claude-mem-lite 6.18.0 → 6.19.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.18.0",
+      "version": "6.19.0",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.18.0",
+  "version": "6.19.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -237,6 +237,20 @@ rm -rf ~/claude-mem-lite/   # pre-v0.5 unhidden (if not auto-moved)
     repos/               # Shallow-cloned source repos
 ```
 
+## Upgrading to 6.19.0
+
+**Search output changes; no switch.** No schema change and no migration, so reverting is
+pinning `claude-mem-lite@6.18.0`.
+
+- **`search` / `mem_search` mark machine-written observations with `🤖`**, and `get` /
+  `mem_get` name them in the header. Hook-captured, imported and compressed rows carry it;
+  explicit saves and events do not. The result line explains the mark whenever a shown row
+  has it, and `search --json` adds `auto` to observation rows.
+- **`mem_search` shows a snippet line only when it adds to the title.**
+- Fixes: a lone search match in a new per-project store no longer sorts last; a Bash
+  step's stored description keeps the end of its output; the secret scrubber catches values
+  behind markdown labels and stays linear-time on crafted input.
+
 ## Upgrading to 6.18.0
 
 **One default changes, with a switch.** No schema change and no migration. Pinning

package/README.zh-CN.md

@@ -199,6 +199,17 @@ rm -rf ~/claude-mem-lite/   # v0.5 前的非隐藏目录（如未自动迁移）
     repos/               # 浅克隆的源代码仓库
 ```
 
+## 升级到 6.19.0
+
+**搜索输出有变化，没有开关。** 没有 schema 变更、不需要迁移，回退只需固定 `claude-mem-lite@6.18.0`。
+
+- **`search` / `mem_search` 用 `🤖` 标出机器写入的 observation**，`get` / `mem_get` 在标题行注明。
+  hook 采集、导入和压缩生成的行带这个标记；显式保存的和 events 不带。只要显示的行里有带标记的，
+  结果行就会解释它的含义；`search --json` 的 observation 行多一个 `auto` 字段。
+- **`mem_search` 只在摘录比标题多出信息时才显示摘录行。**
+- 修复：新的按项目存储里，单条搜索命中不再排在最后；Bash 步骤存下的描述会保留输出的结尾；
+  密钥擦除器能识别 markdown 标签后面的值，并且在构造输入下保持线性时间。
+
 ## 升级到 6.18.0
 
 **一处默认行为改变，有开关。** 没有 schema 变更、不需要迁移。固定 `claude-mem-lite@6.17.1`

package/format-utils.mjs

@@ -92,7 +92,9 @@ export function queryLabel(query) {
 
 // Two delimiter classes are defanged here:
 //   1. The blocks claude-mem-lite wraps injected context in (claude-mem-context /
-//      memory-context / session-handoff). User-derived text containing one LITERALLY
+//      memory-context / session-handoff / the handoff's inner session-summary — D#129: a
+//      summary carrying `</session-summary><session-summary source="report">` closed the
+//      real block and forged its provenance). User-derived text containing one LITERALLY
 //      would prematurely open/close the block it lands in, spilling the rest as
 //      undelimited context.
 //   2. Harness-authority + tool-call tags the runtime injects (system-reminder /
@@ -113,7 +115,7 @@ export function queryLabel(query) {
 // Reachable by editing files that contain these tokens \u2014 e.g. developing claude-mem-lite
 // itself, where source/observations carry the delimiter names.
 const CONTEXT_DELIMITER_RE =
-  /<\/?(?:claude-mem-context|memory-context|session-handoff|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
+  /<\/?(?:claude-mem-context|memory-context|session-handoff|session-summary|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
 
 // Pass cap for the fixpoint loop below. 32 nested layers of a forged delimiter is far past
 // anything prose produces; the cap exists only to bound the ADVERSARIAL cost (an unbounded

package/hook-llm.mjs

@@ -991,6 +991,7 @@ export async function handleLLMEpisode() {
   // events; treating them as a separate role + boundary marker reduces the
   // attack surface for memory poisoning via crafted file content.
   const SHARED_OBS_SCHEMA_TAIL = `${MEMORY_INPUT_GUARD}
+Grounding: state only outcomes the user message shows. An action description may be cut short ("…"); if its result is not visible, say what was run, not how it turned out. Never write that something passed, failed, was verified or confirmed unless that result appears in the user message.
 type: pick by strongest signal. decision = explicit tradeoff / "chose X over Y because Z" / rejected an approach (e.g. "Rejected schema migration — single-source module + sync test instead"; "Heterogeneous hook events → heterogeneous context budgets"). bugfix = prior-failing path fixed with a named root cause. feature = new user-visible capability. refactor = behavior unchanged but structure improved. discovery = learned how a system works (read-heavy, no writes). change = routine edit with no new principle (default if unsure and nothing else fits).
 Facts: each MUST be (1) atomic—one claim, (2) self-contained—no pronouns, include file/function name, (3) specific—"refreshToken() in auth.ts:45 uses 1h TTL" not "handles tokens"
 importance: Be strict — default to 1. 0=pure browsing with zero learning value. 1=routine file edits, standard changes, normal workflow (MOST episodes). 2=notable ONLY if it reveals something non-obvious: error fix with discovered root cause, architectural decision with explicit tradeoff, config change with unexpected side effects. 3=critical: breaking change affecting users, security vulnerability fix, data migration. Ask yourself: "would a future session benefit from knowing this?" — if not, it's importance=1.

