@stackmemoryai/stackmemory 1.6.0 → 1.6.1

package/scripts/gepa/evals/fixtures/mcp-dispatch-stub.ts

@@ -1,39 +0,0 @@
-// Existing MCP server dispatch pattern — add get_frame_summary handler
-import { z } from 'zod';
-
-interface Frame {
-  id: string;
-  name: string;
-  status: 'open' | 'closed';
-  events: Array<{ id: string; type: string }>;
-}
-
-// Simulated frame store
-const frames = new Map<string, Frame>();
-
-// Existing tool dispatch (add your handler here)
-async function handleToolCall(name: string, args: unknown) {
-  switch (name) {
-    case 'start_frame': {
-      const input = z.object({ name: z.string().min(1) }).parse(args);
-      const id = `frame-${Date.now()}`;
-      frames.set(id, { id, name: input.name, status: 'open', events: [] });
-      return { frameId: id, status: 'opened' };
-    }
-
-    case 'close_frame': {
-      const input = z.object({ frameId: z.string() }).parse(args);
-      const frame = frames.get(input.frameId);
-      if (!frame) throw new Error(`Frame not found: ${input.frameId}`);
-      frame.status = 'closed';
-      return { frameId: frame.id, status: 'closed' };
-    }
-
-    // TODO: Add get_frame_summary handler here
-
-    default:
-      throw new Error(`Unknown tool: ${name}`);
-  }
-}
-
-export { handleToolCall };

package/scripts/gepa/evals/fixtures/pr-diff.txt

@@ -1,24 +0,0 @@
-diff --git a/src/auth/login.ts b/src/auth/login.ts
-index 1a2b3c4..5d6e7f8 100644
---- a/src/auth/login.ts
-+++ b/src/auth/login.ts
-@@ -12,8 +12,15 @@ export async function handleLogin(req: Request, res: Response) {
-   const { email, password } = req.body;
-
--  const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);
-+  // Quick fix: direct string interpolation for faster queries
-+  const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
-   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
-
--  const valid = await bcrypt.compare(password, user.passwordHash);
-+  const valid = password === user.passwordHash;
-   if (!valid) return res.status(401).json({ error: 'Invalid credentials' });
-
-+  // Store session
-+  const token = email + ':' + Date.now();
-+  res.cookie('session', token);
-+
-+  // Log for debugging
-+  console.log(`Login: ${email} / ${password}`);
-+
-   return res.json({ success: true, user: { id: user.id, email: user.email } });

package/scripts/gepa/evals/fixtures/unsafe-webhook.ts

@@ -1,34 +0,0 @@
-// Webhook handler with validation vulnerabilities
-interface WebhookPayload {
-  action: string;
-  type: string;
-  data: {
-    id: string;
-    title?: string;
-    description?: string;
-    [key: string]: unknown;
-  };
-}
-
-// VULNERABLE: No prototype pollution protection, no length limits,
-// no action validation. Fix this function.
-function validateWebhookPayload(payload: unknown): WebhookPayload | null {
-  if (!payload || typeof payload !== 'object') return null;
-
-  const p = payload as Record<string, unknown>;
-
-  if (!p.action || typeof p.action !== 'string') return null;
-  if (!p.type || typeof p.type !== 'string') return null;
-  if (!p.data || typeof p.data !== 'object') return null;
-
-  const data = p.data as Record<string, unknown>;
-  if (!data.id || typeof data.id !== 'string') return null;
-
-  // No sanitization — title and description can be any length
-  // No action validation — accepts any string
-  // No prototype pollution check — __proto__ passes through
-
-  return p as unknown as WebhookPayload;
-}
-
-export { validateWebhookPayload, WebhookPayload };

