRE_THRESHOLD_SRC, FUZZY_DEDUP_THRESHOLD, FUZZY_BODY_THRESHOLD, MINHASH_PREFILTER } from './dedup-constants.mjs';
+import { liveObsFilterSql } from './inject-search-core.mjs';
 
 export const STALE_AGE_MS = 30 * 86400000;
 export const OP_CAP = 1000;
@@ -132,9 +133,8 @@ export function recoverOrphanedChildren(db, { projectFilter = '', baseParams = [
 export function recoverBuriedLessons(db, { projectFilter = '', baseParams = [] } = {}) {
   return db.prepare(`
     UPDATE observations SET importance = 1
-    WHERE COALESCE(compressed_into, 0) = 0
+    WHERE ${liveObsFilterSql('')}
       AND COALESCE(importance, 1) = 0
-      AND superseded_at IS NULL
       AND lesson_learned IS NOT NULL AND lesson_learned <> '' AND lower(lesson_learned) <> 'none'
       ${projectFilter}
   `).run(...baseParams).changes;
@@ -453,7 +453,7 @@ export function rebuildVectors(db) {
   if (!vocab) return { ok: false, reason: 'no observations to build vocabulary from' };
   const allObs = db.prepare(`
     SELECT id, title, narrative, concepts, lesson_learned, search_aliases FROM observations
-    WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL
+    WHERE ${liveObsFilterSql('')}
   `).all();
   let updated = 0;
   const insertStmt = db.prepare('INSERT OR REPLACE INTO observation_vectors (observation_id, vector, vocab_version, created_at_epoch) VALUES (?, ?, ?, ?)');

package/lib/observation-write.mjs

@@ -9,7 +9,7 @@
 // + vector writes in one db.transaction so a failure can't leave a partial row).
 
 import { getVocabulary, computeVector, vectorsEnabled } from '../tfidf.mjs';
-import { debugCatch, cjkBigrams } from '../utils.mjs';
+import { debugCatch, cjkBigrams, scrubSecrets } from '../utils.mjs';
 
 // Canonical column order — must mirror the observations schema (schema.mjs).
 const OBS_COLUMNS = [
@@ -84,7 +84,9 @@ export function insertObservationVector(db, obsId, vecText) {
  * block — the same drift class #8614/#8639 closed for compress/maintain. Caller
  * owns the transaction (vector write is internally non-critical).
  */
-export function rebuildObservationDerived(db, obsId) {
+// P2-12: internal-only since applyObsUpdate became the single update choke point
+// (both faces previously imported this directly; un-exported per knip discipline).
+function rebuildObservationDerived(db, obsId) {
   const row = db.prepare('SELECT title, subtitle, narrative, concepts, facts, lesson_learned, search_aliases FROM observations WHERE id = ?').get(obsId);
   if (!row) return;
   const base = [row.title, row.subtitle, row.narrative, row.concepts, row.facts, row.lesson_learned, row.search_aliases].filter(Boolean).join(' ');
@@ -93,3 +95,37 @@ export function rebuildObservationDerived(db, obsId) {
   db.prepare('UPDATE observations SET text = ? WHERE id = ?').run(textField, obsId);
   insertObservationVector(db, obsId, textField);
 }
+
+// P2-12 (audit 2026-08-14): shared update mutation for the CLI `update` / MCP
+// `mem_update` twin. Both faces previously built the SET list + ran the
+// transaction + rebuild inline (byte-equivalent copies); each keeps its own
+// validation front-end (CLI flag guards / MCP zod) and passes only the fields
+// it accepted. String values are secret-scrubbed here — the single choke point,
+// so a new face can't forget it (concepts had already slipped through once).
+const UPDATABLE_OBS_COLS = ['title', 'narrative', 'type', 'importance', 'lesson_learned', 'concepts'];
+
+/**
+ * Apply a validated field patch to one observation: UPDATE + derived-column
+ * rebuild (FTS text + vector) in one transaction.
+ * @param {import('better-sqlite3').Database} db
+ * @param {number} id - observation id (caller has verified existence)
+ * @param {object} fields - subset of {title, narrative, type, importance, lesson_learned, concepts}
+ * @returns {string[]} column names actually updated ([] = nothing to do, no write)
+ */
+export function applyObsUpdate(db, id, fields) {
+  const updates = [];
+  const params = [];
+  for (const col of UPDATABLE_OBS_COLS) {
+    if (fields[col] !== undefined) {
+      updates.push(`${col} = ?`);
+      params.push(typeof fields[col] === 'string' ? scrubSecrets(fields[col]) : fields[col]);
+    }
+  }
+  if (updates.length === 0) return [];
+  params.push(id);
+  db.transaction(() => {
+    db.prepare(`UPDATE observations SET ${updates.join(', ')} WHERE id = ?`).run(...params);
+    rebuildObservationDerived(db, id);
+  })();
+  return updates.map((u) => u.split(' =')[0]);
+}