package/lib/fast-summary.mjs

@@ -110,8 +110,9 @@ function replyLines(text) {
 
 /**
  * Whether the scrubber finds a secret in `text` as written OR with inline markup (`, |, *)
- * removed. Markup can hide a secret from the scrubber — `**password**=…`, a key split by a
- * backtick or `*`, `gh|p_…` are all missed as written and caught stripped — and storing the
+ * removed. Markup can hide a secret from the scrubber — a key split by a backtick or `*`,
+ * `gh|p_…` are missed as written and caught stripped (a markup-wrapped LABEL such as
+ * `**password**=…` is caught as written since D#128) — and storing the
  * stripped text instead would leave a split key's tail behind. The caller asks it about the
  * exact text it stores, not the reply as written: a list or quote marker between a label and
  * its value hid the pair from a check on the raw reply, and removing the marker for storage

package/lib/provenance.mjs

@@ -0,0 +1,32 @@
+// Which writer produced an observation, read back from its memory_session_id. saveObservation
+// writes every explicit save under MANUAL_SESSION_ID_PREFIX. The hook capture (`hook-`),
+// transcript import (`import-`), compression summaries (`compress-`) and rows imported from
+// older stores (a bare session uuid) are machine-written.
+//
+// Search and get mark the machine-written side, because explicit saves are the large majority
+// of a typical store and a mark on nearly every line would carry no information. An unknown id
+// renders unmarked, as every row did before the mark existed.
+
+export const MANUAL_SESSION_ID_PREFIX = 'manual-';
+
+const AUTO_MARK = '🤖';
+const AUTO_TEXT = 'auto-written, not an explicit save';
+
+/** @param {string|null|undefined} memorySessionId */
+export function isAutoWritten(memorySessionId) {
+  return (
+    typeof memorySessionId === 'string' &&
+    memorySessionId !== '' &&
+    !memorySessionId.startsWith(MANUAL_SESSION_ID_PREFIX)
+  );
+}
+
+/** Search row tag; `auto` is set on obs rows by attachBodyTokens. */
+export const autoTag = (r) => (r.auto ? ` ${AUTO_MARK}` : '');
+
+/** Search result-line legend, shown only when a rendered row carries the tag. */
+export const autoLegend = (rows) => (rows.some((r) => r.auto) ? ` · ${AUTO_MARK} = ${AUTO_TEXT}` : '');
+
+/** Get header note for a full observation row. */
+export const autoHeaderNote = (row) =>
+  isAutoWritten(row.memory_session_id) ? ` · ${AUTO_MARK} ${AUTO_TEXT}` : '';

package/lib/save-observation.mjs

@@ -22,6 +22,7 @@ import { liveObsFilterSql } from './inject-search-core.mjs';
 // Imported, not injected: `allowStatuses` below is the POLICY this function exists to hold,
 // and a caller free to pass its own resolver could reinstate the one-way gate D#195 closed.
 import { resolveDeferredIds, closeDeferredItems } from './deferred-work.mjs';
+import { MANUAL_SESSION_ID_PREFIX } from './provenance.mjs';
 
 const DEDUP_WINDOW_MS = 5 * 60 * 1000;
 const DEDUP_RECENT_LIMIT = 50;
@@ -197,7 +198,7 @@ export function saveObservation(db, params) {
   const safeTitle = scrubSecrets(rawTitle);
   const safeLesson = rawLesson ? scrubSecrets(rawLesson) : null;
 
-  const sessionId = `manual-${project}`;
+  const sessionId = `${MANUAL_SESSION_ID_PREFIX}${project}`;
 
   // Ensure session exists (FK constraint). INSERT OR IGNORE makes this safe
   // under concurrent calls.

package/lib/search-core.mjs

@@ -409,6 +409,20 @@ const SINGLE_MATCH_BANDS = [
   [0, -0.25],
 ];
 
