Skip to content

docs(claude-memory): point stateless purge at the official project-purge command - #1947

Merged
kyle-sexton merged 4 commits into
mainfrom
docs/row74-project-purge-pointer
Aug 5, 2026
Merged

docs(claude-memory): point stateless purge at the official project-purge command#1947
kyle-sexton merged 4 commits into
mainfrom
docs/row74-project-purge-pointer

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Roster row 74. The stateless skill governs auto memory only, and said so without naming the official route for the broader ask ("wipe everything Claude saved about this repo"). Claude Code now ships that route: claude project purge (v2.1.124+). This PR names it wherever the skill states its own scope boundary — the SKILL.md scope statement and table, context/purge.md's pre-gate presentation and follow-through, and reference/official-guidance.md's out-of-scope section — and retires the reference file's now-false "there is no built-in purge command" claim.

Pointer, not a copy: the deletion plan and flags stay in https://code.claude.com/docs/en/claude-directory.

No executable step changes. The bash fences driving Steps 2–4 (manifest capture, backup, delete) and the confirmation gate are byte-identical to the base branch; the additions are narrative bullets outside any executable block, and nothing causes the skill to invoke claude project purge itself.

Review finding fixed — full deletion scope

Codex flagged (P2, official-guidance.md:127) that the summarized deletion scope omitted a category. Re-fetching the live page on 2026-08-04 confirmed it: the command deletes four categories, and the PR's original prose listed three, dropping per-session tasks/, debug/, and file-history/ entries — checkpoint/restore and debug history. That matters because this text is read to a user deciding whether to run a destructive wipe; the omission would have led them to believe checkpoint history survives.

Sweeping the diff found the same omission in five places, not the one flagged. All are corrected:

Location Treatment
reference/official-guidance.md out-of-scope section No longer paraphrases; the verbatim quote block now carries the doc's complete bullet list
SKILL.md scope statement Lists all four categories
context/purge.md Step 2 (pre-gate text) Lists all four categories
context/purge.md Step 5 Was a second hand-maintained copy; now points at Step 2's enumeration
CHANGELOG.md 0.5.6 entry Lists all four categories

Two authoritative enumerations now remain (the reference file's verbatim quote and Step 2's pre-gate text), down from five independently-maintained paraphrases.

Stacking and version

Rebased onto main after #1933 merged, so the diff contains only this PR's five files. 0.5.6 sits directly above #1933's 0.5.5 in both plugin.json and the CHANGELOG, with no gap.

Fresh-context verification completed 2026-08-05 after the rebase: the five-file diff was reviewed against the live official claude-directory page; claude project purge version, deletion scope, exclusions, confirmation behavior, session cleanup, and history persistence all match. markdownlint (14 files), JSON parsing, changelog/version parity, and git diff --check pass locally; the repository-wide skill gate exceeded the local 60-second observation window, so protected CI remains authoritative for that lane.

No linked issue

Related

🤖 Generated with Claude Code

@cursor

cursor Bot commented Aug 4, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@claude

claude Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 49s —— View job


Security review complete

  • Gather context (PR diff, changed files)
  • Review changed files for security issues
  • Post findings

Scope reviewed: git diff origin/main...HEAD — 5 files, all in plugins/claude-memory/:
plugin.json (version bump), CHANGELOG.md, SKILL.md, context/purge.md,
reference/official-guidance.md.

Findings: none

This PR is a pure documentation/prose change. It adds pointers to the official
claude project purge command (with a link to code.claude.com/docs/en/claude-directory)
in the SKILL.md scope table, the pre-gate presentation text and follow-through section of
context/purge.md, and the "out of scope" section of reference/official-guidance.md, plus a
version bump and changelog entry. It does not touch or modify any of the executable bash
code fences in purge.md (Steps 2–4: manifest capture, backup, delete) — those are byte-for-byte
unchanged from origin/main. No new scripts, no GitHub Actions workflow changes, no hooks, no
settings/permissions changes, and no logic that would cause the skill to auto-invoke
claude project purge — the new text only tells the user/agent that the command exists, as
narrative bullets outside any executable block.

No injection surfaces, auth/access-control changes, secret handling, or dangerous CI patterns
are introduced by this diff.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 43a037723b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread plugins/claude-memory/skills/stateless/reference/official-guidance.md Outdated
@claude

claude Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 35s —— View job


Code review complete

  • Gather context (PR diff, changed files, REVIEW.md)
  • Review changed files for correctness, design, conventions, error handling, docs
  • Post findings

Scope reviewed: the 5 files in plugins/claude-memory/ changed by this PR (per git diff origin/main...HEAD). Security is out of scope for this lane per REVIEW.md — this repo has a claude-security-review workflow, and a security pass already ran on this PR (see the earlier comment: no findings).

Per this repo's CLAUDE.md fresh-docs mandate, this diff is a contract-surface doc change (it documents claude project purge's behavior), so I re-fetched code.claude.com/docs/en/claude-directory this session rather than trusting the PR's paraphrase.

🔴 Important — deletion-scope summary understates what claude project purge deletes

The live doc (fetched this session, 2026-08-04) lists four categories deleted by claude project purge:

Run claude project purge to delete the state Claude Code holds for one project... It deletes:

  • Transcripts and auto memory under projects/
  • Per-session tasks/, debug/, and file-history/ entries
  • Matching prompt lines in history.jsonl
  • The project's entry in ~/.claude.json

This PR's paraphrase omits the second bullet (per-session tasks//debug//file-history/ — checkpoint/restore and debug history) in all four places it enumerates the scope:

This matters because official-guidance.md is the file this skill treats as pre-verified ("re-fetch the two source pages if a fact is load-bearing" is the escape hatch, not the default), and purge.md Step 2/5 text is what gets read to a user deciding whether to run a destructive wipe. A user told the scope is "transcripts + auto memory + history + .claude.json" would reasonably assume their checkpoint/restore and debug history survive — it doesn't. This independently confirms the Codex bot's inline comment on official-guidance.md:127, and extends it: the same omission is repeated in 3 more places, not just the one line Codex flagged.

The added verbatim quote block itself (official-guidance.md:132-134) is accurate — it only quotes the command's version requirement, not the bullet list — so the fix is adding the missing bullet to the four prose summaries above, not correcting a misquote.

Fix this →

Note (non-blocking, already disclosed) — version numbering vs PR #1933

CHANGELOG.md's new [0.5.6] entry self-describes as "claude-memory 0.5.5 → 0.5.6," but 0.5.5 doesn't exist on this branch or on main — it's PR #1933's unmerged version bump. The PR description already flags this as a known campaign-coordination gap, so this isn't a new finding, just confirming it's real: whichever of #1933 / this PR merges second will need its version renumbered to avoid a duplicate/skipped version, and the "0.5.5 → 0.5.6" changelog wording will need adjusting either way.

