claude-mem-lite 6.2.0 → 6.4.0

package/install.mjs

@@ -54,7 +54,7 @@ const SERVER_PATH = join(INSTALL_DIR, 'server.mjs');
 const HOOK_PATH = join(INSTALL_DIR, 'hook.mjs');
 // P2-7: both constants and the predicate come from lib/plugin-key.mjs, which hook.mjs also
 // imports — this pair used to be typed out in each.
-import { MARKETPLACE_KEY, PLUGIN_KEY, isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
+import { MARKETPLACE_KEY, PLUGIN_KEY, PLUGIN_NAME, isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
 const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 
 import {
@@ -68,8 +68,11 @@ import {
   probeBetterSqlite3Binding,
   ensureBetterSqlite3Working,
   nativeBindingRepairHint,
+  isNativeBindingError,
 } from './lib/binding-probe.mjs';
+import { readSnapshots } from './lib/db-backup.mjs';
 import { detectInstallShape, probeRuntimeRoots } from './lib/install-shape.mjs';
+import { probeSchemaCompat, schemaSkewRemedy } from './lib/schema-skew.mjs';
 import { clearNativeBindingBreakage, readNativeBindingBreakage } from './lib/native-binding-hint.mjs';
 import { sweepStaleTestFixtures } from './lib/tmp-fixture-sweep.mjs';
 import { ORPHAN_EPISODE_AGE_MS } from './lib/time-constants.mjs';
@@ -332,6 +335,147 @@ function isDevInstall() {
   }
 }
 
