claude-mem-lite 6.19.0 → 6.19.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.19.0",
+      "version": "6.19.1",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.0",
+  "version": "6.19.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-optimize.mjs

@@ -32,6 +32,7 @@ import { normalizeScope, SCOPE_PROMPT_LEGEND, insertObservationRow } from './lib
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 import { MEMORY_INPUT_GUARD } from './lib/memory-input-guard.mjs';
+import { MANUAL_SESSION_ID_PREFIX } from './lib/provenance.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
 // P1-14: same resolver as hook-shared.mjs — this was the second module that had never
@@ -1108,7 +1109,7 @@ export function findMergeCandidates(db, maxClusters = 5, { project } = {}) {
     -- keeper.search_aliases when it rebuilt the keeper's TF-IDF vector. Phase-2 removed that
     -- rebuild, so the column had no reader left and went with it. Do NOT re-add it on the
     -- strength of R10 P3-7 -- that finding is moot, not pending. executeMergeCluster reads
-    -- keeper.{id,importance,narrative,concepts,facts} and o.{id,title,type,narrative,
+    -- keeper.{id,project,importance,narrative,concepts,facts} and o.{id,title,type,narrative,
     -- importance,access_count,lesson_learned}, and nothing else off these rows.
     SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig, lesson_learned, concepts, facts
     FROM observations
@@ -1311,10 +1312,33 @@ Return ONLY valid JSON:
          SELECT ${snapColList}, ? FROM observations WHERE id = ?`,
       ).run(keeper.id, keeper.id);
 
+      // The keeper now holds model text. Search reads authorship from memory_session_id, so an
+      // explicit save's `manual-` id would mark it as one (D#138); it moves to the compression
+      // writer's id. A machine-written keeper keeps its id, and so does the snapshot above, which
+      // is the original save. The writer's session row is best-effort: sdk_sessions refuses an id
+      // shaped like a uuid, which `compress-<project>` is for a 27-character project shaped
+      // xxxx-xxxx-xxxx-xxxxxxxxxxxx, and that refusal must not fail the merge (v6.19.1 pre-tag F5a).
+      let rewriteSessionId = null;
+      const keeperSession = db
+        .prepare('SELECT memory_session_id FROM observations WHERE id = ?')
+        .get(keeper.id);
+      if (keeperSession?.memory_session_id?.startsWith(MANUAL_SESSION_ID_PREFIX)) {
+        const compressSessionId = `compress-${keeper.project}`;
+        try {
+          db.prepare(
+            `INSERT OR IGNORE INTO sdk_sessions (content_session_id, memory_session_id, project, started_at, started_at_epoch, status)
+             VALUES (?, ?, ?, ?, ?, 'active')`,
+          ).run(compressSessionId, compressSessionId, keeper.project, new Date().toISOString(), Date.now());
+          rewriteSessionId = compressSessionId;
+        } catch (e) {
+          debugCatch(e, 'cluster-merge writer session');
+        }
+      }
       db.prepare(
         `
         UPDATE observations SET title=?, narrative=?, concepts=?, facts=?, text=?,
-          importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?
+          importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?,
+          memory_session_id = COALESCE(?, memory_session_id)
         WHERE id = ?
       `,
       ).run(
@@ -1327,6 +1351,7 @@ Return ONLY valid JSON:
         safe.lesson_learned,
         minhashSig,
         Date.now(),
+        rewriteSessionId,
         keeper.id,
       );
 

package/lib/activity.mjs

@@ -199,6 +199,8 @@ export function promoteInsightEvents(
       // manual-save contract) so it lands in the high-weight FTS field.
       lesson_learned: ev.body.slice(0, 500),
       now: new Date(ev.created_at_epoch),
+      // Event bodies are machine-written (episode summaries), so the row is not an explicit save.
+      sessionId: `promote-${ev.project}`,
     });
     mark.run(Date.now(), ev.id);
     return r;

package/lib/deferred-work.mjs

@@ -86,6 +86,30 @@ export function listOpenWithOrdinal(db, project, limit = 10) {
     .all(project, limit);
 }
 
