claude-mem-lite 3.97.0 → 3.98.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.97.0",
+      "version": "3.98.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.97.0",
+  "version": "3.98.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -809,6 +809,19 @@ claude-mem-lite.
 | `CLAUDE_MEM_NO_TEMPLATE_REFRESH` | `1` stops SessionStart from refreshing the adopted `CLAUDE.md` managed block when the shipped template changes. | _(refreshes)_ |
 | `MEM_QUIET_HOOKS` | See Core above — the broadest injection-volume switch. | _(disabled)_ |
 
+### Registry import bounds
+
+`registry import-url` pulls from a third-party repository, so it is bounded. Entries past a
+bound are refused, not truncated, and the refusal is printed with the import result. Set any
+of these to `0` for the pre-v3.98 unlimited behavior; an unparseable or negative value keeps
+the default rather than removing the bound.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `CLAUDE_MEM_IMPORT_MAX_ITEMS` | Max skills/agents imported from one repository. | `200` |
+| `CLAUDE_MEM_IMPORT_MAX_FILE_BYTES` | Max size of a single `SKILL.md`/`AGENT.md`. Oversized entries are skipped; the rest still import. | `2097152` (2 MB) |
+| `CLAUDE_MEM_IMPORT_MAX_TOTAL_BYTES` | Byte budget for one import run. Exhausting it stops the walk and books the remainder as refused. | `52428800` (50 MB) |
+
 ### Retrieval tuning
 
 Prompt-time search (`UPS_*` = the UserPromptSubmit surface). Defaults are the values the

package/cli/common.mjs

@@ -8,7 +8,7 @@
 // relative-time formatting — every command imports from here so the CLI stays
 // consistent.
 
-import { neutralizeContextDelimiters } from '../format-utils.mjs';
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters } from '../format-utils.mjs';
 
 // ─── Argument Parsing ────────────────────────────────────────────────────────
 
@@ -107,11 +107,19 @@ export function parseArgs(argv) {
  * The transform is idempotent (it strips brackets, it does not re-add them), so a
  * path that already defanged upstream — `context` → buildSessionContextLines — is
  * unaffected.
+ *
+ * `<skill-loaded>` is neutralized here too (audit 2026-09-05 R6 P1-2). It is deliberately
+ * OFF CONTEXT_DELIMITER_RE so the MCP `mem_use` load path can emit a real wrapper — but no
+ * CLI command emits one, while `registry search|list` DOES print third-party registry names
+ * (a GitHub frontmatter name, or `import --name`, which applies no charset filter). A crafted
+ * name therefore forged a complete skill block out of nothing in ordinary CLI output. The MCP
+ * twin closes the same hole at its own chokepoint (server.mjs defangResult); doing it on one
+ * face only is this repo's first-listed defect class.
  */
 export function out(text) {
-  // String() first: neutralizeContextDelimiters coerces nullish to '', which would turn
-  // a pre-existing `out(undefined)` line from "undefined" into an empty line.
-  outVerbatim(neutralizeContextDelimiters(String(text)));
+  // String() first: the neutralizers coerce nullish to '', which would turn a pre-existing
+  // `out(undefined)` line from "undefined" into an empty line.
+  outVerbatim(neutralizeSkillDelimiters(neutralizeContextDelimiters(String(text))));
 }
 
 /**

package/mem-cli.mjs

@@ -3531,12 +3531,17 @@ async function cmdImport(argv) {
   }
 
   try {
-    const { importFromGitHub } = await import('./registry-importer.mjs');
+    const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
     out(`[mem] Importing from ${url}...`);
-    const results = await importFromGitHub(rdb, url);
+    // `skipped` sink + shared summary (R6 Q1) — same helper the MCP twin renders, so the
+    // bounds cannot end up enforced-but-silent on one of the two faces.
+    const skipped = [];
+    const results = await importFromGitHub(rdb, url, { skipped });
+    const refusal = formatImportSkips(skipped);
 
     if (results.length === 0) {
       out('[mem] No skills/agents found in this repository.');
+      if (refusal) out(`[mem] ${refusal}`);
       return;
     }
 
