claude-mem-lite 6.10.0 → 6.10.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.10.0",
+      "version": "6.10.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.0",
+  "version": "6.10.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/format-utils.mjs

@@ -2,6 +2,45 @@ import { DAY_MS } from './lib/time-constants.mjs';
 // claude-mem-lite: String formatting and display utilities
 // Extracted from utils.mjs for focused responsibility
 
+/**
+ * Collapse a value to ONE line: newlines to spaces, then trim. Non-strings and nullish
+ * become ''.
+ *
+ * Named and exported because it is a PRECONDITION two other transforms silently relied on
+ * `truncate` to provide, and both broke when they were reordered around it:
+ *
+ * - `scrubSecrets` — three SECRET_PATTERNS arms carry the prose-position lookbehind
+ *   `(?<![A-Za-z][ \t])`, whose class is HORIZONTAL whitespace on purpose. A credential
+ *   noun at the start of a line therefore reads as CONFIG position to raw text and as PROSE
+ *   position to collapsed text, and the config arm redacts any 6+ char value. Scrubbing
+ *   before truncating (2026-09-21) fed it raw newlines and reinstated a corruption
+ *   secret-scrub.mjs:45-57 records as deliberately undone: `"Reset the\npassword:
+ *   instructions are in the onboarding doc"` stored as `password: *** are in…`, irreversibly.
+ *   Measured 2026-09-22 on a 90-cell grid (6 credential nouns x 5 previous-line endings x 3
+ *   value shapes): 12 cells over-redact and 0 leak. The COUNT is grid-dependent and is
+ *   stated here once with its population rather than repeated elsewhere — the pre-ship lens
+ *   read 9 on a 90-cell grid of the same shape with different value fixtures. What does not
+ *   move between grids: every affected cell needs the previous line to end in a LETTER, the
+ *   direction is uniformly over-redaction rather than leakage, and with this normalization
+ *   restored all 90 cells are byte-identical to the pre-reorder output.
+ * - single-line RENDER sites — a `\n` inside an interpolated value starts a new line in the
+ *   assembled block, so any `## ` after it is a real heading rather than mid-line noise.
+ *
+ * So: any site that scrubs-then-truncates, or that interpolates free text into one line of a
+ * markdown block, normalizes HERE first. `truncate` calls it, which is what kept the two
+ * behaviours coupled while nothing named the coupling.
+ *
+ * @param {*} str Input (any type; coerced)
+ * @returns {string} One-line form, trimmed
+ */
+export function normalizeInline(str) {
+  // Defense-in-depth: a non-string (e.g. an LLM that returned title as an array/number)
+  // would throw `str.replace is not a function` and abort the caller. Coerce to '' rather
+  // than crash; the real type-guarding happens at the call site.
+  if (!str || typeof str !== 'string') return '';
+  return str.replace(/\n/g, ' ').trim();
+}
+
 /**
  * Truncate a string to a maximum length, replacing newlines with spaces.
  * @param {string} str Input string
@@ -9,12 +48,8 @@ import { DAY_MS } from './lib/time-constants.mjs';
  * @returns {string} Truncated string with ellipsis if needed
  */
 export function truncate(str, max = 80) {
+  str = normalizeInline(str);
   if (!str) return '';
-  // Defense-in-depth: a non-string (e.g. an LLM that returned title as an array/number)
-  // would throw `str.replace is not a function` and abort the caller. Coerce to '' rather
-  // than crash; the real type-guarding happens at the call site.
-  if (typeof str !== 'string') return '';
-  str = str.replace(/\n/g, ' ').trim();
   if (str.length <= max) return str;
   // Never split a UTF-16 surrogate pair: slicing between the high and low half emits a
   // lone surrogate (invalid UTF-16) that then gets persisted to the DB. If the last kept
@@ -134,6 +169,68 @@ export function neutralizeContextDelimiters(s) {
   return defangToFixpoint(s, CONTEXT_DELIMITER_RE);
 }
 
