claude-mem-lite 6.23.1 → 6.23.3

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.23.1",
+      "version": "6.23.3",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.23.1",
+  "version": "6.23.3",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -189,7 +189,7 @@ cd claude-mem-lite
 node install.mjs install
 ```
 
-Source files stay in the cloned repo. Update via `git pull && node install.mjs install`.
+`install` copies the source files to `~/.claude-mem-lite/`, as the npx method does. Update with `node install.mjs update`, which installs the latest signed release. `git pull && node install.mjs install` installs the checked-out branch instead: it can be ahead of the latest release, and no signature is checked.
 
 ### What happens during installation
 
@@ -812,7 +812,8 @@ npx claude-mem-lite doctor            # Diagnose issues
 > around a dozen static imports before its first line runs — one missing file and it exits
 > with a Node stack instead of telling you which file. `cli.mjs` has no static local imports
 > and catches that, naming the file and a repair command. Everything else in the list is
-> unaffected either way.
+> unaffected either way, except `update`: through `cli.mjs` (and the `claude-mem-lite`
+> command) `update <id>` edits a memory, and the updater is `self-update`.
 
 Notes:
 - Plugin mode only reports available updates; it does not self-update plugin files.
@@ -822,7 +823,8 @@ Notes:
   /plugin install claude-mem-lite@sdsrss
   ```
   (The first command refreshes the local marketplace clone; the second reinstalls from it. Without the first command, `/plugin install` reuses the stale local clone and you stay on whichever version you originally pulled.)
-- Direct install / npx mode keeps auto-update enabled and uses staged replacement with rollback on install failure.
+- Direct install / npx mode checks GitHub Releases once a day (every 6 hours while GitHub is rate-limiting), from a session start, and shows a notice about a newer version at the next session start; the check does not install it. `npx claude-mem-lite self-update` (from a git clone, `node install.mjs update`) installs it, with staged replacement and rollback on install failure. Two things install without a command: when a hook finds a module or dependency missing, a session start runs `repair` (at most once per 6 hours), which installs the latest release if its signature verifies; and when the plugin is installed too, a session start copies a newer plugin version into the direct install (that copy is not signature-checked).
+- `CLAUDE_MEM_SKIP_UPDATE` turns off the check, the notice, and `self-update` / `install.mjs update` as well, so unset it before updating. It stops neither of the two installs above.
 - If you disabled the plugin but still have old mem hooks in `~/.claude/settings.json`, run `node install.mjs cleanup-hooks`.
 
 #### Trust model per install path
@@ -831,7 +833,7 @@ The three install paths do **not** carry the same supply-chain guarantees — pi
 
 | Path | Update mechanism | Ed25519 release-signature verification |
 |------|------------------|----------------------------------------|
-| npm / npx / git-clone direct install | auto-update from GitHub Releases | **Yes** — every runtime file (140 entries incl. hook scripts, MCP launcher, plugin declaration files) is hash-pinned in a signed manifest; verification is fail-closed |
+| npm / npx / git-clone direct install | daily check announces; `self-update` installs from GitHub Releases, and `repair` reinstalls the latest release when a hook finds a module or dependency missing. With the plugin also installed, a session start copies a newer plugin version in without a signature check | **Yes** — every runtime file (hook scripts, MCP launcher and plugin declaration files included) is hash-pinned in a signed manifest; verification is fail-closed |
 | `/plugin install` (marketplace) | manual `/plugin marketplace update` + reinstall | **No** — Claude Code installs from a git clone of the marketplace repo; the plugin's own signature chain is not consulted on this path. You are trusting GitHub + the repo's branch protection, not the release signing key |
 
 **Rollback recipe (plugin path).** If an update misbehaves, pin the marketplace clone to the previous release tag and reinstall from it:
@@ -866,7 +868,7 @@ Shows MCP registration, hook configuration, plugin disabled state, and database
 
 ### Recovery (stuck install / hook errors)
 
-If you see `ERR_MODULE_NOT_FOUND` on PreToolUse:Read/Edit hooks, or `claude-mem-lite` commands crash with import errors, you're likely hit by a partial auto-update — the updater copied new scripts but missed a sibling `lib/*` file, breaking the hook chain (and the next auto-update that would have healed it).
+If you see `ERR_MODULE_NOT_FOUND` on PreToolUse:Read/Edit hooks, or `claude-mem-lite` commands crash with import errors, you're likely hit by a partial update — an updater copied new scripts but missed a sibling `lib/*` file, breaking the hook chain.
 
 **v2.84.0+** ships a `repair` subcommand that re-syncs from the latest GitHub release:
 
@@ -1089,7 +1091,7 @@ claude-mem-lite.
 | `CLAUDE_MEM_DIR` | Custom data directory. All databases, runtime files, and managed resources are stored here. | `~/.claude-mem-lite/` |
 | `CLAUDE_MEM_MODEL` | LLM model for background calls (episode extraction, session summaries). Accepts `haiku` or `sonnet`. | `haiku` |
 | `ANTHROPIC_API_KEY` | Anthropic API key. When set, all background LLM calls go directly to the Anthropic Messages API (with prompt caching) - or to the `ANTHROPIC_BASE_URL` gateway when that is set. Highest priority. | _(unset → CLI)_ |
-| `ANTHROPIC_BASE_URL` | Base URL for the direct Messages API when an Anthropic-compatible gateway serves the models (Azure AI Foundry, LiteLLM, Bedrock/Vertex proxies). No `/v1` suffix — the endpoint path is appended. The `claude -p` fallback reads the same variable, so one value covers both transports. Plain `http://` is accepted only for a loopback host; anything else would send the API key unencrypted. A value that is set but unusable skips the direct API leg, so background calls fall back to the `claude -p` CLI, and doctor warns. | `https://api.anthropic.com` |
+| `ANTHROPIC_BASE_URL` | Base URL for the direct Messages API when an Anthropic-compatible gateway serves the models (Azure AI Foundry, LiteLLM, Bedrock/Vertex proxies). No `/v1` suffix — the endpoint path is appended. The `claude -p` fallback reads the same variable, so one value covers both transports. Plain `http://` is accepted only for a loopback host; anything else would send the API key unencrypted. That request always goes straight to the loopback host, even when `NODE_USE_ENV_PROXY=1` sends other requests through `HTTP_PROXY`. A value that is set but unusable skips the direct API leg, so background calls fall back to the `claude -p` CLI, and doctor warns. | `https://api.anthropic.com` |
 | `ANTHROPIC_DEFAULT_HAIKU_MODEL` | Model ID or gateway deployment name for the `haiku` tier, honored on the direct API **only when `ANTHROPIC_BASE_URL` is set**. Without a base URL it stays CLI-only, so the Bedrock/Vertex form of this alias is never sent to `api.anthropic.com`. Use it when the gateway routes on deployment names rather than Anthropic model IDs (Azure Foundry deployments). The `claude -p` fallback resolves its `--model haiku` alias through it too. | built-in `claude-haiku-4-5-…` |
 | `ANTHROPIC_DEFAULT_SONNET_MODEL` | Same as above for the `sonnet` tier. | built-in `claude-sonnet-4-5-…` |
 | `OPENROUTER_API_KEY` | OpenRouter API key (OpenAI-compatible). Used for background LLM calls when `ANTHROPIC_API_KEY` is **not** set. If neither key is set, calls fall back to the `claude -p` CLI. | _(unset)_ |
@@ -1192,7 +1194,7 @@ what is already stored — only whether new work runs.