@@ -3544,6 +3549,7 @@ async function cmdImport(argv) {
     for (const r of results) {
       out(`  ${r.type === 'skill' ? 'S' : 'A'} ${r.name} (id=${r.id})`);
     }
+    if (refusal) out(`[mem] ${refusal}`);
 
     if (flags.enrich) {
       out('[mem] Running LLM enrichment...');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.97.0",
+  "version": "3.98.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.97.0",
+      "version": "3.98.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.30.0",
         "better-sqlite3": "^12.11.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.97.0",
+  "version": "3.98.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-github.mjs

@@ -34,25 +34,43 @@ export function parseGitHubUrl(url) {
   };
 }
 
+// Percent-encode ONE path segment. Git ref names may legally contain `#` (git forbids `?`,
+// not `#`), and so may file names — interpolated raw, that `#` opens a URL FRAGMENT and
+// swallows the rest: `…/git/trees/feat#x?recursive=1` parses as hash `#x?recursive=1` with an
+// EMPTY query, so GitHub answered a NON-recursive tree and every nested skills/*/SKILL.md went
+// silently undiscovered; the raw content URL lost its whole path the same way (audit
+// 2026-09-05 R6 Q2, measured). encodeURIComponent leaves the unreserved set — including the
+// `.`, `-`, `_` and `~` that ordinary owners/repos/branches are made of — untouched.
+const seg = (s) => encodeURIComponent(String(s ?? ''));
+
+// A repo-relative file path is MANY segments: encode each one but keep the `/` separators.
+// encodeURIComponent on the whole path would emit `skills%2Ffoo%2FSKILL.md` and 404 every
+// ordinary import — the counter-case pinned in tests/registry-github.test.mjs.
+const segPath = (p) =>
+  String(p ?? '')
+    .split('/')
+    .map(seg)
+    .join('/');
+
 /**
  * Build GitHub API tree URL (recursive).
  */
 export function buildTreeUrl(owner, repo, branch) {
-  return `https://api.github.com/repos/${owner}/${repo}/git/trees/${branch}?recursive=1`;
+  return `https://api.github.com/repos/${seg(owner)}/${seg(repo)}/git/trees/${seg(branch)}?recursive=1`;
 }
 
 /**
  * Build raw content URL for a file.
  */
 export function buildContentUrl(owner, repo, branch, path) {
-  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
+  return `https://raw.githubusercontent.com/${seg(owner)}/${seg(repo)}/${seg(branch)}/${segPath(path)}`;
 }
 
 /**
  * Build GitHub API repo metadata URL.
  */
 export function buildRepoUrl(owner, repo) {
-  return `https://api.github.com/repos/${owner}/${repo}`;
+  return `https://api.github.com/repos/${seg(owner)}/${seg(repo)}`;
 }
 
 /**

package/registry-importer.mjs

@@ -22,6 +22,71 @@ import { DB_DIR } from './schema.mjs';
 // read them under CLAUDE_MEM_DIR relocation (D#29). Equals homedir when the env is unset.
 const MANAGED_DIR = join(DB_DIR, 'managed');
 
