stackmem 1.0.26 → 1.0.27

package/dist/index.js

@@ -4,7 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { analyzeCodebase, getFileSummary, findDependencies } from "./ast-index.js";
 import { getDeviceId } from "./device.js";
-import { applyContextBudget, buildSummaryContent, clusterMemories, computeDecayScore, computeMemoryLinks, decideSaveAction, estimateTokens, indicatesFailedApproach, isAuthRelatedFile, isCodeFile, isQualityMessage, redactSecrets, } from "./scoring.js";
+import { applyContextBudget, buildSummaryContent, clusterMemories, computeDecayScore, computeMemoryLinks, decideSaveAction, estimateTokens, indicatesFailedApproach, isAuthRelatedFile, isCodeFile, isQualityMessage, parseUtcDate, redactSecrets, } from "./scoring.js";
 import { supabase } from "./storage.js";
 const CONTEXT_BUDGET_TOKENS = 2000;
 const COMPRESSION_THRESHOLD = 20;
@@ -24,7 +24,8 @@ server.registerTool("session_start", {
         .from("memories")
         .select("*")
         .eq("project", project)
-        .eq("resolved", false);
+        .eq("resolved", false)
+        .eq("suggested", false);
     if (error) {
         throw new Error(`Failed to load memories: ${error.message}`);
     }
@@ -32,7 +33,7 @@ server.registerTool("session_start", {
     const scoredMemories = memories
         .map((memory) => ({
         ...memory,
-        decay_score: computeDecayScore(new Date(memory.created_at), memory.access_count ?? 0, memory.pinned ?? false),
+        decay_score: computeDecayScore(parseUtcDate(memory.created_at), memory.access_count ?? 0, memory.pinned ?? false),
     }))
         .sort((a, b) => b.decay_score - a.decay_score);
     const budgetedMemories = applyContextBudget(scoredMemories, CONTEXT_BUDGET_TOKENS);
@@ -112,7 +113,8 @@ async function compressMemories(project) {
         .from("memories")
         .select("*")
         .eq("project", project)
-        .eq("resolved", false);
+        .eq("resolved", false)
+        .eq("suggested", false);
     if (error) {
         throw new Error(`Failed to load memories for compression: ${error.message}`);
     }

package/dist/scoring.js

@@ -65,7 +65,9 @@ function trigramSet(text) {
 // similarity (typos, partial substrings, shared phrasing) that word-based
 // containment misses entirely, since containment only ever compares whole
 // extracted entities.
-function ngramOverlap(a, b) {
+// Exported for direct unit testing (src/tests/scoring.test.ts) — hybridScore
+// is the only production caller.
+export function ngramOverlap(a, b) {
     const trigramsA = trigramSet(a);
     const trigramsB = trigramSet(b);
     const union = new Set([...trigramsA, ...trigramsB]);
@@ -114,7 +116,9 @@ const NEGATION_WORDS = [
     "switched", "removed", "replaced", "no longer", "instead",
     "deprecated", "reverted", "changed",
 ];
-function containsNegationWord(text) {
+// Exported for direct unit testing (src/tests/scoring.test.ts) — decideSaveAction
+// is the only production caller.
+export function containsNegationWord(text) {
     const lower = text.toLowerCase();
     return NEGATION_WORDS.some((word) => lower.includes(word));
 }
@@ -159,6 +163,17 @@ export function decideSaveAction(newContent, existingMemories) {
     return { action: "created" };
 }
 // --- memory decay --------------------------------------------------------
+// Supabase/PostgREST sometimes returns a timestamptz column without an
+// explicit UTC suffix (e.g. "2026-10-26T00:36:16.36535" — no "Z" or
+// offset — even though the underlying value is UTC). The bare `new
+// Date(...)` constructor then parses that as LOCAL time, silently
+// shifting every timestamp by the machine's UTC offset — several hours
+// of error on every decay score, and a negative "N seconds ago" for
+// anything created in roughly the last half-day. Normalize first.