+/**
+ * One open row's ordinal, numbered as listOpenWithOrdinal numbers it; null when the row is not
+ * open. `defer add` / `mem_defer` read it from a 50-row page before, so an item added past 50
+ * open printed `(item ?)` (D#123).
+ * @param {Database} db
+ * @param {string} project
+ * @param {number} id
+ * @returns {number|null}
+ */
+export function openOrdinalOf(db, project, id) {
+  const row = db
+    .prepare(
+      `
+    SELECT ordinal FROM (
+      SELECT id, ROW_NUMBER() OVER (ORDER BY priority DESC, created_at_epoch ASC, id ASC) AS ordinal
+      FROM deferred_work
+      WHERE project = ? AND status = 'open'
+    ) WHERE id = ?
+  `,
+    )
+    .get(project, id);
+  return row ? row.ordinal : null;
+}
+
 /**
  * How many open rows `defer list` / `mem_defer_list` left off their page, as a line to
  * print — '' when the page held them all. Without it a page one short of the open set

package/lib/lesson-bridge.mjs

@@ -26,7 +26,8 @@ export function buildBridgePrompt(lesson, hunk) {
 
 // { ok:true, check } when the bridge produced a usable, applicable check;
 // { ok:false } on N/A / empty / error / timeout. NEVER throws — the caller
-// falls back to the baseline ACK_DIRECTIVE on { ok:false }.
+// falls back to the arm's plain directive on { ok:false } (VERDICT_DIRECTIVE since 6.17.0,
+// scripts/pre-tool-recall.js ACTIVE_DIRECTIVE).
 export async function bridgeLesson({ lesson, hunk, timeoutMs = 2500, _callLLM = callLLM }) {
   try {
     const raw = await _callLLM(buildBridgePrompt(lesson, hunk), timeoutMs);

package/lib/provenance.mjs

@@ -1,7 +1,8 @@
 // Which writer produced an observation, read back from its memory_session_id. saveObservation
 // writes every explicit save under MANUAL_SESSION_ID_PREFIX. The hook capture (`hook-`),
-// transcript import (`import-`), compression summaries (`compress-`) and rows imported from
-// older stores (a bare session uuid) are machine-written.
+// transcript import (`import-`), compression summaries and cluster-merge keepers (`compress-`),
+// promoted events (`promote-`) and rows imported from older stores (a bare session uuid) are
+// machine-written.
 //
 // Search and get mark the machine-written side, because explicit saves are the large majority
 // of a typical store and a mark on nearly every line would carry no information. An unknown id

package/lib/save-observation.mjs

@@ -144,6 +144,7 @@ export function formatSupersedeSkipped(skipped) {
  * @param {string|null} [params.lesson_learned]   Caller validates ≤500 chars.
  * @param {boolean} [params.force=false]          Skip the near-duplicate window (below).
  * @param {Date}   [params.now]                   Override for tests.
+ * @param {string} [params.sessionId]             Writer id; default `manual-<project>` (an explicit save).
  * Both result shapes carry `supersededIds` (observations actually tombstoned) and
  * `supersedeSkipped` (requested but NOT tombstoned, each with a `reason`:
  * `malformed-id` | `no-such-observation` | `no-such-event` | `other-project` |
@@ -198,7 +199,9 @@ export function saveObservation(db, params) {
   const safeTitle = scrubSecrets(rawTitle);
   const safeLesson = rawLesson ? scrubSecrets(rawLesson) : null;
 
-  const sessionId = `${MANUAL_SESSION_ID_PREFIX}${project}`;
+  // An explicit save by default; a caller storing machine-written text names its own writer
+  // (lib/provenance.mjs reads authorship from this id).
+  const sessionId = params.sessionId || `${MANUAL_SESSION_ID_PREFIX}${project}`;
 
   // Ensure session exists (FK constraint). INSERT OR IGNORE makes this safe
   // under concurrent calls.

package/mem-cli.mjs

@@ -163,6 +163,7 @@ import { aggregateMetrics, readMetrics } from './lib/metrics.mjs';
 import {
   insertDeferred,
   listOpenWithOrdinal,
+  openOrdinalOf,
   dropDeferred,
   formatDropReasonHint,
   resolveDeferredIds,
@@ -1448,9 +1449,8 @@ function cmdDeferAdd(db, args) {
     return;
   }
   // Compute the freshly-inserted row's ordinal for an immediately-actionable
-  // response ("ok, deferred this as item N"). Mirrors server.mjs:980.
-  const open = listOpenWithOrdinal(db, project, 50);
-  const ord = open.find((o) => o.id === r.id)?.ordinal ?? '?';
+  // response ("ok, deferred this as item N"), as mem_defer does.
+  const ord = openOrdinalOf(db, project, r.id) ?? '?';
   out(`[mem] Deferred as D#${r.id} (item ${ord}) in project "${project}".`);
 }
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.0",
+  "version": "6.19.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.19.0",
+      "version": "6.19.1",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.0",
+  "version": "6.19.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/secret-scrub.mjs