+// ─── Import bounds (audit 2026-09-05 R6 Q1) ─────────────────────────────────
+// Measured before these existed: a tree offering 500 `skills/*/SKILL.md` entries of 2 MB
+// each imported all 500, issued 502 fetches and wrote 1000.0 MB in 20.1 s — from one
+// `registry import-url`. There was no bound on count, per-file size, or run total, and the
+// input is a third-party repository, so one URL could fill the user's data dir.
+//
+// USER-VISIBLE DEFAULT BEHAVIOR CHANGE: an import that used to be unbounded can now refuse
+// entries. Each bound has an env opt-out and `0` means unlimited — the pre-cap behavior.
+export const IMPORT_DEFAULT_LIMITS = {
+  items: 200,
+  fileBytes: 2 * 1024 * 1024,
+  totalBytes: 50 * 1024 * 1024,
+};
+
+// Module-private: both consumers (resolveImportLimits, formatImportSkips) live here, and
+// exporting it would add a name to the knip unused-export baseline for nothing.
+const IMPORT_LIMIT_ENV = {
+  items: 'CLAUDE_MEM_IMPORT_MAX_ITEMS',
+  fileBytes: 'CLAUDE_MEM_IMPORT_MAX_FILE_BYTES',
+  totalBytes: 'CLAUDE_MEM_IMPORT_MAX_TOTAL_BYTES',
+};
+
+const SKIP_REASON_TEXT = {
+  'item-cap': 'beyond the per-import item cap',
+  'file-too-large': 'over the per-file byte cap',
+  'total-budget': 'past the total byte budget for this import',
+};
+
+/**
+ * Effective bounds: caller override (tests) < env < default.
+ * @param {object} [override] Partial {items,fileBytes,totalBytes}
+ * @param {object} [env] Env source (tests pass their own)
+ */
+function resolveImportLimits(override = {}, env = process.env) {
+  const limits = {};
+  for (const key of Object.keys(IMPORT_DEFAULT_LIMITS)) {
+    const base = override[key] ?? IMPORT_DEFAULT_LIMITS[key];
+    const raw = env[IMPORT_LIMIT_ENV[key]];
+    if (raw === undefined || String(raw).trim() === '') {
+      limits[key] = base;
+      continue;
+    }
+    const n = Number(raw);
+    // `0` = unlimited, the documented opt-out. Anything unparseable or negative KEEPS the
+    // bound: the failure mode of a typo must be "the limit still applies", never "no limit"
+    // — the same fail-closed rule registryConfineEnabled states for its escape hatch.
+    limits[key] = Number.isFinite(n) && n >= 0 ? (n === 0 ? Infinity : n) : base;
+  }
+  return limits;
+}
+
+/**
+ * One-line refusal summary for the two import faces. Shared so the CLI and the MCP tool
+ * cannot drift into two spellings of the same refusal (this repo's first-listed defect class).
+ * @param {Array<{reason: string}>} skipped
+ * @returns {string} '' when nothing was refused.
+ */
+export function formatImportSkips(skipped) {
+  if (!skipped || skipped.length === 0) return '';
+  const byReason = new Map();
+  for (const s of skipped) byReason.set(s.reason, (byReason.get(s.reason) || 0) + 1);
+  const parts = [...byReason].map(([reason, n]) => `${n} ${SKIP_REASON_TEXT[reason] || reason} (${reason})`);
+  return `Refused ${skipped.length}: ${parts.join('; ')}. Set ${IMPORT_LIMIT_ENV.items}/${IMPORT_LIMIT_ENV.fileBytes}/${IMPORT_LIMIT_ENV.totalBytes} (0 = unlimited) to change these bounds.`;
+}
+
 // ─── Tree Discovery ─────────────────────────────────────────────────────────
 
 // Patterns: flat (skills/name/SKILL.md), plugin (plugins/x/skills/y/SKILL.md),
@@ -346,11 +411,30 @@ export async function importFromGitHub(db, url, opts = {}) {
   const discovered = discoverFromTree(treeData, pathFilter);
   if (discovered.length === 0) return [];
 
+  // 4b. Apply the import bounds (R6 Q1). `skipped` is a caller-supplied sink so both faces
+  // can render the refusal; callers that pass nothing keep the previous return shape.
+  const limits = resolveImportLimits(opts.limits, opts.env);
+  const skipped = opts.skipped ?? [];
+  let admitted = discovered;
+  if (discovered.length > limits.items) {
+    admitted = discovered.slice(0, limits.items);
+    for (const over of discovered.slice(limits.items)) {
+      skipped.push({ name: over.name, type: over.type, reason: 'item-cap' });
+    }
+    debugLog(
+      'WARN',
+      'importer',
+      `Item cap ${limits.items} reached; refused ${discovered.length - limits.items} entries`,
+    );
+  }
+
   const repoUrl = `https://github.com/${owner}/${repo}`;
   const results = [];
+  let totalBytes = 0;
 
