@stackmemoryai/stackmemory 1.2.0 → 1.2.2

package/scripts/gepa/results/eval-1-variant-d.json

@@ -0,0 +1,198 @@
+{
+  "variant": "variant-d",
+  "generation": 1,
+  "results": [
+    {
+      "taskId": "eval-001",
+      "taskName": "simple_function",
+      "weight": 1,
+      "passed": true,
+      "passRate": 0.6666666666666666,
+      "criteria": {
+        "has_function": {
+          "passed": true,
+          "reason": "A complete, working function `isPalindrome` is defined in TypeScript with proper syntax, parameters, return type, and implementation."
+        },
+        "handles_edge_cases": {
+          "passed": true,
+          "reason": "The code handles edge cases: empty strings (returns true), mixed case (lowercase normalization), and special characters (regex removal of non-alphanumeric)."
+        },
+        "is_tested": {
+          "passed": false,
+          "reason": "The output shows example outputs but provides no actual test cases, unit tests, or test function definitions. Examples are illustrative documentation, not executable tests."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 26370,
+      "output": "I've written a palindrome checker function at `/private/tmp/gepa-eval-X4niM9/isPalindrome.ts`:\n\n```typescript\nexport function isPalindrome(str: string): boolean {\n  if (!str) return true;\n\n  const normalized = str.toLowerCase().replace(/[^a-z0-9]/g, '');\n  const reversed = normalized.split('').reverse().join('');\n\n  return normalized === reversed;\n}\n```\n\n**Features**:\n- Returns `true` for empty strings\n- Normalizes by converting to lowercase and removing non-alphanumeric characters\n- Compares the normalized string with its reverse\n\n**Examples**:\n- `isPalindrome(\"racecar\")` → `true`\n- `isPalindrome(\"A man, a plan, a canal: Panama\")` → `true`\n- `isPalindrome(\"hello\")` → `false`\n"
+    },
+    {
+      "taskId": "eval-002",
+      "taskName": "refactor_code",
+      "weight": 1.5,
+      "passed": false,
+      "passRate": 0,
+      "criteria": {
+        "uses_async": {
+          "passed": false,
+          "reason": "No async/await code is provided; AI only requests the original code instead of demonstrating the refactored solution"
+        },
+        "preserves_behavior": {
+          "passed": false,
+          "reason": "No refactored code is shown, so behavior preservation cannot be verified"
+        },
+        "no_nested_callbacks": {
+          "passed": false,
+          "reason": "No refactored code is demonstrated; the output is a request for input rather than a solution"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 8335,
+      "output": "I need to see the code you want to refactor. Could you please provide the file path or share the code that uses callbacks?\n"
+    },
+    {
+      "taskId": "eval-003",
+      "taskName": "fix_bug",
+      "weight": 1.2,
+      "passed": true,
+      "passRate": 0.6666666666666666,
+      "criteria": {
+        "bug_fixed": {
+          "passed": false,
+          "reason": "The output only describes the fix but does not show the actual fixed code. No corrected code snippet is provided to verify the bug is actually fixed."
+        },
+        "no_new_bugs": {
+          "passed": true,
+          "reason": "The suggested fix (changing `i <= items.length` to `i < items.length`) is a standard, correct solution for off-by-one errors and introduces no new bugs."
+        },
+        "explains_fix": {
+          "passed": true,
+          "reason": "The output clearly explains what was wrong (accessing undefined index 3 on a 3-element array) and why the fix works (using < instead of <=)."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 25447,
+      "output": "Fixed buggy-loop.js:6 - changed `i <= items.length` to `i < items.length` to prevent accessing `items[3]` (undefined) on a 3-element array.\n"
+    },
+    {
+      "taskId": "eval-004",
+      "taskName": "add_feature",