+// Last-resort recovery command, printed when the signature-verified repair path itself
+// fails. It resolves the latest RELEASE tarball via the GitHub API rather than fetching
+// `/tarball`, which serves the DEFAULT BRANCH — unreleased WIP. That mattered: repair()
+// exists because the old auto-path ran main HEAD unverified, and until 2026-09-08 the
+// fallback it printed on failure handed the user exactly that behaviour back. A shell
+// one-liner cannot check an Ed25519 signature, so this remains a trust decision the user
+// makes explicitly; pinning it to a release at least removes the unreleased-WIP half.
+//
+// FOUR surfaces carry this string — here, scripts/hook-launcher.mjs (pure-`node:` charter,
+// cannot import lib/), README.md and README.zh-CN.md. Exported so
+// tests/manual-fallback-sync.test.mjs can pin the other three to this one and fail if a
+// fifth appears; a string kept in sync by a comment is a string that drifts.
+export const MANUAL_TARBALL_FALLBACK =
+  'T=$(mktemp -d) && U=$(curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/releases/latest | grep -o \'"tarball_url"[^,]*\' | cut -d\'"\' -f4) && curl -sL "$U" | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install';
+
+/**
+ * Whether the local marketplace clone can still be fast-forwarded.
+ *
+ * This is the near cause of the failure v6.3.0 shipped a detector for. Claude Code updates a
+ * git-source marketplace by pulling that clone; a DIRTY working tree blocks the pull, the
+ * plugin silently stops updating, and eventually the database is written by a newer
+ * claude-mem-lite than the code that has to open it. On this machine the clone was pinned 22
+ * commits behind while everything reported green.
+ *
+ * It gets dirty on its own: with a DIRECTORY-source marketplace, `${CLAUDE_PLUGIN_ROOT}`
+ * resolves inside the clone, and `scripts/launch.mjs` runs `npm install` there whenever
+ * `node_modules/better-sqlite3` is missing — which is every materialization of a new version.
+ * That install rewrites **`package-lock.json`**, which IS tracked, and that is what blocks the
+ * pull. So the plugin's own launcher can create the state that stops the plugin updating.
+ *
+ * **Do not add a `node_modules` special case here.** A first cut did, and pre-ship review
+ * measured it dead: the clone is a clone of THIS repo, whose `.gitignore` carries
+ * `/node_modules`, so `git status --porcelain` never sees it — the branch was reachable only
+ * from a fixture that omitted the `.gitignore` the real clone always has. An ignored
+ * `node_modules` also does not block a fast-forward, so reporting it would have been noise
+ * even if it were visible. The tracked-file dirt is the whole signal.
+ *
+ * Five outcomes, and `unknown` is one of them on purpose: "I could not run git" must not be
+ * reported in the same voice as "the tree is clean".
+ *
+ * Exported for tests/marketplace-clone-health.test.mjs.
+ */
+export function marketplaceCloneHealth(
+  dir,
+  run = (args) => execFileSync('git', args, { encoding: 'utf8', timeout: 20000 }),
+) {
+  if (!existsSync(dir)) return { kind: 'absent' };
+  if (!existsSync(join(dir, '.git'))) return { kind: 'not-git' };
+  let porcelain;
+  try {
+    porcelain = run(['-C', dir, 'status', '--porcelain']);
+  } catch (e) {
+    return { kind: 'unknown', reason: e?.code || e?.message || 'git failed' };
+  }
+  const entries = String(porcelain)
+    .split('\n')
+    .filter((l) => l.trim());
+  if (entries.length === 0) return { kind: 'clean' };
+  return { kind: 'dirty', count: entries.length };
+}
+
+/**
+ * The `mem-lite` / `mem` registrations in `claude mcp list` output that are NOT provided by
+ * a plugin manifest.
+ *
+ * `claude mcp list` prints one `<name>: <command>` line per server, and a plugin-provided
+ * one is named `plugin:<plugin>:<server>`. The old test — `list.includes('mem-lite:')` —
+ * matched inside `plugin:claude-mem-lite:mem-lite:`, so it could not tell the two apart and
+ * always answered "registered" for a plugin user.
+ *
+ * Deliberately named for what it MEASURES: a bare-name registration, whatever its scope.
+ * `mcp list` does not label user vs project scope on the line itself, so calling this
+ * "user-scope" would claim more than the output supports.
+ *
+ * Exported for tests/mcp-registration-parse.test.mjs.
+ */
+export function nonPluginMemRegistrations(listOutput) {
+  const names = [];
+  for (const line of String(listOutput ?? '').split('\n')) {
+    // Anchored, no leading whitespace: the diagnostics block below the list is indented, and
+    // its `└ [Warning] [mem-lite] mcpServers.mem-lite: …` lines are not registrations.
+    const m = /^(\S+):\s+\S/.exec(line);
+    if (!m) continue;
+    const name = m[1];
+    if (name.startsWith('plugin:')) continue;
+    if (name === 'mem-lite' || name === 'mem') names.push(name);
+  }
+  return names;
+}
+
+/**
+ * The remedy line for a `doctor` database check that threw — or null when the failure is
+ * one this cannot classify.
+ *
+ * Returning null is deliberate and is the case worth defending: a diagnostic that always
+ * prints a fix eventually prints the wrong one, and the bare error message is a better
+ * answer than a confident irrelevance. The three CLASSIFIED outcomes are kept apart for the
+ * same reason — "restore this snapshot", "there is no snapshot", and "I could not read the
+ * directory to find out" are three different situations, and collapsing the last two ends
+ * the reader's search with a fact nobody checked.
+ *
+ * Shell commands only, no `claude-mem-lite <cmd>`: the remedy for a broken store must not
+ * itself depend on which install shape the user has (the plugin cache has no CLI on PATH).
+ *
+ * Exported for tests/doctor-db-remedy.test.mjs, which also drives the shipped doctor over a
+ * corrupt file — a pure function nothing calls is the wiring gap this repo keeps finding.
+ */
+export function dbCheckRemedy(dbPath, err) {
+  if (isNativeBindingError(err)) return `Repair: ${nativeBindingRepairHint(PROJECT_DIR)}`;
+  const msg = String(err?.message ?? err ?? '');
+  // SQLite's own spellings for "this file is not a usable database".
+  if (!/not a database|disk image is malformed|file is not a database/i.test(msg)) return null;
+
+  const clear = `rm -f "${dbPath}-wal" "${dbPath}-shm"`;
+  const snap = readSnapshots(dbPath);
+  if (!snap.ok) {
+    return (
+      `Could not read ${dirname(dbPath)} to look for a backup snapshot (${snap.reason}) — ` +
+      `fix that directory first, then look for ${basename(dbPath)}.*.bak beside the database.`
+    );
+  }
+  if (snap.snapshots.length === 0) {
+    return (
+      `No backup snapshot exists beside the database. Set the broken file aside so a fresh ` +
+      `store is created on the next session: ${clear} && mv "${dbPath}" "${dbPath}.corrupt" ` +
+      `— memories in that file are not recoverable without a backup.`
+    );
+  }
+  // Newest by mtime. Ties are broken by name, which carries an ISO stamp, so the answer is
+  // total rather than dependent on which of two same-millisecond files readdir returned
+  // first (the D#9 shape).
+  const newest = snap.snapshots
+    .slice()
+    .sort((a, b) => b.mtimeMs - a.mtimeMs || (a.path < b.path ? 1 : -1))[0];
+  return (
+    `Restore the newest of ${snap.snapshots.length} backup snapshot(s): ` +
+    `${clear} && cp "${newest.path}" "${dbPath}" ` +
+    `— move the broken file aside first if you want to keep it for inspection.`
+  );
+}
+
 // ─── Install ────────────────────────────────────────────────────────────────
 