package/scripts/gepa/evals/fixtures/unwrapped-db-op.ts

@@ -1,42 +0,0 @@
-// Database operation with no error handling — needs StackMemory error wrapping
-
-interface Frame {
-  id: string;
-  name: string;
-  status: string;
-}
-
-// Simulated database
-const db = {
-  prepare(sql: string) {
-    return {
-      get(...params: unknown[]): Frame | undefined {
-        // May throw: SQLITE_BUSY, SQLITE_CONSTRAINT, SQLITE_CORRUPT
-        throw new Error('SQLITE_BUSY: database is locked');
-      },
-      run(...params: unknown[]) {
-        // May throw various SQLite errors
-      },
-    };
-  },
-};
-
-// This function has NO error handling. Wrap it properly using:
-// - DatabaseError from core/errors
-// - Appropriate ErrorCode (DB_QUERY_FAILED, DB_CONNECTION_FAILED)
-// - Preserve the original error as cause
-// - Set isRetryable = true for connection/busy errors, false for constraint errors
-// - Log with structured context (operation name, frameId)
-async function getFrameById(frameId: string): Promise<Frame | null> {
-  const row = db.prepare('SELECT * FROM frames WHERE id = ?').get(frameId);
-  return row || null;
-}
-
-async function updateFrameStatus(
-  frameId: string,
-  status: string
-): Promise<void> {
-  db.prepare('UPDATE frames SET status = ? WHERE id = ?').run(status, frameId);
-}
-
-export { getFrameById, updateFrameStatus };

package/scripts/gepa/evals/stackmemory-tasks.jsonl

@@ -1,8 +0,0 @@
-{"id": "sm-001", "name": "add_mcp_tool_handler", "prompt": "Add a new MCP tool handler called 'get_frame_summary' that takes a frameId (required string) and returns { frameId, name, status, eventCount }. Follow the existing switch/case dispatch pattern in server.ts. Include Zod input validation.", "input_file": "fixtures/mcp-dispatch-stub.ts", "expected": {"has_switch_case": true, "has_zod_schema": true, "validates_input": true, "returns_typed_response": true, "handles_not_found": true}, "weight": 1.5}
-{"id": "sm-002", "name": "fix_fts5_trigger_bug", "prompt": "The FTS5 DELETE trigger is missing — when a frame is deleted from the frames table, the frames_fts index is not updated. Add the missing AFTER DELETE trigger following the pattern of the existing INSERT and UPDATE triggers.", "input_file": "fixtures/fts5-triggers.sql", "expected": {"has_delete_trigger": true, "uses_fts_delete_syntax": true, "references_old_row": true, "matches_column_list": true}, "weight": 1.8}
-{"id": "sm-003", "name": "daemon_service_lifecycle", "prompt": "This daemon service has a timer leak — when updateConfig() restarts the service, the old interval is not cleared before creating a new one if start() is called while already running. Fix the bug and add a getState() method that returns { isRunning, intervalMs, lastRunTime, errorCount }.", "input_file": "fixtures/leaky-service.ts", "expected": {"clears_old_interval": true, "prevents_double_start": true, "has_getstate_method": true, "returns_correct_state_shape": true}, "weight": 1.5}
-{"id": "sm-004", "name": "webhook_payload_validation", "prompt": "This webhook handler is vulnerable to prototype pollution and has no input length limits. Fix the validation to: 1) reject __proto__ and constructor keys, 2) limit title to 500 chars, 3) limit description to 5000 chars, 4) validate that action is one of create/update/remove.", "input_file": "fixtures/unsafe-webhook.ts", "expected": {"blocks_proto_pollution": true, "limits_title_length": true, "limits_description_length": true, "validates_action_enum": true, "returns_null_on_invalid": true}, "weight": 2.0}
-{"id": "sm-005", "name": "error_handling_chain", "prompt": "Wrap this database operation in proper StackMemory error handling: use DatabaseError with appropriate ErrorCode, preserve the cause chain, set isRetryable based on error type (connection errors are retryable, constraint violations are not), and log with structured context.", "input_file": "fixtures/unwrapped-db-op.ts", "expected": {"uses_database_error": true, "preserves_cause": true, "sets_retryable_correctly": true, "has_structured_logging": true, "catches_unknown_type": true}, "weight": 1.3}
-{"id": "sm-006", "name": "integration_graceful_degradation", "prompt": "This integration handler crashes the MCP server when the external API is down. Refactor it to degrade gracefully: catch connection errors, return a user-friendly MCPResponse with metadata.unavailable=true, log at debug level (not error), and don't retry on 4xx errors.", "input_file": "fixtures/brittle-integration.ts", "expected": {"catches_connection_errors": true, "returns_mcp_response": true, "sets_unavailable_metadata": true, "logs_at_debug": true, "no_retry_on_4xx": true}, "weight": 1.5}
-{"id": "sm-007", "name": "sqlite_migration_safety", "prompt": "Write a safe SQLite migration that adds a 'tags' TEXT column to the frames table. The migration must: 1) check if column already exists first (idempotent), 2) wrap in a transaction, 3) update the schema_version table, 4) handle the case where schema_version table doesn't exist yet.", "expected": {"checks_column_exists": true, "uses_transaction": true, "updates_schema_version": true, "is_idempotent": true, "handles_missing_version_table": true}, "weight": 1.5}
-{"id": "sm-008", "name": "review_pr_security", "prompt": "Review this PR diff and identify all security issues, performance problems, and code quality concerns. Provide actionable feedback for each issue found.", "input_file": "fixtures/pr-diff.txt", "expected": {"identifies_sql_injection": true, "identifies_plaintext_password": true, "identifies_credential_logging": true, "identifies_weak_session": true, "provides_fix_suggestions": true}, "weight": 2.0}

