claude-mem-lite 6.10.1 → 6.10.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.10.1",
+      "version": "6.10.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.1",
+  "version": "6.10.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/format-utils.mjs

@@ -2,6 +2,45 @@ import { DAY_MS } from './lib/time-constants.mjs';
 // claude-mem-lite: String formatting and display utilities
 // Extracted from utils.mjs for focused responsibility
 
+/**
+ * Collapse a value to ONE line: newlines to spaces, then trim. Non-strings and nullish
+ * become ''.
+ *
+ * Named and exported because it is a PRECONDITION two other transforms silently relied on
+ * `truncate` to provide, and both broke when they were reordered around it:
+ *
+ * - `scrubSecrets` — three SECRET_PATTERNS arms carry the prose-position lookbehind
+ *   `(?<![A-Za-z][ \t])`, whose class is HORIZONTAL whitespace on purpose. A credential
+ *   noun at the start of a line therefore reads as CONFIG position to raw text and as PROSE
+ *   position to collapsed text, and the config arm redacts any 6+ char value. Scrubbing
+ *   before truncating (2026-09-21) fed it raw newlines and reinstated a corruption
+ *   secret-scrub.mjs:45-57 records as deliberately undone: `"Reset the\npassword:
+ *   instructions are in the onboarding doc"` stored as `password: *** are in…`, irreversibly.
+ *   Measured 2026-09-22 on a 90-cell grid (6 credential nouns x 5 previous-line endings x 3
+ *   value shapes): 12 cells over-redact and 0 leak. The COUNT is grid-dependent and is
+ *   stated here once with its population rather than repeated elsewhere — the pre-ship lens
+ *   read 9 on a 90-cell grid of the same shape with different value fixtures. What does not
+ *   move between grids: every affected cell needs the previous line to end in a LETTER, the
+ *   direction is uniformly over-redaction rather than leakage, and with this normalization
+ *   restored all 90 cells are byte-identical to the pre-reorder output.
+ * - single-line RENDER sites — a `\n` inside an interpolated value starts a new line in the
+ *   assembled block, so any `## ` after it is a real heading rather than mid-line noise.
+ *
+ * So: any site that scrubs-then-truncates, or that interpolates free text into one line of a
+ * markdown block, normalizes HERE first. `truncate` calls it, which is what kept the two
+ * behaviours coupled while nothing named the coupling.
+ *
+ * @param {*} str Input (any type; coerced)
+ * @returns {string} One-line form, trimmed
+ */
+export function normalizeInline(str) {
+  // Defense-in-depth: a non-string (e.g. an LLM that returned title as an array/number)
+  // would throw `str.replace is not a function` and abort the caller. Coerce to '' rather
+  // than crash; the real type-guarding happens at the call site.
+  if (!str || typeof str !== 'string') return '';
+  return str.replace(/\n/g, ' ').trim();
+}
+
 /**
  * Truncate a string to a maximum length, replacing newlines with spaces.
  * @param {string} str Input string
@@ -9,12 +48,8 @@ import { DAY_MS } from './lib/time-constants.mjs';
  * @returns {string} Truncated string with ellipsis if needed
  */
 export function truncate(str, max = 80) {
+  str = normalizeInline(str);
   if (!str) return '';
-  // Defense-in-depth: a non-string (e.g. an LLM that returned title as an array/number)
-  // would throw `str.replace is not a function` and abort the caller. Coerce to '' rather
-  // than crash; the real type-guarding happens at the call site.
-  if (typeof str !== 'string') return '';
-  str = str.replace(/\n/g, ' ').trim();
   if (str.length <= max) return str;
   // Never split a UTF-16 surrogate pair: slicing between the high and low half emits a
   // lone surrogate (invalid UTF-16) that then gets persisted to the DB. If the last kept
@@ -134,6 +169,68 @@ export function neutralizeContextDelimiters(s) {
   return defangToFixpoint(s, CONTEXT_DELIMITER_RE);
 }
 
