claude-mem-lite 6.10.0 → 6.10.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.10.0",
+      "version": "6.10.1",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.0",
+  "version": "6.10.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-handoff.mjs

@@ -14,7 +14,7 @@ import {
   notLowSignalTitleClause,
   neutralizeContextDelimiters,
 } from './utils.mjs';
-import { scrubRecord, scrubFilePath } from './lib/scrub-record.mjs';
+import { scrubRecord, scrubFilePath, scrubFilePaths } from './lib/scrub-record.mjs';
 import {
   HANDOFF_EXPIRY_CLEAR,
   HANDOFF_EXPIRY_EXIT,
@@ -372,9 +372,10 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
       // rewrite the serialized form risks breaking the downstream JSON.parse. Same rule
       // key_files follows below.
       nextSteps = JSON.stringify({
-        // scrubFilePath, not scrubSecrets: this field is a filesystem PATH, and eight of
-        // the secret patterns carry a value class that does not exclude `/`, so a
-        // whole-path scrub eats the separator and destroys the filename. That is the named
+        // scrubFilePath, not scrubSecrets: this field is a filesystem PATH, and many of
+        // the secret patterns carry a value class that does not exclude `/` (count and
+        // population: lib/scrub-record.mjs), so a whole-path scrub eats the separator and
+        // destroys the filename. That is the named
         // mechanism this repo grew for exactly this shape; the prose fields below are prose
         // and correctly take the plain scrub.
         file: scrubFilePath(String(note.file)),
@@ -386,9 +387,44 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
     /* best-effort, like the task reader above — never block the handoff */
   }
 
-  // 6. Match keywords
-  const allText = [workingOn, ...completed.map((c) => c.title).filter(Boolean), unfinished].join(' ');
-  const keywords = extractMatchKeywords(allText, [...fileSet]);
+  // 6. Match keywords.
+  //
+  // Scrubbed at the DERIVATION, and the scrubbed file array is derived ONCE and feeds both
+  // sinks (here and key_files below) — the shape hook-llm.mjs uses where one path array
+  // reaches two columns. lib/scrub-record.mjs excludes match_keywords from scrubRecord, and
+  // the reason it recorded — "built from tokenizeHandoff() output (alphanumeric tokens
+  // only), so secrets cannot survive the upstream tokenizer" — does not hold on either arm:
+  // the FILE arm never reaches the tokenizer (it takes basename-minus-extension straight off
+  // this set, which holds RAW paths), and the tokenizer SPLITS a secret from its keyword
+  // rather than removing it, so `token=ghp_…` contributes `ghp_…` as a term of its own.
+  //
+  // Exposure, measured rather than asserted: nothing renders this column and no export face
+  // reads the table — `EXPORT_COLUMNS` is observations-only and `session_handoffs` has zero
+  // occurrences in server.mjs and the CLI. So this is local-DB-at-rest, with no egress path.
+  // A credential in a stored column is still worth removing; it is not a disclosure. (The
+  // sentence this replaces claimed egress through `export` and was false — a replacement
+  // justification written while retracting another one, unverified, which is this repo's
+  // signature recurrence. Pre-ship claims lens.)
+  //
+  // Per ELEMENT, then join — never scrub the concatenation. A credential noun ending one
+  // element and a `=`/`:` opening the next form a match that exists in NEITHER, and the
+  // derived term set then loses a word both columns keep (measured: `zebrafish`). Same rule
+  // next_steps and key_files already follow, and the same rule the truncation note below
+  // states. NOT identity on ordinary prose, which an earlier draft of this comment claimed:
+  // `api_key: handling` loses `handling` (5 of 6 ordinary developer prompts in a directed
+  // grid lose exactly one term). What is true, and is the actual justification, is that the
+  // term set now AGREES with what the resuming session is shown — `working_on` / `completed`
+  // / `unfinished` lose the same word through scrubRecord below. No value is scrubbed twice:
+  // these elements and the columns below are separate derivations from one raw source, each
+  // scrubbed once, which is the distinction D#46 is open about.
+  const safeFiles = scrubFilePaths([...fileSet]);
+  // The nullish guard mirrors what join() already did with a nullish element. Without it
+  // String(undefined) would put the literal token "undefined" into the term set — a behaviour
+  // change smuggled in by the per-element rewrite rather than chosen.
+  const allText = [workingOn, ...completed.map((c) => c.title).filter(Boolean), unfinished]
+    .map((t) => (t === null || t === undefined ? '' : scrubSecrets(String(t))))
+    .join(' ');
+  const keywords = extractMatchKeywords(allText, safeFiles);
 