+export function parseUtcDate(dateString) {
+    const hasTimezone = /[Zz]$|[+-]\d{2}:?\d{2}$/.test(dateString);
+    return new Date(hasTimezone ? dateString : `${dateString}Z`);
+}
 // Decay constant tuned for a ~14-day half-life: exp(-0.05 * 14) ≈ 0.5.
 // Overridable per-project via .stackmem.json's decayLambda (src/config-file.ts).
 export const DEFAULT_DECAY_LAMBDA = 0.05;

package/dist/tests/crud.test.js

@@ -0,0 +1,93 @@
+// CRUD-behavior tests. Tests 1-3 are pure (decideSaveAction, no network).
+// Tests 4-6 exercise the real Supabase backend via the compiled CLI,
+// matching src/tests/regression.test.ts's convention — using a dedicated
+// throwaway project cleaned up in `after()` regardless of pass/fail.
+import { test, after } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { decideSaveAction } from "../scoring.js";
+import { supabase } from "../storage.js";
+const CLI_PATH = path.join(import.meta.dirname, "..", "..", "dist", "cli.js");
+const CRUD_TEST_PROJECT = "crud-test-temp";
+function runCli(args) {
+    return execFileSync(process.execPath, [CLI_PATH, ...args], { encoding: "utf-8" });
+}
+// 1. decideSaveAction returns "duplicate" ("skip", in the task's wording)
+// for near-identical content.
+test('decideSaveAction returns "duplicate" for near-identical content', () => {
+    const existing = [{ id: "mem-1", content: "add stripe webhook signature verification" }];
+    const decision = decideSaveAction("add stripe webhook signature verification", existing);
+    assert.equal(decision.action, "duplicate");
+});
+// 2. decideSaveAction returns "superseded" ("replace", in the task's
+// wording) for contradicting content.
+test('decideSaveAction returns "superseded" for contradicting content', () => {
+    const existing = [{ id: "mem-1", content: "use redis for session storage" }];
+    const decision = decideSaveAction("we switched from redis to postgres for session storage", existing);
+    assert.equal(decision.action, "superseded");
+});
+// 3. decideSaveAction returns "created" ("create", in the task's wording)
+// for genuinely new content.
+test('decideSaveAction returns "created" for genuinely new content', () => {
+    const existing = [{ id: "mem-1", content: "use redis for session storage" }];
+    const decision = decideSaveAction("add rate limiting to the public api gateway", existing);
+    assert.equal(decision.action, "created");
+});
+after(async () => {
+    const { data: mem } = await supabase.from("memories").select("id").eq("project", CRUD_TEST_PROJECT);
+    const ids = (mem ?? []).map((m) => m.id);
+    if (ids.length > 0) {
+        const idList = ids.join(",");
+        await supabase.from("memory_links").delete().or(`source_id.in.(${idList}),target_id.in.(${idList})`);
+    }
+    await supabase.from("memories").delete().eq("project", CRUD_TEST_PROJECT);
+});
+// 4. A duplicate commit_sha is recognized by the check-commit guard
+// (src/cli.ts cmdCheckCommit) rather than producing a second memory for
+// the same commit — this is the actual mechanism behind "saving a memory
+// with a duplicate commit_sha doesn't create a new one": the hook calls
+// `cm check-commit` once per invocation and skips its entire capture
+// pass if it reports the commit_sha already has a memory, rather than
+// cmdSave de-duplicating per individual save. Exit code is inverted:
+// 0 = not seen yet (proceed), 1 = already has a memory (duplicate, skip).
+test("check-commit: fresh sha allowed, then blocked once a memory exists for it", () => {
+    const sha = `test-sha-${Date.now()}-fresh`;
+    // No memory for this sha yet — check-commit should exit 0 (allowed).
+    runCli(["check-commit", CRUD_TEST_PROJECT, sha]);
+    // Save a memory tagged with that sha.
