claude-mem-lite 3.97.0 → 3.99.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.97.0",
+      "version": "3.99.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.97.0",
+  "version": "3.99.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -809,6 +809,19 @@ claude-mem-lite.
 | `CLAUDE_MEM_NO_TEMPLATE_REFRESH` | `1` stops SessionStart from refreshing the adopted `CLAUDE.md` managed block when the shipped template changes. | _(refreshes)_ |
 | `MEM_QUIET_HOOKS` | See Core above — the broadest injection-volume switch. | _(disabled)_ |
 
+### Registry import bounds
+
+`registry import-url` pulls from a third-party repository, so it is bounded. Entries past a
+bound are refused, not truncated, and the refusal is printed with the import result. Set any
+of these to `0` for the pre-v3.98 unlimited behavior; an unparseable or negative value keeps
+the default rather than removing the bound.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `CLAUDE_MEM_IMPORT_MAX_ITEMS` | Max skills/agents imported from one repository. | `200` |
+| `CLAUDE_MEM_IMPORT_MAX_FILE_BYTES` | Max size of a single `SKILL.md`/`AGENT.md`. Oversized entries are skipped; the rest still import. | `2097152` (2 MB) |
+| `CLAUDE_MEM_IMPORT_MAX_TOTAL_BYTES` | Byte budget for one import run. Exhausting it stops the walk and books the remainder as refused. | `52428800` (50 MB) |
+
 ### Retrieval tuning
 
 Prompt-time search (`UPS_*` = the UserPromptSubmit surface). Defaults are the values the

package/adopt-content.mjs

@@ -17,11 +17,21 @@
 // memory-dir MEMORY.md sentinel also carried `v1`, but it lives in a different file
 // and is migrated away (claudemd.migrateLegacyMemoryDir), so there is no collision.
 
-import { CLI_INVOKE } from './cli-path.mjs';
-
 export const PLUGIN_SLUG = 'claude-mem-lite';
 export const CURRENT_SENTINEL_VERSION = 'v1';
 
+// The CLI name as written into the user's project tree — deliberately NOT `CLI_INVOKE`
+// (audit R7 P2-1). CLI_INVOKE resolves to an absolute, VERSION-PINNED path
+// (`node /home/<user>/.claude/plugins/cache/sdsrss/claude-mem-lite/<version>/cli.mjs`), and
+// both generators below write files the user may commit: the managed block lands in
+// <cwd>/CLAUDE.md and the detail doc in <cwd>/.claude/, which is the standard home for
+// project-scoped settings/commands/agents and is commonly tracked. Embedding the resolved
+// path there rewrote the file on every plugin release (needsRefresh sees doc drift) and gave
+// teammates a $HOME path that exists on no other machine. This module's output must be
+// byte-identical across installs; the resolved path belongs only on runtime-generated
+// surfaces that never touch the repo (MCP `instructions`, hook recovery lines).
+const CLI = 'claude-mem-lite';
+
 /**
  * The concise managed block injected into <cwd>/CLAUDE.md (between the
  * slug-scoped sentinels — those are added by claudemd.renderBlock, NOT here).
@@ -32,8 +42,8 @@ export const CURRENT_SENTINEL_VERSION = 'v1';
 export function buildClaudeMdBlock() {
   // Intentionally machine-stable: MCP tool names only, NO CLI_INVOKE (that
   // resolves to an absolute path that differs per install — it would make this
-  // committed/refreshed block churn across machines). The robust CLI table lives
-  // in the detail doc (.claude/, gitignored).
+  // committed/refreshed block churn across machines). The detail doc holds the
+  // full CLI table and, since R7 P2-1, is held to the same standard — see CLI above.
   return `## claude-mem-lite — persistent memory
 
 PreToolUse hooks already run \`mem_recall\` for past lessons before Read/Edit/Write. The calls worth making proactively:
@@ -46,7 +56,7 @@ PreToolUse hooks already run \`mem_recall\` for past lessons before Read/Edit/Wr
 | Deferring to a future session | \`mem_defer({title, priority:1|2|3, detail})\`; when fixed, add \`closes_deferred=[N]\` to \`mem_save\` |
 | Looking up past work / history | \`mem_search "keywords"\` · \`mem_recent\` · \`mem_timeline\` |
 
-Path cost is round-trips, not milliseconds: the PreToolUse hook above already recalls (0 calls) — prefer it. For an explicit query, if these \`mem_*\` tools are deferred behind ToolSearch this session, the Bash CLI (exact path in the detail doc) is one call vs two (ToolSearch + call).
+Path cost is round-trips, not milliseconds: the PreToolUse hook above already recalls (0 calls) — prefer it. For an explicit query, if these \`mem_*\` tools are deferred behind ToolSearch this session, the Bash CLI \`${CLI}\` is one call vs two (ToolSearch + call); the MCP server instructions carry the absolute path to use when it is not on PATH.
 