+// Markdown ATX markers carried by replayed text, at a token boundary.
+//
+// The injected blocks frame THEMSELVES with `## Working On` / `### Working State` / `###
+// Recent`, and the text they replay is user prompt text — a prompt that opens with its own
+// outline flattens into the block carrying `#` and `##` of its own, on the same line,
+// because working_on joins up to five prompts with ` → `. A real injection read
+// `## Working On` / `# 自主端到端测试与修复循环  ## 角色与授权 …`, at which point the
+// block's structure and the replayed text's structure are indistinguishable to whatever
+// reads it next. Same class as the authority-tag defanging above: a forged SECTION rather
+// than a forged tag.
+//
+// Only a marker followed by whitespace, at a token boundary, counts — `#42`, `C#` and
+// `D#216` are ordinary in this project's prose and survive untouched.
+const ATX_HEADING_RE = /(^|\s)#{1,6}\s/g;
+const ATX_MAX_PASSES = 32;
+
+/**
+ * Strip ATX markers to a FIXPOINT, not in one pass.
+ *
+ * The gap is two characters wide and it is the same one `defangToFixpoint` documents for
+ * the tag half: `(^|\s)` CONSUMES the boundary, so after removing the first `## ` the regex
+ * resumes past the second one and leaves it live. `## ## Key Decisions` came out of a single
+ * pass as a real `## Key Decisions` section inside the block — the precise property this
+ * defanging exists to hold, defeated by two extra characters.
+ *
+ * TERMINATION: every match contains at least one `#` and the replacement drops all of them,
+ * so any pass that changes the string removes at least one `#`. Self-bounded by the number
+ * of `#` in the input, and bounded again by the constant.
+ *
+ * INERT AT ANY DEPTH: still changing at the cap (≥32 nested forged layers, not reachable by
+ * accident) → drop every remaining `#`. Lossier, but the return value then provably carries
+ * no marker, which is the property callers rely on. Same fail-closed shape as the sibling.
+ */
+function stripAtxToFixpoint(s) {
+  let text = s;
+  for (let pass = 0; pass < ATX_MAX_PASSES; pass++) {
+    const next = text.replace(ATX_HEADING_RE, '$1');
+    if (next === text) return text;
+    text = next;
+  }
+  return text.replace(/#/g, '');
+}
+
+/**
+ * Defang authority tags AND section markers, for any replayed free text.
+ *
+ * Lives here rather than in one renderer because the SAME session_handoffs columns are
+ * replayed by two surfaces — `hook-handoff.mjs`'s `<session-handoff>` block and
+ * `hook-context.mjs`'s `### Working State (from /clear)` — and until 2026-09-21 only the first
+ * one called it. One home, so they cannot drift apart again.
+ *
+ * Apply it PER FIELD, never to an assembled block: both callers structure themselves with
+ * ATX headers, so a whole-string pass would delete their own sectioning along with the
+ * forged one.
+ *
+ * @param {*} value Replayed free text (any type; coerced)
+ * @returns {string} Text with delimiter tags and section markers defanged
+ */
+export function safeText(value) {
+  return stripAtxToFixpoint(neutralizeContextDelimiters(String(value)));
+}
+
 // <skill-loaded> is deliberately NOT in CONTEXT_DELIMITER_RE above: mem_use's legitimate
 // load path has to emit a REAL one, and that result goes through the same handler-wide
 // defang, which would strip it. So the tag is neutralized here instead — per call site,