+// Markdown ATX markers carried by replayed text, at a token boundary.
+//
+// The injected blocks frame THEMSELVES with `## Working On` / `### Working State` / `###
+// Recent`, and the text they replay is user prompt text — a prompt that opens with its own
+// outline flattens into the block carrying `#` and `##` of its own, on the same line,
+// because working_on joins up to five prompts with ` → `. A real injection read
+// `## Working On` / `# 自主端到端测试与修复循环  ## 角色与授权 …`, at which point the
+// block's structure and the replayed text's structure are indistinguishable to whatever
+// reads it next. Same class as the authority-tag defanging above: a forged SECTION rather
+// than a forged tag.
+//
+// Only a marker followed by whitespace, at a token boundary, counts — `#42`, `C#` and
+// `D#216` are ordinary in this project's prose and survive untouched.
+const ATX_HEADING_RE = /(^|\s)#{1,6}\s/g;
+const ATX_MAX_PASSES = 32;
+
+/**
+ * Strip ATX markers to a FIXPOINT, not in one pass.
+ *
+ * The gap is two characters wide and it is the same one `defangToFixpoint` documents for
+ * the tag half: `(^|\s)` CONSUMES the boundary, so after removing the first `## ` the regex
+ * resumes past the second one and leaves it live. `## ## Key Decisions` came out of a single
+ * pass as a real `## Key Decisions` section inside the block — the precise property this
+ * defanging exists to hold, defeated by two extra characters.
+ *
+ * TERMINATION: every match contains at least one `#` and the replacement drops all of them,
+ * so any pass that changes the string removes at least one `#`. Self-bounded by the number
+ * of `#` in the input, and bounded again by the constant.
+ *
+ * INERT AT ANY DEPTH: still changing at the cap (≥32 nested forged layers, not reachable by
+ * accident) → drop every remaining `#`. Lossier, but the return value then provably carries
+ * no marker, which is the property callers rely on. Same fail-closed shape as the sibling.
+ */
+function stripAtxToFixpoint(s) {
+  let text = s;
+  for (let pass = 0; pass < ATX_MAX_PASSES; pass++) {
+    const next = text.replace(ATX_HEADING_RE, '$1');
+    if (next === text) return text;
+    text = next;
+  }
+  return text.replace(/#/g, '');
+}
+
+/**
+ * Defang authority tags AND section markers, for any replayed free text.
+ *
+ * Lives here rather than in one renderer because the SAME session_handoffs columns are
+ * replayed by two surfaces — `hook-handoff.mjs`'s `<session-handoff>` block and
+ * `hook-context.mjs`'s `### Working State (from /clear)` — and until 2026-09-21 only the first
+ * one called it. One home, so they cannot drift apart again.
+ *
+ * Apply it PER FIELD, never to an assembled block: both callers structure themselves with
+ * ATX headers, so a whole-string pass would delete their own sectioning along with the
+ * forged one.
+ *
+ * @param {*} value Replayed free text (any type; coerced)
+ * @returns {string} Text with delimiter tags and section markers defanged
+ */
+export function safeText(value) {
+  return stripAtxToFixpoint(neutralizeContextDelimiters(String(value)));
+}
+
 // <skill-loaded> is deliberately NOT in CONTEXT_DELIMITER_RE above: mem_use's legitimate
 // load path has to emit a REAL one, and that result goes through the same handler-wide
 // defang, which would strip it. So the tag is neutralized here instead — per call site,