+// #36: the ratio above assumes the lone hit's magnitude says how well it matched. It does not
+// when FTS5 clamped the IDF: a term in at least half of a table's rows gets idf <= 0, which
+// FTS5 replaces with 1e-6, so the raw bm25 is at most 1e-6 × (k1+1 = 2.2) per phrase whatever
+// the match. A new per-project store reaches it on every query (2 observations, term in 1:
+// idf = ln(1.5/1.5) = 0). Such a lone row is scored the way a multi-row source's best already
+// is (-1): of two clamped rows the better was normalized to -1; a single one was sunk to -0.25.
+// The test reads the RAW bm25 on the obs leg (rawScore): FULL_SCORE's multipliers go down to
+// 0.5 × 0.5 × 0.2 × 0.4 = 0.02, so a demoted row with an informative IDF (0.18) scored 1.35e-4
+// and was lifted from last to first when the final score was tested (v6.19.0 pre-tag review
+// P3-3). Session and event multipliers are >= 1 and prompts carry raw bm25, so their final
+// score is tested. An obs row without rawScore keeps the bands. A near-zero IDF that FTS5 did not
+// clamp (a term in very nearly half the rows) can land below the scale too, and says as little.
+const CLAMPED_IDF_SCALE = 1e-4;
+
 /**
  * Normalize each source's BM25 scores to [-1, 0] before cross-source merge.
  * Prevents observations (BM25 can reach -40) from systematically outranking
@@ -437,6 +451,11 @@ export function normalizeCrossSourceScores(results, sourceKey) {
     );
     if (srcResults.length === 0) continue;
     if (srcResults.length === 1) {
+      const magnitude = src === 'obs' ? srcResults[0].rawScore : srcResults[0].score;
+      if (typeof magnitude === 'number' && Math.abs(magnitude) < CLAMPED_IDF_SCALE) {
+        srcResults[0].score = -1;
+        continue;
+      }
       const ratio = globalMaxAbs > 0 ? Math.abs(srcResults[0].score) / globalMaxAbs : 0;
       srcResults[0].score = SINGLE_MATCH_BANDS.find(([floor]) => ratio >= floor)[1];
       continue;

package/mem-cli.mjs

@@ -25,6 +25,7 @@ import { resolveProject } from './project-utils.mjs';
 import { resolveCliProject as cliProject } from './lib/cli-project.mjs';
 import { reRankWithContext } from './search-scoring.mjs';
 import { searchObservationsHybrid } from './search-engine.mjs';
+import { autoHeaderNote, autoLegend, autoTag } from './lib/provenance.mjs';
 import {
   fetchObsDetail,
   fetchPromptDetail,
@@ -565,6 +566,8 @@ async function cmdSearch(db, args, { llm } = {}) {
         importance: r.importance ?? null,
         files_modified: r.files_modified || null,
         body_tokens: r.bodyTokens ?? null,
+        // Events carry no session id, so only observations can say who wrote them.
+        ...(r.source === 'obs' ? { auto: r.auto === true } : {}),
       };
     });
     out(
@@ -588,7 +591,7 @@ async function cmdSearch(db, args, { llm } = {}) {
   // Pluralize on total — "Found 1 of 44 result" reads wrong; the population (44) drives
   // grammatical number, not the page slice (1).
   out(
-    `[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${queryLabel(query)}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}`,
+    `[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${queryLabel(query)}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}${autoLegend(paged)}`,
   );
   // `~Nt` = est. tokens to fetch this row's full body via mem_get (attachBodyTokens, paired with
   // MCP). Conditional so a row that skipped enrichment renders cleanly, not "~undefinedt".
@@ -614,7 +617,7 @@ async function cmdSearch(db, args, { llm } = {}) {
     } else {
       const date = fmtDateShort(r.created_at);
       const title = truncate(r.title || r.subtitle || '(untitled)', 80);
-      out(`#${r.id} ${typeIcon(r.type)} ${date}${timeStr} ${title}${tok(r)}`);
+      out(`#${r.id} ${typeIcon(r.type)}${autoTag(r)} ${date}${timeStr} ${title}${tok(r)}`);
       if (r.lesson_learned) {
         out(`  -> ${truncate(r.lesson_learned, 80)}`);
       }
@@ -793,7 +796,7 @@ function renderObsRows(db, ids, requestedFields) {
   const fields = requestedFields || OBS_FIELDS;
   const parts = [];
   for (const r of rows) {
-    const lines = [`#${r.id} [${r.type}] ${fmtDateShort(r.created_at)}`];
+    const lines = [`#${r.id} [${r.type}] ${fmtDateShort(r.created_at)}${autoHeaderNote(r)}`];
     // Retraction first (shared with mem_get via get-core) — see supersededNotice.
     const retracted = supersededNotice(r);
     if (retracted) lines.push(retracted);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.18.0",
+  "version": "6.19.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.18.0",
+      "version": "6.19.0",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.18.0",
+  "version": "6.19.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -82,6 +82,7 @@
     "lib/stats-quality.mjs",
     "lib/low-signal-patterns.mjs",
     "lib/private-strip.mjs",
+    "lib/provenance.mjs",
     "lib/citation-tracker.mjs",
     "lib/edge-attribution.mjs",
     "lib/file-edge-match.mjs",

package/search-engine.mjs

@@ -21,6 +21,7 @@ import {
 import { citeFactorClause } from './scoring-sql.mjs';
 import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 import { liveObsFilterSql, recencyDecaySql } from './lib/inject-search-core.mjs';
+import { isAutoWritten } from './lib/provenance.mjs';
 