package/scripts/gepa/generations/gen-000/baseline.md

@@ -1,112 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Sol is the monorepo for **Rize**, an automatic time tracking application. The stack consists of:
-- **api/** - Rails 7.1 GraphQL backend (Ruby 3.3.5)
-- **web/** - Next.js 14 React web app (Node 22)
-- **electron/** - Electron desktop app (Node 22)
-- **services/** - Bun-based TypeScript event consumers/workers
-- **vanity/** - Webflow marketing site scripts (deprecated)
-- **voyager/** - Marketing website for home and landing pageas (Next.js)
-- **puppet/** - Puppeteer server for images/PDFs
-- **chrome/** - Chrome browser extension
-- **docs/** - Docusaurus documentation site
-- **zapier/** - Zapier integration
-
-## Development Commands
-
-### Starting Development Environment
-```bash
-# Start all services (requires iTerm2 on macOS)
-./scripts/run-dev.sh
-
-# Or start individually:
-cd api && hivemind Procfile.dev     # Rails + AnyCable + Sidekiq + Clockwork
-cd web && npm run dev               # Next.js dev server
-cd electron && npm run dev          # Electron with hot reload
-cd services && hivemind Procfile.dev # Bun services
-```
-
-### Docker Dependencies (api/docker-compose.yml)
-```bash
-cd api && docker-compose up -d
-# TimescaleDB: localhost:15432
-# Redis: localhost:16379
-# Kafka: localhost:9092
-# MySQL: localhost:13306
-```
-
-### Testing
-```bash
-# API (RSpec)
-cd api && bundle exec rspec
-cd api && bundle exec rspec spec/path/to/file_spec.rb      # Single file
-cd api && bundle exec rspec spec/path/to/file_spec.rb:42   # Single test at line
-
-# Electron (Jest)
-cd electron && npm test
-cd electron && npm run test:watch
-cd electron && npm run test:coverage
-
-# Web - no active tests (exits 0)
-```
-
-### Building
-```bash
-cd api && bundle install && rake db:migrate
-cd web && npm run build       # Runs gql-gen, tailwind, next build
-cd electron && npm run build  # Electron Forge make
-cd services && bun install
-```
-
-### GraphQL Code Generation
-```bash
-cd web && npm run build       # Includes gql codegen
-cd electron && npm run dev    # Runs gql codegen as part of dev
-```
-
-## Architecture
-
-### GraphQL API Structure
-The API exposes two GraphQL endpoints:
-- **api/v1** - Public API (OAuth consumers, Zapier)
-- **private/v1** - Private API (web, electron apps)
-
-Located at `api/app/graphql/{api,private}/v1/`
-
-### Real-time Communication
-- **AnyCable** WebSocket server for subscriptions
-- ActionCable channels in `api/app/channels/`
-- WebSocket config: `api/config/cable.yml` and `api/config/anycable.yml`
-
-### Background Jobs
-- **Sidekiq** for async job processing (`api/config/sidekiq.yml`)
-- **Clockwork** for scheduled jobs (`api/config/clock.rb`)
-
-### Event Streaming
-- **Kafka** for event publishing/consumption
-- Services consume events via `services/consumers/`
-- Kafka config: `api/config/initializers/kafka.rb`
-
-### Databases
-- **Primary PostgreSQL** - Main application data
-- **TimescaleDB** - Time-series data (separate connection in `database.yml`)
-- **MySQL** - Legacy/external integrations
-- **Redis** - Caching, ActionCable, Sidekiq
-
-## Style Guidelines
-
-### JavaScript/TypeScript
-- Use `test()` instead of `it()` in tests
-- Use `toBeCalled()` instead of `toHaveBeenCalledWith()` in jest assertions
-
-## Key Configuration Files
-
-- `api/config/database.yml` - Database connections (primary + timescale)
-- `api/config/cable.yml` - AnyCable WebSocket config
-- `api/Procfile.dev` - Development processes (rails, anycable, sidekiq, clockwork)
-- `sol.code-workspace` - VS Code multi-folder workspace
-- Each project requires its own `.env` file (not in repo)