package/hook-context.mjs

@@ -16,6 +16,8 @@ import {
   inferProject,
   debugLog,
   neutralizeContextDelimiters,
+  safeText,
+  normalizeInline,
   DECAY_HALF_LIFE_BY_TYPE,
   DEFAULT_DECAY_HALF_LIFE_MS,
   notLowSignalTitleClause,
@@ -647,7 +649,19 @@ export function buildSessionContextLines(
           const files = JSON.parse(o.files_modified);
           const fname = basename(Array.isArray(files) && files.length > 0 ? files[0] : '');
           if (fname) {
-            fileLessons.push({ id: o.id, line: `- ${fname}: ${truncate(o.lesson_learned, 100)} (#${o.id})` });
+            // `fname` is the ONE value in this block interpolated with neither `truncate` nor
+            // a defang, so a newline inside a stored path put everything after it on its own
+            // line and any `## ` there became a real heading. Reproduced end to end from
+            // `files_modified = ["notes.mjs\n## Forged"]`, which reaches the column because
+            // lib/save-observation.mjs filters `files` on `typeof f === 'string'` and length
+            // only — and `mem_save` is agent-callable, which is the threat model this
+            // defanging exists for. Same mechanism and same source column as the
+            // `- Key files:` line below; found by the pre-ship defect lens after the commit
+            // that fixed that one declared this family closed.
+            fileLessons.push({
+              id: o.id,
+              line: `- ${safeText(normalizeInline(fname))}: ${truncate(o.lesson_learned, 100)} (#${o.id})`,
+            });
             continue;
           }
         } catch {
@@ -772,17 +786,46 @@ export function buildSessionContextLines(
   const handoffLines = [];
   if (prevClearHandoff) {
     handoffLines.push('### Working State (from /clear)');
+    // `safeText`, per field, on all three: these are the same session_handoffs columns
+    // hook-handoff.mjs's `<session-handoff>` block replays, and that surface has defanged
+    // them since a real injection arrived carrying `## ` of its own. This one applied only
+    // the TAG half — the `neutralizeContextDelimiters` at the bottom of this function covers
+    // every line in the block — and no ATX marker at all, so a forged SECTION replayed live.
+    // `working_on` is the worst of the three: it is raw user prompt text.
+    //
+    // Defang BEFORE truncate, the same order the handoff builder's own persistence comment
+    // prescribes, so the 200-char cut cannot leave a half-processed marker at the boundary.
+    //
+    // Per FIELD, never over the assembled block: `### Working State` / `### Recent` /
+    // `### Last Session` are this block's OWN sectioning and a whole-string ATX pass would
+    // delete it. That is also why this is not simply folded into the return below.
     if (prevClearHandoff.working_on) {
-      handoffLines.push(`- Working on: ${truncate(prevClearHandoff.working_on, 200)}`);
+      handoffLines.push(`- Working on: ${truncate(safeText(prevClearHandoff.working_on), 200)}`);
     }
     if (prevClearHandoff.unfinished) {
       const pendingSummary = extractUnfinishedSummary(prevClearHandoff.unfinished);
-      if (pendingSummary) handoffLines.push(`- Recent activity: ${truncate(pendingSummary, 200)}`);
+      if (pendingSummary) {
+        handoffLines.push(`- Recent activity: ${truncate(safeText(pendingSummary), 200)}`);
+      }
     }
     if (prevClearHandoff.key_files) {
       try {
         const files = JSON.parse(prevClearHandoff.key_files);
-        if (files.length > 0) handoffLines.push(`- Key files: ${files.map((f) => basename(f)).join(', ')}`);
+        if (files.length > 0) {
+          // `normalizeInline` as well as `safeText`, and this line is the reason the pair is
+          // needed rather than either alone. Of the three fields here it is the only one with
+          // no `truncate`, so it is the only one where a stored newline can start a line —
+          // which is what turns a marker from mid-line noise into a real heading. It also
+          // closes a composition gap `safeText` cannot see: `#<>#` is neither an ATX marker
+          // nor a delimiter tag, so safeText leaves it, and the block-level defang at the end
+          // of this function strips every `<`/`>` when it fails closed, collapsing it to `##`
+          // with no ATX pass left to run. Collapsed to one line, that `##` can only land
+          // mid-line. (The fail-closed trigger itself is reachable through the untruncated
+          // `Lessons:` / `Decisions:` lines in buildSummaryLines — still open, see below.)
+          handoffLines.push(
+            `- Key files: ${safeText(normalizeInline(files.map((f) => basename(f)).join(', ')))}`,
+          );
+        }
       } catch {
         /* malformed JSON — skip */
       }

package/hook-handoff.mjs

@@ -4,6 +4,7 @@
 import { basename } from 'path';
 import {
   truncate,
+  normalizeInline,
   extractMatchKeywords,
   tokenizeHandoff,
   isSpecificTerm,
@@ -12,9 +13,9 @@ import {
   EDIT_TOOLS,
   isMetaTriggerPrompt,
   notLowSignalTitleClause,
-  neutralizeContextDelimiters,
+  safeText,
 } from './utils.mjs';
-import { scrubRecord, scrubFilePath } from './lib/scrub-record.mjs';
+import { scrubRecord, scrubFilePath, scrubFilePaths } from './lib/scrub-record.mjs';
 import {
   HANDOFF_EXPIRY_CLEAR,
   HANDOFF_EXPIRY_EXIT,
@@ -101,14 +102,60 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
   const subjectPrompts = prompts.filter((p) => !isMetaTriggerPrompt(p.prompt_text));
   const sourcePrompts = subjectPrompts.length > 0 ? subjectPrompts : prompts;
 
