claude-mem-lite 3.93.0 → 3.93.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.93.0",
+      "version": "3.93.1",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.93.0",
+  "version": "3.93.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -897,8 +897,9 @@ Set by the tool or by the test harness. Setting these by hand is not supported:
 
 The last two are worth one more sentence each, because they are the ones a harness reaches
 for. `CLAUDE_MEM_RUNTIME_DIR` relocates the runtime directory for hook-written state — markers,
-cooldowns, hook-error telemetry, the native-binding breakage marker, `metrics/`, episode
-buffers. Before v3.93.0 it was honoured by some readers and ignored by others, so setting it
+cooldowns, hook-error telemetry, the native-binding breakage marker, episode buffers.
+(`metrics/` is NOT in that set: it is a sibling of `runtime/` under the data dir and moves
+with `CLAUDE_MEM_DIR` only.) Before v3.93.0 it was honoured by some readers and ignored by others, so setting it
 split the runtime rather than moving it. Installation-identity state (`install.lock`,
 `update-state.json`, update residue) deliberately stays under `CLAUDE_MEM_DIR`: two
 installers pointed at different override directories would otherwise each take their own

package/hook-update.mjs

@@ -33,7 +33,7 @@ const INSTALL_DIR = CODE_DIR;  // ~/.claude-mem-lite/ (code)
 // DB_DIR), matching hook-shared RUNTIME_DIR and install.mjs doctor's read path.
 // Equal to INSTALL_DIR unless CLAUDE_MEM_DIR relocates the data dir.
 const STATE_DIR = DB_DIR;
-const STATE_FILE = join(STATE_DIR, 'runtime', 'update-state.json');
+const STATE_FILE = join(STATE_DIR, 'runtime', 'update-state.json'); // runtime-dir:stays-put — installation identity
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;       // 24 hours
 const FETCH_TIMEOUT_MS = 3000;                         // 3s network timeout
 // When rate-limited we got NO release data, so re-check sooner than the normal 24h
@@ -641,7 +641,7 @@ export async function verifyReleaseAuthenticity(extractedDir, assets, publicKey
 // hooks are best-effort, so losing one fire beats importing a mixed module graph.
 // Carries pid + ts because the launcher must never be muted permanently by an
 // updater that was killed mid-swap (it applies the same staleness bound).
-const SWAP_MARKER = join(STATE_DIR, 'runtime', 'swap-in-progress');
+const SWAP_MARKER = join(STATE_DIR, 'runtime', 'swap-in-progress'); // runtime-dir:stays-put — installation identity
 // Intent journal, written INSIDE the backup dir before each rename. On a hard kill
 // the backup dir survives (every normal exit deletes it) and this file says exactly
 // which paths were in flight, so the next entry can finish the rollback at the right
@@ -781,7 +781,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
   // holding the lock means an install is already in flight — skip rather than
   // race. Shared path with install.mjs so direct install + repair + auto-update
   // are mutually exclusive.
-  const release = acquireLock(join(STATE_DIR, 'runtime', 'install.lock'));
+  const release = acquireLock(join(STATE_DIR, 'runtime', 'install.lock')); // runtime-dir:stays-put — install lock serialises real installers
   if (!release) {
     debugLog('DEBUG', 'hook-update', 'installExtractedRelease: another install/update is in progress — skipping');
     return false;
@@ -1115,7 +1115,7 @@ function readState() {
 
 function saveState(state) {
   try {
-    const dir = join(STATE_DIR, 'runtime');
+    const dir = join(STATE_DIR, 'runtime'); // runtime-dir:stays-put — mkdir for update-state.json above
     mkdirSync(dir, { recursive: true });
     const tmpFile = STATE_FILE + `.tmp-${process.pid}`;
     writeFileSync(tmpFile, JSON.stringify(state, null, 2));