+    runCli(["save", CRUD_TEST_PROJECT, "decision", "duplicate commit_sha guard test", "--force", "--commit-sha", sha]);
+    // Now the same sha must be blocked (non-zero exit = duplicate).
+    assert.throws(() => runCli(["check-commit", CRUD_TEST_PROJECT, sha]));
+});
+// 5. cm pin sets pinned=true.
+test("cm pin sets pinned=true on the target memory", async () => {
+    runCli(["save", CRUD_TEST_PROJECT, "decision", "memory to be pinned in crud test", "--force"]);
+    const { data } = await supabase
+        .from("memories")
+        .select("id")
+        .eq("project", CRUD_TEST_PROJECT)
+        .eq("content", "memory to be pinned in crud test")
+        .single();
+    assert.ok(data);
+    runCli(["pin", CRUD_TEST_PROJECT, data.id]);
+    const { data: after_ } = await supabase.from("memories").select("pinned").eq("id", data.id).single();
+    assert.ok(after_);
+    assert.equal(after_.pinned, true);
+});
+// 6. cm unpin sets pinned=false.
+test("cm unpin sets pinned=false on the target memory", async () => {
+    runCli(["save", CRUD_TEST_PROJECT, "decision", "memory to be unpinned in crud test", "--force"]);
+    const { data } = await supabase
+        .from("memories")
+        .select("id")
+        .eq("project", CRUD_TEST_PROJECT)
+        .eq("content", "memory to be unpinned in crud test")
+        .single();
+    assert.ok(data);
+    runCli(["pin", CRUD_TEST_PROJECT, data.id]);
+    runCli(["unpin", CRUD_TEST_PROJECT, data.id]);
+    const { data: after_ } = await supabase.from("memories").select("pinned").eq("id", data.id).single();
+    assert.ok(after_);
+    assert.equal(after_.pinned, false);
+});

package/dist/tests/hook.test.js

@@ -0,0 +1,296 @@
+// Hook integration tests against real temporary git repos. These hit the
+// real Supabase backend (same convention as regression.test.ts) — each
+// test uses its own throwaway project name, cleaned up in `after()`
+// regardless of pass/fail. No MCP contract tests yet (Phase 2, per the
+// user). Run with `npm test`.
+import { test, after } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, existsSync, writeFileSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { supabase } from "../storage.js";
+const CLI_PATH = path.join(import.meta.dirname, "..", "..", "dist", "cli.js");
+const projectsToCleanUp = [];
+let uniqueCounter = 0;
+function uniqueProject(label) {
+    uniqueCounter++;
+    const project = `hooktest-${label}-${Date.now()}-${uniqueCounter}`;
+    projectsToCleanUp.push(project);
+    return project;
+}
+function makeTempRepo() {
+    return mkdtempSync(path.join(tmpdir(), "stackmem-hooktest-repo-"));
+}
+function gitInit(dir) {
+    execFileSync("git", ["init", "-q"], { cwd: dir });
+}
+// cm init also registers Claude Code hooks, the MCP server, and editor
+// MCP configs into $HOME — scoped to a scratch HOME so none of that
+// touches this machine's real config, same convention used throughout
+// manual verification earlier in this phase.
