sessionmem 1.0.6 → 1.1.1

package/dist/adapters/global/codex.js

@@ -1,22 +1,82 @@
-import { join } from "path";
+import { join, dirname } from "path";
 import { homedir } from "os";
 import { GenericMCPAdapter } from "../generic.js";
-import { IDEInstaller } from "../ide/installer.js";
+/**
+ * The TOML block Codex expects in ~/.codex/config.toml. Codex uses TOML, not
+ * JSON, so the JSON-based IDEInstaller helpers cannot be reused here.
+ */
+const CODEX_MCP_BLOCK = `
+[mcp_servers.sessionmem]
+command = "sessionmem"
+args = ["run"]
+`;
 export class CodexAdapter extends GenericMCPAdapter {
     name = "Codex";
-    capabilities = {
-        supportsPrompts: true,
-        supportsResources: true,
-        supportsTools: true,
-    };
+    // Capabilities inherited from GenericMCPAdapter (tools only).
+    /** Codex reads AGENTS.md; the global one lives in ~/.codex/AGENTS.md. */
+    guidanceTargets() {
+        return [join(homedir(), ".codex", "AGENTS.md")];
+    }
     async install() {
-        const configPath = join(homedir(), ".codex", "config.json");
-        return IDEInstaller.injectMcpConfig(configPath, "sessionmem", "sessionmem", [
-            "run",
-        ]);
+        try {
+            const { readFileSync, writeFileSync, existsSync, mkdirSync } = await import("fs");
+            const configPath = join(homedir(), ".codex", "config.toml");
+            const existing = existsSync(configPath)
+                ? readFileSync(configPath, "utf-8")
+                : "";
+            // Idempotent: skip if the sessionmem server section already exists.
+            // Anchor on line start so a commented/substring mention doesn't match.
+            if (existing.split("\n").some((line) => line.trimStart().startsWith("[mcp_servers.sessionmem]")))
+                return true;
+            const dir = dirname(configPath);
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true });
+            }
+            // Append the TOML block, trimming trailing whitespace to keep a single
+            // blank-line separator before our section.
+            const updated = existing.trimEnd() + "\n" + CODEX_MCP_BLOCK;
+            writeFileSync(configPath, updated, "utf-8");
+            return true;
+        }
+        catch {
+            return false;
+        }
     }
     async uninstall() {
-        const configPath = join(homedir(), ".codex", "config.json");
-        return IDEInstaller.removeMcpConfig(configPath, "sessionmem");
+        try {
+            const { readFileSync, writeFileSync, existsSync } = await import("fs");
+            const configPath = join(homedir(), ".codex", "config.toml");
+            if (!existsSync(configPath))
+                return true;
+            const existing = readFileSync(configPath, "utf-8");
+            if (!existing.includes("[mcp_servers.sessionmem]"))
+                return true;
+            const lines = existing.split("\n");
+            const result = [];
+            let i = 0;
+            while (i < lines.length) {
+                if (lines[i].trim() === "[mcp_servers.sessionmem]") {
+                    // Skip this section's header and body until the next section header
+                    // (a line starting with "[") or end of file.
+                    i++;
+                    while (i < lines.length && !lines[i].trimStart().startsWith("[")) {
+                        i++;
+                    }
+                    // Drop any trailing blank lines accumulated before the next section.
+                    while (result.length > 0 && result[result.length - 1].trim() === "") {
+                        result.pop();
+                    }
+                    continue;
+                }
+                result.push(lines[i]);
+                i++;
+            }
+            const updated = result.join("\n").trimEnd() + "\n";
+            writeFileSync(configPath, updated, "utf-8");
+            return true;
+        }
+        catch {
+            return false;
+        }
     }
 }