 // Scoring expressions — full adds project boost + access bonus; simple is for
 // expansion paths where boost would over-amplify already-loose matches.
@@ -69,7 +70,8 @@ export function buildObsFtsQuery(scoring, { multiplier, withSnippet, withOffset,
     SELECT o.id, o.type, o.title, o.subtitle, o.project, o.created_at, o.created_at_epoch, o.importance,
            o.files_modified, o.lesson_learned,
            ${withSnippet ? "snippet(observations_fts, 2, '»', '«', '…', 10) as match_snippet," : ''}
-           ${scoreExpr}${mult} as score
+           ${scoreExpr}${mult} as score,
+           ${OBS_BM25} as raw_bm25
     FROM observations_fts
     JOIN observations o ON observations_fts.rowid = o.id
     WHERE observations_fts MATCH ?
@@ -330,6 +332,19 @@ export function countSearchTotal(
   return total;
 }
 
+/**
+ * True when an FTS excerpt says something the title does not. snippet() wraps matches in »« and
+ * cuts with …, and a save's title is the start of its narrative, so an excerpt that is only a
+ * piece of the title repeats it once markers and ellipses are stripped.
+ * @param {string|null|undefined} snippet
+ * @param {string|null|undefined} title
+ */
+export function snippetAddsInfo(snippet, title) {
+  if (typeof snippet !== 'string' || snippet.length <= 10) return false;
+  const bare = snippet.replace(/[»«]/g, '').replace(/^…|…$/g, '').trim();
+  return !(title || '').includes(bare);
+}
+
 export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
   return {
     source: 'obs',
@@ -346,6 +361,9 @@ export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
     created_at: r.created_at,
     created_at_epoch: r.created_at_epoch,
     score: scoreMultiplier ? r.score * scoreMultiplier : r.score,
+    // bm25 before FULL_SCORE's multipliers, which can shrink it 50x: only this can say whether
+    // FTS5 clamped the IDF (normalizeCrossSourceScores, CLAMPED_IDF_SCALE).
+    rawScore: r.raw_bm25,
     files_modified: r.files_modified,
     importance: r.importance,
     lesson_learned: r.lesson_learned,
@@ -362,7 +380,8 @@ export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
 // heavy obs fields are batch-fetched by id HERE rather than carried on every result. The source
 // key is read as `source || _source` because the two render paths disagree (#8654): MCP sets
 // `source`+`text`, CLI sets `_source`+`prompt_text`. estimateTokens floors at 1, so a missing row
-// or empty body yields 1 — never 0/NaN.
+// or empty body yields 1 — never 0/NaN. The same by-id read sets `auto` (lib/provenance.mjs) on
+// the rendered page only, so no result producer has to carry memory_session_id.
 export function attachBodyTokens(db, results) {
   if (!Array.isArray(results) || results.length === 0) return results;
   const obsIds = results
@@ -373,7 +392,7 @@ export function attachBodyTokens(db, results) {
     try {
       const ph = obsIds.map(() => '?').join(',');
       const rows = db
-        .prepare(`SELECT id, narrative, facts, text FROM observations WHERE id IN (${ph})`)
+        .prepare(`SELECT id, narrative, facts, text, memory_session_id FROM observations WHERE id IN (${ph})`)
         .all(...obsIds);
       for (const row of rows) bodyById.set(row.id, row);
     } catch (e) {
@@ -385,6 +404,7 @@ export function attachBodyTokens(db, results) {
     let parts;
     if (src === 'obs') {
       const row = bodyById.get(r.id) || {};
+      r.auto = isAutoWritten(row.memory_session_id);
       parts = [r.title, r.subtitle, r.lesson_learned, row.narrative, row.facts, row.text];
     } else if (src === 'session') {
       parts = [r.request, r.completed, r.working_on];