@@ -184,32 +184,50 @@ export const SECRET_PATTERNS = [
   [/\b(?:xox[bpasr]|xapp|xoxe)-[a-zA-Z0-9-]{10,}\b/g, '***'],
   // Slack incoming-webhook URL — the path after /services/ is the shared secret.
   [/(https:\/\/hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g, '$1***'],
-  // JWT tokens (eyJ...eyJ...). A JWT begins its own token, so the start is `(?<![\w-])`, not
-  // `\b`: `-` is a base64url character, and `\b` let every `-eyJ` inside one dotless run be a
-  // fresh start that rescans the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
-  // (D#130). A `-eyJ` start is the middle of a run, never a JWT's first character.
-  // A JWT glued by a hyphen to up to 40 characters of hyphenated words (`my-sess-eyJ…`,
-  // `X-Auth-Token-eyJ…`) is a start too. `\b` allowed any length; past 40 characters it is missed. The lookbehind needs a token
-  // boundary within those 41 characters, so a hyphen run has at most ~10 starts, not one per
-  // `-eyJ` (v6.19.0 pre-tag reviews P3-2, delta P3-1).
+  // JWT tokens (eyJ...eyJ...), from any `eyJ`: one glued to a prefix (`my-sess-eyJ…`,
+  // `session-<uuid>-eyJ…`, `tok_eyJ…`) is still a JWT. Every `eyJ` of one dotless run used to be a
+  // fresh start that rescanned the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
+  // (D#130) — and v6.19.0's bounded lookbehind that fixed it missed a prefix over 40 characters
+  // (round-3 review P3-2). Here a failed start consumes its run instead (`|eyJ[\w-]*`, returned
+  // unchanged), so the scan resumes after it. Nothing is lost: the first segment cannot contain a
+  // `.`, so every later `eyJ` of the same run reaches the same run end and fails the same way.
   [
-    /(?:(?<![\w-])|(?<=(?:^|[^\w-])[\w-]{1,40}-))eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g,
-    '***',
+    /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b|eyJ[a-zA-Z0-9_-]*/g,
+    (m) => (m.includes('.') ? '***' : m),
   ],
   // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
   // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
   // alternation missed; the block delimiters make FP impossible.
   // The body stops at the next `-----BEGIN ` (D#130): with `[\s\S]*?` every header with no END
   // scanned to the end of the text, on each of scrubSecrets' passes — quadratic, 8.3 s on 500k
-  // chars. A block whose END is missing ends where the next private-key BEGIN starts, so a cut-off
-  // key's body is scrubbed too (v6.19.0 pre-tag review P2-1: requiring the END there stored that
-  // body); any other BEGIN (a certificate) does not end it, so a bare header in prose does not
-  // erase the text up to one (delta review P3-2). A header with no END and no later key header
-  // is left as it was in v6.18.0.
+  // chars. A block whose END is missing is left to the next pattern.
   [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|(?=-----BEGIN [A-Z0-9 ]*PRIVATE KEY))/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
     '***PEM_KEY***',
   ],
+  // A cut-off key (`head id_rsa`, a tool output cut mid-key): the header and the WHOLE lines of
+  // base64 (or RFC 1421 headers) that follow it. Stored whole through v6.19.0 when no later key
+  // header followed. Whole lines only, so prose naming a header mid-sentence keeps its text
+  // (v6.19.0 round-3 P3-3: ending the block at the next key header erased the prose between two).
+  // A body line starts with 16+ base64 characters, and one shorter whole line may follow the last
+  // of them (a key's last line): a line of one word or number is prose (v6.19.1 pre-tag review F3),
+  // so the body needs a long line, and blank lines count only between long ones. A long line need
+  // not be whole, so a key cut mid-line loses the cut line too. A line break may be JSON-escaped
+  // (`\n` as two characters) and a quote may end the last line (v6.19.1 claims review F1). A header
+  // value may hold a backslash that does not start an escaped break (a Windows path), and it does
+  // not share its whitespace with a second quantifier, which was quadratic (delta review P1).
+  [
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*(?:\r?\n|\\r\\n|\\n)(?=[ \t]*(?:\r?\n|\\r\\n|\\n)))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*(?:[A-Za-z0-9+/=]{16,}|(?:Proc-Type|DEK-Info|Version|Comment|Hash|Charset):(?:[^\r\n\\]|\\(?![rn]))*(?=\r?\n|\\[rn]|["']|$)))(?:(?:[ \t]*(?:\r?\n|\\r\\n|\\n)(?=[ \t]*(?:\r?\n|\\r\\n|\\n)))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*(?:[A-Za-z0-9+/=]{16,}|(?:Proc-Type|DEK-Info|Version|Comment|Hash|Charset):(?:[^\r\n\\]|\\(?![rn]))*(?=\r?\n|\\[rn]|["']|$))))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*[A-Za-z0-9+/=]{1,15}[ \t]*(?=\r?\n|\\[rn]|["']|$))?/g,
+    '***PEM_KEY***',
+  ],
+  // The other end (`tail key.pem`): whole base64 lines ending in a private-key END, the same line
+  // rule as above but with two shorter lines allowed before the END (an armored PGP key's last data
+  // line and its `=XXXX` checksum; delta review P2). A line may start after a quote. A run of lines
+  // that does not end there is consumed and returned unchanged, so no line starts a second scan.
+  [
+    /(?:(?<![^\n])|(?<=\\n|["']))(?:[ \t]*[A-Za-z0-9+/=]{16,}[ \t]*(?:\r?\n|\\r\\n|\\n))+(?:[ \t]*[A-Za-z0-9+/=]{1,15}[ \t]*(?:\r?\n|\\r\\n|\\n)){0,2}(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----)?/g,
+    (m) => (m.endsWith('-----') ? '***PEM_KEY***' : m),
+  ],
   // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
   // `hash` deliberately excluded: `hash: <40hex>` / `hash=<md5>` are git SHAs and
   // checksums (real, preserved data in this hash-heavy repo), not credentials.