package/dist/adapters/global/qcoder.js

@@ -2,13 +2,26 @@ import { join } from "path";
 import { homedir } from "os";
 import { GenericMCPAdapter } from "../generic.js";
 import { IDEInstaller } from "../ide/installer.js";
+// ⚠️ UNVERIFIED MCP CONFIG PATH — see audit round 18.
+// The real product is "Qoder" (Alibaba's agentic AI IDE, a VS Code fork), not
+// "QCoder", and it is NOT a Google tool / not "Project IDX" (IDX became Firebase
+// Studio). Qoder configures MCP servers through its in-IDE Settings UI; the
+// underlying global config FILE PATH is NOT publicly documented as of 2026-06.
+// Qoder's published config snippet does use the standard
+// `{ "mcpServers": { command, args, env } }` schema that
+// IDEInstaller.injectMcpConfig writes, so the JSON STRUCTURE here is correct —
+// but `~/.qoder/config.json` (let alone the current misspelled `~/.qcoder/...`)
+// is an EDUCATED GUESS. If Qoder reads MCP config from a different file, this
+// install() is a silent no-op for the host. TODO: confirm against a real Qoder
+// install (Qoder Settings → MCP → "View raw config") and correct the path +
+// directory spelling, or wire it through the UI-managed store if no file exists.
 export class QCoderAdapter extends GenericMCPAdapter {
     name = "QCoder";
-    capabilities = {
-        supportsPrompts: true,
-        supportsResources: true,
-        supportsTools: true,
-    };
+    // Capabilities inherited from GenericMCPAdapter (tools only).
+    /** QCoder reads AGENTS.md-style guidance from its global config dir. */
+    guidanceTargets() {
+        return [join(homedir(), ".qcoder", "AGENTS.md")];
+    }
     async install() {
         const configPath = join(homedir(), ".qcoder", "config.json");
         return IDEInstaller.injectMcpConfig(configPath, "sessionmem", "sessionmem", [

package/dist/adapters/ide/cline.js

@@ -1,20 +1,67 @@
 import { join } from "path";
 import { homedir } from "os";
+import { existsSync } from "fs";
 import { GenericMCPAdapter } from "../generic.js";
 import { IDEInstaller } from "./installer.js";
+/**
+ * VS Code variants Cline can be installed into, in detection-priority order.
+ * The globalStorage path differs only by this editor-name segment.
+ */
+const VSCODE_EDITOR_VARIANTS = [
+    "Code",
+    "Code - Insiders",
+    "VSCodium",
+    "Cursor",
+];
 export class ClineAdapter extends GenericMCPAdapter {
     name = "Cline";
-    capabilities = {
-        supportsPrompts: true,
-        supportsResources: true,
-        supportsTools: true,
-    };
+    // Capabilities inherited from GenericMCPAdapter (tools only).
+    /** Cline reads global rules from ~/Documents/Cline/Rules/. */
+    guidanceTargets() {
+        return [join(homedir(), "Documents", "Cline", "Rules", "sessionmem.md")];
+    }
+    /**
+     * Cline (the VS Code extension `saoudrizwan.claude-dev`) stores MCP servers in
+     * `cline_mcp_settings.json` under the editor's globalStorage — NOT in a
+     * `~/.cline/config.json`. The base dir differs per platform:
+     *  - macOS:   ~/Library/Application Support/Code/User/globalStorage/...
+     *  - Windows: %APPDATA%\Code\User\globalStorage\...
+     *  - Linux:   ~/.config/Code/User/globalStorage/...
+     */
+    get configPath() {
+        const home = homedir();
+        let base;
+        if (process.platform === "win32") {
+            base = process.env.APPDATA ?? join(home, "AppData", "Roaming");
+        }
+        else if (process.platform === "darwin") {
+            base = join(home, "Library", "Application Support");
+        }
+        else {
+            base = join(home, ".config");
+        }
+        const rest = [
+            "User",
+            "globalStorage",
+            "saoudrizwan.claude-dev",
+            "settings",
+            "cline_mcp_settings.json",
+        ];
+        // "Code" is VS Code stable, but Cline also installs into Insiders, VSCodium,
+        // and Cursor. Pick the first variant whose globalStorage dir already exists;
+        // fall back to stable "Code" when none is found (fresh install).
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+        // `name` is from the hardcoded VSCODE_EDITOR_VARIANTS constant above — not user input.
+        const editorName = VSCODE_EDITOR_VARIANTS.find((name) => existsSync(join(base, name, "User", "globalStorage"))) ?? "Code";
+        return join(base, editorName, ...rest);
+    }
     async install() {
-        const configPath = join(homedir(), ".cline", "config.json");
-        return IDEInstaller.injectMcpConfig(configPath, "sessionmem", "sessionmem", ["run"]);
+        // Cline's server schema carries `disabled` and `autoApprove` alongside
+        // command/args; pass them through so the written block matches what Cline
+        // expects to read.
+        return IDEInstaller.injectMcpConfig(this.configPath, "sessionmem", "sessionmem", ["run"], { disabled: false, autoApprove: [] });
     }
     async uninstall() {
-        const configPath = join(homedir(), ".cline", "config.json");
-        return IDEInstaller.removeMcpConfig(configPath, "sessionmem");
+        return IDEInstaller.removeMcpConfig(this.configPath, "sessionmem");
     }
 }

