chore: bump version to 9.0.12

The previous approach (PR #837) set CLAUDE_CONFIG_DIR to isolate observer
sessions from `claude --resume`. However, this broke authentication because
Claude Code stores credentials in the config directory.

This fix uses the SDK's `cwd` option instead:
- Observer sessions run with cwd=~/.claude-mem/observer-sessions/
- Project name = path.basename(cwd) = "observer-sessions"
- Sessions won't appear when running `claude --resume` from actual projects
- Authentication works because ~/.claude/ config is preserved

Changes:
- ProcessRegistry.ts: Remove CLAUDE_CONFIG_DIR override from spawn
- SDKAgent.ts: Add cwd option to query() pointing to observer dir
- paths.ts: Rename OBSERVER_CONFIG_DIR to OBSERVER_SESSIONS_DIR

Fixes regression from #837

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem",
-      "version": "9.0.11",
+      "version": "9.0.12",
       "source": "./plugin",
       "description": "Persistent memory system for Claude Code - context compression across sessions"
     }

.claude/plans/bugfix-env-auth.md

@@ -0,0 +1,176 @@
+# Bugfix Plan: Observer Sessions Authentication Failure
+
+## Problem Summary
+
+Observer sessions fail with "Invalid API key · Please run /login" because the `CLAUDE_CONFIG_DIR` environment variable is being set to an isolated directory (`~/.claude-mem/observer-config/`) that lacks authentication credentials.
+
+## Root Cause
+
+**File:** `src/services/worker/ProcessRegistry.ts` (lines 207-211)
+
+```typescript
+const isolatedEnv = {
+  ...spawnOptions.env,
+  CLAUDE_CONFIG_DIR: OBSERVER_CONFIG_DIR  // <-- This isolates auth credentials!
+};
+```
+
+This was added in Issue #832 to prevent observer sessions from polluting the `claude --resume` list. However, it also isolates the authentication credentials, breaking the SDK's ability to authenticate with the Anthropic API.
+
+## Evidence
+
+1. Running Claude with alternate config dir reproduces the error:
+   ```bash
+   CLAUDE_CONFIG_DIR=/tmp/test-claude claude --print "hello"
+   # Output: Invalid API key · Please run /login
+   ```
+
+2. The observer config directory exists but only has cached feature flags, no authentication:
+   - `~/.claude-mem/observer-config/.claude.json` - feature flags only
+   - No credentials copied from main `~/.claude/` directory
+
+## Solution
+
+The fix must allow authentication while still isolating session history. Claude Code stores different data types in `CLAUDE_CONFIG_DIR`:
+- Authentication credentials (needed)
+- Session history/resume list (should be isolated)
+- Feature flags and settings (can be shared or isolated)
+
+**Approach:** Do NOT override `CLAUDE_CONFIG_DIR`. Instead, find an alternative solution for Issue #832.
+
+### Alternative Approaches for Session Isolation
+
+1. **Use `--no-resume` flag** (if SDK supports it) - Prevent observer sessions from being resumable
+2. **Accept pollution** - Observer sessions in resume list may be acceptable tradeoff
+3. **Post-hoc cleanup** - Clean up observer session entries from history after completion
+4. **SDK parameter** - Check if SDK has a session isolation option that doesn't affect auth
+
+---
+
+## Phase 0: Documentation Discovery
+
+### Objective
+Understand SDK options for session isolation without breaking authentication.
+
+### Tasks
+1. Read SDK documentation/source for:
+   - Available `query()` options
+   - Session isolation mechanisms
+   - Authentication handling
+
+2. Read Issue #832 context:
+   - What was the original problem?
+   - How bad was the pollution?
+   - Are there alternative solutions mentioned?
+
+### Verification
+- [ ] List all `query()` options available
+- [ ] Identify if `--no-resume` or equivalent exists
+- [ ] Document the tradeoffs
+
+---
+
+## Phase 1: Fix Authentication
+
+### Objective
+Remove the `CLAUDE_CONFIG_DIR` override to restore authentication.
+
+### File to Modify
+`src/services/worker/ProcessRegistry.ts`
+
+### Change
+Remove lines 207-211 that override `CLAUDE_CONFIG_DIR`:
+
+**Before:**
+```typescript
+const isolatedEnv = {
+  ...spawnOptions.env,
+  CLAUDE_CONFIG_DIR: OBSERVER_CONFIG_DIR
+};
+```
+
+**After:**
+```typescript
+const isolatedEnv = {
+  ...spawnOptions.env
+  // CLAUDE_CONFIG_DIR removed - observer sessions need access to auth credentials
+  // Session isolation addressed via [alternative approach]
+};
+```
+
+### Verification
+- [ ] Build succeeds: `npm run build`
+- [ ] Observer sessions authenticate successfully
+- [ ] Observations are saved to database
+
+---
+
+## Phase 2: Address Session Isolation (Issue #832)
+
+### Objective
+Find alternative solution to prevent observer sessions from polluting `claude --resume` list.
+
+### Options to Evaluate
+
+1. **Option A: Accept the tradeoff**
+   - Observer sessions appear in resume list but users can ignore them
+   - No code changes needed beyond Phase 1
+
+2. **Option B: Use isSynthetic flag**
+   - If SDK has a flag to mark sessions as non-resumable, use it
+   - Requires SDK documentation review
+
+3. **Option C: Post-processing cleanup**
+   - After session ends, remove observer entries from history
+   - More complex, may have race conditions
+
+### Decision Point
+After Phase 0 documentation review, choose the appropriate option.
+
+### Verification
+- [ ] Chosen approach documented
+- [ ] If code changes made, tests pass
+- [ ] Observer sessions either isolated OR tradeoff accepted
+
+---
+
+## Phase 3: Testing
+
+### Manual Tests
+1. Start a new Claude Code session with the plugin
+2. Verify observations are being saved (check logs)
+3. Check that no "Invalid API key" errors appear
+4. Verify `claude --resume` behavior (acceptable level of observer entries)
+
+### Verification Checklist
+- [ ] `npm run build` succeeds
+- [ ] Worker service starts without errors
+- [ ] Observations save to database
+- [ ] No authentication errors in logs
+- [ ] Issue #832 regression acceptable or addressed
+
+---
+
+## Anti-Patterns to Avoid
+
+1. **DO NOT** add `ANTHROPIC_API_KEY` to environment - authentication is handled by Claude Code's built-in credential management
+2. **DO NOT** copy credential files to observer config dir - credentials may be in keychain or other secure storage
+3. **DO NOT** try to "fix" authentication by adding API key loading - that creates Issue #588 (unexpected API charges)
+
+---
+
+## Files Involved
+
+| File | Purpose |
+|------|---------|
+| `src/services/worker/ProcessRegistry.ts` | Contains the problematic `CLAUDE_CONFIG_DIR` override |
+| `src/shared/paths.ts` | Defines `OBSERVER_CONFIG_DIR` constant |
+| `src/services/worker/SDKAgent.ts` | Uses `createPidCapturingSpawn` which sets the env |
+
+---
+
+## Risk Assessment
+
+**Low Risk:** Removing the `CLAUDE_CONFIG_DIR` override is a simple, targeted change.
+
+**Regression Risk (Issue #832):** Observer sessions may appear in `claude --resume` list again. This is a cosmetic issue vs. complete authentication failure, so the tradeoff favors removing the override.

