claude-mem-lite 3.92.0 → 3.93.0

package/scripts/user-prompt-search.js

@@ -5,6 +5,8 @@
 
 import { ensureDb, DB_DIR, REGISTRY_DB_PATH } from '../schema.mjs';
 import { relaxFtsQueryToOr, truncate, typeIcon, inferProject, OBS_BM25, notLowSignalTitleClause, stripPrivate, neutralizeContextDelimiters, MAX_UPS_PROMPT_BYTES } from '../utils.mjs';
+import { readHookStdin } from '../lib/hook-stdin.mjs';
+import { resolveRuntimeDir } from '../lib/resolve-data-dir.mjs';
 import { liveObsFilterSql, injectionRelevanceSql } from '../lib/inject-search-core.mjs';
 import { fileMatchClause, fileMatchParams, basenameAnySep } from '../lib/file-edge-match.mjs';
 import { cjkPrecisionOk } from '../nlp.mjs';
@@ -25,13 +27,20 @@ import { DAY_MS } from '../lib/time-constants.mjs';
 
 // Telemetry sink (lib/hook-telemetry.mjs contract): env override for tests, else
 // <data-dir>/runtime — the same dir the sibling hook scripts + `stats` read.
-const RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || join(DB_DIR, 'runtime');
+// EVERY runtime path in this file goes through this constant, including the two
+// below. They used to be `join(DB_DIR, 'runtime', …)`, which reproduced the exact
+// defect P1-14 closed one seam over: this file's RUNTIME_DIR honoured the override
+// while its MARKER did not, so under `CLAUDE_MEM_RUNTIME_DIR` the `fyi` face wrote
+// the shared cross-hook marker to <data>/runtime while `pre-tool-recall` (`pretool`)
+// wrote it to the override and `hook.mjs` (`ups`) read the override. Caught by the
+// v3.93.0 pre-tag test-effectiveness review, from a surviving mutation.
+const RUNTIME_DIR = resolveRuntimeDir(DB_DIR);
 // D#120: one marker file per CC session — payload-only session keying (M-6) let
 // two concurrent windows full-replace each other's marker, killing dedup between
 // them and resetting `count` on every alternation. Derived per invocation once
 // the session id is parsed from stdin; no session id → legacy project-keyed file.
 const injectedIdsFileFor = (sessionId) =>
-  join(DB_DIR, 'runtime', injectedIdsFileName(inferProject(), sessionId));
+  join(RUNTIME_DIR, injectedIdsFileName(inferProject(), sessionId));
 // Per-prompt UPS cap. Cut from 5 → 3 after the 2026-05-09 per-hook recall
 // scan (#8255): UPS contributed 74% of silent injected IDs (131/177) at 26%
 // recall, vs PreToolUse:Read at 94% recall on a tighter file-keyed set.
@@ -482,28 +491,19 @@ function searchRecent(db, project, limit) {
 
 // ─── stdin Reader ───────────────────────────────────────────────────────────
 
-function readStdin() {
-  return new Promise((resolve, reject) => {
-    let data = '';
-    const timeout = setTimeout(() => {
-      process.stdin.destroy();
-      reject(new Error('timeout'));
-    }, 2000);
-    process.stdin.setEncoding('utf8');
-    process.stdin.on('data', chunk => {
-      data += chunk;
-      // Cap the prompt (#9494 huge-prompt guard) — deliberately tighter than the
-      // 256KB full-payload tier; both tiers live in utils.mjs (G19).
-      if (data.length > MAX_UPS_PROMPT_BYTES) {
-        process.stdin.destroy();
-        clearTimeout(timeout);
-        resolve(data.slice(0, MAX_UPS_PROMPT_BYTES));
-      }
-    });
-    process.stdin.on('end', () => { clearTimeout(timeout); resolve(data); });
-    process.stdin.on('error', err => { clearTimeout(timeout); reject(err); });
-    process.stdin.resume();
+// P1-9: shared mechanism (lib/hook-stdin.mjs), this entry point's own caliber. 2 s and
+// MAX_UPS_PROMPT_BYTES (64 KB, #9494's huge-prompt guard) are deliberately tighter than the
+// 256 KB full-payload tier hook.mjs uses — both tiers live in utils.mjs (G19) — because the
+// payload here is a user PROMPT, not a tool response. `rejectOnTimeout` matches the previous
+// behaviour: the caller treats a timeout as "skip the injection".
+// Returns a bare string, as this script's callers expect.
+async function readStdin() {
+  const { text } = await readHookStdin({
+    timeoutMs: 2000,
+    maxBytes: MAX_UPS_PROMPT_BYTES,
+    rejectOnTimeout: true,
   });
+  return text;
 }
 
 // ─── Format Output ──────────────────────────────────────────────────────────
@@ -550,7 +550,7 @@ function formatPromptResults(rows) {
 // pointer line so Claude can decide to invoke via SkillTool. The cooldown
 // and match mechanics below are unchanged.
 