package/dist/adapters/ide/cursor.js

@@ -4,20 +4,22 @@ import { GenericMCPAdapter } from "../generic.js";
 import { IDEInstaller } from "./installer.js";
 export class CursorAdapter extends GenericMCPAdapter {
     name = "Cursor";
-    capabilities = {
-        supportsPrompts: false,
-        supportsResources: false,
-        supportsTools: true,
-    };
+    // Capabilities inherited from GenericMCPAdapter (tools only).
+    /**
+     * Cursor reads project rules from `.cursor/rules/*.mdc`. A home-level rule
+     * file gives every project the sessionmem guidance. The injector seeds
+     * `alwaysApply: true` frontmatter on creation so the rule is always active.
+     */
+    guidanceTargets() {
+        return [join(homedir(), ".cursor", "rules", "sessionmem.mdc")];
+    }
+    /**
+     * Cursor reads MCP servers from `~/.cursor/mcp.json` (global) — NOT from the
+     * VS Code-style `Cursor/User/settings.json`, which Cursor ignores for MCP.
+     * The path is the same on every platform.
+     */
     get configPath() {
-        const home = homedir();
-        if (process.platform === "win32") {
-            return join(process.env.APPDATA ?? home, "Cursor", "User", "settings.json");
-        }
-        if (process.platform === "darwin") {
-            return join(home, "Library", "Application Support", "Cursor", "User", "settings.json");
-        }
-        return join(home, ".config", "Cursor", "User", "settings.json");
+        return join(homedir(), ".cursor", "mcp.json");
     }
     async install() {
         return IDEInstaller.injectMcpConfig(this.configPath, "sessionmem", "sessionmem", ["run"]);