 // Dynamic-import helpers, resolved against the installed copy at INSTALL_DIR
@@ -1135,11 +1279,23 @@ async function uninstall() {
     ok('Marketplace directory removed');
   }
 
-  // 5b. Remove cache directory
+  // 5b. Remove cache directories — OURS unconditionally, the marketplace-wide one gated.
+  //
+  // The gate exists so uninstalling this plugin does not delete a sibling plugin published
+  // under the same marketplace. That reasoning covers `cache/<marketplace>/`; it does not
+  // cover `cache/<marketplace>/claude-mem-lite/`, which is ours alone. Because only the
+  // gated branch existed, a user with any other sdsrss plugin installed kept every cached
+  // version of THIS one — measured at 241 MB on a machine where `/plugin uninstall` had
+  // already removed the manifest, i.e. bytes belonging to a plugin that was gone.
+  const ownCacheDir = join(pluginsDir, 'cache', marketplaceKey, PLUGIN_NAME);
+  if (existsSync(ownCacheDir)) {
+    rmSync(ownCacheDir, { recursive: true, force: true });
+    ok('Plugin cache removed');
+  }
   const cacheDir = join(pluginsDir, 'cache', marketplaceKey);
   if (canRemoveMarketplaceArtifacts && existsSync(cacheDir)) {
     rmSync(cacheDir, { recursive: true, force: true });
-    ok('Plugin cache removed');
+    ok('Marketplace cache directory removed');
   }
 
