stackmem 1.0.24 → 1.0.26

package/src/config-file.ts

@@ -0,0 +1,98 @@
+import fs from "node:fs";
+import path from "node:path";
+
+export const STACKMEM_CONFIG_FILENAME = ".stackmem.json";
+
+export interface StackmemConfig {
+  ignore: string[];
+  tokenBudget: number;
+  decayLambda: number;
+  captureTypes: string[];
+  minQualityScore: number;
+}
+
+export const DEFAULT_STACKMEM_CONFIG: StackmemConfig = {
+  ignore: [],
+  tokenBudget: 2000,
+  decayLambda: 0.05,
+  captureTypes: ["decision", "constraint", "discovery", "rejection"],
+  minQualityScore: 0.3,
+};
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+
+// Every field is independently optional — a partial or malformed
+// .stackmem.json falls back to the default for whichever fields it got
+// wrong, rather than failing the whole read.
+function mergeWithDefaults(parsed: unknown): StackmemConfig {
+  const raw = (parsed && typeof parsed === "object" ? parsed : {}) as Record<string, unknown>;
+
+  return {
+    ignore: isStringArray(raw.ignore) ? raw.ignore : DEFAULT_STACKMEM_CONFIG.ignore,
+    tokenBudget:
+      typeof raw.tokenBudget === "number" && raw.tokenBudget > 0
+        ? raw.tokenBudget
+        : DEFAULT_STACKMEM_CONFIG.tokenBudget,
+    decayLambda:
+      typeof raw.decayLambda === "number" && raw.decayLambda > 0
+        ? raw.decayLambda
+        : DEFAULT_STACKMEM_CONFIG.decayLambda,
+    captureTypes: isStringArray(raw.captureTypes) ? raw.captureTypes : DEFAULT_STACKMEM_CONFIG.captureTypes,
+    minQualityScore:
+      typeof raw.minQualityScore === "number"
+        ? raw.minQualityScore
+        : DEFAULT_STACKMEM_CONFIG.minQualityScore,
+  };
+}
+
+// Reads .stackmem.json from `projectRoot` (defaulting to cwd). Missing
+// file, unreadable file, or invalid JSON all fall back to defaults
+// silently — a config file is an optimization, never a hard requirement.
+export function readStackmemConfig(projectRoot: string = process.cwd()): StackmemConfig {
+  const configPath = path.join(projectRoot, STACKMEM_CONFIG_FILENAME);
+
+  if (!fs.existsSync(configPath)) {
+    return { ...DEFAULT_STACKMEM_CONFIG };
+  }
+
+  try {
+    const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    return mergeWithDefaults(parsed);
+  } catch {
+    return { ...DEFAULT_STACKMEM_CONFIG };
+  }
+}
+
+export function defaultConfigFileContents(): string {
+  return JSON.stringify(DEFAULT_STACKMEM_CONFIG, null, 2) + "\n";
+}
+
+// Minimal glob support for the `ignore` list: a trailing "/" matches a
+// directory name anywhere in the path (like "dist/" already does
+// elsewhere in the hook's own skip list); "*" matches any run of
+// characters. Everything else is an exact match against the basename or
+// full path. Deliberately not a real glob engine — just enough for the
+// documented ignore patterns ("dist/", "migrations/", "*.generated.*").
+export function matchesIgnorePattern(filePath: string, pattern: string): boolean {
+  const baseName = filePath.split("/").pop() ?? filePath;
+
+  if (pattern.endsWith("/")) {
+    const dirName = pattern.slice(0, -1);
+    return filePath.split("/").includes(dirName);
+  }
+
+  if (pattern.includes("*")) {
+    const regex = new RegExp(
+      "^" + pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$"
+    );
+    return regex.test(baseName) || regex.test(filePath);
+  }
+
+  return filePath === pattern || baseName === pattern;
+}
+
+export function isIgnoredByConfig(filePath: string, config: StackmemConfig): boolean {
+  return config.ignore.some((pattern) => matchesIgnorePattern(filePath, pattern));
+}

package/src/config.ts

@@ -1,3 +1,7 @@
+// Where the hosted vault lives. `cm link` prints a URL under this origin for
+// the user to open in a browser, so it has to be the deployed domain.
+export const VAULT_URL = "https://stackmem-vault.vercel.app";
+
 export const SUPABASE_URL = "https://vuplpnwwygojkwxwsnip.supabase.co";
 export const SUPABASE_ANON_KEY =
   "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZ1cGxwbnd3eWdvamt3eHdzbmlwIiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTA0NjU2MjIsImV4cCI6MjEwNjA0MTYyMn0.gIIWuALWlOAzKRD3AAQVHnCNq-o4mVOHOgHJKc0fmYs";

package/src/index.ts

@@ -16,6 +16,7 @@ import {
   isAuthRelatedFile,
   isCodeFile,
   isQualityMessage,
+  redactSecrets,
 } from "./scoring.js";
 import { supabase } from "./storage.js";
 