+  // Scrub BEFORE truncate. A secret straddling the 200-char cut is shortened below the
+  // length floor its own pattern requires, stops matching entirely, and the retained head is
+  // then stored verbatim — the exact failure the persistence-boundary comment below
+  // prescribes against, in the three call sites that sit above it.
+  //
+  // Measured 2026-09-22 on this machine, one fixture set for every number below (the first
+  // draft used two probes with two different `xoxb-` tokens, so its denominator and its
+  // table described different fixtures): five credential families, the cut walked through
+  // the token one character at a time, 244 cut points. Under truncate-then-scrub **38** cut
+  // points leak ≥12 characters (33 leak ≥13); under this order, 0. FIXED-LENGTH families are
+  // the worst case, because a short read matches nothing at all rather than matching less —
+  // longest head the old order still stored, minus the prefix:
+  //
+  //   ghp_ + 36          29 of 36 entropy chars
+  //   AKIA + 16          15 of 16
+  //   xoxb- (12-12-24)    9 of 50
+  //   password= + 32      4 of 32   (the appended `…` counts toward the `{6,}` value class)
+  //   sk-ant-api03- + 80  1 of 80   (the `ant` alternation lets `api03-AA` satisfy `{8,}`)
+  //
+  // The variable-length row is the contrast case and it is 1, not 0. The destination is not
+  // a log line: this column is persisted and replayed into a later session's prompt by both
+  // renderers.
+  //
+  // `working_on` is consequently the one column scrubbed TWICE — here, and again at the
+  // persistence boundary via scrubRecord, which stays as-is because `completed` and
+  // `unfinished` do NOT come from prompts: `completed` is a stored-row query (:218), and
+  // `unfinished` is the in-memory episode snapshot or the on-disk task list under
+  // `~/.claude/tasks/`, with observation narrative appended (:246-:289). An earlier draft of
+  // this sentence said both "reach that call from STORED ROWS", which is the load-bearing
+  // half of why those two columns were left alone, and it was wrong about `unfinished`.
+  // scrubSecrets is a fixpoint on its own output for every family that reaches this path;
+  // that property is pinned in tests/handoff-working-on-scrub-order.test.mjs rather than
+  // assumed here, since D#46 is open on idempotence by CONTRACT.
+  // `normalizeInline` FIRST, and it is not cosmetic. `truncate` used to run before
+  // `scrubSecrets` and collapsed newlines on the way; moving the scrub earlier handed it raw
+  // newlines, which flips every line-start credential noun from the scrubber's prose arm to
+  // its config arm and irreversibly redacts ordinary English. That corruption is recorded at
+  // secret-scrub.mjs:45-57 as one a prior pre-tag review already undone once. See
+  // normalizeInline's own docblock for the measured grid. The scrubber now sees exactly the
+  // one-line shape it saw before the reorder; only the LENGTH cut moved.
+  //
+  // Dedup keys on the SCRUBBED line, deliberately, and this is a behaviour change from the
+  // pre-reorder code: two prompts differing only in their credential both render as
+  // `deploy with key ***`, and keying on the raw text would replay that identical sentence
+  // twice. The key is what the resuming session is actually shown. Pinned by a case.
   const seen = new Set();
-  const uniquePrompts = sourcePrompts.filter((p) => {
-    const t = truncate(p.prompt_text, 200);
-    if (seen.has(t)) return false;
-    seen.add(t);
-    return true;
-  });
-  let workingOn = uniquePrompts.map((p) => truncate(p.prompt_text, 200)).join(' → ');
+  const safePromptLines = [];
+  for (const p of sourcePrompts) {
+    const line = truncate(scrubSecrets(normalizeInline(p.prompt_text)), 200);
+    if (seen.has(line)) continue;
+    seen.add(line);
+    safePromptLines.push(line);
+  }
+  let workingOn = safePromptLines.join(' → ');
 
   if (subjectPrompts.length === 0) {
     const fallback = db
@@ -123,7 +170,10 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
       )
       .get(project);
     if (fallback?.title) {
-      workingOn = `(carry-forward subject) ${truncate(fallback.title, 180)}`;
+      // Same order as the prompt arm above. Titles are scrubbed on write TODAY, so this is
+      // defense-in-depth for rows that predate that — which is not hypothetical: D#49 still
+      // has three bare credential-shaped values backfilled in a sibling column.
+      workingOn = `(carry-forward subject) ${truncate(scrubSecrets(normalizeInline(fallback.title)), 180)}`;
     }
   }
 
@@ -372,9 +422,10 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
       // rewrite the serialized form risks breaking the downstream JSON.parse. Same rule
       // key_files follows below.
       nextSteps = JSON.stringify({
-        // scrubFilePath, not scrubSecrets: this field is a filesystem PATH, and eight of
-        // the secret patterns carry a value class that does not exclude `/`, so a
-        // whole-path scrub eats the separator and destroys the filename. That is the named
+        // scrubFilePath, not scrubSecrets: this field is a filesystem PATH, and many of
+        // the secret patterns carry a value class that does not exclude `/` (count and
+        // population: lib/scrub-record.mjs), so a whole-path scrub eats the separator and
+        // destroys the filename. That is the named
         // mechanism this repo grew for exactly this shape; the prose fields below are prose
         // and correctly take the plain scrub.
         file: scrubFilePath(String(note.file)),
@@ -386,9 +437,60 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
     /* best-effort, like the task reader above — never block the handoff */
   }
 