 Full tool + CLI tables, citation/decay rules, and save discipline → \`.claude/plugin_claude_mem_lite.md\``;
 }
@@ -60,10 +70,16 @@ Full tool + CLI tables, citation/decay rules, and save discipline → \`.claude/
 export function getDetailDoc() {
   return `# claude-mem-lite 插件契约（完整）
 
-> 由 \`${CLI_INVOKE} adopt\` 生成、随版本自动刷新；卸载用 \`${CLI_INVOKE} unadopt\`。
+> 由 \`${CLI} adopt\` 生成、随版本自动刷新；卸载用 \`${CLI} unadopt\`。
 > 精炼触发表在项目 \`CLAUDE.md\` 的 \`claude-mem-lite\` 托管块里；本文件是其展开。
 > 设计背景见 docs/CLAUDE-MD-STEERING-PLAN.md。
 
+> **本文下方所有命令写作 \`${CLI} <cmd>\`。** 该名字只在全局装过
+> （\`npm i -g claude-mem-lite\`）时才在 PATH 上；否则用等价的
+> \`node <插件根目录>/cli.mjs <cmd>\`，绝对路径见本会话 MCP server 的 instructions。
+> 本文件**刻意不写死绝对路径**：它随安装位置与版本变化，而本文件可能被提交进仓库，
+> 写死会导致每次升版都改动该文件、且队友拿到的是只在别人机器上存在的路径。
+
 ## 被动 recall（hook 已自动跑，你只需采纳）
 
 PreToolUse hook 在你 Read / Edit / Write 文件前已自动 \`mem_recall\` 该文件：
@@ -108,7 +124,7 @@ PreToolUse hook 在你 Read / Edit / Write 文件前已自动 \`mem_recall\` 该
   lesson_learned="<一行根因+一行修法>", importance=2)\`。判据：未来改同一文件的会话看到这条能否避坑？能→存。
 - **非显然架构决策后**（≠ 改名/挪代码）调 \`mem_save(type="decision",
   lesson_learned="<约束+为何这样选+牺牲了什么>")\`。\`decision\` 命中率显著高于 \`change\`（当前遥测约
-  3:1，会漂移——用 \`${CLI_INVOKE} stats\` 实测，别套固定倍数）；方向稳健：一条好 decision 抵数条 change。
+  3:1，会漂移——用 \`${CLI} stats\` 实测，别套固定倍数）；方向稳健：一条好 decision 抵数条 change。
   别注水：decision 只留给真权衡，不是风格选择。
 - **推迟到未来会话**（≠ 在途 todo、≠ 本 PR 跟进）调
   \`mem_defer({title, priority:1|2|3, detail:"<约束+为何推迟>"})\`。
@@ -127,45 +143,45 @@ PreToolUse hook 在你 Read / Edit / Write 文件前已自动 \`mem_recall\` 该
 
 | 场景 | CLI |
 |------|-----|
-| 清理过期记忆 | \`${CLI_INVOKE} maintain scan --ops purge_stale\` → \`maintain execute --ops purge_stale --confirm\`（删行必须 \`--confirm\`） |
-| 深度优化（Haiku） | \`${CLI_INVOKE} optimize\`（默认 preview；\`--run\` 执行，\`--task re-enrich,normalize,cluster-merge,smart-compress\`） |
-| 压缩旧条目 | \`${CLI_INVOKE} compress\`（默认 preview；\`--execute\` 执行，\`--age-days N\`） |
-| FTS5 索引检查 / 重建 | \`${CLI_INVOKE} fts-check <check\\|rebuild>\` |
-| tier 分组浏览 | \`${CLI_INVOKE} browse [--tier active]\` |
-| 导出 JSON/JSONL | \`${CLI_INVOKE} export [--format jsonl]\` |
-| 统计总量 / 健康 | \`${CLI_INVOKE} stats [--days 30]\` |
-| 删除 / 更新某条 | \`${CLI_INVOKE} delete <id>[,<id>]\` · \`${CLI_INVOKE} update <id> [--title ...]\` |
-| skill-agent registry | \`${CLI_INVOKE} registry <list\\|search\\|import>\` |
+| 清理过期记忆 | \`${CLI} maintain scan --ops purge_stale\` → \`maintain execute --ops purge_stale --confirm\`（删行必须 \`--confirm\`） |
+| 深度优化（Haiku） | \`${CLI} optimize\`（默认 preview；\`--run\` 执行，\`--task re-enrich,normalize,cluster-merge,smart-compress\`） |
+| 压缩旧条目 | \`${CLI} compress\`（默认 preview；\`--execute\` 执行，\`--age-days N\`） |
+| FTS5 索引检查 / 重建 | \`${CLI} fts-check <check\\|rebuild>\` |
+| tier 分组浏览 | \`${CLI} browse [--tier active]\` |
+| 导出 JSON/JSONL | \`${CLI} export [--format jsonl]\` |
+| 统计总量 / 健康 | \`${CLI} stats [--days 30]\` |
+| 删除 / 更新某条 | \`${CLI} delete <id>[,<id>]\` · \`${CLI} update <id> [--title ...]\` |
+| skill-agent registry | \`${CLI} registry <list\\|search\\|import>\` |
 
 ## CLI 速查（常用检索）
 
 | 命令 | 用途 |
 |------|------|
-| \`${CLI_INVOKE} search "query"\` | FTS5 全文搜索（默认排除低信号 \`Modified X\` 等；加 \`--include-noise\` 找文件变更记录） |
-| \`${CLI_INVOKE} search "err" --type bugfix\` | 按类型过滤 |
-| \`${CLI_INVOKE} recall "file.mjs"\` | 文件相关记忆 |
-| \`${CLI_INVOKE} recent 5\` | 最近 5 条 |
-| \`${CLI_INVOKE} get 42,43\` | 按 ID 展开 |
-| \`${CLI_INVOKE} timeline --anchor 42\` | 时间线上下文 |
+| \`${CLI} search "query"\` | FTS5 全文搜索（默认排除低信号 \`Modified X\` 等；加 \`--include-noise\` 找文件变更记录） |
+| \`${CLI} search "err" --type bugfix\` | 按类型过滤 |
+| \`${CLI} recall "file.mjs"\` | 文件相关记忆 |
+| \`${CLI} recent 5\` | 最近 5 条 |
+| \`${CLI} get 42,43\` | 按 ID 展开 |
+| \`${CLI} timeline --anchor 42\` | 时间线上下文 |
 
