@stackmemoryai/stackmemory 1.2.0 → 1.2.2

package/dist/src/utils/hook-installer.js

@@ -0,0 +1,155 @@
+import { fileURLToPath as __fileURLToPath } from 'url';
+import { dirname as __pathDirname } from 'path';
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __pathDirname(__filename);
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+const CANONICAL_HOOKS = [
+  {
+    scriptName: "session-rescue.sh",
+    eventType: "Stop",
+    timeout: 12,
+    required: true
+  },
+  {
+    scriptName: "stop-checkpoint.js",
+    eventType: "Stop",
+    timeout: 5,
+    commandPrefix: "node",
+    required: true
+  },
+  {
+    scriptName: "chime-on-stop.sh",
+    eventType: "Stop",
+    timeout: 2,
+    required: true
+  },
+  {
+    scriptName: "auto-checkpoint.js",
+    eventType: "PostToolUse",
+    timeout: 2,
+    commandPrefix: "node",
+    required: true
+  }
+];
+const DEAD_HOOKS = ["sms-response-handler.js"];
+function buildCommand(entry, hooksDir) {
+  const scriptPath = path.join(hooksDir, entry.scriptName);
+  if (entry.commandPrefix) {
+    return `${entry.commandPrefix} ${scriptPath}`;
+  }
+  return scriptPath;
+}
+function hookExists(settings, entry) {
+  const groups = settings.hooks?.[entry.eventType];
+  if (!groups) return false;
+  for (const group of groups) {
+    for (const hook of group.hooks) {
+      if (hook.command.includes(entry.scriptName)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function hasDeadHooks(settings) {
+  if (!settings.hooks) return false;
+  for (const groups of Object.values(settings.hooks)) {
+    for (const group of groups) {
+      for (const hook of group.hooks) {
+        for (const dead of DEAD_HOOKS) {
+          if (hook.command.includes(dead)) return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function removeDeadHooks(settings) {
+  if (!settings.hooks) return false;
+  let removed = false;
+  for (const eventType of Object.keys(settings.hooks)) {
+    const groups = settings.hooks[eventType];
+    for (const group of groups) {
+      const before = group.hooks.length;
+      group.hooks = group.hooks.filter((hook) => {
+        for (const dead of DEAD_HOOKS) {
+          if (hook.command.includes(dead)) return false;
+        }
+        return true;
+      });
+      if (group.hooks.length < before) removed = true;
+    }
+    settings.hooks[eventType] = groups.filter((g) => g.hooks.length > 0);
+    if (settings.hooks[eventType].length === 0) {
+      delete settings.hooks[eventType];
+    }
+  }
+  return removed;
+}
+function addHook(settings, entry, hooksDir) {
+  if (!settings.hooks) settings.hooks = {};
+  const eventGroups = settings.hooks[entry.eventType] || [];
+  const command = buildCommand(entry, hooksDir);
+  const hookCmd = { type: "command", command };
+  if (entry.timeout) hookCmd.timeout = entry.timeout;
+  const matcherValue = entry.matcher ?? void 0;
+  const targetGroup = eventGroups.find((g) => {
+    if (matcherValue) return g.matcher === matcherValue;
+    return !g.matcher;
+  });
+  if (targetGroup) {
+    targetGroup.hooks.push(hookCmd);
+  } else {
+    const newGroup = { hooks: [hookCmd] };
+    if (matcherValue) newGroup.matcher = matcherValue;
+    eventGroups.push(newGroup);
+  }
+  settings.hooks[entry.eventType] = eventGroups;
+}
+function mergeSettings(existing, hooksDir) {
+  const merged = JSON.parse(JSON.stringify(existing));
+  removeDeadHooks(merged);
+  for (const entry of CANONICAL_HOOKS) {
+    if (!hookExists(merged, entry)) {
+      addHook(merged, entry, hooksDir);
+    }
+  }
+  return merged;
+}
+function getSettingsPath() {
+  return path.join(os.homedir(), ".claude", "settings.json");
+}
+function readSettings(settingsPath) {
+  const p = settingsPath ?? getSettingsPath();
+  try {
+    if (fs.existsSync(p)) {
+      return JSON.parse(fs.readFileSync(p, "utf8"));
+    }
+  } catch {
+  }
+  return {};
+}
+function writeSettingsAtomic(settings, settingsPath) {
+  const p = settingsPath ?? getSettingsPath();
+  const dir = path.dirname(p);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  const tmp = p + ".tmp";
+  fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
+  fs.renameSync(tmp, p);
+}
+export {
+  CANONICAL_HOOKS,
+  DEAD_HOOKS,
+  buildCommand,
+  getSettingsPath,
+  hasDeadHooks,
+  hookExists,
+  mergeSettings,
+  readSettings,
+  removeDeadHooks,
+  writeSettingsAtomic
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackmemoryai/stackmemory",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Project-scoped memory for AI coding tools. Durable context across sessions with MCP integration, frames, smart retrieval, Claude Code skills, and automatic hooks.",
   "engines": {
     "node": ">=20.0.0",
@@ -171,7 +171,7 @@
     "@types/better-sqlite3": "^7.6.8",
     "@types/express": "^4.17.25",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.10.6",
+    "@types/node": "^22.0.0",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.5.10",
     "@typescript-eslint/eslint-plugin": "^8.50.1",