-  // 6. Match keywords
-  const allText = [workingOn, ...completed.map((c) => c.title).filter(Boolean), unfinished].join(' ');
-  const keywords = extractMatchKeywords(allText, [...fileSet]);
+  // 6. Match keywords.
+  //
+  // Scrubbed at the DERIVATION, and the scrubbed file array is derived ONCE and feeds both
+  // sinks (here and key_files below) — the shape hook-llm.mjs uses where one path array
+  // reaches two columns. lib/scrub-record.mjs excludes match_keywords from scrubRecord, and
+  // the reason it recorded — "built from tokenizeHandoff() output (alphanumeric tokens
+  // only), so secrets cannot survive the upstream tokenizer" — does not hold on either arm:
+  // the FILE arm never reaches the tokenizer (it takes basename-minus-extension straight off
+  // this set, which holds RAW paths), and the tokenizer SPLITS a secret from its keyword
+  // rather than removing it, so `token=ghp_…` contributes `ghp_…` as a term of its own.
+  //
+  // Exposure, measured rather than asserted: nothing renders this column and no export face
+  // reads the table — `EXPORT_COLUMNS` is observations-only and `session_handoffs` has zero
+  // occurrences in server.mjs and the CLI. So this is local-DB-at-rest, with no egress path.
+  // A credential in a stored column is still worth removing; it is not a disclosure. (The
+  // sentence this replaces claimed egress through `export` and was false — a replacement
+  // justification written while retracting another one, unverified, which is this repo's
+  // signature recurrence. Pre-ship claims lens.)
+  //
+  // Per ELEMENT, then join — never scrub the concatenation. A credential noun ending one
+  // element and a `=`/`:` opening the next form a match that exists in NEITHER, and the
+  // derived term set then loses a word both columns keep (measured: `zebrafish`). Same rule
+  // next_steps and key_files already follow, and the same rule the truncation note below
+  // states. NOT identity on ordinary prose, which an earlier draft of this comment claimed:
+  // `api_key: handling` loses `handling` (5 of 6 ordinary developer prompts in a directed
+  // grid lose exactly one term). What is true, and is the actual justification, is that the
+  // term set now AGREES with what the resuming session is shown — `working_on` / `completed`
+  // / `unfinished` lose the same word through scrubRecord below.
+  //
+  // SUPERSEDED 2026-09-21, and the correction is load-bearing rather than cosmetic. This
+  // block used to end "No value is scrubbed twice: these elements and the columns below are
+  // separate derivations from one raw source, each scrubbed once, which is the distinction
+  // D#46 is open about." That still holds for `completed` and `unfinished`. It is now FALSE
+  // for `workingOn`, which arrives here ALREADY scrubbed, because the prompt arm above had
+  // to scrub before truncating to stop a boundary-straddling secret from being stored as a
+  // verbatim head.
+  //
+  // The chain depth is TWO, on each of the two derivations, and it is worth spelling out
+  // because a draft of this block said "twice on this derivation and a third time through
+  // scrubRecord" — which counts one value as three and no value is:
+  //   match_keywords : prompt arm -> the `allText` map below            = 2
+  //   working_on     : prompt arm -> scrubRecord at the INSERT          = 2
+  // Idempotence is therefore a property this file now DEPENDS on rather than merely
+  // tolerates — measured and pinned in tests/handoff-working-on-scrub-order.test.mjs, not
+  // asserted here. D#46 stays open on idempotence by CONTRACT; what is closed is
+  // idempotence for the eleven families that test pins.
+  const safeFiles = scrubFilePaths([...fileSet]);
+  // The nullish guard mirrors what join() already did with a nullish element. Without it
+  // String(undefined) would put the literal token "undefined" into the term set — a behaviour
+  // change smuggled in by the per-element rewrite rather than chosen.
+  const allText = [workingOn, ...completed.map((c) => c.title).filter(Boolean), unfinished]
+    .map((t) => (t === null || t === undefined ? '' : scrubSecrets(String(t))))
+    .join(' ');
+  const keywords = extractMatchKeywords(allText, safeFiles);
 
   // T10d: capture HEAD sha so detectContinuationIntent can anchor on it later.
   // Best-effort — failures (non-git dir, missing binary, timeout) yield null.
@@ -427,7 +529,21 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
     key_decisions: decisions.map((d) => `[${d.type}] ${d.title}`).join('\n'),
     match_keywords: keywords,
   });
-  const safeKeyFiles = JSON.stringify([...fileSet].slice(0, 20).map((f) => scrubSecrets(String(f))));
+  // scrubFilePath, not scrubSecrets — the same correction next_steps.file took above, and
+  // key_files was the last of the six path columns still taking the whole-string form. It
+  // was already element-wise, which is what made it look compliant with this module's
+  // prescription; the function was the wrong one. Many SECRET_PATTERNS have a value class
+  // that does not exclude `/` (count and population: lib/scrub-record.mjs), so a whole-path
+  // match eats the separator and the filename
+  // with it, and the renderer below emits `basename(f)` — `## Key Files` read `password=***`
+  // where the file was `notes.mjs`. Worse than a wrong name: fileSet is keyed on the RAW
+  // path, so two files under one credential-bearing directory survive dedup and then
+  // collapse onto the identical stored string.
+  // `safeFiles` was derived at the keywords block above, so both sinks see one scrubbed
+  // array rather than two independent scrubs of the same paths. Slicing after the map is
+  // equivalent to mapping after the slice (per-element, order-preserving) and keeps the
+  // keyword arm on the FULL set, which is what it read before.
+  const safeKeyFiles = JSON.stringify(safeFiles.slice(0, 20));
   // The UPSERT below resets `consumed_at`. Rewriting a handoff makes it fresh again, so it
   // must become injectable again: the DELETE that consumeHandoff replaced did this
   // implicitly (row gone, next build INSERTed a new one), while the UPSERT reuses the row.
@@ -723,54 +839,12 @@ export function renderHandoffInjection(db, project, currentCcSessionId = null) {
   return renderHandoffFromRow(handoff, db, project);
 }
 