   // T10d: capture HEAD sha so detectContinuationIntent can anchor on it later.
   // Best-effort — failures (non-git dir, missing binary, timeout) yield null.
@@ -427,7 +463,21 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
     key_decisions: decisions.map((d) => `[${d.type}] ${d.title}`).join('\n'),
     match_keywords: keywords,
   });
-  const safeKeyFiles = JSON.stringify([...fileSet].slice(0, 20).map((f) => scrubSecrets(String(f))));
+  // scrubFilePath, not scrubSecrets — the same correction next_steps.file took above, and
+  // key_files was the last of the six path columns still taking the whole-string form. It
+  // was already element-wise, which is what made it look compliant with this module's
+  // prescription; the function was the wrong one. Many SECRET_PATTERNS have a value class
+  // that does not exclude `/` (count and population: lib/scrub-record.mjs), so a whole-path
+  // match eats the separator and the filename
+  // with it, and the renderer below emits `basename(f)` — `## Key Files` read `password=***`
+  // where the file was `notes.mjs`. Worse than a wrong name: fileSet is keyed on the RAW
+  // path, so two files under one credential-bearing directory survive dedup and then
+  // collapse onto the identical stored string.
+  // `safeFiles` was derived at the keywords block above, so both sinks see one scrubbed
+  // array rather than two independent scrubs of the same paths. Slicing after the map is
+  // equivalent to mapping after the slice (per-element, order-preserving) and keeps the
+  // keyword arm on the FULL set, which is what it read before.
+  const safeKeyFiles = JSON.stringify(safeFiles.slice(0, 20));
   // The UPSERT below resets `consumed_at`. Rewriting a handoff makes it fresh again, so it
   // must become injectable again: the DELETE that consumeHandoff replaced did this
   // implicitly (row gone, next build INSERTed a new one), while the UPSERT reuses the row.

package/lib/paused-reader.mjs

@@ -7,8 +7,16 @@
 // while the answer sat in the repo in prose.
 //
 // It is also why the next step is taken from a FILE rather than from a model summary:
-// session_summaries.next_steps is non-empty in 11 of 310 rows (3.5%), so that route has
-// already been measured and does not work.
+// session_summaries.next_steps is thin, but quote BOTH numbers, because the lifetime
+// average hides a trend and a single average was the original justification: 15 of 318 rows
+// non-empty over the corpus lifetime (4.7%), and 4 of the newest 20 (20%). So the honest
+// form is "unreliable", not "does not work" — the recent regime is four times the average.
+// The reason to read a FILE instead is not the rate anyway: a paused note is written by a
+// human on purpose and names its own verify command, which is a different kind of signal
+// from a field an LLM fills in when it happens to.
+//
+// The pre-ship claims lens raised this, reporting 4 of the newest 5 non-empty; that specific
+// figure did not reproduce (measured 1 of 5, 4 of 20). The caveat stood, its number did not.
 //
 // A leaf on purpose — `fs`/`path` only, no package imports and no edge back into the hook
 // layer, so importing it costs nothing at load time (same reason lib/data-paths.mjs is a

package/lib/scrub-record.mjs

@@ -17,6 +17,13 @@
 // .files_modified / .files_read, observation_files.filename and events
 // .file_paths all stored raw paths while the title DERIVED FROM THE SAME PATH
 // was scrubbed. A prescription in a comment is not a mechanism; the helper is.
+//
+// Second axis, found after D#44 closed: that one compliant call site was compliant
+// in SHAPE only. It mapped `scrubSecrets` over the elements — element-wise, as
+// prescribed — and so read as the model the other five were measured against, while
+// taking the whole-string function this module exists to keep off a path. "Follows the
+// rule" and "calls the helper" are different claims, and only the second is checkable.
+// Which is why the prescription above names `scrubFilePaths` rather than describing it.
 
 import { scrubSecrets } from '../secret-scrub.mjs';
 