   // 5. Process each discovered item
-  for (const item of discovered) {
+  for (let i = 0; i < admitted.length; i++) {
+    const item = admitted[i];
     try {
       // 5a. Fetch content via raw GitHub URL
       const contentUrl = buildContentUrl(owner, repo, branch, item.filePath);
@@ -361,14 +445,45 @@ export async function importFromGitHub(db, url, opts = {}) {
       }
       const content = await contentResp.text();
 
+      // 5a-bis. Byte bounds, checked on the fetched body before anything is parsed or
+      // written. The per-file cap refuses ONE entry and keeps going; the run total is a
+      // budget, so exhausting it stops the walk and books every remaining entry as refused
+      // (a partial import must still account for what it did not take).
+      const bytes = Buffer.byteLength(content, 'utf8');
+      if (bytes > limits.fileBytes) {
+        skipped.push({ name: item.name, type: item.type, reason: 'file-too-large', bytes });
+        debugLog('WARN', 'importer', `Refused ${item.filePath}: ${bytes} B over cap ${limits.fileBytes}`);
+        continue;
+      }
+      if (totalBytes + bytes > limits.totalBytes) {
+        for (const rest of admitted.slice(i)) {
+          skipped.push({ name: rest.name, type: rest.type, reason: 'total-budget' });
+        }
+        debugLog('WARN', 'importer', `Total byte budget ${limits.totalBytes} exhausted at ${item.filePath}`);
+        break;
+      }
+      totalBytes += bytes;
+
       // 5b. Parse frontmatter
       const { frontmatter, body } = parseFrontmatter(content);
 
       // Root skill naming: use frontmatter name if present, else repo name for root, else discovered name
       const rawName = frontmatter.name || (item.name === 'root' ? repo : item.name);
       const name = rawName.replace(/[^a-zA-Z0-9._-]/g, '_');
-      // Path traversal guard: reject names that would escape managed directory
       const typeDir = item.type === 'agent' ? 'agents' : 'skills';
+      // Segment guard, BEFORE the confinement check — which cannot catch these (audit
+      // 2026-09-05 R6 P3-2). `.` and `..` survive the charset filter (dot is allowed) and
+      // then PASS confinement, because join() resolves them away first: `<managed>/skills/..`
+      // IS `<managed>`, admitted on isPathConfined's `resolved === base` arm. Not a traversal
+      // — the write stays inside managedDir — but it lands outside the one-directory-per-
+      // resource layout (`<managed>/SKILL.md`, `<managed>/skills/SKILL.md`), where the flat
+      // scanner picks the latter up as a loose resource named `SKILL`, and two repos both
+      // declaring `name: .` overwrite each other. An empty name collapses the same way.
+      if (!name || name === '.' || name === '..') {
+        debugLog('WARN', 'importer', `Rejected non-segment name: ${rawName}`);
+        continue;
+      }
+      // Path traversal guard: reject names that would escape managed directory
       if (!isPathConfined(join(managedDir, typeDir, name), managedDir)) {
         debugLog('WARN', 'importer', `Rejected path-traversal name: ${rawName}`);
         continue;