Everything else

  • The command-version quote ("Run claude project purge... requires Claude Code v2.1.124 or later") is byte-accurate against the live page.
  • docs/OFFICIAL-DOCS.md already indexes claude-directory (row 97), so no index update was needed here.
  • The retired "there is no built-in purge command" claim in official-guidance.md is correctly replaced — claude project purge does exist now, and the new wording ("no auto-memory-only built-in command") is accurate.
  • Scope/framing is otherwise consistent across all four touched files, and the diff doesn't touch any executable step (Steps 2–4's bash fences are untouched), matching the PR's own description.

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 4m 25s —— View job


Code review complete

  • Gather context (PR diff via git diff origin/main...HEAD, REVIEW.md, CLAUDE.md)
  • Review changed files for correctness, design, conventions, maintainability
  • Post findings

Scope reviewed: all 10 files changed vs origin/main in plugins/claude-memory/. Security is out of scope for this lane per REVIEW.md (this repo has a claude-security-review workflow); a security pass already ran on an earlier commit of this PR with no findings.

Note on prior review comments: the code-review and Codex bot comments on this PR (21:28–21:33) reviewed an earlier commit (43a037723b) that no longer exists on this branch — the four commits currently on HEAD (573ff10) are a different history. I re-checked their flagged issue independently: the "deletion-scope summary omits per-session tasks//debug//file-history/" finding is already fixed in the current HEAD — all four locations (SKILL.md:24-28, context/purge.md Step 2 and Step 5, reference/official-guidance.md's "Out of scope" quote block) now name that category. No further action needed there.

Fresh-docs verification: per this repo's CLAUDE.md fresh-docs mandate, official-guidance.md/criteria.md are prose-body edits (out of the mandate's contract-surface scope), but I re-fetched code.claude.com/docs/en/memory this session anyway to check the new quotes in plugins/claude-memory/skills/audit/reference/official-guidance.md. All verified byte-accurate: the frontmatter/HTML-comment-stripping quote (lines 183-184), the @import "four hops" correction, the autoMemoryDirectory any-settings-scope + workspace-trust-dialog wording, and the "Set up a project CLAUDE.md" section-title attribution all match the live page verbatim.

memory-dir-stats.sh: traced the new strip_unloaded awk logic (frontmatter strip, fence-aware HTML-comment strip) by hand against the new test fixture in memory-dir-stats.test.sh (Case 4b) — output matches the asserted 5 lines / 35 bytes. Test coverage for the new --memory-bytes mode and the strip behavior (comment inside vs. outside a fence, absent-file, empty-dir) looks complete.

🟡 Nit — stale "re-fetch both/two source pages" pointer, now more wrong than before

This PR adds a 4th source page (claude-directory) to reference/official-guidance.md's source list, but two nearby pointers that predate this PR still say "two"/"both":

  • reference/official-guidance.md:9 — "Refresh this file from current official docs before relying on it (re-fetch both pages)." sits directly below a 4-entry Sources list (lines 4-7) this PR just grew from 3 to 4.
  • SKILL.md:31 — "re-fetch the two source pages if a fact is load-bearing" has the same count.

This was already stale before this PR (3 sources, not 2), but since this PR is the one that touched the Sources line and pushed it to 4, it's a good place to fix both counts (or reword to "the source pages," dropping the number so it can't drift again).

Fix this →

Everything else

  • CHANGELOG.md's 0.5.5 → 0.5.6 versioning gap against PR docs(claude-memory): re-align auto-memory reference facts with live memory doc #1933's unmerged 0.5.5 is unchanged from the earlier disclosed status — still a real campaign-coordination item, not new.
  • plugin.json version (0.5.6), criteria.md version (1.5.1), and the changelog entries' descriptions accurately match their respective diffs.
  • Scope/framing across SKILL.md, context/purge.md, and reference/official-guidance.md (stateless) is internally consistent, and the executable bash fences in purge.md (Steps 2-4) are untouched.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 11s —— View job


Security review complete

  • Gather context (gh pr diff / git diff origin/main...HEAD)
  • Review changed files for security issues
  • Post findings

Scope reviewed: all 10 files changed in this PR (git diff origin/main...HEAD against HEAD 573ff10), spanning plugins/claude-memory/: plugin.json (version bump), CHANGELOG.md, skills/audit/{SKILL.md, reference/criteria.md, reference/official-guidance.md, scripts/memory-dir-stats.sh, scripts/memory-dir-stats.test.sh}, skills/stateless/{SKILL.md, context/purge.md, reference/official-guidance.md}.

Findings: none

This is a documentation-and-test PR with one small shell-script change; no logic, authorization, injection, secrets-handling, or GitHub Actions surface is touched:

  • 9 of 10 files are pure prose/version-bump edits (SKILL.md, reference docs, CHANGELOG.md, plugin.json). They only add pointers to the official claude project purge command and correct stale doc facts (@import depth, autoMemoryDirectory scope behavior, MEMORY.md strip-before-measure semantics). No executable content, no new scripts, no config/permission changes, and no .github/ workflow touched.
  • skills/audit/scripts/memory-dir-stats.sh (the only executable change) adds a --memory-bytes mode and a strip_unloaded() awk/tr pipeline that strips YAML frontmatter and block-level HTML comments before counting lines/bytes of MEMORY.md.
    • $index is built entirely from $memory_dir (resolved via the unmodified sibling resolve-memory-dir.sh) concatenated with the literal MEMORY.md — not attacker-influenced, not eval'd, and only ever used inside a quoted redirection (<"$index"), so there's no command- or path-injection surface.
    • $mode stays gated by the existing strict allow-list check (--md-count/--memory-lines/--memory-bytes/usage-and-exit-2` otherwise) — the new branch doesn't loosen that.
    • The output contract (single integer, always exit 0 on data paths) is preserved, and this script is invoked by SKILL.md's pre-computed-context line the same way as before — no new trust boundary crossed.
  • memory-dir-stats.test.sh only adds fixture/assertion coverage for the new mode — no execution-path changes.
  • The prior code-review pass (comment above, and Codex's inline official-guidance.md:127 note) flagged that the purge-scope prose summaries omitted the "per-session tasks//debug//file-history/" deletion category in 4 spots. Verified that HEAD (573ff10) already carries the fix in all four: SKILL.md:26, context/purge.md:65, reference/official-guidance.md:135 (quote block), and the corresponding context/purge.md Step 5 follow-through text — this is now consistent with the live code.claude.com/docs/en/claude-directory page.

