@stackmemoryai/stackmemory 1.2.1 → 1.2.2

package/scripts/gepa/results/eval-1-variant-c.json

@@ -5,37 +5,194 @@
     {
       "taskId": "eval-001",
       "taskName": "simple_function",
+      "weight": 1,
       "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "passRate": 0,
+      "criteria": {
+        "has_function": {
+          "passed": false,
+          "reason": "No function is defined or implemented. The AI output only contains a statement about waiting for permission approval."
+        },
+        "handles_edge_cases": {
+          "passed": false,
+          "reason": "No code is present to handle edge cases. Without a function implementation, edge cases cannot be addressed."
+        },
+        "is_tested": {
+          "passed": false,
+          "reason": "No tests are provided. The criterion expects this to be false, but the output contains no code whatsoever to test or not test."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 26808,
+      "output": "Let me wait for permission approval before proceeding.\n"
     },
     {
       "taskId": "eval-002",
       "taskName": "refactor_code",
+      "weight": 1.5,
       "passed": false,
-      "duration": 5,
-      "output": "/bin/sh: timeout: command not found\n"
+      "passRate": 0,
+      "criteria": {
+        "uses_async": {
+          "passed": false,
+          "reason": "No async/await code is present in the output. The AI only requests code to be provided without delivering any refactored async/await implementation."
+        },
+        "preserves_behavior": {
+          "passed": false,
+          "reason": "No refactored code exists to evaluate whether behavior is preserved. The output is a request for input rather than a solution."
+        },
+        "no_nested_callbacks": {
+          "passed": false,
+          "reason": "No code transformation was performed. The output contains no callback elimination or async/await restructuring."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 9457,
+      "output": "I'd be happy to help refactor code from callbacks to async/await! However, I don't see any code provided yet. Could you please share the code you'd like me to refactor?\n\nYou can either:\n1. Provide the file path (e.g., `src/path/to/file.ts`)\n2. Paste the code directly\n3. Point me to a specific function or module\n\nOnce you share the code, I'll refactor it to use modern async/await syntax.\n"
     },
     {
       "taskId": "eval-003",
       "taskName": "fix_bug",
+      "weight": 1.2,
       "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "passRate": 0,
+      "criteria": {
+        "bug_fixed": {
+          "passed": false,
+          "reason": "No code was provided in the output - only empty code blocks. The bug cannot be fixed without actual code."
+        },
+        "no_new_bugs": {
+          "passed": false,
+          "reason": "No code was provided to evaluate for new bugs."
+        },
+        "explains_fix": {
+          "passed": false,
+          "reason": "No explanation was provided. The output is completely empty."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 24117,
+      "output": "\n"
     },
     {
       "taskId": "eval-004",
       "taskName": "add_feature",
-      "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "weight": 1.5,
+      "passed": true,
+      "passRate": 0.75,
+      "criteria": {
+        "has_pagination": {
+          "passed": true,
+          "reason": "Pagination is clearly described with page and limit parameters, and response includes pagination metadata object"
+        },
+        "has_limit": {
+          "passed": true,
+          "reason": "Limit parameter is explicitly defined with default of 10 and max of 100"
+        },
+        "has_offset": {
+          "passed": false,
+          "reason": "Output uses page-based pagination, not offset-based. Offset parameter is not mentioned or implemented"
+        },
+        "backwards_compatible": {
+          "passed": true,
+          "reason": "Default values (page=1, limit=10) ensure existing calls without parameters continue to work as before"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 24827,
+      "output": "I've added pagination to the `/users` endpoint with the following features:\n\n**Query Parameters:**\n- `page` (default: 1, min: 1)\n- `limit` (default: 10, min: 1, max: 100)\n\n**Response Format:**\n```json\n{\n  \"data\": [...],\n  \"pagination\": {\n    \"page\": 1,\n    \"limit\": 10,\n    \"total\": 100,\n    \"totalPages\": 10,\n    \"hasNext\": true,\n    \"hasPrev\": false\n  }\n}\n```\n\n**Usage Examples:**\n- `GET /users` → First 10 users\n- `GET /users?page=2&limit=20` → Users 21-40\n- `GET /users?limit=50` → First 50 users\n\nThe implementation includes:\n- Safe parameter parsing with defaults\n- Bounds checking (limit capped at 100)\n- Comprehensive pagination metadata\n- Navigation helpers (hasNext/hasPrev)\n"
     },
     {
       "taskId": "eval-005",
       "taskName": "code_review",
+      "weight": 1.3,
+      "passed": false,
+      "passRate": 0,
+      "criteria": {
+        "identifies_security_issue": {
+          "passed": false,
+          "reason": "The output does not identify any security issue. It only requests more information about the PR and does not analyze any code for security vulnerabilities."