 ## CLI 速查（写入 / 记录）
 
-写入类工具多从 \`tools/list\` 隐藏 → 只能走 CLI。下表带**硬上限**（超限直接报错，别撞了才知道）；完整 flag 见 \`${CLI_INVOKE} help\`。
+写入类工具多从 \`tools/list\` 隐藏 → 只能走 CLI。下表带**硬上限**（超限直接报错，别撞了才知道）；完整 flag 见 \`${CLI} help\`。
 
 | 命令 | 签名（含硬约束） |
 |------|------------------|
-| 存观测 | \`${CLI_INVOKE} save "<text>" --type bugfix\\|decision --lesson "<≤500 字符>" [--importance 1-3] [--closes-deferred N]\` — \`<text>\` **必填定位参数**；\`--lesson\` 超 500 直接 fail |
-| 推迟工作 | \`${CLI_INVOKE} defer add "<title ≤200>" [--priority 1\\|2\\|3] [--detail "<约束+为何推迟>"]\` — 标题 >200 挪到 \`--detail\` |
-| 改某条 | \`${CLI_INVOKE} update <id> [--lesson "<≤500>"] [--title T] [--type T] [--importance 1-3] [--narrative T] [--concepts "a b c"]\` |
-| 事件日志 | \`${CLI_INVOKE} activity save --type <bugfix\\|lesson\\|bug\\|discovery\\|refactor\\|feature\\|observation\\|decision> "<title>" [--body T] [--files f1,f2]\` |
+| 存观测 | \`${CLI} save "<text>" --type bugfix\\|decision --lesson "<≤500 字符>" [--importance 1-3] [--closes-deferred N]\` — \`<text>\` **必填定位参数**；\`--lesson\` 超 500 直接 fail |
+| 推迟工作 | \`${CLI} defer add "<title ≤200>" [--priority 1\\|2\\|3] [--detail "<约束+为何推迟>"]\` — 标题 >200 挪到 \`--detail\` |
+| 改某条 | \`${CLI} update <id> [--lesson "<≤500>"] [--title T] [--type T] [--importance 1-3] [--narrative T] [--concepts "a b c"]\` |
+| 事件日志 | \`${CLI} activity save --type <bugfix\\|lesson\\|bug\\|discovery\\|refactor\\|feature\\|observation\\|decision> "<title>" [--body T] [--files f1,f2]\` |
 
 \`maintain\` / \`optimize\` / \`compress\` 见上方「维护 / 管理类工具」；\`maintain --ops\` 取值 \`cleanup,decay,boost,demote_pinned,dedup,purge_stale,rebuild_vectors,vacuum\`，省略时默认 \`cleanup,decay,boost,demote_pinned\`（顺序有意义：demote_pinned 必须在 boost 之后）；\`--retain-days\` ∈ [7,365]。
 
 ## 卸载 / 关闭
 
-- \`${CLI_INVOKE} unadopt\`：移除 CLAUDE.md 托管块 + \`.claude/plugin_claude_mem_lite.md\`；
+- \`${CLI} unadopt\`：移除 CLAUDE.md 托管块 + \`.claude/plugin_claude_mem_lite.md\`；
   CLAUDE.md 里你自己的内容（sentinel 之外）不动。
-- 本项目永久关闭自动 adopt：\`${CLI_INVOKE} adopt --disable\`（\`--enable\` 重新武装）。
+- 本项目永久关闭自动 adopt：\`${CLI} adopt --disable\`（\`--enable\` 重新武装）。
 - 全局禁用自动 adopt：环境变量 \`MEM_NO_AUTO_ADOPT=1\`。
 - 关闭版本漂移自动刷新（保留你对托管块的手改）：\`CLAUDE_MEM_NO_TEMPLATE_REFRESH=1\`。
 `;

package/claudemd.mjs

@@ -16,7 +16,7 @@
 //
 // See docs/CLAUDE-MD-STEERING-PLAN.md for rationale + migration.
 
-import { readFileSync, existsSync, unlinkSync, mkdirSync, rmdirSync, readdirSync } from 'fs';
+import { readFileSync, existsSync, unlinkSync, mkdirSync, rmdirSync, readdirSync, lstatSync } from 'fs';
 import { atomicWriteFileSync as atomicWrite } from './lib/atomic-write.mjs';
 import { join } from 'path';
 import { createHash } from 'crypto';
@@ -259,7 +259,21 @@ export function removeManaged(cwd, slug) {
       // Delete the now-empty file rather than writing a 0-byte CLAUDE.md, so
       // unadopt fully restores the pre-adopt state — mirrors the emptied-.claude/
       // cleanup below ("unadopt leaves no trace").
-      if (raw.trim() === '') {
+      //
+      // UNLESS the path is a SYMLINK (audit R7 P2-2). writeManaged reaches this file
+      // through atomicWriteFileSync, which lstats and writes THROUGH a link on purpose —
+      // that is the audit 2026-09-02 P0-5 fix, for CLAUDE.md symlinked into a dotfiles
+      // repo (chezmoi/stow/yadm). Unlinking here would delete the LINK and orphan the
+      // target, i.e. undo that invariant on the removal side. Empty it through the link
+      // instead: a 0-byte file is the lesser evil against silently rearranging the
+      // user's dotfiles. Only a regular file we can prove is ours to remove gets removed.
+      let isLink = false;
+      try {
+        isLink = lstatSync(p).isSymbolicLink();
+      } catch {
+        /* raced away → fall through to the unlink attempt, which will no-op */
+      }
+      if (raw.trim() === '' && !isLink) {
         try {
           unlinkSync(p);
         } catch {

package/cli/common.mjs

@@ -8,7 +8,7 @@
 // relative-time formatting — every command imports from here so the CLI stays
 // consistent.
 
