@stackmemoryai/stackmemory 0.8.1 → 1.0.1

package/scripts/test-claude-config.sh

@@ -1,123 +0,0 @@
-#!/bin/bash
-# Test CLAUDE.md format effectiveness
-# Compares compact vs verbose configurations
-
-set -e
-
-CLAUDE_DIR="$HOME/.claude"
-VERBOSE_FILE="$CLAUDE_DIR/CLAUDE.md"
-COMPACT_FILE="$CLAUDE_DIR/CLAUDE.compact.md"
-BACKUP_FILE="$CLAUDE_DIR/CLAUDE.backup.md"
-RESULTS_DIR="/tmp/claude-config-test-$(date +%Y%m%d-%H%M%S)"
-
-mkdir -p "$RESULTS_DIR"
-
-echo "=== CLAUDE.md A/B Test ==="
-echo "Results: $RESULTS_DIR"
-echo ""
-
-# Test prompts that exercise CLAUDE.md rules
-declare -a TEST_PROMPTS=(
-  "What's your communication style preference?"
-  "I want to add a feature. Should you ask clarifying questions or just start coding?"
-  "Write a function to hash a password"
-  "What should you do before editing a file?"
-  "How do you handle ESM imports in TypeScript?"
-)
-
-# Token counts
-VERBOSE_TOKENS=$(cat "$VERBOSE_FILE" 2>/dev/null | wc -c | awk '{print int($1/3.5)}')
-COMPACT_TOKENS=$(cat "$COMPACT_FILE" 2>/dev/null | wc -c | awk '{print int($1/3.5)}')
-
-echo "Token comparison:"
-echo "  Verbose: ~$VERBOSE_TOKENS tokens"
-echo "  Compact: ~$COMPACT_TOKENS tokens"
-echo "  Savings: ~$((VERBOSE_TOKENS - COMPACT_TOKENS)) tokens ($(( (VERBOSE_TOKENS - COMPACT_TOKENS) * 100 / VERBOSE_TOKENS ))%)"
-echo ""
-
-# Backup current config
-cp "$VERBOSE_FILE" "$BACKUP_FILE"
-
-run_test() {
-  local config_name=$1
-  local config_file=$2
-  local output_dir="$RESULTS_DIR/$config_name"
-  mkdir -p "$output_dir"
-
-  echo "Testing with $config_name config..."
-
-  # Swap config
-  cp "$config_file" "$VERBOSE_FILE"
-
-  local i=0
-  for prompt in "${TEST_PROMPTS[@]}"; do
-    i=$((i + 1))
-    echo "  Prompt $i: ${prompt:0:40}..."
-
-    # Run claude with prompt, capture output
-    # Using --print flag for non-interactive mode
-    claude --print "$prompt" > "$output_dir/prompt_$i.txt" 2>&1 || true
-
-    # Brief pause to avoid rate limiting
-    sleep 1
-  done
-
-  echo "  Done. Outputs in $output_dir/"
-}
-
-# Test verbose config
-if [ -f "$VERBOSE_FILE" ]; then
-  # Save original verbose as .verbose for testing
-  cp "$VERBOSE_FILE" "$CLAUDE_DIR/CLAUDE.verbose.md"
-  run_test "verbose" "$CLAUDE_DIR/CLAUDE.verbose.md"
-fi
-
-# Test compact config
-if [ -f "$COMPACT_FILE" ]; then
-  run_test "compact" "$COMPACT_FILE"
-fi
-
-# Restore original config
-cp "$BACKUP_FILE" "$VERBOSE_FILE"
-rm -f "$BACKUP_FILE"
-
-echo ""
-echo "=== Analysis ==="
-
-# Compare output lengths (proxy for verbosity)
-echo "Output lengths (chars):"
-echo "  Verbose config:"
-for f in "$RESULTS_DIR/verbose"/prompt_*.txt; do
-  [ -f "$f" ] && echo "    $(basename $f): $(wc -c < "$f")"
-done
-
-echo "  Compact config:"
-for f in "$RESULTS_DIR/compact"/prompt_*.txt; do
-  [ -f "$f" ] && echo "    $(basename $f): $(wc -c < "$f")"
-done
-
-# Check for key behaviors
-echo ""
-echo "Behavior checks:"
-
-check_behavior() {
-  local name=$1
-  local pattern=$2
-  local verbose_match=$(grep -l "$pattern" "$RESULTS_DIR/verbose"/*.txt 2>/dev/null | wc -l)
-  local compact_match=$(grep -l "$pattern" "$RESULTS_DIR/compact"/*.txt 2>/dev/null | wc -l)
-  echo "  $name: verbose=$verbose_match compact=$compact_match"
-}
-
-check_behavior "Concise style" "concise\|brief\|short"
-check_behavior "Security mention" "security\|validate\|hash"
-check_behavior "ESM/extension" "\.js\|extension\|ESM"
-check_behavior "Read before edit" "read\|before\|first"
-
-echo ""
-echo "=== Summary ==="
-echo "Config files preserved. Review outputs in:"
-echo "  $RESULTS_DIR/verbose/"
-echo "  $RESULTS_DIR/compact/"
-echo ""
-echo "To manually compare:"
-echo "  diff $RESULTS_DIR/verbose/prompt_1.txt $RESULTS_DIR/compact/prompt_1.txt"

package/scripts/test-cli-security.js

@@ -1,293 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Security Testing Script for StackMemory CLI/API
- * Tests input validation and security vulnerabilities
- */
-
-import { spawn, execSync } from 'child_process';
-import { existsSync, mkdirSync, rmSync } from 'fs';
-import { join } from 'path';
-
-const TEST_DIR = '/tmp/stackmemory-security-test';