 | `CLAUDE_MEM_SKIP_OPTIMIZE` | Skip the LLM optimization pass (re-enrich, normalize, cluster-merge). | _(runs)_ |
 | `CLAUDE_MEM_SKIP_AUTO_DEDUP_FUZZY` | Skip the MinHash near-duplicate pass, keeping exact dedup. | _(runs)_ |
 | `CLAUDE_MEM_SKIP_MARKER_GC` | Skip the runtime-marker sweep. **Must be exactly `1`** — unlike the other `CLAUDE_MEM_SKIP_*` flags, which accept any truthy value, this one compares against the string `1`. That is deliberate: a truthy check makes `=0` mean "skip", which is the opposite of what anyone typing it intends. | _(runs)_ |
-| `CLAUDE_MEM_SKIP_UPDATE` | Skip the 24h auto-update check against GitHub Releases. | _(runs)_ |
+| `CLAUDE_MEM_SKIP_UPDATE` | Skip the 24h update check against GitHub Releases, its session-start notice, and `self-update` / `install.mjs update` (unset it to update). A `repair` triggered by a missing module or dependency still runs. | _(runs)_ |
 | `CLAUDE_MEM_SKIP_SIG_VERIFY` | Skip Ed25519 signature verification of a downloaded update. **Escape hatch — leaves updates unauthenticated.** | _(verifies)_ |
 | `CLAUDE_MEM_NO_LESSON_RETRY` | `1` disables the one-shot retry that re-asks for a missing `lesson_learned`. | _(retries)_ |
 | `CLAUDE_MEM_FLUSH_TIMEOUT` | Seconds the Stop hook waits for pending episode flushes. | `15` |

package/README.zh-CN.md

@@ -147,7 +147,7 @@ cd claude-mem-lite
 node install.mjs install
 ```
 
-源文件保留在克隆的仓库中。通过 `git pull && node install.mjs install` 更新。
+`install` 会把源文件复制到 `~/.claude-mem-lite/`，与 npx 方式相同。用 `node install.mjs update` 更新，它安装最新的已签名发布。`git pull && node install.mjs install` 安装的则是当前检出的分支：可能领先于最新发布，也不校验签名。
 
 ### 安装过程
 
@@ -661,9 +661,11 @@ npx claude-mem-lite doctor            # 诊断问题
   已经坏掉时才会用到的命令，而 `install.mjs` 在执行第一行代码之前要解析十几个静态
   import——少一个文件就直接吐一段 Node 栈，而不是告诉你少了哪个文件。`cli.mjs` 没有
   任何本地静态 import，会捕获这种失败并说出缺失的文件和修复命令。列表中其余命令两种
-  写法都一样。
+  写法都一样，唯独 `update`：经 `cli.mjs`（以及 `claude-mem-lite` 命令）调用时，
+  `update <id>` 是编辑一条记忆，更新器要写 `self-update`。
 - 插件模式只提示可用更新，不会自更新插件文件。
-- direct install / npx 模式保留自动更新，并使用 staged replacement；若依赖安装失败会回滚。
+- direct install / npx 模式每天检查一次 GitHub Releases（GitHub 限流期间每 6 小时一次，都在会话开始时触发），发现新版本会在下一次会话开始时提示；检查本身不安装。运行 `npx claude-mem-lite self-update`（git clone 安装用 `node install.mjs update`）才安装，使用 staged replacement，若依赖安装失败会回滚。有两种情况不经命令就会安装：hook 发现缺少模块或依赖时，会在会话开始时运行 `repair`（每 6 小时最多一次），签名校验通过才安装最新发布；同时装了插件时，会话开始会把更新的插件版本拷进 direct install（这次拷贝不做签名校验）。
+- `CLAUDE_MEM_SKIP_UPDATE` 会同时关掉检查、提示以及 `self-update` / `install.mjs update`，更新前要先取消它；上面两种自动安装它都不阻止。
 - 如果你禁用了插件，但 `~/.claude/settings.json` 里还有旧的 mem hooks，可运行 `node install.mjs cleanup-hooks`。
 
 ### doctor
@@ -680,7 +682,7 @@ npx claude-mem-lite doctor            # 诊断问题
 
 ### 故障恢复（安装卡死 / hook 报错）
 
-如果你看到 PreToolUse:Read/Edit hook 报 `ERR_MODULE_NOT_FOUND`，或者 `claude-mem-lite` 命令本身因为 import 错误崩溃，多半是被部分自动更新坑了——更新器复制了新脚本但漏了配套的 `lib/*` 文件，hook 链就此断掉（连下一次本可自愈的自动更新也跑不了）。
+如果你看到 PreToolUse:Read/Edit hook 报 `ERR_MODULE_NOT_FOUND`，或者 `claude-mem-lite` 命令本身因为 import 错误崩溃，多半是被一次不完整的更新坑了——更新器复制了新脚本但漏了配套的 `lib/*` 文件，hook 链就此断掉。
 
 **v2.84.0+** 提供 `repair` 子命令，从 GitHub 最新 release 重新同步：
 
@@ -831,7 +833,7 @@ npm run benchmark:gate    # CI 门控：指标回退超过 5% 容差时失败
 | `CLAUDE_MEM_DIR` | 自定义数据目录。所有数据库与运行时文件均存储在此。 | `~/.claude-mem-lite/` |
 | `CLAUDE_MEM_MODEL` | 后台 LLM 调用模型（Episode 提取、会话总结、调度）。可选 `haiku` 或 `sonnet`。 | `haiku` |
 | `ANTHROPIC_API_KEY` | Anthropic API key。设置后所有后台 LLM 调用直连 Anthropic Messages API（带 prompt caching）；设了 `ANTHROPIC_BASE_URL` 时改发往那个网关。优先级最高。 | _(未设 → CLI)_ |
-| `ANTHROPIC_BASE_URL` | 由兼容 Anthropic 的网关（Azure AI Foundry、LiteLLM、Bedrock/Vertex 代理）提供模型时，直连 Messages API 使用的基础 URL。不要带 `/v1` 后缀，端点路径会自动拼上。`claude -p` 兜底读取同一个变量，所以一个值同时作用于两条路径。明文 `http://` 只接受回环主机，否则 API key 会以明文发送。设了但不可用的值会跳过直连这一路，后台调用改走 `claude -p`，doctor 会提示。 | `https://api.anthropic.com` |
+| `ANTHROPIC_BASE_URL` | 由兼容 Anthropic 的网关（Azure AI Foundry、LiteLLM、Bedrock/Vertex 代理）提供模型时，直连 Messages API 使用的基础 URL。不要带 `/v1` 后缀，端点路径会自动拼上。`claude -p` 兜底读取同一个变量，所以一个值同时作用于两条路径。明文 `http://` 只接受回环主机，否则 API key 会以明文发送。这个请求总是直连回环主机，即使 `NODE_USE_ENV_PROXY=1` 让其他请求走 `HTTP_PROXY`。设了但不可用的值会跳过直连这一路，后台调用改走 `claude -p`，doctor 会提示。 | `https://api.anthropic.com` |
 | `ANTHROPIC_DEFAULT_HAIKU_MODEL` | `haiku` 档的模型 ID 或网关部署名，**仅在设了 `ANTHROPIC_BASE_URL` 时**用于直连 API。没有基础 URL 时只给 CLI 用，所以这个别名的 Bedrock/Vertex 写法不会被发往 `api.anthropic.com`。网关按部署名而不是 Anthropic 模型 ID 路由时（Azure Foundry 部署）使用。`claude -p` 兜底的 `--model haiku` 别名也经由它解析。 | 内置 `claude-haiku-4-5-…` |
 | `ANTHROPIC_DEFAULT_SONNET_MODEL` | 同上，用于 `sonnet` 档。 | 内置 `claude-sonnet-4-5-…` |
 | `OPENROUTER_API_KEY` | OpenRouter API key（OpenAI 兼容）。当**未设** `ANTHROPIC_API_KEY` 时用于后台 LLM 调用；两者都未设则回退到 `claude -p` CLI。 | _(未设)_ |

package/haiku-client.mjs

@@ -20,7 +20,7 @@ import { randomUUID } from 'crypto';
 import { debugLog, debugCatch, parseJsonFromLLM } from './utils.mjs';
 import { DB_DIR } from './schema.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
-import { httpConnectProxyFor, postViaConnectProxy } from './lib/proxy-fetch.mjs';
+import { httpConnectProxyFor, postViaConnectProxy, postDirectHttp } from './lib/proxy-fetch.mjs';
 import { resolveAnthropicBaseUrl } from './lib/anthropic-base-url.mjs';
 
 /**