package/secret-scrub.mjs

@@ -28,9 +28,41 @@ export const SECRET_PATTERNS = [
   // keyword. Allowing a leading `_` catches those while the prose lookbehind still
   // excludes "Marker token: …". `secret` added so a bare SECRET=… with a mixed-alnum
   // value is covered (the hex-only assignment pattern below misses non-hex values).
+  //
+  // MARKDOWN AROUND A LABEL (D#128). `- **Password**: \`<v>\`` put `**` between the noun and
+  // its separator, so no label pattern matched and the value was stored. Models write labels
+  // that way all the time. So a label may carry up to three markup characters after the noun
+  // (`[*_~\`]`), and up to two of `*_~` between the separator and the value
+  // (`**Password:** <v>`). Three rules keep this from widening what counts as a value:
+  //   - no backtick after the separator: `` `password:` <next word> `` names the label and
+  //     then goes on in prose, and the next word (or a CJK run with no spaces) was scrubbed;
+  //   - at most two characters there, so the scrubber's own `***` is never taken for markup
+  //     (`password=*** token=abc` would scrub `token=abc` on the second pass);
+  //   - the prose check looks through emphasis (`the **password**: …` is prose) but not a
+  //     backtick, since `` word `token: <v>` `` is code, not prose. A label wrapped in code
+  //     (`` `GH_TOKEN`: <v> ``) has its own branch, whose prose check looks past the opening
+  //     backtick. That branch starts with a cheap lookahead: without it the 40-char lookbehind
+  //     ran at every position, and a 500k-char input went from 407 ms to 3,387 ms.
+  // Measured 2026-09-27 over 831,328 unique lines (this repo's tracked text plus local
+  // transcripts: prompts, replies, tool output), old and new run back to back: 28 lines
+  // differ. All the catches are fixtures quoted from the D#128 audit; the rest are
+  // `- **token**:assistant …` and `` `PGPASSWORD`=PG+password ``, which the same text with
+  // no markup scrubs too, plus a JSON-escaped `\n` taken as a value. Idempotence failures: 0
+  // and 0. A 13,770-case ground-truth fuzz (labels × 8 wrappings × separators × values ×
+  // positions): leaks 12,580 → 421, none newly opened. All 421 are `<word> token|secret|bearer:`
+  // in prose, left open by design (below).
+  //
+  // ACCEPTED GAPS (D#131). This scrubber stops ACCIDENTAL persistence; an author who wants a
+  // secret stored can always encode it. So shapes only an adversary writes stay open:
+  // zero-width characters inside a label, fullwidth letters. Shapes that occur naturally but
+  // cannot be told from prose stay open too: `password is <v>` and `<word> token: <v>` (the
+  // guard below). A pattern that caught them would also rewrite ordinary sentences, and
+  // v3.61.0 already had to undo exactly that. `| password | <v> |` table rows stay open for a
+  // different reason: those 831k lines held 1 such row and none with a credential-shaped
+  // value, so a table pattern's false-positive rate cannot be measured here.
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
   [
-    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)(?:[*_~`]{1,3})?\s*=(?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   //   1b. `:` separator, PASSWORD nouns. Position decides how permissive the value
@@ -71,16 +103,16 @@ export const SECRET_PATTERNS = [
   //       Both arms emit `***` (3 chars, under the {6,} floor), so they cannot
   //       double-apply.
   [
-    /((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:password|passwd|passphrase)(?:[*_~]{1,3})?|(?=_?(?:password|passwd|passphrase)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:password|passwd|passphrase)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   [
-    /((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[\s,;'"}\]]|$))[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:password|passwd|passphrase)(?:[*_~`]{1,3})?\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[`*~]*(?:[\s,;'"}\]]|$)))[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   //   1c. `:` separator, prose-ambiguous nouns → keep the lookbehind ("the token: alicebob"):
   [
-    /((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:token|bearer|secret)(?:[*_~]{1,3})?|(?=_?(?:token|bearer|secret)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:token|bearer|secret)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   // access_token / refresh_token are the canonical OAuth2 field names — they were
@@ -95,7 +127,7 @@ export const SECRET_PATTERNS = [
   // low-FP decision that `topsecret=` / `access_token_count:` are non-credentials
   // (#8283 + utils.test.mjs:1089-1100); bare `pwd` is omitted so `PWD=` (a path) survives.
   [
-    /((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)\s*[=:]\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)(?:[*_~`]{1,3})?\s*[=:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   // Space-separated credential CLI flag: `--password <value>` (long-form). The KV
@@ -118,19 +150,28 @@ export const SECRET_PATTERNS = [
   //   (a) bare credential nouns: `=` always scrubs; `:` keeps the prose lookbehind
   //       (mirrors the unquoted 1a/1b split — a quoted value doesn't turn `:` prose
   //       into config, but `<word> password="x"` is still a leak):
-  [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [
+    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)(?:[*_~`]{1,3})?\s*=(?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
+  [
+    /((?:\b|_)(?:password|passwd|passphrase)(?:[*_~`]{1,3})?\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
+  [
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:token|bearer|secret)(?:[*_~]{1,3})?|(?=_?(?:token|bearer|secret)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:token|bearer|secret)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [
-    /((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi,
