claude-mem-lite 4.0.3 → 5.0.0

package/install.mjs

@@ -10,7 +10,6 @@ import {
   mkdirSync,
   mkdtempSync,
   copyFileSync,
-  cpSync,
   renameSync,
   symlinkSync,
   unlinkSync,
@@ -18,7 +17,7 @@ import {
   statSync,
   lstatSync,
 } from 'fs';
-import { join, resolve, dirname, isAbsolute, basename } from 'path';
+import { join, resolve, dirname, basename } from 'path';
 import { homedir, tmpdir } from 'os';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { createRequire } from 'node:module';
@@ -58,7 +57,6 @@ const HOOK_PATH = join(INSTALL_DIR, 'hook.mjs');
 import { MARKETPLACE_KEY, PLUGIN_KEY, isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
 const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 
-import { RESOURCE_METADATA } from './install-metadata.mjs';
 import {
   scanPluginCacheHookPollution,
   hasInstallManagedHooks,
@@ -75,6 +73,7 @@ import { clearNativeBindingBreakage, readNativeBindingBreakage } from './lib/nat
 import { sweepStaleTestFixtures } from './lib/tmp-fixture-sweep.mjs';
 import { acquireLock } from './lib/proc-lock.mjs';
 import { atomicWriteFileSync } from './lib/atomic-write.mjs';
+import { isMemHook, launcherEntryPath } from './lib/hook-prune.mjs';
 
 // Re-export for backward compatibility — tests/install-hook-scripts.test.mjs
 // and any external consumers still import HOOK_SCRIPT_FILES from install.mjs.
@@ -126,177 +125,6 @@ export function migrateLegacyClaudeMemData(oldDir, newDir, opts = {}) {
   return { action: 'backed-up', backupPath };
 }
 
