claude-mem-lite 6.23.1 → 6.23.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.23.1",
+      "version": "6.23.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.23.1",
+  "version": "6.23.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -812,7 +812,8 @@ npx claude-mem-lite doctor            # Diagnose issues
 > around a dozen static imports before its first line runs — one missing file and it exits
 > with a Node stack instead of telling you which file. `cli.mjs` has no static local imports
 > and catches that, naming the file and a repair command. Everything else in the list is
-> unaffected either way.
+> unaffected either way, except `update`: through `cli.mjs` (and the `claude-mem-lite`
+> command) `update <id>` edits a memory, and the updater is `self-update`.
 
 Notes:
 - Plugin mode only reports available updates; it does not self-update plugin files.
@@ -822,7 +823,8 @@ Notes:
   /plugin install claude-mem-lite@sdsrss
   ```
   (The first command refreshes the local marketplace clone; the second reinstalls from it. Without the first command, `/plugin install` reuses the stale local clone and you stay on whichever version you originally pulled.)
-- Direct install / npx mode keeps auto-update enabled and uses staged replacement with rollback on install failure.
+- Direct install / npx mode checks GitHub Releases once a day (every 6 hours while GitHub is rate-limiting), from a session start, and shows a notice about a newer version at the next session start; the check does not install it. `npx claude-mem-lite self-update` (from a git clone, `node install.mjs update`) installs it, with staged replacement and rollback on install failure. Two things install without a command: when a hook finds a module or dependency missing, a session start runs `repair` (at most once per 6 hours), which installs the latest release if its signature verifies; and when the plugin is installed too, a session start copies a newer plugin version into the direct install (that copy is not signature-checked).
+- `CLAUDE_MEM_SKIP_UPDATE` turns off the check, the notice, and `self-update` / `install.mjs update` as well, so unset it before updating. It stops neither of the two installs above.
 - If you disabled the plugin but still have old mem hooks in `~/.claude/settings.json`, run `node install.mjs cleanup-hooks`.
 
 #### Trust model per install path
@@ -831,7 +833,7 @@ The three install paths do **not** carry the same supply-chain guarantees — pi
 
 | Path | Update mechanism | Ed25519 release-signature verification |
 |------|------------------|----------------------------------------|
-| npm / npx / git-clone direct install | auto-update from GitHub Releases | **Yes** — every runtime file (140 entries incl. hook scripts, MCP launcher, plugin declaration files) is hash-pinned in a signed manifest; verification is fail-closed |
+| npm / npx / git-clone direct install | daily check announces; `self-update` installs from GitHub Releases, and `repair` reinstalls the latest release when a hook finds a module or dependency missing. With the plugin also installed, a session start copies a newer plugin version in without a signature check | **Yes** — every runtime file (hook scripts, MCP launcher and plugin declaration files included) is hash-pinned in a signed manifest; verification is fail-closed |
 | `/plugin install` (marketplace) | manual `/plugin marketplace update` + reinstall | **No** — Claude Code installs from a git clone of the marketplace repo; the plugin's own signature chain is not consulted on this path. You are trusting GitHub + the repo's branch protection, not the release signing key |
 
 **Rollback recipe (plugin path).** If an update misbehaves, pin the marketplace clone to the previous release tag and reinstall from it:
@@ -866,7 +868,7 @@ Shows MCP registration, hook configuration, plugin disabled state, and database
 
 ### Recovery (stuck install / hook errors)
 
-If you see `ERR_MODULE_NOT_FOUND` on PreToolUse:Read/Edit hooks, or `claude-mem-lite` commands crash with import errors, you're likely hit by a partial auto-update — the updater copied new scripts but missed a sibling `lib/*` file, breaking the hook chain (and the next auto-update that would have healed it).
+If you see `ERR_MODULE_NOT_FOUND` on PreToolUse:Read/Edit hooks, or `claude-mem-lite` commands crash with import errors, you're likely hit by a partial update — an updater copied new scripts but missed a sibling `lib/*` file, breaking the hook chain.