-// Markdown ATX markers carried by replayed text, at a token boundary.
-//
-// This block frames itself with `## Working On` / `## Completed` / `## Next steps`, and
-// working_on is user prompt text — a prompt that opens with its own outline flattens into
-// the block carrying `#` and `##` of its own, on the same line, because working_on joins up
-// to five prompts with ` → `. A real injection read
-// `## Working On` / `# 自主端到端测试与修复循环  ## 角色与授权 …`, at which point the
-// block's structure and the replayed text's structure are indistinguishable to whatever
-// reads it next. Same class as the authority-tag defanging one level down: a forged
-// SECTION rather than a forged tag.
-//
-// Only a marker followed by whitespace, at a token boundary, counts — `#42`, `C#` and
-// `D#216` are ordinary in this project's prose and survive untouched.
-const ATX_HEADING_RE = /(^|\s)#{1,6}\s/g;
-const ATX_MAX_PASSES = 32;
-
-/**
- * Strip ATX markers to a FIXPOINT, not in one pass.
- *
- * The gap is two characters wide and it is the same one format-utils' `defangToFixpoint`
- * documents for the tag half: `(^|\s)` CONSUMES the boundary, so after removing the first
- * `## ` the regex resumes past the second one and leaves it live. `## ## Key Decisions`
- * came out of a single pass as a real `## Key Decisions` section inside the block — the
- * precise property this defanging exists to hold, defeated by two extra characters. Found
- * by the pre-ship defect lens; reproduced end-to-end before the fix.
- *
- * TERMINATION: every match contains at least one `#` and the replacement drops all of them,
- * so any pass that changes the string removes at least one `#`. Self-bounded by the number
- * of `#` in the input, and bounded again by the constant.
- *
- * INERT AT ANY DEPTH: still changing at the cap (≥32 nested forged layers, not reachable by
- * accident) → drop every remaining `#`. Lossier, but the return value then provably carries
- * no marker, which is the property callers rely on. Same fail-closed shape as the sibling.
- */
-function stripAtxToFixpoint(s) {
-  let text = s;
-  for (let pass = 0; pass < ATX_MAX_PASSES; pass++) {
-    const next = text.replace(ATX_HEADING_RE, '$1');
-    if (next === text) return text;
-    text = next;
-  }
-  return text.replace(/#/g, '');
-}
-
-/** Defang authority tags AND section markers, for any replayed free text. */
-function safeText(value) {
-  return stripAtxToFixpoint(neutralizeContextDelimiters(String(value)));
-}
+// `safeText` — the ATX-marker + authority-tag defang this renderer has applied since a real
+// injection came back carrying `## ` of its own — moved to format-utils.mjs 2026-09-21. It
+// was private here while hook-context's `### Working State (from /clear)` replayed the SAME
+// three session_handoffs columns with only the tag half of the treatment, so the two surfaces
+// had drifted apart by a whole defence. One home now; see the docblock there for why it must
+// be applied per FIELD and never to an assembled block.
 
 // `[bugfix] title` → `title`. Both `completed` and `key_decisions` store the observation
 // type this way; the bracket run is length-capped so a title that merely opens with a

package/hook.mjs

@@ -2114,13 +2114,16 @@ function saveHandoffAndFastSummary(
       debugCatch(e, 'session-start-handoff');
     }
 