-/**
- * Derive invocation_name from resource name when metadata doesn't provide one.
- * Rules:
- *   "parent/child" → "parent:child"  (plugin:resource format)
- *   "simple-name"  → "simple-name"   (standalone resource)
- * @param {string} name Resource name
- * @returns {string} Derived invocation name
- */
-function deriveInvocationName(name) {
-  if (name.includes('/')) return name.replace('/', ':');
-  return name;
-}
-
-/**
- * Apply curated metadata to existing resource DB entries.
- * Fixes existing installs that have generic name-echo metadata.
- * Also syncs keywords, tech_stack, use_cases and auto-derives invocation_name.
- * @param {Database} rdb Registry database handle
- */
-function reindexKnownResources(rdb) {
-  const update = rdb.prepare(`
-    UPDATE resources SET
-      intent_tags = ?, domain_tags = ?,
-      capability_summary = ?, trigger_patterns = ?,
-      invocation_name = CASE WHEN ? != '' THEN ? ELSE invocation_name END,
-      recommendation_mode = CASE WHEN ? != '' THEN ? ELSE recommendation_mode END,
-      keywords = CASE WHEN ? != '' THEN ? ELSE keywords END,
-      tech_stack = CASE WHEN ? != '' THEN ? ELSE tech_stack END,
-      use_cases = CASE WHEN ? != '' THEN ? ELSE use_cases END,
-      updated_at = datetime('now')
-    WHERE type = ? AND name = ?
-  `);
-
-  rdb.transaction(() => {
-    for (const [key, meta] of Object.entries(RESOURCE_METADATA)) {
-      const sep = key.indexOf(':');
-      if (sep < 0) continue; // skip malformed keys without type:name separator
-      const type = key.slice(0, sep);
-      const name = key.slice(sep + 1);
-      const invName = meta.invocation_name || deriveInvocationName(name);
-      const recMode = meta.recommendation_mode || '';
-      const kw = meta.keywords || '';
-      const ts = meta.tech_stack || '';
-      const uc = meta.use_cases || '';
-      update.run(
-        meta.intent_tags,
-        meta.domain_tags,
-        meta.capability_summary,
-        meta.trigger_patterns,
-        invName,
-        invName,
-        recMode,
-        recMode,
-        kw,
-        kw,
-        ts,
-        ts,
-        uc,
-        uc,
-        type,
-        name,
-      );
-    }
-  })();
-}
-
-/**
- * Register plugin resources that have no local files (virtual resources).
- * These are skills/agents from other installed plugins that the dispatch
- * system should know about for intelligent recommendation.
- * Only inserts entries that don't already exist in the resources table.
- * @param {Database} rdb Registry database handle
- */
-function registerVirtualResources(rdb) {
-  const insert = rdb.prepare(`
-    INSERT OR IGNORE INTO resources (name, type, status, source, local_path, invocation_name,
-      intent_tags, domain_tags, capability_summary, trigger_patterns,
-      keywords, tech_stack, use_cases, recommendation_mode,
-      created_at, updated_at)
-    VALUES (?, ?, 'active', 'preinstalled', '', ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
-  `);
-
-  // Backfill FTS5 fields for existing resources that have empty keywords/tech_stack/use_cases
-  const updateFts = rdb.prepare(`
-    UPDATE resources SET
-      keywords = CASE WHEN (keywords IS NULL OR keywords = '') AND ?1 != '' THEN ?1 ELSE keywords END,
-      tech_stack = CASE WHEN (tech_stack IS NULL OR tech_stack = '') AND ?2 != '' THEN ?2 ELSE tech_stack END,
-      use_cases = CASE WHEN (use_cases IS NULL OR use_cases = '') AND ?3 != '' THEN ?3 ELSE use_cases END,
-      updated_at = datetime('now')
-    WHERE type = ?4 AND name = ?5
-      AND ((keywords IS NULL OR keywords = '') OR (tech_stack IS NULL OR tech_stack = '') OR (use_cases IS NULL OR use_cases = ''))
-  `);
-
-  let count = 0;
-  rdb.transaction(() => {
-    for (const [key, meta] of Object.entries(RESOURCE_METADATA)) {
-      const sep = key.indexOf(':');
-      if (sep < 0) continue;
-      const type = key.slice(0, sep);
-      const name = key.slice(sep + 1);
-      const { changes } = insert.run(
-        name,
-        type,
-        meta.invocation_name || deriveInvocationName(name),
-        meta.intent_tags || name.replace(/-/g, ' '),
-        meta.domain_tags || '',
-        meta.capability_summary || `${type}: ${name.replace(/-/g, ' ')}`,
-        meta.trigger_patterns || `when user needs ${name.replace(/-/g, ' ')}`,
-        meta.keywords || '',
-        meta.tech_stack || '',
-        meta.use_cases || '',
-        meta.recommendation_mode || 'proactive',
-      );
-      count += changes;
-
-      // Backfill FTS5 fields for existing resources.
-      // ?N numbered placeholders REQUIRE object-form binding in better-sqlite3 —
-      // positional .run(v1, v2, …) always throws "Too many parameter values"
-      // regardless of arg count. Pre-fix this swallow-warned on every install
-      // (masked by install.mjs:785 import failure before the v2.84.2 path fix).
-      if (changes === 0) {
-        updateFts.run({
-          1: meta.keywords || '',
-          2: meta.tech_stack || '',
-          3: meta.use_cases || '',
-          4: type,
-          5: name,
-        });
-      }
-    }
-
-    // Backfill keywords from preinstalled tags for resources still missing keywords
-    try {
-      const backfill = rdb.prepare(`
-        UPDATE resources SET keywords = (
-          SELECT GROUP_CONCAT(json_each.value, ',')
-          FROM preinstalled p, json_each(p.tags)
-          WHERE p.type = resources.type AND p.name = resources.name
-        )
-        WHERE (keywords IS NULL OR keywords = '')
-          AND EXISTS (
-            SELECT 1 FROM preinstalled p
-            WHERE p.type = resources.type AND p.name = resources.name
-              AND p.tags != '[]' AND p.tags IS NOT NULL
-          )
-      `);
-      backfill.run();
-    } catch {}
-
-    // Backfill invocation_name for resources that still have it empty
-    // Derive from name: "parent/child" → "parent:child", otherwise use name as-is
-    try {
-      const emptyInvoc = rdb
-        .prepare(
-          `
-        SELECT id, name FROM resources
-        WHERE status = 'active' AND (invocation_name IS NULL OR invocation_name = '')
-      `,
-        )
-        .all();
-      if (emptyInvoc.length > 0) {
-        const setInvoc = rdb.prepare('UPDATE resources SET invocation_name = ? WHERE id = ?');
-        for (const r of emptyInvoc) {
-          setInvoc.run(deriveInvocationName(r.name), r.id);
-        }
-      }
-    } catch {}
-  })();
-  return count;
-}
-
 let cmd = process.argv[2];
 let flags = new Set(process.argv.slice(3));
 