+    /((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)(?:[*_~`]{1,3})?\s*[=:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
     '$1$2***$2',
   ],
   // AWS access keys: AKIA (long-term) + ASIA (STS temp) + AROA (role) + AIDA
   // (user) + ANPA/ANVA/AGPA (other principal types). All share the 4-letter
   // prefix + exactly 16 base32 chars shape — specific enough for near-zero FP.
-  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}\b/g, '***'],
+  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}(?![A-Za-z0-9])/g, '***'],
   // OpenAI / Anthropic keys (sk-...) — specific prefixes have lower length threshold
   [/\bsk-(?:proj|ant|ant-api\d{2})-[a-zA-Z0-9_-]{8,}\b/g, '***'],
   [/\bsk-[a-zA-Z0-9_-]{20,}\b/g, '***'],
@@ -143,13 +184,30 @@ export const SECRET_PATTERNS = [
   [/\b(?:xox[bpasr]|xapp|xoxe)-[a-zA-Z0-9-]{10,}\b/g, '***'],
   // Slack incoming-webhook URL — the path after /services/ is the shared secret.
   [/(https:\/\/hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g, '$1***'],
-  // JWT tokens (eyJ...eyJ...)
-  [/\beyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g, '***'],
+  // JWT tokens (eyJ...eyJ...). A JWT begins its own token, so the start is `(?<![\w-])`, not
+  // `\b`: `-` is a base64url character, and `\b` let every `-eyJ` inside one dotless run be a
+  // fresh start that rescans the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
+  // (D#130). A `-eyJ` start is the middle of a run, never a JWT's first character.
+  // A JWT glued by a hyphen to up to 40 characters of hyphenated words (`my-sess-eyJ…`,
+  // `X-Auth-Token-eyJ…`) is a start too. `\b` allowed any length; past 40 characters it is missed. The lookbehind needs a token
+  // boundary within those 41 characters, so a hyphen run has at most ~10 starts, not one per
+  // `-eyJ` (v6.19.0 pre-tag reviews P3-2, delta P3-1).
+  [
+    /(?:(?<![\w-])|(?<=(?:^|[^\w-])[\w-]{1,40}-))eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g,
+    '***',
+  ],
   // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
   // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
   // alternation missed; the block delimiters make FP impossible.
+  // The body stops at the next `-----BEGIN ` (D#130): with `[\s\S]*?` every header with no END
+  // scanned to the end of the text, on each of scrubSecrets' passes — quadratic, 8.3 s on 500k
+  // chars. A block whose END is missing ends where the next private-key BEGIN starts, so a cut-off
+  // key's body is scrubbed too (v6.19.0 pre-tag review P2-1: requiring the END there stored that
+  // body); any other BEGIN (a certificate) does not end it, so a bare header in prose does not
+  // erase the text up to one (delta review P3-2). A header with no END and no later key header
+  // is left as it was in v6.18.0.
   [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|(?=-----BEGIN [A-Z0-9 ]*PRIVATE KEY))/g,
     '***PEM_KEY***',
   ],
   // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
@@ -160,7 +218,10 @@ export const SECRET_PATTERNS = [
   [/\bAIza[A-Za-z0-9_-]{35}\b/g, '***'],
   // Authorization header credentials — Bearer (opaque), Basic (base64 user:pass),
   // and GitHub's `token` scheme all carry secrets after the scheme word.
-  [/(Authorization:\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi, '$1***'],
+  [
+    /(Authorization(?:[*_~`]{1,3})?[:：](?:[*_~]{1,2}(?=\s))?\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi,
+    '$1***',
+  ],
   // R10 P1-6: the same header as a QUOTED KEY — `{"Authorization":"Bearer …"}`. The
   // pattern above needs `Authorization:` literally, and in JSON a quote sits between the
   // name and the colon, so a `curl -v` / fetch header dump walked straight through. The
@@ -194,10 +255,10 @@ export const SECRET_PATTERNS = [
     '$1$2://***',
   ],
   // npm tokens (npm_...)
-  [/\bnpm_[a-zA-Z0-9]{36,}\b/g, '***'],
+  [/\bnpm_[a-zA-Z0-9]{36,}(?![A-Za-z0-9])/g, '***'],
   // Stripe keys (sk_live_, rk_live_, pk_live_, sk_test_, pk_test_) + webhook signing secret (whsec_)
-  [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}\b/g, '***'],
-  [/\bwhsec_[a-zA-Z0-9]{20,}\b/g, '***'],
+  [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}(?![A-Za-z0-9])/g, '***'],
+  [/\bwhsec_[a-zA-Z0-9]{20,}(?![A-Za-z0-9])/g, '***'],
   // SendGrid API keys: SG.<22>.<43> — two dots at fixed offsets make this
   // structurally unmistakable; near-zero false-positive risk.
   [/\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, '***'],
@@ -224,8 +285,11 @@ export const SECRET_PATTERNS = [
   // (password|secret|api_key|auth_token|access_token|private_key) so a benign
   // `"token_count"` value (numeric, <6 non-quote chars after scrub) and prose
   // keys stay low-FP; over-scrub is the safe direction for at-rest memory.
+  // `\w{0,64}`, not `\w*`, on both sides of the noun here and in the next pattern (D#130): from
+  // one quote, `\w*` ran to the end of a word run and backtracked through every keyword in it,
+  // each rescanning the run — `"` + `secret` x 33k took 4.6 s. 64 is far past any key name.
   [
-    /("\w*(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*"\s*:\s*")[^"]{6,}(")/gi,
+    /("\w{0,64}(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w{0,64}"\s*:\s*")[^"]{6,}(")/gi,
     '$1***$2',
   ],
   // Quoted-KEY credential values — Python dict reprs `{'api_key': '...'}`, single-quoted
@@ -241,7 +305,7 @@ export const SECRET_PATTERNS = [
   // `'token_count': 123456`); `passphrase` added here too (double-quoted JSON passphrase is
   // subsumed by this pattern since `['"]` matches `"`). Over-scrub is the safe direction.
   [
-    /(['"]\w*(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*['"]\s*:\s*)(['"])[^'"]{6,}\2/gi,
+    /(['"](?:\w{0,64}(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w{0,64}|\w{1,64}_token)['"]\s*:\s*)(['"])[^'"]{6,}\2/gi,
     '$1$2***$2',
   ],
   // Session cookies in headers / urlencoded bodies (sessionid=, session_id=, JSESSIONID=, PHPSESSID=).