 
 **v2.84.0+** ships a `repair` subcommand that re-syncs from the latest GitHub release:
 
@@ -1192,7 +1194,7 @@ what is already stored — only whether new work runs.
 | `CLAUDE_MEM_SKIP_OPTIMIZE` | Skip the LLM optimization pass (re-enrich, normalize, cluster-merge). | _(runs)_ |
 | `CLAUDE_MEM_SKIP_AUTO_DEDUP_FUZZY` | Skip the MinHash near-duplicate pass, keeping exact dedup. | _(runs)_ |
 | `CLAUDE_MEM_SKIP_MARKER_GC` | Skip the runtime-marker sweep. **Must be exactly `1`** — unlike the other `CLAUDE_MEM_SKIP_*` flags, which accept any truthy value, this one compares against the string `1`. That is deliberate: a truthy check makes `=0` mean "skip", which is the opposite of what anyone typing it intends. | _(runs)_ |
-| `CLAUDE_MEM_SKIP_UPDATE` | Skip the 24h auto-update check against GitHub Releases. | _(runs)_ |
+| `CLAUDE_MEM_SKIP_UPDATE` | Skip the 24h update check against GitHub Releases, its session-start notice, and `self-update` / `install.mjs update` (unset it to update). A `repair` triggered by a missing module or dependency still runs. | _(runs)_ |
 | `CLAUDE_MEM_SKIP_SIG_VERIFY` | Skip Ed25519 signature verification of a downloaded update. **Escape hatch — leaves updates unauthenticated.** | _(verifies)_ |
 | `CLAUDE_MEM_NO_LESSON_RETRY` | `1` disables the one-shot retry that re-asks for a missing `lesson_learned`. | _(retries)_ |
 | `CLAUDE_MEM_FLUSH_TIMEOUT` | Seconds the Stop hook waits for pending episode flushes. | `15` |

package/README.zh-CN.md

@@ -661,9 +661,11 @@ npx claude-mem-lite doctor            # 诊断问题
   已经坏掉时才会用到的命令，而 `install.mjs` 在执行第一行代码之前要解析十几个静态
   import——少一个文件就直接吐一段 Node 栈，而不是告诉你少了哪个文件。`cli.mjs` 没有
   任何本地静态 import，会捕获这种失败并说出缺失的文件和修复命令。列表中其余命令两种
-  写法都一样。
+  写法都一样，唯独 `update`：经 `cli.mjs`（以及 `claude-mem-lite` 命令）调用时，
+  `update <id>` 是编辑一条记忆，更新器要写 `self-update`。
 - 插件模式只提示可用更新，不会自更新插件文件。
-- direct install / npx 模式保留自动更新，并使用 staged replacement；若依赖安装失败会回滚。
+- direct install / npx 模式每天检查一次 GitHub Releases（GitHub 限流期间每 6 小时一次，都在会话开始时触发），发现新版本会在下一次会话开始时提示；检查本身不安装。运行 `npx claude-mem-lite self-update`（git clone 安装用 `node install.mjs update`）才安装，使用 staged replacement，若依赖安装失败会回滚。有两种情况不经命令就会安装：hook 发现缺少模块或依赖时，会在会话开始时运行 `repair`（每 6 小时最多一次），签名校验通过才安装最新发布；同时装了插件时，会话开始会把更新的插件版本拷进 direct install（这次拷贝不做签名校验）。
+- `CLAUDE_MEM_SKIP_UPDATE` 会同时关掉检查、提示以及 `self-update` / `install.mjs update`，更新前要先取消它；上面两种自动安装它都不阻止。
 - 如果你禁用了插件，但 `~/.claude/settings.json` 里还有旧的 mem hooks，可运行 `node install.mjs cleanup-hooks`。
 
 ### doctor
@@ -680,7 +682,7 @@ npx claude-mem-lite doctor            # 诊断问题
 
 ### 故障恢复（安装卡死 / hook 报错）
 
-如果你看到 PreToolUse:Read/Edit hook 报 `ERR_MODULE_NOT_FOUND`，或者 `claude-mem-lite` 命令本身因为 import 错误崩溃，多半是被部分自动更新坑了——更新器复制了新脚本但漏了配套的 `lib/*` 文件，hook 链就此断掉（连下一次本可自愈的自动更新也跑不了）。
+如果你看到 PreToolUse:Read/Edit hook 报 `ERR_MODULE_NOT_FOUND`，或者 `claude-mem-lite` 命令本身因为 import 错误崩溃，多半是被一次不完整的更新坑了——更新器复制了新脚本但漏了配套的 `lib/*` 文件，hook 链就此断掉。
 
 **v2.84.0+** 提供 `repair` 子命令，从 GitHub 最新 release 重新同步：
 

package/lib/proxy-fetch.mjs

@@ -43,18 +43,54 @@ export function httpConnectProxyFor(targetUrl) {
     // caller's try/catch, and takes the process (MCP server included) down.