package/hook-context.mjs

@@ -16,6 +16,8 @@ import {
   inferProject,
   debugLog,
   neutralizeContextDelimiters,
+  safeText,
+  normalizeInline,
   DECAY_HALF_LIFE_BY_TYPE,
   DEFAULT_DECAY_HALF_LIFE_MS,
   notLowSignalTitleClause,
@@ -647,7 +649,19 @@ export function buildSessionContextLines(
           const files = JSON.parse(o.files_modified);
           const fname = basename(Array.isArray(files) && files.length > 0 ? files[0] : '');
           if (fname) {
-            fileLessons.push({ id: o.id, line: `- ${fname}: ${truncate(o.lesson_learned, 100)} (#${o.id})` });
+            // `fname` is the ONE value in this block interpolated with neither `truncate` nor
+            // a defang, so a newline inside a stored path put everything after it on its own
+            // line and any `## ` there became a real heading. Reproduced end to end from
+            // `files_modified = ["notes.mjs\n## Forged"]`, which reaches the column because
+            // lib/save-observation.mjs filters `files` on `typeof f === 'string'` and length
+            // only — and `mem_save` is agent-callable, which is the threat model this
+            // defanging exists for. Same mechanism and same source column as the
+            // `- Key files:` line below; found by the pre-ship defect lens after the commit
+            // that fixed that one declared this family closed.
+            fileLessons.push({
+              id: o.id,
+              line: `- ${safeText(normalizeInline(fname))}: ${truncate(o.lesson_learned, 100)} (#${o.id})`,
+            });
             continue;
           }
         } catch {
@@ -772,17 +786,46 @@ export function buildSessionContextLines(
   const handoffLines = [];
   if (prevClearHandoff) {
     handoffLines.push('### Working State (from /clear)');
+    // `safeText`, per field, on all three: these are the same session_handoffs columns
+    // hook-handoff.mjs's `<session-handoff>` block replays, and that surface has defanged
+    // them since a real injection arrived carrying `## ` of its own. This one applied only
+    // the TAG half — the `neutralizeContextDelimiters` at the bottom of this function covers
+    // every line in the block — and no ATX marker at all, so a forged SECTION replayed live.
+    // `working_on` is the worst of the three: it is raw user prompt text.
+    //
+    // Defang BEFORE truncate, the same order the handoff builder's own persistence comment
+    // prescribes, so the 200-char cut cannot leave a half-processed marker at the boundary.
+    //
+    // Per FIELD, never over the assembled block: `### Working State` / `### Recent` /
+    // `### Last Session` are this block's OWN sectioning and a whole-string ATX pass would
+    // delete it. That is also why this is not simply folded into the return below.
     if (prevClearHandoff.working_on) {
-      handoffLines.push(`- Working on: ${truncate(prevClearHandoff.working_on, 200)}`);
+      handoffLines.push(`- Working on: ${truncate(safeText(prevClearHandoff.working_on), 200)}`);
     }
     if (prevClearHandoff.unfinished) {
       const pendingSummary = extractUnfinishedSummary(prevClearHandoff.unfinished);
-      if (pendingSummary) handoffLines.push(`- Recent activity: ${truncate(pendingSummary, 200)}`);
+      if (pendingSummary) {
+        handoffLines.push(`- Recent activity: ${truncate(safeText(pendingSummary), 200)}`);
+      }
     }
     if (prevClearHandoff.key_files) {
       try {
         const files = JSON.parse(prevClearHandoff.key_files);
-        if (files.length > 0) handoffLines.push(`- Key files: ${files.map((f) => basename(f)).join(', ')}`);
+        if (files.length > 0) {
+          // `normalizeInline` as well as `safeText`, and this line is the reason the pair is
+          // needed rather than either alone. Of the three fields here it is the only one with
+          // no `truncate`, so it is the only one where a stored newline can start a line —
+          // which is what turns a marker from mid-line noise into a real heading. It also
+          // closes a composition gap `safeText` cannot see: `#<>#` is neither an ATX marker
+          // nor a delimiter tag, so safeText leaves it, and the block-level defang at the end
+          // of this function strips every `<`/`>` when it fails closed, collapsing it to `##`
+          // with no ATX pass left to run. Collapsed to one line, that `##` can only land
+          // mid-line. (The fail-closed trigger itself is reachable through the untruncated
+          // `Lessons:` / `Decisions:` lines in buildSummaryLines — still open, see below.)
+          handoffLines.push(
+            `- Key files: ${safeText(normalizeInline(files.map((f) => basename(f)).join(', ')))}`,
+          );
+        }
       } catch {
         /* malformed JSON — skip */
       }