   // 5c. Clean known_marketplaces.json
@@ -1223,35 +1379,52 @@ async function status() {
   // configured` at a correctly-installed plugin user — two red marks describing
   // the intended state.
   const shape = detectInstallShape({ home: homedir(), projectDir: PROJECT_DIR, installDir: INSTALL_DIR });
-  const pluginProvides = !!shape.activePluginVersion;
-
-  // MCP
-  try {
-    const list = execFileSync('claude', ['mcp', 'list'], { encoding: 'utf8' });
-    // Accept either the current "mem-lite" registration or the legacy "mem"
-    // name (pre-v2.78) so a user mid-upgrade still sees a green status until
-    // setup.sh / install.mjs purges the legacy entry on next run.
-    // v2.79.1: dropped a `/\bmem\b\s/` fallback regex — the `\b` word boundary
-    // also matched "mem-lite" (because `-` is a non-word char), so the regex
-    // was always-true noise (benign only because the mem-lite checks short-
-    // circuited first). `claude mcp list` formats as `<name>: <command>`, so
-    // the two colon-form checks below cover every shape.
-    const registered = list.includes('mem-lite:') || list.includes('mem:');
-    if (registered) {
-      push('ok', 'mcp', 'MCP server: registered', { registered });
-    } else if (pluginProvides) {
-      push(
-        'ok',
-        'mcp',
-        `MCP server: provided by the plugin manifest (v${shape.activePluginVersion.version} .mcp.json) — no user-scope registration expected`,
-        { registered: false, via: 'plugin' },
-      );
-    } else {
-      push('fail', 'mcp', 'MCP server: not registered', { registered });
+  // A cache DIRECTORY is not an installed plugin — `/plugin uninstall` leaves version dirs
+  // behind (this project's own README documents that), and `activePluginVersion` falls back to
+  // "newest cache dir" when nothing recorded an install. Both branches below credit the
+  // manifest with providing something, so both need the registration, not the directory.
+  const pluginProvides =
+    !!shape.activePluginVersion && pluginIsRegistered({ home: homedir(), settings: readSettings() });
+
+  // MCP. A plugin install answers this from the manifest and does NOT shell out.
+  //
+  // Two reasons, and the first is correctness rather than speed. `claude mcp list` prints a
+  // plugin server as `plugin:claude-mem-lite:mem-lite: …`, and the old substring test
+  // `list.includes('mem-lite:')` matched INSIDE that name — so a plugin user was reported as
+  // having a user-scope registration they do not have, and the branch written for them below
+  // was unreachable. That is the same accidental-match class as the `\bmem\b` regex this
+  // comment block used to describe. Second: the official help says approved servers are
+  // "health-checked", i.e. the call STARTS every MCP server configured on the machine —
+  // measured 2026-09-08 at 2.546s wall for three servers, one of them a remote HTTP endpoint.
+  // A status command should not pay that, and a plugin user gains nothing from it.
+  //
+  // `doctor` GAINS the exec instead (it had none before this change) and runs it
+  // unconditionally: it is the deep check, and it is where the duplicate/legacy registration
+  // the README's "Mixed-install residue" section describes now gets detected — nothing
+  // detected it before. That means `doctor` now health-checks every MCP server on the
+  // machine; both READMEs say so under their `doctor` sections.
+  if (pluginProvides) {
+    push(
+      'ok',
+      'mcp',
+      `MCP server: provided by the plugin manifest (v${shape.activePluginVersion.version} .mcp.json) — no user-scope registration expected`,
+      { registered: false, via: 'plugin' },
+    );
+  } else
+    try {
+      const list = execFileSync('claude', ['mcp', 'list'], { encoding: 'utf8', timeout: 60000 });
+      // Accept either the current "mem-lite" registration or the legacy "mem" name
+      // (pre-v2.78) so a user mid-upgrade still sees a green status until setup.sh /
+      // install.mjs purges the legacy entry on next run.
+      const registered = nonPluginMemRegistrations(list).length > 0;
+      if (registered) {
+        push('ok', 'mcp', 'MCP server: registered', { registered });
+      } else {
+        push('fail', 'mcp', 'MCP server: not registered', { registered });
+      }
+    } catch {
+      push('warn', 'mcp', 'Could not check MCP status', { registered: null });
     }
-  } catch {
-    push('warn', 'mcp', 'Could not check MCP status', { registered: null });
-  }
 
   // Hooks
   const settings = readSettings();
@@ -1479,6 +1652,73 @@ async function doctor() {
     }
   }
 