package/install.mjs

@@ -1791,7 +1791,7 @@ async function doctor() {
 
   // Update state
   try {
-    const stateFile = join(MEM_DATA_DIR, 'runtime', 'update-state.json');
+    const stateFile = join(MEM_DATA_DIR, 'runtime', 'update-state.json'); // runtime-dir:stays-put — installation identity
     if (existsSync(stateFile)) {
       const state = JSON.parse(readFileSync(stateFile, 'utf8'));
       const parts = [];
@@ -1951,8 +1951,12 @@ async function doctor() {
   try {
     // hook-update + the episode workers write runtime/ + staging under DB_DIR
     // (= MEM_DATA_DIR, env-aware), NOT the homedir code dir — scan there so doctor
-    // sees the real residue under relocation.
-    const runtimeDir = join(MEM_DATA_DIR, 'runtime');
+    // sees the real residue under relocation. MEM_RUNTIME_DIR rather than
+    // join(MEM_DATA_DIR,'runtime'): `pending-*` / `ep-flush-*` are written through
+    // hook-shared.mjs's override-aware RUNTIME_DIR, and `cleanup()` below deletes them from
+    // MEM_RUNTIME_DIR — v3.93.0 moved the deleter and left this scanner behind, so under the
+    // override doctor reported "none" while the cleanup it recommends removed files.
+    const runtimeDir = MEM_RUNTIME_DIR;
     let staleCount = 0;
     const stalePatterns = ['.update-staging-', '.update-backup-'];
     if (existsSync(MEM_DATA_DIR)) {
@@ -2560,7 +2564,7 @@ function bindingHostDir() {
 // two concurrent rebuilds can clobber the .node mid-compile. A live peer → report
 // and exit 0 (it is doing this very work), never race it.
 async function rebuildBinding() {
-  const release = acquireLock(join(MEM_DATA_DIR, 'runtime', 'install.lock'));
+  const release = acquireLock(join(MEM_DATA_DIR, 'runtime', 'install.lock')); // runtime-dir:stays-put — install lock serialises real installers
   if (!release) {
     // NOT exit 0: skipping is not healing. Callers key their state on the exit
     // code — a false success would let the launcher drop its cooldown and the
@@ -2609,7 +2613,7 @@ async function rebuildBinding() {
 // install/self-heal) holds it → skip rather than race into a torn install. Lock
 // path is shared with hook-update.installExtractedRelease (both env-aware).
 async function runLockedInstall() {
-  const release = acquireLock(join(MEM_DATA_DIR, 'runtime', 'install.lock'));
+  const release = acquireLock(join(MEM_DATA_DIR, 'runtime', 'install.lock')); // runtime-dir:stays-put — install lock serialises real installers
   if (!release) {
     console.log('[install] Another install/repair is in progress — skipping to avoid a torn write.');
     return;

package/lib/hook-stdin.mjs

@@ -61,7 +61,13 @@ export const TOOL_INPUT_FILE_MAX_BYTES = 8 * 1024 * 1024;
  * @returns {{filePath: string, sessionId: string|null, toolName: string|null} | null}
  */
 export function salvageTruncatedHookEvent(prefix) {
-  const fp = prefix.match(/"file_path"\s*:\s*"((?:[^"\\]|\\.)*)"/);
+  // Bounded capture. Unbounded, an 8 MB prefix whose `file_path` string is never closed
+  // makes V8 exceed its regexp backtrack limit and THROW RangeError — measured at the cap by
+  // the v3.93.0 post-release review. The throw escapes the caller's catch into its top-level
+  // one, which still exits 0 but writes a `pre-recall:top` telemetry row: the same
+  // hook-error noise the caller split `pre-recall:json` away from. 4096 is far above any
+  // real path (PATH_MAX is 4096 on Linux, 1024 on macOS), so no reachable payload is lost.
+  const fp = prefix.match(/"file_path"\s*:\s*"((?:[^"\\]|\\.){0,4096})"/);
   if (!fp) return null;
   let filePath;
   // The captured group is still JSON-escaped (Windows paths arrive as `C:\\x`).