+function initStackmem(dir, project) {
+    const fakeHome = mkdtempSync(path.join(tmpdir(), "stackmem-hooktest-home-"));
+    writeFileSync(path.join(fakeHome, ".claude.json"), JSON.stringify({ mcpServers: {} }), "utf-8");
+    execFileSync(process.execPath, [CLI_PATH, "init", project, "."], {
+        cwd: dir,
+        env: { ...process.env, HOME: fakeHome },
+    });
+}
+function commit(dir, message, files = { "f.txt": "x" }) {
+    for (const [name, content] of Object.entries(files)) {
+        writeFileSync(path.join(dir, name), content, "utf-8");
+    }
+    execFileSync("git", ["add", "."], { cwd: dir });
+    execFileSync("git", ["-c", "user.email=a@b.com", "-c", "user.name=t", "commit", "-q", "-m", message], { cwd: dir });
+}
+async function fetchMemories(project) {
+    const { data, error } = await supabase
+        .from("memories")
+        .select("content, type")
+        .eq("project", project);
+    if (error)
+        throw new Error(error.message);
+    return data ?? [];
+}
+after(async () => {
+    for (const project of projectsToCleanUp) {
+        const { data: mem } = await supabase.from("memories").select("id").eq("project", project);
+        const ids = (mem ?? []).map((m) => m.id);
+        if (ids.length > 0) {
+            const idList = ids.join(",");
+            await supabase.from("memory_links").delete().or(`source_id.in.(${idList}),target_id.in.(${idList})`);
+        }
+        await supabase.from("memories").delete().eq("project", project);
+        await supabase.from("execution_log").delete().eq("project", project);
+    }
+});
+// 1. Fresh repo: cm init writes all expected files.
+test("fresh repo: cm init writes all expected files", () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const project = uniqueProject("init");
+        initStackmem(dir, project);
+        for (const file of [
+            ".stackmem",
+            "CLAUDE.md",
+            "AGENTS.md",
+            "GEMINI.md",
+            ".cursorrules",
+            ".windsurfrules",
+            ".gitignore",
+            path.join(".cursor", "rules", "stackmem.md"),
+            path.join(".coding-memory", "post-commit-hook.mjs"),
+            path.join(".git", "hooks", "post-commit"),
+            path.join(".git", "hooks", "post-rewrite"),
+            path.join(".claude", "settings.json"),
+        ]) {
+            assert.ok(existsSync(path.join(dir, file)), `expected ${file} to exist`);
+        }
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 2. Commit with a "feat:" message saves a decision.
+test('commit with a "feat:" message saves a decision', async () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const project = uniqueProject("feat");
+        initStackmem(dir, project);
+        commit(dir, "feat: add stripe webhook signature verification logic today");
+        const memories = await fetchMemories(project);
+        assert.ok(memories.some((m) => m.type === "decision" && m.content.includes("stripe webhook")), `expected a decision memory, got: ${JSON.stringify(memories)}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 3. Commit with a "chore:" message saves nothing.
+test('commit with a "chore:" message saves nothing', async () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const project = uniqueProject("chore");
+        initStackmem(dir, project);
+        commit(dir, "chore: bump dependency versions across the board today");
+        const memories = await fetchMemories(project);
+        assert.equal(memories.length, 0, `expected no memories, got: ${JSON.stringify(memories)}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 4. Commit message with an AWS key saves [REDACTED], not the raw key.
+test("commit message with an AWS key saves [REDACTED], not the raw key", async () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const project = uniqueProject("redact");
+        initStackmem(dir, project);
+        commit(dir, "feat: rotate credentials AKIAABCDEFGHIJ123456 for the deploy pipeline");
+        const memories = await fetchMemories(project);
+        const decision = memories.find((m) => m.type === "decision");
+        assert.ok(decision, `expected a decision memory, got: ${JSON.stringify(memories)}`);
+        assert.doesNotMatch(decision.content, /AKIA[0-9A-Z]{16}/);
+        assert.match(decision.content, /\[REDACTED\]/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 5. Amend doesn't create a duplicate memory for the same final commit
+// sha (SHA idempotency via check-commit — see src/cli.ts cmdCheckCommit).
+// Amending legitimately produces a NEW commit_sha, which legitimately
+// gets its own new capture — that's 2 decisions total, correctly. What
+// the idempotency guard actually prevents is post-commit AND
+// post-rewrite both capturing that same amended sha a second time.