-const SKILL_COOLDOWN_FILE = join(DB_DIR, 'runtime', `.skill-cooldown-${inferProject()}`);
+const SKILL_COOLDOWN_FILE = join(RUNTIME_DIR, `.skill-cooldown-${inferProject()}`);
 const SKILL_COOLDOWN_MS = 300_000; // 5 minutes
 
 function loadManagedSkillNames() {

package/server.mjs

@@ -21,7 +21,7 @@ import {
 // snapshotDb left with maintain-core: the pre-maintain snapshot is part of the op ORDER
 // (it must see the pre-existing pending rows), so it moved into runMaintainOps (P1-5).
 import { deleteObservations, previewDeleteRows } from './lib/delete-core.mjs';
-import { fetchObsDetail, fetchPromptDetail, fetchEventDetail, OBS_FIELDS, SESSION_DETAIL_FIELDS, PROMPT_DETAIL_FIELDS, EVENT_DETAIL_FIELDS, supersededNotice } from './lib/get-core.mjs';
+import { fetchObsDetail, fetchPromptDetail, fetchEventDetail, fetchSessionDetail, OBS_FIELDS, SESSION_DETAIL_FIELDS, PROMPT_DETAIL_FIELDS, EVENT_DETAIL_FIELDS, supersededNotice } from './lib/get-core.mjs';
 import { collectBrowseTiers, getActiveMemorySessionId, BROWSE_TIERS, BROWSE_TIER_LABELS } from './lib/browse-core.mjs';
 import { effectiveQuiet, RUNTIME_DIR } from './hook-shared.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
@@ -45,13 +45,12 @@ import { optimizePreview, optimizeRun } from './hook-optimize.mjs';
 import { join, sep } from 'path';
 import { homedir } from 'os';
 import { ensureRegistryDb, collectRegistryStats, listResourcesRanked, formatRegistryListLine } from './registry.mjs';
-import { IMPORT_STRING_FIELDS, importResource, removeResource, reindexResources, enrichImportedResources, enrichNamedResource } from './lib/registry-core.mjs';
+import { IMPORT_STRING_FIELDS, importResource, removeResource, reindexResources, enrichImportedResources, enrichNamedResource, resourceUseHint } from './lib/registry-core.mjs';
 import { searchResources } from './registry-retriever.mjs';
 import { probeOtherSources as probeIdSources, bucketIdTokens, splitDeferredTokens } from './lib/id-routing.mjs';
 import { saveWithClosures, formatSupersedeSkipped, formatSupersededNote } from './lib/save-observation.mjs';
 import { applyObsUpdate } from './lib/observation-write.mjs';
-import { EXPORT_COLUMNS_SQL } from './lib/export-columns.mjs';
-import { liveObsFilterSql } from './lib/inject-search-core.mjs';
+import { EXPORT_COLUMNS_SQL, buildExportWhere } from './lib/export-columns.mjs';
 import { recallByFile } from './lib/recall-core.mjs';
 import { fetchRecent } from './lib/recent-core.mjs';
 import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
@@ -646,8 +645,7 @@ server.registerTool(
     }
 
     if (bySrc.session.length > 0) {
-      const ph = bySrc.session.map(() => '?').join(',');
-      const rows = db.prepare(`SELECT * FROM session_summaries WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...bySrc.session);
+      const rows = fetchSessionDetail(db, bySrc.session);
       // SESSION_DETAIL_FIELDS (get-core, P2-12): shared full set — adds remaining_items
       // (searchable via FTS but previously unrendered on BOTH detail faces).
       const sessFields = SESSION_DETAIL_FIELDS;
@@ -1307,27 +1305,12 @@ server.registerTool(
         return { content: [{ type: 'text', text: `No matching resources for: "${args.query}"` }] };
       }
       const home = homedir();
-      const toPortable = (p) => p && p.startsWith(home) ? '~' + p.slice(home.length) : (p || '');
       const lines = results.map(r => {
         const qualityBadge = r.quality_tier === 'installed' ? '[✓]' : r.quality_tier === 'verified' ? '[★]' : '[○]';
         const categoryLabel = r.category ? ` [${r.category}]` : '';
-        const isManaged = r.local_path && r.local_path.includes(join(DB_DIR, 'managed') + sep);
-        const portablePath = isManaged ? toPortable(r.local_path) : '';
-        let howToUse;
-        if (isManaged) {
-          // Managed: use Read(path) or mem_use — Skill() won't work for managed resources
-          // Agents always have complete .md paths (e.g., agents/group/agents/name.md)
-          // Only skills can be directory paths (9 cases) — resolve to /SKILL.md
-          const resolvedPath = portablePath.endsWith('.md') ? portablePath : `${portablePath}/SKILL.md`;
-          howToUse = `Read("${resolvedPath}") or mem_use(name="${r.name}"${r.type === 'agent' ? ', type="agent"' : ''})`;
-        } else if (r.invocation_name) {
-          // Native plugin/user skill: Skill() with full invocation name
-          howToUse = r.type === 'skill'
-            ? `Skill("${r.invocation_name}")`
-            : `Agent(subagent_type="${r.invocation_name}")`;
-        } else {
-          howToUse = `mem_use(name="${r.name}"${r.type === 'agent' ? ', type="agent"' : ''})`;
-        }
+        // P2-6: the invocation rule is shared; only the Markdown bold and the two-space
+        // indent below are this face's.
+        const { portablePath, howToUse } = resourceUseHint(r, { home, managedPrefix: join(DB_DIR, 'managed') + sep });
         const pathLine = portablePath ? `\n  Path: ${portablePath}` : '';
         return `${qualityBadge} ${r.type === 'skill' ? 'S' : 'A'} **${r.name}**${categoryLabel} — ${truncate(r.capability_summary || '', 80)}${pathLine}\n  Use: ${howToUse}`;
       });
@@ -1594,33 +1577,32 @@ export async function handleExportForTest(db, args) {
 }
 