No injection surfaces, auth/access-control changes, secret handling, permission-widening, or dangerous CI patterns are introduced by this diff.

@kyle-sexton
kyle-sexton changed the base branch from main to docs/row127-memory-doc-alignment August 5, 2026 00:57
kyle-sexton added a commit that referenced this pull request Aug 5, 2026
…size gate

`strip_unloaded()` treated a line-1 `---` as frontmatter and skipped to a
closing `---` that need not exist, so a leading thematic break or frontmatter
clipped mid-file discarded the whole file and reported 0 lines / 0 bytes. M1 is
a [FAIL]-severity size check and 0 passes it, so the gate could not fire. An
unclosed `<!--` swallowed the file the same way. MEMORY.md carries frontmatter
by design — Claude Code stamps a `modified` field into any memory file that has
it — so this is a live shape, not a corner case.

An opening delimiter is now held rather than dropped and flushed at EOF when it
never closes, which counts the whole file exactly as a reader following
criteria.md would. One mechanism covers both block kinds.

Two further strip defects, same function: the fence rules ran before the
comment rule, so a fence inside a comment toggled fence state and leaked the
commented-out body back into the count; and a line sharing space with a
comment's open or close was dropped whole, losing real content.

criteria.md M1 now states the four readings the strip applies and marks them as
this plugin's reading, not doc-derived. The memory doc states the fenced-code
carve-out under "How CLAUDE.md files load" and says nothing either way for
MEMORY.md, so the previous "per the documented comment behavior" was an
inference presented as a citation. Byte counts are LF-normalized; that
assumption is now recorded rather than silent.

official-guidance.md's `Last researched` date scopes the 2026-08-04 re-verify to
the memory page, the only source this PR re-checked.

Version stays 0.5.5 / criteria 1.5.1: 0.5.5 is unmerged and its changelog entry
is this PR's own, so amending it is not a version event. #1947 keeps 0.5.6.

Tests: 29/29 pass, including regressions for each defect above. ShellCheck exit 0.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 4m 35s —— View job


Code review complete

  • Gather context (git diff 8664a65..1169bef — the merge-base for origin/docs/row127-memory-doc-alignment...HEAD, since the shallow clone can't resolve the three-dot range directly; confirmed it matches the PR's stated 5 files / +66/-9)
  • Review changed files for correctness, design, conventions, maintainability
  • Post findings

Scope reviewed: the 5 files this PR changes relative to origin/docs/row127-memory-doc-alignment (e597abc): plugin.json, CHANGELOG.md, skills/stateless/{SKILL.md, context/purge.md, reference/official-guidance.md}. Security is out of scope for this lane per REVIEW.md (this repo runs claude-security-review); prior security passes on this PR found nothing, and this diff since then is prose-only.

I re-verified the previously-flagged deletion-scope omission (Codex + earlier review passes): confirmed fixed — all four categories from the live claude-directory doc now appear everywhere the scope is stated, and the earlier "two source pages" / "both pages" nit is also now fixed (SKILL.md:31, official-guidance.md:10-11 both say "the source pages listed there" / "every source listed above"). No further action on either.

Diffing the newest commit (1169bef) against the previously-reviewed one (573ff10) to scope this pass to what's new turned up two issues in the row-split it made to SKILL.md's scope table:

🔴 Important — broken sentence in the Transcripts scope-table row

SKILL.md:41:

claude project purge (v2.1.124+) deletes this project's now

This is missing a word after "project's" — an incomplete sentence, most likely dropped while splitting the old single "Transcripts / history / sessions / snapshots" row into four (visible in the 573ff101169bef diff: the old row read "...immediate full wipe: claude project purge (v2.1.124+)", cleanly worded, and the split introduced this fragment). This table is exactly the text a user/agent reads to learn what claude project purge deletes — the same purpose the earlier-fixed omission mattered for — so a garbled clause here undercuts the PR's own goal.

Fix this →

🟡 Nit — reference file still makes the blanket claim the split was meant to correct

This PR's own CHANGELOG.md "Fixed" entry says the old single scope-table row was wrong because it applied one cleanupPeriodDays-sweep verdict to four different entities, and that only transcripts (not history.jsonl, not sessions/) actually match it. SKILL.md's new rows 41-44 reflect that correctly. But reference/official-guidance.md:125-128 — pre-existing text this PR didn't touch — still opens with the same blanket claim it names as wrong elsewhere:

Transcripts / history / shell snapshots / sessions. Session files are auto-cleaned at startup by cleanupPeriodDays...

SKILL.md tells readers this reference file is where "what it does and does not delete is quoted verbatim" — so the source of truth still states the generalization the PR's own changelog and scope-table split just refuted for two of the four items in that list.

Fix this →

Everything else

  • purge.md Step 2 and Step 5 correctly point at the reference file's verbatim quote instead of restating the scope — no drift-prone third copy introduced.
  • CHANGELOG.md's new [0.5.6] "Changed" and "Fixed" entries accurately describe the diff (verified against the actual row-split and pointer changes).
  • plugin.json version bump (0.5.50.5.6) is consistent with the changelog; the 0.5.5-doesn't-exist-yet coordination gap against docs(claude-memory): re-align auto-memory reference facts with live memory doc #1933 is unchanged from what's already disclosed in the PR description, not a new issue.
  • The claude-directory verbatim quote block (official-guidance.md:133-140) is unchanged from the prior review pass and remains accurate.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 32s —— View job


Security review complete

  • Gather context (git show/diff for both commits on this PR, verified against reported diff stats)
  • Review changed files for security issues
  • Post findings

Scope reviewed: the 5 files changed by this PR's two commits (573ff10, 1169bef) against their parent — verified the combined diff matches the PR's reported stats exactly (66 additions / 9 deletions across plugin.json, CHANGELOG.md, skills/stateless/SKILL.md, skills/stateless/context/purge.md, skills/stateless/reference/official-guidance.md):

  • plugins/claude-memory/.claude-plugin/plugin.json — version bump only (0.5.50.5.6).
  • plugins/claude-memory/CHANGELOG.md — new [0.5.6] entry, prose only.
  • plugins/claude-memory/skills/stateless/SKILL.md — scope statement + table gains a pointer to claude project purge and splits one merged row into four.
  • plugins/claude-memory/skills/stateless/context/purge.md — adds narrative bullets to Step 2 (pre-gate) and Step 5 (follow-through) pointing at claude project purge.
  • plugins/claude-memory/skills/stateless/reference/official-guidance.md — extends the Sources list, retires a now-false "no purge command" claim, and adds a verbatim quote block of the command's deletion scope.