+        },
+        "identifies_performance_issue": {
+          "passed": false,
+          "reason": "The output does not identify any performance issue. It is a meta-response asking for input rather than an actual code review."
+        },
+        "actionable_feedback": {
+          "passed": false,
+          "reason": "While the output provides reasonable next steps to enable a review, it does not provide any actionable feedback about code issues. It is a request for clarification, not feedback on actual problems."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 15976,
+      "output": "I see this isn't a git repository. Could you please provide:\n\n1. **PR URL** (e.g., GitHub/GitLab link), or\n2. **Branch name** to compare, or\n3. **Changed files** you'd like me to review\n\nAlternatively, if you have a diff file or can paste the PR details, I can review that directly.\n"
+    },
+    {
+      "taskId": "sm-001",
+      "taskName": "add_mcp_tool_handler",
+      "weight": 1.5,
+      "passed": true,
+      "passRate": 1,
+      "criteria": {
+        "has_switch_case": {
+          "passed": true,
+          "reason": "Code shows a switch/case statement with 'case' keyword and proper case block syntax"
+        },
+        "has_zod_schema": {
+          "passed": true,
+          "reason": "Zod schema is defined inline: z.object({ frameId: z.string() })"
+        },
+        "validates_input": {
+          "passed": true,
+          "reason": "Input validation is performed via .parse(args) which will throw on invalid input"
+        },
+        "returns_typed_response": {
+          "passed": true,
+          "reason": "Returns an object with all required fields: frameId, name, status, eventCount with appropriate types"
+        },
+        "handles_not_found": {
+          "passed": true,
+          "reason": "Includes explicit null check with error thrown when frame is not found in the frames map"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 34329,
+      "output": "I've added the `get_frame_summary` handler. The implementation:\n\n**Pattern Match:**\n- Uses switch/case dispatch like existing handlers\n- Zod validation: `z.object({ frameId: z.string() }).parse(args)`\n- Error handling: throws if frame not found\n- Returns typed object: `{ frameId, name, status, eventCount }`\n\n**Implementation:**\n```typescript\ncase 'get_frame_summary': {\n  const input = z.object({ frameId: z.string() }).parse(args);\n  const frame = frames.get(input.frameId);\n  if (!frame) throw new Error(`Frame not found: ${input.frameId}`);\n  return {\n    frameId: frame.id,\n    name: frame.name,\n    status: frame.status,\n    eventCount: frame.events.length,\n  };\n}\n```\n\nThe handler validates input, retrieves the frame, and returns the summary with event count derived from the events array length.\n"
+    },
+    {
+      "taskId": "sm-002",
+      "taskName": "fix_fts5_trigger_bug",
+      "weight": 1.8,
+      "passed": false,
+      "passRate": 0,
+      "criteria": {
+        "has_delete_trigger": {
+          "passed": false,
+          "reason": "The output only describes/mentions the trigger but does not show the actual SQL code. No real trigger definition is provided."
+        },
+        "uses_fts_delete_syntax": {
+          "passed": false,
+          "reason": "The correct FTS5 delete syntax is described in text but not shown in executable code form. Without actual code, the syntax cannot be verified."
+        },
+        "references_old_row": {
+          "passed": false,
+          "reason": "The output mentions using 'old row values' but provides no actual code demonstrating the use of the OLD keyword in the trigger body."
+        },
+        "matches_column_list": {
+          "passed": false,
+          "reason": "No column list is shown in the output. The AI does not provide code that demonstrates matching the column structure of the INSERT and UPDATE triggers."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 29794,
+      "output": "The missing DELETE trigger has been added following the same pattern as the UPDATE trigger:\n\n**Added:**\n- `frames_ad` (AFTER DELETE) trigger\n- Deletes the corresponding FTS5 entry when a frame is deleted from the frames table\n- Uses the special `'delete'` command with old row values to remove from the FTS5 index\n\nThe trigger follows the FTS5 external content pattern where `INSERT INTO frames_fts(frames_fts, ...) VALUES ('delete', ...)` removes entries from the index.\n"
+    },
+    {
+      "taskId": "sm-003",
+      "taskName": "daemon_service_lifecycle",
+      "weight": 1.5,
       "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "duration": 120017,
+      "error": "claude timed out after 120000ms"
     }
   ]
 }

package/scripts/gepa/results/eval-1-variant-d.json

@@ -5,37 +5,194 @@
     {
       "taskId": "eval-001",
       "taskName": "simple_function",
-      "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "weight": 1,
+      "passed": true,
+      "passRate": 0.6666666666666666,
+      "criteria": {
+        "has_function": {
+          "passed": true,
+          "reason": "A complete, working function `isPalindrome` is defined in TypeScript with proper syntax, parameters, return type, and implementation."
