claude-mem-lite 3.96.1 → 3.98.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.96.1",
+      "version": "3.98.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.96.1",
+  "version": "3.98.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -809,6 +809,19 @@ claude-mem-lite.
 | `CLAUDE_MEM_NO_TEMPLATE_REFRESH` | `1` stops SessionStart from refreshing the adopted `CLAUDE.md` managed block when the shipped template changes. | _(refreshes)_ |
 | `MEM_QUIET_HOOKS` | See Core above — the broadest injection-volume switch. | _(disabled)_ |
 
+### Registry import bounds
+
+`registry import-url` pulls from a third-party repository, so it is bounded. Entries past a
+bound are refused, not truncated, and the refusal is printed with the import result. Set any
+of these to `0` for the pre-v3.98 unlimited behavior; an unparseable or negative value keeps
+the default rather than removing the bound.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `CLAUDE_MEM_IMPORT_MAX_ITEMS` | Max skills/agents imported from one repository. | `200` |
+| `CLAUDE_MEM_IMPORT_MAX_FILE_BYTES` | Max size of a single `SKILL.md`/`AGENT.md`. Oversized entries are skipped; the rest still import. | `2097152` (2 MB) |
+| `CLAUDE_MEM_IMPORT_MAX_TOTAL_BYTES` | Byte budget for one import run. Exhausting it stops the walk and books the remainder as refused. | `52428800` (50 MB) |
+
 ### Retrieval tuning
 
 Prompt-time search (`UPS_*` = the UserPromptSubmit surface). Defaults are the values the

package/cli/common.mjs

@@ -8,7 +8,7 @@
 // relative-time formatting — every command imports from here so the CLI stays
 // consistent.
 
-import { neutralizeContextDelimiters } from '../format-utils.mjs';
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters } from '../format-utils.mjs';
 
 // ─── Argument Parsing ────────────────────────────────────────────────────────
 
@@ -107,11 +107,19 @@ export function parseArgs(argv) {
  * The transform is idempotent (it strips brackets, it does not re-add them), so a
  * path that already defanged upstream — `context` → buildSessionContextLines — is
  * unaffected.
+ *
+ * `<skill-loaded>` is neutralized here too (audit 2026-09-05 R6 P1-2). It is deliberately
+ * OFF CONTEXT_DELIMITER_RE so the MCP `mem_use` load path can emit a real wrapper — but no
+ * CLI command emits one, while `registry search|list` DOES print third-party registry names
+ * (a GitHub frontmatter name, or `import --name`, which applies no charset filter). A crafted
+ * name therefore forged a complete skill block out of nothing in ordinary CLI output. The MCP
+ * twin closes the same hole at its own chokepoint (server.mjs defangResult); doing it on one
+ * face only is this repo's first-listed defect class.
  */
 export function out(text) {
-  // String() first: neutralizeContextDelimiters coerces nullish to '', which would turn
-  // a pre-existing `out(undefined)` line from "undefined" into an empty line.
-  outVerbatim(neutralizeContextDelimiters(String(text)));
+  // String() first: the neutralizers coerce nullish to '', which would turn a pre-existing
+  // `out(undefined)` line from "undefined" into an empty line.
+  outVerbatim(neutralizeSkillDelimiters(neutralizeContextDelimiters(String(text))));
 }
 
 /**

package/hook-context.mjs

@@ -22,7 +22,7 @@ import {
 } from './utils.mjs';
 import {
   STALE_SESSION_MS,
-  FALLBACK_OBS_WINDOW_MS,
+  RELATED_OBS_WINDOW_MS,
   RUNTIME_DIR,
   effectiveQuiet,
   isQuietHooks,
@@ -459,7 +459,7 @@ export function buildSessionContextLines(
   let fallbackObs = [];
   if (observations.length < 3) {
     const fbOneDayAgo = now.getTime() - STALE_SESSION_MS;
-    const fbSevenDaysAgo = now.getTime() - FALLBACK_OBS_WINDOW_MS;
+    const fbSevenDaysAgo = now.getTime() - RELATED_OBS_WINDOW_MS;
     fallbackObs = db
       .prepare(
         `

package/hook-shared.mjs

@@ -54,18 +54,27 @@ export const SESSION_EXPIRY_MS = 12 * 60 * 60 * 1000; // 12h
 export const STALE_SESSION_MS = 24 * 60 * 60 * 1000; // 24h
 export const STALE_LOCK_MS = 30000; // 30s
 
+// Backstop for cleanStaleLockFiles(): a lock whose recorded pid is ALIVE is kept until it
+// reaches this age, not STALE_LOCK_MS. Deliberately LONGER than proc-lock.mjs's own 5-min
+// steal window, so the sweeper is never the more aggressive of the two — whatever it
+// removes, the lock protocol itself would already have let the next caller steal. Its only
+// job is to garbage-collect a leaked file whose pid was recycled onto an unrelated live
+// process, which would otherwise pin the file forever. (A20260905-R5-P1-1)
+export const ABANDONED_LOCK_MS = 10 * 60 * 1000; // 10 min
+
 // The background-maintenance mutex, defined HERE next to the sweeper policy it has to
-// escape. cleanStaleLockFiles() below unlinks any `*.lock` older than STALE_LOCK_MS
-// WITHOUT checking whether the holder is alive — right for the episode lock's millisecond
-// critical section, fatal for a maintenance pass that runs for seconds to minutes. The
-// name therefore ends in `.proclock`, and `tests/auto-maintain-proc-lock.test.mjs` asserts
-// that against THIS constant rather than a re-typed copy: the first version of that test
-// built its own path from a literal, so renaming the lock left it green with the hazard
+// escape. cleanStaleLockFiles() sweeps every `*.lock` in RUNTIME_DIR; until
+// A20260905-R5-P1-1 it did so on AGE ALONE once past STALE_LOCK_MS — right for the episode
+// lock's millisecond critical section, fatal for a maintenance pass that runs for seconds
+// to minutes. The sweeper now spares a live holder, but this mutex keeps the `.proclock`
+// name: not being swept at all is a stronger guarantee than being spared by a liveness
+// probe, and pid checks are meaningless across a shared homedir. `tests/auto-maintain-proc-lock.test.mjs`
+// asserts that against THIS constant rather than a re-typed copy: the first version of that
+// test built its own path from a literal, so renaming the lock left it green with the hazard
 // back. proc-lock's own staleness policy (age OR provably-dead pid) is the correct one.
 export const AUTO_MAINTAIN_LOCK = 'auto-maintain.proclock';
 export const DEDUP_WINDOW_MS = 5 * 60 * 1000; // 5 min (title dedup)
 export const RELATED_OBS_WINDOW_MS = 7 * DAY_MS; // 7 days
-export const FALLBACK_OBS_WINDOW_MS = RELATED_OBS_WINDOW_MS; // same window
 // Candidate rows the SessionStart Key Context surface considers (hook-context.mjs
 // keyObs; each of the two sections then renders at most 5). The user-prompt
 // exclude-set does NOT mirror this query — it reads the ids actually rendered