 async function runExport(db, args) {
-  const wheres = [];
-  const params = [];
-  // Composed, not hand-written: the CLI twin (mem-cli.mjs cmdExport) already
-  // routes through liveObsFilterSql, and a hand-rolled copy here is how the
-  // live-row predicate drifted apart on other surfaces (P2-11/D#123). With
-  // include_compressed the compressed half is dropped but retractions still
-  // are not — tombstone export is opt-in, supersession is never exported.
-  wheres.push(args.include_compressed ? 'superseded_at IS NULL' : liveObsFilterSql(''));
-  if (args.project) { wheres.push('project = ?'); params.push(_resolveProjectShared(db, args.project)); }
-  if (args.type) { wheres.push('type = ?'); params.push(args.type); }
-  // T3-P1-A: surface invalid dates instead of silently dropping the filter — mirrors
-  // mem_search, which threw. A dropped filter can quietly expand the export blast radius.
+  // PARSE + VALIDATE here; the SQL predicate comes from buildExportWhere (P2-5), shared
+  // with mem-cli.mjs cmdExport. This face THROWS where the CLI prints a usage message —
+  // T3-P1-A: surface invalid dates instead of silently dropping the filter (mirrors
+  // mem_search). A dropped filter can quietly expand the export blast radius.
+  let fromEpoch = null;
+  let toEpoch = null;
   if (args.date_from) {
-    const epoch = new Date(args.date_from).getTime();
-    if (isNaN(epoch)) throw new Error(`Invalid date_from: "${args.date_from}" (use ISO 8601 or YYYY-MM-DD)`);
-    wheres.push('created_at_epoch >= ?');
-    params.push(epoch);
+    fromEpoch = new Date(args.date_from).getTime();
+    if (isNaN(fromEpoch)) throw new Error(`Invalid date_from: "${args.date_from}" (use ISO 8601 or YYYY-MM-DD)`);
   }
   if (args.date_to) {
     const d = args.date_to.length === 10 ? args.date_to + 'T23:59:59.999Z' : args.date_to;
-    const epoch = new Date(d).getTime();
-    if (isNaN(epoch)) throw new Error(`Invalid date_to: "${args.date_to}" (use ISO 8601 or YYYY-MM-DD)`);
-    wheres.push('created_at_epoch <= ?');
-    params.push(epoch);
+    toEpoch = new Date(d).getTime();
+    if (isNaN(toEpoch)) throw new Error(`Invalid date_to: "${args.date_to}" (use ISO 8601 or YYYY-MM-DD)`);
   }
-
-  const where = wheres.length > 0 ? 'WHERE ' + wheres.join(' AND ') : '';
+  const { params, where } = buildExportWhere({
+    includeCompressed: Boolean(args.include_compressed),
+    // `|| args.project`: buildExportWhere gates the predicate on TRUTHINESS, so a falsy
+    // resolution would DROP the project filter and export the whole store. The code this
+    // replaced pushed `project = ?` unconditionally, so an unresolvable name yielded zero
+    // rows — which is the safe direction, and the comment above is specifically about not
+    // letting a dropped filter widen the export.
+    project: args.project ? (_resolveProjectShared(db, args.project) || args.project) : null,
+    type: args.type || null,
+    fromEpoch, toEpoch,
+  });
   // No clamp (audit 2026-08-14 A2): `Math.min(args.limit ?? 200, 1000)` made an MCP-driven
   // backup of a >1000-row store impossible, on the tool whose own description says "USE
   // when: Backing up memory before a migration or reinstall" — while the CLI twin exported

package/source-files.mjs

@@ -110,6 +110,8 @@ export const SOURCE_FILES = [
   // Single-envelope stdout for hook processes — imported by hook.mjs. Claude Code
   // parses hook stdout as ONE JSON document; missing from the manifest → an updated
   // install throws ERR_MODULE_NOT_FOUND on every hook fire.
+  'lib/hook-stdin.mjs',
+  'lib/plugin-key.mjs',
   'lib/hook-stdout.mjs',
   // audit P0/P1: inter-process install lock + atomic config writes — imported by
   // install.mjs (settings.json + install lock) and hook-update.mjs (.claude.json