package/server.mjs

@@ -293,14 +293,28 @@ function applyArgAliases(args, pairs) {
   return next;
 }
 
-function defangResult(result) {
+/**
+ * @param {object} result Tool result.
+ * @param {object} [opts]
+ * @param {boolean} [opts.skillBlocks=true] Also neutralize `<skill-loaded>`. Default ON:
+ *   registry rows carry third-party text (a GitHub frontmatter name, or `import --name`,
+ *   which applies no charset filter), and every registry render used to interpolate it raw —
+ *   so a crafted name FORGED a whole skill block out of nothing in ordinary search/list
+ *   output (audit 2026-09-05 R6 P1-2; F7 on a third face). Enumerating mem_registry found
+ *   the same shape on seven branches plus the shared formatRegistryListLine, which is why
+ *   this is a chokepoint default rather than seven call-site patches. `mem_use` — the one
+ *   handler that must emit a REAL wrapper — turns it off explicitly and defangs its own
+ *   untrusted pieces per call site instead (R6 P1-1).
+ */
+function defangResult(result, { skillBlocks = true } = {}) {
   if (!result || !Array.isArray(result.content)) return result;
+  const scrub = skillBlocks
+    ? (t) => neutralizeSkillDelimiters(neutralizeContextDelimiters(t))
+    : neutralizeContextDelimiters;
   return {
     ...result,
     content: result.content.map((c) =>
-      c && c.type === 'text' && typeof c.text === 'string'
-        ? { ...c, text: neutralizeContextDelimiters(c.text) }
-        : c,
+      c && c.type === 'text' && typeof c.text === 'string' ? { ...c, text: scrub(c.text) } : c,
     ),
   };
 }
@@ -311,14 +325,18 @@ function defangResult(result) {
  * @param {boolean} [opts.verbatim=false] Skip the defang pass. Only for payloads that
  *   must round-trip byte-exact — `mem_export` feeds `restore`, so neutralizing it would
  *   silently corrupt backups of any memory that legitimately discusses these tags.
+ * @param {boolean} [opts.emitsSkillBlock=false] This handler legitimately emits a real
+ *   `<skill-loaded>` wrapper, so the chokepoint must not strip it. `mem_use` is the only
+ *   one, and it neutralizes its own untrusted body/name/path per call site (R6 P1-1).
+ *   Applies to the SUCCESS path only — an error message never emits a wrapper.
  */
-function safeHandler(fn, { verbatim = false } = {}) {
+function safeHandler(fn, { verbatim = false, emitsSkillBlock = false } = {}) {
   return async (args, extra) => {
     try {
       lastMcpRequestTime = Date.now();
       idleCleanupRan = false;
       const result = await fn(args, extra);
-      return verbatim ? result : defangResult(result);
+      return verbatim ? result : defangResult(result, { skillBlocks: !emitsSkillBlock });
     } catch (err) {
       return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
     }
@@ -1683,11 +1701,16 @@ server.registerTool(
       if (!args.url) {
         return { content: [{ type: 'text', text: 'import_url requires a url parameter' }], isError: true };
       }
-      const { importFromGitHub } = await import('./registry-importer.mjs');
+      const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
       try {
-        const results = await importFromGitHub(rdb, args.url);
+        // `skipped` sink + shared summary (R6 Q1): the import bounds must REFUSE visibly, and
+        // the CLI twin renders the identical string from the identical helper.
+        const skipped = [];
+        const results = await importFromGitHub(rdb, args.url, { skipped });
+        const refusal = formatImportSkips(skipped);
         if (results.length === 0) {
-          return { content: [{ type: 'text', text: `No skills/agents found in: ${args.url}` }] };
+          const head = `No skills/agents found in: ${args.url}`;
+          return { content: [{ type: 'text', text: refusal ? `${head}\n${refusal}` : head }] };
         }
 
         let enrichMsg = '';
@@ -1707,7 +1730,7 @@ server.registerTool(
           content: [
             {
               type: 'text',
-              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}`,
+              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}${refusal ? `\n${refusal}` : ''}`,
             },
           ],
         };
@@ -1787,133 +1810,166 @@ server.registerTool(
     description: descriptionOf('mem_use'),
     inputSchema: memUseSchema,
   },
-  safeHandler(async (args) => {
-    const rdb = getRegistryDb();
-    if (!rdb) {
-      return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
-    }
+  safeHandler(
+    async (args) => {
+      const rdb = getRegistryDb();
+      if (!rdb) {
+        return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
+      }
 
-    const name = args.name.trim();
-    const type = args.type || 'skill';
+      const name = args.name.trim();
+      const type = args.type || 'skill';
 