-import { neutralizeContextDelimiters } from '../format-utils.mjs';
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters } from '../format-utils.mjs';
 
 // ─── Argument Parsing ────────────────────────────────────────────────────────
 
@@ -107,11 +107,19 @@ export function parseArgs(argv) {
  * The transform is idempotent (it strips brackets, it does not re-add them), so a
  * path that already defanged upstream — `context` → buildSessionContextLines — is
  * unaffected.
+ *
+ * `<skill-loaded>` is neutralized here too (audit 2026-09-05 R6 P1-2). It is deliberately
+ * OFF CONTEXT_DELIMITER_RE so the MCP `mem_use` load path can emit a real wrapper — but no
+ * CLI command emits one, while `registry search|list` DOES print third-party registry names
+ * (a GitHub frontmatter name, or `import --name`, which applies no charset filter). A crafted
+ * name therefore forged a complete skill block out of nothing in ordinary CLI output. The MCP
+ * twin closes the same hole at its own chokepoint (server.mjs defangResult); doing it on one
+ * face only is this repo's first-listed defect class.
  */
 export function out(text) {
-  // String() first: neutralizeContextDelimiters coerces nullish to '', which would turn
-  // a pre-existing `out(undefined)` line from "undefined" into an empty line.
-  outVerbatim(neutralizeContextDelimiters(String(text)));
+  // String() first: the neutralizers coerce nullish to '', which would turn a pre-existing
+  // `out(undefined)` line from "undefined" into an empty line.
+  outVerbatim(neutralizeSkillDelimiters(neutralizeContextDelimiters(String(text))));
 }
 
 /**

package/lib/citation-tracker.mjs

@@ -1065,12 +1065,30 @@ const SUBAGENT_INJECT_ID_RE = new RegExp(`^\\s{0,4}#(${OBS_ID_DIGITS})\\s+—`);
  * Extract observation ids injected into a subagent's PROMPT by pre-agent-inject.js
  * (formatSubagentContext). Only the `#NN — ` tag line counts; a body cross-reference is
  * ignored. Returns numeric ids.
+ *
+ * TYPE-GATED (audit R7 P1-1). Without `entry.type === 'user'` this scanned assistant text
+ * too, so a subagent that merely QUOTED the block — reviewing this code, summarizing what it
+ * was handed — had those ids counted as injected; and since collectSubagentSurface takes a
+ * per-file `seen ∩ said` intersection, the same quotation credited them as cited, reading
+ * 100% on one self-reference. SURFACE_MATCHERS.task_imperative defends the identical shape by
+ * also gating on the command, for the reason stated in its docblock; this face had nothing.
+ * That mattered beyond metering: `sub.injected` is a citation-decay ENTRY gate (hook.mjs) and
+ * an allow-list for bumpCitationAccess → access_count → the `boost` op → importance.
+ *
+ * The gate value is MEASURED, not assumed (2026-09-05, 11 real subagent transcripts): the
+ * dispatched task prompt is the FIRST entry of each subagent file and carries `type='user'`,
+ * `role='user'`, `isSidechain=true`; the corpus holds assistant ×1036 / attachment ×973 /
+ * user ×668. `tool_result` blocks ride a user entry too, but carry `content` rather than
+ * `text`, so the `x?.text` map below already contributes nothing for them — same reasoning
+ * extractUserTypedIds states for its own scan.
+ *
  * @param {string|null|undefined} transcriptPath
  * @returns {Set<number>}
  */
 export function extractInjectedFromSubagentPrompt(transcriptPath) {
   const ids = new Set();
   for (const entry of readTranscriptEntries(transcriptPath)) {
+    if (entry.type !== 'user') continue;
     const c = entry.message?.content;
     const text =
       typeof c === 'string'

package/mem-cli.mjs

@@ -3531,12 +3531,17 @@ async function cmdImport(argv) {
   }
 
   try {
-    const { importFromGitHub } = await import('./registry-importer.mjs');
+    const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
     out(`[mem] Importing from ${url}...`);
-    const results = await importFromGitHub(rdb, url);
+    // `skipped` sink + shared summary (R6 Q1) — same helper the MCP twin renders, so the
+    // bounds cannot end up enforced-but-silent on one of the two faces.
+    const skipped = [];
+    const results = await importFromGitHub(rdb, url, { skipped });
+    const refusal = formatImportSkips(skipped);
 
     if (results.length === 0) {
       out('[mem] No skills/agents found in this repository.');
+      if (refusal) out(`[mem] ${refusal}`);
       return;
     }
 
@@ -3544,6 +3549,7 @@ async function cmdImport(argv) {
     for (const r of results) {
       out(`  ${r.type === 'skill' ? 'S' : 'A'} ${r.name} (id=${r.id})`);
     }
+    if (refusal) out(`[mem] ${refusal}`);
 
     if (flags.enrich) {
       out('[mem] Running LLM enrichment...');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.97.0",
+  "version": "3.99.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.97.0",
+      "version": "3.99.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.30.0",
         "better-sqlite3": "^12.11.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.97.0",
+  "version": "3.99.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-github.mjs