@@ -553,8 +553,20 @@ async function callModelAPI(prompt, model, { timeout, maxTokens, temperature = D
       'x-api-key': apiKey,
       'anthropic-version': '2023-06-01',
     };
+    // Plain http is loopback-only (resolveAnthropicBaseUrl), and loopback must stay on this
+    // machine: native fetch would hand it, x-api-key in cleartext, to HTTP_PROXY under
+    // NODE_USE_ENV_PROXY=1. (D#250) Parsed, not a prefix test: the resolver accepts the scheme
+    // in any case (`HTTP://127.0.0.1`) and returns the raw text.
+    const plainHttp = new URL(apiUrl).protocol === 'http:';
     const send = (payload) => {
       const json = JSON.stringify(payload);
+      if (plainHttp) {
+        return postDirectHttp(apiUrl, {
+          headers: apiHeaders,
+          body: json,
+          timeout: Math.max(1, deadline - Date.now()),
+        });
+      }
       const apiProxy = httpConnectProxyFor(apiUrl);
       return apiProxy
         ? postViaConnectProxy(apiProxy, apiUrl, {

package/hook-update.mjs

@@ -1,6 +1,7 @@
-// claude-mem-lite: Auto-update via GitHub Releases
-// Checks for new versions on SessionStart, downloads and installs automatically.
-// Skips in dev mode (symlinked installs). Silent on network failure.
+// claude-mem-lite: update check and installer via GitHub Releases
+// The SessionStart check (hook.mjs, allowInstall:false) only records and announces a newer
+// release; `self-update` and `repair` install one, signature-verified. Skips a dev install
+// (a git checkout or symlinks) and under CLAUDE_MEM_SKIP_UPDATE. Silent on network failure.
 
 import { isOurMcpRegistration } from './lib/mcp-ownership.mjs';
 import { execSync, execFileSync } from 'node:child_process';
@@ -67,12 +68,17 @@ const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 
 // ── Main Entry ─────────────────────────────────────────────
 export async function checkForUpdate(options = {}) {
+  // A failed lookup returns null by default, which a background caller wants (silent on
+  // network failure). `self-update` printed that null as "Already up to date", so a caller
+  // that reports to a person asks for the failure instead. (D#251)
+  const failed = (rateLimited) =>
+    options.reportFailure ? { updateAvailable: false, updated: false, checkFailed: true, rateLimited } : null;
   try {
     const pluginMode = isPluginMode();
     const force = Boolean(options.force);
     const allowInstall = options.allowInstall ?? !pluginMode;
 
-    if (isDevMode() || process.env.CLAUDE_MEM_SKIP_UPDATE) return null;
+    if (updateCheckDisabledReason()) return null;
 
     const state = readState();
     if (!force && !shouldCheck(state)) {
@@ -99,7 +105,7 @@ export async function checkForUpdate(options = {}) {
       // rate-limit mechanism is dead. Re-reading preserves the freshly-written flag.
       const fresh = readState();
       saveState({ ...fresh, lastCheck: new Date().toISOString() });
-      return null;
+      return failed(lastLookupRateLimited);
     }
 
     const currentVersion = getCurrentVersion();
@@ -147,7 +153,7 @@ export async function checkForUpdate(options = {}) {
       const s = readState();
       saveState({ ...s, lastCheck: new Date().toISOString(), lastError: err.message });
     } catch {}
-    return null;
+    return failed(false);
   }
 }
 
@@ -160,7 +166,7 @@ export async function checkForUpdate(options = {}) {
 // Banner string from cached update-state (≤24h stale), or null. No network I/O.
 export function getCachedUpdateBanner() {
   try {
-    if (isDevMode() || process.env.CLAUDE_MEM_SKIP_UPDATE) return null;
+    if (updateCheckDisabledReason()) return null;
     const state = readState();
     const running = pendingCachedUpdate(state);
     if (running) {
@@ -193,7 +199,7 @@ export function pendingCachedUpdate(state) {
 // Caller spawns the refresh in the background so this session doesn't wait.
 export function isUpdateCheckDue() {
   try {
-    if (isDevMode() || process.env.CLAUDE_MEM_SKIP_UPDATE) return false;
+    if (updateCheckDisabledReason()) return false;
     return shouldCheck(readState());
   } catch {
     return false;
@@ -203,7 +209,7 @@ export function isUpdateCheckDue() {
 // D#187. `CLAUDE_PLUGIN_ROOT` is set in every hook and MCP process Claude Code
 // spawns, so inside those the env var answers "am I a plugin install?" perfectly —
 // which is why v3.84.1's fix, which reads it, was enough THERE. It is not set in a
-// plain terminal, and a plugin-only user typing `claude-mem-lite update` therefore
+// plain terminal, and a plugin-only user typing `claude-mem-lite self-update` therefore
 // fell off both plugin paths at once: getCurrentVersion() returned '0.0.0' (so every
 // release compares as newer, forever), and isPluginMode() was false, so allowInstall
 // defaulted to true and downloadAndInstall laid a full managed tree into
@@ -252,6 +258,19 @@ function isPluginMode() {
 // never a command that would overwrite its working tree. Re-implementing the check at the
 // call site would make it the second copy of a predicate this file has already had to get
 // right twice (whole-dir symlink, then per-file drift) — the twin-drift class.