package/lib/recall-core.mjs

@@ -7,6 +7,7 @@
 
 import { basename } from 'path';
 import { notLowSignalTitleClause } from '../utils.mjs';
+import { liveObsFilterSql } from './inject-search-core.mjs';
 
 /**
  * Recall observations linked to a file (basename or full path). Returns
@@ -31,8 +32,7 @@ export function recallByFile(db, file, { limit = 10, includeNoise = false } = {}
                     o.created_at, o.created_at_epoch, o.project
     FROM observations o
     JOIN observation_files of2 ON of2.obs_id = o.id
-    WHERE COALESCE(o.compressed_into, 0) = 0
-      AND o.superseded_at IS NULL
+    WHERE ${liveObsFilterSql('o')}
       AND (of2.filename = ? OR of2.filename LIKE ? ESCAPE '\\')
       ${noiseClause}
     ORDER BY o.created_at_epoch DESC

package/lib/recent-core.mjs

@@ -14,6 +14,8 @@
 // MCP wants `project`) — same convention as recall-core, so neither surface needs
 // its own SELECT list.
 
+import { liveObsFilterSql } from './inject-search-core.mjs';
+
 const RECENT_COLS = 'id, type, title, subtitle, importance, project, created_at, created_at_epoch';
 
 // Upper bound on rows a single `recent` call may pull, shared so the cap can't
@@ -38,7 +40,7 @@ export const RECENT_MAX = 1000;
  */
 export function fetchRecent(db, { project = null, type = null, since = null, limit = 10 } = {}) {
   const params = [];
-  const wheres = ['COALESCE(compressed_into, 0) = 0', 'superseded_at IS NULL'];
+  const wheres = [liveObsFilterSql('')];
   if (project) { wheres.push('project = ?'); params.push(project); }
   if (type) { wheres.push('type = ?'); params.push(type); }
   if (Number.isFinite(since)) { wheres.push('created_at_epoch >= ?'); params.push(since); }

package/lib/search-core.mjs

@@ -29,6 +29,7 @@ import { cjkPrecisionOk, extractCjkLikePatterns } from '../nlp.mjs';
 import { computeTier } from '../tier.mjs';
 import { countSearchTotal, attachBodyTokens } from '../search-engine.mjs';
 import { notLowSignalTitleClause } from '../scoring-sql.mjs';
+import { liveObsFilterSql, recencyDecaySql } from './inject-search-core.mjs';
 