+        },
+        "handles_edge_cases": {
+          "passed": true,
+          "reason": "The code handles edge cases: empty strings (returns true), mixed case (lowercase normalization), and special characters (regex removal of non-alphanumeric)."
+        },
+        "is_tested": {
+          "passed": false,
+          "reason": "The output shows example outputs but provides no actual test cases, unit tests, or test function definitions. Examples are illustrative documentation, not executable tests."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 26370,
+      "output": "I've written a palindrome checker function at `/private/tmp/gepa-eval-X4niM9/isPalindrome.ts`:\n\n```typescript\nexport function isPalindrome(str: string): boolean {\n  if (!str) return true;\n\n  const normalized = str.toLowerCase().replace(/[^a-z0-9]/g, '');\n  const reversed = normalized.split('').reverse().join('');\n\n  return normalized === reversed;\n}\n```\n\n**Features**:\n- Returns `true` for empty strings\n- Normalizes by converting to lowercase and removing non-alphanumeric characters\n- Compares the normalized string with its reverse\n\n**Examples**:\n- `isPalindrome(\"racecar\")` → `true`\n- `isPalindrome(\"A man, a plan, a canal: Panama\")` → `true`\n- `isPalindrome(\"hello\")` → `false`\n"
     },
     {
       "taskId": "eval-002",
       "taskName": "refactor_code",
+      "weight": 1.5,
       "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "passRate": 0,
+      "criteria": {
+        "uses_async": {
+          "passed": false,
+          "reason": "No async/await code is provided; AI only requests the original code instead of demonstrating the refactored solution"
+        },
+        "preserves_behavior": {
+          "passed": false,
+          "reason": "No refactored code is shown, so behavior preservation cannot be verified"
+        },
+        "no_nested_callbacks": {
+          "passed": false,
+          "reason": "No refactored code is demonstrated; the output is a request for input rather than a solution"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 8335,
+      "output": "I need to see the code you want to refactor. Could you please provide the file path or share the code that uses callbacks?\n"
     },
     {
       "taskId": "eval-003",
       "taskName": "fix_bug",
-      "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "weight": 1.2,
+      "passed": true,
+      "passRate": 0.6666666666666666,
+      "criteria": {
+        "bug_fixed": {
+          "passed": false,
+          "reason": "The output only describes the fix but does not show the actual fixed code. No corrected code snippet is provided to verify the bug is actually fixed."
+        },
+        "no_new_bugs": {
+          "passed": true,
+          "reason": "The suggested fix (changing `i <= items.length` to `i < items.length`) is a standard, correct solution for off-by-one errors and introduces no new bugs."
+        },
+        "explains_fix": {
+          "passed": true,
+          "reason": "The output clearly explains what was wrong (accessing undefined index 3 on a 3-element array) and why the fix works (using < instead of <=)."