-const TESTS_PASSED = [];
-const TESTS_FAILED = [];
-
-// Color output helpers
-const red = (str) => `\x1b[31m${str}\x1b[0m`;
-const green = (str) => `\x1b[32m${str}\x1b[0m`;
-const yellow = (str) => `\x1b[33m${str}\x1b[0m`;
-const blue = (str) => `\x1b[34m${str}\x1b[0m`;
-
-// Test runner
-async function runTest(name, testFn) {
-  process.stdout.write(`Testing ${name}... `);
-  try {
-    await testFn();
-    TESTS_PASSED.push(name);
-    console.log(green('✓ PASSED'));
-    return true;
-  } catch (error) {
-    TESTS_FAILED.push({ name, error: error.message });
-    console.log(red('✗ FAILED'));
-    console.log(`  ${yellow(error.message)}`);
-    return false;
-  }
-}
-
-// Execute CLI command safely
-function execCLI(args, options = {}) {
-  try {
-    const result = execSync(`npx stackmemory ${args}`, {
-      cwd: TEST_DIR,
-      encoding: 'utf8',
-      stdio: 'pipe',
-      ...options
-    });
-    return { success: true, output: result };
-  } catch (error) {
-    return { 
-      success: false, 
-      output: error.stdout || '',
-      error: error.stderr || error.message 
-    };
-  }
-}
-
-// Setup test environment
-function setupTestEnv() {
-  if (existsSync(TEST_DIR)) {
-    rmSync(TEST_DIR, { recursive: true, force: true });
-  }
-  mkdirSync(TEST_DIR, { recursive: true });
-  process.chdir(TEST_DIR);
-  
-  // Initialize StackMemory
-  execSync('npx stackmemory init', { cwd: TEST_DIR, stdio: 'ignore' });
-}
-
-// Security Tests
-const securityTests = {
-  // SQL Injection Tests
-  async testSQLInjection() {
-    const payloads = [
-      "'; DROP TABLE frames; --",
-      "1' OR '1'='1",
-      "1; DELETE FROM tasks WHERE 1=1; --",
-      "' UNION SELECT * FROM frames --",
-      "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--"
-    ];
-    
-    for (const payload of payloads) {
-      const result = execCLI(`search "${payload}"`);
-      if (!result.success && result.error?.includes('DROP TABLE')) {
-        throw new Error(`SQL injection vulnerability detected with payload: ${payload}`);
-      }
-    }
-  },
-
-  // Command Injection Tests
-  async testCommandInjection() {
-    const payloads = [
-      '$(whoami)',
-      '`id`',
-      '; ls -la',
-      '| cat /etc/passwd',
-      '&& rm -rf /',
-      '\n/bin/sh',
-      '"; cat ~/.ssh/id_rsa; echo "'
-    ];
-    
-    for (const payload of payloads) {
-      const result = execCLI(`linear update "${payload}"`);
-      // Check if command was executed
-      if (result.output?.includes('root') || result.output?.includes('uid=')) {
-        throw new Error(`Command injection vulnerability with payload: ${payload}`);
-      }
-    }
-  },
-
-  // Path Traversal Tests
-  async testPathTraversal() {
-    const payloads = [
-      '../../../etc/passwd',
-      '..\\..\\..\\windows\\system32\\config\\sam',
-      'file:///etc/passwd',
-      '....//....//....//etc/passwd',
-      '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'
-    ];
-    
-    for (const payload of payloads) {
-      // Test with project commands
-      const result = execCLI(`projects add "${payload}"`);
-      if (result.output?.includes('root:') || result.output?.includes('Administrator:')) {
-        throw new Error(`Path traversal vulnerability with payload: ${payload}`);
-      }
-    }
-  },
-
-  // Invalid Input Handling
-  async testInvalidInputs() {
-    const tests = [
-      { cmd: 'linear sync --direction invalid', shouldFail: true },
-      { cmd: 'linear config --set-interval -1', shouldFail: true },
-      { cmd: 'linear config --set-quiet-start 25', shouldFail: true },
-      { cmd: 'analytics --port abc', shouldFail: true },
-      { cmd: 'search --limit notanumber', shouldFail: true }
-    ];
-    
-    for (const test of tests) {
-      const result = execCLI(test.cmd);
-      if (test.shouldFail && result.success) {
-        throw new Error(`Invalid input accepted: ${test.cmd}`);
-      }
-    }
-  },
-
-  // Buffer Overflow Tests
-  async testBufferOverflow() {
-    const largeString = 'A'.repeat(1000000); // 1MB string