@@ -34,25 +34,43 @@ export function parseGitHubUrl(url) {
   };
 }
 
+// Percent-encode ONE path segment. Git ref names may legally contain `#` (git forbids `?`,
+// not `#`), and so may file names — interpolated raw, that `#` opens a URL FRAGMENT and
+// swallows the rest: `…/git/trees/feat#x?recursive=1` parses as hash `#x?recursive=1` with an
+// EMPTY query, so GitHub answered a NON-recursive tree and every nested skills/*/SKILL.md went
+// silently undiscovered; the raw content URL lost its whole path the same way (audit
+// 2026-09-05 R6 Q2, measured). encodeURIComponent leaves the unreserved set — including the
+// `.`, `-`, `_` and `~` that ordinary owners/repos/branches are made of — untouched.
+const seg = (s) => encodeURIComponent(String(s ?? ''));
+
+// A repo-relative file path is MANY segments: encode each one but keep the `/` separators.
+// encodeURIComponent on the whole path would emit `skills%2Ffoo%2FSKILL.md` and 404 every
+// ordinary import — the counter-case pinned in tests/registry-github.test.mjs.
+const segPath = (p) =>
+  String(p ?? '')
+    .split('/')
+    .map(seg)
+    .join('/');
+
 /**
  * Build GitHub API tree URL (recursive).
  */
 export function buildTreeUrl(owner, repo, branch) {
-  return `https://api.github.com/repos/${owner}/${repo}/git/trees/${branch}?recursive=1`;
+  return `https://api.github.com/repos/${seg(owner)}/${seg(repo)}/git/trees/${seg(branch)}?recursive=1`;
 }
 
 /**
  * Build raw content URL for a file.
  */
 export function buildContentUrl(owner, repo, branch, path) {
-  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
+  return `https://raw.githubusercontent.com/${seg(owner)}/${seg(repo)}/${seg(branch)}/${segPath(path)}`;
 }
 
 /**
  * Build GitHub API repo metadata URL.
  */
 export function buildRepoUrl(owner, repo) {
-  return `https://api.github.com/repos/${owner}/${repo}`;
+  return `https://api.github.com/repos/${seg(owner)}/${seg(repo)}`;
 }
 
 /**

package/registry-importer.mjs

@@ -22,6 +22,71 @@ import { DB_DIR } from './schema.mjs';
 // read them under CLAUDE_MEM_DIR relocation (D#29). Equals homedir when the env is unset.
 const MANAGED_DIR = join(DB_DIR, 'managed');
 
+// ─── Import bounds (audit 2026-09-05 R6 Q1) ─────────────────────────────────
+// Measured before these existed: a tree offering 500 `skills/*/SKILL.md` entries of 2 MB
+// each imported all 500, issued 502 fetches and wrote 1000.0 MB in 20.1 s — from one
+// `registry import-url`. There was no bound on count, per-file size, or run total, and the
+// input is a third-party repository, so one URL could fill the user's data dir.
+//
+// USER-VISIBLE DEFAULT BEHAVIOR CHANGE: an import that used to be unbounded can now refuse
+// entries. Each bound has an env opt-out and `0` means unlimited — the pre-cap behavior.
+export const IMPORT_DEFAULT_LIMITS = {
+  items: 200,
+  fileBytes: 2 * 1024 * 1024,
+  totalBytes: 50 * 1024 * 1024,
+};
+
+// Module-private: both consumers (resolveImportLimits, formatImportSkips) live here, and
+// exporting it would add a name to the knip unused-export baseline for nothing.
+const IMPORT_LIMIT_ENV = {
+  items: 'CLAUDE_MEM_IMPORT_MAX_ITEMS',
+  fileBytes: 'CLAUDE_MEM_IMPORT_MAX_FILE_BYTES',
+  totalBytes: 'CLAUDE_MEM_IMPORT_MAX_TOTAL_BYTES',
+};
+
+const SKIP_REASON_TEXT = {
+  'item-cap': 'beyond the per-import item cap',
+  'file-too-large': 'over the per-file byte cap',
+  'total-budget': 'past the total byte budget for this import',
+};
+
+/**
+ * Effective bounds: caller override (tests) < env < default.
+ * @param {object} [override] Partial {items,fileBytes,totalBytes}
+ * @param {object} [env] Env source (tests pass their own)
+ */
+function resolveImportLimits(override = {}, env = process.env) {
+  const limits = {};
+  for (const key of Object.keys(IMPORT_DEFAULT_LIMITS)) {
+    const base = override[key] ?? IMPORT_DEFAULT_LIMITS[key];
+    const raw = env[IMPORT_LIMIT_ENV[key]];
+    if (raw === undefined || String(raw).trim() === '') {
+      limits[key] = base;
+      continue;
+    }
+    const n = Number(raw);
+    // `0` = unlimited, the documented opt-out. Anything unparseable or negative KEEPS the
+    // bound: the failure mode of a typo must be "the limit still applies", never "no limit"
+    // — the same fail-closed rule registryConfineEnabled states for its escape hatch.
+    limits[key] = Number.isFinite(n) && n >= 0 ? (n === 0 ? Infinity : n) : base;
+  }
+  return limits;
+}
+
+/**
+ * One-line refusal summary for the two import faces. Shared so the CLI and the MCP tool
+ * cannot drift into two spellings of the same refusal (this repo's first-listed defect class).
+ * @param {Array<{reason: string}>} skipped
+ * @returns {string} '' when nothing was refused.
+ */
+export function formatImportSkips(skipped) {
+  if (!skipped || skipped.length === 0) return '';
+  const byReason = new Map();
+  for (const s of skipped) byReason.set(s.reason, (byReason.get(s.reason) || 0) + 1);
+  const parts = [...byReason].map(([reason, n]) => `${n} ${SKIP_REASON_TEXT[reason] || reason} (${reason})`);
+  return `Refused ${skipped.length}: ${parts.join('; ')}. Set ${IMPORT_LIMIT_ENV.items}/${IMPORT_LIMIT_ENV.fileBytes}/${IMPORT_LIMIT_ENV.totalBytes} (0 = unlimited) to change these bounds.`;
+}
+
 // ─── Tree Discovery ─────────────────────────────────────────────────────────
 