package/hook-handoff.mjs

@@ -4,6 +4,7 @@
 import { basename } from 'path';
 import {
   truncate,
+  normalizeInline,
   extractMatchKeywords,
   tokenizeHandoff,
   isSpecificTerm,
@@ -12,7 +13,7 @@ import {
   EDIT_TOOLS,
   isMetaTriggerPrompt,
   notLowSignalTitleClause,
-  neutralizeContextDelimiters,
+  safeText,
 } from './utils.mjs';
 import { scrubRecord, scrubFilePath, scrubFilePaths } from './lib/scrub-record.mjs';
 import {
@@ -101,14 +102,60 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
   const subjectPrompts = prompts.filter((p) => !isMetaTriggerPrompt(p.prompt_text));
   const sourcePrompts = subjectPrompts.length > 0 ? subjectPrompts : prompts;
 
+  // Scrub BEFORE truncate. A secret straddling the 200-char cut is shortened below the
+  // length floor its own pattern requires, stops matching entirely, and the retained head is
+  // then stored verbatim — the exact failure the persistence-boundary comment below
+  // prescribes against, in the three call sites that sit above it.
+  //
+  // Measured 2026-09-22 on this machine, one fixture set for every number below (the first
+  // draft used two probes with two different `xoxb-` tokens, so its denominator and its
+  // table described different fixtures): five credential families, the cut walked through
+  // the token one character at a time, 244 cut points. Under truncate-then-scrub **38** cut
+  // points leak ≥12 characters (33 leak ≥13); under this order, 0. FIXED-LENGTH families are
+  // the worst case, because a short read matches nothing at all rather than matching less —
+  // longest head the old order still stored, minus the prefix:
+  //
+  //   ghp_ + 36          29 of 36 entropy chars
+  //   AKIA + 16          15 of 16
+  //   xoxb- (12-12-24)    9 of 50
+  //   password= + 32      4 of 32   (the appended `…` counts toward the `{6,}` value class)
+  //   sk-ant-api03- + 80  1 of 80   (the `ant` alternation lets `api03-AA` satisfy `{8,}`)
+  //
+  // The variable-length row is the contrast case and it is 1, not 0. The destination is not
+  // a log line: this column is persisted and replayed into a later session's prompt by both
+  // renderers.
+  //
+  // `working_on` is consequently the one column scrubbed TWICE — here, and again at the
+  // persistence boundary via scrubRecord, which stays as-is because `completed` and
+  // `unfinished` do NOT come from prompts: `completed` is a stored-row query (:218), and
+  // `unfinished` is the in-memory episode snapshot or the on-disk task list under
+  // `~/.claude/tasks/`, with observation narrative appended (:246-:289). An earlier draft of
+  // this sentence said both "reach that call from STORED ROWS", which is the load-bearing
+  // half of why those two columns were left alone, and it was wrong about `unfinished`.
+  // scrubSecrets is a fixpoint on its own output for every family that reaches this path;
+  // that property is pinned in tests/handoff-working-on-scrub-order.test.mjs rather than
+  // assumed here, since D#46 is open on idempotence by CONTRACT.
+  // `normalizeInline` FIRST, and it is not cosmetic. `truncate` used to run before
+  // `scrubSecrets` and collapsed newlines on the way; moving the scrub earlier handed it raw
+  // newlines, which flips every line-start credential noun from the scrubber's prose arm to
+  // its config arm and irreversibly redacts ordinary English. That corruption is recorded at
+  // secret-scrub.mjs:45-57 as one a prior pre-tag review already undone once. See
+  // normalizeInline's own docblock for the measured grid. The scrubber now sees exactly the
+  // one-line shape it saw before the reorder; only the LENGTH cut moved.
+  //
+  // Dedup keys on the SCRUBBED line, deliberately, and this is a behaviour change from the
+  // pre-reorder code: two prompts differing only in their credential both render as
+  // `deploy with key ***`, and keying on the raw text would replay that identical sentence
+  // twice. The key is what the resuming session is actually shown. Pinned by a case.
   const seen = new Set();
-  const uniquePrompts = sourcePrompts.filter((p) => {
-    const t = truncate(p.prompt_text, 200);
-    if (seen.has(t)) return false;
-    seen.add(t);
-    return true;
-  });
-  let workingOn = uniquePrompts.map((p) => truncate(p.prompt_text, 200)).join(' → ');
+  const safePromptLines = [];
+  for (const p of sourcePrompts) {
+    const line = truncate(scrubSecrets(normalizeInline(p.prompt_text)), 200);
+    if (seen.has(line)) continue;
+    seen.add(line);
+    safePromptLines.push(line);
+  }
+  let workingOn = safePromptLines.join(' → ');
 