Findings: none

This is a pure documentation/prose PR — no executable surface changes:

  • No code fences were touched. purge.md's Steps 2–4 (manifest capture, backup, delete) and Step 3's confirmation gate are byte-identical to the base; the diff only adds narrative bullets outside any executable block. Nothing in this PR causes the skill to auto-invoke claude project purge — it only tells the user/agent the command exists and where its authoritative scope is documented.
  • No secrets, credentials, or tokens appear in any of the five files.
  • No GitHub Actions workflows, hooks, settings, or permission scopes are touched.
  • No injection surface. The new content is static markdown (prose bullets and a blockquote); none of it is interpolated into a shell command, path, or template anywhere in the skill.
  • URL added is the legitimate official domain (code.claude.com/docs/en/claude-directory), consistent with the other three sources already cited in the same file — no typosquat/redirect risk.
  • plugin.json's version bump is a plain string change with no schema or permission implications.

No injection surfaces, auth/access-control changes, secret handling, permission-widening, or dangerous CI patterns are introduced by this diff.

@kyle-sexton
kyle-sexton force-pushed the docs/row74-project-purge-pointer branch from 1169bef to 51806cd Compare August 5, 2026 05:12
@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 2s —— View job


Code review complete

  • Gather context (git diff origin/docs/row127-memory-doc-alignment...HEAD, CLAUDE.md, REVIEW.md)
  • Review changed files for correctness, design, conventions, maintainability
  • Verify previously-flagged issues (broken sentence, blanket-claim nit) status on current HEAD
  • Post findings

Scope reviewed: the 5 files this PR changes relative to origin/docs/row127-memory-doc-alignment (confirmed diff stats match the PR description exactly: +66/-9 across plugin.json, CHANGELOG.md, skills/stateless/{SKILL.md, context/purge.md, reference/official-guidance.md}). Security is out of scope for this lane per REVIEW.md (this repo runs claude-security-review); prior security passes on this PR found nothing, and nothing security-relevant has changed since.

This PR was rebased since the last review pass, so old commit SHAs (573ff10, 1169bef) no longer exist — current HEAD is 51806cd. I re-verified the previously-flagged issues against the current content rather than trusting their prior "fixed" status:

🔴 Important — broken sentence survives the rebase

SKILL.md:41:

claude project purge (v2.1.124+) deletes this project's now

This is the same incomplete sentence flagged in the previous review pass (missing a word after "project's" — most likely "transcripts too", matching the official-guidance.md quote "Transcripts and auto memory under projects/"). It was flagged against commit 1169bef, and it's still present verbatim at current HEAD 51806cd — the rebase carried the bug forward unchanged. This is exactly the row this PR's own CHANGELOG.md "Fixed" entry describes as needing correction (the four-row split replacing the old merged "Transcripts / history / sessions / snapshots" row), so a garbled clause here undercuts the PR's stated purpose: this table is what a user/agent reads to learn what claude project purge does and doesn't delete.

Fix this →

🟡 Nit — reference file's blanket claim still contradicts the PR's own table split

reference/official-guidance.md:125-128 (pre-existing text, not touched by this PR's diff) still opens with:

Transcripts / history / shell snapshots / sessions. Session files are auto-cleaned at startup by cleanupPeriodDays...

This blanket claim is exactly what this PR's own CHANGELOG.md "Fixed" entry and the new SKILL.md scope-table split (lines 41-44) establish as wrong for two of the four items: history.jsonl "persists indefinitely" (not swept), and sessions/ "isn't part of the age-based sweep." SKILL.md tells readers this reference file is where the scope "is quoted verbatim" — so the source of truth still states the generalization the PR's own changelog and table split just refuted. Non-blocking since it's untouched by this diff and was already noted last pass, but since the PR is specifically about scope accuracy, it's a natural fix to bundle here.

Fix this →

Resolved since last pass

  • The 0.5.5-doesn't-exist coordination gap is now moot: origin/docs/row127-memory-doc-alignment (this PR's actual base, per the stacking) already carries [0.5.5] in CHANGELOG.md and "version": "0.5.5" in plugin.json, so 0.5.6 sits directly above it with no gap.
  • The "two source pages" / "both pages" stale-count nit is fixed: SKILL.md:31 and official-guidance.md:10-11 both now say "the source pages listed there" / "every source listed above" instead of counting them.
  • The four-category deletion-scope omission (Codex's original finding) remains fixed everywhere: SKILL.md's table, context/purge.md Steps 2 and 5, and official-guidance.md's verbatim quote block (lines 133-140) all carry or point to the complete four-item list.

Everything else

  • context/purge.md's new bullets in Step 2 (pre-gate) and Step 5 (follow-through) correctly point at the reference file's verbatim quote rather than restating the scope — no third drift-prone copy introduced.
  • CHANGELOG.md's [0.5.6] "Changed" and "Fixed" entries accurately describe the diff.
  • plugin.json's version bump (0.5.50.5.6) is consistent with the changelog.
  • No executable step changes — purge.md Steps 2-4's bash fences and the confirmation gate are untouched, matching the PR's own description.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 48s —— View job


Security review complete

  • Gather context (git diff origin/docs/row127-memory-doc-alignment...HEAD)
  • Review changed files for security issues
  • Post findings

Scope reviewed: the 5 files this PR changes relative to its stated base docs/row127-memory-doc-alignment (e597abc) — confirmed the diff matches the PR's reported stats exactly (66 additions / 9 deletions):

  • plugins/claude-memory/.claude-plugin/plugin.json — version bump only (0.5.50.5.6).
  • plugins/claude-memory/CHANGELOG.md — new [0.5.6] entry, prose only.
  • plugins/claude-memory/skills/stateless/SKILL.md — scope statement gains a pointer to claude project purge; the merged scope-table row is split into four per-entity rows.
  • plugins/claude-memory/skills/stateless/context/purge.md — adds narrative bullets to Step 2 (pre-gate) and Step 5 (follow-through) pointing at claude project purge.
  • plugins/claude-memory/skills/stateless/reference/official-guidance.md — extends the Sources list, retires a now-false "no purge command" claim, adds a verbatim quote block of the command's deletion scope, and fixes stale "two source pages" pointers.

