claude-mem-lite 4.0.4 → 5.0.0

package/scripts/user-prompt-search.js

@@ -3,7 +3,7 @@
 // Runs as UserPromptSubmit hook — injects relevant memories before Claude sees the prompt
 // Lightweight: only imports schema.mjs and utils.mjs, no MCP SDK
 
-import { ensureDb, DB_DIR, REGISTRY_DB_PATH } from '../schema.mjs';
+import { ensureDb, DB_DIR } from '../schema.mjs';
 import {
   relaxFtsQueryToOr,
   truncate,
@@ -22,10 +22,9 @@ import { fileMatchClause, fileMatchParams, basenameAnySep } from '../lib/file-ed
 import { cjkPrecisionOk } from '../nlp.mjs';
 import { upsFtsQuery } from '../lib/ups-query.mjs';
 import { corpusFloorScale } from '../lib/relevance-floor.mjs';
-import { writeFileSync, readFileSync, existsSync, renameSync } from 'fs';
-import { join, sep } from 'path';
+import { readFileSync } from 'fs';
+import { join } from 'path';
 import { pathToFileURL } from 'url';
-import Database from 'better-sqlite3';
 import {
   shouldSkip,
   computeEffectiveLen,
@@ -35,12 +34,10 @@ import {
   extractErrorSignature,
   extractDeferredRefs,
   DEDUP_STALE_MS,
-  matchRegistrySkillName,
   detectMemOverride,
 } from './prompt-search-utils.mjs';
 import { injectedIdsFileName, mergeInjectedMarker } from '../lib/injected-ids.mjs';
 import { getDeferredByIds } from '../lib/deferred-work.mjs';
-import { recommendSkill } from '../registry-recommend.mjs';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 
 import { DAY_MS } from '../lib/time-constants.mjs';
@@ -649,73 +646,6 @@ function formatPromptResults(rows) {
   return lines.join('\n');
 }
 
-// ─── Registry Skill Pointer (T4 v2.31) ─────────────────────────────────────
-// Formerly "auto-load": we used to read the full SKILL.md body (up to 16KB)
-// and inject it into stdout on keyword match. Now we only emit a short
-// pointer line so Claude can decide to invoke via SkillTool. The cooldown
-// and match mechanics below are unchanged.
-
-const SKILL_COOLDOWN_FILE = join(RUNTIME_DIR, `.skill-cooldown-${inferProject()}`);
-const SKILL_COOLDOWN_MS = 300_000; // 5 minutes
-
-function loadManagedSkillNames() {
-  if (!existsSync(REGISTRY_DB_PATH)) return new Set();
-  try {
-    const rdb = new Database(REGISTRY_DB_PATH, { readonly: true });
-    rdb.pragma('busy_timeout = 500');
-    try {
-      // D#29: derive the managed marker from the env-aware data dir, not a hardcoded
-      // homedir literal — under CLAUDE_MEM_DIR relocation the stored local_path lives at
-      // DB_DIR/managed, so the old literal matched nothing and dropped every managed skill
-      // from injection. Coarse LIKE prefilter; resource names are re-validated downstream.
-      // D#29: derive the managed marker from the env-aware data dir, not a hardcoded
-      // homedir literal — under CLAUDE_MEM_DIR relocation the stored local_path lives at
-      // DB_DIR/managed, so the old literal matched nothing and dropped every managed skill
-      // from injection. Coarse LIKE prefilter; resource names are re-validated downstream.
-      const rows = rdb
-        .prepare(
-          `
-        SELECT name FROM resources
-        WHERE status = 'active' AND local_path LIKE ?