+  // Can each code home actually OPEN this database? A binding that loads is not the same
+  // question: better-sqlite3 can be perfect and the store still unreadable, because
+  // schema.mjs refuses a DB written by a newer claude-mem-lite (correctly — replaying old
+  // migrations over a newer layout would corrupt it). That is a one-way ratchet, and on a
+  // plugin install it is REACHED ROUTINELY: the cache only advances when Claude Code's
+  // marketplace updater advances it, so anything else that opens the DB — an npm-global
+  // CLI, a dev checkout — can leave the cache locked out. Measured 2026-09-08: DB v49 vs a
+  // live 5.6.0 cache supporting v48, >=648 identical hook errors in one day, and the only
+  // user-visible signal was `-32000 Connection closed` from the MCP host.
+  //
+  // Probed per root, out of process, exactly like the binding check above and for the same
+  // reason: this is the check that has to survive answering the question, and importing
+  // another tree's schema.mjs would poison the process that must report the answer. It is
+  // also why this check is USEFUL TODAY rather than only after the next upgrade — doctor
+  // runs from whichever tree the user invoked, so new code here can diagnose an old cache.
+  if (!existsSync(DB_PATH)) {
+    ok('DB schema: no database yet — nothing to compare');
+  } else if (rootProbes.length === 0) {
+    // The fourth outcome the first cut had and did not print. The `fail` above already tells
+    // the reader no install owns a binding, but a block whose stated design point is "three
+    // outcomes, never two" must not answer a fourth case with silence.
+    dwarn('DB schema: not checked — no install on this machine owns a native binding to read it with');
+  } else {
+    const compat = probeSchemaCompat(shape.runtimeRoots, DB_PATH);
+    const behind = compat.filter((c) => c.status === 'skew');
+    const unknown = compat.filter((c) => c.status === 'unknown');
+    if (behind.length === 0 && unknown.length === 0) {
+      ok(`DB schema: v${compat[0]?.dbVersion} — readable by all ${compat.length} install(s)`);
+    }
+    if (behind.length > 0) {
+      // Dynamic: only a skewed machine pays for it, and it reuses hook-update's isDevMode
+      // rather than re-deriving "is this a checkout", which that file has already had to
+      // correct twice (whole-dir symlink, then per-file drift).
+      let dev = false;
+      try {
+        const { isDevMode } = await import('./hook-update.mjs');
+        dev = isDevMode();
+      } catch {
+        /* unreadable → the initialiser stands: a non-dev install gets the common remedy */
+      }
+      for (const b of behind) {
+        // PER ROOT, inside the loop. Computing one remedy for every skewed tree printed the
+        // machine's global answer beneath a label naming a different tree — on a mixed
+        // managed+plugin install that meant `self-update` under "plugin cache v5.6.0",
+        // which advances nothing. b.root is the tree that is actually behind.
+        const remedy = schemaSkewRemedy({
+          managed: shape.managed,
+          activePluginVersion: shape.activePluginVersion,
+          dev,
+          root: b.root,
+        });
+        // fail, not warn: every write path is dead in this state and only the user can fix it.
+        fail(`DB schema v${b.dbVersion} is newer than ${b.label}, which supports up to v${b.supported}`);
+        for (const c of remedy.commands) log(`    ${c}`);
+        if (remedy.note) log(`    ${remedy.note}`);
+        issues++;
+      }
+    }
+    for (const u of unknown) {
+      // Deliberately its own outcome. "I could not determine what this install supports"
+      // printed as a green line is the defect the v6.2.0 round wrote and its pre-ship review
+      // caught before the tag — a check that says "nothing to check" and "I could not look"
+      // in the same voice ends the reader's search instead of directing it.
+      dwarn(`DB schema: could not determine compatibility for ${u.label} (${u.error})`);
+    }
+  }
+
   try {
     await import('@modelcontextprotocol/sdk/server/mcp.js');
     ok('@modelcontextprotocol/sdk: verified (import OK)');
@@ -1639,6 +1879,65 @@ async function doctor() {
     ok('Orphan hooks: none (all hook targets present)');
   }
 