Findings: none

This is a pure documentation PR — no executable surface is touched:

  • No code fences changed. purge.md's Steps 2–4 (manifest capture, backup, delete) and the Step 3 confirmation gate are byte-identical to the base branch; the diff only adds narrative bullets and a blockquote outside any executable block. Nothing in this diff causes the skill to auto-invoke claude project purge — it only tells the user/agent the command exists and where its authoritative scope is documented.
  • No secrets, credentials, or tokens appear in any of the five files.
  • No GitHub Actions workflows, hooks, settings, or permission scopes are touched — the only non-markdown file is plugin.json, and its only change is the version string.
  • No injection surface. The new content is static markdown (prose bullets and a blockquote); nothing is interpolated into a shell command, path, or template anywhere in the skill.
  • URL added is the legitimate official domain (code.claude.com/docs/en/claude-directory), consistent with the three sources already cited in the same file — no typosquat/redirect risk.
  • plugin.json's version bump is a plain string change with no schema or permission implications.

This confirms the same conclusion reached by the prior security-review passes on this PR (at commits 43a037723b, 573ff10, and 1169bef) — the current HEAD (51806cd) adds only a scope-table split and CHANGELOG prose since the last pass, both non-executable.

No injection surfaces, auth/access-control changes, secret handling, permission-widening, or dangerous CI patterns are introduced by this diff.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 10s —— View job


Code review complete

  • Gather context (git diff origin/docs/row127-memory-doc-alignment...HEAD, CLAUDE.md, REVIEW.md)
  • Review changed files for correctness, design, conventions, maintainability
  • Verify previously-flagged issues (broken sentence at SKILL.md:41-42, blanket-claim nit) status on current HEAD
  • Post findings

Scope reviewed: the 5 files this PR changes relative to origin/docs/row127-memory-doc-alignment (confirmed diff matches the PR description: +96/-14 across plugin.json, CHANGELOG.md, skills/stateless/{SKILL.md, context/purge.md, reference/official-guidance.md}). Security is out of scope for this lane per REVIEW.md (this repo runs a claude-security-review workflow); multiple security passes on this PR already found nothing, and nothing security-relevant has changed since.

The latest commit (67d4b94) is itself a self-correction of the CHANGELOG/reference issues raised in the prior review pass. I re-verified against current HEAD rather than trusting prior "fixed" status.

🔴 Important — broken sentence still present after 3 review passes and 2 rebases

SKILL.md:42:

claude project purge (v2.1.124+) deletes this project's now

Still missing a word after "project's" (most likely "transcripts too" — matching the reference file's quote "Transcripts and auto memory under projects/"). This was flagged in three prior review passes (against 1169bef, 51806cd, and now 67d4b94) and has survived two rebases plus the commit that specifically re-fixed the neighboring CHANGELOG/reference-file issues from the same review round — that commit touched SKILL.md (adding the CLAUDE.local.md row split) without touching this line. This is the row a user/agent reads to learn what claude project purge actually deletes, so the garbled clause undercuts the PR's own stated purpose.

Fix this →

Resolved since last pass

  • Blanket-claim nit (reference/official-guidance.md's "Out of scope" section stating one cleanupPeriodDays verdict for all four transcripts/history/snapshots/sessions entities): fixed. The section now splits transcripts+shell-snapshots (swept) from history.jsonl+sessions/ (not swept), backed by two new verbatim quotes, and this now agrees with the SKILL.md table's per-row breakdown.
  • CHANGELOG.md miscounted the fix ("wrong for three of them" when the base state was only wrong for two): corrected in 67d4b94 — now accurately says "wrong for two of them" and separates the purge-scope description (added by this branch, not part of the before-state) from the sweep-claim description.
  • New in this pass, and correctly done: the CLAUDE.md / CLAUDE.local.md / .claude/rules/ scope-table row is split — CLAUDE.local.md has no user-scope equivalent (repo only), while CLAUDE.md and .claude/rules/ correctly retain repo + user. Matches code.claude.com/docs/en/memory's "Just you (current project)" vs. "Personal rules ... every project" distinction, and the CHANGELOG.md entry describing it is accurate.

Everything else

  • The four-category deletion-scope omission (Codex's original finding) remains fixed everywhere: SKILL.md's table, context/purge.md Steps 2 and 5, and official-guidance.md's verbatim quote block all carry or point to the complete four-item list.
  • The "two source pages" / "both pages" stale-count nit remains fixed (SKILL.md:31, official-guidance.md:10-11).
  • context/purge.md's Step 2/Step 5 bullets correctly point at the reference file's verbatim quote rather than restating scope — no third drift-prone copy introduced. Executable bash fences (Steps 2-4) and the confirmation gate are untouched.
  • plugin.json's version bump (0.5.50.5.6) is consistent with the changelog; 0.5.5 now exists on the PR's actual base branch, so the earlier disclosed version-gap concern is moot.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 11s —— View job


Security review complete

  • Gather context (git diff origin/docs/row127-memory-doc-alignment...HEAD)
  • Review changed files for security issues
  • Post findings

Scope reviewed: the 5 files this PR changes relative to its stated base docs/row127-memory-doc-alignment (e597abc) — confirmed the diff matches the PR's reported stats exactly (+96/-14):

  • plugins/claude-memory/.claude-plugin/plugin.json — version bump only (0.5.50.5.6).
  • plugins/claude-memory/CHANGELOG.md — new [0.5.6] entry, prose only.
  • plugins/claude-memory/skills/stateless/SKILL.md — scope statement gains a claude project purge pointer; the merged scope-table row is split into four per-entity rows.
  • plugins/claude-memory/skills/stateless/context/purge.md — adds narrative bullets to Step 2 (pre-gate) and Step 5 (follow-through) pointing at claude project purge.
  • plugins/claude-memory/skills/stateless/reference/official-guidance.md — extends the Sources list, retires a now-false "no purge command" claim, adds verbatim quote blocks for the command's deletion scope and the history.jsonl/sessions/ sweep behavior.

Findings: none

This is a pure documentation PR — no executable surface is touched:

  • No code fences changed. purge.md's Step 2 and Step 5 additions are narrative bullets (- If the intent is...) outside any bash fence; Steps 2–4's execution blocks and the Step 3 confirmation gate remain untouched from the base branch. Nothing in this diff causes the skill to auto-invoke claude project purge — it only tells the user/agent the command exists and points at the authoritative doc for its scope.
  • No secrets, credentials, or tokens appear in any of the five files.
  • No GitHub Actions workflows, hooks, settings, or permission scopes are touched — the only non-markdown file is plugin.json, and its only change is the version string.
  • No injection surface. All new content is static markdown (prose bullets and blockquotes); nothing is interpolated into a shell command, path, or template anywhere in the skill.
  • URLs added are the legitimate official domain (code.claude.com/docs/en/claude-directory), consistent with the three sources already cited in the same file — no typosquat/redirect risk.
  • plugin.json's version bump is a plain string change with no schema or permission implications.