   if (subjectPrompts.length === 0) {
     const fallback = db
@@ -123,7 +170,10 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
       )
       .get(project);
     if (fallback?.title) {
-      workingOn = `(carry-forward subject) ${truncate(fallback.title, 180)}`;
+      // Same order as the prompt arm above. Titles are scrubbed on write TODAY, so this is
+      // defense-in-depth for rows that predate that — which is not hypothetical: D#49 still
+      // has three bare credential-shaped values backfilled in a sibling column.
+      workingOn = `(carry-forward subject) ${truncate(scrubSecrets(normalizeInline(fallback.title)), 180)}`;
     }
   }
 
@@ -414,9 +464,25 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
   // `api_key: handling` loses `handling` (5 of 6 ordinary developer prompts in a directed
   // grid lose exactly one term). What is true, and is the actual justification, is that the
   // term set now AGREES with what the resuming session is shown — `working_on` / `completed`
-  // / `unfinished` lose the same word through scrubRecord below. No value is scrubbed twice:
-  // these elements and the columns below are separate derivations from one raw source, each
-  // scrubbed once, which is the distinction D#46 is open about.
+  // / `unfinished` lose the same word through scrubRecord below.
+  //
+  // SUPERSEDED 2026-09-21, and the correction is load-bearing rather than cosmetic. This
+  // block used to end "No value is scrubbed twice: these elements and the columns below are
+  // separate derivations from one raw source, each scrubbed once, which is the distinction
+  // D#46 is open about." That still holds for `completed` and `unfinished`. It is now FALSE
+  // for `workingOn`, which arrives here ALREADY scrubbed, because the prompt arm above had
+  // to scrub before truncating to stop a boundary-straddling secret from being stored as a
+  // verbatim head.
+  //
+  // The chain depth is TWO, on each of the two derivations, and it is worth spelling out
+  // because a draft of this block said "twice on this derivation and a third time through
+  // scrubRecord" — which counts one value as three and no value is:
+  //   match_keywords : prompt arm -> the `allText` map below            = 2
+  //   working_on     : prompt arm -> scrubRecord at the INSERT          = 2
+  // Idempotence is therefore a property this file now DEPENDS on rather than merely
+  // tolerates — measured and pinned in tests/handoff-working-on-scrub-order.test.mjs, not
+  // asserted here. D#46 stays open on idempotence by CONTRACT; what is closed is
+  // idempotence for the eleven families that test pins.
   const safeFiles = scrubFilePaths([...fileSet]);
   // The nullish guard mirrors what join() already did with a nullish element. Without it
   // String(undefined) would put the literal token "undefined" into the term set — a behaviour
@@ -773,54 +839,12 @@ export function renderHandoffInjection(db, project, currentCcSessionId = null) {
   return renderHandoffFromRow(handoff, db, project);
 }
 