package/scripts/gepa/.before-optimize.md

@@ -0,0 +1,140 @@
+# StackMemory - Project Configuration
+
+## Project Structure
+
+```
+src/
+  cli/           # CLI commands and entry point
+  core/          # Core business logic
+    context/     # Frame and context management
+    database/    # Database adapters (SQLite, ParadeDB)
+    digest/      # Digest generation
+    query/       # Query parsing and routing
+  integrations/  # External integrations (Linear, MCP)
+  services/      # Business services
+  skills/        # Claude Code skills
+  utils/         # Shared utilities
+scripts/         # Build and utility scripts
+config/          # Configuration files
+docs/            # Documentation
+```
+
+## Key Files
+
+- Entry: src/cli/index.ts
+- MCP Server: src/integrations/mcp/server.ts
+- Frame Manager: src/core/context/frame-manager.ts
+- Database: src/core/database/sqlite-adapter.ts
+
+## Detailed Guides
+
+Quick reference (agent_docs/):
+- linear_integration.md - Linear sync
+- mcp_server.md - MCP tools
+- database_storage.md - Storage
+- claude_hooks.md - Hooks
+
+Full documentation (docs/):
+- principles.md - Agent programming paradigm
+- architecture.md - Extension model and browser sandbox
+- SPEC.md - Technical specification
+- API_REFERENCE.md - API docs
+- DEVELOPMENT.md - Dev guide
+- SETUP.md - Installation
+
+## Commands
+
+```bash
+npm run build          # Compile TypeScript (esbuild)
+npm run lint           # ESLint check
+npm run lint:fix       # Auto-fix lint issues
+npm test               # Run Vitest (watch)
+npm run test:run       # Run tests once
+npm run linear:sync    # Sync with Linear
+
+# StackMemory CLI
+stackmemory capture    # Save session state for handoff
+stackmemory restore    # Restore from captured state
+```
+
+## Working Directory
+
+- PRIMARY: /Users/jwu/Dev/stackmemory
+- ALLOWED: All subdirectories
+- TEMP: /tmp for temporary operations
+
+## Validation (MUST DO)
+
+After code changes:
+1. `npm run lint` - fix any errors AND warnings
+2. `npm run test:run` - verify no regressions
+3. `npm run build` - ensure compilation
+4. Run code to verify it works
+
+Test coverage:
+- New features require tests in `src/**/__tests__/`
+- Maintain or improve coverage (no untested code paths)
+- Critical paths: context management, handoff, Linear sync
+
+Never: Assume success | Skip testing | Use mock data as fallback
+
+## Git Rules (CRITICAL)
+
+- NEVER use `--no-verify` on git push or commit
+- ALWAYS fix lint/test errors before pushing
+- If pre-push hooks fail, fix the underlying issue
+- Run `npm run lint && npm run test:run` before pushing
+- Commit message format: `type(scope): message`
+- Branch naming: `feature/STA-XXX-description` | `fix/STA-XXX-description` | `chore/description`
+
+## Task Management
+
+- Use TodoWrite for 3+ steps or multiple requests
+- Keep one task in_progress at a time
+- Update task status immediately on completion
+
+## Security
+
+NEVER hardcode secrets - use process.env with dotenv/config
+
+```javascript
+import 'dotenv/config';
+const API_KEY = process.env.LINEAR_API_KEY;
+if (!API_KEY) {
+  console.error('LINEAR_API_KEY not set');
+  process.exit(1);
+}
+```
+
+Environment sources (check in order):
+1. .env file
+2. .env.local
+3. ~/.zshrc
+4. Process environment
+
+Secret patterns to block: lin_api_* | lin_oauth_* | sk-* | npm_*
+
+## Deploy
+
+```bash
+# npm publish (uses NPM_TOKEN from .env, no OTP needed)
+git stash -- scripts/gepa/           # stash GEPA state (dirties working tree)
+NPM_TOKEN=$(grep '^NPM_TOKEN=' .env | cut -d= -f2) \
+  npm publish --registry https://registry.npmjs.org/ \
+  --//registry.npmjs.org/:_authToken="$NPM_TOKEN"
+git stash pop                         # restore GEPA state
+
+# Railway
+railway up
+
+# Pre-publish checks require clean git status — stash GEPA files first
+```
+
+## Workflow
+
+- Check .env for API keys before asking
+- Run npm run linear:sync after task completion
+- Use browser MCP for visual testing
+- Review recent commits and stackmemory.json on session start
+- Use subagents for multi-step tasks
+- Ask 1-3 clarifying questions for complex commands (one at a time)