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to claude-mem.
 
+## [v9.0.11] - 2026-01-28
+
+## Bug Fixes
+
+### Observer Session Isolation (#837)
+Observer sessions created by claude-mem were polluting the `claude --resume` list, cluttering it with internal plugin sessions that users never intend to resume. In one user's case, 74 observer sessions out of ~220 total (34% noise).
+
+**Solution**: Observer processes now use a dedicated config directory (`~/.claude-mem/observer-config/`) to isolate their session files from user sessions.
+
+Thanks to @Glucksberg for this fix! Fixes #832.
+
+### Stale memory_session_id Crash Prevention (#839)
+After a worker restart, stale `memory_session_id` values in the database could cause crashes when attempting to resume SDK conversations. The existing guard didn't protect against this because session data was loaded from the database.
+
+**Solution**: Clear `memory_session_id` when loading sessions from the database (not from cache). The key insight: if a session isn't in memory, any database `memory_session_id` is definitely stale.
+
+Thanks to @bigph00t for this fix! Fixes #817.
+
+---
+**Full Changelog**: https://github.com/thedotmack/claude-mem/compare/v9.0.10...v9.0.11
+
 ## [v9.0.10] - 2026-01-26
 
 ## Bug Fix
@@ -1308,9 +1329,3 @@ This represents a major reliability improvement for Windows users, eliminating c
 
 **Full Changelog**: https://github.com/thedotmack/claude-mem/compare/v7.3.6...v7.3.7
 
-## [v7.3.6] - 2025-12-17
-
-## Bug Fixes
-
-- Enhanced SDKAgent response handling and message processing
-

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem",
-  "version": "9.0.11",
+  "version": "9.0.12",
   "description": "Memory compression system for Claude Code - persist context across sessions",
   "keywords": [
     "claude",

plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem",
-  "version": "9.0.11",
+  "version": "9.0.12",
   "description": "Persistent memory system for Claude Code - seamlessly preserve context across sessions",
   "author": {
     "name": "Alex Newman"

plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-plugin",
-  "version": "9.0.11",
+  "version": "9.0.12",
   "private": true,
   "description": "Runtime dependencies for claude-mem bundled hooks",
   "type": "module",

src/services/worker/ProcessRegistry.ts

@@ -19,7 +19,6 @@
 import { spawn, exec, ChildProcess } from 'child_process';
 import { promisify } from 'util';
 import { logger } from '../../utils/logger.js';
-import { OBSERVER_CONFIG_DIR, ensureDir } from '../../shared/paths.js';
 
 const execAsync = promisify(exec);
 