@@ -54,7 +55,7 @@ server.registerTool(
     const scoredMemories = memories
       .map((memory) => ({
         ...memory,
-        decay_score: computeDecayScore(new Date(memory.created_at), memory.access_count ?? 0),
+        decay_score: computeDecayScore(new Date(memory.created_at), memory.access_count ?? 0, memory.pinned ?? false),
       }))
       .sort((a, b) => b.decay_score - a.decay_score);
 
@@ -224,6 +225,8 @@ server.registerTool(
     },
   },
   async ({ project, type, content }) => {
+    content = redactSecrets(content);
+
     const { data: existingRows, error: existingError } = await supabase
       .from("memories")
       .select("id, content")
@@ -261,7 +264,7 @@ server.registerTool(
 
     const { data: inserted, error } = await supabase
       .from("memories")
-      .insert({ project, type, content, device_id: getDeviceId() })
+      .insert({ project, type, content, device_id: getDeviceId(), source: "mcp" })
       .select("id")
       .single();
 

package/src/scoring.ts

@@ -202,13 +202,27 @@ export function decideSaveAction(
 // --- memory decay --------------------------------------------------------
 
 // Decay constant tuned for a ~14-day half-life: exp(-0.05 * 14) ≈ 0.5.
-const DECAY_LAMBDA = 0.05;
+// Overridable per-project via .stackmem.json's decayLambda (src/config-file.ts).
+export const DEFAULT_DECAY_LAMBDA = 0.05;
+
+// A pinned memory always sorts first and never decays — 999 is well above
+// any value the exponential formula below can produce, so ranking by this
+// score alone puts every pinned memory ahead of every unpinned one.
+const PINNED_SCORE = 999;
 
 // Recency-weighted relevance: frequently-accessed memories decay slower,
-// but every memory still fades over time regardless of access count.
-export function computeDecayScore(createdAt: Date, accessCount: number): number {
+// but every memory still fades over time regardless of access count —
+// unless pinned.
+export function computeDecayScore(
+  createdAt: Date,
+  accessCount: number,
+  pinned = false,
+  lambda = DEFAULT_DECAY_LAMBDA
+): number {
+  if (pinned) return PINNED_SCORE;
+
   const daysSinceCreated = (Date.now() - createdAt.getTime()) / (1000 * 60 * 60 * 24);
-  return (1 + Math.log(1 + accessCount)) * Math.exp(-DECAY_LAMBDA * daysSinceCreated);
+  return (1 + Math.log(1 + accessCount)) * Math.exp(-lambda * daysSinceCreated);
 }
 
 // --- context budget ------------------------------------------------------
@@ -485,4 +499,30 @@ export function scoreMemoryRelevance(memoryContent: string, task: string): numbe
 
   return structuralScore * 0.7 + wordOverlapRatio * 0.3;
 }
+
+// --- task-aware ranking signals (branch name / PR title overlap) -----------
+
+const TOKEN_SPLIT_RE = /[^a-zA-Z0-9]+/;
+const MIN_TOKEN_LENGTH = 3;
+
+// Branch names and PR titles use "/", "-", "_" as word separators (e.g.
+// "feature/stripe-webhook-retry"), unlike prose content — splitWords above
+// only splits on whitespace, so it can't tokenize these the same way.
+export function tokenize(text: string): Set<string> {
+  const tokens = new Set<string>();
+  for (const word of text.toLowerCase().split(TOKEN_SPLIT_RE)) {
+    if (word.length >= MIN_TOKEN_LENGTH && !STOP_WORDS.has(word)) {
+      tokens.add(word);
+    }
+  }
+  return tokens;
+}
+
+export function hasTokenOverlap(a: Set<string>, b: Set<string>): boolean {
+  for (const token of a) {
+    if (b.has(token)) return true;
+  }
+  return false;
+}
+
 // TODO: optimize the clustering algorithm

package/src/storage.ts

@@ -27,7 +27,7 @@ import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 import { SUPABASE_ANON_KEY, SUPABASE_URL } from "./config.js";
 import { getDeviceId } from "./device.js";
 