+test("amend doesn't create a duplicate memory for the same commit_sha (SHA idempotency)", async () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const project = uniqueProject("amend");
+        initStackmem(dir, project);
+        commit(dir, "feat: initial commit for amend idempotency test today");
+        execFileSync("git", ["-c", "user.email=a@b.com", "-c", "user.name=t", "commit", "--amend", "-q", "-m", "feat: amended commit for amend idempotency test today"], { cwd: dir });
+        const { data, error } = await supabase
+            .from("memories")
+            .select("content, commit_sha")
+            .eq("project", project)
+            .eq("type", "decision");
+        if (error)
+            throw new Error(error.message);
+        const shas = (data ?? []).map((m) => m.commit_sha);
+        assert.equal(shas.length, new Set(shas).size, `expected no two decisions sharing a commit_sha, got: ${JSON.stringify(data)}`);
+        assert.ok((data ?? []).some((m) => m.content.includes("amended commit")));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 6. Hook times out after 2s and exits 0 (never blocks the commit).
+test("hook times out after 2s and exits 0", () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "stackmem-hooktest-timeout-"));
+    const scriptPath = path.join(dir, "slow-hook.mjs");
+    // Mirrors buildHookLogicScript's main()/runHook() timeout wrapper
+    // (src/cli.ts) exactly, with runHook() replaced by an artificial 5s
+    // hang to deterministically force the timeout path — forcing the real
+    // hook's own body (git/network calls) to take >2s isn't something a
+    // test can reliably control.
+    writeFileSync(scriptPath, `
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+
+const HOOK_TIMEOUT_MS = 2000;
+
+function logHookError(error) {
+  try {
+    const logPath = join(process.cwd(), ".coding-memory", "hook.log");
+    mkdirSync(dirname(logPath), { recursive: true });
+    appendFileSync(logPath, \`[\${new Date().toISOString()}] \${error instanceof Error ? error.message : String(error)}\\n\`);
+  } catch {}
+}
+
+async function runHook() {
+  await new Promise((resolve) => setTimeout(resolve, 5000));
+}
+
+async function main() {
+  let timeoutHandle;
+  try {
+    await Promise.race([
+      runHook(),
+      new Promise((_resolve, reject) => {
+        timeoutHandle = setTimeout(
+          () => reject(new Error("stackmem post-commit hook exceeded " + HOOK_TIMEOUT_MS + "ms timeout")),
+          HOOK_TIMEOUT_MS
+        );
+      }),
+    ]);
+  } catch (error) {
+    logHookError(error);
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+}
+
+main().finally(() => process.exit(0));
+`, "utf-8");
+    try {
+        const start = Date.now();
+        execFileSync(process.execPath, [scriptPath], { cwd: dir, encoding: "utf-8" });
+        const elapsedMs = Date.now() - start;
+        assert.ok(elapsedMs < 4000, `expected timeout around 2s, took ${elapsedMs}ms`);
+        const log = readFileSync(path.join(dir, ".coding-memory", "hook.log"), "utf-8");
+        assert.match(log, /exceeded 2000ms timeout/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 7. An existing (foreign) post-commit hook is chained, not overwritten.
+test("existing post-commit hook is chained, not overwritten", () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const hooksDir = path.join(dir, ".git", "hooks");
+        const foreignHookPath = path.join(hooksDir, "post-commit");
+        const markerFile = path.join(dir, "foreign-hook-ran.log");
+        writeFileSync(foreignHookPath, `#!/bin/sh\necho ran >> "${markerFile}"\n`, "utf-8");
+        execFileSync("chmod", ["+x", foreignHookPath]);
+        const project = uniqueProject("chain");
+        initStackmem(dir, project);
+        const hookContent = readFileSync(foreignHookPath, "utf-8");
+        assert.match(hookContent, /stackmem-managed/);
+        assert.ok(existsSync(path.join(hooksDir, "post-commit.pre-stackmem")), "expected the foreign hook to be preserved as a backup");
+        commit(dir, "feat: verify the foreign hook actually still runs today");
+        assert.ok(existsSync(markerFile), "expected the chained foreign hook to have run");
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 8. Lockfile changes don't create memories (Item 3's diff filtering).