package/scripts/gepa/config.json

@@ -24,7 +24,7 @@
 
   "evals": {
     "directory": "./evals",
-    "minSamplesPerVariant": 5,
+    "minSamplesPerVariant": 8,
     "timeout": 120000,
     "metrics": [
       "task_completion",
@@ -34,6 +34,12 @@
     ]
   },
 
+  "judge": {
+    "model": "claude-haiku-4-5-20251001",
+    "maxOutputTokens": 2000,
+    "timeoutMs": 30000
+  },
+
   "scoring": {
     "weights": {
       "task_completion": 0.4,

package/scripts/gepa/evals/fixtures/api-endpoint.ts

@@ -0,0 +1,31 @@
+// Simple API endpoint that needs pagination added
+import express from 'express';
+
+const router = express.Router();
+
+interface User {
+  id: number;
+  name: string;
+  email: string;
+}
+
+// In-memory store
+const users: User[] = Array.from({ length: 100 }, (_, i) => ({
+  id: i + 1,
+  name: `User ${i + 1}`,
+  email: `user${i + 1}@example.com`,
+}));
+
+// GET /users - returns ALL users (no pagination)
+router.get('/users', (req, res) => {
+  res.json(users);
+});
+
+// GET /users/:id
+router.get('/users/:id', (req, res) => {
+  const user = users.find((u) => u.id === parseInt(req.params.id));
+  if (!user) return res.status(404).json({ error: 'Not found' });
+  res.json(user);
+});
+
+export default router;

package/scripts/gepa/evals/fixtures/brittle-integration.ts

@@ -0,0 +1,38 @@
+// Integration handler that crashes on external API failure
+// Needs graceful degradation following the DiffMem/Greptile pattern
+
+interface MCPResponse {
+  content: Array<{ type: string; text: string }>;
+  metadata?: Record<string, unknown>;
+}
+
+// This handler crashes the entire MCP server when the API is unreachable.
+// Refactor to degrade gracefully.
+async function handleExternalLookup(args: {
+  query: string;
+  limit?: number;
+}): Promise<MCPResponse> {
+  const response = await fetch('https://api.external-service.com/search', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ query: args.query, limit: args.limit || 10 }),
+  });
+
+  // BUG: No error handling — fetch failures (ECONNREFUSED, DNS, timeout)
+  // will throw and crash the MCP server process.
+  // BUG: 4xx errors (bad request, auth failed) should not be retried.
+  // BUG: Logs at error level, flooding logs when service is down.
+
+  if (!response.ok) {
+    throw new Error(`API error: ${response.status}`);
+  }
+
+  const data = await response.json();
+
+  return {
+    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],
+    metadata: { tool: 'external_lookup', resultCount: data.results?.length },
+  };
+}
+
+export { handleExternalLookup };