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 25447,
+      "output": "Fixed buggy-loop.js:6 - changed `i <= items.length` to `i < items.length` to prevent accessing `items[3]` (undefined) on a 3-element array.\n"
     },
     {
       "taskId": "eval-004",
       "taskName": "add_feature",
+      "weight": 1.5,
       "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "passRate": 0,
+      "criteria": {
+        "has_pagination": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        },
+        "has_limit": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        },
+        "has_offset": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        },
+        "backwards_compatible": {
+          "passed": false,
+          "reason": "No code provided in output - empty code block"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 20951,
+      "output": "\n"
     },
     {
       "taskId": "eval-005",
       "taskName": "code_review",
+      "weight": 1.3,
+      "passed": true,
+      "passRate": 0.6666666666666666,
+      "criteria": {
+        "identifies_security_issue": {
+          "passed": true,
+          "reason": "Output correctly identifies 5 legitimate security vulnerabilities: SQL injection, plaintext password comparison, sensitive data logging, insecure session tokens, and missing HttpOnly cookie flags with clear code examples and impact analysis"
+        },
+        "identifies_performance_issue": {
+          "passed": false,
+          "reason": "Output does not identify any performance issues. The review focuses exclusively on security vulnerabilities with no mention of performance, scalability, or optimization concerns"
+        },
+        "actionable_feedback": {
+          "passed": true,
+          "reason": "Output provides specific, actionable fixes for each issue including exact code examples (e.g., parameterized queries, bcrypt.compare, crypto.randomBytes, cookie options) that developers can immediately implement"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 29814,
+      "output": "## Critical Security Issues Found\n\nThis PR contains **MULTIPLE SEVERE SECURITY VULNERABILITIES** that must be rejected:\n\n### 🔴 CRITICAL: SQL Injection (Line 10)\n```typescript\nconst user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);\n```\n**Issue**: Direct string interpolation enables SQL injection attacks  \n**Attack**: `email = \"' OR '1'='1' --\"` bypasses authentication  \n**Fix**: Revert to parameterized query: `db.query('SELECT * FROM users WHERE email = $1', [email])`\n\n### 🔴 CRITICAL: Plaintext Password Comparison (Line 14)\n```typescript\nconst valid = password === user.passwordHash;\n```\n**Issue**: Removes bcrypt password hashing, comparing plaintext to hash  \n**Impact**: Authentication always fails OR passwords stored in plaintext  \n**Fix**: Revert to `await bcrypt.compare(password, user.passwordHash)`\n\n### 🔴 CRITICAL: Sensitive Data Logging (Line 22)\n```typescript\nconsole.log(`Login: ${email} / ${password}`);\n```\n**Issue**: Logs plaintext passwords to console/logs  \n**Impact**: Password exposure in log files, GDPR/compliance violation  \n**Fix**: Remove this line entirely or log only: `console.log(\\`Login attempt: ${email}\\`)`\n\n### 🔴 HIGH: Insecure Session Token (Line 18)\n```typescript\nconst token = email + ':' + Date.now();\n```\n**Issue**: Predictable token generation (email + timestamp)  \n**Impact**: Session hijacking via token guessing  \n**Fix**: Use cryptographically secure random tokens: `crypto.randomBytes(32).toString('hex')`\n\n### 🟡 MEDIUM: Missing HttpOnly Cookie Flag\n```typescript\nres.cookie('session', token);\n```\n**Issue**: Cookie accessible via JavaScript (XSS vulnerability)  \n**Fix**: `res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'strict' })`\n\n## Recommendation\n\n**REJECT THIS PR IMMEDIATELY** - Contains multiple critical security vulnerabilities including SQL injection and plaintext password exposure. The \"quick fix\" comment on line 9 is a red flag for introducing security issues.\n\nAll changes should be *"
+    },
+    {
+      "taskId": "sm-001",
+      "taskName": "add_mcp_tool_handler",
+      "weight": 1.5,
+      "passed": true,
+      "passRate": 1,
+      "criteria": {
+        "has_switch_case": {
+          "passed": true,
+          "reason": "Code shows a case statement 'get_frame_summary' within a switch/case structure, following the dispatch pattern"
+        },
+        "has_zod_schema": {
+          "passed": true,
+          "reason": "Zod schema is defined inline: z.object({ frameId: z.string() }), validating the required frameId parameter"
+        },
+        "validates_input": {
+          "passed": true,
+          "reason": "Input validation occurs via .parse(args) which will throw if frameId is missing or not a string"
+        },
+        "returns_typed_response": {
+          "passed": true,
+          "reason": "Return statement explicitly returns an object with the four required properties: frameId, name, status, eventCount"
+        },
+        "handles_not_found": {