package/dist/adapters/ide/installer.js

@@ -1,11 +1,99 @@
+/**
+ * The exact command Claude Code runs at session start. Installed as a
+ * `SessionStart` hook in ~/.claude/settings.json so prior memories are injected
+ * into every session automatically — the deterministic counterpart to the
+ * advisory `startup_inject_memories` tool (which the agent must choose to call).
+ */
+export const SESSIONMEM_HOOK_COMMAND = "sessionmem session-start";
+/**
+ * The command Claude Code runs when a session ends. Installed as a `SessionEnd`
+ * hook so the session-end pipeline (light retention prune + auto-summarization
+ * of any ingested session events) runs automatically once per session, without
+ * relying on the agent choosing to call a tool.
+ */
+export const SESSIONMEM_SESSION_END_HOOK_COMMAND = "sessionmem session-end";
+/** Default Claude Code hook event for the legacy 2-arg hook helpers. */
+const DEFAULT_HOOK_EVENT = "SessionStart";
 export class IDEInstaller {
     static parseJsonc(content) {
-        const stripped = content
-            .replace(/\/\/[^\n]*/g, "")
-            .replace(/,(\s*[}\]])/g, "$1");
-        return JSON.parse(stripped);
+        // Strip single-line comments (//) that appear outside of string literals.
+        // A naive regex strips // inside strings (e.g. URLs). This implementation
+        // tracks whether we are inside a double-quoted string to avoid that.
+        let result = "";
+        let inString = false;
+        let i = 0;
+        while (i < content.length) {
+            const ch = content[i];
+            if (ch === "\\" && inString) {
+                result += content[i] + (content[i + 1] ?? "");
+                i += 2;
+                continue;
+            }
+            if (ch === '"') {
+                inString = !inString;
+                result += ch;
+                i++;
+                continue;
+            }
+            if (!inString && ch === "/" && content[i + 1] === "/") {
+                while (i < content.length && content[i] !== "\n")
+                    i++;
+                continue;
+            }
+            if (!inString && ch === "/" && content[i + 1] === "*") {
+                i += 2;
+                while (i < content.length) {
+                    if (content[i] === "*" && content[i + 1] === "/") {
+                        i += 2;
+                        break;
+                    }
+                    i++;
+                }
+                continue;
+            }
+            result += ch;
+            i++;
+        }
+        // Strip trailing commas outside of string literals. Doing this with a single
+        // regex over the whole string corrupts string values that contain ",]" or
+        // ",}"; mirror the inString tracking so only structural commas are removed.
+        let cleaned = "";
+        let inStr = false;
+        let i2 = 0;
+        while (i2 < result.length) {
+            const c = result[i2];
+            if (c === "\\" && inStr) {
+                cleaned += result[i2] + (result[i2 + 1] ?? "");
+                i2 += 2;
+                continue;
+            }
+            if (c === '"') {
+                inStr = !inStr;
+                cleaned += c;
+                i2++;
+                continue;
+            }
+            if (!inStr && c === ",") {
+                // look ahead for optional whitespace then } or ]
+                let j = i2 + 1;
+                while (j < result.length &&
+                    (result[j] === " " ||
+                        result[j] === "\n" ||
+                        result[j] === "\r" ||
+                        result[j] === "\t"))
+                    j++;
+                if (j < result.length && (result[j] === "}" || result[j] === "]")) {
+                    i2++; // skip the comma
+                    continue;
+                }
+            }
+            cleaned += c;
+            i2++;
+        }
+        result = cleaned;
+        return JSON.parse(result);
     }
-    static injectMcpBlock(content, serverName, command, args) {
+    static injectMcpBlock(content, serverName, command, args, extraFields) {
         const config = content.trim()
             ? this.parseJsonc(content)
             : {};
@@ -14,6 +102,10 @@ export class IDEInstaller {
         config.mcpServers[serverName] = {
             command,
             args,
+            // Hosts with a richer server schema (e.g. Cline's
+            // `disabled` / `autoApprove`) pass those fields through here so the
+            // written block matches what the host expects to read.
+            ...extraFields,
         };
         return JSON.stringify(config, null, 2);
     }
@@ -26,13 +118,22 @@ export class IDEInstaller {
         }
         return JSON.stringify(config, null, 2);
     }
-    static async injectMcpConfig(filePath, serverName, command, args) {
+    static async injectMcpConfig(filePath, serverName, command, args, extraFields) {
         try {