This is consistent with every prior security-review pass on this PR (at commits 43a037723b, 573ff10, 1169bef, and 51806cd) — the diff since the last pass adds only quote-block prose to official-guidance.md and a Last researched date update, both non-executable.

No injection surfaces, auth/access-control changes, secret handling, permission-widening, or dangerous CI patterns are introduced by this diff.

@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 3m 10s —— View job


Security review complete

  • Gather context (git diff against the exact merge-base with docs/row127-memory-doc-alignment, verified against PR's reported diffstat)
  • Review changed files for security issues
  • Post findings

Scope reviewed: all 5 files this PR changes relative to its base (confirmed the diff matches the PR's reported stats exactly — 146 additions / 25 deletions):

  • plugins/claude-memory/.claude-plugin/plugin.json — version bump only (0.5.50.5.6).
  • plugins/claude-memory/CHANGELOG.md — new [0.5.6] entry, prose only.
  • plugins/claude-memory/skills/stateless/SKILL.md — scope statement gains a claude project purge pointer; the merged scope-table row is split into four per-entity rows.
  • plugins/claude-memory/skills/stateless/context/purge.md — adds narrative bullets to Step 2 (pre-gate) and Step 5 (follow-through) pointing at claude project purge.
  • plugins/claude-memory/skills/stateless/reference/official-guidance.md — extends the Sources list, retires a now-false "no purge command" claim, and adds verbatim quote blocks for the command's deletion scope and the history.jsonl/sessions/ sweep behavior.

Findings: none

This remains a pure documentation PR — no executable surface is touched, and nothing has changed in that respect since the prior security-review passes on this PR:

  • No code fences changed. purge.md's Step 2 and Step 5 additions are narrative bullets (- If the intent is...) outside any bash fence; Steps 2–4's execution blocks and the Step 3 confirmation gate are byte-identical to the base branch. Nothing in this diff causes the skill to auto-invoke claude project purge — it only tells the user/agent the command exists and points at the authoritative doc for its scope.
  • No secrets, credentials, or tokens appear in any of the five files.
  • No GitHub Actions workflows, hooks, settings, or permission scopes are touched — the only non-markdown file is plugin.json, and its only change is the version string.
  • No injection surface. All new content is static markdown (prose bullets and blockquotes, several of them verbatim doc quotes); nothing is interpolated into a shell command, path, or template anywhere in the skill.
  • URLs added are the legitimate official domain (code.claude.com/docs/en/claude-directory), consistent with the sources already cited in the same file — no typosquat/redirect risk.
  • plugin.json's version bump is a plain string change with no schema or permission implications.

This is consistent with every prior security-review pass on this PR (at commits 43a037723b, 573ff10, 1169bef, 51806cd, and 67d4b94) — the diff since the last pass adds only more verbatim quote-block prose to official-guidance.md (sweep-behavior quotes for history.jsonl/sessions/, a CLAUDE_CODE_SKIP_PROMPT_HISTORY quote) and a Last researched date update, both non-executable.

No injection surfaces, auth/access-control changes, secret handling, permission-widening, or dangerous CI patterns are introduced by this diff.

(Note: the correctness issues flagged in prior code-review passes — e.g. the incomplete sentence at SKILL.md:42 — are outside this security lane's scope and are not re-reported here.)

kyle-sexton added a commit that referenced this pull request Aug 5, 2026
…emory doc (#1933)

## Summary

Row-127 doc-alignment pass: every shipped `claude-memory` assertion
about the auto-memory / project-memory page was verified against the
live doc (https://code.claude.com/docs/en/memory, fetched 2026-08-04,
35,136 bytes, sha256 `7440c455…`). Most claims are current; this PR
corrects the ones that drifted.

- `skills/audit/reference/official-guidance.md`
- `@import` recursion depth: 5 hops → 4 hops (live: "maximum depth of
four hops").
- `autoMemoryDirectory`: replaced the stale "user or local settings
only; not accepted from project settings" claim with the live behavior —
read from any settings scope (user, project, local, policy,
`--settings`), with project/local values honored only after the
workspace trust dialog.
- Quote attribution: "Project memory" section no longer exists; now
cites "Set up a project CLAUDE.md".
- Added the backing quote for the MEMORY.md limit check measuring
stripped content.
- `skills/audit/reference/criteria.md` (1.5.0 → 1.5.1): M1 now measures
the content that loads — YAML frontmatter and block-level HTML comments
are stripped before the index loads and don't count toward the
200-line/25KB limits.
- `skills/audit/scripts/memory-dir-stats.sh`: `--memory-lines` measures
post-strip loaded content instead of raw `wc -l`, and a new
`--memory-bytes` mode covers the 25KB limb; covered by
`memory-dir-stats.test.sh`.
- `skills/audit/SKILL.md`: scope table now states the 25KB limb of the
MEMORY.md load limit alongside the 200-line one, and the pre-computed
context reports both post-strip figures so M1 never disagrees with its
own injected stats.
- Version: claude-memory 0.5.4 → 0.5.5, with CHANGELOG entry.

Serialization note: this PR was rebased onto current `main` after the
row-60 work landed. Row 60 shipped as #1932 at claude-memory 0.5.4 /
criteria 1.5.0 (commit `f668526f7`), which is the `main` this branch now
sits on, so this PR takes the next free literals — 0.5.5 / criteria
1.5.1. #1947 (row 74, `stateless` skill) is the only other open
claude-memory PR and already claims 0.5.6; it is now rebased on top of
this branch and does not touch `skills/audit/reference/criteria.md`.

## Post-rebase CI fix (`8664a65647`)

The rebased head failed the `hygiene` check. Root cause: the post-strip
test fixture wrote its literal markdown code fence inside a
single-quoted `printf` format, and ShellCheck reads backticks in single
quotes as an unexpanded command substitution (SC2016). The repo's gate
invokes ShellCheck with an empty severity setting — ShellCheck's default
`style` level — so the info-level finding failed CI rather than being
advisory.

Fixed by writing the fixture with double quotes and escaped backticks,
which produces byte-identical output (verified by md5) and keeps the
file's existing `printf` convention rather than introducing a second
fixture-writing mechanism. No `# shellcheck disable` was added.