 /** Sanitize a user query to FTS5 syntax; optionally force OR semantics. */
 export function buildSearchFtsQuery(query, { or = false } = {}) {
@@ -146,7 +147,7 @@ export function searchSessionsFts(db, { ftsQuery, project = null, projectBoost =
   return db.prepare(`
     SELECT s.id, s.request, s.completed, s.project, s.created_at, s.created_at_epoch,
            ${SESS_BM25}
-             * (1.0 + EXP(-0.693 * MAX(0, ? - s.created_at_epoch) / ${DEFAULT_DECAY_HALF_LIFE_MS}.0))
+             * ${recencyDecaySql({ tsExpr: 's.created_at_epoch', halfLifeSql: `${DEFAULT_DECAY_HALF_LIFE_MS}.0` })}
              * (CASE WHEN ? IS NOT NULL AND s.project = ? THEN 2.0 ELSE 1.0 END) as score
     FROM session_summaries_fts
     JOIN session_summaries s ON session_summaries_fts.rowid = s.id
@@ -235,7 +236,7 @@ export function searchEventsFts(db, { ftsQuery, project = null, projectBoost = n
   return db.prepare(`
     SELECT e.id, e.event_type, e.title, e.body, e.project, e.importance, e.file_paths, e.created_at_epoch,
            ${EVT_BM25}
-             * (1.0 + EXP(-0.693 * MAX(0, ? - e.created_at_epoch) / ${DEFAULT_DECAY_HALF_LIFE_MS}.0))
+             * ${recencyDecaySql({ tsExpr: 'e.created_at_epoch', halfLifeSql: `${DEFAULT_DECAY_HALF_LIFE_MS}.0` })}
              * (CASE WHEN ? IS NOT NULL AND e.project = ? THEN 2.0 ELSE 1.0 END) as score
     FROM events_fts
     JOIN events e ON events_fts.rowid = e.id
@@ -258,7 +259,16 @@ export function searchEventsFts(db, { ftsQuery, project = null, projectBoost = n
 // obs/event/session BM25 live on comparable scales (weighted bm25 × decay ×
 // project-boost), so the ratio is meaningful there; small-scale sources (prompts,
 // bm25 ≈ -1) can only be penalized by this comparison, never inflated — the safe
-// direction. Bands (ratio = |lone| / globalMaxAbs, first match wins):
+// direction.
+// D#121 (2026-08-16): obs FULL_SCORE additionally carries citeFactor (0.4–3.0) ×
+// noisePenalty (0.2–1.0) — behavior state events/sessions never have. A heavily-
+// cited obs can therefore widen globalMaxAbs and demote a lone event's band: this
+// is ACCEPTED direction (cite is genuine relevance evidence), and it is BOUNDED —
+// citeFactor caps at 3.0, so a lone hit that was the raw max keeps ratio >= 1/3
+// and never sinks below the -0.5 neutral mid; noise only shrinks obs (can only
+// IMPROVE the lone hit's band). Real-SQL pins: benchmark/events-pipeline-probes.mjs
+// (cite-widening-bounded-3x / decisive-lone-event-survives-max-cite / noise-shrink).
+// Bands (ratio = |lone| / globalMaxAbs, first match wins):
 //   ratio ≥ 1   → -1.05  the lone hit IS the strongest raw match anywhere: rank it
 //                        strictly ahead of every normalized -1 (ties in raw
 //                        strength resolve toward the lone hit — the [-1, 0] band
@@ -598,7 +608,7 @@ export async function coreRunSearchPipeline(ctx, opts) {
 
   // ── Type-list fallback (MCP): obs_type set + 0 matches → list recent of that type ──
   if (obsTypeFallback && results.length === 0 && obsType) {
-    const typeWheres = ['COALESCE(compressed_into, 0) = 0', 'superseded_at IS NULL', 'type = ?'];
+    const typeWheres = [liveObsFilterSql(''), 'type = ?'];
     // Mirror the FTS path's low-signal filter (buildObsFtsQuery): this fallback is still a
     // SEARCH surface, so degraded titles ("Modified X", "Error: …") must not lead it —
     // acute for obs_type='change', the noise band. (The no-query recent-listing in

package/lib/stats-core.mjs

@@ -10,6 +10,7 @@ import { inferProject } from '../utils.mjs';
 import { buildNotLowSignalSql } from './low-signal-patterns.mjs';
 import { TIER_CASE_SQL, tierSqlParams } from '../tier.mjs';
 import { computeNoiseGauge } from './stats-quality.mjs';
+import { liveObsFilterSql } from './inject-search-core.mjs';
 