+/**
+ * Why the update check will not look at all, or null when it will. checkForUpdate returns
+ * null both for "nothing newer" and for "never looked", so a caller that reports to a
+ * person asks this first: `self-update` used to print "Already up to date" under
+ * CLAUDE_MEM_SKIP_UPDATE without a single request (D#251).
+ * @returns {'dev-install'|'CLAUDE_MEM_SKIP_UPDATE'|null}
+ */
+export function updateCheckDisabledReason() {
+  if (isDevMode()) return 'dev-install';
+  if (process.env.CLAUDE_MEM_SKIP_UPDATE) return 'CLAUDE_MEM_SKIP_UPDATE';
+  return null;
+}
+
 export function isDevMode() {
   try {
     // A dev checkout always carries a .git dir. This catches a whole-directory
@@ -285,7 +304,13 @@ function shouldCheck(state) {
 
 // ── GitHub API ─────────────────────────────────────────────
 // Try releases/latest first, fallback to tags (some repos only use tags)
+// Whether the most recent fetchLatestRelease call was refused with 403/429. The persisted
+// `rateLimited` flag is not that: only a successful lookup clears it, so reading it after a
+// network failure blamed a rate limit from an earlier call. (pre-tag review of cd9f1ab7)
+let lastLookupRateLimited = false;
+
 export async function fetchLatestRelease() {
+  lastLookupRateLimited = false;
   const headers = {
     Accept: 'application/vnd.github+json',
     'User-Agent': 'claude-mem-lite-updater/1.0',
@@ -347,6 +372,7 @@ async function fetchWithTimeout(url, headers) {
       const state = readState();
       saveState({ ...state, rateLimited: true });
       debugLog('DEBUG', 'hook-update', 'GitHub API rate limited; will retry on the 6h rate-limit cadence');
+      lastLookupRateLimited = true;
       return 'rate-limited';
     }
     if (!res.ok) return null;
@@ -412,7 +438,7 @@ export function getCurrentVersion() {
   }
   // D#187: no env var in a plain terminal, so ask the filesystem which plugin
   // version this machine actually runs. Without this a plugin-only user's
-  // `claude-mem-lite update` reads 0.0.0 and every release compares as newer.
+  // `claude-mem-lite self-update` reads 0.0.0 and every release compares as newer.
   const active = installShape()?.activePluginVersion;
   if (active) {
     try {

package/install.mjs

@@ -3213,14 +3213,36 @@ function cleanup() {
 // ─── Manual Update ───────────────────────────────────────────────────────────
 
 async function manualUpdate() {
-  console.log('\nclaude-mem-lite update\n');
+  // `self-update`, not `update`: through cli.mjs `update <id>` is the memory editor.
+  console.log('\nclaude-mem-lite self-update\n');
 
   // Force check by importing hook-update (bypasses throttle for manual use)
-  const { checkForUpdate, getCurrentVersion } = await import('./hook-update.mjs');
+  const { checkForUpdate, getCurrentVersion, updateCheckDisabledReason } = await import('./hook-update.mjs');
+  // checkForUpdate returns null without looking in these two cases, and the branch at the
+  // bottom would then report "Already up to date" for a check that never ran. (D#251)
+  const disabled = updateCheckDisabledReason();
+  if (disabled === 'CLAUDE_MEM_SKIP_UPDATE') {
+    warn('Not checked: CLAUDE_MEM_SKIP_UPDATE is set, which turns off update checks and installs.');
+    log('  Unset it and run this command again to update.');
+    console.log('');
+    return;
+  }
+  if (disabled === 'dev-install') {
+    warn(`Not checked: ${INSTALL_DIR} is a development install (a git checkout or symlinks).`);
+    log('  Update the checkout it points to with git instead.');
+    console.log('');
+    return;
+  }
   log('Checking for updates...');
-  const result = await checkForUpdate({ force: true, allowInstall: true });
+  const result = await checkForUpdate({ force: true, allowInstall: true, reportFailure: true });
 
-  if (result?.updated) {
+  if (result?.checkFailed) {
+    warn(
+      result.rateLimited
+        ? 'Not checked: GitHub is rate-limiting requests from this address. Try again later.'
+        : 'Not checked: could not reach GitHub Releases (network, proxy or DNS). Nothing was installed.',
+    );
+  } else if (result?.updated) {
     ok(`Updated: v${result.from} → v${result.to}`);
   } else if (result?.updateAvailable && result?.installDeferred) {
     warn(`v${result.to} available — plugin mode only checks for updates.`);

package/lib/proxy-fetch.mjs

@@ -1,7 +1,8 @@
 // lib/proxy-fetch.mjs — HTTPS over an HTTP CONNECT tunnel, using node: built-ins only.
 //
-// Node's global fetch (undici) does NOT honour HTTP(S)_PROXY, and undici's
-// ProxyAgent is not importable without adding a dependency (this package ships
+// Node's global fetch (undici) does NOT honour HTTP(S)_PROXY unless the user opts in with
+// NODE_USE_ENV_PROXY=1 (which then proxies plain http:// too; see postDirectHttp), and
+// undici's ProxyAgent is not importable without adding a dependency (this package ships
 // three: @modelcontextprotocol/sdk, better-sqlite3, zod — a proxy shim is not
 // worth a fourth). In an environment where external hosts are only reachable
 // through a local proxy, a direct fetch hangs or dies instantly, so every
@@ -43,18 +44,54 @@ export function httpConnectProxyFor(targetUrl) {
     // caller's try/catch, and takes the process (MCP server included) down.