+      "weight": 1.5,
+      "passed": false,
+      "passRate": 0,
+      "criteria": {
+        "has_pagination": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        },
+        "has_limit": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        },
+        "has_offset": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        },
+        "backwards_compatible": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 20951,
+      "output": "\n"
+    },
+    {
+      "taskId": "eval-005",
+      "taskName": "code_review",
+      "weight": 1.3,
+      "passed": true,
+      "passRate": 0.6666666666666666,
+      "criteria": {
+        "identifies_security_issue": {
+          "passed": true,
+          "reason": "Output correctly identifies 5 legitimate security vulnerabilities: SQL injection, plaintext password comparison, sensitive data logging, insecure session tokens, and missing HttpOnly cookie flags with clear code examples and impact analysis"
+        },
+        "identifies_performance_issue": {
+          "passed": false,
+          "reason": "Output does not identify any performance issues. The review focuses exclusively on security vulnerabilities with no mention of performance, scalability, or optimization concerns"
+        },
+        "actionable_feedback": {
+          "passed": true,
+          "reason": "Output provides specific, actionable fixes for each issue including exact code examples (e.g., parameterized queries, bcrypt.compare, crypto.randomBytes, cookie options) that developers can immediately implement"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 29814,
+      "output": "## Critical Security Issues Found\n\nThis PR contains **MULTIPLE SEVERE SECURITY VULNERABILITIES** that must be rejected:\n\n### 🔴 CRITICAL: SQL Injection (Line 10)\n```typescript\nconst user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);\n```\n**Issue**: Direct string interpolation enables SQL injection attacks  \n**Attack**: `email = \"' OR '1'='1' --\"` bypasses authentication  \n**Fix**: Revert to parameterized query: `db.query('SELECT * FROM users WHERE email = $1', [email])`\n\n### 🔴 CRITICAL: Plaintext Password Comparison (Line 14)\n```typescript\nconst valid = password === user.passwordHash;\n```\n**Issue**: Removes bcrypt password hashing, comparing plaintext to hash  \n**Impact**: Authentication always fails OR passwords stored in plaintext  \n**Fix**: Revert to `await bcrypt.compare(password, user.passwordHash)`\n\n### 🔴 CRITICAL: Sensitive Data Logging (Line 22)\n```typescript\nconsole.log(`Login: ${email} / ${password}`);\n```\n**Issue**: Logs plaintext passwords to console/logs  \n**Impact**: Password exposure in log files, GDPR/compliance violation  \n**Fix**: Remove this line entirely or log only: `console.log(\\`Login attempt: ${email}\\`)`\n\n### 🔴 HIGH: Insecure Session Token (Line 18)\n```typescript\nconst token = email + ':' + Date.now();\n```\n**Issue**: Predictable token generation (email + timestamp)  \n**Impact**: Session hijacking via token guessing  \n**Fix**: Use cryptographically secure random tokens: `crypto.randomBytes(32).toString('hex')`\n\n### 🟡 MEDIUM: Missing HttpOnly Cookie Flag\n```typescript\nres.cookie('session', token);\n```\n**Issue**: Cookie accessible via JavaScript (XSS vulnerability)  \n**Fix**: `res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'strict' })`\n\n## Recommendation\n\n**REJECT THIS PR IMMEDIATELY** - Contains multiple critical security vulnerabilities including SQL injection and plaintext password exposure. The \"quick fix\" comment on line 9 is a red flag for introducing security issues.\n\nAll changes should be *"
+    },
+    {
+      "taskId": "sm-001",
+      "taskName": "add_mcp_tool_handler",
+      "weight": 1.5,
+      "passed": true,
+      "passRate": 1,
+      "criteria": {
+        "has_switch_case": {
+          "passed": true,
+          "reason": "Code shows a case statement 'get_frame_summary' within a switch/case structure, following the dispatch pattern"