@@ -307,51 +135,6 @@ function ok(msg) {
   console.log(`  ✓ ${msg}`);
 }
 
-/**
- * Recursive on-disk size of `dir`, in bytes. Bounded by `maxEntries` so a
- * surprise-large tree can never turn a progress line into a long stat storm —
- * returns `{ bytes, truncated }` and callers render truncated sums as "≥ N MB".
- *
- * @param {string} dir Directory to measure (missing dir → 0 bytes).
- * @param {number} [maxEntries=50000] Stat budget.
- * @returns {{bytes: number, truncated: boolean}}
- */
-function dirSizeBytes(dir, maxEntries = 50000) {
-  let bytes = 0,
-    seen = 0,
-    truncated = false;
-  const stack = [dir];
-  while (stack.length > 0) {
-    const cur = stack.pop();
-    let entries;
-    try {
-      entries = readdirSync(cur, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const e of entries) {
-      if (++seen > maxEntries) {
-        truncated = true;
-        return { bytes, truncated };
-      }
-      const p = join(cur, e.name);
-      if (e.isDirectory()) stack.push(p);
-      else if (e.isFile()) {
-        try {
-          bytes += statSync(p).size;
-        } catch {
-          /* raced away */
-        }
-      }
-    }
-  }
-  return { bytes, truncated };
-}
-
-/** Render a byte count as a short human string ("148 MB"). */
-function fmtMB(bytes, truncated = false) {
-  return `${truncated ? '≥' : ''}${Math.round(bytes / 1048576)} MB`;
-}
 function warn(msg) {
   console.log(`  ⚠ ${msg}`);
 }
@@ -494,50 +277,6 @@ function isDevInstall() {
   }
 }
 
-// Decide what to check out of a registry repo. We only ever copy the manifest's
-// `entry.path` subdirs into managed/skills|agents, so the working tree never
-// needs the rest of the repo — a partial+sparse clone fetches just those subtrees
-// (e.g. davila7/claude-code-templates: 197MB whole repo → a few MB of 3 paths).
-// Returns { full, paths }: `full` forces a normal checkout when any entry maps to
-// the repo root ('.') — sparse buys nothing there. Unsafe paths ('..'/absolute)
-// are dropped here exactly as the copy loop drops them, so they never reach
-// `sparse-checkout set`. Pure + exported for unit testing.
-export function planRepoSparsePaths(entries) {
-  let needsFull = false;
-  const paths = [];
-  for (const e of entries || []) {
-    const p = e && e.path;
-    if (!p || p === '.' || p === './') {
-      needsFull = true;
-      continue;
-    }
-    if (isAbsolute(p) || String(p).includes('..')) continue; // unsafe — skipped at copy too
-    const norm = String(p).replace(/^\.\//, '').replace(/\/+$/, '');
-    if (norm && !paths.includes(norm)) paths.push(norm);
-  }
-  // No usable sparse paths (all root or all unsafe) → a full checkout is the only
-  // thing that can produce content; sparse would be an empty, pointless tree.
-  return { full: needsFull || paths.length === 0, paths };
-}
-
-// True only for a clone this code produced (partial-clone promisor + sparse-checkout
-// both on). A legacy full clone returns false → caller re-clones it slim. Detection
-// erring false only costs a one-time re-clone (the dir is a rebuildable cache), so
-// over-eager migration is safe; under-eager just keeps a fat clone one more cycle.
-function isPartialSparseClone(clonePath) {
-  const cfg = (key) => {
-    try {
-      return execFileSync('git', ['-C', clonePath, 'config', '--get', key], {
-        encoding: 'utf8',
-        stdio: 'pipe',
-      }).trim();
-    } catch {
-      return '';
-    } // missing key → git exits non-zero → treat as unset
-  };
-  return cfg('remote.origin.promisor') === 'true' && cfg('core.sparseCheckout') === 'true';
-}
-
 // ─── Install ────────────────────────────────────────────────────────────────
 
 // Dynamic-import helpers, resolved against the installed copy at INSTALL_DIR
@@ -616,11 +355,6 @@ function installSourceFiles(IS_DEV) {
       execFileSync('chmod', ['+x', join(scriptsDir, 'post-tool-use.sh')], { stdio: 'pipe' });
     } catch {}
     // commands/ is intentionally NOT copied — see dev-mode branch above.
-    // Copy registry manifest
-    const registryDir = join(DATA_DIR, 'registry');
-    if (!existsSync(registryDir)) mkdirSync(registryDir, { recursive: true });
-    const manifestSrc = join(PROJECT_DIR, 'registry', 'preinstalled.json');
-    if (existsSync(manifestSrc)) copyFileSync(manifestSrc, join(registryDir, 'preinstalled.json'));
     ok('Source files copied to ~/.claude-mem-lite/');
 
     // v2.48 P1-4: prune stale top-level .mjs + 0-byte .db files left behind by
@@ -1049,17 +783,6 @@ function configureHooks() {
     ],
   };
 