package/server.mjs

@@ -17,7 +17,8 @@ import {
   formatSchemaSkewNotice,
 } from './lib/schema-skew.mjs';
 import { reRankWithContext, runIdleCleanup, buildServerInstructions } from './search-scoring.mjs';
-import { searchObservationsHybrid } from './search-engine.mjs';
+import { searchObservationsHybrid, snippetAddsInfo } from './search-engine.mjs';
+import { autoHeaderNote, autoLegend, autoTag } from './lib/provenance.mjs';
 import {
   deepSearch,
   resolveDeepMode,
@@ -461,7 +462,7 @@ function formatSearchOutput(
   // explicitly requested OR semantics — there's no "fallback" in that path.
   const fallbackHint = orFallbackFired && !args.or ? ' (relaxed AND→OR)' : '';
   lines.push(
-    `Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}\n`,
+    `Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}${autoLegend(paginatedResults)}\n`,
   );
 
   // `~Nt` = estimated tokens to fetch this row's full body via mem_get (attachBodyTokens).
@@ -470,9 +471,9 @@ function formatSearchOutput(
   for (const r of paginatedResults) {
     if (r.source === 'obs') {
       lines.push(
-        `#${r.id} ${typeIcon(r.type)} [${r.type}] ${truncate(r.title || r.subtitle || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`,
+        `#${r.id} ${typeIcon(r.type)} [${r.type}]${autoTag(r)} ${truncate(r.title || r.subtitle || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`,
       );
-      if (r.snippet && r.snippet.length > 10 && r.snippet !== r.title) {
+      if (snippetAddsInfo(r.snippet, r.title)) {
         lines.push(`     ${truncate(r.snippet, 100)}`);
       }
     } else if (r.source === 'session') {
@@ -900,7 +901,7 @@ server.registerTool(
       const renderFields = obsFieldFilter || OBS_FIELDS;
       for (const row of rows) {
         foundBySource.obs.add(row.id);
-        const lines = [`── #${row.id} ──`];
+        const lines = [`── #${row.id}${autoHeaderNote(row)} ──`];
         // Retraction first (shared with the CLI `get` via get-core) — see supersededNotice.
         const retracted = supersededNotice(row);
         if (retracted) lines.push(retracted);

package/source-files.mjs

@@ -81,6 +81,8 @@ export const SOURCE_FILES = [
   'lib/stats-quality.mjs',
   'lib/low-signal-patterns.mjs',
   'lib/private-strip.mjs',
+  // Which writer produced an observation (explicit save vs machine-written); search + get marks.
+  'lib/provenance.mjs',
   'lib/citation-tracker.mjs',
   // v3.47 (D#78 P1): per-(obs,file) edge attribution. Imported by hook.mjs
   // (handleStop edge resolution). Missing from manifest → tarball hook.mjs

package/utils.mjs

@@ -56,7 +56,8 @@ export {
 } from './bash-utils.mjs';
 