 // Patterns: flat (skills/name/SKILL.md), plugin (plugins/x/skills/y/SKILL.md),
@@ -346,11 +411,30 @@ export async function importFromGitHub(db, url, opts = {}) {
   const discovered = discoverFromTree(treeData, pathFilter);
   if (discovered.length === 0) return [];
 
+  // 4b. Apply the import bounds (R6 Q1). `skipped` is a caller-supplied sink so both faces
+  // can render the refusal; callers that pass nothing keep the previous return shape.
+  const limits = resolveImportLimits(opts.limits, opts.env);
+  const skipped = opts.skipped ?? [];
+  let admitted = discovered;
+  if (discovered.length > limits.items) {
+    admitted = discovered.slice(0, limits.items);
+    for (const over of discovered.slice(limits.items)) {
+      skipped.push({ name: over.name, type: over.type, reason: 'item-cap' });
+    }
+    debugLog(
+      'WARN',
+      'importer',
+      `Item cap ${limits.items} reached; refused ${discovered.length - limits.items} entries`,
+    );
+  }
+
   const repoUrl = `https://github.com/${owner}/${repo}`;
   const results = [];
+  let totalBytes = 0;
 
   // 5. Process each discovered item
-  for (const item of discovered) {
+  for (let i = 0; i < admitted.length; i++) {
+    const item = admitted[i];
     try {
       // 5a. Fetch content via raw GitHub URL
       const contentUrl = buildContentUrl(owner, repo, branch, item.filePath);
@@ -361,14 +445,45 @@ export async function importFromGitHub(db, url, opts = {}) {
       }
       const content = await contentResp.text();
 
+      // 5a-bis. Byte bounds, checked on the fetched body before anything is parsed or
+      // written. The per-file cap refuses ONE entry and keeps going; the run total is a
+      // budget, so exhausting it stops the walk and books every remaining entry as refused
+      // (a partial import must still account for what it did not take).
+      const bytes = Buffer.byteLength(content, 'utf8');
+      if (bytes > limits.fileBytes) {
+        skipped.push({ name: item.name, type: item.type, reason: 'file-too-large', bytes });
+        debugLog('WARN', 'importer', `Refused ${item.filePath}: ${bytes} B over cap ${limits.fileBytes}`);
+        continue;
+      }
+      if (totalBytes + bytes > limits.totalBytes) {
+        for (const rest of admitted.slice(i)) {
+          skipped.push({ name: rest.name, type: rest.type, reason: 'total-budget' });
+        }
+        debugLog('WARN', 'importer', `Total byte budget ${limits.totalBytes} exhausted at ${item.filePath}`);
+        break;
+      }
+      totalBytes += bytes;
+
       // 5b. Parse frontmatter
       const { frontmatter, body } = parseFrontmatter(content);
 
       // Root skill naming: use frontmatter name if present, else repo name for root, else discovered name
       const rawName = frontmatter.name || (item.name === 'root' ? repo : item.name);
       const name = rawName.replace(/[^a-zA-Z0-9._-]/g, '_');
-      // Path traversal guard: reject names that would escape managed directory
       const typeDir = item.type === 'agent' ? 'agents' : 'skills';
+      // Segment guard, BEFORE the confinement check — which cannot catch these (audit
+      // 2026-09-05 R6 P3-2). `.` and `..` survive the charset filter (dot is allowed) and
+      // then PASS confinement, because join() resolves them away first: `<managed>/skills/..`
+      // IS `<managed>`, admitted on isPathConfined's `resolved === base` arm. Not a traversal
+      // — the write stays inside managedDir — but it lands outside the one-directory-per-
+      // resource layout (`<managed>/SKILL.md`, `<managed>/skills/SKILL.md`), where the flat
+      // scanner picks the latter up as a loose resource named `SKILL`, and two repos both
+      // declaring `name: .` overwrite each other. An empty name collapses the same way.
+      if (!name || name === '.' || name === '..') {
+        debugLog('WARN', 'importer', `Rejected non-segment name: ${rawName}`);
+        continue;
+      }
+      // Path traversal guard: reject names that would escape managed directory
       if (!isPathConfined(join(managedDir, typeDir, name), managedDir)) {
         debugLog('WARN', 'importer', `Rejected path-traversal name: ${rawName}`);
         continue;