+        },
+        "has_zod_schema": {
+          "passed": true,
+          "reason": "Zod schema is defined inline: z.object({ frameId: z.string() }), validating the required frameId parameter"
+        },
+        "validates_input": {
+          "passed": true,
+          "reason": "Input validation occurs via .parse(args) which will throw if frameId is missing or not a string"
+        },
+        "returns_typed_response": {
+          "passed": true,
+          "reason": "Return statement explicitly returns an object with the four required properties: frameId, name, status, eventCount"
+        },
+        "handles_not_found": {
+          "passed": true,
+          "reason": "Code includes explicit null check (if (!frame)) with error thrown when frame is not found in the frames map"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 33763,
+      "output": "I've added the `get_frame_summary` handler to the MCP server dispatch pattern. The implementation:\n\n**Added case** (mcp-dispatch-stub.ts:32-42):\n```typescript\ncase 'get_frame_summary': {\n  const input = z.object({ frameId: z.string() }).parse(args);\n  const frame = frames.get(input.frameId);\n  if (!frame) throw new Error(`Frame not found: ${input.frameId}`);\n  return {\n    frameId: frame.id,\n    name: frame.name,\n    status: frame.status,\n    eventCount: frame.events.length\n  };\n}\n```\n\n**Features**:\n- ✓ Zod validation for required `frameId` string parameter\n- ✓ Follows existing switch/case dispatch pattern\n- ✓ Returns `{ frameId, name, status, eventCount }` as specified\n- ✓ Error handling for missing frames (consistent with `close_frame`)\n- ✓ Calculates `eventCount` from `frame.events.length`\n\nThe handler integrates seamlessly with the existing `start_frame` and `close_frame` tools.\n"
+    },
+    {
+      "taskId": "sm-002",
+      "taskName": "fix_fts5_trigger_bug",
+      "weight": 1.8,
+      "passed": true,
+      "passRate": 1,
+      "criteria": {
+        "has_delete_trigger": {
+          "passed": true,
+          "reason": "A DELETE trigger named 'frames_ad' is defined with AFTER DELETE ON frames syntax"
+        },
+        "uses_fts_delete_syntax": {
+          "passed": true,
+          "reason": "The trigger uses FTS5 special syntax with INSERT INTO frames_fts(frames_fts, ...) VALUES ('delete', ...) which is the correct way to delete from FTS index"
+        },
+        "references_old_row": {
+          "passed": true,
+          "reason": "The trigger references old.rowid, old.name, old.digest_text, and old.inputs, old.outputs to access the deleted row values"
+        },
+        "matches_column_list": {
+          "passed": true,
+          "reason": "The column list (rowid, name, digest_text, inputs, outputs) matches the FTS index structure referenced in the INSERT and UPDATE triggers"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 34003,
+      "output": "I've added the missing DELETE trigger following the exact pattern of the existing triggers:\n\n**Pattern analysis:**\n- INSERT trigger (`frames_ai`): Adds new row to FTS index\n- UPDATE trigger (`frames_au`): Deletes old row, inserts new row\n- DELETE trigger (`frames_ad`): Deletes row from FTS index\n\n**Implementation:**\n```sql\nCREATE TRIGGER IF NOT EXISTS frames_ad AFTER DELETE ON frames BEGIN\n  INSERT INTO frames_fts(frames_fts, rowid, name, digest_text, inputs, outputs)\n  VALUES ('delete', old.rowid, old.name, old.digest_text, old.inputs, old.outputs);\nEND;\n```\n\nThe trigger uses the FTS5 special command syntax where `INSERT INTO frames_fts(frames_fts, ...)` with `'delete'` as the first value removes the entry from the full-text index.\n"
+    },
+    {
+      "taskId": "sm-003",
+      "taskName": "daemon_service_lifecycle",
+      "weight": 1.5,
+      "passed": false,
+      "duration": 120042,
+      "error": "claude timed out after 120000ms"
+    }
+  ]
+}