-    // Read the just-saved handoff for downstream consumers (fast summary remaining, working state).
+    // Read the just-saved handoff for the ONE downstream consumer here: the fast summary's
+    // "remaining" line, below. It used to select `working_on, unfinished, key_files` and
+    // read only `unfinished` — the other two were dead, because the `### Working State`
+    // block that renders them is built by hook-context.mjs from its own query, not from
+    // this row. Selected columns are cheap; a reader looking for who consumes `key_files`
+    // is not, and this site answered that question wrongly.
     // Session-scoped read to avoid picking up a parallel session's clear handoff.
     try {
       prevClearHandoff = db
-        .prepare(
-          'SELECT working_on, unfinished, key_files FROM session_handoffs WHERE project = ? AND type = ? AND session_id = ?',
-        )
+        .prepare('SELECT unfinished FROM session_handoffs WHERE project = ? AND type = ? AND session_id = ?')
         .get(prevProject || project, 'clear', handoffScopeId);
     } catch {}
 

package/lib/paused-reader.mjs

@@ -7,8 +7,16 @@
 // while the answer sat in the repo in prose.
 //
 // It is also why the next step is taken from a FILE rather than from a model summary:
-// session_summaries.next_steps is non-empty in 11 of 310 rows (3.5%), so that route has
-// already been measured and does not work.
+// session_summaries.next_steps is thin, but quote BOTH numbers, because the lifetime
+// average hides a trend and a single average was the original justification: 15 of 318 rows
+// non-empty over the corpus lifetime (4.7%), and 4 of the newest 20 (20%). So the honest
+// form is "unreliable", not "does not work" — the recent regime is four times the average.
+// The reason to read a FILE instead is not the rate anyway: a paused note is written by a
+// human on purpose and names its own verify command, which is a different kind of signal
+// from a field an LLM fills in when it happens to.
+//
+// The pre-ship claims lens raised this, reporting 4 of the newest 5 non-empty; that specific
+// figure did not reproduce (measured 1 of 5, 4 of 20). The caveat stood, its number did not.
 //
 // A leaf on purpose — `fs`/`path` only, no package imports and no edge back into the hook
 // layer, so importing it costs nothing at load time (same reason lib/data-paths.mjs is a

package/lib/scrub-record.mjs

@@ -17,6 +17,13 @@
 // .files_modified / .files_read, observation_files.filename and events
 // .file_paths all stored raw paths while the title DERIVED FROM THE SAME PATH
 // was scrubbed. A prescription in a comment is not a mechanism; the helper is.
+//
+// Second axis, found after D#44 closed: that one compliant call site was compliant
+// in SHAPE only. It mapped `scrubSecrets` over the elements — element-wise, as
+// prescribed — and so read as the model the other five were measured against, while
+// taking the whole-string function this module exists to keep off a path. "Follows the
+// rule" and "calls the helper" are different claims, and only the second is checkable.
+// Which is why the prescription above names `scrubFilePaths` rather than describing it.
 
 import { scrubSecrets } from '../secret-scrub.mjs';
 