+test("lockfile changes don't create memories", async () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const project = uniqueProject("lockfile");
+        initStackmem(dir, project);
+        commit(dir, "feat: baseline commit before lockfile-only change today");
+        commit(dir, "chore: update lockfile with an embedded todo marker test", { "package-lock.json": '{"name":"x"}\n// TODO: this should be ignored since it is a lockfile\n' });
+        const memories = await fetchMemories(project);
+        assert.ok(!memories.some((m) => m.content.includes("TODO")), `expected no TODO memory from the lockfile diff, got: ${JSON.stringify(memories)}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// 9. cm uninstall restores the chained (foreign) hook, not just deletes it.
+test("cm uninstall restores a chained foreign hook", () => {
+    const dir = makeTempRepo();
+    try {
+        gitInit(dir);
+        const hooksDir = path.join(dir, ".git", "hooks");
+        const foreignHookPath = path.join(hooksDir, "post-commit");
+        const originalContent = "#!/bin/sh\necho original-foreign-hook\n";
+        writeFileSync(foreignHookPath, originalContent, "utf-8");
+        execFileSync("chmod", ["+x", foreignHookPath]);
+        const project = uniqueProject("uninstall-chain");
+        initStackmem(dir, project);
+        assert.match(readFileSync(foreignHookPath, "utf-8"), /stackmem-managed/);
+        const fakeHome = mkdtempSync(path.join(tmpdir(), "stackmem-hooktest-home-"));
+        writeFileSync(path.join(fakeHome, ".claude.json"), JSON.stringify({ mcpServers: { stackmem: {} } }), "utf-8");
+        execFileSync(process.execPath, [CLI_PATH, "uninstall", project, "."], {
+            cwd: dir,
+            env: { ...process.env, HOME: fakeHome },
+        });
+        assert.equal(readFileSync(foreignHookPath, "utf-8"), originalContent);
+        assert.ok(!existsSync(path.join(hooksDir, "post-commit.pre-stackmem")), "expected the backup file to be cleaned up after restoring");
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});

package/dist/tests/scoring.test.js

@@ -0,0 +1,86 @@
+// Unit tests for the hybrid scoring functions in src/scoring.ts. Pure
+// functions only — no network, no Supabase — using Node's built-in test
+// runner (no Jest). Run with `npm test`.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { containmentScore, containsNegationWord, decideSaveAction, computeDecayScore, extractEntities, hybridScore, ngramOverlap, redactSecrets, } from "../scoring.js";
+// 1. containment(a,b) returns 1.0 for identical strings.
+test("containmentScore returns 1.0 for identical strings", () => {
+    const entities = extractEntities("implement stripe webhook signature verification");
+    assert.equal(containmentScore(entities, entities), 1);
+});
+// 2. containment(a,b) returns 0.0 for disjoint strings.
+test("containmentScore returns 0.0 for entity-disjoint strings", () => {
+    const a = extractEntities("implement stripe webhook signature verification");
+    const b = extractEntities("migrate postgres database connection pooling");
+    assert.equal(containmentScore(a, b), 0);
+});
+// 3. trigramJaccard (ngramOverlap) returns a value between 0 and 1.
+test("ngramOverlap (character-trigram Jaccard) returns a value between 0 and 1", () => {
+    const overlapping = ngramOverlap("hello world", "hello there");
+    const identical = ngramOverlap("hello world", "hello world");
+    const disjoint = ngramOverlap("abc", "xyz123qwerty");
+    for (const score of [overlapping, identical, disjoint]) {
+        assert.ok(score >= 0 && score <= 1, `expected ${score} to be within [0, 1]`);
+    }
+    assert.equal(identical, 1);
+});
+// 4. hybridScore = 0.7*containment + 0.3*trigram.