-    // 1. Exact match by name or invocation_name — the ONLY path that loads content.
-    const row = rdb
-      .prepare(
-        `
+      // 1. Exact match by name or invocation_name — the ONLY path that loads content.
+      const row = rdb
+        .prepare(
+          `
       SELECT id, name, type, local_path, invocation_name, capability_summary
       FROM resources
       WHERE status = 'active' AND type = ?
         AND (name = ? OR invocation_name = ?)
       LIMIT 1
     `,
-      )
-      .get(type, name, name);
-
-    // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
-    // produces the candidate list), but its result is only ever rendered as names: loading
-    // the top hit under the caller's requested name shipped a different skill's body inside
-    // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
-    // nothing marking the swap, so an agent that asked for A executed B (audit F1,
-    // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
-    // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
-    // exact-name decision the caller makes.
-    if (!row) {
-      let candidates = [];
-      try {
-        candidates = searchResources(rdb, name, { type, limit: 5 })
-          .map((r) => r.name)
-          .filter(Boolean);
-      } catch {
-        /* a suggestion is best-effort; the miss message below still stands */
-      }
-      // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
-      // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
-      // imperative inside this message, and the handler-wide defangResult cannot catch it —
-      // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
-      // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
-      // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
-      // the suggestion tells the caller to load one by its exact name, so it must stay exact.
-      const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
-      const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
-      const head = `No ${type} found for "${echoed}".`;
-      const browse = `mem_registry(action="search", query="${echoed}")`;
-      if (candidates.length === 0) {
-        return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
+        )
+        .get(type, name, name);
+
+      // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
+      // produces the candidate list), but its result is only ever rendered as names: loading
+      // the top hit under the caller's requested name shipped a different skill's body inside
+      // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
+      // nothing marking the swap, so an agent that asked for A executed B (audit F1,
+      // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
+      // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
+      // exact-name decision the caller makes.
+      if (!row) {
+        let candidates = [];
+        try {
+          candidates = searchResources(rdb, name, { type, limit: 5 })
+            .map((r) => r.name)
+            .filter(Boolean);
+        } catch {
+          /* a suggestion is best-effort; the miss message below still stands */
+        }
+        // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
+        // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
+        // imperative inside this message, and the handler-wide defangResult cannot catch it —
+        // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
+        // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
+        // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
+        // the suggestion tells the caller to load one by its exact name, so it must stay exact.
+        const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
+        const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
+        const head = `No ${type} found for "${echoed}".`;
+        const browse = `mem_registry(action="search", query="${echoed}")`;
+        if (candidates.length === 0) {
+          return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
+        }
+        const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
+        return {
+          content: [
+            {
+              type: 'text',
+              text:
+                `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
+                `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
+            },
+          ],
+        };
       }
-      const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
-      return {
-        content: [
-          {
-            type: 'text',
-            text:
-              `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
-              `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
-          },
-        ],
-      };
-    }
 
-    // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
-    let skillPath = row.local_path || '';
-    if (skillPath && !skillPath.endsWith('.md')) {
-      for (const candidate of [join(skillPath, 'SKILL.md'), join(skillPath, `skills/${row.name}/SKILL.md`)]) {
-        if (existsSync(candidate)) {
-          skillPath = candidate;
-          break;
+      // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
+      let skillPath = row.local_path || '';
+      if (skillPath && !skillPath.endsWith('.md')) {
+        for (const candidate of [
+          join(skillPath, 'SKILL.md'),
+          join(skillPath, `skills/${row.name}/SKILL.md`),
+        ]) {
+          if (existsSync(candidate)) {
+            skillPath = candidate;
+            break;
+          }
         }
       }
-    }
 
-    // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
-    // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
-    // equals homedir when unset, so this does not weaken the non-relocated confinement.
-    const managedBase = DB_DIR;
-    if (skillPath && !isPathConfined(skillPath, managedBase)) {
-      return {
-        content: [{ type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` }],
-        isError: true,
-      };
-    }
+      // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
+      // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
+      // equals homedir when unset, so this does not weaken the non-relocated confinement.
+      const managedBase = DB_DIR;
+      if (skillPath && !isPathConfined(skillPath, managedBase)) {
+        return {
+          content: [
+            { type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` },
+          ],
+          isError: true,
+        };
+      }
 