+  // MCP registration. This lives in doctor, not status: `claude mcp list` health-checks —
+  // i.e. STARTS — every MCP server configured on the machine (2.546s wall for three servers,
+  // measured 2026-09-08), which is a cost the deep check can carry and a status line cannot.
+  //
+  // What it buys beyond status: the DUPLICATE. The README's "Mixed-install residue" section
+  // has warned since v3 that a plugin user who once ran the npx/git-clone installer keeps a
+  // bare-name registration that double-registers the server — and nothing in the tool
+  // detected it. Orphan hooks had a check; its MCP twin did not.
+  try {
+    const list = execFileSync('claude', ['mcp', 'list'], { encoding: 'utf8', timeout: 60000 });
+    const bare = nonPluginMemRegistrations(list);
+    // Registration, not directory — see pluginIsRegistered. Crediting a leftover cache dir
+    // here told a working npm-channel install to delete its ONLY MCP registration.
+    const viaPlugin =
+      !!shape?.activePluginVersion && pluginIsRegistered({ home: homedir(), settings: readSettings() });
+    if (viaPlugin && bare.length > 0) {
+      dwarn(
+        `MCP registration: the plugin manifest provides the server AND a bare "${bare.join('", "')}" registration exists — the server is registered twice`,
+      );
+      // No `-s` flag, deliberately: `nonPluginMemRegistrations`'s own docblock says `mcp list`
+      // does not label scope, and this repo's tracked `.mcp.json` registers a bare `mem-lite`
+      // at PROJECT scope, which `-s user` cannot remove. `claude mcp remove` without the flag
+      // removes from whichever scope the entry is in. Every name, not just the first.
+      for (const name of bare) log(`    Fix: claude mcp remove ${name}`);
+    } else if (viaPlugin) {
+      ok('MCP registration: provided by the plugin manifest only (no duplicate)');
+    } else if (bare.length > 0) {
+      ok(`MCP registration: "${bare.join('", "')}" registered`);
+    } else {
+      dwarn('MCP registration: no claude-mem-lite MCP server is registered and no plugin provides one');
+    }
+  } catch (e) {
+    // Third outcome, kept apart from "none found" on purpose: the `claude` CLI may not be on
+    // PATH at all, and a green "no duplicate" would end the reader's search on a check that
+    // never ran.
+    dwarn(`MCP registration: could not run \`claude mcp list\` (${e.code || e.message}) — not checked`);
+  }
+
+  // Marketplace clone updatability — see marketplaceCloneHealth for why this is the
+  // precondition behind the schema-skew lock-in v6.3.0 shipped a detector for.
+  const marketplaceClone = join(homedir(), '.claude', 'plugins', 'marketplaces', MARKETPLACE_KEY);
+  const clone = marketplaceCloneHealth(marketplaceClone);
+  if (clone.kind === 'dirty') {
+    dwarn(`Marketplace clone: ${clone.count} uncommitted change(s) in ${marketplaceClone}`);
+    log(
+      '    Claude Code updates a git-source marketplace by pulling this clone, and a dirty tree blocks the pull —',
+    );
+    log(
+      '    the plugin then stops updating silently, which is how a machine ends up running code older than its DB.',
+    );
+    log(`    Inspect: git -C ${marketplaceClone} status`);
+  } else if (clone.kind === 'unknown') {
+    dwarn(`Marketplace clone: could not check ${marketplaceClone} (${clone.reason}) — not checked`);
+  } else if (clone.kind === 'clean') {
+    ok('Marketplace clone: clean (the marketplace updater can fast-forward it)');
+  }
+  // 'absent' / 'not-git' are silent: an npm-channel or npx user has no marketplace clone,
+  // and a check that reports on a thing you do not have is noise.
+
   // Database
   if (existsSync(DB_PATH)) {
     try {
@@ -1682,6 +1981,11 @@ async function doctor() {
       }
     } catch (e) {
       fail('Database: ' + e.message);
+      // Every other ✗ on this screen carries a remedy; this one used to be the exception,
+      // and a corrupt store is the failure a user is least able to diagnose unaided.
+      // dbCheckRemedy returns null rather than invent one for an error it cannot classify.
+      const remedy = dbCheckRemedy(DB_PATH, e);
+      if (remedy) log(`    ${remedy}`);
       issues++;
     }
   } else {
@@ -2288,6 +2592,41 @@ export function hasOtherMarketplacePlugins(
   return Object.keys(plugins).some((key) => key !== pluginKey && key.endsWith(`@${marketplaceKey}`));
 }
 