package/scripts/gepa/state.json

@@ -1,14 +1,53 @@
 {
-  "currentGeneration": 0,
-  "bestVariant": "baseline",
-  "bestScore": 0,
-  "targetPath": "./CLAUDE.md",
+  "currentGeneration": 1,
+  "bestVariant": "variant-d",
+  "bestScore": 0.4985250737463126,
+  "targetPath": "/Users/jwu/Dev/stackmemory/CLAUDE.md",
   "history": [
     {
       "generation": 0,
       "variant": "baseline",
       "action": "init",
-      "timestamp": "2026-02-02T15:09:09.369Z"
+      "timestamp": "2026-02-18T22:59:36.437Z"
+    },
+    {
+      "generation": 1,
+      "action": "mutate",
+      "variants": [
+        "variant-a",
+        "variant-b",
+        "variant-c",
+        "variant-d"
+      ],
+      "timestamp": "2026-02-18T23:03:13.997Z"
+    },
+    {
+      "generation": 1,
+      "action": "select",
+      "scores": [
+        {
+          "variant": "variant-d",
+          "score": 0.4985250737463126
+        },
+        {
+          "variant": "variant-b",
+          "score": 0.3938053097345133
+        },
+        {
+          "variant": "variant-c",
+          "score": 0.23230088495575218
+        },
+        {
+          "variant": "baseline",
+          "score": 0.21165191740412978
+        },
+        {
+          "variant": "variant-a",
+          "score": 0.1762536873156342
+        }
+      ],
+      "best": "variant-d",
+      "timestamp": "2026-02-18T23:23:18.544Z"
     }
   ]
 }

package/scripts/install-claude-hooks-auto.js

@@ -5,6 +5,10 @@
  * This runs as a postinstall script to set up tracing hooks and daemon
  *
  * INTERACTIVE: Asks for user consent before modifying ~/.claude
+ *
+ * Writes to ~/.claude/settings.json (the current Claude Code config format).
+ * Uses CANONICAL_HOOKS from hook-installer when dist is available, otherwise
+ * falls back to an inline definition.
  */
 
 import {
@@ -13,6 +17,8 @@ import {
   copyFileSync,
   readFileSync,
   writeFileSync,
+  renameSync,
+  chmodSync,
 } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
@@ -25,11 +31,144 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 const claudeHooksDir = join(homedir(), '.claude', 'hooks');
-const claudeConfigFile = join(homedir(), '.claude', 'hooks.json');
+const claudeSettingsFile = join(homedir(), '.claude', 'settings.json');
 const templatesDir = join(__dirname, '..', 'templates', 'claude-hooks');
 const stackmemoryBinDir = join(homedir(), '.stackmemory', 'bin');
 const distDir = join(__dirname, '..', 'dist');
 
