claude-mem-lite 6.23.2 → 6.24.0

package/hook-update.mjs

@@ -1,6 +1,7 @@
-// claude-mem-lite: Auto-update via GitHub Releases
-// Checks for new versions on SessionStart, downloads and installs automatically.
-// Skips in dev mode (symlinked installs). Silent on network failure.
+// claude-mem-lite: update check and installer via GitHub Releases
+// The SessionStart check (hook.mjs, allowInstall:false) only records and announces a newer
+// release; `self-update` and `repair` install one, signature-verified. Skips a dev install
+// (a git checkout or symlinks) and under CLAUDE_MEM_SKIP_UPDATE. Silent on network failure.
 
 import { isOurMcpRegistration } from './lib/mcp-ownership.mjs';
 import { execSync, execFileSync } from 'node:child_process';
@@ -20,13 +21,14 @@ import {
 } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { tmpdir, homedir } from 'node:os';
+import { tmpdir } from 'node:os';
 // lib/data-paths.mjs, NOT schema.mjs: this module is what install.mjs::repair() imports to
 // reach the signature-verified release path, and schema.mjs statically imports
 // better-sqlite3 — so importing two path constants from there made the verified repair
 // unreachable on exactly the broken-install state it exists to repair (2026-09-08).
 // tests/repair-path-no-native-dep.test.mjs fails on any package edge reachable from here.
-import { DB_DIR, CODE_DIR } from './lib/data-paths.mjs';
+import { DB_DIR, CODE_DIR, claudeConfigDir, claudeStatePath } from './lib/data-paths.mjs';
+import { workerDirGone } from './lib/worker-data-dir.mjs';
 import { debugCatch, debugLog } from './utils.mjs';
 import { NATIVE_BINDING_SOURCE_BUILD_CMD } from './lib/binding-probe.mjs';
 // Local manifest is fallback only — the active manifest is loaded from the
@@ -40,7 +42,7 @@ import {
 // version check AND the release download — dies instantly behind a proxy, and
 // because checkForUpdate is silent on network failure the plugin then reports
 // itself permanently up to date. Same tunnel the OpenRouter call site uses.
-import { httpConnectProxyFor, getViaConnectProxy } from './lib/proxy-fetch.mjs';
+import { httpConnectProxyFor, getViaConnectProxy, redactProxyUrl } from './lib/proxy-fetch.mjs';
 import { acquireLock } from './lib/proc-lock.mjs';
 import { atomicWriteFileSync } from './lib/atomic-write.mjs';
 import { verifyReleaseFiles, verifyManifestSignature } from './lib/release-digest.mjs';
@@ -67,12 +69,17 @@ const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 
 // ── Main Entry ─────────────────────────────────────────────
 export async function checkForUpdate(options = {}) {
+  // A failed lookup returns null by default, which a background caller wants (silent on
+  // network failure). `self-update` printed that null as "Already up to date", so a caller
+  // that reports to a person asks for the failure instead. (D#251)
+  const failed = (rateLimited) =>
+    options.reportFailure ? { updateAvailable: false, updated: false, checkFailed: true, rateLimited } : null;
   try {
     const pluginMode = isPluginMode();
     const force = Boolean(options.force);
     const allowInstall = options.allowInstall ?? !pluginMode;
 
-    if (isDevMode() || process.env.CLAUDE_MEM_SKIP_UPDATE) return null;
+    if (updateCheckDisabledReason()) return null;
 
     const state = readState();
     if (!force && !shouldCheck(state)) {
@@ -91,15 +98,25 @@ export async function checkForUpdate(options = {}) {
       return null;
     }
 