-      `,
-        )
-        .all(`%${join(DB_DIR, 'managed') + sep}%`);
-      return new Set(rows.map((r) => r.name.toLowerCase()));
-    } finally {
-      rdb.close();
-    }
-  } catch {
-    return new Set();
-  }
-}
-
-function getSkillCooldown() {
-  try {
-    const raw = readFileSync(SKILL_COOLDOWN_FILE, 'utf8');
-    const data = JSON.parse(raw);
-    const now = Date.now();
-    const cleaned = {};
-    for (const [k, v] of Object.entries(data)) {
-      if (now - v < SKILL_COOLDOWN_MS) cleaned[k] = v;
-    }
-    return cleaned;
-  } catch {
-    return {};
-  }
-}
-
-function setSkillCooldown(name) {
-  try {
-    const data = getSkillCooldown();
-    data[name] = Date.now();
-    const tmp = SKILL_COOLDOWN_FILE + `.tmp-${process.pid}`;
-    writeFileSync(tmp, JSON.stringify(data));
-    renameSync(tmp, SKILL_COOLDOWN_FILE);
-  } catch {
-    /* silent */
-  }
-}
-
 // ─── Main ───────────────────────────────────────────────────────────────────
 
 async function main() {
@@ -1091,58 +1021,6 @@ async function main() {
         } catch {}
       }
     }
-
-    // ─── L1: Registry skill pointer (T4 v2.31) ──────────────────────────
-    // Previously this block injected the full skill body (up to 16KB) on
-    // keyword match, silently inflating every matched prompt. We now emit a
-    // single pointer line so Claude can decide to invoke via SkillTool on
-    // demand — the cooldown and match preconditions stay identical.
-    try {
-      const skillNames = loadManagedSkillNames();
-      const matched = matchRegistrySkillName(promptText, skillNames);
-      if (matched) {
-        const cooldown = getSkillCooldown();
-        if (!cooldown[matched]) {
-          // Registry skill names come from third-party repos (tools/adopt import) — an
-          // untrusted boundary like every other DB-derived string on this surface.
-          const safeName = neutralizeContextDelimiters(matched);
-          process.stdout.write(
-            `\n[mem] Skill "${safeName}" may apply — invoke via SkillTool or run: claude-mem-lite registry show ${safeName}\n`,
-          );
-          setSkillCooldown(matched);
-        }
-      }
-    } catch {
-      /* silent — never block on registry failure */
-    }
-
-    // ─── L2: Intent-based skill recommendation (shadow-first, v3.12) ─────
-    // Distinct from L1 (explicit-name pointer): fires on intent even when the
-    // user did not name a skill. Phase 1 = shadow only (logs, never emits).
-    // Reuses a readonly registry DB; cooldown/shadow writes go to the FS.
-    try {
-      if (existsSync(REGISTRY_DB_PATH)) {
-        // #8259: explicit-signal presence is the decisive lever for UPS injection
-        // quality (UPS cite-recall was 25.8% until gated on it). Logged in shadow so
-        // Phase 2 can decide whether live injection gates on it. Shadow measures broadly.
-        const hasSignal = !!(
-          extractErrorSignature(promptText) ||
-          extractFiles(promptText).length > 0 ||
-          detectIntent(promptText)
-        );
-        const rdb = new Database(REGISTRY_DB_PATH, { readonly: true });
-        rdb.pragma('busy_timeout = 500');
-        // CC session_id (hook stdin) is the cross-hook pairing key: PostToolUse adoptions
-        // in this same session join back to this reco for matched precision (B1).