package/server.mjs

@@ -125,6 +125,7 @@ import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
   insertDeferred,
   listOpenWithOrdinal,
+  openOrdinalOf,
   dropDeferred,
   formatDropReasonHint,
   resolveDeferredIds,
@@ -1221,8 +1222,7 @@ server.registerTool(
     });
     // Compute the ordinal for the freshly-inserted row so the response is
     // immediately actionable ("ok, I deferred this as item 1").
-    const open = listOpenWithOrdinal(db, project, 50);
-    const ord = open.find((o) => o.id === r.id)?.ordinal ?? null;
+    const ord = openOrdinalOf(db, project, r.id);
     return {
       content: [
         {

package/utils.mjs

@@ -289,13 +289,34 @@ const DESC_SCRUB_WINDOW = 4096;
 // before the first remaining `<private>` or private-key BEGIN, so no field shows a span whose end
 // is out of view. Before v6.19.0 an unclosed opener in the window (a Grep line
 // `notes.md:3:<private>bank pin 4412`) was shown as written (v6.19.0 pre-tag reviews P3-1, r3 P2-1).
-// The PEM half is case-sensitive, like the scrubber's PEM pattern.
-const PRIVATE_OPENER_RE = /<[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----BEGIN [A-Z0-9 ]*PRIVATE KEY/;
-function scrubTruncate(str, max) {
+// A `</private>` or private-key END that comes first is a span whose START is out of view (a
+// nested span, `tail key.pem`), so everything before it may be its inside: the field shows nothing
+// (round-3 P3-1). The PEM half is case-sensitive, like the scrubber's PEM pattern.
+const PRIVATE_MARK_RE = /<\/?[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----(?:BEGIN|END) [A-Z0-9 ]*PRIVATE KEY/;
+// A window edge that cuts a token leaves a fragment shorter than its pattern needs (`ghp_` and 12
+// of its 36 characters), and whitespace collapsing can bring it into view: the cut token is
+// dropped (defect review P3-6, round-3 P3-4/P3-6). A head window with no whitespace keeps it: its
+// start is intact and it is the only part shown. A tail window with no whitespace is all one cut token.
+const isWs = (c) => c === ' ' || c === '\n' || c === '\t' || c === '\r' || /\s/.test(c);
+function dropCutTokenAtEnd(win, next) {
+  if (next === undefined || isWs(next)) return win;
+  let i = win.length;
+  while (i > 0 && !isWs(win[i - 1])) i--;
+  return i > 0 ? win.slice(0, i) : win;
+}
+function dropCutTokenAtStart(win, prev) {
+  if (prev === undefined || isWs(prev)) return win;
+  let i = 0;
+  while (i < win.length && !isWs(win[i])) i++;
+  return win.slice(i);
+}
+function scrubTruncate(str, max, window = DESC_SCRUB_WINDOW) {
   if (typeof str !== 'string' || str === '') return truncate(str, max);
-  let win = stripPrivate(str).slice(0, DESC_SCRUB_WINDOW);
-  const at = win.search(PRIVATE_OPENER_RE);
-  if (at >= 0) win = win.slice(0, at);
+  const stripped = stripPrivate(str);
+  let win = stripped.slice(0, window);
+  const mark = PRIVATE_MARK_RE.exec(win);