+// ---------------------------------------------------------------------------
+// Try to import from compiled hook-installer; fall back to inline definitions
+// ---------------------------------------------------------------------------
+
+/** @type {Array<{scriptName: string, eventType: string, matcher?: string, timeout?: number, commandPrefix?: string, required: boolean}>} */
+let CANONICAL_HOOKS;
+let mergeSettingsFn;
+let readSettingsFn;
+let writeSettingsAtomicFn;
+
+try {
+  const mod = await import('../dist/src/utils/hook-installer.js');
+  CANONICAL_HOOKS = mod.CANONICAL_HOOKS;
+  mergeSettingsFn = mod.mergeSettings;
+  readSettingsFn = mod.readSettings;
+  writeSettingsAtomicFn = mod.writeSettingsAtomic;
+} catch {
+  // dist not built yet — use inline fallback
+  CANONICAL_HOOKS = [
+    {
+      scriptName: 'session-rescue.sh',
+      eventType: 'Stop',
+      timeout: 12,
+      required: true,
+    },
+    {
+      scriptName: 'stop-checkpoint.js',
+      eventType: 'Stop',
+      timeout: 5,
+      commandPrefix: 'node',
+      required: true,
+    },
+    {
+      scriptName: 'chime-on-stop.sh',
+      eventType: 'Stop',
+      timeout: 2,
+      required: true,
+    },
+    {
+      scriptName: 'auto-checkpoint.js',
+      eventType: 'PostToolUse',
+      timeout: 2,
+      commandPrefix: 'node',
+      required: true,
+    },
+  ];
+
+  const DEAD_HOOKS = ['sms-response-handler.js'];
+
+  readSettingsFn = (p) => {
+    try {
+      if (existsSync(p)) return JSON.parse(readFileSync(p, 'utf8'));
+    } catch {
+      /* parse error */
+    }
+    return {};
+  };
+
+  writeSettingsAtomicFn = (settings, p) => {
+    const dir = dirname(p);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    const tmp = p + '.tmp';
+    writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
+    renameSync(tmp, p);
+  };
+
+  mergeSettingsFn = (existing, hooksDir) => {
+    const merged = JSON.parse(JSON.stringify(existing));
+    if (!merged.hooks) merged.hooks = {};
+
+    // Remove dead hooks
+    for (const eventType of Object.keys(merged.hooks)) {
+      const groups = merged.hooks[eventType];
+      for (const group of groups) {
+        group.hooks = group.hooks.filter((h) => {
+          for (const dead of DEAD_HOOKS) {
+            if (h.command.includes(dead)) return false;
+          }
+          return true;
+        });
+      }
+      merged.hooks[eventType] = groups.filter((g) => g.hooks.length > 0);
+      if (merged.hooks[eventType].length === 0) delete merged.hooks[eventType];
+    }
+
+    // Add missing canonical hooks
+    for (const entry of CANONICAL_HOOKS) {
+      const exists = (merged.hooks[entry.eventType] || []).some((group) =>
+        group.hooks.some((h) => h.command.includes(entry.scriptName))
+      );
+      if (exists) continue;
+
+      const scriptPath = join(hooksDir, entry.scriptName);
+      const command = entry.commandPrefix
+        ? `${entry.commandPrefix} ${scriptPath}`
+        : scriptPath;
+      const hookCmd = { type: 'command', command };
+      if (entry.timeout) hookCmd.timeout = entry.timeout;
+
+      const eventGroups = merged.hooks[entry.eventType] || [];
+      const matcherValue = entry.matcher;
+      let targetGroup = eventGroups.find((g) =>
+        matcherValue ? g.matcher === matcherValue : !g.matcher
+      );
+
+      if (targetGroup) {
+        targetGroup.hooks.push(hookCmd);
+      } else {
+        const newGroup = { hooks: [hookCmd] };
+        if (matcherValue) newGroup.matcher = matcherValue;
+        eventGroups.push(newGroup);
+      }
+      merged.hooks[entry.eventType] = eventGroups;
+    }
+
+    return merged;
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Legacy hook files (still installed for backward-compat tooling hooks)
+// ---------------------------------------------------------------------------
+
+const LEGACY_HOOK_FILES = [
+  'tool-use-trace.js',
+  'on-startup.js',
+  'on-clear.js',
+  'on-task-complete.js',
+  'skill-eval.sh',
+  'skill-eval.cjs',
+];
+const LEGACY_DATA_FILES = ['skill-rules.json'];
+
 /**
  * Ask user for confirmation before installing hooks
  * Returns true if user consents, false otherwise
@@ -51,14 +190,13 @@ async function askForConsent() {
     return false;
   }
 
-  console.log('\n📦 StackMemory Post-Install\n');
+  console.log('\nStackMemory Post-Install\n');
   console.log(
     'StackMemory can integrate with Claude Code by installing hooks that:'
   );
   console.log('  - Track tool usage for better context');
   console.log('  - Enable session persistence across restarts');
-  console.log('  - Sync context with Linear (optional)');
-  console.log('  - Auto-update PROMPT_PLAN on task completion');
+  console.log('  - Auto-checkpoint and session rescue');
   console.log('  - Recommend relevant skills based on your prompts');
   console.log('\nThis will modify files in ~/.claude/\n');
 
@@ -91,24 +229,38 @@ async function installClaudeHooks() {
       console.log('Created ~/.claude/hooks directory');
     }
 
-    // Copy hook files (scripts + data files)
-    const hookFiles = [
-      'tool-use-trace.js',
-      'on-startup.js',
-      'on-clear.js',
-      'on-task-complete.js',
-      'skill-eval.sh',
-      'skill-eval.cjs',
-    ];
-    const dataFiles = ['skill-rules.json'];
     let installed = 0;
 