 /**
  * Compute the primary stats feed. Row shapes are returned exactly as the twin
@@ -98,7 +99,7 @@ export function computeStatsFeed(db, { project = null, days = 30, now = Date.now
   const tierDist = db.prepare(`
     SELECT tier, COUNT(*) as c FROM (
       SELECT ${TIER_CASE_SQL} as tier FROM observations
-      WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${projectFilter}
+      WHERE ${liveObsFilterSql('')} ${projectFilter}
     ) GROUP BY tier ORDER BY tier
   `).all(...tdParams, ...baseParams);
   const tierMap = Object.fromEntries(tierDist.map((r) => [r.tier, r.c]));

package/lib/timeline-core.mjs

@@ -14,6 +14,7 @@
 import { parseIdToken } from './id-routing.mjs';
 import { findFtsAnchor } from '../search-engine.mjs';
 import { sanitizeFtsQuery } from '../utils.mjs';
+import { liveObsFilterSql } from './inject-search-core.mjs';
 
 const TIMELINE_COLS = 'id, type, title, subtitle, project, created_at, created_at_epoch';
 
@@ -21,7 +22,7 @@ const TIMELINE_COLS = 'id, type, title, subtitle, project, created_at, created_a
 function nearestObservation(db, epoch, project) {
   return db.prepare(`
     SELECT id FROM observations
-    WHERE COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${project ? 'AND project = ?' : ''}
+    WHERE ${liveObsFilterSql('')} ${project ? 'AND project = ?' : ''}
     ORDER BY ABS(created_at_epoch - ?) ASC LIMIT 1
   `).get(...(project ? [project, epoch] : [epoch]));
 }
@@ -162,9 +163,9 @@ export function resolveQueryAnchor(db, queryStr, { project = null } = {}) {
 
 /** No-anchor fallback: most recent live (non-compressed, non-superseded) obs, newest first. */
 export function fetchRecentTimeline(db, { project = null, limit }) {
-  // superseded_at IS NULL mirrors the before/after window legs (fetchTimelineWindow) and
-  // every other read path — a superseded row must not lead the "most recent" timeline.
-  const liveFilter = 'COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL';
+  // A superseded row must not lead the "most recent" timeline — same live-row
+  // invariant as the before/after window legs (fetchTimelineWindow).
+  const liveFilter = liveObsFilterSql('');
   const where = project ? `WHERE ${liveFilter} AND project = ?` : `WHERE ${liveFilter}`;
   const params = project ? [project, limit] : [limit];
   return db.prepare(`
@@ -200,7 +201,7 @@ export function fetchTimelineWindow(db, anchorId, { before, after, project = nul
   const beforeRows = db.prepare(`
     SELECT ${TIMELINE_COLS}
     FROM observations
-    WHERE created_at_epoch < ? AND COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${projectFilter}
+    WHERE created_at_epoch < ? AND ${liveObsFilterSql('')} ${projectFilter}
     ORDER BY created_at_epoch DESC
     LIMIT ?
   `).all(anchorRow.created_at_epoch, ...baseParams, before).reverse();
@@ -208,7 +209,7 @@ export function fetchTimelineWindow(db, anchorId, { before, after, project = nul
   const afterRows = db.prepare(`
     SELECT ${TIMELINE_COLS}
     FROM observations
-    WHERE created_at_epoch > ? AND COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL ${projectFilter}
+    WHERE created_at_epoch > ? AND ${liveObsFilterSql('')} ${projectFilter}
     ORDER BY created_at_epoch ASC
     LIMIT ?
   `).all(anchorRow.created_at_epoch, ...baseParams, after);