-    const latest = await fetchLatestRelease();
+    const lookup = await lookupLatestRelease();
+    const latest = lookup.release;
     if (!latest) {
-      // Re-read from disk: a 403 inside fetchWithTimeout just persisted rateLimited:true.
+      // Re-read from disk: a 403 inside fetchJson just persisted rateLimited:true.
       // Spreading the stale in-memory `state` (captured above with rateLimited:false) would
       // clobber that flag back to false, so shouldCheck never honors the backoff and the
       // rate-limit mechanism is dead. Re-reading preserves the freshly-written flag.
+      // lookupError / lookupFailingSince are doctor's evidence: lastCheck alone advanced on a
+      // failed lookup too, so doctor printed a fresh "last check" in green while every lookup
+      // behind a proxy failed from 2026-08-19 to 2026-10-07 (D#255). A success clears both.
       const fresh = readState();
-      saveState({ ...fresh, lastCheck: new Date().toISOString() });
-      return null;
+      const now = new Date().toISOString();
+      saveState({
+        ...fresh,
+        lastCheck: now,
+        lookupError: lookup.error,
+        lookupFailingSince: fresh.lookupFailingSince || now,
+      });
+      return failed(lookup.rateLimited);
     }
 
     const currentVersion = getCurrentVersion();
@@ -139,6 +156,8 @@ export async function checkForUpdate(options = {}) {
       updateAvailable: false,
       rateLimited: false,
       lastError: null,
+      lookupError: null,
+      lookupFailingSince: null,
     });
     return null;
   } catch (err) {
@@ -147,7 +166,7 @@ export async function checkForUpdate(options = {}) {
       const s = readState();
       saveState({ ...s, lastCheck: new Date().toISOString(), lastError: err.message });
     } catch {}
-    return null;
+    return failed(false);
   }
 }
 
@@ -160,7 +179,7 @@ export async function checkForUpdate(options = {}) {
 // Banner string from cached update-state (≤24h stale), or null. No network I/O.
 export function getCachedUpdateBanner() {
   try {
-    if (isDevMode() || process.env.CLAUDE_MEM_SKIP_UPDATE) return null;
+    if (updateCheckDisabledReason()) return null;
     const state = readState();
     const running = pendingCachedUpdate(state);
     if (running) {
@@ -193,7 +212,7 @@ export function pendingCachedUpdate(state) {
 // Caller spawns the refresh in the background so this session doesn't wait.
 export function isUpdateCheckDue() {
   try {
-    if (isDevMode() || process.env.CLAUDE_MEM_SKIP_UPDATE) return false;
+    if (updateCheckDisabledReason()) return false;
     return shouldCheck(readState());
   } catch {
     return false;
@@ -203,7 +222,7 @@ export function isUpdateCheckDue() {
 // D#187. `CLAUDE_PLUGIN_ROOT` is set in every hook and MCP process Claude Code
 // spawns, so inside those the env var answers "am I a plugin install?" perfectly —
 // which is why v3.84.1's fix, which reads it, was enough THERE. It is not set in a
-// plain terminal, and a plugin-only user typing `claude-mem-lite update` therefore
+// plain terminal, and a plugin-only user typing `claude-mem-lite self-update` therefore
 // fell off both plugin paths at once: getCurrentVersion() returned '0.0.0' (so every
 // release compares as newer, forever), and isPluginMode() was false, so allowInstall
 // defaulted to true and downloadAndInstall laid a full managed tree into
@@ -252,6 +271,19 @@ function isPluginMode() {
 // never a command that would overwrite its working tree. Re-implementing the check at the
 // call site would make it the second copy of a predicate this file has already had to get
 // right twice (whole-dir symlink, then per-file drift) — the twin-drift class.
+/**
+ * Why the update check will not look at all, or null when it will. checkForUpdate returns
+ * null both for "nothing newer" and for "never looked", so a caller that reports to a
+ * person asks this first: `self-update` used to print "Already up to date" under
+ * CLAUDE_MEM_SKIP_UPDATE without a single request (D#251).
+ * @returns {'dev-install'|'CLAUDE_MEM_SKIP_UPDATE'|null}
+ */
+export function updateCheckDisabledReason() {
+  if (isDevMode()) return 'dev-install';
+  if (process.env.CLAUDE_MEM_SKIP_UPDATE) return 'CLAUDE_MEM_SKIP_UPDATE';
+  return null;
+}
+
 export function isDevMode() {
   try {
     // A dev checkout always carries a .git dir. This catches a whole-directory
@@ -286,57 +318,93 @@ function shouldCheck(state) {
 // ── GitHub API ─────────────────────────────────────────────
 // Try releases/latest first, fallback to tags (some repos only use tags)
 export async function fetchLatestRelease() {
+  return (await lookupLatestRelease()).release;
+}
+
+// One lookup's outcome, returned rather than kept in module state: a module flag let a second
+// lookup running at the same time read the first one's 403 (D#260). `rateLimited` is THIS
+// lookup's refusal; the persisted flag is not that, since only a successful lookup clears it
+// (pre-tag review of cd9f1ab7). `error` says why there is no release, for doctor (D#255).
+async function lookupLatestRelease() {
   const headers = {
     Accept: 'application/vnd.github+json',
     'User-Agent': 'claude-mem-lite-updater/1.0',
   };
+  const fail = (rateLimited, error) => ({ release: null, rateLimited, error });
 