-        try {
-          recommendSkill(rdb, promptText, inferProject(), { hasSignal, sessionId: hookData.session_id });
-        } finally {
-          rdb.close();
-        }
-      }
-    } catch {
-      /* silent — never block on recommendation failure */
-    }
   } catch (e) {
     // Hooks must never break Claude Code — swallow, but RECORD: this catch wraps
     // every FTS query on the surface, so a schema/FTS drift here would zero out

package/server.mjs

@@ -5,9 +5,9 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { truncate, typeIcon, inferProject, fmtDate, debugLog, debugCatch, isPathConfined } from './utils.mjs';
+import { truncate, typeIcon, inferProject, fmtDate, debugLog, debugCatch } from './utils.mjs';
 import { resolveProject as _resolveProjectShared } from './project-utils.mjs';
-import { ensureDbWithWalRecovery, DB_PATH, DB_DIR, REGISTRY_DB_PATH } from './schema.mjs';
+import { ensureDbWithWalRecovery, DB_PATH, DB_DIR } from './schema.mjs';
 import { reRankWithContext, runIdleCleanup, buildServerInstructions } from './search-scoring.mjs';
 import { searchObservationsHybrid } from './search-engine.mjs';
 import { deepSearch, resolveDeepMode, shouldEscalateToDeep, autoDeepLlmReady } from './deep-search.mjs';
@@ -77,9 +77,7 @@ import {
   memExportSchema,
   memRecallSchema,
   memFtsCheckSchema,
-  memRegistrySchema,
   memBrowseSchema,
-  memUseSchema,
   memDeferSchema,
   memDeferListSchema,
   memDeferDropSchema,
@@ -95,24 +93,7 @@ function descriptionOf(name) {
   return d;
 }
 import { optimizePreview, optimizeRun } from './hook-optimize.mjs';
-import { join, sep } from 'path';
-import { homedir } from 'os';
-import {
-  ensureRegistryDb,
-  collectRegistryStats,
-  listResourcesRanked,
-  formatRegistryListLine,
-} from './registry.mjs';
-import {
-  IMPORT_STRING_FIELDS,
-  importResource,
-  removeResource,
-  reindexResources,
-  enrichImportedResources,
-  enrichNamedResource,
-  resourceUseHint,
-} from './lib/registry-core.mjs';
-import { searchResources } from './registry-retriever.mjs';
+import { join } from 'path';
 import {
   probeOtherSources as probeIdSources,
   bucketIdTokens,
@@ -182,21 +163,6 @@ try {
 // Server process uses longer busy_timeout for concurrent MCP requests
 db.pragma('busy_timeout = 5000');
 
-// ─── Registry Database (lazy-loaded on first mem_registry call) ─────────────
-
-let registryDb = null;
-
-function getRegistryDb() {
-  if (registryDb) return registryDb;
-  try {
-    registryDb = ensureRegistryDb(REGISTRY_DB_PATH);
-    registryDb.pragma('busy_timeout = 5000'); // match main DB + ensureRegistryDb (was 3000, overriding it back down)
-  } catch (e) {
-    debugLog('WARN', 'server', `Registry DB not available: ${e.message}`);
-  }
-  return registryDb;
-}
-
 // inferProject, typeIcon, truncate, fmtDate imported from utils.mjs
 
 // ─── Project Name Resolution ────────────────────────────────────────────────
@@ -325,18 +291,20 @@ function defangResult(result, { skillBlocks = true } = {}) {
  * @param {boolean} [opts.verbatim=false] Skip the defang pass. Only for payloads that
  *   must round-trip byte-exact — `mem_export` feeds `restore`, so neutralizing it would
  *   silently corrupt backups of any memory that legitimately discusses these tags.
- * @param {boolean} [opts.emitsSkillBlock=false] This handler legitimately emits a real
- *   `<skill-loaded>` wrapper, so the chokepoint must not strip it. `mem_use` is the only
- *   one, and it neutralizes its own untrusted body/name/path per call site (R6 P1-1).
- *   Applies to the SUCCESS path only — an error message never emits a wrapper.
+ *
+ * There used to be an `emitsSkillBlock` opt-out here, for the one handler that
+ * legitimately emitted a real `<skill-loaded>` wrapper: `mem_use`. It went with the skill
+ * registry, so the chokepoint is now unconditional — every non-verbatim result is defanged
+ * for skill blocks. Do not reintroduce the opt-out for a handler that merely wants to emit
+ * a wrapper; R6 P1-1 was exactly the shape where one exempt face carried the whole risk.