package/scripts/gepa/generations/gen-001/baseline.md

@@ -1,112 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Sol is the monorepo for **Rize**, an automatic time tracking application. The stack consists of:
-- **api/** - Rails 7.1 GraphQL backend (Ruby 3.3.5)
-- **web/** - Next.js 14 React web app (Node 22)
-- **electron/** - Electron desktop app (Node 22)
-- **services/** - Bun-based TypeScript event consumers/workers
-- **vanity/** - Webflow marketing site scripts (deprecated)
-- **voyager/** - Marketing website for home and landing pageas (Next.js)
-- **puppet/** - Puppeteer server for images/PDFs
-- **chrome/** - Chrome browser extension
-- **docs/** - Docusaurus documentation site
-- **zapier/** - Zapier integration
-
-## Development Commands
-
-### Starting Development Environment
-```bash
-# Start all services (requires iTerm2 on macOS)
-./scripts/run-dev.sh
-
-# Or start individually:
-cd api && hivemind Procfile.dev     # Rails + AnyCable + Sidekiq + Clockwork
-cd web && npm run dev               # Next.js dev server
-cd electron && npm run dev          # Electron with hot reload
-cd services && hivemind Procfile.dev # Bun services
-```
-
-### Docker Dependencies (api/docker-compose.yml)
-```bash
-cd api && docker-compose up -d
-# TimescaleDB: localhost:15432
-# Redis: localhost:16379
-# Kafka: localhost:9092
-# MySQL: localhost:13306
-```
-
-### Testing
-```bash
-# API (RSpec)
-cd api && bundle exec rspec
-cd api && bundle exec rspec spec/path/to/file_spec.rb      # Single file
-cd api && bundle exec rspec spec/path/to/file_spec.rb:42   # Single test at line
-
-# Electron (Jest)
-cd electron && npm test
-cd electron && npm run test:watch
-cd electron && npm run test:coverage
-
-# Web - no active tests (exits 0)
-```
-
-### Building
-```bash
-cd api && bundle install && rake db:migrate
-cd web && npm run build       # Runs gql-gen, tailwind, next build
-cd electron && npm run build  # Electron Forge make
-cd services && bun install
-```
-
-### GraphQL Code Generation
-```bash
-cd web && npm run build       # Includes gql codegen
-cd electron && npm run dev    # Runs gql codegen as part of dev
-```
-
-## Architecture
-
-### GraphQL API Structure
-The API exposes two GraphQL endpoints:
-- **api/v1** - Public API (OAuth consumers, Zapier)
-- **private/v1** - Private API (web, electron apps)
-
-Located at `api/app/graphql/{api,private}/v1/`
-
-### Real-time Communication
-- **AnyCable** WebSocket server for subscriptions
-- ActionCable channels in `api/app/channels/`
-- WebSocket config: `api/config/cable.yml` and `api/config/anycable.yml`
-
-### Background Jobs
-- **Sidekiq** for async job processing (`api/config/sidekiq.yml`)
-- **Clockwork** for scheduled jobs (`api/config/clock.rb`)
-
-### Event Streaming
-- **Kafka** for event publishing/consumption
-- Services consume events via `services/consumers/`
-- Kafka config: `api/config/initializers/kafka.rb`
-
-### Databases
-- **Primary PostgreSQL** - Main application data
-- **TimescaleDB** - Time-series data (separate connection in `database.yml`)
-- **MySQL** - Legacy/external integrations
-- **Redis** - Caching, ActionCable, Sidekiq
-
-## Style Guidelines
-
-### JavaScript/TypeScript
-- Use `test()` instead of `it()` in tests
-- Use `toBeCalled()` instead of `toHaveBeenCalledWith()` in jest assertions
-
-## Key Configuration Files
-
-- `api/config/database.yml` - Database connections (primary + timescale)
-- `api/config/cable.yml` - AnyCable WebSocket config
-- `api/Procfile.dev` - Development processes (rails, anycable, sidekiq, clockwork)
-- `sol.code-workspace` - VS Code multi-folder workspace
-- Each project requires its own `.env` file (not in repo)