     // Native fetch handles http directly, so the caller keeps that path.
     if (target.protocol !== 'https:') return null;
-    const host = target.hostname;
-    const noProxy = (process.env.NO_PROXY || process.env.no_proxy || '')
-      .split(',')
-      .map((s) => s.trim())
-      .filter(Boolean);
-    if (noProxy.some((n) => n === host || (n.startsWith('.') && host.endsWith(n.slice(1))))) return null;
+    const noProxy = process.env.NO_PROXY || process.env.no_proxy || '';
+    if (noProxyMatches(target.hostname, Number(target.port) || 443, noProxy)) return null;
     return proxy;
   } catch {
     return null;
   }
 }
 
+/**
+ * Does a NO_PROXY list exempt this host? NO_PROXY has no standard (survey:
+ * about.gitlab.com/blog/we-need-to-talk-no-proxy). Every common client suffix-matches a
+ * name; beyond that they disagree, so for names and ports this accepts the UNION of the
+ * forms curl, Python and Go accept, and it can exempt a host one of them would still
+ * proxy. Case-insensitive; a '*' entry exempts every host (Go); a name entry covers itself
+ * and every subdomain on a '.' boundary, with or without a leading '.' (curl, Python) or
+ * '*.' (Go); an optional :port narrows the entry to that port (Python, Go); IPv6 with or
+ * without brackets. Narrower than the union: an IP entry matches only the canonical
+ * spelling URL.hostname uses, never as a suffix (Python suffix-matches IPs), no CIDR
+ * (curl, Go), no IDN-to-xn-- conversion (Go), no DNS lookups. NO_PROXY is read before
+ * no_proxy; curl, Python and Go (golang.org/x/net/http/httpproxy) read no_proxy first.
+ * @param {string} hostname URL.hostname (lowercase; IPv6 bracketed)
+ * @param {number} port effective target port
+ * @param {string} list raw NO_PROXY value
+ * @returns {boolean}
+ */
+function noProxyMatches(hostname, port, list) {
+  const host = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+  for (const raw of list.split(',')) {
+    let entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === '*') return true;
+    let entryPort = null;
+    const bracketed = /^\[([^\]]+)\](?::(\d+))?$/.exec(entry);
+    if (bracketed) {
+      entry = bracketed[1];
+      entryPort = bracketed[2] ?? null;
+    } else if (entry.split(':').length === 2) {
+      [entry, entryPort] = entry.split(':');
+    }
+    if (entryPort !== null && Number(entryPort) !== port) continue;
+    entry = entry.replace(/^\*?\./, '').replace(/\.$/, '');
+    if (!entry) continue;
+    if (host === entry) return true;
+    if (!net.isIP(host) && host.endsWith(`.${entry}`)) return true;
+  }
+  return false;
+}
+
 /**
  * Proxy-Authorization header for a proxy URL that carries credentials, or {} when it does
  * not. R10 P2-14.
@@ -240,23 +277,30 @@ export function onceViaConnectProxy(
       // the certificate identity check, brackets stripped for IPv6.
       const tlsHost = t.hostname.replace(/^\[|\]$/g, '');
       const sni = net.isIP(tlsHost) ? {} : { servername: tlsHost };
+      // defaultPort: with createConnection and no agent, https.request takes its default
+      // port as 80, so a URL without a port went out as `Host: api.github.com:80`. GitHub
+      // answers that with 400 (API) or a 301 to the same URL (release downloads), which
+      // broke the update check and the release download behind every proxy, silently.
       const req = https.request(
         url,
-        { method, headers, createConnection: () => tls.connect({ socket, host: tlsHost, ...sni }) },
+        {
+          method,
+          headers,
+          defaultPort: 443,
+          createConnection: () => tls.connect({ socket, host: tlsHost, ...sni }),
+        },
         (resp) => {
           const chunks = [];
-          resp.on('data', (c) => chunks.push(Buffer.from(c)));
-          resp.on('end', () => {
-            const buf = Buffer.concat(chunks);
-            finish(resolve, {
-              ok: resp.statusCode >= 200 && resp.statusCode < 300,
-              status: resp.statusCode,
-              headers: resp.headers,
-              buffer: () => buf,
-              text: () => buf.toString('utf8'),
-              json: () => JSON.parse(buf.toString('utf8')),
-            });
+          // A connection dropped mid-body destroys the response without 'end' (and
+          // emits 'error' only to a listener), but 'close' always fires. Without this
+          // the call stayed pending until the unref'd overall timer, so an otherwise
+          // idle worker exited with it unsettled and its caller's fallback never ran.
+          // Native fetch rejects here too.
+          resp.on('close', () => {
+            if (!resp.complete) finish(reject, new Error('proxy response closed before the body ended'));
           });
+          resp.on('data', (c) => chunks.push(Buffer.from(c)));
+          resp.on('end', () => finish(resolve, fetchLikeResponse(resp, Buffer.concat(chunks))));
         },
       );
       req.setTimeout(remaining(), () => req.destroy(new Error('proxy request timeout')));
@@ -267,6 +311,80 @@ export function onceViaConnectProxy(
   });
 }
 
+/** The fetch-compatible subset both node:http transports below resolve with. */
+function fetchLikeResponse(resp, buf) {
+  return {
+    ok: resp.statusCode >= 200 && resp.statusCode < 300,
+    status: resp.statusCode,
+    headers: resp.headers,
+    buffer: () => buf,
+    text: () => buf.toString('utf8'),
+    json: () => JSON.parse(buf.toString('utf8')),
+  };
+}
+
+/**
+ * ONE plain-http POST that never goes through a proxy. Same contract as
+ * onceViaConnectProxy: resolves the fetch-compatible subset without following a
+ * redirect, and REJECTS on a socket error, on `timeout` (the whole call), or on a body
+ * cut off mid-stream.
+ *
+ * Native fetch cannot promise "direct". With NODE_USE_ENV_PROXY=1 it hands an http:// URL
+ * to HTTP_PROXY unless Node's own NO_PROXY matcher exempts the host, headers in cleartext.