  */
-function safeHandler(fn, { verbatim = false, emitsSkillBlock = false } = {}) {
+function safeHandler(fn, { verbatim = false } = {}) {
   return async (args, extra) => {
     try {
       lastMcpRequestTime = Date.now();
       idleCleanupRan = false;
       const result = await fn(args, extra);
-      return verbatim ? result : defangResult(result, { skillBlocks: !emitsSkillBlock });
+      return verbatim ? result : defangResult(result, { skillBlocks: true });
     } catch (err) {
       return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
     }
@@ -1569,409 +1537,6 @@ server.registerTool(
   }),
 );
 
-// ─── Tool: mem_registry ─────────────────────────────────────────────────────
-
-server.registerTool(
-  'mem_registry',
-  {
-    description: descriptionOf('mem_registry'),
-    inputSchema: memRegistrySchema,
-  },
-  safeHandler(async (args) => {
-    const rdb = getRegistryDb();
-    if (!rdb) {
-      return {
-        content: [{ type: 'text', text: 'Registry DB not available. Run install first.' }],
-        isError: true,
-      };
-    }
-
-    const action = args.action;
-
-    if (action === 'search') {
-      if (!args.query) {
-        return { content: [{ type: 'text', text: 'search requires a query parameter' }], isError: true };
-      }
-      let results = searchResources(rdb, args.query, {
-        type: args.type || undefined,
-        limit: args.category || args.quality ? 20 : 10, // fetch more for post-filtering
-      });
-      // Apply category/quality filters if provided
-      if (args.category) results = results.filter((r) => r.category === args.category);
-      if (args.quality) results = results.filter((r) => r.quality_tier === args.quality);
-      // Prioritize directly invocable resources (with invocation_name) over community resources
-      results.sort((a, b) => {
-        const aInvocable = a.invocation_name ? 1 : 0;
-        const bInvocable = b.invocation_name ? 1 : 0;
-        if (aInvocable !== bInvocable) return bInvocable - aInvocable;
-        return 0; // preserve FTS5 ranking within same tier
-      });
-      results = results.slice(0, 5);
-      if (results.length === 0) {
-        return { content: [{ type: 'text', text: `No matching resources for: "${args.query}"` }] };
-      }
-      const home = homedir();
-      const lines = results.map((r) => {
-        const qualityBadge =
-          r.quality_tier === 'installed' ? '[✓]' : r.quality_tier === 'verified' ? '[★]' : '[○]';
-        const categoryLabel = r.category ? ` [${r.category}]` : '';
-        // P2-6: the invocation rule is shared; only the Markdown bold and the two-space
-        // indent below are this face's.
-        const { portablePath, howToUse } = resourceUseHint(r, {
-          home,
-          managedPrefix: join(DB_DIR, 'managed') + sep,
-        });
-        const pathLine = portablePath ? `\n  Path: ${portablePath}` : '';
-        return `${qualityBadge} ${r.type === 'skill' ? 'S' : 'A'} **${r.name}**${categoryLabel} — ${truncate(r.capability_summary || '', 80)}${pathLine}\n  Use: ${howToUse}`;
-      });
-      return {
-        content: [
-          {
-            type: 'text',
-            text: `Found ${results.length} resource(s) for "${args.query}":\n\n${lines.join('\n\n')}`,
-          },
-        ],
-      };
-    }
-
-    if (action === 'list') {
-      // Shared ranked query + row line (registry.mjs, P2-12) — single source with CLI list.
-      const resources = listResourcesRanked(rdb, { type: args.type });
-      if (resources.length === 0) return { content: [{ type: 'text', text: 'No resources found.' }] };
-      const lines = resources.map(formatRegistryListLine);
-      return { content: [{ type: 'text', text: `Resources (${resources.length}):\n${lines.join('\n')}` }] };
-    }
-
-    if (action === 'stats') {
-      // Shared collection (registry.mjs collectRegistryStats, P2-12) — single
-      // source with the CLI registry stats action.
-      const s = collectRegistryStats(rdb);
-      const lines = [
-        `Registry Stats:`,
-        `  Total active: ${s.total}`,
-        ...s.byType.map((t) => `  ${t.type}: ${t.c}`),
-        `  User-added: ${s.userAdded}`,
-        `  Zero adoption (recommended but never adopted): ${s.zeroAdopt}`,
-      ];
-      if (s.topAdopted.length > 0) {
-        lines.push('', 'Top adopted:');
-        for (const r of s.topAdopted) {
-          lines.push(`  ${r.name} (${r.type}): ${r.adopt_count}/${r.recommend_count}`);
-        }
-      }
-      return { content: [{ type: 'text', text: lines.join('\n') }] };
-    }
-
-    if (action === 'import') {
-      if (!args.name || !args.resource_type) {
-        return { content: [{ type: 'text', text: 'import requires name and resource_type' }], isError: true };
-      }
-      // Provenance preservation + the 'installed' tier grant live in lib/registry-core.mjs,
-      // shared with the `registry import` CLI twin (audit 2026-08-22 P1-3). Before that
-      // extraction this side wrote its own SQL and silently skipped the tier grant.