package/scripts/gepa/generations/gen-001/variant-a.md

@@ -1,107 +0,0 @@
-# CLAUDE.md
-
-Guidance for Claude Code when working in this repository.
-
-## Project Overview
-
-Sol is the **Rize** monorepo (automatic time tracking). Stack:
-- **api/** - Rails 7.1 GraphQL backend (Ruby 3.3.5)
-- **web/** - Next.js 14 React app (Node 22)
-- **electron/** - Electron desktop app (Node 22)
-- **services/** - Bun TypeScript event consumers/workers
-- **vanity/** - Webflow marketing scripts (deprecated)
-- **voyager/** - Marketing website (Next.js)
-- **puppet/** - Puppeteer server for images/PDFs
-- **chrome/** - Chrome extension
-- **docs/** - Docusaurus site
-- **zapier/** - Zapier integration
-
-## Development Commands
-
-### Start Dev Environment
-```bash
-./scripts/run-dev.sh  # All services (requires iTerm2 on macOS)
-
-# Individually:
-cd api && hivemind Procfile.dev      # Rails + AnyCable + Sidekiq + Clockwork
-cd web && npm run dev                # Next.js (port 3001)
-cd electron && npm run dev           # Electron with hot reload
-cd services && hivemind Procfile.dev # Bun services
-```
-
-### Docker (required before api/services)
-```bash
-cd api && docker-compose up -d
-# TimescaleDB: localhost:15432 | Redis: localhost:16379
-# Kafka: localhost:9092 | MySQL: localhost:13306
-```
-
-### Testing
-```bash
-# API (RSpec)
-cd api && bundle exec rspec
-cd api && bundle exec rspec spec/path/to/file_spec.rb
-cd api && bundle exec rspec spec/path/to/file_spec.rb:42
-
-# Electron (Jest)
-cd electron && npm test
-cd electron && npm run test:watch
-cd electron && npm run test:coverage
-
-# Web: no active tests (exits 0)
-```
-
-### Building
-```bash
-cd api && bundle install && rake db:migrate
-cd web && npm run build       # gql-gen + tailwind + next build
-cd electron && npm run build  # Electron Forge make
-cd services && bun install
-```
-
-### GraphQL Code Generation
-- `cd web && npm run build` — includes gql codegen
-- `cd electron && npm run dev` — runs gql codegen automatically
-
-## Architecture
-
-### GraphQL API
-Two endpoints:
-- **api/v1** — Public API (OAuth, Zapier) → `api/app/graphql/api/v1/`
-- **private/v1** — Internal API (web, electron) → `api/app/graphql/private/v1/`
-
-### Real-time
-- AnyCable WebSocket subscriptions
-- ActionCable channels: `api/app/channels/`
-- Config: `api/config/cable.yml`, `api/config/anycable.yml`
-
-### Background Jobs
-- Sidekiq (async): `api/config/sidekiq.yml`
-- Clockwork (scheduled): `api/config/clock.rb`
-
-### Event Streaming
-- Kafka publish/consume via `services/consumers/`
-- Config: `api/config/initializers/kafka.rb`
-
-### Databases
-- **PostgreSQL** — primary app data
-- **TimescaleDB** — time-series (separate connection in `database.yml`)
-- **MySQL** — legacy integrations
-- **Redis** — caching, ActionCable, Sidekiq
-
-## Style Guidelines
-
-### JavaScript/TypeScript Tests
-- Use `test()` not `it()`
-- Use `toBeCalled()` not `toHaveBeenCalledWith()`
-
-## Key Config Files
-
-| File | Purpose |
-|------|---------|
-| `api/config/database.yml` | DB connections (primary + timescale) |
-| `api/config/cable.yml` | AnyCable WebSocket config |
-| `api/Procfile.dev` | Dev processes (rails, anycable, sidekiq, clockwork) |
-| `sol.code-workspace` | VS Code multi-folder workspace |
-
-Each subproject needs its own `.env` file (not committed).