+ * Measured 2026-10-07 against a fake proxy: Node 26.8.1 sent it as a plain request, Node
+ * 22.23.3 wrote it into a CONNECT tunnel the proxy can read, and on both an explicit
+ * `agent: false` (a fresh Agent without `proxyEnv`) went straight to the target. The only
+ * caller is a loopback gateway (resolveAnthropicBaseUrl refuses plain http to any other
+ * host), and the proxy's loopback is not this machine's. (D#250)
+ *
+ * @param {string} url absolute http:// target
+ * @param {{headers?:object, body?:string, timeout?:number}} [opts]
+ */
+export function postDirectHttp(url, { headers = {}, body = '', timeout = 20000 } = {}) {
+  return new Promise((resolve, reject) => {
+    let t;
+    try {
+      t = new URL(url);
+    } catch (e) {
+      return reject(e);
+    }
+    if (t.protocol !== 'http:') {
+      return reject(new Error(`direct http supports http targets only (got ${t.protocol})`));
+    }
+    let settled = false;
+    let req = null;
+    const finish = (fn, arg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(overall);
+      fn(arg);
+    };
+    const overall = setTimeout(() => {
+      req?.destroy();
+      finish(reject, new Error('direct http request timeout'));
+    }, timeout);
+    if (typeof overall.unref === 'function') overall.unref();
+    req = http.request(
+      t,
+      {
+        method: 'POST',
+        headers: { ...headers, 'Content-Length': Buffer.byteLength(body) },
+        agent: false,
+      },
+      (resp) => {
+        const chunks = [];
+        resp.on('close', () => {
+          if (!resp.complete) finish(reject, new Error('response closed before the body ended'));
+        });
+        resp.on('data', (c) => chunks.push(Buffer.from(c)));
+        resp.on('end', () => finish(resolve, fetchLikeResponse(resp, Buffer.concat(chunks))));
+      },
+    );
+    req.on('error', (e) => finish(reject, e));
+    req.end(body);
+  });
+}
+
 /**
  * onceViaConnectProxy + redirect following. Native fetch follows redirects by
  * default, so a call site swapped from fetch to the tunnel needs this or the

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.23.1",
+  "version": "6.23.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.23.1",
+      "version": "6.23.3",
       "os": [
         "darwin",
         "linux",
@@ -22,14 +22,14 @@
       },
       "devDependencies": {
         "@eslint/js": "^10.0.1",
-        "@vitest/coverage-v8": "^5.0.1",
+        "@vitest/coverage-v8": "^5.0.3",
         "acorn": "8.18.0",
         "eslint": "^10.11.0",
         "fast-check": "^4.10.2",
         "knip": "^6.38.0",
         "picomatch": "^4.0.4",
         "prettier": "3.9.9",
-        "vitest": "^5.0.0"
+        "vitest": "^5.0.3"
       },
       "engines": {
         "node": ">=22"
@@ -1078,9 +1078,9 @@
       ]
     },
     "node_modules/@rolldown/binding-android-arm-eabi": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.10.tgz",
-      "integrity": "sha512-bp9svZb+QurZeh+8H4BhrZkifEB0YBNvTVzNSJnJQkj4NrRwmQoDUCGP0vSN7PbvLeM7l1tK6GXL8mrTiH2myg==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.13.tgz",
+      "integrity": "sha512-Vu/NICrgdRvUOeaJZIyB2FP63s6fO/4ud5l8dXmxDx9yDyn+mN0y+gsvsVviSli+T361Aqo0h46EuMoobrwawA==",
       "cpu": [
         "arm"
       ],
@@ -1096,9 +1096,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.10.tgz",
-      "integrity": "sha512-wm6Dld3RXUAZ/gRWKyUy+4W1B5CB5UeFaOzsSWJWEdxZXHH8rCYiZ5dGe6oJmhsunAPWzL7FZV+VtvmN5Ye2eA==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.13.tgz",
+      "integrity": "sha512-6LEoIrGy5vvCd2boNnv2soPSUZj/PRvhp8R/t9KlX+mIZxThIE/ZqxrGXxmuNX0FuvQFvLdZr7S4HrYpYBVhEQ==",
       "cpu": [
         "arm64"
       ],
@@ -1114,9 +1114,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.10.tgz",
-      "integrity": "sha512-UbEfXq/AqGNgRTV3ik+X/iR6mUxu2QdYAadwRxJWquUGnW6gDqdP1FtLtFXRow7RJx0ssRwi80XAPr4r+4DtsA==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.13.tgz",
+      "integrity": "sha512-CaJSRzlQ6Q+zkDMVA9OkVxBjVoPRCDEE3v0FSJ9kIQBgRjFApA3Si4ijhbNVUji7ZJt+PfO0e46qy4nPInHUPA==",
       "cpu": [
         "arm64"
       ],
@@ -1132,9 +1132,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.10.tgz",
-      "integrity": "sha512-7f5h17q5KZVx/ji1vb8OTq31ch1O2I7K8NPIr44GkyWTApXMIsmhWqZfgpOH10xeauqghDAvGlZktasCkcF6Eg==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.13.tgz",
+      "integrity": "sha512-e4r340I5hxSzJkD3YJBxgzq/rJ3wwxwdLLb2FPt1Zpyem20nrQPT11DDEEkazwxaHumH8wpglsp/Ozgj/wT6mw==",
       "cpu": [
         "x64"
       ],
@@ -1150,9 +1150,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.10.tgz",
-      "integrity": "sha512-ynOk/eEYhC6ZB2xCGvKrEOwE58oBy9LnrAqtkrDF9Fz1VTaNdGZTsV0VarJdhPwb+sOJTGjCLwcuyRJZ1dnMcQ==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.13.tgz",
+      "integrity": "sha512-hoBWDZ4/K/mJKVMbsgUd1jfpA2DiOrJ54mpegObU9TBHBBrtX4FLIXJJQRDPZ/2Dn91GvPob+Z2hwKJzf4E5SQ==",
       "cpu": [
         "x64"
       ],
@@ -1168,9 +1168,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.10.tgz",
-      "integrity": "sha512-ERrAs185meZZhGan7a4l3RiiJK1ArSDlHdST++uvSxe+FDbR4TwUPahT/cbZJvaG6fIpDpF78surN+tX708Y4Q==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.13.tgz",
+      "integrity": "sha512-oF9fZu3vTWnTiVAkDFxU9PJLt1nh20K9RRpuHsR7ZnE2L7XookBbDBVLojCVSLGbvtSlxeUNnjAj6DbNsKyzbg==",
       "cpu": [
         "arm"
       ],
@@ -1186,9 +1186,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.10.tgz",
-      "integrity": "sha512-KN7OHKD0J3jy1UzBwZWPxpwhODf9IARUIJcrH+yLYKOcmegZ8luEUM38lDP1bDVj40yP6PsSzCqOJF76vljFnQ==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.13.tgz",
+      "integrity": "sha512-DTpb/+jMiqWMPgphn4ksW1zW+XLJ6dJJ9FMvnIk9I291LhCctMPhMYJrP5t9p6C9qa3KXadDdUEZHBaPh3kNxQ==",
       "cpu": [
         "arm64"
       ],
@@ -1204,9 +1204,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.10.tgz",
-      "integrity": "sha512-8l9wP8O+wa8zD6iw6egSfzVtu7oZVfH3hlUsMM4MwbLMhxleqeoXbZzjddyK3YyNlwLhqznq3tF7PkNJ8T/V2w==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.13.tgz",
+      "integrity": "sha512-xU+Kvv9N2A3SY35zFh1FWWNjxbadE/BKeqnkXe7vScU4GZsw757BlVmDLITZEq8DPpk6m7uoDYkK7P+x/uU5Ow==",
       "cpu": [
         "arm64"
       ],
@@ -1222,9 +1222,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.10.tgz",
-      "integrity": "sha512-SeXNKeQzA5kLhz/J0CH6ZP0/HJ3v1xm/0YbiYpE0kK7emfRC2OIGGIaE14xzkISEGv2aYuUSpiLiU5Gbq+OI0A==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.13.tgz",
+      "integrity": "sha512-XMk/hnhh25oQ756Lclb1Q11h4ll0xC0Esa5w4Vzp+mAE2S3AGJgeM0SonrIgY8fHhjarb6hcoTuwoFG0VVP2ig==",
       "cpu": [
         "ppc64"
       ],
@@ -1240,9 +1240,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.10.tgz",