+test("hybridScore combines containment and trigram overlap with 0.7/0.3 weights", () => {
+    const a = "implement stripe webhook signature verification logic";
+    const b = "add stripe webhook handler with signature checks";
+    const containment = containmentScore(extractEntities(a), extractEntities(b));
+    const trigram = ngramOverlap(a, b);
+    const expected = containment * 0.7 + trigram * 0.3;
+    assert.ok(Math.abs(hybridScore(a, b) - expected) < 1e-9);
+});
+// 5. isDuplicate (decideSaveAction's "duplicate" branch) fires when
+// hybridScore exceeds the 0.85 threshold.
+test('decideSaveAction returns "duplicate" when content scores above 0.85 against an existing memory', () => {
+    const existing = [{ id: "mem-1", content: "implement stripe webhook signature verification logic" }];
+    const decision = decideSaveAction("implement stripe webhook signature verification logic", existing);
+    assert.equal(decision.action, "duplicate");
+});
+// 6. isContradiction: negation-word detection, and decideSaveAction's
+// "superseded" branch when a negation word pairs with enough overlap.
+test("containsNegationWord detects negation/contradiction language", () => {
+    assert.equal(containsNegationWord("we switched from REST to GraphQL"), true);
+    assert.equal(containsNegationWord("no longer using the old queue"), true);
+    assert.equal(containsNegationWord("a totally unrelated sentence about cats"), false);
+});
+test('decideSaveAction returns "superseded" when new content contradicts an existing memory', () => {
+    const existing = [{ id: "mem-1", content: "use rest api for payment webhook processing" }];
+    const decision = decideSaveAction("we switched from rest api to graphql for payment webhook processing", existing);
+    assert.equal(decision.action, "superseded");
+});
+// 7. computeDecayScore returns a higher score for more recently created
+// memories (same access count).
+test("computeDecayScore returns a higher score for more recently created memories", () => {
+    const recent = computeDecayScore(new Date(Date.now() - 1000), 0);
+    const old = computeDecayScore(new Date(Date.now() - 30 * 24 * 60 * 60 * 1000), 0);
+    assert.ok(recent > old);
+});
+// 8. computeDecayScore returns a higher score for more frequently
+// accessed memories (same creation time).
+test("computeDecayScore returns a higher score for more frequently accessed memories", () => {
+    const createdAt = new Date(Date.now() - 5 * 24 * 60 * 60 * 1000);
+    const lowAccess = computeDecayScore(createdAt, 0);
+    const highAccess = computeDecayScore(createdAt, 50);
+    assert.ok(highAccess > lowAccess);
+});
+// 9. Pinned memories always get score 999, regardless of age or access
+// count.
+test("computeDecayScore returns 999 for pinned memories regardless of age or access count", () => {
+    assert.equal(computeDecayScore(new Date(0), 0, true), 999);
+    assert.equal(computeDecayScore(new Date(), 10_000, true), 999);
+    assert.equal(computeDecayScore(new Date(Date.now() - 365 * 24 * 60 * 60 * 1000), 0, true), 999);
+});
+// 10. redactSecrets catches all 5 documented pattern types.
+test("redactSecrets catches AWS keys, API keys, bearer tokens, private keys, and .env lines", () => {
+    assert.doesNotMatch(redactSecrets("deployed with AKIAABCDEFGHIJ123456 in prod"), /AKIA[0-9A-Z]{16}/);
+    assert.match(redactSecrets("deployed with AKIAABCDEFGHIJ123456 in prod"), /\[REDACTED\]/);
+    assert.match(redactSecrets("api_key: abcdefghijklmnopqrstuvwxyz1234567890"), /\[REDACTED\]/);
+    assert.match(redactSecrets("Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.payload.signature"), /\[REDACTED\]/);
+    assert.match(redactSecrets("-----BEGIN RSA PRIVATE KEY-----\nMIIBogIBAAJ...\n-----END RSA PRIVATE KEY-----"), /\[REDACTED\]/);
+    assert.match(redactSecrets("DATABASE_URL=postgres://user:pass@host:5432/db"), /\[REDACTED\]/);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackmem",
-  "version": "1.0.26",
+  "version": "1.0.27",
   "description": "",
   "main": "index.js",
   "type": "module",