   // Attempt 1: GitHub Releases API
-  const result = await fetchWithTimeout(
-    `https://api.github.com/repos/${GITHUB_REPO}/releases/latest`,
-    headers,
-  );
-  if (result === 'rate-limited') return null;
+  const result = await fetchJson(`https://api.github.com/repos/${GITHUB_REPO}/releases/latest`, headers);
+  if (result.rateLimited) return fail(true, result.error);
   // Guard tag_name: a 200-OK with a malformed body ({} / {tag_name:null}) would throw
   // `Cannot read properties of undefined (reading 'replace')`. Caught upstream, but it
   // poisons lastError and blocks the tags fallback below — fall through instead.
-  if (result && typeof result.tag_name === 'string') {
+  const rel = result.body;
+  if (rel && typeof rel.tag_name === 'string') {
     return {
-      version: result.tag_name.replace(/^v/, ''),
-      tarballUrl: result.tarball_url,
-      releaseUrl: result.html_url,
-      assets: Array.isArray(result.assets) ? result.assets : [],
+      release: {
+        version: rel.tag_name.replace(/^v/, ''),
+        tarballUrl: rel.tarball_url,
+        releaseUrl: rel.html_url,
+        assets: Array.isArray(rel.assets) ? rel.assets : [],
+      },
+      rateLimited: false,
+      error: null,
     };
   }
 
   // Attempt 2: Tags API fallback (for repos without formal releases)
-  const tags = await fetchWithTimeout(`https://api.github.com/repos/${GITHUB_REPO}/tags?per_page=1`, headers);
-  if (tags === 'rate-limited') return null;
-  if (Array.isArray(tags) && tags.length > 0 && typeof tags[0]?.name === 'string') {
-    const tag = tags[0];
+  const tags = await fetchJson(`https://api.github.com/repos/${GITHUB_REPO}/tags?per_page=1`, headers);
+  if (tags.rateLimited) return fail(true, tags.error);
+  const tagList = tags.body;
+  if (Array.isArray(tagList) && tagList.length > 0 && typeof tagList[0]?.name === 'string') {
+    const tag = tagList[0];
     return {
-      version: tag.name.replace(/^v/, ''),
-      tarballUrl: `https://api.github.com/repos/${GITHUB_REPO}/tarball/${tag.name}`,
-      releaseUrl: `https://github.com/${GITHUB_REPO}/releases/tag/${tag.name}`,
-      assets: [],
+      release: {
+        version: tag.name.replace(/^v/, ''),
+        tarballUrl: `https://api.github.com/repos/${GITHUB_REPO}/tarball/${tag.name}`,
+        releaseUrl: `https://github.com/${GITHUB_REPO}/releases/tag/${tag.name}`,
+        assets: [],
+      },
+      rateLimited: false,
+      error: null,
     };
   }
 