package/lib/resolve-data-dir.mjs

@@ -111,16 +111,26 @@ export function resolveDataDir(raw) {
  * the native-binding breakage marker, which is the self-heal trigger). The rule that
  * resolved them, stated so the next sweep does not overshoot:
  *
- *   MOVES with the override — state a HOOK writes and another component reads back:
- *   cross-hook injected-ids markers, skill/pre-recall cooldowns, hook-error telemetry,
- *   the native-binding breakage marker, `metrics/`, `ep-flush-*` / `pending-*` buffers,
- *   the shadow-recommendation log.
+ *   MOVES with the override — state a HOOK writes INTO THE RUNTIME DIR and another
+ *   component reads back: cross-hook injected-ids markers, skill/pre-recall cooldowns,
+ *   hook-error telemetry, the launcher's breakage/heal markers, the native-binding
+ *   breakage marker, `ep-flush-*` / `pending-*` buffers, the shadow-recommendation log.
  *
- *   STAYS under the data dir — state about the ONE REAL INSTALLATION: `install.lock`,
- *   `update-state.json`, `swap-in-progress`, and the `.update-staging-*` /
- *   `.update-backup-*` residue scan. These must NOT follow a per-harness override: the
- *   lock exists to serialise concurrent installers, and two installers pointed at
- *   different override directories would each take their own lock and both proceed.
+ *   STAYS under the data dir, for two DIFFERENT reasons — do not collapse them:
+ *     (a) state about the ONE REAL INSTALLATION — `install.lock`, `update-state.json`,
+ *         `swap-in-progress`, the `.update-staging-*` / `.update-backup-*` residue scan.
+ *         These must not follow a per-harness override: the lock exists to serialise
+ *         concurrent installers, and two installers pointed at different override
+ *         directories would each take their own lock and both proceed.
+ *     (b) state that was never under `runtime/` at all — `metrics/` is a SIBLING of it
+ *         (`lib/metrics.mjs` is `join(dbDir, 'metrics')`) and every caller passes the data
+ *         dir. A v3.93.0 draft of this list put it in the MOVES column, which is the one
+ *         error a reader following this docblock would act on: a sweep obeying it would
+ *         convert `recordMetric(DB_DIR, …)` to a runtime-relative path and re-open exactly
+ *         what that release closed. What was fixed there was `join(RUNTIME_DIR, '..')` —
+ *         an inverse derivation of the data dir that stopped equalling `DB_DIR` the moment
+ *         the override was honoured. Deriving one dir from the other is the defect; the
+ *         sink itself never moved.
  *
  * `tests/runtime-dir-single-home.test.mjs` sweeps for the defect FORM (a shipped module
  * building `join(…, 'runtime')` itself) with the stays-put sites as a named allowlist, so
@@ -137,6 +147,6 @@ export function resolveRuntimeDir(dataDir, env = process.env) {
   // turning a previously-working relative path into a throw would break isolation setups
   // in order to enforce tidiness. It is resolved against cwd instead, so the value is at
   // least absolute by the time anything writes to it.
-  if (raw === undefined || raw === null || raw === '') return join(dataDir, 'runtime');
+  if (raw === undefined || raw === null || raw === '') return join(dataDir, 'runtime'); // runtime-dir:stays-put — this IS the default branch of the rule
   return isAbsolute(raw) ? raw : resolve(raw);
 }

package/mem-cli.mjs

@@ -1326,7 +1326,7 @@ async function cmdStats(db, args) {
   out(`  Low-value (imp≤1, never used, >30d): ${lowVal.c} (${(noiseRatio * 100).toFixed(1)}% noise)`);
   out(`  Low-signal titles (Modified/Error/Worked on…): ${lowSignalTitle.c} (${(lowSignalRatio * 100).toFixed(1)}%)`);
   out(`  Compressed: ${compressedCount.c}`);
-  out(`  Hook errors (last 24h): ${hookErrors24h}${hookErrors24h > 0 ? `  ← tail ${join(DB_DIR, 'runtime/hook-errors')}` : ''}`);
+  out(`  Hook errors (last 24h): ${hookErrors24h}${hookErrors24h > 0 ? `  ← tail ${join(resolveRuntimeDir(DB_DIR), 'hook-errors')}` : ''}`);
   // Hint threshold = the REAL eviction budget (pre-release review 2026-08-16: a
   // hardcoded 3×-DB heuristic promised an eviction that fires only past the budget).
   out(`  Disk: DB ${mb(dbBytes)}MB | ${snaps.length} backup snapshot(s) ${mb(backupBytes)}MB${backupBytes > backupBudgetBytes() ? `  ← over the ${mb(backupBudgetBytes())}MB backup budget; next maintain/save snapshot evicts oldest (>7d old)` : ''}`);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.93.0",
+  "version": "3.93.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.93.0",
+      "version": "3.93.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.93.0",
+  "version": "3.93.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/binding-probe-cli.mjs