-            const { readFileSync, writeFileSync, existsSync } = await import("fs");
+            const { readFileSync, writeFileSync, existsSync, mkdirSync } = await import("fs");
+            const { dirname } = await import("path");
             const existing = existsSync(filePath)
                 ? readFileSync(filePath, "utf-8")
                 : "{}";
-            const updated = this.injectMcpBlock(existing, serverName, command, args);
+            const updated = this.injectMcpBlock(existing, serverName, command, args, extraFields);
+            // Create the host's config directory if it doesn't exist yet (fresh
+            // install, or a config path the host hasn't created). writeFileSync alone
+            // throws ENOENT on a missing parent, which previously surfaced as an
+            // opaque "config update failed".
+            const dir = dirname(filePath);
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true });
+            }
             writeFileSync(filePath, updated, "utf-8");
             return true;
         }
@@ -54,4 +155,96 @@ export class IDEInstaller {
             return false;
         }
     }
+    /** True when a SessionStart entry contains a command-hook running `command`. */
+    static hookEntryHasCommand(entry, command) {
+        if (!entry || !Array.isArray(entry.hooks))
+            return false;
+        return entry.hooks.some((hook) => hook?.command === command);
+    }
+    /**
+     * Merge a Claude Code command hook into a settings.json string, preserving
+     * every other key (mcpServers, other hook events, user settings). Defaults to
+     * the `SessionStart` event; pass `eventName` for another event (e.g.
+     * `SessionEnd`). Idempotent: re-injecting the same command on the same event
+     * never produces a duplicate entry.
+     */
+    static injectClaudeHookBlock(content, command, eventName = DEFAULT_HOOK_EVENT) {
+        const config = content.trim()
+            ? this.parseJsonc(content)
+            : {};
+        const hooks = config.hooks && typeof config.hooks === "object"
+            ? config.hooks
+            : {};
+        const eventEntries = Array.isArray(hooks[eventName])
+            ? hooks[eventName]
+            : [];
+        // Drop any pre-existing sessionmem entry so re-install stays idempotent and
+        // a stale command form is replaced rather than duplicated.
+        const filtered = eventEntries.filter((entry) => !this.hookEntryHasCommand(entry, command));
+        filtered.push({ hooks: [{ type: "command", command }] });
+        hooks[eventName] = filtered;
+        config.hooks = hooks;
+        return JSON.stringify(config, null, 2);
+    }
+    /**
+     * Remove a sessionmem command hook from a settings.json string, leaving all
+     * other hooks and settings intact. Defaults to the `SessionStart` event.
+     * Cleans up the event array and the hooks object when they become empty.
+     */
+    static removeClaudeHookBlock(content, command, eventName = DEFAULT_HOOK_EVENT) {
+        const config = content.trim()
+            ? this.parseJsonc(content)
+            : {};
+        const hooks = config.hooks && typeof config.hooks === "object"
+            ? config.hooks
+            : undefined;
+        if (!hooks)
+            return JSON.stringify(config, null, 2);
+        if (Array.isArray(hooks[eventName])) {
+            const filtered = hooks[eventName].filter((entry) => !this.hookEntryHasCommand(entry, command));
+            if (filtered.length === 0) {
+                delete hooks[eventName];
+            }
+            else {
+                hooks[eventName] = filtered;
+            }
+        }
+        if (Object.keys(hooks).length === 0) {
+            delete config.hooks;
+        }
+        return JSON.stringify(config, null, 2);
+    }
+    static async injectClaudeHook(filePath, command, eventName = DEFAULT_HOOK_EVENT) {
+        try {
+            const { readFileSync, writeFileSync, existsSync, mkdirSync } = await import("fs");
+            const { dirname } = await import("path");
+            const existing = existsSync(filePath)
+                ? readFileSync(filePath, "utf-8")
+                : "{}";
+            const updated = this.injectClaudeHookBlock(existing, command, eventName);
+            const dir = dirname(filePath);
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true });
+            }
+            writeFileSync(filePath, updated, "utf-8");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    static async removeClaudeHook(filePath, command, eventName = DEFAULT_HOOK_EVENT) {
+        try {
+            const { readFileSync, writeFileSync, existsSync } = await import("fs");
+            if (!existsSync(filePath))
+                return true;
+            const existing = readFileSync(filePath, "utf-8");
+            const updated = this.removeClaudeHookBlock(existing, command, eventName);
+            writeFileSync(filePath, updated, "utf-8");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
 }