-  return null;
+  const relErr = result.error || 'no release in the response';
+  const tagErr = tags.error || 'no tag in the response';
+  return fail(false, relErr === tagErr ? relErr : `${relErr}; tags: ${tagErr}`);
+}
+
+// Why a request produced no usable body, in words doctor can print: the status, or the
+// transport error's code (native fetch wraps it as `fetch failed` with the code on `cause`).
+// The proxy is named redacted — HTTP(S)_PROXY may carry user:pass@.
+// Total: it runs inside fetchJson's catch, and a throw there would reject the lookup the
+// background check relies on never rejecting.
+function describeLookupError(e, proxy) {
+  try {
+    const what =
+      e?.name === 'AbortError'
+        ? `timed out after ${FETCH_TIMEOUT_MS / 1000} s`
+        : String(e?.cause?.code || e?.code || e?.message || e || 'unknown error');
+    return `${what.slice(0, 160)}${proxy ? ` via proxy ${redactProxyUrl(proxy)}` : ''}`;
+  } catch {
+    return 'unknown error';
+  }
 }
 
-async function fetchWithTimeout(url, headers) {
+async function fetchJson(url, headers) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  let proxy = null;
   try {
     // Proxy configured → CONNECT tunnel; otherwise native fetch, byte-for-byte
     // the previous behaviour. Both shapes expose { status, ok, json() }, and the
     // tunnel REJECTS on transport failure exactly as a failed fetch does, so the
-    // catch below still returns null and the caller still stays silent.
+    // catch below still yields no body and the caller still stays silent.
     // The AbortController above governs only the fetch branch; the tunnel takes
     // the same budget as an explicit argument and bounds the whole call with it
     // (redirect chain included). (pre-tag review NOTE 7)
-    const proxy = httpConnectProxyFor(url);
+    proxy = httpConnectProxyFor(url);
     const res = proxy
       ? await getViaConnectProxy(proxy, url, { headers, timeout: FETCH_TIMEOUT_MS })
       : await fetch(url, { signal: controller.signal, headers });
@@ -347,12 +415,15 @@ async function fetchWithTimeout(url, headers) {
       const state = readState();
       saveState({ ...state, rateLimited: true });
       debugLog('DEBUG', 'hook-update', 'GitHub API rate limited; will retry on the 6h rate-limit cadence');
-      return 'rate-limited';
+      return {
+        rateLimited: true,
+        error: describeLookupError({ message: `HTTP ${res.status} (rate limited)` }, proxy),
+      };
     }
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
+    if (!res.ok) return { error: describeLookupError({ message: `HTTP ${res.status}` }, proxy) };
+    return { body: await res.json() };
+  } catch (e) {
+    return { error: describeLookupError(e, proxy) };
   } finally {
     clearTimeout(timeout);
   }
@@ -412,7 +483,7 @@ export function getCurrentVersion() {
   }
   // D#187: no env var in a plain terminal, so ask the filesystem which plugin
   // version this machine actually runs. Without this a plugin-only user's
-  // `claude-mem-lite update` reads 0.0.0 and every release compares as newer.
+  // `claude-mem-lite self-update` reads 0.0.0 and every release compares as newer.
   const active = installShape()?.activePluginVersion;
   if (active) {
     try {
@@ -1030,7 +1101,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // guard rejects. Failure is non-fatal — a stale entry is noisy, not broken, and must
     // never roll back an otherwise-good update.
     try {
-      const settingsPath = join(homedir(), '.claude', 'settings.json');
+      const settingsPath = join(claudeConfigDir(), 'settings.json');
       if (existsSync(settingsPath)) {
         const { pruneDanglingMemHooks } = await import('./lib/hook-prune.mjs');
         const before = JSON.parse(readFileSync(settingsPath, 'utf8'));
@@ -1059,7 +1130,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // server was deleted on every plugin update that re-synced a direct install.
     try {
       if (isPluginMode()) {
-        const claudeJsonPath = join(homedir(), '.claude.json');
+        const claudeJsonPath = claudeStatePath();
         const cfg = JSON.parse(readFileSync(claudeJsonPath, 'utf8'));
         let changed = false;
         for (const k of ['mem', 'mem-lite']) {
@@ -1154,7 +1225,7 @@ export async function syncDataDirFromCache(opts = {}) {
     let sourceDir = opts.sourceDir || null;
     if (!sourceDir) {
       const cacheBase =
-        opts.cacheBase || join(homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
+        opts.cacheBase || join(claudeConfigDir(), 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
       if (!existsSync(cacheBase)) return { synced: false, reason: 'no-cache' };
       const versions = readdirSync(cacheBase)
         .filter((n) => /^\d+\.\d+/.test(n))
@@ -1294,7 +1365,7 @@ function copyReleaseIntoStaging(
 // appearing in a serialized hooks block) so the two cannot disagree about whether
 // settings.json owns the hooks.
 function hasInstallManagedSettingsHooks() {
-  const settingsPath = join(homedir(), '.claude', 'settings.json');
+  const settingsPath = join(claudeConfigDir(), 'settings.json');
   if (!existsSync(settingsPath)) return false;
   let s;
   try {
@@ -1336,7 +1407,7 @@ export function clearCacheHookResidue() {
   // status/doctor then see the shape of a healthy plugin-only install. Inlined
   // here for the same reason the rest of this function is (see header).
   if (!hasInstallManagedSettingsHooks()) return 0;
-  const cacheBase = join(homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
+  const cacheBase = join(claudeConfigDir(), 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
   if (!existsSync(cacheBase)) return 0;
   let cleared = 0;
   for (const ver of readdirSync(cacheBase)) {
@@ -1385,7 +1456,7 @@ function isSameDir(a, b) {
 }
 