-  const memPreSkillBridge = {
-    matcher: 'Skill',
-    hooks: [
-      {
-        type: 'command',
-        command: nodeHook('scripts/pre-skill-bridge.js'),
-        timeout: 3,
-      },
-    ],
-  };
-
   // P0 subagent dispatch-time injection (default off — CLAUDE_MEM_SUBAGENT_INJECT).
   // Fires on the Agent/Task dispatch so a subagent (otherwise memory-blind — #8848)
   // can receive one relevant lesson via updatedInput. Parity with hooks/hooks.json.
@@ -1079,13 +802,13 @@ function configureHooks() {
   };
 
   // Filter out existing mem hooks, then append fresh ones
-  // PreToolUse has three separate matchers, so we register all three
+  // PreToolUse has two separate matchers, so we register both
   // Event set MUST stay equal to hooks/hooks.json's (minus scripts/setup.sh, which
   // bootstraps the plugin cache and has no settings.json counterpart) —
   // tests/audit-silent-20260814.test.mjs diffs a real `install --dev` run's
   // settings.json against the shipped manifest and reds on any new divergence.
   const hookConfigs = {
-    PreToolUse: [memPreToolRecall, memPreSkillBridge, memPreAgentInject],
+    PreToolUse: [memPreToolRecall, memPreAgentInject],
     PostToolUse: [memPostToolUse, memPostToolRecall],
     PostToolUseFailure: [memPostToolFailure],
     PreCompact: [memPreCompact],
@@ -1143,339 +866,6 @@ function backupLegacyClaudeMemData() {
   }
 }
 