package/scripts/gepa/evals/fixtures/fts5-triggers.sql

@@ -0,0 +1,23 @@
+-- FTS5 external content table for full-text search on frames
+CREATE VIRTUAL TABLE IF NOT EXISTS frames_fts USING fts5(
+  name, digest_text, inputs, outputs,
+  content='frames', content_rowid='rowid'
+);
+
+-- Sync trigger: INSERT
+CREATE TRIGGER IF NOT EXISTS frames_ai AFTER INSERT ON frames BEGIN
+  INSERT INTO frames_fts(rowid, name, digest_text, inputs, outputs)
+  VALUES (new.rowid, new.name, new.digest_text, new.inputs, new.outputs);
+END;
+
+-- Sync trigger: UPDATE
+CREATE TRIGGER IF NOT EXISTS frames_au AFTER UPDATE ON frames BEGIN
+  INSERT INTO frames_fts(frames_fts, rowid, name, digest_text, inputs, outputs)
+  VALUES ('delete', old.rowid, old.name, old.digest_text, old.inputs, old.outputs);
+  INSERT INTO frames_fts(rowid, name, digest_text, inputs, outputs)
+  VALUES (new.rowid, new.name, new.digest_text, new.inputs, new.outputs);
+END;
+
+-- BUG: Missing DELETE trigger!
+-- When a frame is deleted, the FTS index still contains stale data.
+-- Add the missing AFTER DELETE trigger below.

package/scripts/gepa/evals/fixtures/leaky-service.ts

@@ -0,0 +1,70 @@
+// Daemon service with timer leak bug
+interface ServiceConfig {
+  enabled: boolean;
+  interval: number; // minutes
+}
+
+interface ServiceState {
+  isRunning: boolean;
+  intervalMs: number;
+  lastRunTime: number;
+  errorCount: number;
+}
+
+class MonitorService {
+  private config: ServiceConfig;
+  private intervalId?: NodeJS.Timeout;
+  private isRunning = false;
+  private lastRunTime = 0;
+  private errorCount = 0;
+
+  constructor(config: ServiceConfig) {
+    this.config = config;
+  }
+
+  // BUG: No guard against double-start — calling start() twice
+  // creates two intervals but only stores the second one.
+  // The first interval leaks and keeps running forever.
+  start(): void {
+    this.isRunning = true;
+    const intervalMs = this.config.interval * 60 * 1000;
+
+    this.doWork(); // initial run
+
+    this.intervalId = setInterval(() => {
+      this.doWork();
+    }, intervalMs);
+  }
+
+  stop(): void {
+    if (this.intervalId) {
+      clearInterval(this.intervalId);
+      this.intervalId = undefined;
+    }
+    this.isRunning = false;
+  }
+
+  // BUG: Calls stop() then start() but start() doesn't check
+  // if already running, so if stop() fails to clear the interval
+  // (e.g., intervalId is undefined), we leak.
+  updateConfig(config: Partial<ServiceConfig>): void {
+    const wasRunning = this.isRunning;
+    if (wasRunning) this.stop();
+    this.config = { ...this.config, ...config };
+    if (wasRunning && this.config.enabled) this.start();
+  }
+
+  // TODO: Add getState() method returning ServiceState
+
+  private doWork(): void {
+    try {
+      // Simulate work
+      console.log('Running monitor check...');
+      this.lastRunTime = Date.now();
+    } catch (err) {
+      this.errorCount++;
+    }
+  }
+}
+
+export { MonitorService, ServiceConfig, ServiceState };

package/scripts/gepa/evals/fixtures/mcp-dispatch-stub.ts

@@ -0,0 +1,39 @@
+// Existing MCP server dispatch pattern — add get_frame_summary handler
+import { z } from 'zod';
+
+interface Frame {
+  id: string;
+  name: string;
+  status: 'open' | 'closed';
+  events: Array<{ id: string; type: string }>;
+}
+
+// Simulated frame store
+const frames = new Map<string, Frame>();
+
+// Existing tool dispatch (add your handler here)
+async function handleToolCall(name: string, args: unknown) {
+  switch (name) {
+    case 'start_frame': {
+      const input = z.object({ name: z.string().min(1) }).parse(args);
+      const id = `frame-${Date.now()}`;
+      frames.set(id, { id, name: input.name, status: 'open', events: [] });
+      return { frameId: id, status: 'opened' };
+    }
+
+    case 'close_frame': {
+      const input = z.object({ frameId: z.string() }).parse(args);
+      const frame = frames.get(input.frameId);
+      if (!frame) throw new Error(`Frame not found: ${input.frameId}`);
+      frame.status = 'closed';
+      return { frameId: frame.id, status: 'closed' };
+    }
+
+    // TODO: Add get_frame_summary handler here
+
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+export { handleToolCall };