Verified locally on the final head:

- `shellcheck --rcfile=.shellcheckrc` over both scripts — exit 0, no
findings.
- `bash memory-dir-stats.test.sh` — **all 23 checks passed**, including
the post-strip line and byte assertions. Both earlier review passes
noted they could not execute this suite in the CI sandbox and asked for
a local run; this is that run.

## Strip correctness fix (`e597abcd95`) — the M1 gate could not fire

An independent verifier pass found that the post-strip measurement
shipped earlier in this PR had a hole that inverted the check it was
meant to sharpen.

`strip_unloaded()` treated a line-1 `---` as opening YAML frontmatter
and skipped every line until a closing `---`. When no closing `---`
exists, the whole file was discarded:

```
"---\ntype: index\n# Title\nreal\n"    ->  lines=0 bytes=0
"---\n# Title\nreal one\nreal two\n"   ->  lines=0 bytes=0
```

M1 is a `[FAIL]`-severity size gate and **0 always passes it**, so any
index with frontmatter clipped mid-file — or a leading `---` used as a
thematic break — silently disarmed the gate. The memory doc notes Claude
Code stamps a `modified` frontmatter field into any memory file that
already has frontmatter, so MEMORY.md is frontmatter-bearing by design;
this is a live shape. An unclosed `<!--` swallowed the file the same
way.

Fixed by holding an opening delimiter's lines and flushing them at EOF
when it never closes, so an unterminated block is counted as the content
it is — matching what a reader following `criteria.md` counts. One
mechanism covers both block kinds.

Two further defects in the same function, found while fixing the first:

- The fence rules ran before the comment rule, so a fence **inside** a
comment toggled fence state and leaked the commented-out body back into
the count.
- A line sharing space with a comment's open or close was dropped whole,
losing real content.

**Provenance correction.** The fenced-code carve-out was justified in
the script header as "per the documented comment behavior". Re-fetching
the live page shows that sentence sits under **How CLAUDE.md files
load**, while the MEMORY.md limit paragraph under **How it works** says
only that frontmatter and block-level HTML comments are stripped — the
doc is silent on the carve-out for MEMORY.md. The behavior is kept (a
comment inside a fence is code, not block-level markdown), but
`criteria.md` M1 now records it, together with the unterminated-block
rule, the partial-line rule, and the `--memory-bytes` LF-normalization
assumption, under a `**Provenance**:` note marking them as this plugin's
reading rather than doc-derived.

Also: `official-guidance.md`'s `Last researched` line now scopes the
2026-08-04 re-verify to the memory page, the only source this PR
re-checked, instead of implying the whole source list was refreshed.

**Version stays 0.5.5 / criteria 1.5.1.** 0.5.5 is unmerged and its
CHANGELOG entry is this PR's own, so amending it is not a version event;
#1947 keeps 0.5.6 and no re-stack is needed.

Verified on `e597abcd95`: ShellCheck exit 0, **29/29 tests pass** (a
regression test per defect), markdownlint clean, all 32 CI checks green
and `MERGEABLE` / `CLEAN`.

No linked issue

## Related

- Source of truth: https://code.claude.com/docs/en/memory ("How Claude
remembers your project")
- Doc-alignment campaign roster row 127 (claude-memory vs the memory
page); supporting facts cross-checked against the live settings,
env-vars, and claude-directory pages the reference files cite.
- Serialization predecessor: #1932 (roster row 60, claude-memory 0.5.4 /
criteria 1.5.0), now on `main`.
- Stacked successor: #1947 (roster row 74, claude-memory 0.5.6), based
on this branch.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- linkage revalidated under v0.10.2 -->

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Base automatically changed from docs/row127-memory-doc-alignment to main August 5, 2026 20:17
kyle-sexton and others added 4 commits August 5, 2026 16:19
…rge command

`claude project purge` wipes a project's transcripts and auto memory under
projects/, its per-session tasks/, debug/, and file-history/ entries, its matching
history.jsonl lines, and its ~/.claude.json entry; the stateless skill deliberately
stops at auto memory, so a user who asks to wipe what Claude saved about a repo
needs the broader route named. Pointer, not a copy of its flags: the reference
file quotes the doc's deletion list verbatim and the other call sites cite it.

Doc-alignment row 74. Version 0.5.6 sits above #1933's 0.5.5; this branch is
stacked on #1933 and merges after it.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… the scope table

The prior commit named `claude project purge` at four call sites and restated
its deletion scope at each, so the plugin carried four hand-maintained copies of
an upstream list. Keep the verbatim quote in reference/official-guidance.md and
turn every other mention into a pointer.

Split the merged `Transcripts / history / sessions / snapshots` scope row, whose
single verdict was true only of transcripts: `history.jsonl` is "not covered by
automatic cleanup", `sessions/` "isn't part of the age-based sweep" and is
absent from the deletion list, and `shell-snapshots/`/`backups/` are swept but
left alone by the command because they are not project-scoped.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…s merged sweep claim

The changelog counted the old merged row's wrong subjects against an
intermediate state of this branch rather than against the PR base. At the base
the row asserted only `cleanupPeriodDays`, which is true of transcripts and
shell snapshots and false for `history.jsonl` and `sessions/` — two wrong, not
three. The purge half it also described was added by this branch's own first
commit, so it was never part of the before-state.

reference/official-guidance.md still stated the sweep for all four entities as
one fact, which is the same defect the entry claims to fix — and SKILL.md now
designates that file as the single source for purge scope, so the pointer chain
led from a corrected table to an uncorrected reference. Split it and add the
two backing quotes.

Also: `CLAUDE.local.md` has no user-scope equivalent, so it no longer shares a
`repo + user` location cell with CLAUDE.md and `.claude/rules/`; and the
`CLAUDE_CODE_SKIP_PROMPT_HISTORY` note no longer refers to a "future skill"
that this branch's edit had removed.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
The stateless skill designates reference/official-guidance.md as the single
source for `claude project purge`'s scope, but only the positive deletion list
was quoted there, leaving the negative half the skill ships unsourced. The
claude-directory doc states both halves, so the leaves-alone sentence and the
confirmation-prompt sentence are now quoted and attributed beside the deletion
list, making SKILL.md's "does and does not delete" claim true and purge.md's
operator instruction answerable. Also replaces three quotes attributed to the
settings doc whose wording was not on that page — the substance was right in
all three cases, the quotation fidelity was not.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@kyle-sexton
kyle-sexton force-pushed the docs/row74-project-purge-pointer branch from f957eec to d068889 Compare August 5, 2026 20:23
@claude

claude Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 53s —— View job


Security review complete

  • Gather context (git diff origin/main...HEAD, confirmed against PR's reported diffstat)
  • Review changed files for security issues
  • Post findings

Scope reviewed: all 5 files this PR changes vs origin/main — confirmed the diff matches the PR's reported stats exactly (146 additions / 25 deletions):

  • plugins/claude-memory/.claude-plugin/plugin.json — version bump only (0.5.50.5.6).
  • plugins/claude-memory/CHANGELOG.md — new [0.5.6] entry, prose only.
  • plugins/claude-memory/skills/stateless/SKILL.md — scope statement gains a claude project purge pointer; the merged scope-table row is split into four per-entity rows.
  • plugins/claude-memory/skills/stateless/context/purge.md — adds narrative bullets to Step 2 (pre-gate) and Step 5 (follow-through) pointing at claude project purge.
  • plugins/claude-memory/skills/stateless/reference/official-guidance.md — extends the Sources list, retires a now-false "no purge command" claim, and adds verbatim quote blocks for the command's deletion scope and the history.jsonl/sessions/ sweep behavior.