@@ -189,14 +188,10 @@ export async function reapOrphanedProcesses(activeSessionIds: Set<number>): Prom
  * The SDK's spawnClaudeCodeProcess option allows us to intercept subprocess
  * creation and capture the PID before the SDK hides it.
  *
- * IMPORTANT (Issue #832): We set CLAUDE_CONFIG_DIR to isolate observer sessions.
- * This prevents observer sessions from appearing in `claude --resume` list,
- * which was causing 34%+ of resume entries to be internal plugin sessions.
+ * NOTE: Session isolation is handled via the `cwd` option in SDKAgent.ts,
+ * NOT via CLAUDE_CONFIG_DIR (which breaks authentication).
  */
 export function createPidCapturingSpawn(sessionDbId: number) {
-  // Ensure observer config directory exists
-  ensureDir(OBSERVER_CONFIG_DIR);
-
   return (spawnOptions: {
     command: string;
     args: string[];
@@ -204,15 +199,9 @@ export function createPidCapturingSpawn(sessionDbId: number) {
     env?: NodeJS.ProcessEnv;
     signal?: AbortSignal;
   }) => {
-    // Inject CLAUDE_CONFIG_DIR to isolate observer sessions (Issue #832)
-    const isolatedEnv = {
-      ...spawnOptions.env,
-      CLAUDE_CONFIG_DIR: OBSERVER_CONFIG_DIR
-    };
-
     const child = spawn(spawnOptions.command, spawnOptions.args, {
       cwd: spawnOptions.cwd,
-      env: isolatedEnv,
+      env: spawnOptions.env,
       stdio: ['pipe', 'pipe', 'pipe'],
       signal: spawnOptions.signal, // CRITICAL: Pass signal for AbortController integration
       windowsHide: true

src/services/worker/SDKAgent.ts

@@ -16,7 +16,7 @@ import { SessionManager } from './SessionManager.js';
 import { logger } from '../../utils/logger.js';
 import { buildInitPrompt, buildObservationPrompt, buildSummaryPrompt, buildContinuationPrompt } from '../../sdk/prompts.js';
 import { SettingsDefaultsManager } from '../../shared/SettingsDefaultsManager.js';
-import { USER_SETTINGS_PATH } from '../../shared/paths.js';
+import { USER_SETTINGS_PATH, OBSERVER_SESSIONS_DIR, ensureDir } from '../../shared/paths.js';
 import type { ActiveSession, SDKUserMessage } from '../worker-types.js';
 import { ModeManager } from '../domain/ModeManager.js';
 import { processAgentResponse, type WorkerRef } from './agents/index.js';
@@ -101,10 +101,15 @@ export class SDKAgent {
     // Run Agent SDK query loop
     // Only resume if we have a captured memory session ID
     // Use custom spawn to capture PIDs for zombie process cleanup (Issue #737)
+    // Use dedicated cwd to isolate observer sessions from user's `claude --resume` list
+    ensureDir(OBSERVER_SESSIONS_DIR);
     const queryResult = query({
       prompt: messageGenerator,
       options: {
         model: modelId,
+        // Isolate observer sessions - they'll appear under project "observer-sessions"
+        // instead of polluting user's actual project resume lists
+        cwd: OBSERVER_SESSIONS_DIR,
         // Only resume if BOTH: (1) we have a memorySessionId AND (2) this isn't the first prompt
         // On worker restart, memorySessionId may exist from a previous SDK session but we
         // need to start fresh since the SDK context was lost

src/shared/paths.ts

@@ -38,9 +38,9 @@ export const USER_SETTINGS_PATH = join(DATA_DIR, 'settings.json');
 export const DB_PATH = join(DATA_DIR, 'claude-mem.db');
 export const VECTOR_DB_DIR = join(DATA_DIR, 'vector-db');
 
-// Isolated config directory for observer sessions (Issue #832)
-// This prevents observer sessions from appearing in `claude --resume` list
-export const OBSERVER_CONFIG_DIR = join(DATA_DIR, 'observer-config');
+// Observer sessions directory - used as cwd for SDK queries
+// Sessions here won't appear in user's `claude --resume` for their actual projects
+export const OBSERVER_SESSIONS_DIR = join(DATA_DIR, 'observer-sessions');
 
 // Claude integration paths
 export const CLAUDE_SETTINGS_PATH = join(CLAUDE_CONFIG_DIR, 'settings.json');