-async function installPreinstalledResources() {
-  // 6. Install pre-installed resources (skills + agents)
-  if (process.env.CLAUDE_MEM_SKIP_REPOS) {
-    ok('Skill/agent registry: skipped (CLAUDE_MEM_SKIP_REPOS)');
-  } else
-    try {
-      const manifestPath = join(INSTALL_DIR, 'registry', 'preinstalled.json');
-      if (!existsSync(manifestPath)) {
-        // For git-clone mode, check PROJECT_DIR
-        const altPath = join(PROJECT_DIR, 'registry', 'preinstalled.json');
-        if (existsSync(altPath)) {
-          const registryDir = join(INSTALL_DIR, 'registry');
-          if (!existsSync(registryDir)) mkdirSync(registryDir, { recursive: true });
-          copyFileSync(altPath, manifestPath);
-        }
-      }
-
-      if (existsSync(manifestPath)) {
-        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        const resources = manifest.resources || [];
-
-        if (resources.length > 0) {
-          const managedDir = join(MEM_DATA_DIR, 'managed');
-
-          // 6a. Git shallow clone unique repos
-          const repos = new Map();
-          for (const r of resources) {
-            if (!repos.has(r.repo)) repos.set(r.repo, []);
-            repos.get(r.repo).push(r);
-          }
-
-          // Disclose the cost BEFORE spending it. This step is the single largest
-          // thing `install` does — N shallow git clones over the network, ~150 MB on
-          // disk for the default manifest — and it used to announce itself only after
-          // the fact ("Repos: 15 cloned"). A first-time user on a metered link or a
-          // small disk had no warning and no visible way out; the opt-out existed but
-          // lived only in an env var no output ever mentioned.
-          // Count only repos not already on disk — a re-run/update clones nothing, and
-          // announcing "cloning 15 repos" every time would be false.
-          const repoDirName = (repoUrl) =>
-            repoUrl
-              .split('/')
-              .slice(-2)
-              .join('-')
-              .replace(/[^a-zA-Z0-9._-]/g, '_');
-          const pendingClones = [...repos.keys()].filter(
-            (repoUrl) => !existsSync(join(managedDir, 'repos', repoDirName(repoUrl))),
-          ).length;
-          if (pendingClones > 0) {
-            log(`Skill/agent registry: cloning ${pendingClones} repo(s) — network + ~150 MB on disk.`);
-            log('  Skip with CLAUDE_MEM_SKIP_REPOS=1 (memory features work without it).');
-          }
-
-          let cloned = 0,
-            updated = 0;
-          const deadRepos = new Set(); // repos that no longer exist (404)
-
-          const isRepoNotFound = (err) => {
-            const msg = (err?.stderr ? err.stderr.toString() : '') + (err?.message || '');
-            return /repository.*not found|404/i.test(msg);
-          };
-
-          for (const [repoUrl, entries] of repos) {
-            const repoName = repoUrl
-              .split('/')
-              .slice(-2)
-              .join('-')
-              .replace(/[^a-zA-Z0-9._-]/g, '_');
-            const clonePath = join(managedDir, 'repos', repoName);
-            let repoReady = false;
-
-            const plan = planRepoSparsePaths(entries);
-            const cloneUrl = `${repoUrl.replace(/\.git$/, '')}.git`;
-            // Clone only what we extract: a partial (blob:none) + sparse clone fetches
-            // just the manifest subpaths' subtrees instead of the whole repo. Falls
-            // back to a plain shallow clone if partial-clone/sparse-checkout is
-            // unsupported (old git/server) — identical to the prior behavior.
-            const cloneSlim = () => {
-              if (plan.full) {
-                execFileSync('git', ['clone', '--depth', '1', cloneUrl, clonePath], {
-                  stdio: 'pipe',
-                  timeout: 30000,
-                });
-                return;
-              }
-              try {
-                execFileSync(
-                  'git',
-                  ['clone', '--depth', '1', '--filter=blob:none', '--no-checkout', cloneUrl, clonePath],
-                  { stdio: 'pipe', timeout: 30000 },
-                );
-                execFileSync('git', ['-C', clonePath, 'sparse-checkout', 'set', '--no-cone', ...plan.paths], {
-                  stdio: 'pipe',
-                  timeout: 30000,
-                });
-                execFileSync('git', ['-C', clonePath, 'checkout'], { stdio: 'pipe', timeout: 30000 });
-              } catch {
-                try {
-                  rmSync(clonePath, { recursive: true, force: true });
-                } catch {}
-                execFileSync('git', ['clone', '--depth', '1', cloneUrl, clonePath], {
-                  stdio: 'pipe',
-                  timeout: 30000,
-                });
-              }
-            };
-
-            // Migrate a legacy full clone: drop it so the fresh-clone path below
-            // rebuilds it slim. managed/repos is a rebuildable cache, so this loses
-            // nothing and reclaims the bulk of its footprint on the next install run.
-            if (!plan.full && existsSync(clonePath) && !isPartialSparseClone(clonePath)) {
-              try {
-                rmSync(clonePath, { recursive: true, force: true });
-              } catch {}
-            }
-
-            if (!existsSync(clonePath)) {
-              // Fresh clone (also the rebuild path for a just-migrated legacy clone)
-              try {
-                mkdirSync(join(managedDir, 'repos'), { recursive: true });
-                cloneSlim();
-                cloned++;
-                repoReady = true;
-              } catch (err) {
-                if (isRepoNotFound(err)) {
-                  deadRepos.add(repoUrl);
-                  warn(`  Repo not found (removed?): ${repoUrl}`);
-                } else {
-                  warn(`  Clone failed: ${repoUrl}`);
-                }
-                continue;
-              }
-            } else {
-              // Update existing: fetch latest and fast-forward
-              try {
-                // Re-assert the sparse set so a newer manifest that adds a subpath to
-                // an already-slim clone checks it out (idempotent; no-op for full clones).
-                if (!plan.full && isPartialSparseClone(clonePath)) {
-                  try {
-                    execFileSync(
-                      'git',
-                      ['-C', clonePath, 'sparse-checkout', 'set', '--no-cone', ...plan.paths],
-                      { stdio: 'pipe', timeout: 30000 },
-                    );
-                  } catch {}
-                }
-                const localHash = execFileSync('git', ['-C', clonePath, 'rev-parse', 'HEAD'], {
-                  encoding: 'utf8',
-                  stdio: 'pipe',
-                }).trim();
-                execFileSync('git', ['-C', clonePath, 'fetch', '--depth', '1', 'origin'], {
-                  stdio: 'pipe',
-                  timeout: 30000,
-                });
-                const remoteHash = execFileSync('git', ['-C', clonePath, 'rev-parse', 'FETCH_HEAD'], {
-                  encoding: 'utf8',
-                  stdio: 'pipe',
-                }).trim();
-                if (localHash !== remoteHash) {
-                  execFileSync('git', ['-C', clonePath, 'reset', '--hard', 'FETCH_HEAD'], { stdio: 'pipe' });
-                  updated++;
-                  repoReady = true; // needs re-copy
-                }
-              } catch (err) {
-                if (isRepoNotFound(err)) {
-                  deadRepos.add(repoUrl);
-                  warn(`  Repo not found (removed?): ${repoUrl} — cleaning up`);
-                  // Remove local clone
-                  try {
-                    rmSync(clonePath, { recursive: true, force: true });
-                  } catch {}