package/hook-update.mjs

@@ -16,6 +16,7 @@ import {
   rmSync,
   renameSync,
   chmodSync,
+  realpathSync,
 } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -1294,6 +1295,19 @@ export function clearCacheHookResidue() {
 // ── Plugin Cache Pruning ──────────────────────────────────
 const PLUGIN_CACHE_KEEP = 3;
 
+/**
+ * Same-directory test that survives trailing slashes, `..` segments and symlinks.
+ * realpathSync throws on a path that no longer exists → fall back to lexical resolve.
+ */
+function isSameDir(a, b) {
+  if (!a || !b) return false;
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return resolve(a) === resolve(b);
+  }
+}
+
 export function prunePluginCache() {
   const cacheBase = join(homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
   if (!existsSync(cacheBase)) return 0;
@@ -1304,11 +1318,20 @@ export function prunePluginCache() {
 
   if (entries.length <= PLUGIN_CACHE_KEEP) return 0;
 
+  // A20260905-R5-Q1: "not in the newest 3" is not the same question as "not in use".
+  // CLAUDE_PLUGIN_ROOT is the version dir THIS process was launched from, and after a
+  // marketplace rollback (a bad release withdrawn while >=3 newer dirs are already cached)
+  // it is not among the newest 3 — so keep-latest-3 rm -rf'd the tree the running hooks and
+  // MCP server import from. scripts/setup.sh step 8 carries the same guard for the same
+  // reason; the two prune the same directory and must agree.
+  const runningRoot = process.env.CLAUDE_PLUGIN_ROOT;
   const toRemove = entries.slice(PLUGIN_CACHE_KEEP);
   let removed = 0;
   for (const ver of toRemove) {
+    const dir = join(cacheBase, ver);
+    if (isSameDir(dir, runningRoot)) continue;
     try {
-      rmSync(join(cacheBase, ver), { recursive: true, force: true });
+      rmSync(dir, { recursive: true, force: true });
       removed++;
     } catch {}
   }

package/hook.mjs

@@ -70,6 +70,7 @@ import {
   SESSION_EXPIRY_MS,
   STALE_SESSION_MS,
   STALE_LOCK_MS,
+  ABANDONED_LOCK_MS,
   AUTO_MAINTAIN_LOCK,
   STALE_EPISODE_BUFFER_AGE_MS,
   HANDOFF_EXPIRY_CLEAR,
@@ -1945,14 +1946,15 @@ function scheduleSessionStartAutoMaintain(project) {
   if (!process.env.CLAUDE_MEM_SKIP_MAINTAIN) spawnBackground('auto-maintain', project);
 }
 
-// The maintenance mutex deliberately does NOT end in `.lock`: cleanStaleLockFiles()
-// below unlinks every `*.lock` in RUNTIME_DIR whose age exceeds STALE_LOCK_MS (30s)
-// WITHOUT consulting the holder's pid — a policy written for the episode lock, whose
-// critical section is milliseconds. A maintenance pass is seconds to minutes (VACUUM INTO
-// snapshot, purge, decay, dedup over the whole DB), so that sweeper would strip this lock
-// mid-pass and hand the exclusion straight back to the race it exists to close.
-// proc-lock brings its own staleness policy (age OR provably-dead pid), which is the
-// correct one here.
+// The maintenance mutex deliberately does NOT end in `.lock`, so cleanStaleLockFiles()
+// below never sees it at all. That sweeper used to unlink every `*.lock` past
+// STALE_LOCK_MS (30s) without consulting the holder's pid — a policy written for the
+// episode lock, whose critical section is milliseconds — and a maintenance pass is seconds
+// to minutes (VACUUM INTO snapshot, purge, decay, dedup over the whole DB). It now spares a
+// live holder (A20260905-R5-P1-1), but this escape stays: not being swept is a stronger
+// guarantee than being spared by a pid probe, and pids are meaningless across a shared
+// homedir. proc-lock brings its own staleness policy (age OR provably-dead pid), which is
+// the correct one here.
 // Generous upper bound on one pass; a crashed holder is normally reclaimed sooner via the
 // dead-pid check, so this only matters for a holder killed on another host.
 const AUTO_MAINTAIN_LOCK_STALE_MS = 10 * 60 * 1000;
@@ -2078,8 +2080,29 @@ function saveHandoffAndFastSummary(
   }
 }
 