 export function prunePluginCache() {
-  const cacheBase = join(homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
+  const cacheBase = join(claudeConfigDir(), 'plugins', 'cache', 'sdsrss', 'claude-mem-lite');
   if (!existsSync(cacheBase)) return 0;
 
   const entries = readdirSync(cacheBase)
@@ -1409,7 +1480,7 @@ export function prunePluginCache() {
   const runningRoot = process.env.CLAUDE_PLUGIN_ROOT;
   let recordedRoot = null;
   try {
-    recordedRoot = detectInstallShape({ home: homedir() }).activePluginVersion?.root || null;
+    recordedRoot = detectInstallShape().activePluginVersion?.root || null;
   } catch {
     /* best-effort — a failure here must not stop pruning entirely */
   }
@@ -1444,6 +1515,9 @@ function readState() {
 }
 
 function saveState(state) {
+  // The update-check worker runs this after its release lookup; a data dir removed meanwhile
+  // stays removed (D#265, pre-tag review).
+  if (workerDirGone(STATE_DIR)) return;
   try {
     const dir = join(STATE_DIR, 'runtime'); // runtime-dir:stays-put — mkdir for update-state.json above
     mkdirSync(dir, { recursive: true });

package/hook.mjs

@@ -240,6 +240,8 @@ async function loadCacheGuard() {
 import { SKIP_TOOLS, SKIP_PREFIXES } from './skip-tools.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
+import { workerDirGone } from './lib/worker-data-dir.mjs';
+import { claudeConfigDir } from './lib/data-paths.mjs';
 // Prevent recursive hooks from background claude -p calls
 // Background workers (llm-episode, llm-summary) are exempt — they're ours
 const event = process.argv[2];
@@ -273,7 +275,7 @@ const BG_EVENTS = new Set([
 // install.mjs already holds a parsed settings object when it asks, this process does not.
 function pluginDisabledHere() {
   try {
-    const settingsPath = join(homedir(), '.claude', 'settings.json');
+    const settingsPath = join(claudeConfigDir(), 'settings.json');
     return isPluginExplicitlyDisabled(JSON.parse(readFileSync(settingsPath, 'utf8')));
   } catch {
     // Missing or unparseable settings.json → not disabled. Fail OPEN: a corrupt file must
@@ -284,6 +286,9 @@ function pluginDisabledHere() {
 
 if (event && pluginDisabledHere()) process.exit(0);
 if (process.env.CLAUDE_MEM_HOOK_RUNNING && !BG_EVENTS.has(event)) process.exit(0);
+// A worker whose data dir was removed before it started does nothing: no LLM call, no network,
+// and no write that would re-create the dir (D#265).
+if (BG_EVENTS.has(event) && workerDirGone(DB_DIR)) process.exit(0);
 
 // Crash-safe: flush episode buffer on unexpected termination to prevent data loss
 // Uses flag-based approach to avoid calling file I/O inside signal handlers,