-export const supabase: SupabaseClient = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+const rawSupabase: SupabaseClient = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
   global: {
     headers: {
       "x-device-id": getDeviceId(),
@@ -35,6 +35,106 @@ export const supabase: SupabaseClient = createClient(SUPABASE_URL, SUPABASE_ANON
   },
 });
 
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// maxAttempts counts RETRIES, not total tries — the default (3 retries,
+// 500ms base) produces exactly the 500ms / 1000ms / 2000ms backoff
+// sequence across 4 total tries (1 initial + 3 retries).
+export async function withRetry<T>(
+  fn: () => Promise<T>,
+  maxAttempts = 3,
+  baseDelayMs = 500
+): Promise<T> {
+  let lastError: unknown;
+
+  for (let attempt = 0; attempt <= maxAttempts; attempt++) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (attempt === maxAttempts) break;
+
+      const delayMs = baseDelayMs * 2 ** attempt;
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(
+        `Supabase request failed (retry ${attempt + 1}/${maxAttempts} in ${delayMs}ms): ${message}`
+      );
+      await sleep(delayMs);
+    }
+  }
+
+  throw lastError;
+}
+
+// A 4xx response (bad request, not found, RLS denial) is a logic error —
+// retrying it wastes time and can't succeed. status 0 (the fetch itself
+// failed: DNS, connection refused, timeout) and 5xx (transient server
+// errors) are the cases retrying can actually help with.
+function isRetryableStatus(status: number): boolean {
+  return status === 0 || status >= 500;
+}
+
+// Supabase/postgrest query results RESOLVE with { data, error, status }
+// even on failure — they don't reject — so a plain try/catch around the
+// call never sees a 5xx or network failure to retry. This wraps every
+// query builder returned from `.from(...)` so that a retryable result
+// is converted into a throw (for withRetry's catch to see), while a
+// success or a non-retryable 4xx result still resolves normally, exactly
+// as every existing `const { data, error } = await supabase.from(...)...`
+// call site already expects — no call site elsewhere needs to change.
+function wrapWithRetry<T>(target: T): T {
+  if (target === null || typeof target !== "object") return target;
+
+  return new Proxy(target as object, {
+    get(obj: any, prop, receiver) {
+      if (prop === "then") {
+        return (onFulfilled?: unknown, onRejected?: unknown) => {
+          const attempt = () =>
+            new Promise((resolve, reject) => {
+              obj.then(
+                (result: any) => {
+                  if (result && result.error && isRetryableStatus(result.status)) {
+                    const err = new Error(
+                      `Supabase request failed (status ${result.status}): ${result.error.message}`
+                    );
+                    (err as any).status = result.status;
+                    (err as any).supabaseError = result.error;
+                    reject(err);
+                  } else {
+                    resolve(result);
+                  }
+                },
+                (err: unknown) => reject(err)
+              );
+            });
+
+          return withRetry(attempt).then(
+            onFulfilled as ((value: unknown) => unknown) | undefined,
+            onRejected as ((reason: unknown) => unknown) | undefined
+          );
+        };
+      }
+
+      const value = Reflect.get(obj, prop, receiver);
+      if (typeof value === "function") {
+        return (...args: unknown[]) => wrapWithRetry(value.apply(obj, args));
+      }
+      return value;
+    },
+  }) as T;
+}
+
+export const supabase: SupabaseClient = new Proxy(rawSupabase, {
+  get(obj, prop, receiver) {
+    if (prop === "from") {
+      return (...args: unknown[]) => wrapWithRetry((obj.from as (...a: unknown[]) => unknown)(...args));
+    }
+    return Reflect.get(obj, prop, receiver);
+  },
+}) as SupabaseClient;
+
 // Run this migration in the Supabase SQL editor to add the access_count
 // column used by the memory decay scoring in src/scoring.ts (computeDecayScore)
 // and consumed by cm start / session_start in src/cli.ts and src/index.ts.
@@ -55,3 +155,10 @@ export const supabase: SupabaseClient = createClient(SUPABASE_URL, SUPABASE_ANON
 //
 // create index memory_links_source_id_idx on memory_links(source_id);
 // create index memory_links_target_id_idx on memory_links(target_id);
+
+// `cm link` (src/cli.ts) writes to a link_codes table, and the vault pairs
+// devices to GitHub accounts via user_devices. The vault owns that schema —
+// run supabase/migrations/001_user_devices_and_link_codes.sql from the
+// stackmem-vault repo. link_codes is RLS-scoped to the same 'x-device-id'
+// header as the policies above, so a device can create and poll only its own
+// codes; the vault reads them with the service-role key.