package/dist/adapters/ide/windsurf.js

@@ -4,20 +4,21 @@ import { GenericMCPAdapter } from "../generic.js";
 import { IDEInstaller } from "./installer.js";
 export class WindsurfAdapter extends GenericMCPAdapter {
     name = "Windsurf";
-    capabilities = {
-        supportsPrompts: true,
-        supportsResources: true,
-        supportsTools: true,
-    };
+    // Capabilities inherited from GenericMCPAdapter (tools only).
+    /** Windsurf reads global rules from ~/.codeium/windsurf/memories/global_rules.md. */
+    guidanceTargets() {
+        return [
+            join(homedir(), ".codeium", "windsurf", "memories", "global_rules.md"),
+        ];
+    }
+    /**
+     * Windsurf reads MCP servers from `~/.codeium/windsurf/mcp_config.json` — NOT
+     * from the VS Code-style `Windsurf/User/settings.json`. Same path on every
+     * platform (mirrors the `.codeium/windsurf` root the guidance file already
+     * uses).
+     */
     get configPath() {
-        const home = homedir();
-        if (process.platform === "win32") {
-            return join(process.env.APPDATA ?? home, "Windsurf", "User", "settings.json");
-        }
-        if (process.platform === "darwin") {
-            return join(home, "Library", "Application Support", "Windsurf", "User", "settings.json");
-        }
-        return join(home, ".config", "Windsurf", "User", "settings.json");
+        return join(homedir(), ".codeium", "windsurf", "mcp_config.json");
     }
     async install() {
         return IDEInstaller.injectMcpConfig(this.configPath, "sessionmem", "sessionmem", ["run"]);

package/dist/cli/commands/config.js

@@ -20,6 +20,13 @@ function coerceRetentionDays(raw) {
     }
     return n;
 }
+function coerceInjectionCap(raw) {
+    const n = coerceInt(raw);
+    if (n < 100 || n > 10000) {
+        throw new Error(`injectionCap must be an integer between 100 and 10000, got "${raw}"`);
+    }
+    return n;
+}
 function coerceBool(raw) {
     const v = raw.trim().toLowerCase();
     if (v === "true")
@@ -34,6 +41,7 @@ const CONFIG_KEYS = {
     "retention.days": { field: "retentionDays", coerce: coerceRetentionDays },
     retentionDays: { field: "retentionDays", coerce: coerceRetentionDays },
     redactionEnabled: { field: "redactionEnabled", coerce: coerceBool },
+    injectionCap: { field: "injectionCap", coerce: coerceInjectionCap },
 };
 function resolvePath(options) {
     return options?.configPath ?? configFilePath();
@@ -50,7 +58,8 @@ export function configGetCommand(key, options) {
         return;
     }
     const config = readPolicyConfig(resolvePath(options));
-    console.log(String(config[def.field]));
+    const val = config[def.field];
+    console.log(val === undefined ? "(not set)" : String(val));
 }
 /**
  * `sessionmem config set <key> <value>` — coerce and persist to config.json.

package/dist/cli/commands/import.js

@@ -73,7 +73,9 @@ export async function importCommand(pathArg, options, ctx) {
             invalidCount += 1;
             continue;
         }
-        validMemories.push(mapped[i]);
+        // Use the parsed/transformed record so `kind` is narrowed to the
+        // canonical enum (memoryKindSchema maps legacy values like `architecture`).
+        validMemories.push(check.data);
     }
     if (validMemories.length === 0) {
         if (invalidCount > 0) {
@@ -100,6 +102,9 @@ export async function importCommand(pathArg, options, ctx) {
     let suffix = result.skippedCrossProject > 0
         ? ` (${result.skippedCrossProject} skipped: id belongs to another project)`
         : "";
+    if (result.skippedExisting > 0) {
+        suffix += ` (${result.skippedExisting} skipped: id already exists in this project)`;
+    }
     if (invalidCount > 0) {
         suffix += ` (${invalidCount} invalid record(s) skipped)`;
     }