 // Internal imports for functions that remain in this module
-import { truncate } from './format-utils.mjs';
+import { normalizeInline, truncate } from './format-utils.mjs';
+import { stripPrivate } from './lib/private-strip.mjs';
 import { stripTestSuffix } from './bash-utils.mjs';
 // Static, and deliberately the dependency-free resolver (node:os + node:path only) —
 // debugCatch's sampler must not pull in the DB layer. See its comment below.
@@ -282,9 +283,56 @@ export function isRelatedToEpisode(episode, newFiles) {
 // magnitude above the longest cut here, so a secret that begins before the cut is still
 // seen whole by the patterns, at bounded cost.
 const DESC_SCRUB_WINDOW = 4096;
+
+// Every field is cut strictly around private spans: closed `<private>` spans are redacted across
+// the WHOLE input first (one linear pass; hook input is capped at 256 KiB), then the window stops
+// before the first remaining `<private>` or private-key BEGIN, so no field shows a span whose end
+// is out of view. Before v6.19.0 an unclosed opener in the window (a Grep line
+// `notes.md:3:<private>bank pin 4412`) was shown as written (v6.19.0 pre-tag reviews P3-1, r3 P2-1).
+// The PEM half is case-sensitive, like the scrubber's PEM pattern.
+const PRIVATE_OPENER_RE = /<[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----BEGIN [A-Z0-9 ]*PRIVATE KEY/;
 function scrubTruncate(str, max) {
   if (typeof str !== 'string' || str === '') return truncate(str, max);
-  return truncate(_scrubSecrets(str.slice(0, DESC_SCRUB_WINDOW)), max);
+  let win = stripPrivate(str).slice(0, DESC_SCRUB_WINDOW);
+  const at = win.search(PRIVATE_OPENER_RE);
+  if (at >= 0) win = win.slice(0, at);
+  // The window edge can split a surrogate pair; truncate only guards a cut it makes itself.
+  if (/[\uD800-\uDBFF]$/.test(win)) win = win.slice(0, -1);
+  return truncate(_scrubSecrets(win), max);
+}
+
+// Head+tail cut for command output. A check usually prints its verdict last ("...parsed: 0",
+// "3 passed"); a head-only cut hands the episode summarizer an unresolved-looking fragment,
+// and it has written a bugfix narrative for a check that passed. The tail comes from its own
+// scrub window at the END of the original string: taking it from the head window would drop
+// the verdict of any output longer than DESC_SCRUB_WINDOW.
+//
+// Output with a private span anywhere in it (a `<private>` tag or a PEM private-key marker) shows
+// no tail, only v6.18.0's 60-character head (cut as above). The tail is scrubbed in its own
+// window, which cannot see a span that crosses its edge, and pairing the markers per window
+// stored span text two ways in the v6.19.0 pre-tag review (a cut inside a closed `<private>`, a
+// key with no END more than 4096 characters back).
+const PRIVATE_TAG_HINT_RE = /<\/?private>/i;
+const HEAD_ONLY_MAX = 60;
+// The early return needs the WHOLE output inside the head window: a long output whose first
+// 4096 characters collapse to a few (whitespace) still has a tail to show (v6.19.0 pre-tag
+// claims review F2).
+function scrubTruncateEnds(str, max) {
+  if (typeof str === 'string' && (str.includes('PRIVATE KEY') || PRIVATE_TAG_HINT_RE.test(str))) {
+    return scrubTruncate(str, HEAD_ONLY_MAX);
+  }
+  const flat = scrubTruncate(str, DESC_SCRUB_WINDOW);
+  const whole = typeof str !== 'string' || str.length <= DESC_SCRUB_WINDOW;
+  if (whole && flat.length <= max) return flat;
+  const tailLen = Math.floor(max / 2) - 1;
+  const tailSrc = whole ? flat : normalizeInline(_scrubSecrets(str.slice(-DESC_SCRUB_WINDOW)));
+  // Drop a lone low surrogate the tail's cut may start on.
+  const tail = tailSrc.slice(-tailLen).replace(/^[\uDC00-\uDFFF]/, '');
+  // A head short enough to escape truncate's own "…" still gets one before the tail.
+  const budget = max - tailLen;
+  let head = truncate(flat, budget);
+  if (!head.endsWith('…')) head = head.length < budget ? `${head}…` : truncate(flat, budget - 1);
+  return head + tail;
 }
 
 export function makeEntryDesc(toolName, input, resp, opts) {
@@ -302,7 +350,7 @@ export function makeEntryDesc(toolName, input, resp, opts) {
       const isErr =
         opts?.isError ??
         (/\berror\b|\bfail(ed|ure)?\b|\bexception\b|\bpanic\b/i.test(resp) && resp.length > 30);
-      const snippet = scrubTruncate(resp, 60);
+      const snippet = scrubTruncateEnds(resp, 100);
       return isErr ? `${cmd} → ERROR: ${snippet}` : `${cmd} → ${snippet}`;
     }
     case 'Grep':