claude-code: skill bodies and harness-injected blocks are retained as user conversation

[runbgp]

Problem

The Claude Code integration retains content the harness injects into user turns as if the user had written it. Two cases:

1. Skill bodies. When a skill is invoked, Claude Code records the full SKILL.md as an ordinary user message beginning Base directory for this skill: <path>. Auto-retain sends it to extraction.
2. <system-reminder> / <task-notification> blocks. strip_memory_tags() removes Hindsight's own <hindsight_memories> / <relevant_memories> blocks, but nothing removes the harness's.

This is the same class of bug as #1345 (Codex retaining AGENTS.md startup messages), fixed in #1346. The Codex path now has is_synthetic_codex_user_message(); the Claude Code path has no equivalent.

Steps to Reproduce

1. Configure the plugin with retainMode: "full-session" and auto-retain enabled.
2. In a session, invoke any bundled skill (the size scales with the skill).
3. Let the Stop hook fire.

Observed Behavior

Measured over my local transcripts, after applying the plugin's own strip_memory_tags():

retainable messages: 1413   total chars: 1,328,726
skill-body messages : 1 msg    566,804 chars (42.7%)
injected blocks     : 23 msgs   93,180 chars ( 7.0%)
combined                                      49.7%

A single claude-api skill invocation accounted for 42.7% of everything that session sent to extraction — one user message of 566,804 characters. Extraction turned it into ~1,600 world facts about the Anthropic SDK (budget_tokens deprecations, Bedrock client setup, effort levels) stored as facts about my work.

Downstream, an untagged whole-bank mental model then synthesised those into a "user profile" asserting model and API preferences I had never expressed. That is the part that took a while to notice — the facts look plausible and nothing marks them as documentation.

Another user reproduced the same failure independently on a separate setup with a 785 KB skill payload.

Expected Behavior

Skill bodies should not be retained as user conversation, and harness-injected blocks should be stripped the same way Hindsight's own injected blocks already are.

Environment

hindsight-memory plugin 0.7.5, self-hosted API, retainMode: full-session, retainToolCalls: false.

PR follows.

[nicoloboschi]

Fixed in the Coding Agents plugin (which supersedes the per-agent claude-code plugin) — though the investigation landed somewhere different from the report, so recording what I measured.

I checked all three cases against 400 real Claude Code transcripts, then confirmed each by running the actual transcript reader:

your case	in Coding Agents	why
skill bodies retained as user conversation	already handled	Claude Code marks them isMeta: true (8/8 in the sample) and the reader drops every isMeta line
<system-reminder> retained	already handled	they arrive inside tool_result blocks, which the reader drops entirely
—	<task-notification> was live	39 across 400 transcripts, delivered as a plain type:"user" message with a string body and no isMeta flag

So the class you identified is real, just not through either path you traced: the harness's background-task plumbing (task id, tool-use id, status, summary) was reaching fact extraction as things the user said. Reproduced on a real transcript — 243 retained turns, one of them 519 chars of pure transport — and 0 after the fix, with every genuine turn preserved.

The fix adds <task-notification> (and <system-reminder>, as insurance if the harness ever moves it) to the same tag-structural rule that already covered codex's <hook_prompt>. Stripping removes the block and keeps surrounding text, so a message that is only a wrapper drops out entirely while a real message mentioning one keeps the user's words — deliberately not the unanchored behaviour of the old plugin's strip_channel_envelope (#3124).

Shipped in #3378; it will go out in the next Coding Agents release. Welcome to migrate: npx @vectorize-io/hindsight-coding-agents install claude-code (https://hindsight.vectorize.io/sdks/integrations/coding-agents). Thanks for the report — the measurement it prompted is what turned up the case that was actually leaking.