     // Native fetch handles http directly, so the caller keeps that path.
     if (target.protocol !== 'https:') return null;
-    const host = target.hostname;
-    const noProxy = (process.env.NO_PROXY || process.env.no_proxy || '')
-      .split(',')
-      .map((s) => s.trim())
-      .filter(Boolean);
-    if (noProxy.some((n) => n === host || (n.startsWith('.') && host.endsWith(n.slice(1))))) return null;
+    const noProxy = process.env.NO_PROXY || process.env.no_proxy || '';
+    if (noProxyMatches(target.hostname, Number(target.port) || 443, noProxy)) return null;
     return proxy;
   } catch {
     return null;
   }
 }
 
+/**
+ * Does a NO_PROXY list exempt this host? NO_PROXY has no standard (survey:
+ * about.gitlab.com/blog/we-need-to-talk-no-proxy). Every common client suffix-matches a
+ * name; beyond that they disagree, so for names and ports this accepts the UNION of the
+ * forms curl, Python and Go accept, and it can exempt a host one of them would still
+ * proxy. Case-insensitive; a '*' entry exempts every host (Go); a name entry covers itself
+ * and every subdomain on a '.' boundary, with or without a leading '.' (curl, Python) or
+ * '*.' (Go); an optional :port narrows the entry to that port (Python, Go); IPv6 with or
+ * without brackets. Narrower than the union: an IP entry matches only the canonical
+ * spelling URL.hostname uses, never as a suffix (Python suffix-matches IPs), no CIDR
+ * (curl, Go), no IDN-to-xn-- conversion (Go), no DNS lookups. NO_PROXY is read before
+ * no_proxy; curl, Python and Go (golang.org/x/net/http/httpproxy) read no_proxy first.
+ * @param {string} hostname URL.hostname (lowercase; IPv6 bracketed)
+ * @param {number} port effective target port
+ * @param {string} list raw NO_PROXY value
+ * @returns {boolean}
+ */
+function noProxyMatches(hostname, port, list) {
+  const host = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+  for (const raw of list.split(',')) {
+    let entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === '*') return true;
+    let entryPort = null;
+    const bracketed = /^\[([^\]]+)\](?::(\d+))?$/.exec(entry);
+    if (bracketed) {
+      entry = bracketed[1];
+      entryPort = bracketed[2] ?? null;
+    } else if (entry.split(':').length === 2) {
+      [entry, entryPort] = entry.split(':');
+    }
+    if (entryPort !== null && Number(entryPort) !== port) continue;
+    entry = entry.replace(/^\*?\./, '').replace(/\.$/, '');
+    if (!entry) continue;
+    if (host === entry) return true;
+    if (!net.isIP(host) && host.endsWith(`.${entry}`)) return true;
+  }
+  return false;
+}
+
 /**
  * Proxy-Authorization header for a proxy URL that carries credentials, or {} when it does
  * not. R10 P2-14.
@@ -245,6 +281,14 @@ export function onceViaConnectProxy(
         { method, headers, createConnection: () => tls.connect({ socket, host: tlsHost, ...sni }) },
         (resp) => {
           const chunks = [];
+          // A connection dropped mid-body destroys the response without 'end' (and
+          // emits 'error' only to a listener), but 'close' always fires. Without this
+          // the call stayed pending until the unref'd overall timer, so an otherwise
+          // idle worker exited with it unsettled and its caller's fallback never ran.
+          // Native fetch rejects here too.
+          resp.on('close', () => {
+            if (!resp.complete) finish(reject, new Error('proxy response closed before the body ended'));
+          });
           resp.on('data', (c) => chunks.push(Buffer.from(c)));
           resp.on('end', () => {
             const buf = Buffer.concat(chunks);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.23.1",
+  "version": "6.23.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.23.1",
+      "version": "6.23.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.23.1",
+  "version": "6.23.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",