package/server.mjs

@@ -293,14 +293,28 @@ function applyArgAliases(args, pairs) {
   return next;
 }
 
-function defangResult(result) {
+/**
+ * @param {object} result Tool result.
+ * @param {object} [opts]
+ * @param {boolean} [opts.skillBlocks=true] Also neutralize `<skill-loaded>`. Default ON:
+ *   registry rows carry third-party text (a GitHub frontmatter name, or `import --name`,
+ *   which applies no charset filter), and every registry render used to interpolate it raw —
+ *   so a crafted name FORGED a whole skill block out of nothing in ordinary search/list
+ *   output (audit 2026-09-05 R6 P1-2; F7 on a third face). Enumerating mem_registry found
+ *   the same shape on seven branches plus the shared formatRegistryListLine, which is why
+ *   this is a chokepoint default rather than seven call-site patches. `mem_use` — the one
+ *   handler that must emit a REAL wrapper — turns it off explicitly and defangs its own
+ *   untrusted pieces per call site instead (R6 P1-1).
+ */
+function defangResult(result, { skillBlocks = true } = {}) {
   if (!result || !Array.isArray(result.content)) return result;
+  const scrub = skillBlocks
+    ? (t) => neutralizeSkillDelimiters(neutralizeContextDelimiters(t))
+    : neutralizeContextDelimiters;
   return {
     ...result,
     content: result.content.map((c) =>
-      c && c.type === 'text' && typeof c.text === 'string'
-        ? { ...c, text: neutralizeContextDelimiters(c.text) }
-        : c,
+      c && c.type === 'text' && typeof c.text === 'string' ? { ...c, text: scrub(c.text) } : c,
     ),
   };
 }
@@ -311,14 +325,18 @@ function defangResult(result) {
  * @param {boolean} [opts.verbatim=false] Skip the defang pass. Only for payloads that
  *   must round-trip byte-exact — `mem_export` feeds `restore`, so neutralizing it would
  *   silently corrupt backups of any memory that legitimately discusses these tags.
+ * @param {boolean} [opts.emitsSkillBlock=false] This handler legitimately emits a real
+ *   `<skill-loaded>` wrapper, so the chokepoint must not strip it. `mem_use` is the only
+ *   one, and it neutralizes its own untrusted body/name/path per call site (R6 P1-1).
+ *   Applies to the SUCCESS path only — an error message never emits a wrapper.
  */
-function safeHandler(fn, { verbatim = false } = {}) {
+function safeHandler(fn, { verbatim = false, emitsSkillBlock = false } = {}) {
   return async (args, extra) => {
     try {
       lastMcpRequestTime = Date.now();
       idleCleanupRan = false;
       const result = await fn(args, extra);
-      return verbatim ? result : defangResult(result);
+      return verbatim ? result : defangResult(result, { skillBlocks: !emitsSkillBlock });
     } catch (err) {
       return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
     }
@@ -1683,11 +1701,16 @@ server.registerTool(
       if (!args.url) {
         return { content: [{ type: 'text', text: 'import_url requires a url parameter' }], isError: true };
       }
-      const { importFromGitHub } = await import('./registry-importer.mjs');
+      const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
       try {
-        const results = await importFromGitHub(rdb, args.url);
+        // `skipped` sink + shared summary (R6 Q1): the import bounds must REFUSE visibly, and
+        // the CLI twin renders the identical string from the identical helper.
+        const skipped = [];
+        const results = await importFromGitHub(rdb, args.url, { skipped });
+        const refusal = formatImportSkips(skipped);
         if (results.length === 0) {
-          return { content: [{ type: 'text', text: `No skills/agents found in: ${args.url}` }] };
+          const head = `No skills/agents found in: ${args.url}`;
+          return { content: [{ type: 'text', text: refusal ? `${head}\n${refusal}` : head }] };
         }
 
         let enrichMsg = '';
@@ -1707,7 +1730,7 @@ server.registerTool(
           content: [
             {
               type: 'text',
-              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}`,
+              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}${refusal ? `\n${refusal}` : ''}`,
             },
           ],
         };
@@ -1787,133 +1810,166 @@ server.registerTool(
     description: descriptionOf('mem_use'),
     inputSchema: memUseSchema,
   },
-  safeHandler(async (args) => {
-    const rdb = getRegistryDb();
-    if (!rdb) {
-      return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
-    }
+  safeHandler(
+    async (args) => {
+      const rdb = getRegistryDb();
+      if (!rdb) {
+        return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
+      }
 
-    const name = args.name.trim();
-    const type = args.type || 'skill';
+      const name = args.name.trim();
+      const type = args.type || 'skill';
 
-    // 1. Exact match by name or invocation_name — the ONLY path that loads content.
-    const row = rdb
-      .prepare(
-        `
+      // 1. Exact match by name or invocation_name — the ONLY path that loads content.
+      const row = rdb
+        .prepare(
+          `
       SELECT id, name, type, local_path, invocation_name, capability_summary
       FROM resources
       WHERE status = 'active' AND type = ?
         AND (name = ? OR invocation_name = ?)
       LIMIT 1
     `,
-      )
-      .get(type, name, name);
-
-    // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
-    // produces the candidate list), but its result is only ever rendered as names: loading
-    // the top hit under the caller's requested name shipped a different skill's body inside
-    // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
-    // nothing marking the swap, so an agent that asked for A executed B (audit F1,
-    // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
-    // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
-    // exact-name decision the caller makes.
-    if (!row) {
-      let candidates = [];
-      try {
-        candidates = searchResources(rdb, name, { type, limit: 5 })
-          .map((r) => r.name)
-          .filter(Boolean);
-      } catch {
-        /* a suggestion is best-effort; the miss message below still stands */
-      }
-      // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
-      // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
-      // imperative inside this message, and the handler-wide defangResult cannot catch it —
-      // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
-      // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
-      // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
-      // the suggestion tells the caller to load one by its exact name, so it must stay exact.
-      const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
-      const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
-      const head = `No ${type} found for "${echoed}".`;
-      const browse = `mem_registry(action="search", query="${echoed}")`;
-      if (candidates.length === 0) {
-        return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
+        )
+        .get(type, name, name);
+
+      // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
+      // produces the candidate list), but its result is only ever rendered as names: loading
+      // the top hit under the caller's requested name shipped a different skill's body inside
+      // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
+      // nothing marking the swap, so an agent that asked for A executed B (audit F1,
+      // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
+      // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
+      // exact-name decision the caller makes.
+      if (!row) {
+        let candidates = [];
+        try {
+          candidates = searchResources(rdb, name, { type, limit: 5 })
+            .map((r) => r.name)
+            .filter(Boolean);
+        } catch {
+          /* a suggestion is best-effort; the miss message below still stands */
+        }
+        // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
+        // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
+        // imperative inside this message, and the handler-wide defangResult cannot catch it —
+        // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
+        // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
+        // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
+        // the suggestion tells the caller to load one by its exact name, so it must stay exact.
+        const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
+        const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
+        const head = `No ${type} found for "${echoed}".`;
+        const browse = `mem_registry(action="search", query="${echoed}")`;
+        if (candidates.length === 0) {
+          return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
+        }
+        const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
+        return {
+          content: [
+            {
+              type: 'text',
+              text:
+                `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
+                `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
+            },
+          ],
+        };
       }
-      const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
-      return {
-        content: [
-          {
-            type: 'text',
-            text:
-              `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
-              `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
-          },
-        ],
-      };
-    }
 