Findings: none

This remains a pure documentation PR — no executable surface is touched, and nothing has changed in that respect since the prior security-review passes on this PR:

  • No code fences changed. purge.md's Step 2 and Step 5 additions are narrative bullets (- If the intent is...) outside any bash fence; Steps 2–4's execution blocks and the Step 3 confirmation gate are byte-identical to origin/main. Nothing in this diff causes the skill to auto-invoke claude project purge — it only tells the user/agent the command exists and points at the authoritative doc for its scope.
  • No secrets, credentials, or tokens appear in any of the five files.
  • No GitHub Actions workflows, hooks, settings, or permission scopes are touched — the only non-markdown file is plugin.json, and its only change is the version string.
  • No injection surface. All new content is static markdown (prose bullets and blockquotes, several of them verbatim doc quotes); nothing is interpolated into a shell command, path, or template anywhere in the skill.
  • URLs added are the legitimate official domain (code.claude.com/docs/en/claude-directory, code.claude.com/docs/en/settings), consistent with the sources already cited in the same file — no typosquat/redirect risk.
  • plugin.json's version bump is a plain string change with no schema or permission implications.

This is consistent with every prior security-review pass on this PR (at commits 43a037723b, 573ff10, 1169bef, 51806cd, 67d4b94, and the prior d068889 pass) — the diff at current HEAD hasn't changed since the last security pass.

No injection surfaces, auth/access-control changes, secret handling, permission-widening, or dangerous CI patterns are introduced by this diff.

(Note: correctness/prose issues from prior code-review passes are outside this security lane's scope and are not re-reported here.)

@kyle-sexton
kyle-sexton merged commit 7b2407c into main Aug 5, 2026
34 checks passed
@kyle-sexton
kyle-sexton deleted the docs/row74-project-purge-pointer branch August 5, 2026 20:31
kyle-sexton added a commit that referenced this pull request Aug 5, 2026
…lock would swallow (#1962)

Follow-up to #1933 (work-items row 127, campaign ledger #1941). #1933
shipped the M1 index-size measurement fixes for `memory-dir-stats.sh`;
this closes the last under-count residual that surfaced during its gate
review, after the PR had already merged.

No linked issue — the residual was found by #1933's own gate review
rather than filed as an issue, and the campaign ledger it belongs to
stays open past this PR.

## The bug

`memory-dir-stats.sh` admitted `#` lines to its frontmatter grammar. A
`MEMORY.md` that opens with a `---` thematic break, carries heading
lines, and reaches any later `---` therefore had the whole span stripped
as frontmatter:

```
---
# heading one
# heading two
---
body
```

Raw 5 lines / 41 bytes, reported **1 line / 5 bytes**.

M1 is a `[FAIL]`-severity size gate, and a low count always passes it,
so the shape disarmed the gate outright rather than merely mismeasuring
it. This is the same failure species #1933 exists to eliminate — silent
under-count on the gate — reached through the frontmatter grammar
instead of the comment strip.

A `#` line is a comment to YAML but a **heading** to markdown, and
headings are loaded content. The grammar now accepts only blank lines
and `key:` mapping entries.

## Evidence

Measured against `origin/main`'s script and this branch's, same
fixtures:

| fixture | 0.5.6 | 0.5.7 |
|---|---|---|
| 5-line heading pseudo-block | 1 line / 5 bytes | 5 / 41 (raw) |
| 20 headings + later `---` (23 lines) | 1 line / 5 bytes | 23 / 123
(raw) |
| genuine `key:`-only frontmatter | 1 / 5 | 1 / 5 (still strips) |
| genuine frontmatter with a `# note` | 1 / 5 | 6 / 44 (raw) |

The bound is capped at `fmcap` (20) lines, so the worst case was ~22
content lines — 11% of the 200-line budget — never a full disarm of the
line limb, but enough to make a five-line index report one.

## The cost, stated plainly

A real YAML comment inside frontmatter now ends the block, and ending it
strips **nothing at all**: the opening `---`, every entry held so far,
and the rest of the block through its close all count. That is an
over-count, the direction M1's readings already guess toward — it can
make the gate fire early, never fail to fire. It takes a hand-edited
index to reach, since Claude Code only stamps a `modified` scalar into
frontmatter a file already has. Comments join an existing class rather
than opening a new one: frontmatter this grammar cannot parse already
ended the block before this change, and a block sequence under `tags:`
still does.

`criteria.md` M1 reading 1 records both halves.

## Verification

- Full suite **60/60, exit 0** — run in this worktree off current
`main`.
- Fresh-context verifier, rationale withheld, **PASS on all six
criteria** (suite; heading fixture reports raw; `key:`-only frontmatter
still strips; comment/fence behavior unregressed; no `#` alternation
left in the executed awk; version + changelog hygiene). It derived every
expectation from the awk before looking at output, and added its own
mutation check — running `origin/main`'s pre-fix script side by side to
confirm the fix is load-bearing and the numbers above reproduce.

## Versions

`claude-memory` 0.5.6 → **0.5.7** (0.5.5 → 0.5.6 landed via #1947);
`criteria.md` 1.5.1 → **1.5.2**; CHANGELOG entry under `[0.5.7]`.

## Related

- #1933 — predecessor, merged. Shipped the M1 measurement fixes
(frontmatter bounding, greedy-comment fix, comment re-scan) this builds
on; the residual fixed here was found during its gate review. Not closed
by this PR.
- #1941 — campaign ledger tracking work-items row 127 and its siblings.
Stays open past this PR.
- #1947 — carried `claude-memory` 0.5.5 → 0.5.6, the version this PR
bumps from. Reference only.

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant