stackmem 1.0.22 → 1.0.25

package/dist/cli.js

@@ -2,9 +2,11 @@
 import nodeFs from "node:fs";
 import nodeOs from "node:os";
 import nodePath from "node:path";
+import { randomInt } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { analyzeCodebase } from "./ast-index.js";
+import { VAULT_URL } from "./config.js";
 import { getDeviceId } from "./device.js";
 import { applyContextBudget, buildSummaryContent, clusterMemories, computeDecayScore, computeMemoryLinks, decideSaveAction, estimateTokens, extractEntities, indicatesFailedApproach, isAuthRelatedFile, isCodeFile, isQualityMessage, redactSecrets, scoreMemoryRelevance, } from "./scoring.js";
 import { supabase } from "./storage.js";
@@ -43,6 +45,7 @@ function usage() {
   cm compress [project]
   cm init <project> <path>
   cm uninstall [project] [path]
+  cm link
   cm sync
   cm context [--project <name>] <task>
   cm session-end [project] [--summary <text>] [--errors <a,b>] [--files <a,b>] [--approaches <a,b>]
@@ -130,6 +133,13 @@ function cmdHelp() {
       Also removes the stackmem entry from ~/.claude.json's mcpServers.
       [project] defaults to the .stackmem file at <path> if omitted.
 
+  cm link
+      Connect this device to your GitHub account in the hosted vault.
+      Prints a 6-digit code, then waits for you to enter it at
+      stackmem-vault.vercel.app/link while signed in. The code is
+      single-use and expires after 10 minutes; polling stops when it
+      does. Links are per-device, so run this once on each machine.
+
   cm sync
       Regenerate .cursorrules and .windsurfrules from the project's
       current unresolved memories (decay-ranked, capped at a 2000
@@ -1472,6 +1482,73 @@ async function cmdSync(project) {
     nodeFs.writeFileSync(nodePath.join(resolvedPath, ".windsurfrules"), rulesContent, "utf-8");
     console.log("Synced memories to .cursorrules and .windsurfrules");
 }
+// --- cm link ---------------------------------------------------------------
+// Mirrors the link_codes.expires_at default in the migration
+// (supabase/migrations/001_user_devices_and_link_codes.sql in the vault repo).
+// If that interval changes, change this too — polling past expires_at just
+// burns requests against a row the API will refuse.
+const LINK_CODE_TTL_MS = 10 * 60 * 1000;
+const LINK_POLL_INTERVAL_MS = 3_000;
+const LINK_CODE_INSERT_ATTEMPTS = 5;
+const PG_UNIQUE_VIOLATION = "23505";
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// randomInt is a CSPRNG and uniform over the range. Math.random() would do
+// neither, and a link code is a short-lived credential for claiming this
+// device's memories — a guessable one is a hijack.
+function generateLinkCode() {
+    return String(randomInt(0, 1_000_000)).padStart(6, "0");
+}
+async function cmdLink() {
+    const deviceId = getDeviceId();
+    // A 6-digit space collides rarely, but only unclaimed codes occupy it and
+    // the primary key makes a collision a hard error rather than a silent
+    // overwrite — so retry with a fresh code instead of failing the command.
+    let code = null;
+    for (let attempt = 0; attempt < LINK_CODE_INSERT_ATTEMPTS; attempt++) {
+        const candidate = generateLinkCode();
+        const { error } = await supabase
+            .from("link_codes")
+            .insert({ code: candidate, device_id: deviceId });
+        if (!error) {
+            code = candidate;
+            break;
+        }
+        if (error.code !== PG_UNIQUE_VIOLATION) {
+            fail(`Failed to create a link code: ${error.message}`);
+        }
+    }
+    if (!code) {
+        fail("Could not get an unused link code. Try again in a minute.");
+    }
+    console.log(`Go to ${VAULT_URL}/link and enter code: ${code}`);
+    const deadline = Date.now() + LINK_CODE_TTL_MS;
+    while (Date.now() < deadline) {
+        await sleep(LINK_POLL_INTERVAL_MS);
+        const { data, error } = await supabase
+            .from("link_codes")
+            .select("claimed_at")
+            .eq("code", code)
+            .maybeSingle();
+        // A transient read failure shouldn't abandon a link the user may have
+        // already completed in the browser — keep polling until the code expires.
+        if (error)
+            continue;
+        // The row is gone: either housekeeping swept it or it was never visible
+        // to this device. Either way there's nothing left to claim.
+        if (!data)
+            break;
+        if (data.claimed_at) {
+            console.log("Device linked to your GitHub account.");
+            // Best-effort cleanup — the code is spent either way, and the API
+            // rejects claimed codes, so a failure here is harmless.
+            await supabase.from("link_codes").delete().eq("code", code);
+            return;
+        }
+    }
+    console.log("Link code expired. Run cm link again.");
+}
 // --- cm context ------------------------------------------------------------
 const CONTEXT_TYPE_ORDER = ["decision", "constraint", "rejection", "discovery"];
 const CONTEXT_TOP_N = 5;
@@ -2065,6 +2142,12 @@ async function main() {
             await cmdInit(project, targetPath);
             break;
         }
+        case "link": {
+            if (args.length > 0)
+                usage();
+            await cmdLink();
+            break;
+        }
         case "sync": {
             if (args.length > 0)
                 usage();
@@ -2149,8 +2232,20 @@ async function main() {
 }
 // Guards the auto-run so importing this module (e.g. from a test file, to
 // reach exported helpers like trySeedMemory) doesn't also execute main()
-// against the test runner's own argv.
-const isMainModule = process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href;
+// against the test runner's own argv. realpathSync matters here: the `cm`
+// bin is typically a symlink (npm link, or the global install this project
+// itself uses), and process.argv[1] preserves the symlink path as invoked
+// while import.meta.url resolves to the link's real target — comparing
+// them raw would never match, silently skipping main() entirely.
+function resolveMainModulePath(argvPath) {
+    try {
+        return pathToFileURL(nodeFs.realpathSync(argvPath)).href;
+    }
+    catch {
+        return null;
+    }
+}
+const isMainModule = process.argv[1] != null && import.meta.url === resolveMainModulePath(process.argv[1]);
 if (isMainModule) {
     main().catch((error) => {
         fail(error instanceof Error ? error.message : String(error));