+          "passed": true,
+          "reason": "Code includes explicit null check (if (!frame)) with error thrown when frame is not found in the frames map"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 33763,
+      "output": "I've added the `get_frame_summary` handler to the MCP server dispatch pattern. The implementation:\n\n**Added case** (mcp-dispatch-stub.ts:32-42):\n```typescript\ncase 'get_frame_summary': {\n  const input = z.object({ frameId: z.string() }).parse(args);\n  const frame = frames.get(input.frameId);\n  if (!frame) throw new Error(`Frame not found: ${input.frameId}`);\n  return {\n    frameId: frame.id,\n    name: frame.name,\n    status: frame.status,\n    eventCount: frame.events.length\n  };\n}\n```\n\n**Features**:\n- ✓ Zod validation for required `frameId` string parameter\n- ✓ Follows existing switch/case dispatch pattern\n- ✓ Returns `{ frameId, name, status, eventCount }` as specified\n- ✓ Error handling for missing frames (consistent with `close_frame`)\n- ✓ Calculates `eventCount` from `frame.events.length`\n\nThe handler integrates seamlessly with the existing `start_frame` and `close_frame` tools.\n"
+    },
+    {
+      "taskId": "sm-002",
+      "taskName": "fix_fts5_trigger_bug",
+      "weight": 1.8,
+      "passed": true,
+      "passRate": 1,
+      "criteria": {
+        "has_delete_trigger": {
+          "passed": true,
+          "reason": "A DELETE trigger named 'frames_ad' is defined with AFTER DELETE ON frames syntax"
+        },
+        "uses_fts_delete_syntax": {
+          "passed": true,
+          "reason": "The trigger uses FTS5 special syntax with INSERT INTO frames_fts(frames_fts, ...) VALUES ('delete', ...) which is the correct way to delete from FTS index"
+        },
+        "references_old_row": {
+          "passed": true,
+          "reason": "The trigger references old.rowid, old.name, old.digest_text, and old.inputs, old.outputs to access the deleted row values"
+        },
+        "matches_column_list": {
+          "passed": true,
+          "reason": "The column list (rowid, name, digest_text, inputs, outputs) matches the FTS index structure referenced in the INSERT and UPDATE triggers"
+        }
+      },
+      "judgeMode": "llm",
+      "duration": 34003,
+      "output": "I've added the missing DELETE trigger following the exact pattern of the existing triggers:\n\n**Pattern analysis:**\n- INSERT trigger (`frames_ai`): Adds new row to FTS index\n- UPDATE trigger (`frames_au`): Deletes old row, inserts new row\n- DELETE trigger (`frames_ad`): Deletes row from FTS index\n\n**Implementation:**\n```sql\nCREATE TRIGGER IF NOT EXISTS frames_ad AFTER DELETE ON frames BEGIN\n  INSERT INTO frames_fts(frames_fts, rowid, name, digest_text, inputs, outputs)\n  VALUES ('delete', old.rowid, old.name, old.digest_text, old.inputs, old.outputs);\nEND;\n```\n\nThe trigger uses the FTS5 special command syntax where `INSERT INTO frames_fts(frames_fts, ...)` with `'delete'` as the first value removes the entry from the full-text index.\n"
+    },
+    {
+      "taskId": "sm-003",
+      "taskName": "daemon_service_lifecycle",
+      "weight": 1.5,
       "passed": false,
-      "duration": 4,
-      "output": "/bin/sh: timeout: command not found\n"
+      "duration": 120042,
+      "error": "claude timed out after 120000ms"
     }
   ]
 }

package/scripts/gepa/state.json

@@ -1,14 +1,14 @@
 {
-  "currentGeneration": 0,
-  "bestVariant": "baseline",
-  "bestScore": 0,
-  "targetPath": "/Users/jwu/Dev/provenantai/AGENTS.md",
+  "currentGeneration": 1,
+  "bestVariant": "variant-d",
+  "bestScore": 0.4985250737463126,
+  "targetPath": "/Users/jwu/Dev/stackmemory/CLAUDE.md",
   "history": [
     {
       "generation": 0,
       "variant": "baseline",
       "action": "init",
-      "timestamp": "2026-02-14T17:42:19.929Z"
+      "timestamp": "2026-02-18T22:59:36.437Z"
     },
     {
       "generation": 1,
@@ -19,35 +19,35 @@
         "variant-c",
         "variant-d"
       ],
-      "timestamp": "2026-02-14T17:44:28.832Z"
+      "timestamp": "2026-02-18T23:03:13.997Z"
     },
     {
       "generation": 1,
       "action": "select",
       "scores": [
         {
-          "variant": "baseline",
-          "score": 0
-        },
-        {
-          "variant": "variant-a",
-          "score": 0
+          "variant": "variant-d",
+          "score": 0.4985250737463126
         },
         {
           "variant": "variant-b",
-          "score": 0
+          "score": 0.3938053097345133
         },
         {
           "variant": "variant-c",
-          "score": 0
+          "score": 0.23230088495575218
         },
         {
-          "variant": "variant-d",
-          "score": 0
+          "variant": "baseline",
+          "score": 0.21165191740412978
+        },
+        {
+          "variant": "variant-a",
+          "score": 0.1762536873156342
         }
       ],
-      "best": "baseline",
-      "timestamp": "2026-02-14T17:44:28.998Z"
+      "best": "variant-d",
+      "timestamp": "2026-02-18T23:23:18.544Z"
     }
   ]
 }