+/**
+ * Whether Claude Code actually has this plugin INSTALLED — as opposed to a leftover version
+ * directory sitting in its cache.
+ *
+ * `detectInstallShape`'s `activePluginVersion` is not that question. Its own comment calls its
+ * third tier — the newest cache directory — "a guess, and after a rollback the wrong one", and
+ * a terminal has neither of the first two tiers (`CLAUDE_PLUGIN_ROOT`, `installed_plugins.json`)
+ * after `/plugin uninstall`. `/plugin uninstall` leaves the version dirs behind, which this
+ * project's own README now documents — so "a cache directory exists" is true on machines that
+ * have no plugin at all.
+ *
+ * Using it as "the plugin provides the MCP server" was measured to tell a working npm-channel
+ * install that its server was registered twice, with a remedy that removes its ONLY
+ * registration. Read from the two places that RECORD an installation instead.
+ *
+ * Deliberately NOT `!shape.managed`: a mixed install has both, and that is precisely the state
+ * the duplicate check exists for. Over-narrowing here is safe by construction — the caller
+ * falls back to asking `claude mcp list`, which is the pre-fix behaviour and correct.
+ *
+ * Exported for tests/mcp-registration-parse.test.mjs.
+ */
+export function pluginIsRegistered({ home = homedir(), settings = {} } = {}) {
+  if (isPluginExplicitlyDisabled(settings)) return false;
+  if (settings?.enabledPlugins?.[PLUGIN_KEY] === true) return true;
+  try {
+    const installed = JSON.parse(
+      readFileSync(join(home, '.claude', 'plugins', 'installed_plugins.json'), 'utf8'),
+    );
+    return PLUGIN_KEY in getInstalledPluginEntries(installed);
+  } catch {
+    // Missing or unparseable registry: not evidence of an installation.
+    return false;
+  }
+}
+
 /** Thrown when settings.json exists but is not parseable. Never a reason to write. */
 class SettingsUnparseableError extends Error {}
 
@@ -2556,9 +2895,7 @@ async function repair() {
     console.log('  Automatic repair fails closed rather than run unverified code.');
     console.log('  Manual fallback — run this in any shell (you are choosing to trust it):');
     console.log('');
-    console.log(
-      '  T=$(mktemp -d) && curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/tarball | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install',
-    );
+    console.log(`  ${MANUAL_TARBALL_FALLBACK}`);
     console.log('');
     process.exit(1);
   } finally {

package/lib/data-paths.mjs

@@ -0,0 +1,33 @@
+/**
+ * The three location constants, in a leaf module.
+ *
+ * They lived in `schema.mjs`, which statically imports `better-sqlite3`. That made the
+ * native driver a LOAD-TIME dependency of anything that wanted a path — including
+ * `hook-update.mjs`, which `install.mjs::repair()` imports to reach the Ed25519-verified
+ * release path. Measured 2026-09-08: on a tree with no `node_modules`, that import threw
+ * `ERR_MODULE_NOT_FOUND` from `schema.mjs`, repair() caught it, refused to auto-install
+ * unverified code, and printed the unverified default-branch tarball instead. So the
+ * signature check was unreachable on the one install state the self-heal exists to fix.
+ *
+ * Keep this module free of package imports — `node:` builtins and `lib/resolve-data-dir.mjs`
+ * only. `tests/repair-path-no-native-dep.test.mjs` walks the static import graph from
+ * `hook-update.mjs` and fails on ANY package edge, so a future import here has to argue
+ * with a test rather than silently disarm the repair path.
+ *
+ * `schema.mjs` re-exports all three names, so every existing importer keeps working and
+ * this is not a contract change.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveDataDir } from './resolve-data-dir.mjs';
+
+// DATA location — DB, managed resources, registry DB, runtime/. Honors
+// CLAUDE_MEM_DIR so users can relocate state to a larger/faster volume.
+export const DB_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
+export const DB_PATH = join(DB_DIR, 'claude-mem-lite.db');
+// CODE / install location — server.mjs, hook.mjs, cli.mjs, package.json live
+// here. ALWAYS homedir-rooted: Claude Code's settings.json + MCP registration
+// bake ABSOLUTE paths to server.mjs/hooks, so the code must NOT follow the
+// CLAUDE_MEM_DIR relocation env var (mirrors install.mjs INSTALL_DIR). Equals
+// DB_DIR when CLAUDE_MEM_DIR is unset — the common, non-relocated case.
+export const CODE_DIR = join(homedir(), '.claude-mem-lite');