-      "integrity": "sha512-mtht0nR+y8/hart4175Ll15w7lY8dg7CtQ+j2FDNTsDRspOWTK/2V3l0aj9sIj7XmvqxT8Yli/wq22e7feTTWg==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.13.tgz",
+      "integrity": "sha512-U1BoTHYmlywE2n3HUWjzZ+8EQsKr+OwpxYuDWaubx42tUL8QSL7nOqRz/NVHanibbFP3M1Rxuprz/wNcbMKjqw==",
       "cpu": [
         "s390x"
       ],
@@ -1258,9 +1258,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.10.tgz",
-      "integrity": "sha512-FSM94nGd55NYo48usCyM/nHfUKRnqc9+b0vJNuKV0oCCpIp/OGims7rO1Nv/DkFkt0S/s2rxsJ2kkS8J3HcpeA==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.13.tgz",
+      "integrity": "sha512-J4cm80Pc6wEwV5AZ42o62sIQgDk+Y7R2s646jIwuvO+4V46QB58N4vVuMPWCBaNgursXLpmUWJV//WQAkPvHBQ==",
       "cpu": [
         "x64"
       ],
@@ -1276,9 +1276,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.10.tgz",
-      "integrity": "sha512-C3YxNB16myRLs7o+B+6PnQ6jBsdIS4+AE4Ah8glVGhDpEv9AOvxhZ/1duAb4B0UGczEK/lBbccksd8VI+p6zfw==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.13.tgz",
+      "integrity": "sha512-W0euZS40U4V6JkmEnVCIX9mcsL6cbXQ4X8c2w+MMOIjFg68TXUW+u3RT+2e1t1pv9mg/EP3pDtK3POXdQ7Rxyw==",
       "cpu": [
         "x64"
       ],
@@ -1294,9 +1294,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.10.tgz",
-      "integrity": "sha512-571TlE/F1eeTjjdjYAMMMPs1Mfv3MtX6s3+ZKVU6HiUjZ5Njc6c/qzNy/8K3zALTZnaw3JQVYrHxvNfjm43KAg==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.13.tgz",
+      "integrity": "sha512-do/AF/4n9MRshia3a5aXoy8xM2c6mgfT6D7H/dY6my5z+hfCIR4ab7mk4IRj++nsEQpKy39kd0DQnDq+r692tw==",
       "cpu": [
         "arm64"
       ],
@@ -1312,9 +1312,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.10.tgz",
-      "integrity": "sha512-QXW+ZWaiqs2c7Fi++D/SsW07LTPcUrncxcskJGfGNBoaLik1IU6fJymz4HsqwEO0u5Iq11yTO0B/mc4cPk7jrQ==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.13.tgz",
+      "integrity": "sha512-6FtUf2cJZobutJdxnGYX8z0vtbgqU0b2v8vfBhkXb9wp2MppMFtkunE+IaOntyi01rkIQoPW2GHABtfzsC0BRQ==",
       "cpu": [
         "arm64"
       ],
@@ -1330,9 +1330,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.10.tgz",
-      "integrity": "sha512-5FQFGgah17YeMtG1Yd5a+rMxQpTksyNXxRtKz06FVTaQw3RKYUJQbUoKk0/5jrXBpDo+7makNP7UHA2LQyH64A==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.13.tgz",
+      "integrity": "sha512-UKhFaZTeTcbKrb3iU82m17jVcPEAoqDkCN5MBqgPyZSwp/cQmib21crTS0DdH7T1B7wZRWEI89YQAOJMet5yhg==",
       "cpu": [
         "x64"
       ],
@@ -1406,9 +1406,9 @@
       "license": "MIT"
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-5.0.1.tgz",
-      "integrity": "sha512-FRC8ACiudC3dI6MTplzRSYWHDRnIv2IPfbzs4FdoJNsMal/35sWV8hwIfV8ZcqzSPy+uXHeMVONt9CEqtOU17w==",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-5.0.3.tgz",
+      "integrity": "sha512-+klsyz7BvT1vCU28Zkfzms1Ia78XD0V41U3FUtRaa3S+vOr/EXvK1O6BvVD7l1RzEjm6SONR2aybOvDDf9u0mQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1425,8 +1425,8 @@
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "5.0.1",
-        "vitest": "5.0.1"
+        "@vitest/browser": "5.0.3",
+        "vitest": "5.0.3"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -1458,14 +1458,14 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.1.tgz",
-      "integrity": "sha512-6K1DoBNAPGvuOcSsGA4D6x+5zEEff/KmOOP3uetT2TrGpVfI+HRHRnJJfKi5ib/g1vx8IYHQD8s0pbJz8WQI7Q==",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.3.tgz",
+      "integrity": "sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "0.3.31",
-        "@vitest/spy": "5.0.1",
+        "@vitest/spy": "5.0.3",
         "estree-walker": "^3.0.3",
         "magic-string": "^1.2.3"
       },
@@ -1486,9 +1486,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.1.tgz",
-      "integrity": "sha512-rbto/mF/SGERxEgYOek7Xm6B9b+y+mVoo+f4b2LymYO8zM1b7uB5nHuhVMTP2hxdzgxvGiZYGxGIaMvL5y180Q==",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.3.tgz",
+      "integrity": "sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -1646,9 +1646,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1711,9 +1711,9 @@
       }
     },
     "node_modules/chai": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3075,9 +3075,9 @@
       }
     },
     "node_modules/magic-string": {
-      "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.2.tgz",
-      "integrity": "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==",
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",
+      "integrity": "sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3174,9 +3174,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.19",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
-      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
+      "version": "3.3.20",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
+      "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
       "dev": true,
       "funding": [
         {
@@ -3240,9 +3240,9 @@
       }
     },
     "node_modules/obug": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.4.tgz",
-      "integrity": "sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
+      "integrity": "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
@@ -3468,9 +3468,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.28",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
-      "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
+      "version": "8.5.29",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.29.tgz",
+      "integrity": "sha512-49cGhUbXj8Qenv0iTMxA1cFBzxXoctpC9Ujd77t1WcbJIr6nF/eI7g/8MgxrYldFRuAXvja7xQRwavoW7kgrxQ==",
       "dev": true,
       "funding": [
         {
@@ -3489,9 +3489,9 @@
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "nanoid": "^3.3.18",
+        "nanoid": "^3.3.19",
         "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
+        "source-map-js": "^1.2.2"
       },
       "engines": {
         "node": "^10 || ^12 || >=14"
@@ -3647,14 +3647,14 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.10.tgz",
-      "integrity": "sha512-OxkA08pSryMK7B3XiFA09B4OJ1xJMPgIYCBMY2xchzpqgBGsV1o0DetPAE+Sl3N3L4oCPiEzmHVSOj7iR04Zog==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.13.tgz",
+      "integrity": "sha512-/5apOkwWxtACcQtZ5WlrAsKS4JwXVThQPJZ3RqIruRY9UG9M8e0VlXN068xum/JRKA4aIUoJ13ghe/kGCvidiQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "@oxc-project/types": "=0.151.0",
+        "@oxc-project/types": "=0.153.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -3664,27 +3664,27 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm-eabi": "1.2.10",
-        "@rolldown/binding-android-arm64": "1.2.10",
-        "@rolldown/binding-darwin-arm64": "1.2.10",
-        "@rolldown/binding-darwin-x64": "1.2.10",
-        "@rolldown/binding-freebsd-x64": "1.2.10",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.2.10",
-        "@rolldown/binding-linux-arm64-gnu": "1.2.10",