+/**
+ * Sweep abandoned `*.lock` files out of RUNTIME_DIR on SessionStart.
+ *
+ * "Stale" has to mean ABANDONED, not merely old. Until A20260905-R5-P1-1 this swept on AGE
+ * ALONE (pid was consulted only for locks YOUNGER than STALE_LOCK_MS, i.e. exactly the ones
+ * it was going to keep anyway), so a lock older than 30s was unlinked no matter who held it.
+ * `runtime/install.lock` — lib/proc-lock.mjs, taken by `install.mjs repair`,
+ * `install.mjs rebuild-binding`, hook-update.installExtractedRelease and scripts/launch.mjs —
+ * guards a critical section that routinely runs 30s–2min (npm install in staging is capped at
+ * 60s, npm rebuild in smoke at 120s). Any parallel Claude Code window starting up during that
+ * span deleted the live holder's lock; the next installer then acquired it and began renaming
+ * files into the same install dir, which is the torn mixed-version install (server vN + hook
+ * vN+1) proc-lock.mjs's header exists to prevent.
+ *
+ * Policy now: a recorded pid that is ALIVE (or alive-but-not-ours, EPERM) is spared until
+ * ABANDONED_LOCK_MS; a provably-dead pid (ESRCH) is swept at any age; a lock with no usable
+ * pid falls back to STALE_LOCK_MS, as before.
+ *
+ * Liveness of the two real lock families does not depend on this sweeper, so tightening it
+ * cannot wedge either: hook-episode.acquireLock() preempts a >30s episode lock itself at
+ * acquire time, and proc-lock.acquireLock() steals on age OR dead pid at 5 min.
+ */
 function cleanStaleLockFiles() {
-  // Clean stale lock files in runtime dir
   try {
     for (const f of readdirSync(RUNTIME_DIR)) {
       if (!f.endsWith('.lock')) continue;
@@ -2089,12 +2112,16 @@ function cleanStaleLockFiles() {
         const info = JSON.parse(raw);
         const age = Date.now() - (info.ts || 0);
         let stale = age > STALE_LOCK_MS;
-        if (!stale && info.pid) {
+        if (info.pid) {
+          let alive = false;
           try {
             process.kill(info.pid, 0);
+            alive = true;
           } catch (killErr) {
-            stale = killErr.code === 'ESRCH';
+            // EPERM = the process exists but belongs to another user — still a live holder.
+            alive = killErr.code === 'EPERM';
           }
+          stale = alive ? age > ABANDONED_LOCK_MS : true;
         }
         if (stale) unlinkSync(lp);
       } catch {

package/mem-cli.mjs

@@ -3531,12 +3531,17 @@ async function cmdImport(argv) {
   }
 
   try {
-    const { importFromGitHub } = await import('./registry-importer.mjs');
+    const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
     out(`[mem] Importing from ${url}...`);
-    const results = await importFromGitHub(rdb, url);
+    // `skipped` sink + shared summary (R6 Q1) — same helper the MCP twin renders, so the
+    // bounds cannot end up enforced-but-silent on one of the two faces.
+    const skipped = [];
+    const results = await importFromGitHub(rdb, url, { skipped });
+    const refusal = formatImportSkips(skipped);
 
     if (results.length === 0) {
       out('[mem] No skills/agents found in this repository.');
+      if (refusal) out(`[mem] ${refusal}`);
       return;
     }
 
@@ -3544,6 +3549,7 @@ async function cmdImport(argv) {
     for (const r of results) {
       out(`  ${r.type === 'skill' ? 'S' : 'A'} ${r.name} (id=${r.id})`);
     }
+    if (refusal) out(`[mem] ${refusal}`);
 
     if (flags.enrich) {
       out('[mem] Running LLM enrichment...');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.96.1",
+  "version": "3.98.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.96.1",
+      "version": "3.98.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.30.0",
         "better-sqlite3": "^12.11.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.96.1",
+  "version": "3.98.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-github.mjs

@@ -34,25 +34,43 @@ export function parseGitHubUrl(url) {
   };
 }
 
+// Percent-encode ONE path segment. Git ref names may legally contain `#` (git forbids `?`,
+// not `#`), and so may file names — interpolated raw, that `#` opens a URL FRAGMENT and
+// swallows the rest: `…/git/trees/feat#x?recursive=1` parses as hash `#x?recursive=1` with an
+// EMPTY query, so GitHub answered a NON-recursive tree and every nested skills/*/SKILL.md went
+// silently undiscovered; the raw content URL lost its whole path the same way (audit
+// 2026-09-05 R6 Q2, measured). encodeURIComponent leaves the unreserved set — including the
+// `.`, `-`, `_` and `~` that ordinary owners/repos/branches are made of — untouched.
+const seg = (s) => encodeURIComponent(String(s ?? ''));
+
+// A repo-relative file path is MANY segments: encode each one but keep the `/` separators.
+// encodeURIComponent on the whole path would emit `skills%2Ffoo%2FSKILL.md` and 404 every
+// ordinary import — the counter-case pinned in tests/registry-github.test.mjs.
+const segPath = (p) =>
+  String(p ?? '')
+    .split('/')
+    .map(seg)
+    .join('/');
+
 /**
  * Build GitHub API tree URL (recursive).
  */
 export function buildTreeUrl(owner, repo, branch) {
-  return `https://api.github.com/repos/${owner}/${repo}/git/trees/${branch}?recursive=1`;
+  return `https://api.github.com/repos/${seg(owner)}/${seg(repo)}/git/trees/${seg(branch)}?recursive=1`;
 }
 
 /**
  * Build raw content URL for a file.
  */
 export function buildContentUrl(owner, repo, branch, path) {
-  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
+  return `https://raw.githubusercontent.com/${seg(owner)}/${seg(repo)}/${seg(branch)}/${segPath(path)}`;
 }
 
 /**
  * Build GitHub API repo metadata URL.
  */
 export function buildRepoUrl(owner, repo) {
-  return `https://api.github.com/repos/${owner}/${repo}`;
+  return `https://api.github.com/repos/${seg(owner)}/${seg(repo)}`;
 }
 
 /**

package/registry-importer.mjs

@@ -22,6 +22,71 @@ import { DB_DIR } from './schema.mjs';
 // read them under CLAUDE_MEM_DIR relocation (D#29). Equals homedir when the env is unset.
 const MANAGED_DIR = join(DB_DIR, 'managed');
 