-    // 5. Read content
-    let content;
-    try {
-      content = readFileSync(skillPath, 'utf8');
-    } catch {
-      const msg = skillPath.endsWith('.md')
-        ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
-        : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
-      return { content: [{ type: 'text', text: msg }], isError: true };
-    }
+      // 5. Read content
+      let content;
+      try {
+        content = readFileSync(skillPath, 'utf8');
+      } catch {
+        const msg = skillPath.endsWith('.md')
+          ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
+          : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
+        return { content: [{ type: 'text', text: msg }], isError: true };
+      }
 
-    // 5. Record invocation
-    try {
-      rdb
-        .prepare(
-          `
+      // 5. Record invocation
+      try {
+        rdb
+          .prepare(
+            `
         INSERT INTO invocations (resource_id, session_id, trigger, adopted, outcome)
         VALUES (?, ?, 'user_explicit', 1, 'success')
       `,
-        )
-        .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
-    } catch {
-      /* non-critical */
-    }
+          )
+          .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
+      } catch {
+        /* non-critical */
+      }
 
-    const _home = homedir();
-    const portablePath =
-      skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
-    const pathAttr = portablePath ? ` path="${portablePath}"` : '';
-    const reloadHint = portablePath ? ` Reload: Read("${portablePath}")` : '';
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `<skill-loaded name="${row.name}" type="${row.type}"${pathAttr}>\n${content}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
-        },
-      ],
-    };
-  }),
+      const _home = homedir();
+      const portablePath =
+        skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
+
+      // Defang the untrusted pieces before wrapping (audit 2026-09-05 R6 P1-1). All three come
+      // from a third-party repo by way of the registry — `registry import-url` stores a body
+      // verbatim, and `registry import --name` stores a name with no charset filter at all — so
+      // this emitter is the containment boundary, not the import.
+      //
+      // The handler-wide defangResult only runs neutralizeContextDelimiters, and <skill-loaded>
+      // is deliberately OFF that list (format-utils.mjs) so this very line can emit a real
+      // wrapper. So the body needs the per-call-site neutralizer: a literal `</skill-loaded>`
+      // in it closed the wrapper and forged a second block attributed to another skill, with
+      // the "Follow the instructions above" sentence below landing after it as an endorsement.
+      // Name and path are stripped rather than neutralized because they land in ATTRIBUTE
+      // position, where a bare `"` breaks out of the tag regardless of any tag-shaped pattern.
+      //
+      // Same treatment the sibling face already applies (scripts/pre-skill-bridge.js, audit
+      // 2026-08-14 M-4 + D#122 ③). The wrapper itself stays live — that is the counter-case
+      // pinned by tests/audit-findings-20260814.test.mjs:605 and this file's last case.
+      // `row.type` is not defanged: the resources CHECK constraint admits only 'skill'|'agent'.
+      const attrSafe = (s) => String(s ?? '').replace(/["'<>]/g, '');
+      const safeName = attrSafe(row.name);
+      const safePath = attrSafe(portablePath);
+      const safeBody = neutralizeSkillDelimiters(content);
+      const pathAttr = safePath ? ` path="${safePath}"` : '';
+      const reloadHint = safePath ? ` Reload: Read("${safePath}")` : '';
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `<skill-loaded name="${safeName}" type="${row.type}"${pathAttr}>\n${safeBody}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
+          },
+        ],
+      };
+      // The one handler that emits a real <skill-loaded> wrapper, so the chokepoint's
+      // skill-block pass is turned OFF here — see defangResult. Everything untrusted inside
+      // the wrapper is neutralized above, per call site.
+    },
+    { emitsSkillBlock: true },
+  ),
 );
 
 // ─── Tool: mem_update ────────────────────────────────────────────────────────