-    // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
-    let skillPath = row.local_path || '';
-    if (skillPath && !skillPath.endsWith('.md')) {
-      for (const candidate of [join(skillPath, 'SKILL.md'), join(skillPath, `skills/${row.name}/SKILL.md`)]) {
-        if (existsSync(candidate)) {
-          skillPath = candidate;
-          break;
+      // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
+      let skillPath = row.local_path || '';
+      if (skillPath && !skillPath.endsWith('.md')) {
+        for (const candidate of [
+          join(skillPath, 'SKILL.md'),
+          join(skillPath, `skills/${row.name}/SKILL.md`),
+        ]) {
+          if (existsSync(candidate)) {
+            skillPath = candidate;
+            break;
+          }
         }
       }
-    }
 
-    // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
-    // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
-    // equals homedir when unset, so this does not weaken the non-relocated confinement.
-    const managedBase = DB_DIR;
-    if (skillPath && !isPathConfined(skillPath, managedBase)) {
-      return {
-        content: [{ type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` }],
-        isError: true,
-      };
-    }
+      // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
+      // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
+      // equals homedir when unset, so this does not weaken the non-relocated confinement.
+      const managedBase = DB_DIR;
+      if (skillPath && !isPathConfined(skillPath, managedBase)) {
+        return {
+          content: [
+            { type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` },
+          ],
+          isError: true,
+        };
+      }
 
-    // 5. Read content
-    let content;
-    try {
-      content = readFileSync(skillPath, 'utf8');
-    } catch {
-      const msg = skillPath.endsWith('.md')
-        ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
-        : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
-      return { content: [{ type: 'text', text: msg }], isError: true };
-    }
+      // 5. Read content
+      let content;
+      try {
+        content = readFileSync(skillPath, 'utf8');
+      } catch {
+        const msg = skillPath.endsWith('.md')
+          ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
+          : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
+        return { content: [{ type: 'text', text: msg }], isError: true };
+      }
 
-    // 5. Record invocation
-    try {
-      rdb
-        .prepare(
-          `
+      // 5. Record invocation
+      try {
+        rdb
+          .prepare(
+            `
         INSERT INTO invocations (resource_id, session_id, trigger, adopted, outcome)
         VALUES (?, ?, 'user_explicit', 1, 'success')
       `,
-        )
-        .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
-    } catch {
-      /* non-critical */
-    }
+          )
+          .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
+      } catch {
+        /* non-critical */
+      }
 
-    const _home = homedir();
-    const portablePath =
-      skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
-    const pathAttr = portablePath ? ` path="${portablePath}"` : '';
-    const reloadHint = portablePath ? ` Reload: Read("${portablePath}")` : '';
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `<skill-loaded name="${row.name}" type="${row.type}"${pathAttr}>\n${content}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
-        },
-      ],
-    };
-  }),
+      const _home = homedir();
+      const portablePath =
+        skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
+
+      // Defang the untrusted pieces before wrapping (audit 2026-09-05 R6 P1-1). All three come
+      // from a third-party repo by way of the registry — `registry import-url` stores a body
+      // verbatim, and `registry import --name` stores a name with no charset filter at all — so
+      // this emitter is the containment boundary, not the import.
+      //
+      // The handler-wide defangResult only runs neutralizeContextDelimiters, and <skill-loaded>
+      // is deliberately OFF that list (format-utils.mjs) so this very line can emit a real
+      // wrapper. So the body needs the per-call-site neutralizer: a literal `</skill-loaded>`
+      // in it closed the wrapper and forged a second block attributed to another skill, with
+      // the "Follow the instructions above" sentence below landing after it as an endorsement.
+      // Name and path are stripped rather than neutralized because they land in ATTRIBUTE
+      // position, where a bare `"` breaks out of the tag regardless of any tag-shaped pattern.
+      //
+      // Same treatment the sibling face already applies (scripts/pre-skill-bridge.js, audit
+      // 2026-08-14 M-4 + D#122 ③). The wrapper itself stays live — that is the counter-case
+      // pinned by tests/audit-findings-20260814.test.mjs:605 and this file's last case.
+      // `row.type` is not defanged: the resources CHECK constraint admits only 'skill'|'agent'.
+      const attrSafe = (s) => String(s ?? '').replace(/["'<>]/g, '');
+      const safeName = attrSafe(row.name);
+      const safePath = attrSafe(portablePath);
+      const safeBody = neutralizeSkillDelimiters(content);
+      const pathAttr = safePath ? ` path="${safePath}"` : '';
+      const reloadHint = safePath ? ` Reload: Read("${safePath}")` : '';
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `<skill-loaded name="${safeName}" type="${row.type}"${pathAttr}>\n${safeBody}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
+          },
+        ],
+      };
+      // The one handler that emits a real <skill-loaded> wrapper, so the chokepoint's
+      // skill-block pass is turned OFF here — see defangResult. Everything untrusted inside
+      // the wrapper is neutralized above, per call site.
+    },
+    { emitsSkillBlock: true },
+  ),
 );
 
 // ─── Tool: mem_update ────────────────────────────────────────────────────────