Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-06 · high
Version 13.24.0's manifest said one thing, its bundled scripts said another, and the mismatch sent the background worker into a kill and respawn loop on every hook event.
Why now: The fix went up September 5 and the underlying mismatch reached the research corpus the next day.
claude-mem's worker process checks its own version before it runs. In v13.24.0, that check broke.
The release bumped every manifest to 13.24.0, but the build never re-ran. The committed plugin/scripts/*.cjs files still held 13.23.1 bytes, baked-in __DEFAULT_PACKAGE_VERSION__ constant included. Claude Code's marketplace installs straight from the repo via .claude-plugin/marketplace.json, so there's no packaging step to catch a mismatch like this before it reaches a user's machine.
Once installed, ensureWorkerRunning() compared the plugin-cache directory version (13.24.0) against the version string baked into the worker file (13.23.1). They didn't match, so the function SIGKILLed the running worker and respawned it. The respawned worker was the same stale file, so the version check failed again on the very next hook event. Kill, respawn, kill, respawn, taking down whatever observer process was mid-run each time.
v13.24.1, released September 5, rebuilds the bundles so the manifest and the code finally agree.
The specific bug is fixed. The pattern that caused it isn't unique to claude-mem. Any plugin that commits pre-built output instead of building at install time is one skipped build step away from shipping a manifest that lies about what's actually running. A version check that trusts a string baked into a file, instead of checking the file's actual behavior, will keep failing the same way for anyone who copies the pattern.
Each link below shares sources, entities, or timing with this story.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
Grep and Glob had the same gap, and the release also blocks project settings from logging raw API request bodies.
The mirror syncs nightly from Anthropic's internal review queue, and every plugin in it already cleared automated security scanning before listing.
v13.24.1 fixes it, and the failure mode generalizes to any Claude Code plugin distributed as committed build artifacts. The manifest bumped to 13.24.0 but the build never re-ran, so the committed .cjs files still carried 13.23.1 bytes. ensureWorkerRunning() compared the plugin...
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
The open-source tool now sits at 98.9k GitHub stars and pairs a skill with a proxy that compresses code, logs and JSON before they hit the model.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.