+// ─── Import bounds (audit 2026-09-05 R6 Q1) ─────────────────────────────────
+// Measured before these existed: a tree offering 500 `skills/*/SKILL.md` entries of 2 MB
+// each imported all 500, issued 502 fetches and wrote 1000.0 MB in 20.1 s — from one
+// `registry import-url`. There was no bound on count, per-file size, or run total, and the
+// input is a third-party repository, so one URL could fill the user's data dir.
+//
+// USER-VISIBLE DEFAULT BEHAVIOR CHANGE: an import that used to be unbounded can now refuse
+// entries. Each bound has an env opt-out and `0` means unlimited — the pre-cap behavior.
+export const IMPORT_DEFAULT_LIMITS = {
+  items: 200,
+  fileBytes: 2 * 1024 * 1024,
+  totalBytes: 50 * 1024 * 1024,
+};
+
+// Module-private: both consumers (resolveImportLimits, formatImportSkips) live here, and
+// exporting it would add a name to the knip unused-export baseline for nothing.
+const IMPORT_LIMIT_ENV = {
+  items: 'CLAUDE_MEM_IMPORT_MAX_ITEMS',
+  fileBytes: 'CLAUDE_MEM_IMPORT_MAX_FILE_BYTES',
+  totalBytes: 'CLAUDE_MEM_IMPORT_MAX_TOTAL_BYTES',
+};
+
+const SKIP_REASON_TEXT = {
+  'item-cap': 'beyond the per-import item cap',
+  'file-too-large': 'over the per-file byte cap',
+  'total-budget': 'past the total byte budget for this import',
+};
+
+/**
+ * Effective bounds: caller override (tests) < env < default.
+ * @param {object} [override] Partial {items,fileBytes,totalBytes}
+ * @param {object} [env] Env source (tests pass their own)
+ */
+function resolveImportLimits(override = {}, env = process.env) {
+  const limits = {};
+  for (const key of Object.keys(IMPORT_DEFAULT_LIMITS)) {
+    const base = override[key] ?? IMPORT_DEFAULT_LIMITS[key];
+    const raw = env[IMPORT_LIMIT_ENV[key]];
+    if (raw === undefined || String(raw).trim() === '') {
+      limits[key] = base;
+      continue;
+    }
+    const n = Number(raw);
+    // `0` = unlimited, the documented opt-out. Anything unparseable or negative KEEPS the
+    // bound: the failure mode of a typo must be "the limit still applies", never "no limit"
+    // — the same fail-closed rule registryConfineEnabled states for its escape hatch.
+    limits[key] = Number.isFinite(n) && n >= 0 ? (n === 0 ? Infinity : n) : base;
+  }
+  return limits;
+}
+
+/**
+ * One-line refusal summary for the two import faces. Shared so the CLI and the MCP tool
+ * cannot drift into two spellings of the same refusal (this repo's first-listed defect class).
+ * @param {Array<{reason: string}>} skipped
+ * @returns {string} '' when nothing was refused.
+ */
+export function formatImportSkips(skipped) {
+  if (!skipped || skipped.length === 0) return '';
+  const byReason = new Map();
+  for (const s of skipped) byReason.set(s.reason, (byReason.get(s.reason) || 0) + 1);
+  const parts = [...byReason].map(([reason, n]) => `${n} ${SKIP_REASON_TEXT[reason] || reason} (${reason})`);
+  return `Refused ${skipped.length}: ${parts.join('; ')}. Set ${IMPORT_LIMIT_ENV.items}/${IMPORT_LIMIT_ENV.fileBytes}/${IMPORT_LIMIT_ENV.totalBytes} (0 = unlimited) to change these bounds.`;
+}
+
 // ─── Tree Discovery ─────────────────────────────────────────────────────────
 
 // Patterns: flat (skills/name/SKILL.md), plugin (plugins/x/skills/y/SKILL.md),
@@ -346,11 +411,30 @@ export async function importFromGitHub(db, url, opts = {}) {
   const discovered = discoverFromTree(treeData, pathFilter);
   if (discovered.length === 0) return [];
 
+  // 4b. Apply the import bounds (R6 Q1). `skipped` is a caller-supplied sink so both faces
+  // can render the refusal; callers that pass nothing keep the previous return shape.
+  const limits = resolveImportLimits(opts.limits, opts.env);
+  const skipped = opts.skipped ?? [];
+  let admitted = discovered;
+  if (discovered.length > limits.items) {
+    admitted = discovered.slice(0, limits.items);
+    for (const over of discovered.slice(limits.items)) {
+      skipped.push({ name: over.name, type: over.type, reason: 'item-cap' });
+    }
+    debugLog(
+      'WARN',
+      'importer',
+      `Item cap ${limits.items} reached; refused ${discovered.length - limits.items} entries`,
+    );
+  }
+
   const repoUrl = `https://github.com/${owner}/${repo}`;
   const results = [];
+  let totalBytes = 0;
 
   // 5. Process each discovered item
-  for (const item of discovered) {
+  for (let i = 0; i < admitted.length; i++) {
+    const item = admitted[i];
     try {
       // 5a. Fetch content via raw GitHub URL
       const contentUrl = buildContentUrl(owner, repo, branch, item.filePath);
@@ -361,14 +445,45 @@ export async function importFromGitHub(db, url, opts = {}) {
       }
       const content = await contentResp.text();
 
+      // 5a-bis. Byte bounds, checked on the fetched body before anything is parsed or
+      // written. The per-file cap refuses ONE entry and keeps going; the run total is a
+      // budget, so exhausting it stops the walk and books every remaining entry as refused
+      // (a partial import must still account for what it did not take).
+      const bytes = Buffer.byteLength(content, 'utf8');
+      if (bytes > limits.fileBytes) {
+        skipped.push({ name: item.name, type: item.type, reason: 'file-too-large', bytes });
+        debugLog('WARN', 'importer', `Refused ${item.filePath}: ${bytes} B over cap ${limits.fileBytes}`);
+        continue;
+      }
+      if (totalBytes + bytes > limits.totalBytes) {
+        for (const rest of admitted.slice(i)) {
+          skipped.push({ name: rest.name, type: rest.type, reason: 'total-budget' });
+        }
+        debugLog('WARN', 'importer', `Total byte budget ${limits.totalBytes} exhausted at ${item.filePath}`);
+        break;
+      }
+      totalBytes += bytes;
+
       // 5b. Parse frontmatter
       const { frontmatter, body } = parseFrontmatter(content);
 
       // Root skill naming: use frontmatter name if present, else repo name for root, else discovered name
       const rawName = frontmatter.name || (item.name === 'root' ? repo : item.name);
       const name = rawName.replace(/[^a-zA-Z0-9._-]/g, '_');
-      // Path traversal guard: reject names that would escape managed directory
       const typeDir = item.type === 'agent' ? 'agents' : 'skills';
+      // Segment guard, BEFORE the confinement check — which cannot catch these (audit
+      // 2026-09-05 R6 P3-2). `.` and `..` survive the charset filter (dot is allowed) and
+      // then PASS confinement, because join() resolves them away first: `<managed>/skills/..`
+      // IS `<managed>`, admitted on isPathConfined's `resolved === base` arm. Not a traversal
+      // — the write stays inside managedDir — but it lands outside the one-directory-per-
+      // resource layout (`<managed>/SKILL.md`, `<managed>/skills/SKILL.md`), where the flat
+      // scanner picks the latter up as a loose resource named `SKILL`, and two repos both
+      // declaring `name: .` overwrite each other. An empty name collapses the same way.
+      if (!name || name === '.' || name === '..') {
+        debugLog('WARN', 'importer', `Rejected non-segment name: ${rawName}`);
+        continue;
+      }
+      // Path traversal guard: reject names that would escape managed directory
       if (!isPathConfined(join(managedDir, typeDir, name), managedDir)) {
         debugLog('WARN', 'importer', `Rejected path-traversal name: ${rawName}`);
         continue;

package/scripts/hook-launcher.mjs

@@ -14,7 +14,9 @@
 // dir) or a missing bare dependency like better-sqlite3 (e.url is undefined and
 // the importer named in the message is under the install dir) — run
 // `install.mjs repair` (rate-limited via a 6h marker file under runtime/) and
-// retry the import once. If repair is unavailable or fails, degrade quietly:
+// retry the import once. That repair runs at SESSION-START ONLY; every other
+// event records the breakage and defers (A20260905-R5-Q2, see attemptHeal).
+// If repair is unavailable, deferred or fails, degrade quietly:
 // these are best-effort memory hooks, so a broken/missing dependency emits one
 // clean recovery line and exits 0 rather than dumping a Node stack trace on
 // every fire. On any other (foreign) exception, re-throw so Node's default
@@ -272,6 +274,37 @@ function clearBreakage() {
   }
 }
 
+// Hot-path counterpart of attemptHeal (A20260905-R5-Q2).
+//
+// attemptHeal() runs `install.mjs repair` SYNCHRONOUSLY with a 300s timeout. The events
+// this launcher fires on cannot host that: hooks/hooks.json gives PreToolUse 3s,
+// PostToolUse 3s, UserPromptSubmit 2s, Stop and PreCompact 5s — only SessionStart's 15s is
+// in the same order of magnitude as an npm run. Worse than being killed: recordHealAttempt()
+// arms the 6h cooldown BEFORE the spawn, deliberately, as concurrent-fire rate limiting (see
+// clearHealMarker below). So a repair the host killed at 2s still bought six hours of
+// "Self-heal skipped" — including for the SessionStart fire that had the budget to finish it.
+// The hot path now records the breakage for `doctor` and gets out of the way.
+//
+// This is the same rule healNativeBindingIfBroken() below already follows, for the same
+// reason ("never on the per-tool hot path, where an npm run would stall the user's edit").
+//
+// Do NOT "fix" the cooldown by moving recordHealAttempt() after the spawn instead: that is
+// the mutual-exclusion between concurrent fires, and the R5 report's first suggestion.
+//
+// Known gap this does NOT close, because it was already open: if the missing module sits on
+// a DIFFERENT entry's import chain and session-start's own entry imports cleanly, nothing
+// heals — a clean session-start clears the breakage marker without repairing. Narrow in
+// practice (hook.mjs imports most of lib/), and closing it needs a detached, stdio-ignored
+// spawn like the native-binding path, not this one.
+function deferHealToSessionStart(reason) {
+  process.stderr.write(
+    `[claude-mem-lite] Broken install (${reason}) — self-heal deferred to the next SessionStart ` +
+      `(this hook has a 2-5s budget; repair needs minutes).\n` +
+      `[claude-mem-lite] Manual recovery: ${CLI_REPAIR}\n`,
+  );
+  return false;
+}
+
 async function attemptHeal(reason) {
   if (recentHealAttempt()) {
     process.stderr.write(
@@ -298,6 +331,64 @@ async function attemptHeal(reason) {
   return result.status === 0;
 }
 
+// Session-start heal driven by the BREAKAGE MARKER rather than by our own failed import
+// (A20260905-R5-Q2, second half).
+//
+// Since the heal moved off the hot path, a hot-path fire that hits a missing module records
+// the breakage and defers. But this launcher fronts several entries — hook.mjs plus
+// pre-tool-recall.js, pre-skill-bridge.js, post-tool-recall.js, user-prompt-search.js — and
+// the missing module may sit on one of THEIR import chains and not on hook.mjs's. Then
+// session-start's own entry imports cleanly, the catch below never fires, and before this
+// function existed the clean fire simply cleared the marker: nothing ever repaired it. (That
+// gap predates the hot-path gate — a clean session-start always cleared the marker — but the
+// gate is what makes it the ONLY remaining route, so it is closed here.)
+//
+// DETACHED with stdio ignored, exactly like healNativeBindingIfBroken() below and for the
+// same two reasons: the fire is capped at 15s while `install.mjs repair` can take minutes,
+// and install.mjs logs to STDOUT while SessionStart stdout is a JSON envelope Claude Code
+// parses. That is also why this cannot reuse attemptHeal(), whose spawn is synchronous and
+// inherits stdio — correct where the entry failed and nothing has been written yet, wrong
+// here, where runEntry() has already emitted the envelope.
+//
+// Marker bookkeeping, and why it differs from the native-binding path: `install.mjs repair`
+// does not know about `hook-launcher-broken` (only doctor reads it, only this file writes
+// it), so no child can clear it on our behalf. Clearing it here after spawning keeps
+// `doctor` honest — a repair that did not take is re-recorded by the very next failing fire
+// — while the 6h cooldown, not the marker, is what bounds repair spawns to one per window.
+// Within that window the marker is deliberately left in place so doctor still reports the
+// unrepaired breakage.
+function healRecordedBreakage() {
+  try {
+    if (!existsSync(BROKEN_MARKER)) {
+      // No fire has recorded a degraded exit since the last session-start → as healthy as
+      // this launcher can tell. Drop a stale cooldown so a LATER unrelated break heals
+      // immediately rather than waiting out a window earned by an old fault. (#6/#9)
+      clearHealMarker();
+      return;
+    }
+    if (recentHealAttempt()) return; // on cooldown — keep the marker, doctor should see it
+    const installer = join(INSTALL_DIR, 'install.mjs');
+    if (!existsSync(installer)) {
+      process.stderr.write(
+        `[claude-mem-lite] A hook fire degraded to exit 0 and install.mjs is missing — ${TARBALL_FALLBACK}\n`,
+      );
+      return;
+    }
+    recordHealAttempt();
+    process.stderr.write(
+      '[claude-mem-lite] A previous hook fire degraded to exit 0 — repairing in the background\n',
+    );
+    const child = spawn(process.execPath, [installer, 'repair'], {
+      detached: true,
+      stdio: 'ignore',
+    });
+    child.unref();
+    clearBreakage();
+  } catch {
+    /* best-effort — a heal failure must never stop the fire */
+  }
+}
+
 // Defense-in-depth for plugin-mode version drift: the plugin-cache MCP server
 // (kept current by Claude Code) migrates the shared DB schema forward, while
 // this data-dir code (the standalone CLI + these hooks) is only advanced by the
@@ -398,9 +489,12 @@ if (IS_SESSION_START) {
 
 try {
   await runEntry();
-  // A clean session-start fire confirms the install is healthy → clear any stale
-  // breakage marker. Gated to session-start so the per-tool hot path pays nothing.
-  if (IS_SESSION_START) clearBreakage();
+  // Our entry imported cleanly, but that is NOT the same as "the install is whole": this
+  // launcher fronts five entries and the missing module may be on another one's chain. So
+  // act on the recorded breakage instead of just clearing it — background repair if there is
+  // one to do, clear either way. Gated to session-start so the hot path pays nothing.
+  // (Was an unconditional clearBreakage(); A20260905-R5-Q2.)
+  if (IS_SESSION_START) healRecordedBreakage();
   // After the entry too: the fire that DISCOVERS the breakage is the one that
   // records it, so a pre-entry-only check would leave the whole session dead and
   // heal one session late.
@@ -408,7 +502,7 @@ try {
 } catch (e) {
   if (!isLocalModuleErr(e)) throw e;
   const reason = describeFailure(e);
-  const healed = await attemptHeal(reason);
+  const healed = IS_SESSION_START ? await attemptHeal(reason) : deferHealToSessionStart(reason);
   if (!healed) {
     // Broken/missing dependency we can't repair right now (repair failed, or
     // was skipped within the 6h cooldown). attemptHeal already wrote actionable

package/scripts/setup.sh

@@ -248,10 +248,25 @@ if [[ -n "${CLAUDE_PLUGIN_ROOT:-}" ]]; then
     done < <(for _d in "${_all_dirs[@]}"; do [[ -d "$_d" ]] && echo "${_d##*/}"; done | sort -t. -k1,1nr -k2,2nr -k3,3nr | tail -n +4)
     unset _all_dirs _d
     if [[ ${#OLD_VERS[@]} -gt 0 ]]; then
+      PRUNED=0
       for ver in "${OLD_VERS[@]}"; do
+        # A20260905-R5-Q1: "not in the newest 3" is not the same question as "not in use".
+        # CLAUDE_PLUGIN_ROOT is the version dir this session is RUNNING from, and after a
+        # marketplace rollback (a bad release withdrawn while >=3 newer dirs sit in the
+        # cache) it falls outside the newest 3 — so this loop deleted the tree every hook
+        # and the MCP server import from, mid-session. -ef compares device+inode, so it is
+        # not fooled by a trailing slash, a `..` segment or a symlinked cache dir.
+        # hook-update.mjs prunePluginCache() carries the same guard; the two prune the same
+        # directory and must agree.
+        if [[ "$CACHE_DIR/$ver" -ef "$CLAUDE_PLUGIN_ROOT" ]]; then
+          continue
+        fi
         rm -rf "${CACHE_DIR:?}/$ver" 2>/dev/null || true
+        PRUNED=$((PRUNED + 1))
       done
-      log_ok "Plugin cache pruned: removed ${#OLD_VERS[@]} old version(s)"
+      if [[ $PRUNED -gt 0 ]]; then
+        log_ok "Plugin cache pruned: removed $PRUNED old version(s)"
+      fi
     fi
   fi
 fi

package/server.mjs

@@ -293,14 +293,28 @@ function applyArgAliases(args, pairs) {
   return next;
 }
 
-function defangResult(result) {
+/**
+ * @param {object} result Tool result.
+ * @param {object} [opts]
+ * @param {boolean} [opts.skillBlocks=true] Also neutralize `<skill-loaded>`. Default ON:
+ *   registry rows carry third-party text (a GitHub frontmatter name, or `import --name`,
+ *   which applies no charset filter), and every registry render used to interpolate it raw —
+ *   so a crafted name FORGED a whole skill block out of nothing in ordinary search/list
+ *   output (audit 2026-09-05 R6 P1-2; F7 on a third face). Enumerating mem_registry found
+ *   the same shape on seven branches plus the shared formatRegistryListLine, which is why
+ *   this is a chokepoint default rather than seven call-site patches. `mem_use` — the one
+ *   handler that must emit a REAL wrapper — turns it off explicitly and defangs its own
+ *   untrusted pieces per call site instead (R6 P1-1).
+ */
+function defangResult(result, { skillBlocks = true } = {}) {
   if (!result || !Array.isArray(result.content)) return result;
+  const scrub = skillBlocks
+    ? (t) => neutralizeSkillDelimiters(neutralizeContextDelimiters(t))
+    : neutralizeContextDelimiters;
   return {
     ...result,
     content: result.content.map((c) =>
-      c && c.type === 'text' && typeof c.text === 'string'
-        ? { ...c, text: neutralizeContextDelimiters(c.text) }
-        : c,
+      c && c.type === 'text' && typeof c.text === 'string' ? { ...c, text: scrub(c.text) } : c,
     ),
   };
 }
@@ -311,14 +325,18 @@ function defangResult(result) {
  * @param {boolean} [opts.verbatim=false] Skip the defang pass. Only for payloads that
  *   must round-trip byte-exact — `mem_export` feeds `restore`, so neutralizing it would
  *   silently corrupt backups of any memory that legitimately discusses these tags.
+ * @param {boolean} [opts.emitsSkillBlock=false] This handler legitimately emits a real
+ *   `<skill-loaded>` wrapper, so the chokepoint must not strip it. `mem_use` is the only
+ *   one, and it neutralizes its own untrusted body/name/path per call site (R6 P1-1).
+ *   Applies to the SUCCESS path only — an error message never emits a wrapper.
  */
-function safeHandler(fn, { verbatim = false } = {}) {
+function safeHandler(fn, { verbatim = false, emitsSkillBlock = false } = {}) {
   return async (args, extra) => {
     try {
       lastMcpRequestTime = Date.now();
       idleCleanupRan = false;
       const result = await fn(args, extra);
-      return verbatim ? result : defangResult(result);
+      return verbatim ? result : defangResult(result, { skillBlocks: !emitsSkillBlock });
     } catch (err) {
       return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
     }
@@ -1683,11 +1701,16 @@ server.registerTool(
       if (!args.url) {
         return { content: [{ type: 'text', text: 'import_url requires a url parameter' }], isError: true };
       }
-      const { importFromGitHub } = await import('./registry-importer.mjs');
+      const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
       try {
-        const results = await importFromGitHub(rdb, args.url);
+        // `skipped` sink + shared summary (R6 Q1): the import bounds must REFUSE visibly, and
+        // the CLI twin renders the identical string from the identical helper.
+        const skipped = [];
+        const results = await importFromGitHub(rdb, args.url, { skipped });
+        const refusal = formatImportSkips(skipped);
         if (results.length === 0) {
-          return { content: [{ type: 'text', text: `No skills/agents found in: ${args.url}` }] };
+          const head = `No skills/agents found in: ${args.url}`;
+          return { content: [{ type: 'text', text: refusal ? `${head}\n${refusal}` : head }] };
         }
 
         let enrichMsg = '';
@@ -1707,7 +1730,7 @@ server.registerTool(
           content: [
             {
               type: 'text',
-              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}`,
+              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}${refusal ? `\n${refusal}` : ''}`,
             },
           ],
         };
@@ -1787,133 +1810,166 @@ server.registerTool(
     description: descriptionOf('mem_use'),
     inputSchema: memUseSchema,
   },
-  safeHandler(async (args) => {
-    const rdb = getRegistryDb();
-    if (!rdb) {
-      return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
-    }
+  safeHandler(
+    async (args) => {
+      const rdb = getRegistryDb();
+      if (!rdb) {
+        return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
+      }
 
-    const name = args.name.trim();
-    const type = args.type || 'skill';
+      const name = args.name.trim();
+      const type = args.type || 'skill';
 
-    // 1. Exact match by name or invocation_name — the ONLY path that loads content.
-    const row = rdb
-      .prepare(
-        `
+      // 1. Exact match by name or invocation_name — the ONLY path that loads content.
+      const row = rdb
+        .prepare(
+          `
       SELECT id, name, type, local_path, invocation_name, capability_summary
       FROM resources
       WHERE status = 'active' AND type = ?
         AND (name = ? OR invocation_name = ?)
       LIMIT 1
     `,
-      )
-      .get(type, name, name);
-
-    // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
-    // produces the candidate list), but its result is only ever rendered as names: loading
-    // the top hit under the caller's requested name shipped a different skill's body inside
-    // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
-    // nothing marking the swap, so an agent that asked for A executed B (audit F1,
-    // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
-    // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
-    // exact-name decision the caller makes.
-    if (!row) {
-      let candidates = [];
-      try {
-        candidates = searchResources(rdb, name, { type, limit: 5 })
-          .map((r) => r.name)
-          .filter(Boolean);
-      } catch {
-        /* a suggestion is best-effort; the miss message below still stands */
-      }
-      // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
-      // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
-      // imperative inside this message, and the handler-wide defangResult cannot catch it —
-      // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
-      // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
-      // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
-      // the suggestion tells the caller to load one by its exact name, so it must stay exact.
-      const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
-      const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
-      const head = `No ${type} found for "${echoed}".`;
-      const browse = `mem_registry(action="search", query="${echoed}")`;
-      if (candidates.length === 0) {
-        return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
+        )
+        .get(type, name, name);
+
+      // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
+      // produces the candidate list), but its result is only ever rendered as names: loading
+      // the top hit under the caller's requested name shipped a different skill's body inside
+      // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
+      // nothing marking the swap, so an agent that asked for A executed B (audit F1,
+      // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
+      // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
+      // exact-name decision the caller makes.
+      if (!row) {
+        let candidates = [];
+        try {
+          candidates = searchResources(rdb, name, { type, limit: 5 })
+            .map((r) => r.name)
+            .filter(Boolean);
+        } catch {
+          /* a suggestion is best-effort; the miss message below still stands */
+        }
+        // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
+        // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
+        // imperative inside this message, and the handler-wide defangResult cannot catch it —
+        // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
+        // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
+        // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
+        // the suggestion tells the caller to load one by its exact name, so it must stay exact.
+        const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
+        const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
+        const head = `No ${type} found for "${echoed}".`;
+        const browse = `mem_registry(action="search", query="${echoed}")`;
+        if (candidates.length === 0) {
+          return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
+        }
+        const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
+        return {
+          content: [
+            {
+              type: 'text',
+              text:
+                `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
+                `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
+            },
+          ],
+        };
       }
-      const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
-      return {
-        content: [
-          {
-            type: 'text',
-            text:
-              `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
-              `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
-          },
-        ],
-      };
-    }
 