-      const fields = {};
-      for (const f of IMPORT_STRING_FIELDS) fields[f] = args[f] || '';
-      const { id } = importResource(rdb, {
-        name: args.name,
-        type: args.resource_type,
-        source: args.source,
-        fields,
-      });
-      return { content: [{ type: 'text', text: `Imported: ${args.resource_type}:${args.name} (id=${id})` }] };
-    }
-
-    if (action === 'remove') {
-      if (!args.name || !args.resource_type) {
-        return { content: [{ type: 'text', text: 'remove requires name and resource_type' }], isError: true };
-      }
-      const { removed } = removeResource(rdb, { name: args.name, type: args.resource_type });
-      return {
-        content: [
-          { type: 'text', text: removed ? `Removed: ${args.resource_type}:${args.name}` : 'Not found.' },
-        ],
-      };
-    }
-
-    if (action === 'reindex') {
-      const { activeCount } = reindexResources(rdb);
-      return { content: [{ type: 'text', text: `FTS5 reindexed. ${activeCount} active resources.` }] };
-    }
-
-    if (action === 'import_url') {
-      if (!args.url) {
-        return { content: [{ type: 'text', text: 'import_url requires a url parameter' }], isError: true };
-      }
-      const { importFromGitHub, formatImportSkips } = await import('./registry-importer.mjs');
-      try {
-        // `skipped` sink + shared summary (R6 Q1): the import bounds must REFUSE visibly, and
-        // the CLI twin renders the identical string from the identical helper.
-        const skipped = [];
-        const results = await importFromGitHub(rdb, args.url, { skipped });
-        const refusal = formatImportSkips(skipped);
-        if (results.length === 0) {
-          const head = `No skills/agents found in: ${args.url}`;
-          return { content: [{ type: 'text', text: refusal ? `${head}\n${refusal}` : head }] };
-        }
-
-        let enrichMsg = '';
-        if (args.enrich) {
-          const { enrichResource } = await import('./registry-enricher.mjs');
-          const { ok, denied } = await enrichImportedResources(rdb, results, {
-            confineTo: DB_DIR,
-            enrichResource,
-          });
-          enrichMsg =
-            `\nEnriched: ${ok}/${results.length}` +
-            (denied ? ` (${denied} refused: path outside managed directory)` : '');
-        }
-
-        const lines = results.map((r) => `${r.type === 'skill' ? 'S' : 'A'} ${r.name} (id=${r.id})`);
-        return {
-          content: [
-            {
-              type: 'text',
-              text: `Imported ${results.length} resource(s) from ${args.url}:\n${lines.join('\n')}${enrichMsg}${refusal ? `\n${refusal}` : ''}`,
-            },
-          ],
-        };
-      } catch (e) {
-        return { content: [{ type: 'text', text: `Import failed: ${e.message}` }], isError: true };
-      }
-    }
-
-    if (action === 'enrich') {
-      if (!args.name) {
-        return { content: [{ type: 'text', text: 'enrich requires a name parameter' }], isError: true };
-      }
-      // Confine to the env-aware data dir (managed/ relocates with CLAUDE_MEM_DIR, D#29);
-      // === homedir when the env is unset, so non-relocated confinement is unchanged. The
-      // gate itself now lives in lib/registry-core.mjs so all four enrichment legs share it.
-      const { enrichResource } = await import('./registry-enricher.mjs');
-      try {
-        const { status, error } = await enrichNamedResource(rdb, args.name, {
-          confineTo: DB_DIR,
-          enrichResource,
-        });
-        if (status === 'not-found') {
-          return { content: [{ type: 'text', text: `Resource not found: ${args.name}` }], isError: true };
-        }
-        if (status === 'no-path') {
-          return { content: [{ type: 'text', text: `No local_path for ${args.name}` }], isError: true };
-        }
-        if (status === 'denied') {
-          return {
-            content: [{ type: 'text', text: `Access denied: path outside managed directory` }],
-            isError: true,
-          };
-        }
-        if (status === 'unreadable') {
-          // Pre-refactor this threw out of readFileSync into the catch below and rendered
-          // `Enrich error: <errno>`. Keep the errno: a stale local_path is the common cause.