@@ -52,7 +59,12 @@ export const TEXT_FIELDS_BY_TABLE = {
     'completed',
     'unfinished',
     // Excluded:
-    //   key_files       — JSON.stringify(array); pre-scrub elements at call site
+    //   key_files       — JSON.stringify(array); pre-scrubbed at the call site via
+    //                     `scrubFilePaths`, NOT a bare per-element scrubSecrets. It held
+    //                     filesystem paths and took the whole-string function through
+    //                     v6.10.0, which is the defect scrubFilePath's own docblock
+    //                     describes; the renderer emits basename(), so the destroyed
+    //                     filename was what the resuming session was shown.
     //   next_steps      — same shape, same reason: JSON.stringify({file,title,items}),
     //                     pre-scrubbed element-wise in buildAndSaveHandoff. Listing it
     //                     here would let scrubSecrets rewrite the SERIALIZED JSON, and the
@@ -60,12 +72,20 @@ export const TEXT_FIELDS_BY_TABLE = {
     //                     Next steps section would disappear silently rather than fail.
     //                     Named here because the pre-ship review found the column had been
     //                     added without updating this block, which is the file's contract.
-    //   match_keywords  — currently a space-joined plain string; keeping it
-    //                     here would scrub safely, but the value is built from
-    //                     tokenizeHandoff() output (alphanumeric tokens only),
-    //                     so secrets cannot survive the upstream tokenizer.
-    //                     Excluded to avoid double-work + future-proof against
-    //                     a refactor that switches to JSON.stringify.
+    //   match_keywords  — currently a space-joined plain string. Excluded because the
+    //                     value is scrubbed at its DERIVATION in buildAndSaveHandoff
+    //                     (`scrubSecrets(allText)` + the shared `safeFiles` array), which
+    //                     also future-proofs against a refactor to JSON.stringify.
+    //
+    //                     RETRACTED, measured: the reason recorded here until v6.10.0 was
+    //                     "built from tokenizeHandoff() output (alphanumeric tokens only),
+    //                     so secrets cannot survive the upstream tokenizer." Neither half
+    //                     holds. extractMatchKeywords has TWO arms and the FILE arm never
+    //                     reaches the tokenizer at all — it takes basename-minus-extension
+    //                     off the raw path set. And the tokenizer splits a secret from its
+    //                     keyword rather than removing it: `token=ghp_…` yields `ghp_…` as
+    //                     a term of its own. A no-op justification is worse than no
+    //                     justification, because it retires the question.
     // key_decisions is kept: call site uses '\n'.join (plain string), and
     // decision titles can carry secrets verbatim (LLM output).
     'key_decisions',
@@ -100,8 +120,16 @@ export const TEXT_FIELDS_BY_TABLE = {
  */
 export function scrubFilePath(p) {
   // SEGMENT-WISE, and that is the whole point rather than a micro-optimisation.
-  // Eight SECRET_PATTERNS carry a value class that does not exclude `/`
-  // (secret-scrub.mjs:33/74/78/83/98/109/259/260). On prose that is correct; run
+  // Many SECRET_PATTERNS carry a value class that does not exclude `/`. This is the one place
+  // that number is stated, with its population, because it is GRID-DEPENDENT and five copies of
+  // a bare "eight" is how it went wrong: measured here, 11 of the 40 patterns match text
+  // spanning `/` on a 15-shape credential grid; the two v6.10.1 pre-ship lenses measured 12
+  // (1130 path probes) and 15 (26-shape grid), and 21 on a structural reading of the value
+  // classes. "Eight", carried since v6.8.2 with the enumeration
+  // secret-scrub.mjs:33/74/78/83/98/109/259/260, is an UNDER-count on every one of those
+  // populations — it omits at least the `Authorization:`, `AccountKey=`, `DATABASE_URL`/
+  // `SUPABASE_KEY` and db-connection-URL arms. The mechanism does not depend on the count.
+  // On prose the wide value class is correct; run
   // whole-path, the match eats the separator and everything after it, so
   // `/repo/token=<secret>/notes.mjs` became `/repo/token=***` — the filename
   // destroyed at WRITE time and unrecoverable, and every file under such a
@@ -109,16 +137,27 @@ export function scrubFilePath(p) {
   // recalled another file's observations). Splitting first bounds every pattern to
   // the segment it matched in.
   //
-  // The trade, stated rather than glossed: a credential whose own syntax spans a
-  // separator is no longer caught here — the Slack webhook path and the
-  // `scheme://user:pass@host` arms both need their `/` characters. Those are URL
-  // shapes, and these columns hold filesystem paths; `scrubSecrets` still runs
-  // whole-string on every prose field, which is where a URL actually lands.
-  // Preserving path structure wins because the path IS the recall key.
+  // A credential whose own syntax SPANS a separator — `scheme://user:pass@host`, the Slack
+  // webhook path, a `postgres://` connection string — needs its `/` characters to match at all,
+  // so segment-wise scrubbing cannot see it. That was accepted here until v6.10.1 on the stated
+  // reason "these columns hold filesystem paths", and the pre-ship review measured that premise
+  // FALSE: `lib/save-observation.mjs` filters `params.files` on `typeof f === 'string'` and
+  // nothing else, and `extractFilePaths` returns a URL verbatim from a `{path}` / `{filePath}`
+  // tool input under a `PostToolUse: *` matcher. A URL reaches these columns. Measured: four URL
+  // shapes v6.10.0 redacted were being stored verbatim.
   //
+  // So the value decides, not the column: when it carries `://` it is scrubbed whole-string, the
+  // only way those patterns match. NAMED COST, pinned in tests/secret-scrub-coverage.test.mjs: a
+  // URL whose credential sits in a path SEGMENT now loses its filename to the greedy value class,
+  // which is the thing segment-wise scrubbing exists to prevent, traded back on this one shape.
+  // Redacting a live credential wins over preserving a filename that is not a recall key. The
+  // guard is `scrubSecrets`-decided, not scheme-decided — a credential-free URL comes back
+  // byte-identical, so ordinary `https://` / `s3://` / `file://` values are untouched.
+  const s = String(p ?? '');
+  if (s.includes('://')) return scrubSecrets(s);
   // The capture group keeps the separators in the split output, so join()
   // reconstructs the original byte-for-byte when nothing matches.
-  return String(p ?? '')
+  return s
     .split(/([/\\])/)
     .map((part) => (part === '/' || part === '\\' ? part : scrubSecrets(part)))
     .join('');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.0",
+  "version": "6.10.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.10.0",
+      "version": "6.10.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.0",
+  "version": "6.10.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/utils.mjs

@@ -44,6 +44,8 @@ export {
   isoWeekKey,
   formatErrorRecallHints,
   neutralizeContextDelimiters,
+  safeText,
+  normalizeInline,
 } from './format-utils.mjs';
 export { computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity } from './hash-utils.mjs';
 export {