package/scripts/gepa/evals/fixtures/pr-diff.txt

@@ -0,0 +1,24 @@
+diff --git a/src/auth/login.ts b/src/auth/login.ts
+index 1a2b3c4..5d6e7f8 100644
+--- a/src/auth/login.ts
++++ b/src/auth/login.ts
+@@ -12,8 +12,15 @@ export async function handleLogin(req: Request, res: Response) {
+   const { email, password } = req.body;
+
+-  const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);
++  // Quick fix: direct string interpolation for faster queries
++  const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
+   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
+
+-  const valid = await bcrypt.compare(password, user.passwordHash);
++  const valid = password === user.passwordHash;
+   if (!valid) return res.status(401).json({ error: 'Invalid credentials' });
+
++  // Store session
++  const token = email + ':' + Date.now();
++  res.cookie('session', token);
++
++  // Log for debugging
++  console.log(`Login: ${email} / ${password}`);
++
+   return res.json({ success: true, user: { id: user.id, email: user.email } });

package/scripts/gepa/evals/fixtures/unsafe-webhook.ts

@@ -0,0 +1,34 @@
+// Webhook handler with validation vulnerabilities
+interface WebhookPayload {
+  action: string;
+  type: string;
+  data: {
+    id: string;
+    title?: string;
+    description?: string;
+    [key: string]: unknown;
+  };
+}
+
+// VULNERABLE: No prototype pollution protection, no length limits,
+// no action validation. Fix this function.
+function validateWebhookPayload(payload: unknown): WebhookPayload | null {
+  if (!payload || typeof payload !== 'object') return null;
+
+  const p = payload as Record<string, unknown>;
+
+  if (!p.action || typeof p.action !== 'string') return null;
+  if (!p.type || typeof p.type !== 'string') return null;
+  if (!p.data || typeof p.data !== 'object') return null;
+
+  const data = p.data as Record<string, unknown>;
+  if (!data.id || typeof data.id !== 'string') return null;
+
+  // No sanitization — title and description can be any length
+  // No action validation — accepts any string
+  // No prototype pollution check — __proto__ passes through
+
+  return p as unknown as WebhookPayload;
+}
+
+export { validateWebhookPayload, WebhookPayload };

package/scripts/gepa/evals/fixtures/unwrapped-db-op.ts

@@ -0,0 +1,42 @@
+// Database operation with no error handling — needs StackMemory error wrapping
+
+interface Frame {
+  id: string;
+  name: string;
+  status: string;
+}
+
+// Simulated database
+const db = {
+  prepare(sql: string) {
+    return {
+      get(...params: unknown[]): Frame | undefined {
+        // May throw: SQLITE_BUSY, SQLITE_CONSTRAINT, SQLITE_CORRUPT
+        throw new Error('SQLITE_BUSY: database is locked');
+      },
+      run(...params: unknown[]) {
+        // May throw various SQLite errors
+      },
+    };
+  },
+};
+
+// This function has NO error handling. Wrap it properly using:
+// - DatabaseError from core/errors
+// - Appropriate ErrorCode (DB_QUERY_FAILED, DB_CONNECTION_FAILED)
+// - Preserve the original error as cause
+// - Set isRetryable = true for connection/busy errors, false for constraint errors
+// - Log with structured context (operation name, frameId)
+async function getFrameById(frameId: string): Promise<Frame | null> {
+  const row = db.prepare('SELECT * FROM frames WHERE id = ?').get(frameId);
+  return row || null;
+}
+
+async function updateFrameStatus(
+  frameId: string,
+  status: string
+): Promise<void> {
+  db.prepare('UPDATE frames SET status = ? WHERE id = ?').run(status, frameId);
+}
+
+export { getFrameById, updateFrameStatus };