-          return {
-            content: [{ type: 'text', text: `Enrich error: ${error?.message || 'cannot read local_path'}` }],
-            isError: true,
-          };
-        }
-        return {
-          content: [
-            {
-              type: 'text',
-              text: status === 'enriched' ? `Enriched: ${args.name}` : `Enrichment failed for ${args.name}`,
-            },
-          ],
-        };
-      } catch (e) {
-        return { content: [{ type: 'text', text: `Enrich error: ${e.message}` }], isError: true };
-      }
-    }
-
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `Unknown action: ${action}. Valid: search, list, stats, import, remove, reindex, import_url, enrich`,
-        },
-      ],
-      isError: true,
-    };
-  }),
-);
-
-// ─── Tool: mem_use ──────────────────────────────────────────────────────────
-
-// Cap on the caller-supplied name echoed back in a miss message. Well past any real
-// skill/agent name (the longest registered one here is 23 chars), short enough that an
-// unbounded argument cannot pad the response — the echo appears twice.
-const ECHO_NAME_MAX = 80;
-
-server.registerTool(
-  'mem_use',
-  {
-    description: descriptionOf('mem_use'),
-    inputSchema: memUseSchema,
-  },
-  safeHandler(
-    async (args) => {
-      const rdb = getRegistryDb();
-      if (!rdb) {
-        return { content: [{ type: 'text', text: 'Registry DB not available.' }], isError: true };
-      }
-
-      const name = args.name.trim();
-      const type = args.type || 'skill';
-
-      // 1. Exact match by name or invocation_name — the ONLY path that loads content.
-      const row = rdb
-        .prepare(
-          `
-      SELECT id, name, type, local_path, invocation_name, capability_summary
-      FROM resources
-      WHERE status = 'active' AND type = ?
-        AND (name = ? OR invocation_name = ?)
-      LIMIT 1
-    `,
-        )
-        .get(type, name, name);
-
-      // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
-      // produces the candidate list), but its result is only ever rendered as names: loading
-      // the top hit under the caller's requested name shipped a different skill's body inside
-      // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
-      // nothing marking the swap, so an agent that asked for A executed B (audit F1,
-      // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
-      // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
-      // exact-name decision the caller makes.
-      if (!row) {
-        let candidates = [];
-        try {
-          candidates = searchResources(rdb, name, { type, limit: 5 })
-            .map((r) => r.name)
-            .filter(Boolean);
-        } catch {
-          /* a suggestion is best-effort; the miss message below still stands */
-        }
-        // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
-        // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
-        // imperative inside this message, and the handler-wide defangResult cannot catch it —
-        // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
-        // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
-        // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
-        // the suggestion tells the caller to load one by its exact name, so it must stay exact.
-        const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
-        const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
-        const head = `No ${type} found for "${echoed}".`;
-        const browse = `mem_registry(action="search", query="${echoed}")`;
-        if (candidates.length === 0) {
-          return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
-        }
-        const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
-        return {
-          content: [
-            {
-              type: 'text',
-              text:
-                `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
-                `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.`,
-            },
-          ],
-        };
-      }
-
-      // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
-      let skillPath = row.local_path || '';
-      if (skillPath && !skillPath.endsWith('.md')) {
-        for (const candidate of [
-          join(skillPath, 'SKILL.md'),
-          join(skillPath, `skills/${row.name}/SKILL.md`),
-        ]) {
-          if (existsSync(candidate)) {
-            skillPath = candidate;
-            break;
-          }
-        }
-      }
-
-      // 4. Path confinement check — prevent reading arbitrary files via crafted local_path.
-      // Base is the env-aware data dir (D#29): managed/ relocates with CLAUDE_MEM_DIR and
-      // equals homedir when unset, so this does not weaken the non-relocated confinement.
