claude-recall 0.34.0 → 0.34.2

package/README.md

@@ -141,6 +141,11 @@ claude-recall kiro setup --merge-into <agent-name>
 - **It's a best-effort LLM judgement, not a guarantee.** The classifier decides what's a durable rule vs. chit-chat; it won't catch every phrasing, and near-identical wording can occasionally be judged differently. State preferences plainly ("use pnpm here, not npm") for the best hit rate.
 - **There's a ~3s lag.** A preference you just stated isn't queryable for a couple of seconds while the worker finishes.
 
+**Word your rules precisely — under Kiro this matters more.** Claude Code and Pi re-surface relevant rules right beside each tool call; Kiro has no channel for that, so rules act from a distance (session start + a refresh every 15 prompts). A vague rule tends to get overlooked mid-task; one that names the **trigger** and the **concrete pattern** gets applied. Real example, same session:
+
+- ✗ *"name docs so they sort together in the file explorer"* → agent created `dummy_email.txt` anyway
+- ✓ *"when creating a new file, match the naming prefix of similar files — email files are `email_*.txt`"* → agent named it correctly and cited the rule while doing it
+
 **To verify capture actually worked** — from a second terminal (Kiro's chat can't shell out):
 
 ```bash

package/dist/cli/claude-recall-cli.js

@@ -406,6 +406,12 @@ class ClaudeRecallCLI {
             console.error('\nCheck your connection, then run `claude-recall upgrade` again.');
             process.exit(1);
         }
+        // `latest` is interpolated into an npm argument (via a shell on Windows) —
+        // accept only a plausible semver string from the registry response.
+        if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(latest)) {
+            console.error(`❌ Unexpected version string from the registry: "${latest}"`);
+            process.exit(1);
+        }
         console.log(`Installed: ${current}`);
         console.log(`Latest:    ${latest}`);
         const needsInstall = current !== latest;
@@ -413,7 +419,11 @@ class ClaudeRecallCLI {
             console.log(`\n📦 Upgrading ${current} → ${latest}...\n`);
             // Run npm install -g, streaming output so the user sees progress / errors live.
             // shell: true on Windows — npm is npm.cmd there and a bare spawnSync ENOENTs.
-            const install = spawnSync('npm', ['install', '-g', 'claude-recall@latest'], {
+            // Pin the exact version `npm view` just resolved instead of `@latest`:
+            // right after a publish, the dist-tag replica npm installs from can lag
+            // the metadata endpoint `npm view` read — `@latest` then silently
+            // reinstalls the OLD version with exit 0 (observed live on 0.34.0).
+            const install = spawnSync('npm', ['install', '-g', `claude-recall@${latest}`], {
                 stdio: 'inherit',
                 shell: process.platform === 'win32',
             });
@@ -429,7 +439,9 @@ class ClaudeRecallCLI {
             if (install.status !== 0) {
                 // npm prints its own error — add the practical remediation on top
                 console.error('\n❌ Install failed.');
-                console.error('\nMost common cause: your global npm prefix is owned by root (EACCES).');
+                console.error(`\nIf npm said it can't find claude-recall@${latest} (ETARGET): the release`);
+                console.error('is minutes old and the registry is still propagating — wait a minute and re-run.');
+                console.error('\nMost common cause otherwise: your global npm prefix is owned by root (EACCES).');
                 console.error('\nQuick fix:');
                 console.error('  sudo npm install -g claude-recall');
                 console.error('\nPermanent fix (no more sudo for any global install on this machine):');
@@ -440,6 +452,26 @@ class ClaudeRecallCLI {
                 console.error('\nThen re-run: claude-recall upgrade');
                 process.exit(install.status ?? 1);
             }
+            // Trust but verify: confirm the globally installed version actually IS
+            // `latest` before claiming success. The success message used to report
+            // intent, not fact — a propagation race left 0.33.0 installed while the
+            // command printed "✓ Upgraded to 0.34.0".
+            let installedNow = '';
+            try {
+                const ls = JSON.parse(execSync('npm ls -g claude-recall --json', {
+                    encoding: 'utf-8',
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                }));
+                installedNow = ls?.dependencies?.['claude-recall']?.version ?? '';
+            }
+            catch { /* verification is best-effort; fall through to the mismatch path */ }
+            if (installedNow !== latest) {
+                console.error(`\n❌ Install reported success but the global version is ${installedNow || 'unreadable'}, not ${latest}.`);
+                console.error('   This usually means the npm registry is still propagating a very recent');
+                console.error('   release. Wait a minute, then re-run: claude-recall upgrade');
+                console.error(`   Or install the exact version directly: npm install -g claude-recall@${latest}`);
+                process.exit(1);
+            }
             // Kill any running MCP servers so Claude Code respawns them with the new binary
             console.log('\n🧹 Cleaning up running MCP servers (Claude Code respawns them on next tool call)...');
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-recall",
-  "version": "0.34.0",
+  "version": "0.34.2",
   "description": "Persistent memory for Claude Code and Pi with native Skills integration, automatic capture, failure learning, and project scoping",
   "main": "dist/index.js",
   "bin": {