-    for (const hookFile of [...hookFiles, ...dataFiles]) {
+    // --- Install canonical session-persistence hooks ---
+    for (const entry of CANONICAL_HOOKS) {
+      const srcPath = join(templatesDir, entry.scriptName);
+      const destPath = join(claudeHooksDir, entry.scriptName);
+
+      if (existsSync(srcPath)) {
+        // Backup existing hook if it exists
+        if (existsSync(destPath)) {
+          const backupPath = `${destPath}.backup-${Date.now()}`;
+          copyFileSync(destPath, backupPath);
+          console.log(`  Backed up: ${entry.scriptName}`);
+        }
+
+        copyFileSync(srcPath, destPath);
+        try {
+          chmodSync(destPath, 0o755);
+        } catch {
+          // Silent fail on chmod
+        }
+        installed++;
+        console.log(`  Installed: ${entry.scriptName}`);
+      }
+    }
+
+    // --- Install legacy tooling hooks ---
+    for (const hookFile of [...LEGACY_HOOK_FILES, ...LEGACY_DATA_FILES]) {
       const srcPath = join(templatesDir, hookFile);
       const destPath = join(claudeHooksDir, hookFile);
 
       if (existsSync(srcPath)) {
-        // Backup existing hook if it exists
         if (existsSync(destPath)) {
           const backupPath = `${destPath}.backup-${Date.now()}`;
           copyFileSync(destPath, backupPath);
@@ -117,11 +269,9 @@ async function installClaudeHooks() {
 
         copyFileSync(srcPath, destPath);
 
-        // Make executable (scripts only, not data files)
-        if (!dataFiles.includes(hookFile)) {
+        if (!LEGACY_DATA_FILES.includes(hookFile)) {
           try {
-            const { execSync } = await import('child_process');
-            execSync(`chmod +x "${destPath}"`, { stdio: 'ignore' });
+            chmodSync(destPath, 0o755);
           } catch {
             // Silent fail on chmod
           }
@@ -132,30 +282,14 @@ async function installClaudeHooks() {
       }
     }
 
-    // Update hooks.json configuration
-    let hooksConfig = {};
-    if (existsSync(claudeConfigFile)) {
-      try {
-        hooksConfig = JSON.parse(readFileSync(claudeConfigFile, 'utf8'));
-      } catch {
-        // Start fresh if parse fails
-      }
-    }
-
-    // Add our hooks (don't overwrite existing hooks unless they're ours)
-    const newHooksConfig = {
-      ...hooksConfig,
-      'tool-use-approval': join(claudeHooksDir, 'tool-use-trace.js'),
-      'on-startup': join(claudeHooksDir, 'on-startup.js'),
-      'on-clear': join(claudeHooksDir, 'on-clear.js'),
-      'on-task-complete': join(claudeHooksDir, 'on-task-complete.js'),
-      'user-prompt-submit': join(claudeHooksDir, 'skill-eval.sh'),
-    };
-
-    writeFileSync(claudeConfigFile, JSON.stringify(newHooksConfig, null, 2));
+    // --- Update settings.json (not the deprecated hooks.json) ---
+    const currentSettings = readSettingsFn(claudeSettingsFile);
+    const merged = mergeSettingsFn(currentSettings, claudeHooksDir);
+    writeSettingsAtomicFn(merged, claudeSettingsFile);
 
     if (installed > 0) {
       console.log(`\n[OK] Installed ${installed} Claude hooks`);
+      console.log(`     Config: ~/.claude/settings.json`);
       console.log(`     Traces: ~/.stackmemory/traces/`);
       console.log('     To disable: set DEBUG_TRACE=false in .env');
     }
@@ -189,10 +323,8 @@ async function installSessionDaemon() {
     if (existsSync(daemonSrc)) {
       copyFileSync(daemonSrc, daemonDest);
 
-      // Make executable
       try {
-        const { execSync } = await import('child_process');
-        execSync(`chmod +x "${daemonDest}"`, { stdio: 'ignore' });
+        chmodSync(daemonDest, 0o755);
       } catch {
         // Silent fail on chmod
       }