-      const managedBase = DB_DIR;
-      if (skillPath && !isPathConfined(skillPath, managedBase)) {
-        return {
-          content: [
-            { type: 'text', text: `Access denied: path "${skillPath}" is outside managed directory` },
-          ],
-          isError: true,
-        };
-      }
-
-      // 5. Read content
-      let content;
-      try {
-        content = readFileSync(skillPath, 'utf8');
-      } catch {
-        const msg = skillPath.endsWith('.md')
-          ? `Found ${type} "${row.name}" but cannot read file: ${skillPath}`
-          : `Found ${type} "${row.name}" but no .md file in: ${skillPath}`;
-        return { content: [{ type: 'text', text: msg }], isError: true };
-      }
-
-      // 5. Record invocation
-      try {
-        rdb
-          .prepare(
-            `
-        INSERT INTO invocations (resource_id, session_id, trigger, adopted, outcome)
-        VALUES (?, ?, 'user_explicit', 1, 'success')
-      `,
-          )
-          .run(row.id, process.env.CLAUDE_SESSION_ID || 'unknown');
-      } catch {
-        /* non-critical */
-      }
-
-      const _home = homedir();
-      const portablePath =
-        skillPath && skillPath.startsWith(_home) ? '~' + skillPath.slice(_home.length) : skillPath || '';
-
-      // Defang the untrusted pieces before wrapping (audit 2026-09-05 R6 P1-1). All three come
-      // from a third-party repo by way of the registry — `registry import-url` stores a body
-      // verbatim, and `registry import --name` stores a name with no charset filter at all — so
-      // this emitter is the containment boundary, not the import.
-      //
-      // The handler-wide defangResult only runs neutralizeContextDelimiters, and <skill-loaded>
-      // is deliberately OFF that list (format-utils.mjs) so this very line can emit a real
-      // wrapper. So the body needs the per-call-site neutralizer: a literal `</skill-loaded>`
-      // in it closed the wrapper and forged a second block attributed to another skill, with
-      // the "Follow the instructions above" sentence below landing after it as an endorsement.
-      // Name and path are stripped rather than neutralized because they land in ATTRIBUTE
-      // position, where a bare `"` breaks out of the tag regardless of any tag-shaped pattern.
-      //
-      // Same treatment the sibling face already applies (scripts/pre-skill-bridge.js, audit
-      // 2026-08-14 M-4 + D#122 ③). The wrapper itself stays live — that is the counter-case
-      // pinned by tests/audit-findings-20260814.test.mjs:605 and this file's last case.
-      // `row.type` is not defanged: the resources CHECK constraint admits only 'skill'|'agent'.
-      const attrSafe = (s) => String(s ?? '').replace(/["'<>]/g, '');
-      const safeName = attrSafe(row.name);
-      const safePath = attrSafe(portablePath);
-      const safeBody = neutralizeSkillDelimiters(content);
-      const pathAttr = safePath ? ` path="${safePath}"` : '';
-      const reloadHint = safePath ? ` Reload: Read("${safePath}")` : '';
-      return {
-        content: [
-          {
-            type: 'text',
-            text: `<skill-loaded name="${safeName}" type="${row.type}"${pathAttr}>\n${safeBody}\n</skill-loaded>\n\nFollow the instructions above to execute this ${row.type}.${reloadHint}`,
-          },
-        ],
-      };
-      // The one handler that emits a real <skill-loaded> wrapper, so the chokepoint's
-      // skill-block pass is turned OFF here — see defangResult. Everything untrusted inside
-      // the wrapper is neutralized above, per call site.
-    },
-    { emitsSkillBlock: true },
-  ),
-);
-
 // ─── Tool: mem_update ────────────────────────────────────────────────────────
 
 server.registerTool(
@@ -2335,9 +1900,6 @@ function shutdown(exitCode = 0) {
   try {
     if (db) db.close();
   } catch {}
-  try {
-    if (registryDb) registryDb.close();
-  } catch {}
   process.exit(exitCode);
 }
 process.on('SIGINT', () => shutdown(0));