+  if (mark) win = mark[0][1] === '/' || mark[0].startsWith('-----END') ? '' : win.slice(0, mark.index);
+  else win = dropCutTokenAtEnd(win, stripped[window]);
   // The window edge can split a surrogate pair; truncate only guards a cut it makes itself.
   if (/[\uD800-\uDBFF]$/.test(win)) win = win.slice(0, -1);
   return truncate(_scrubSecrets(win), max);
@@ -314,6 +335,17 @@ function scrubTruncate(str, max) {
 // key with no END more than 4096 characters back).
 const PRIVATE_TAG_HINT_RE = /<\/?private>/i;
 const HEAD_ONLY_MAX = 60;
+// The tail window is scrubbed with TAIL_CONTEXT characters before it, which are then dropped: a
+// label cut by the window's edge (`pass|word: <value>`) is seen whole, so its value is not left
+// unlabelled at the window's start, where whitespace collapsing can bring it into view (v6.19.1
+// pre-tag review F1). A replacement inside the context moves the cut by its length change; the
+// token the cut lands in is dropped either way.
+const TAIL_CONTEXT = 256;
+function scrubTailWindow(str, window) {
+  const scrubbed = _scrubSecrets(str.slice(-(window + TAIL_CONTEXT)));
+  return dropCutTokenAtStart(scrubbed.slice(TAIL_CONTEXT), scrubbed[TAIL_CONTEXT - 1]);
+}
+const oneSpace = (s) => s.replace(/\s+/g, ' ');
 // The early return needs the WHOLE output inside the head window: a long output whose first
 // 4096 characters collapse to a few (whitespace) still has a tail to show (v6.19.0 pre-tag
 // claims review F2).
@@ -321,11 +353,20 @@ function scrubTruncateEnds(str, max) {
   if (typeof str === 'string' && (str.includes('PRIVATE KEY') || PRIVATE_TAG_HINT_RE.test(str))) {
     return scrubTruncate(str, HEAD_ONLY_MAX);
   }
-  const flat = scrubTruncate(str, DESC_SCRUB_WINDOW);
-  const whole = typeof str !== 'string' || str.length <= DESC_SCRUB_WINDOW;
+  // Up to two windows long, one window covers the whole output: two overlapping windows showed
+  // the same text twice (delta review P3-4).
+  const window =
+    typeof str === 'string' && str.length <= 2 * DESC_SCRUB_WINDOW
+      ? 2 * DESC_SCRUB_WINDOW
+      : DESC_SCRUB_WINDOW;
+  // Whitespace runs are one space: a blank-line run no longer spends the budget (or, before the
+  // one-window rule, hid behind the window edge).
+  const flat = oneSpace(scrubTruncate(str, window, window));
+  const whole = typeof str !== 'string' || str.length <= window;
   if (whole && flat.length <= max) return flat;
   const tailLen = Math.floor(max / 2) - 1;
-  const tailSrc = whole ? flat : normalizeInline(_scrubSecrets(str.slice(-DESC_SCRUB_WINDOW)));
+  const tailSrc = whole ? flat : oneSpace(normalizeInline(scrubTailWindow(str, window)));
+  if (tailSrc === '') return truncate(flat, max);
   // Drop a lone low surrogate the tail's cut may start on.
   const tail = tailSrc.slice(-tailLen).replace(/^[\uDC00-\uDFFF]/, '');
   // A head short enough to escape truncate's own "…" still gets one before the tail.