@@ -102,7 +102,7 @@ if (first.ok) process.exit(0);
 // .node mid-compile.
 let lockPath;
 try {
-  lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock');
+  lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock'); // runtime-dir:stays-put — install lock serialises real installers
 } catch (e) {
   // resolveDataDir THROWS on a non-absolute CLAUDE_MEM_DIR. Unhandled, that
   // prints an 8-line rejection stack onto SessionStart stderr; one line is enough.

package/scripts/hook-launcher.mjs

@@ -39,13 +39,36 @@ const INSTALL_DIR = join(__dirname, '..');
 // non-absolute → default. Data-writing paths import that module and throw instead.
 const MEM_DIR = process.env.CLAUDE_MEM_DIR;
 const DATA_DIR = MEM_DIR && isAbsolute(MEM_DIR) ? MEM_DIR : join(homedir(), '.claude-mem-lite');
-const RUNTIME_DIR = join(DATA_DIR, 'runtime');
-const HEAL_MARKER = join(RUNTIME_DIR, 'hook-launcher-lastheal');
+// TWO runtime dirs, because this file writes BOTH classes of state and v3.93.0 shipped a
+// split by moving only doctor's READ side. `RUNTIME_DIR` is data-dir-relative and serves
+// `swap-in-progress`, which is installation identity and must NOT follow a per-harness
+// override (two installers pointed at different override dirs would each see no swap in
+// progress). `HOOK_RUNTIME_DIR` is override-aware and serves every marker another component
+// reads back — the launcher's own breakage/heal markers, which `install.mjs doctor` reads,
+// and the native-binding pair below. That second constant already existed here as
+// `NB_RUNTIME_DIR` and was applied to only half this file's markers.
+//
+// Inline `||`, not `lib/resolve-data-dir.mjs::resolveRuntimeDir`, and this is the single
+// declared exception in the tree: the launcher runs BEFORE the native binding is known to
+// work, so it imports only `node:` builtins on purpose — even a leaf lib module is a
+// resolution it declines to make on the path whose job is surviving a broken install. The
+// standalone hook scripts it mirrors (pre-tool-recall / pre-skill-bridge) honour the same
+// variable and write 78 of every 79 of these markers, so reading a different dir would mean
+// never healing. `resolveRuntimeDir` is the canonical rule (audit 2026-09-02 P1-14) and this
+// is NOT identical to it: the resolver additionally makes a RELATIVE override absolute
+// (`isAbsolute(raw) ? raw : resolve(raw)`), while this hands the relative value straight to
+// `fs`, which resolves it against cwd at call time rather than at module load. They agree on
+// unset, empty and absolute — the three cases that reach a real install. Keep the DEFAULTING
+// behaviour in step; do not read "identical" into the difference.
+// `tests/runtime-dir-single-home.test.mjs` asserts this file still carries the rule.
+const RUNTIME_DIR = join(DATA_DIR, 'runtime'); // runtime-dir:stays-put — serves swap-in-progress only; HOOK_RUNTIME_DIR carries the hook markers
+const HOOK_RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || RUNTIME_DIR;
+const HEAL_MARKER = join(HOOK_RUNTIME_DIR, 'hook-launcher-lastheal');
 const HEAL_COOLDOWN_MS = 6 * 60 * 60 * 1000;
 // Observable breakage state: written when the launcher degrades a broken install
 // to exit 0, cleared once the install is confirmed healthy. `doctor` reads it so
 // the intentional silence (no stack trace per fire) stays detectable. (#4/#8)
-const BROKEN_MARKER = join(RUNTIME_DIR, 'hook-launcher-broken');
+const BROKEN_MARKER = join(HOOK_RUNTIME_DIR, 'hook-launcher-broken');
 