-                  // Remove extracted resources
-                  for (const entry of entries) {
-                    const destDir = join(managedDir, entry.type === 'skill' ? 'skills' : 'agents');
-                    const destPath = join(destDir, entry.name);
-                    try {
-                      if (existsSync(destPath)) rmSync(destPath, { recursive: true, force: true });
-                    } catch {}
-                  }
-                  continue;
-                }
-                // Transient failure — use existing clone as-is
-              }
-            }
-
-            // Copy resources to managed/skills/ or managed/agents/
-            // Re-copy if repo was freshly cloned or updated
-            mkdirSync(join(managedDir, 'skills'), { recursive: true });
-            mkdirSync(join(managedDir, 'agents'), { recursive: true });
-            for (const entry of entries) {
-              // Path traversal guard: reject entries with '..' or absolute paths
-              if (
-                entry.path.includes('..') ||
-                entry.name.includes('..') ||
-                isAbsolute(entry.path) ||
-                isAbsolute(entry.name)
-              )
-                continue;
-              const srcPath = entry.path === '.' ? clonePath : join(clonePath, entry.path);
-              const destDir = join(managedDir, entry.type === 'skill' ? 'skills' : 'agents');
-              const destPath = join(destDir, entry.name);
-              if (existsSync(srcPath) && (repoReady || !existsSync(destPath))) {
-                try {
-                  if (existsSync(destPath)) rmSync(destPath, { recursive: true, force: true });
-                  cpSync(srcPath, destPath, { recursive: true });
-                } catch {}
-              }
-            }
-          }
-          const managedSize = dirSizeBytes(managedDir);
-          ok(
-            `Repos: ${cloned} cloned, ${updated} updated, ${repos.size - deadRepos.size} active` +
-              (deadRepos.size > 0 ? `, ${deadRepos.size} dead removed` : '') +
-              ` (${fmtMB(managedSize.bytes, managedSize.truncated)} in ${managedDir})`,
-          );
-
-          // 6b. Init registry DB and record preinstalled entries
-          const { ensureRegistryDb } = await importFromInstall('registry.mjs');
-          const regDbPath = join(MEM_DATA_DIR, 'resource-registry.db');
-          const rdb = ensureRegistryDb(regDbPath);
-
-          const insertPre = rdb.prepare(`
-        INSERT OR REPLACE INTO preinstalled (name, type, repo_url, repo_path, tags, enabled)
-        VALUES (?, ?, ?, ?, ?, 1)
-      `);
-          const activeResources =
-            deadRepos.size > 0 ? resources.filter((r) => !deadRepos.has(r.repo)) : resources;
-          for (const r of activeResources) {
-            insertPre.run(r.name, r.type, r.repo, r.path, JSON.stringify(r.tags || []));
-          }
-
-          // Clean up DB entries for dead repos
-          if (deadRepos.size > 0) {
-            const delPre = rdb.prepare('DELETE FROM preinstalled WHERE repo_url = ?');
-            const delRes = rdb.prepare('DELETE FROM resources WHERE repo_url = ?');
-            for (const deadUrl of deadRepos) {
-              try {
-                delPre.run(deadUrl);
-              } catch {}
-              try {
-                delRes.run(deadUrl);
-              } catch {}
-            }
-          }
-          ok(
-            `Registry DB initialized (${activeResources.length} preinstalled entries` +
-              (deadRepos.size > 0 ? `, ${deadRepos.size} dead repos purged` : '') +
-              ')',
-          );
-
-          // 6c. Fetch GitHub stars (best-effort, unauthenticated)
-          log('  Fetching GitHub stars...');
-          const starCache = new Map();
-          for (const [repoUrl] of repos) {
-            if (deadRepos.has(repoUrl)) continue;
-            const match = repoUrl.match(/github\.com\/([^/]+)\/([^/]+)/);
-            if (match) {
-              try {
-                const apiUrl = `https://api.github.com/repos/${match[1]}/${match[2]}`;
-                const res = execFileSync('curl', ['-sf', apiUrl], { encoding: 'utf8', timeout: 10000 });
-                const data = JSON.parse(res);
-                if (typeof data.stargazers_count === 'number') {
-                  starCache.set(repoUrl, data.stargazers_count);
-                }
-              } catch {}
-            }
-          }
-          if (starCache.size > 0) ok(`Stars fetched (${starCache.size}/${repos.size} repos)`);
-
-          // 6d. Scan and index resources (fallback-only, Haiku indexing deferred to first run)
-          log('  Scanning resources...');
-          const { scanAllResources, diffResources } = await importFromInstall('registry-scanner.mjs');
-          const scanned = scanAllResources({ dataDir: MEM_DATA_DIR });
-
-          // Attach star counts and repo URLs
-          for (const s of scanned) {
-            const entry = resources.find((r) => r.name === s.name && r.type === s.type);
-            if (entry) {
-              s.repoUrl = entry.repo;
-              s.repoStars = starCache.get(entry.repo) || 0;
-            }
-          }
-
-          const { toIndex } = diffResources(rdb, scanned);
-          if (toIndex.length > 0) {
-            // Use fallback indexing at install time (no Haiku calls)
-            // Full Haiku indexing happens on first SessionStart
-            const { upsertResource } = await importFromInstall('registry.mjs');
-            for (const res of toIndex) {
-              try {
-                const metaKey = `${res.type}:${res.name}`;
-                const meta = RESOURCE_METADATA[metaKey];
-                upsertResource(rdb, {
-                  name: res.name,
-                  type: res.type,
-                  status: 'active',
-                  source: res.source,
-                  repo_url: res.repoUrl || null,
-                  repo_stars: res.repoStars || 0,
-                  local_path: res.localPath,
-                  file_hash: res.fileHash,
-                  invocation_name: meta?.invocation_name || deriveInvocationName(res.name),
-                  intent_tags: meta?.intent_tags || res.name.replace(/-/g, ' '),
-                  domain_tags: meta?.domain_tags || '',
-                  trigger_patterns:
-                    meta?.trigger_patterns || `when user needs ${res.name.replace(/-/g, ' ')}`,
-                  capability_summary:
-                    meta?.capability_summary || `${res.type}: ${res.name.replace(/-/g, ' ')}`,
-                });
-              } catch {}
-            }
-            ok(`Resources registered: ${toIndex.length} indexed`);
-          }
-
-          // Apply curated metadata to all known resources (fixes existing installs)
-          reindexKnownResources(rdb);
-          ok('Resource metadata curated (FTS5 reindexed)');
-
-          // Register plugin resources (skills/agents from other plugins, no local files)
-          const virtualCount = registerVirtualResources(rdb);
-          if (virtualCount > 0) ok(`Plugin resources registered: ${virtualCount} virtual entries`);
-
-          rdb.close();
-        }
-      } else {
-        log('  No preinstalled manifest found, skipping');
-      }
-    } catch (e) {
-      warn('Resource setup: ' + e.message);
-      log('  Skills/agents will be indexed on first use');
-    }
-}
-
 function verifyDatabase() {
   // 7. Verify database
   if (existsSync(DB_PATH)) {
@@ -1557,7 +947,6 @@ async function install() {
   const managedHooks = configureHooks();
   dedupePluginCacheAndHooks({ managedHooks });
   backupLegacyClaudeMemData();
-  await installPreinstalledResources();
   verifyDatabase();
   await dogfoodAutoAdopt();
   disableOldClaudeMemPlugin();
@@ -2480,29 +1869,6 @@ async function doctor() {
     }
   }
 