package/dist/config.js

@@ -1,2 +1,5 @@
+// Where the hosted vault lives. `cm link` prints a URL under this origin for
+// the user to open in a browser, so it has to be the deployed domain.
+export const VAULT_URL = "https://stackmem-vault.vercel.app";
 export const SUPABASE_URL = "https://vuplpnwwygojkwxwsnip.supabase.co";
 export const SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZ1cGxwbnd3eWdvamt3eHdzbmlwIiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTA0NjU2MjIsImV4cCI6MjEwNjA0MTYyMn0.gIIWuALWlOAzKRD3AAQVHnCNq-o4mVOHOgHJKc0fmYs";

package/dist/storage.js

@@ -51,3 +51,9 @@ export const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
 //
 // create index memory_links_source_id_idx on memory_links(source_id);
 // create index memory_links_target_id_idx on memory_links(target_id);
+// `cm link` (src/cli.ts) writes to a link_codes table, and the vault pairs
+// devices to GitHub accounts via user_devices. The vault owns that schema —
+// run supabase/migrations/001_user_devices_and_link_codes.sql from the
+// stackmem-vault repo. link_codes is RLS-scoped to the same 'x-device-id'
+// header as the policies above, so a device can create and poll only its own
+// codes; the vault reads them with the service-role key.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackmem",
-  "version": "1.0.22",
+  "version": "1.0.25",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/cli.ts

@@ -2,9 +2,11 @@
 import nodeFs from "node:fs";
 import nodeOs from "node:os";
 import nodePath from "node:path";
+import { randomInt } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { analyzeCodebase } from "./ast-index.js";
+import { VAULT_URL } from "./config.js";
 import { getDeviceId } from "./device.js";
 import {
   applyContextBudget,
@@ -64,6 +66,7 @@ function usage(): never {
   cm compress [project]
   cm init <project> <path>
   cm uninstall [project] [path]
+  cm link
   cm sync
   cm context [--project <name>] <task>
   cm session-end [project] [--summary <text>] [--errors <a,b>] [--files <a,b>] [--approaches <a,b>]
@@ -152,6 +155,13 @@ function cmdHelp() {
       Also removes the stackmem entry from ~/.claude.json's mcpServers.
       [project] defaults to the .stackmem file at <path> if omitted.
 
+  cm link
+      Connect this device to your GitHub account in the hosted vault.
+      Prints a 6-digit code, then waits for you to enter it at
+      stackmem-vault.vercel.app/link while signed in. The code is
+      single-use and expires after 10 minutes; polling stops when it
+      does. Links are per-device, so run this once on each machine.
+
   cm sync
       Regenerate .cursorrules and .windsurfrules from the project's
       current unresolved memories (decay-ranked, capped at a 2000
@@ -1689,6 +1699,88 @@ async function cmdSync(project: string) {
   console.log("Synced memories to .cursorrules and .windsurfrules");
 }
 