 // ── Native-binding (ABI) self-heal ──────────────────────────────────────────
 // A stale better_sqlite3.node after a Node upgrade does NOT throw at import time
@@ -63,22 +86,9 @@ const BROKEN_MARKER = join(RUNTIME_DIR, 'hook-launcher-broken');
 // lib/hook-telemetry.mjs and lib/native-binding-hint.mjs); this heals from it at
 // SESSION-START only — never on the per-tool hot path, where an npm run would
 // stall the user's edit.
-// Marker dir mirrors the standalone hook scripts (pre-tool-recall /
-// pre-skill-bridge), which honor CLAUDE_MEM_RUNTIME_DIR — they write 78 of every
-// 79 of these markers, so reading a different dir would mean never healing.
-// The last hand-written copy of this rule, and it stays: this launcher runs BEFORE the
-// native binding is known to work, so it imports only `node:` builtins on purpose — even
-// `lib/resolve-data-dir.mjs` is a module resolution it declines to make on the path whose
-// job is to survive a broken install. `lib/resolve-data-dir.mjs::resolveRuntimeDir` is the
-// canonical rule (audit 2026-09-02 P1-14). It is NOT identical to it, and saying so was
-// wrong: the resolver additionally makes a RELATIVE override absolute (`isAbsolute(raw) ?
-// raw : resolve(raw)`), while this expression hands the relative value straight to `fs`,
-// which resolves it against cwd at call time instead of at module load. They agree on
-// unset, on empty and on an absolute override — the three cases that reach a real install.
-// Keep the DEFAULTING behaviour in step; do not read "identical" into the difference.
-const NB_RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || RUNTIME_DIR;
-const NB_BROKEN_MARKER = join(NB_RUNTIME_DIR, 'native-binding-broken');
-const NB_HEAL_MARKER = join(NB_RUNTIME_DIR, 'native-binding-lastheal');
+// Marker dir: HOOK_RUNTIME_DIR (see its definition above for why it is override-aware).
+const NB_BROKEN_MARKER = join(HOOK_RUNTIME_DIR, 'native-binding-broken');
+const NB_HEAL_MARKER = join(HOOK_RUNTIME_DIR, 'native-binding-lastheal');
 // Literal, not imported: the pure-`node:` charter above forbids importing lib/
 // here (this file must survive a broken install). Kept in sync with
 // lib/binding-probe.mjs::NATIVE_BINDING_REBUILD_CMD, which is the single home
@@ -225,7 +235,7 @@ function recentHealAttempt() {
 
 function recordHealAttempt() {
   try {
-    mkdirSync(RUNTIME_DIR, { recursive: true });
+    mkdirSync(HOOK_RUNTIME_DIR, { recursive: true });
     writeFileSync(HEAL_MARKER, String(Date.now()));
   } catch { /* best-effort */ }
 }
@@ -239,7 +249,7 @@ function clearHealMarker() {
 
 function recordBreakage(reason) {
   try {
-    mkdirSync(RUNTIME_DIR, { recursive: true });
+    mkdirSync(HOOK_RUNTIME_DIR, { recursive: true });
     writeFileSync(BROKEN_MARKER, JSON.stringify({ reason, ts: Date.now() }));
   } catch { /* best-effort */ }
 }
@@ -316,7 +326,7 @@ function healNativeBindingIfBroken() {
       if (Date.now() - statSync(NB_HEAL_MARKER).mtimeMs < HEAL_COOLDOWN_MS) return;
     } catch { /* no marker → not on cooldown */ }
     try {
-      mkdirSync(NB_RUNTIME_DIR, { recursive: true });
+      mkdirSync(HOOK_RUNTIME_DIR, { recursive: true });
       writeFileSync(NB_HEAL_MARKER, String(Date.now()));
     } catch { /* best-effort */ }
 

package/scripts/launch.mjs

@@ -76,7 +76,7 @@ try {
   // proceeds; a broken one defers to the peer instead of racing it).
   const { acquireLock } = await import('../lib/proc-lock.mjs');
   const { resolveDataDir } = await import('../lib/resolve-data-dir.mjs');
-  const lockPath = join(resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock');
+  const lockPath = join(resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock'); // runtime-dir:stays-put — install lock serialises real installers
   let release = null;
   for (let i = 0; i < 20 && !(release = acquireLock(lockPath)); i++) {
     await new Promise((r) => setTimeout(r, 500));