-  // Env flags that are ACCEPTED but do nothing. A flag a user set and believes is
-  // in effect is a silent lie the rest of doctor cannot see: every other check here
-  // asks whether the install is healthy, and this install is perfectly healthy while
-  // behaving as though the flag were unset (audit 2026-08-22 P2-5).
-  // Dynamically imported, and the mode table is read from the module that owns it:
-  // a static import would drag the registry retriever's dependency chain into a tool
-  // whose whole job is to run when the tree is broken, and a local copy of the list
-  // is the drift shape this repo keeps paying for.
-  try {
-    const { getRequestedRecommendMode, RECOMMEND_MODE_UNIMPLEMENTED } =
-      await import('./registry-recommend.mjs');
-    const requested = getRequestedRecommendMode();
-    if (RECOMMEND_MODE_UNIMPLEMENTED.has(requested)) {
-      dwarn(
-        `CLAUDE_MEM_RECOMMEND_MODE=${requested}: accepted but NOT implemented — ` +
-          'live skill-recommendation injection is Phase 2 and does not exist. The engine ' +
-          'is running in shadow (logs only, injects nothing). Set shadow or off.',
-      );
-    }
-  } catch (e) {
-    dwarn('Env flags: check failed — ' + e.message);
-  }
-
   // Plugin cache versions
   const pluginCacheBase = join(homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_KEY, 'claude-mem-lite');
   if (existsSync(pluginCacheBase)) {
@@ -2551,30 +1917,6 @@ async function doctor() {
 