+// --- cm link ---------------------------------------------------------------
+
+// Mirrors the link_codes.expires_at default in the migration
+// (supabase/migrations/001_user_devices_and_link_codes.sql in the vault repo).
+// If that interval changes, change this too — polling past expires_at just
+// burns requests against a row the API will refuse.
+const LINK_CODE_TTL_MS = 10 * 60 * 1000;
+const LINK_POLL_INTERVAL_MS = 3_000;
+const LINK_CODE_INSERT_ATTEMPTS = 5;
+const PG_UNIQUE_VIOLATION = "23505";
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// randomInt is a CSPRNG and uniform over the range. Math.random() would do
+// neither, and a link code is a short-lived credential for claiming this
+// device's memories — a guessable one is a hijack.
+function generateLinkCode(): string {
+  return String(randomInt(0, 1_000_000)).padStart(6, "0");
+}
+
+async function cmdLink() {
+  const deviceId = getDeviceId();
+
+  // A 6-digit space collides rarely, but only unclaimed codes occupy it and
+  // the primary key makes a collision a hard error rather than a silent
+  // overwrite — so retry with a fresh code instead of failing the command.
+  let code: string | null = null;
+  for (let attempt = 0; attempt < LINK_CODE_INSERT_ATTEMPTS; attempt++) {
+    const candidate = generateLinkCode();
+    const { error } = await supabase
+      .from("link_codes")
+      .insert({ code: candidate, device_id: deviceId });
+
+    if (!error) {
+      code = candidate;
+      break;
+    }
+    if (error.code !== PG_UNIQUE_VIOLATION) {
+      fail(`Failed to create a link code: ${error.message}`);
+    }
+  }
+
+  if (!code) {
+    fail("Could not get an unused link code. Try again in a minute.");
+  }
+
+  console.log(`Go to ${VAULT_URL}/link and enter code: ${code}`);
+
+  const deadline = Date.now() + LINK_CODE_TTL_MS;
+
+  while (Date.now() < deadline) {
+    await sleep(LINK_POLL_INTERVAL_MS);
+
+    const { data, error } = await supabase
+      .from("link_codes")
+      .select("claimed_at")
+      .eq("code", code)
+      .maybeSingle();
+
+    // A transient read failure shouldn't abandon a link the user may have
+    // already completed in the browser — keep polling until the code expires.
+    if (error) continue;
+
+    // The row is gone: either housekeeping swept it or it was never visible
+    // to this device. Either way there's nothing left to claim.
+    if (!data) break;
+
+    if (data.claimed_at) {
+      console.log("Device linked to your GitHub account.");
+
+      // Best-effort cleanup — the code is spent either way, and the API
+      // rejects claimed codes, so a failure here is harmless.
+      await supabase.from("link_codes").delete().eq("code", code);
+      return;
+    }
+  }
+
+  console.log("Link code expired. Run cm link again.");
+}
+
 // --- cm context ------------------------------------------------------------
 
 const CONTEXT_TYPE_ORDER: MemoryType[] = ["decision", "constraint", "rejection", "discovery"];
@@ -2338,6 +2430,11 @@ async function main() {
       await cmdInit(project, targetPath);
       break;
     }
+    case "link": {
+      if (args.length > 0) usage();
+      await cmdLink();
+      break;
+    }
     case "sync": {
       if (args.length > 0) usage();
       const project = requireProject(null);
@@ -2418,8 +2515,21 @@ async function main() {
 
 // Guards the auto-run so importing this module (e.g. from a test file, to
 // reach exported helpers like trySeedMemory) doesn't also execute main()
-// against the test runner's own argv.
-const isMainModule = process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href;
+// against the test runner's own argv. realpathSync matters here: the `cm`
+// bin is typically a symlink (npm link, or the global install this project
+// itself uses), and process.argv[1] preserves the symlink path as invoked
+// while import.meta.url resolves to the link's real target — comparing
+// them raw would never match, silently skipping main() entirely.
+function resolveMainModulePath(argvPath: string): string | null {
+  try {
+    return pathToFileURL(nodeFs.realpathSync(argvPath)).href;
+  } catch {
+    return null;
+  }
+}
+
+const isMainModule =
+  process.argv[1] != null && import.meta.url === resolveMainModulePath(process.argv[1]);
 if (isMainModule) {
   main().catch((error) => {
     fail(error instanceof Error ? error.message : String(error));

package/src/config.ts

@@ -1,3 +1,7 @@
+// Where the hosted vault lives. `cm link` prints a URL under this origin for
+// the user to open in a browser, so it has to be the deployed domain.
+export const VAULT_URL = "https://stackmem-vault.vercel.app";
+
 export const SUPABASE_URL = "https://vuplpnwwygojkwxwsnip.supabase.co";
 export const SUPABASE_ANON_KEY =
   "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZ1cGxwbnd3eWdvamt3eHdzbmlwIiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTA0NjU2MjIsImV4cCI6MjEwNjA0MTYyMn0.gIIWuALWlOAzKRD3AAQVHnCNq-o4mVOHOgHJKc0fmYs";

package/src/storage.ts

@@ -55,3 +55,10 @@ export const supabase: SupabaseClient = createClient(SUPABASE_URL, SUPABASE_ANON
 //
 // create index memory_links_source_id_idx on memory_links(source_id);
 // create index memory_links_target_id_idx on memory_links(target_id);
+
+// `cm link` (src/cli.ts) writes to a link_codes table, and the vault pairs
+// devices to GitHub accounts via user_devices. The vault owns that schema —
+// run supabase/migrations/001_user_devices_and_link_codes.sql from the
+// stackmem-vault repo. link_codes is RLS-scoped to the same 'x-device-id'
+// header as the policies above, so a device can create and poll only its own
+// codes; the vault reads them with the service-role key.