-// Markdown ATX markers carried by replayed text, at a token boundary.
-//
-// This block frames itself with `## Working On` / `## Completed` / `## Next steps`, and
-// working_on is user prompt text — a prompt that opens with its own outline flattens into
-// the block carrying `#` and `##` of its own, on the same line, because working_on joins up
-// to five prompts with ` → `. A real injection read
-// `## Working On` / `# 自主端到端测试与修复循环  ## 角色与授权 …`, at which point the
-// block's structure and the replayed text's structure are indistinguishable to whatever
-// reads it next. Same class as the authority-tag defanging one level down: a forged
-// SECTION rather than a forged tag.
-//
-// Only a marker followed by whitespace, at a token boundary, counts — `#42`, `C#` and
-// `D#216` are ordinary in this project's prose and survive untouched.
-const ATX_HEADING_RE = /(^|\s)#{1,6}\s/g;
-const ATX_MAX_PASSES = 32;
-
-/**
- * Strip ATX markers to a FIXPOINT, not in one pass.
- *
- * The gap is two characters wide and it is the same one format-utils' `defangToFixpoint`
- * documents for the tag half: `(^|\s)` CONSUMES the boundary, so after removing the first
- * `## ` the regex resumes past the second one and leaves it live. `## ## Key Decisions`
- * came out of a single pass as a real `## Key Decisions` section inside the block — the
- * precise property this defanging exists to hold, defeated by two extra characters. Found
- * by the pre-ship defect lens; reproduced end-to-end before the fix.
- *
- * TERMINATION: every match contains at least one `#` and the replacement drops all of them,
- * so any pass that changes the string removes at least one `#`. Self-bounded by the number
- * of `#` in the input, and bounded again by the constant.
- *
- * INERT AT ANY DEPTH: still changing at the cap (≥32 nested forged layers, not reachable by
- * accident) → drop every remaining `#`. Lossier, but the return value then provably carries
- * no marker, which is the property callers rely on. Same fail-closed shape as the sibling.
- */
-function stripAtxToFixpoint(s) {
-  let text = s;
-  for (let pass = 0; pass < ATX_MAX_PASSES; pass++) {
-    const next = text.replace(ATX_HEADING_RE, '$1');
-    if (next === text) return text;
-    text = next;
-  }
-  return text.replace(/#/g, '');
-}
-
-/** Defang authority tags AND section markers, for any replayed free text. */
-function safeText(value) {
-  return stripAtxToFixpoint(neutralizeContextDelimiters(String(value)));
-}
+// `safeText` — the ATX-marker + authority-tag defang this renderer has applied since a real
+// injection came back carrying `## ` of its own — moved to format-utils.mjs 2026-09-21. It
+// was private here while hook-context's `### Working State (from /clear)` replayed the SAME
+// three session_handoffs columns with only the tag half of the treatment, so the two surfaces
+// had drifted apart by a whole defence. One home now; see the docblock there for why it must
+// be applied per FIELD and never to an assembled block.
 
 // `[bugfix] title` → `title`. Both `completed` and `key_decisions` store the observation
 // type this way; the bracket run is length-capped so a title that merely opens with a

package/hook.mjs

@@ -2114,13 +2114,16 @@ function saveHandoffAndFastSummary(
       debugCatch(e, 'session-start-handoff');
     }
 
-    // Read the just-saved handoff for downstream consumers (fast summary remaining, working state).
+    // Read the just-saved handoff for the ONE downstream consumer here: the fast summary's
+    // "remaining" line, below. It used to select `working_on, unfinished, key_files` and
+    // read only `unfinished` — the other two were dead, because the `### Working State`
+    // block that renders them is built by hook-context.mjs from its own query, not from
+    // this row. Selected columns are cheap; a reader looking for who consumes `key_files`
+    // is not, and this site answered that question wrongly.
     // Session-scoped read to avoid picking up a parallel session's clear handoff.
     try {
       prevClearHandoff = db
-        .prepare(
-          'SELECT working_on, unfinished, key_files FROM session_handoffs WHERE project = ? AND type = ? AND session_id = ?',
-        )
+        .prepare('SELECT unfinished FROM session_handoffs WHERE project = ? AND type = ? AND session_id = ?')
         .get(prevProject || project, 'clear', handoffScopeId);
     } catch {}
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.1",
+  "version": "6.10.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.10.1",
+      "version": "6.10.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.10.1",
+  "version": "6.10.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/utils.mjs

@@ -44,6 +44,8 @@ export {
   isoWeekKey,
   formatErrorRecallHints,
   neutralizeContextDelimiters,
+  safeText,
+  normalizeInline,
 } from './format-utils.mjs';
 export { computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity } from './hash-utils.mjs';
 export {