 // ─── Settings helpers ───────────────────────────────────────────────────────
 
-// Identify a settings hook as one of OURS (to replace on install / strip on uninstall).
-// Must be tight: the old `hook.mjs` + event-word test matched a user's OWN generic hook
-// (`node ~/.config/hook.mjs session-start`) and install/uninstall silently deleted it.
-// The launcher marker (`hook-launcher.mjs`, which every Node hook routes through since v2.84)
-// replaces that clause; the product-name substring (our install-dir / legacy-direct hooks)
-// and the bash prefilter round out the real markers.
-export function isMemHook(cfg) {
-  if (!cfg.hooks) return false;
-  return cfg.hooks.some((h) => {
-    const cmd = h.command || '';
-    return (
-      cmd.includes('claude-mem-lite') ||
-      cmd.includes('hook-launcher.mjs') ||
-      cmd.includes('scripts/post-tool-use.sh') ||
-      // Same reason post-tool-use.sh is named here: a bash prefilter routes through
-      // NO launcher, and the product-name clause only fires when the install dir
-      // happens to contain it — which CLAUDE_MEM_DIR can relocate. Without this line
-      // an Agent|Task hook in a relocated install survives uninstall and duplicates
-      // on reinstall (audit 2026-08-22 P2-5 added the second prefilter).
-      cmd.includes('scripts/pre-agent-inject.sh')
-    );
-  });
-}
-
 function hasMemHooksConfigured(settings) {
   if (!settings?.hooks) return false;
   return Object.values(settings.hooks).some(
@@ -2616,7 +1958,7 @@ function looksLikeHookPath(p) {
   return HOOK_PATH_EXTS.some((ext) => p.endsWith(ext));
 }
 
-export function collectOrphanHookPaths(settings) {
+export function collectOrphanHookPaths(settings, installDir = INSTALL_DIR) {
   if (!settings?.hooks) return [];
   const out = [];
   for (const configs of Object.values(settings.hooks)) {
@@ -2626,6 +1968,14 @@ export function collectOrphanHookPaths(settings) {
       for (const h of cfg.hooks || []) {
         const cmd = h.command || '';
         if (cmd.includes('${CLAUDE_PLUGIN_ROOT}')) continue;
+        // The launcher's entry argument, which is unquoted and so invisible to the
+        // quoted-token scan below. Recorded IN ADDITION to that scan, never instead of
+        // it: a `continue` here shadowed a missing `scripts/hook-launcher.mjs` — the
+        // half-applied-update shape where every hook fire dies with
+        // ERR_MODULE_NOT_FOUND — and doctor went back to printing "Orphan hooks: none".
+        // Both files have to exist for the hook to run, so both are reportable.
+        const entry = launcherEntryPath(cmd, installDir);
+        if (entry && !existsSync(entry) && !out.includes(entry)) out.push(entry);
         // v2.80: scan ALL quoted tokens (was: only the first), prefer ones
         // that look like a hook path. Fixes a footgun where a wrapper command
         // like `bash -c "some inline" "/real/path.sh"` would pick "some inline"
@@ -2661,11 +2011,11 @@ export function collectOrphanHookPaths(settings) {
  *   - 0-byte `.db` files that are NOT in the protected-db allow-list
  *
  * Protections (never touched):
- *   - subdirectories (managed/, runtime/, scripts/, lib/, cli/, commands/, server/, node_modules/, .claude-plugin/, registry/, etc.)
+ *   - subdirectories (runtime/, scripts/, lib/, cli/, commands/, server/, node_modules/, .claude-plugin/, etc.)
  *   - non-empty `.db` files — real data risk, always preserved
  *   - WAL/SHM (`*-wal`, `*-shm`) transients
  *   - files not ending in `.mjs` or `.db`
- *   - the two canonical DBs (`claude-mem-lite.db`, `resource-registry.db`) even when 0-byte (fresh-install transient state)
+ *   - the canonical DB (`claude-mem-lite.db`) even when 0-byte (fresh-install transient state)
  *
  * @param {string} dataDir Absolute path, typically `~/.claude-mem-lite`
  * @param {string[]} sourceFiles SOURCE_FILES manifest
@@ -2677,7 +2027,15 @@ export function pruneStaleInstallFiles(dataDir, sourceFiles) {
   // like 'lib/activity.mjs' — those belong to a subdir and prune never touches
   // subdirs anyway. For top-level entries ('server.mjs'), basename === entry.
   const topLevelAllowed = new Set(sourceFiles.filter((f) => !f.includes('/')).map((f) => f));
-  const PROTECTED_DBS = new Set(['claude-mem-lite.db', 'resource-registry.db']);
+  // `resource-registry.db` came off this list with the registry itself. My first pass kept
+  // it on a wrong premise — "a user upgrading from <=4.x might lose data" — but the prune
+  // below gates on `st.size === 0`, so a registry DB with anything in it was never
+  // reachable here in the first place. The only file the entry saved was a ZERO-BYTE one,
+  // which holds no user data and is exactly the stale artifact this function exists to
+  // clear. Nothing creates the file any more, so the "fresh-install transient state"
+  // rationale that keeps `claude-mem-lite.db` here does not transfer. (R9 review F8a
+  // corrected the premise; the CHANGELOG still tells users where the real file lives.)
+  const PROTECTED_DBS = new Set(['claude-mem-lite.db']);
   const removed = [];
   let entries;
   try {