-    // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
-    let skillPath = row.local_path || '';
-    if (skillPath && !skillPath.endsWith('.md')) {
-      for (const candidate of [join(skillPath, 'SKILL.md'), join(skillPath, `skills/${row.name}/SKILL.md`)]) {
-        if (existsSync(candidate)) {
-          skillPath = candidate;
-          break;
+      // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
+      let skillPath = row.local_path || '';
+      if (skillPath && !skillPath.endsWith('.md')) {
+        for (const candidate of [
+          join(skillPath, 'SKILL.md'),
+          join(skillPath, `skills/${row.name}/SKILL.md`),
+        ]) {
+          if (existsSync(candidate)) {
+            skillPath = candidate;
+            break;
+          }
         }
       }
-    }
 
-    // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
-    // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
-    // equals homedir when unset, so this does not weaken the non-relocated confinement.
-    const managedBase = DB_DIR;
-    if (skillPath && !isPathConfined(skillPath, managedBase)) {
-      return {
-        content: [{ type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` }],
-        isError: true,
-      };
-    }
+      // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
+      // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
+      // equals homedir when unset, so this does not weaken the non-relocated confinement.
+      const managedBase = DB_DIR;
+      if (skillPath && !isPathConfined(skillPath, managedBase)) {
+        return {
+          content: [
+            { type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` },
+          ],
+          isError: true,
+        };
+      }
 
-    // 5. Read content
-    let content;
-    try {
-      content = readFileSync(skillPath, 'utf8');
-    } catch {
-      const msg = skillPath.endsWith('.md')
-        ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
-        : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
-      return { content: [{ type: 'text', text: msg }], isError: true };
-    }
+      // 5. Read content
+      let content;
+      try {
+        content = readFileSync(skillPath, 'utf8');
+      } catch {
+        const msg = skillPath.endsWith('.md')
+          ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
+          : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
+        return { content: [{ type: 'text', text: msg }], isError: true };
+      }
 
-    // 5. Record invocation
-    try {
-      rdb
-        .prepare(
-          `
+      // 5. Record invocation
+      try {
+        rdb
+          .prepare(
+            `
         INSERT INTO invocations (resource_id, session_id, trigger, adopted, outcome)
         VALUES (?, ?, 'user_explicit', 1, 'success')
       `,
-        )
-        .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
-    } catch {
-      /* non-critical */
-    }
+          )
+          .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
+      } catch {
+        /* non-critical */
+      }
 
-    const _home = homedir();
-    const portablePath =
-      skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
-    const pathAttr = portablePath ? ` path="${portablePath}"` : '';
-    const reloadHint = portablePath ? ` Reload: Read("${portablePath}")` : '';
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `<skill-loaded name="${row.name}" type="${row.type}"${pathAttr}>\n${content}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
-        },
-      ],
-    };
-  }),
+      const _home = homedir();
+      const portablePath =
+        skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
+
+      // Defang the untrusted pieces before wrapping (audit 2026-09-05 R6 P1-1). All three come
+      // from a third-party repo by way of the registry — `registry import-url` stores a body
+      // verbatim, and `registry import --name` stores a name with no charset filter at all — so
+      // this emitter is the containment boundary, not the import.
+      //
+      // The handler-wide defangResult only runs neutralizeContextDelimiters, and <skill-loaded>
+      // is deliberately OFF that list (format-utils.mjs) so this very line can emit a real
+      // wrapper. So the body needs the per-call-site neutralizer: a literal `</skill-loaded>`
+      // in it closed the wrapper and forged a second block attributed to another skill, with
+      // the "Follow the instructions above" sentence below landing after it as an endorsement.
+      // Name and path are stripped rather than neutralized because they land in ATTRIBUTE
+      // position, where a bare `"` breaks out of the tag regardless of any tag-shaped pattern.
+      //
+      // Same treatment the sibling face already applies (scripts/pre-skill-bridge.js, audit
+      // 2026-08-14 M-4 + D#122 ③). The wrapper itself stays live — that is the counter-case
+      // pinned by tests/audit-findings-20260814.test.mjs:605 and this file's last case.
+      // `row.type` is not defanged: the resources CHECK constraint admits only 'skill'|'agent'.
+      const attrSafe = (s) => String(s ?? '').replace(/["'<>]/g, '');
+      const safeName = attrSafe(row.name);
+      const safePath = attrSafe(portablePath);
+      const safeBody = neutralizeSkillDelimiters(content);
+      const pathAttr = safePath ? ` path="${safePath}"` : '';
+      const reloadHint = safePath ? ` Reload: Read("${safePath}")` : '';
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `<skill-loaded name="${safeName}" type="${row.type}"${pathAttr}>\n${safeBody}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
+          },
+        ],
+      };
+      // The one handler that emits a real <skill-loaded> wrapper, so the chokepoint's
+      // skill-block pass is turned OFF here — see defangResult. Everything untrusted inside
+      // the wrapper is neutralized above, per call site.
+    },
+    { emitsSkillBlock: true },
+  ),
 );
 
 // ─── Tool: mem_update ────────────────────────────────────────────────────────