@@ -52,7 +59,12 @@ export const TEXT_FIELDS_BY_TABLE = {
     'completed',
     'unfinished',
     // Excluded:
-    //   key_files       — JSON.stringify(array); pre-scrub elements at call site
+    //   key_files       — JSON.stringify(array); pre-scrubbed at the call site via
+    //                     `scrubFilePaths`, NOT a bare per-element scrubSecrets. It held
+    //                     filesystem paths and took the whole-string function through
+    //                     v6.10.0, which is the defect scrubFilePath's own docblock
+    //                     describes; the renderer emits basename(), so the destroyed
+    //                     filename was what the resuming session was shown.
     //   next_steps      — same shape, same reason: JSON.stringify({file,title,items}),
     //                     pre-scrubbed element-wise in buildAndSaveHandoff. Listing it
     //                     here would let scrubSecrets rewrite the SERIALIZED JSON, and the
@@ -60,12 +72,20 @@ export const TEXT_FIELDS_BY_TABLE = {
     //                     Next steps section would disappear silently rather than fail.
     //                     Named here because the pre-ship review found the column had been
     //                     added without updating this block, which is the file's contract.
-    //   match_keywords  — currently a space-joined plain string; keeping it
-    //                     here would scrub safely, but the value is built from
-    //                     tokenizeHandoff() output (alphanumeric tokens only),
-    //                     so secrets cannot survive the upstream tokenizer.
-    //                     Excluded to avoid double-work + future-proof against
-    //                     a refactor that switches to JSON.stringify.
+    //   match_keywords  — currently a space-joined plain string. Excluded because the
+    //                     value is scrubbed at its DERIVATION in buildAndSaveHandoff
+    //                     (`scrubSecrets(allText)` + the shared `safeFiles` array), which
+    //                     also future-proofs against a refactor to JSON.stringify.
+    //
+    //                     RETRACTED, measured: the reason recorded here until v6.10.0 was
+    //                     "built from tokenizeHandoff() output (alphanumeric tokens only),
+    //                     so secrets cannot survive the upstream tokenizer." Neither half
+    //                     holds. extractMatchKeywords has TWO arms and the FILE arm never
+    //                     reaches the tokenizer at all — it takes basename-minus-extension
+    //                     off the raw path set. And the tokenizer splits a secret from its
+    //                     keyword rather than removing it: `token=ghp_…` yields `ghp_…` as
+    //                     a term of its own. A no-op justification is worse than no
+    //                     justification, because it retires the question.
     // key_decisions is kept: call site uses '\n'.join (plain string), and
     // decision titles can carry secrets verbatim (LLM output).
     'key_decisions',
@@ -100,8 +120,16 @@ export const TEXT_FIELDS_BY_TABLE = {
  */
 export function scrubFilePath(p) {
   // SEGMENT-WISE, and that is the whole point rather than a micro-optimisation.
-  // Eight SECRET_PATTERNS carry a value class that does not exclude `/`
-  // (secret-scrub.mjs:33/74/78/83/98/109/259/260). On prose that is correct; run
+  // Many SECRET_PATTERNS carry a value class that does not exclude `/`. This is the one place
+  // that number is stated, with its population, because it is GRID-DEPENDENT and five copies of
+  // a bare "eight" is how it went wrong: measured here, 11 of the 40 patterns match text
+  // spanning `/` on a 15-shape credential grid; the two v6.10.1 pre-ship lenses measured 12
+  // (1130 path probes) and 15 (26-shape grid), and 21 on a structural reading of the value
+  // classes. "Eight", carried since v6.8.2 with the enumeration
+  // secret-scrub.mjs:33/74/78/83/98/109/259/260, is an UNDER-count on every one of those
+  // populations — it omits at least the `Authorization:`, `AccountKey=`, `DATABASE_URL`/
+  // `SUPABASE_KEY` and db-connection-URL arms. The mechanism does not depend on the count.
+  // On prose the wide value class is correct; run
   // whole-path, the match eats the separator and everything after it, so
   // `/repo/token=<secret>/notes.mjs` became `/repo/token=***` — the filename
   // destroyed at WRITE time and unrecoverable, and every file under such a
@@ -109,16 +137,27 @@ export function scrubFilePath(p) {
   // recalled another file's observations). Splitting first bounds every pattern to
   // the segment it matched in.
   //
-  // The trade, stated rather than glossed: a credential whose own syntax spans a
-  // separator is no longer caught here — the Slack webhook path and the
-  // `scheme://user:pass@host` arms both need their `/` characters. Those are URL
-  // shapes, and these columns hold filesystem paths; `scrubSecrets` still runs
-  // whole-string on every prose field, which is where a URL actually lands.
-  // Preserving path structure wins because the path IS the recall key.
+  // A credential whose own syntax SPANS a separator — `scheme://user:pass@host`, the Slack
+  // webhook path, a `postgres://` connection string — needs its `/` characters to match at all,
+  // so segment-wise scrubbing cannot see it. That was accepted here until v6.10.1 on the stated
+  // reason "these columns hold filesystem paths", and the pre-ship review measured that premise
+  // FALSE: `lib/save-observation.mjs` filters `params.files` on `typeof f === 'string'` and
+  // nothing else, and `extractFilePaths` returns a URL verbatim from a `{path}` / `{filePath}`
+  // tool input under a `PostToolUse: *` matcher. A URL reaches these columns. Measured: four URL
+  // shapes v6.10.0 redacted were being stored verbatim.
   //
+  // So the value decides, not the column: when it carries `://` it is scrubbed whole-string, the
+  // only way those patterns match. NAMED COST, pinned in tests/secret-scrub-coverage.test.mjs: a
+  // URL whose credential sits in a path SEGMENT now loses its filename to the greedy value class,
+  // which is the thing segment-wise scrubbing exists to prevent, traded back on this one shape.
+  // Redacting a live credential wins over preserving a filename that is not a recall key. The
+  // guard is `scrubSecrets`-decided, not scheme-decided — a credential-free URL comes back
+  // byte-identical, so ordinary `https://` / `s3://` / `file://` values are untouched.
+  const s = String(p ?? '');
+  if (s.includes('://')) return scrubSecrets(s);
   // The capture group keeps the separators in the split output, so join()
   // reconstructs the original byte-for-byte when nothing matches.
-  return String(p ?? '')
+  return s
     .split(/([/\\])/)
     .map((part) => (part === '/' || part === '\\' ? part : scrubSecrets(part)))
     .join('');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.0",
+  "version": "6.10.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.10.0",
+      "version": "6.10.1",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.0",
+  "version": "6.10.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",