-    const veryLargeString = 'B'.repeat(10000000); // 10MB string
-    
-    // Test with large inputs
-    const result1 = execCLI(`search "${largeString}"`);
-    const result2 = execCLI(`linear create --title "${veryLargeString}"`);
-    
-    // Should handle gracefully without crashing
-    if (result1.error?.includes('Segmentation fault') || 
-        result2.error?.includes('Segmentation fault')) {
-      throw new Error('Buffer overflow vulnerability detected');
-    }
-  },
-
-  // YAML/JSON Injection
-  async testYAMLInjection() {
-    const payloads = [
-      '!!python/object/apply:os.system ["ls"]',
-      '{"__proto__": {"isAdmin": true}}',
-      '{"constructor": {"prototype": {"isAdmin": true}}}',
-      '{ "$gt": "" }',
-      '{"$where": "sleep(1000)"}'
-    ];
-    
-    for (const payload of payloads) {
-      const result = execCLI(`config --import '${payload}'`);
-      if (result.output?.includes('isAdmin') || 
-          result.output?.includes('bin') ||
-          result.output?.includes('etc')) {
-        throw new Error(`YAML/JSON injection vulnerability with payload: ${payload}`);
-      }
-    }
-  },
-
-  // Environment Variable Injection
-  async testEnvVarInjection() {
-    const payloads = [
-      '$HOME',
-      '${PATH}',
-      '$(printenv)',
-      '%USERPROFILE%'
-    ];
-    
-    for (const payload of payloads) {
-      const result = execCLI(`linear setup --client-id "${payload}"`);
-      if (result.output?.includes('/home/') || 
-          result.output?.includes('/usr/') ||
-          result.output?.includes('Users')) {
-        throw new Error(`Environment variable injection with payload: ${payload}`);
-      }
-    }
-  },
-
-  // Integer Overflow Tests
-  async testIntegerOverflow() {
-    const tests = [
-      { cmd: 'search --limit 999999999999999999999', field: 'limit' },
-      { cmd: 'analytics --port 999999999', field: 'port' },
-      { cmd: 'linear config --set-interval 2147483648', field: 'interval' }
-    ];
-    
-    for (const test of tests) {
-      const result = execCLI(test.cmd);
-      // Should validate numeric ranges
-      if (!result.error && result.success) {
-        throw new Error(`Integer overflow not handled for ${test.field}`);
-      }
-    }
-  },
-
-  // XSS in Terminal Output
-  async testXSSInTerminal() {
-    const payloads = [
-      '\x1b[31mRED\x1b[0m\x1b]0;HIJACKED\x07',
-      '<script>alert(1)</script>',
-      '\r\nInjected line',
-      '\x1b[2J\x1b[H' // Clear screen escape
-    ];
-    
-    for (const payload of payloads) {
-      const result = execCLI(`search "${payload}"`);
-      // Output should be sanitized
-      if (result.output?.includes('\x1b]0;') || 
-          result.output?.includes('\x1b[2J')) {
-        throw new Error('Terminal escape sequences not sanitized');
-      }
-    }
-  },
-
-  // Authentication Bypass Tests
-  async testAuthBypass() {
-    // Test accessing Linear commands without auth
-    const commands = [
-      'linear sync',
-      'linear list',
-      'linear update TEST-123'
-    ];
-    
-    // Unset LINEAR_API_KEY for test
-    delete process.env.LINEAR_API_KEY;
-    
-    for (const cmd of commands) {
-      const result = execCLI(cmd);
-      // Should require authentication
-      if (result.success && !result.output?.includes('not configured')) {
-        throw new Error(`Authentication bypass for: ${cmd}`);
-      }
-    }
-  }
-};
-
-// Main test runner
-async function main() {
-  console.log(blue('\n🔒 StackMemory CLI/API Security Testing\n'));
-  console.log('Setting up test environment...\n');
-  
-  setupTestEnv();
-  
-  // Run all security tests
-  for (const [name, testFn] of Object.entries(securityTests)) {
-    await runTest(name, testFn);
-  }
-  
-  // Summary
-  console.log(blue('\n📊 Test Summary\n'));
-  console.log(green(`✓ Passed: ${TESTS_PASSED.length}`));
-  console.log(red(`✗ Failed: ${TESTS_FAILED.length}`));
-  
-  if (TESTS_FAILED.length > 0) {
-    console.log(red('\n❌ Failed Tests:'));
-    TESTS_FAILED.forEach(({ name, error }) => {
-      console.log(`  - ${name}: ${error}`);