-        "@rolldown/binding-linux-arm64-musl": "1.2.10",
-        "@rolldown/binding-linux-ppc64-gnu": "1.2.10",
-        "@rolldown/binding-linux-s390x-gnu": "1.2.10",
-        "@rolldown/binding-linux-x64-gnu": "1.2.10",
-        "@rolldown/binding-linux-x64-musl": "1.2.10",
-        "@rolldown/binding-openharmony-arm64": "1.2.10",
-        "@rolldown/binding-win32-arm64-msvc": "1.2.10",
-        "@rolldown/binding-win32-x64-msvc": "1.2.10"
+        "@rolldown/binding-android-arm-eabi": "1.2.13",
+        "@rolldown/binding-android-arm64": "1.2.13",
+        "@rolldown/binding-darwin-arm64": "1.2.13",
+        "@rolldown/binding-darwin-x64": "1.2.13",
+        "@rolldown/binding-freebsd-x64": "1.2.13",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.13",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.13",
+        "@rolldown/binding-linux-arm64-musl": "1.2.13",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.13",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.13",
+        "@rolldown/binding-linux-x64-gnu": "1.2.13",
+        "@rolldown/binding-linux-x64-musl": "1.2.13",
+        "@rolldown/binding-openharmony-arm64": "1.2.13",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.13",
+        "@rolldown/binding-win32-x64-msvc": "1.2.13"
       }
     },
     "node_modules/rolldown/node_modules/@oxc-project/types": {
-      "version": "0.151.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.151.0.tgz",
-      "integrity": "sha512-J1yXrIlNDZVzE3ada310xeAw7nH8yCAyLPuUIsjKatFPmfn5bS1oW+cM+QsGOtVWd5nhSpbwZWx/rue+r5Z+PA==",
+      "version": "0.153.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.153.0.tgz",
+      "integrity": "sha512-jSNrRIyvPVLL5E1z/tS5zLAprosGz/FuI1PWwEOz59j3E4TTTzSpqKb/RDGqJhhW0QHYISGXxq582wGx6T11Tw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3858,17 +3858,10 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/siginfo": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
-      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/smol-toml": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz",
-      "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.0.tgz",
+      "integrity": "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -3879,22 +3872,15 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
       }
     },
-    "node_modules/stackback": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
-      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/statuses": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
@@ -3905,9 +3891,9 @@
       }
     },
     "node_modules/std-env": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
-      "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
       "dev": true,
       "license": "MIT"
     },
@@ -3925,9 +3911,9 @@
       }
     },
     "node_modules/tinybench": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.1.4.tgz",
-      "integrity": "sha512-9APumHG7r4yOk4X4WlkmE71aZcv1gvin1czO3OQ1U9iJcFA5Ja/ygyb0vPOVHTthFozUYs8CLoLUlM8grb2lTQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.1.tgz",
+      "integrity": "sha512-IAbQaPJIIdhVxi0mqy9lez1wEwje0UQf9F1vwtbelEG5Nbgn0nPOxCvU+mNeNS9gyJTAhrHp74CbUaSynQpZcQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3935,9 +3921,9 @@
       }
     },
     "node_modules/tinyexec": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.0.tgz",
-      "integrity": "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
+      "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4061,9 +4047,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.0.tgz",
-      "integrity": "sha512-lhZBVvEHefgE+HQZC9O7EBJgCU/nVzFNl7vkS4RE0APtWLP02/8QVIkQtzBxPquh7lq5/78NHipTj7ODQ6XuyQ==",
+      "version": "8.3.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.3.tgz",
+      "integrity": "sha512-cTAldKPImjg6c+gk48U19POPn3GCBzZwpdsN8ZMEEcbpes+6/wvfqUd0C2y3qYY4wsj8PwgFwrZ/1jBPVttMSg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4071,7 +4057,7 @@
         "lightningcss": "^1.33.0",
         "picomatch": "^4.0.7",
         "postcss": "^8.5.28",
-        "rolldown": "~1.2.6",
+        "rolldown": "~1.2.11",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -4140,14 +4126,14 @@
       }
     },
     "node_modules/vitest": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.1.tgz",
-      "integrity": "sha512-iA95lQbKEkvrtTkdAgnWbXfbipWiiWe/hDl2P5tMi6WFwD76G0NxXAGp/M9EOcYupeGJRr6wppMc7CoA41TQjg==",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.3.tgz",
+      "integrity": "sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/chai": "^5.2.2",
-        "@vitest/mocker": "5.0.1",
+        "@vitest/mocker": "5.0.3",
         "chai": "^6.2.2",
         "es-module-lexer": "^2.3.2",
         "expect-type": "^1.4.0",
@@ -4155,10 +4141,10 @@
         "obug": "^2.1.4",
         "picomatch": "^4.0.7",
         "std-env": "^4.2.0",
-        "tinybench": "6.1.4",
-        "tinyexec": "1.3.0",
+        "tinybench": "^6.1.4",
+        "tinyexec": "^1.3.0",
         "tinyglobby": "^0.2.17",
-        "why-is-node-running": "^2.3.0"
+        "why-is-node-running": "3.2.1"
       },
       "bin": {
         "vitest": "vitest.mjs"
@@ -4173,12 +4159,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "5.0.1",
-        "@vitest/browser-preview": "5.0.1",
+        "@vitest/browser-playwright": "5.0.3",
+        "@vitest/browser-preview": "5.0.3",
         "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
-        "@vitest/coverage-istanbul": "5.0.1",
-        "@vitest/coverage-v8": "5.0.1",
-        "@vitest/ui": "5.0.1",
+        "@vitest/coverage-istanbul": "5.0.3",
+        "@vitest/coverage-v8": "5.0.3",
+        "@vitest/ui": "5.0.3",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
@@ -4248,20 +4234,16 @@
       }
     },
     "node_modules/why-is-node-running": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
-      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.1.tgz",
+      "integrity": "sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "siginfo": "^2.0.0",
-        "stackback": "0.0.2"
-      },
       "bin": {
         "why-is-node-running": "cli.js"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=20.11"
       }
     },
     "node_modules/word-wrap": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.23.1",
+  "version": "6.23.3",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -241,13 +241,13 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@vitest/coverage-v8": "^5.0.1",
+    "@vitest/coverage-v8": "^5.0.3",
     "acorn": "8.18.0",
     "eslint": "^10.11.0",
     "fast-check": "^4.10.2",
     "knip": "^6.38.0",
     "picomatch": "^4.0.4",
     "prettier": "3.9.9",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.3"
   }
 }