package/lib/db-backup.mjs

@@ -43,26 +43,51 @@ export const BACKUP_EVICTION_GRACE_MS = 7 * DAY_MS;
 // user's hand-made `cp db db.before-upgrade.bak` must never be auto-unlinked.
 const SNAPSHOT_STAMP_RE = /-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d+-\d+\.bak$/;
 
-/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
-export function listSnapshots(dbPath) {
+/**
+ * Snapshots for `dbPath`, keeping "there are none" and "I could not look" APART.
+ *
+ * `listSnapshots` below collapses both into `[]`, which is fine for its callers (a budget
+ * sweep has nothing to do either way) and wrong for anything that REPORTS to a human: a
+ * diagnostic that says "no backup exists" when it actually could not read the directory
+ * ends the reader's search with a false fact. Same rule the doctor bash-hook check
+ * settled on — "nothing to check" and "I could not look" are different answers.
+ *
+ * @returns {{ok: true, snapshots: Array<{path:string,size:number,mtimeMs:number}>}
+ *          | {ok: false, reason: string}}
+ */
+export function readSnapshots(dbPath) {
+  let names;
+  let dir;
+  let prefix;
+  // dirname/basename inside the try, not outside it: `listSnapshots` below has always been
+  // total (it returned [] for any input), and one of this function's callers runs inside
+  // `doctor`'s DB catch block, where the repo's openDb precedent says nothing may throw.
+  // Computing the path outside would make listSnapshots(undefined) a TypeError.
   try {
-    const dir = dirname(dbPath);
-    const prefix = `${basename(dbPath)}.`;
-    const out = [];
-    for (const n of readdirSync(dir)) {
-      if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
-      const full = join(dir, n);
-      try {
-        const st = statSync(full);
-        out.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
-      } catch {
-        /* raced away */
-      }
+    dir = dirname(dbPath);
+    prefix = `${basename(dbPath)}.`;
+    names = readdirSync(dir);
+  } catch (e) {
+    return { ok: false, reason: e?.code || e?.message || 'unreadable' };
+  }
+  const snapshots = [];
+  for (const n of names) {
+    if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
+    const full = join(dir, n);
+    try {
+      const st = statSync(full);
+      snapshots.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
+    } catch {
+      /* raced away */
     }
-    return out;
-  } catch {
-    return [];
   }
+  return { ok: true, snapshots };
+}
+
+/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
+export function listSnapshots(dbPath) {
+  const r = readSnapshots(dbPath);
+  return r.ok ? r.snapshots : [];
 }
 
 /**

package/lib/plugin-key.mjs

@@ -24,8 +24,11 @@
 /** Marketplace this plugin is published under. */
 export const MARKETPLACE_KEY = 'sdsrss';
 
+/** This plugin's own name — the directory Claude Code materializes versions under. */
+export const PLUGIN_NAME = 'claude-mem-lite';
+
 /** The key Claude Code writes under `enabledPlugins` in `~/.claude/settings.json`. */
-export const PLUGIN_KEY = `claude-mem-lite@${MARKETPLACE_KEY}`;
+export const PLUGIN_KEY = `${PLUGIN_NAME}@${MARKETPLACE_KEY}`;
 
 /**
  * Whether the user has EXPLICITLY switched the plugin off.