-    });
-  }
-  
-  // Cleanup
-  if (existsSync(TEST_DIR)) {
-    rmSync(TEST_DIR, { recursive: true, force: true });
-  }
-  
-  process.exit(TESTS_FAILED.length > 0 ? 1 : 0);
-}
-
-// Run tests
-main().catch(console.error);

package/scripts/test-code-execution.js

@@ -1,143 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Test code execution MCP handler
- */
-
-import { CodeExecutionHandler } from '../dist/integrations/mcp/handlers/code-execution-handlers.js';
-
-async function testPythonExecution() {
-  console.log('🐍 Testing Python Code Execution\n');
-  
-  const handler = new CodeExecutionHandler();
-  
-  // Test 1: Simple Python code
-  console.log('Test 1: Simple calculation');
-  const result1 = await handler.executeCode({
-    language: 'python',
-    code: `
-import math
-
-def calculate_circle_area(radius):
-    return math.pi * radius ** 2
-
-# Test the function
-radius = 5
-area = calculate_circle_area(radius)
-print(f"Circle with radius {radius} has area: {area:.2f}")
-
-# Generate some data
-data = [i**2 for i in range(10)]
-print(f"Squares: {data}")
-`,
-  });
-  
-  console.log('Success:', result1.success);
-  console.log('Output:', result1.stdout);
-  if (result1.stderr) console.log('Errors:', result1.stderr);
-  console.log('---\n');
-  
-  // Test 2: Code with warnings
-  console.log('Test 2: Code with security warnings');
-  const code2 = `
-import os
-import subprocess
-
-# This should trigger warnings
-print("Current directory:", os.getcwd())
-`;
-  
-  const validation = handler.validateCode(code2);
-  console.log('Validation result:', validation);
-  
-  if (!validation.safe) {
-    console.log('Executing anyway with force flag...');
-    const result2 = await handler.executeCode({
-      language: 'python',
-      code: code2,
-    });
-    console.log('Output:', result2.stdout);
-  }
-  console.log('---\n');
-  
-  // Test 3: JavaScript execution
-  console.log('Test 3: JavaScript code');
-  const result3 = await handler.executeCode({
-    language: 'javascript',
-    code: `
-// Calculate fibonacci
-function fibonacci(n) {
-  if (n <= 1) return n;
-  return fibonacci(n - 1) + fibonacci(n - 2);
-}
-
-for (let i = 0; i < 10; i++) {
-  console.log(\`fibonacci(\${i}) = \${fibonacci(i)}\`);
-}
-
-// Test async operation
-setTimeout(() => {
-  console.log('Async operation completed');
-}, 100);
-
-// Wait a bit for async
-new Promise(resolve => setTimeout(resolve, 200)).then(() => {
-  console.log('Promise resolved');
-});
-`,
-  });
-  
-  console.log('Success:', result3.success);
-  console.log('Output:', result3.stdout);
-  console.log('---\n');
-  
-  // Test 4: Long-running code with timeout
-  console.log('Test 4: Timeout test');
-  const result4 = await handler.executeCode({
-    language: 'python',
-    code: `
-import time
-print("Starting long operation...")
-time.sleep(5)  # This should timeout if timeout is < 5 seconds
-print("This should not print")
-`,
-    timeout: 2000, // 2 second timeout
-  });
-  
-  console.log('Success:', result4.success);
-  console.log('Output:', result4.stdout);
-  console.log('Errors:', result4.stderr);
-  console.log('---\n');
-  
-  // Test 5: Large output truncation
-  console.log('Test 5: Large output handling');
-  const result5 = await handler.executeCode({
-    language: 'python',
-    code: `
-# Generate large output
-for i in range(10000):
-    print(f"Line {i}: {'=' * 50}")
-`,
-  });
-  
-  console.log('Success:', result5.success);
-  console.log('Truncated:', result5.truncated);
-  if (result5.truncated) {
-    console.log('Output file:', result5.outputFile);
-  }
-  console.log('Output length:', result5.stdout.length);
-  console.log('---\n');
-  
-  // Get sandbox status
-  const status = await handler.getSandboxStatus();
-  console.log('📊 Sandbox Status:', status);
-  
-  // Clean sandbox
-  console.log('\n🧹 Cleaning sandbox...');
-  await handler.cleanSandbox();
-  const statusAfter = await handler.getSandboxStatus();
-  console.log('Sandbox after cleanup:', statusAfter);
-}
-
-// Run tests
-testPythonExecution().catch(console.error);