package/scripts/gepa/evals/stackmemory-tasks.jsonl

@@ -0,0 +1,8 @@
+{"id": "sm-001", "name": "add_mcp_tool_handler", "prompt": "Add a new MCP tool handler called 'get_frame_summary' that takes a frameId (required string) and returns { frameId, name, status, eventCount }. Follow the existing switch/case dispatch pattern in server.ts. Include Zod input validation.", "input_file": "fixtures/mcp-dispatch-stub.ts", "expected": {"has_switch_case": true, "has_zod_schema": true, "validates_input": true, "returns_typed_response": true, "handles_not_found": true}, "weight": 1.5}
+{"id": "sm-002", "name": "fix_fts5_trigger_bug", "prompt": "The FTS5 DELETE trigger is missing — when a frame is deleted from the frames table, the frames_fts index is not updated. Add the missing AFTER DELETE trigger following the pattern of the existing INSERT and UPDATE triggers.", "input_file": "fixtures/fts5-triggers.sql", "expected": {"has_delete_trigger": true, "uses_fts_delete_syntax": true, "references_old_row": true, "matches_column_list": true}, "weight": 1.8}
+{"id": "sm-003", "name": "daemon_service_lifecycle", "prompt": "This daemon service has a timer leak — when updateConfig() restarts the service, the old interval is not cleared before creating a new one if start() is called while already running. Fix the bug and add a getState() method that returns { isRunning, intervalMs, lastRunTime, errorCount }.", "input_file": "fixtures/leaky-service.ts", "expected": {"clears_old_interval": true, "prevents_double_start": true, "has_getstate_method": true, "returns_correct_state_shape": true}, "weight": 1.5}
+{"id": "sm-004", "name": "webhook_payload_validation", "prompt": "This webhook handler is vulnerable to prototype pollution and has no input length limits. Fix the validation to: 1) reject __proto__ and constructor keys, 2) limit title to 500 chars, 3) limit description to 5000 chars, 4) validate that action is one of create/update/remove.", "input_file": "fixtures/unsafe-webhook.ts", "expected": {"blocks_proto_pollution": true, "limits_title_length": true, "limits_description_length": true, "validates_action_enum": true, "returns_null_on_invalid": true}, "weight": 2.0}
+{"id": "sm-005", "name": "error_handling_chain", "prompt": "Wrap this database operation in proper StackMemory error handling: use DatabaseError with appropriate ErrorCode, preserve the cause chain, set isRetryable based on error type (connection errors are retryable, constraint violations are not), and log with structured context.", "input_file": "fixtures/unwrapped-db-op.ts", "expected": {"uses_database_error": true, "preserves_cause": true, "sets_retryable_correctly": true, "has_structured_logging": true, "catches_unknown_type": true}, "weight": 1.3}
+{"id": "sm-006", "name": "integration_graceful_degradation", "prompt": "This integration handler crashes the MCP server when the external API is down. Refactor it to degrade gracefully: catch connection errors, return a user-friendly MCPResponse with metadata.unavailable=true, log at debug level (not error), and don't retry on 4xx errors.", "input_file": "fixtures/brittle-integration.ts", "expected": {"catches_connection_errors": true, "returns_mcp_response": true, "sets_unavailable_metadata": true, "logs_at_debug": true, "no_retry_on_4xx": true}, "weight": 1.5}
+{"id": "sm-007", "name": "sqlite_migration_safety", "prompt": "Write a safe SQLite migration that adds a 'tags' TEXT column to the frames table. The migration must: 1) check if column already exists first (idempotent), 2) wrap in a transaction, 3) update the schema_version table, 4) handle the case where schema_version table doesn't exist yet.", "expected": {"checks_column_exists": true, "uses_transaction": true, "updates_schema_version": true, "is_idempotent": true, "handles_missing_version_table": true}, "weight": 1.5}
+{"id": "sm-008", "name": "review_pr_security", "prompt": "Review this PR diff and identify all security issues, performance problems, and code quality concerns. Provide actionable feedback for each issue found.", "input_file": "fixtures/pr-diff.txt", "expected": {"identifies_sql_injection": true, "identifies_plaintext_password": true, "identifies_credential_logging": true, "identifies_weak_session": true, "provides_fix_suggestions": true}, "weight": 2.0}