superlocalmemory 2.8.5 → 3.0.0

package/ide/integrations/llamaindex/tests/test_security.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 SuperLocalMemory (superlocalmemory.com)
+"""SuperLocalMemory V2 - LlamaIndex Chat Store Security Tests
+
+Security-focused tests: SQL injection, XSS, oversized payloads, null bytes,
+and other adversarial inputs that a production chat store must handle safely.
+"""
+import os
+import sys
+import tempfile
+
+import pytest
+
+# Ensure the SLM source tree is importable for tests
+_SLM_SRC = os.path.join(
+    os.path.dirname(__file__), os.pardir, os.pardir, os.pardir, "src"
+)
+_SLM_SRC = os.path.abspath(_SLM_SRC)
+if _SLM_SRC not in sys.path:
+    sys.path.insert(0, _SLM_SRC)
+
+from llama_index.core.base.llms.types import ChatMessage, MessageRole
+from llama_index.storage.chat_store.superlocalmemory import SuperLocalMemoryChatStore
+
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def tmp_db():
+    with tempfile.TemporaryDirectory() as d:
+        yield os.path.join(d, "test_security.db")
+
+
+@pytest.fixture
+def store(tmp_db):
+    return SuperLocalMemoryChatStore(db_path=tmp_db)
+
+
+# ---------------------------------------------------------------------------
+# SQL Injection Tests
+# ---------------------------------------------------------------------------
+
+
+class TestSQLInjection:
+    """Verify that SQL injection attempts in keys and content are harmless."""
+
+    SQL_PAYLOADS = [
+        "'; DROP TABLE memories; --",
+        "' OR '1'='1",
+        "'; DELETE FROM memories WHERE '1'='1",
+        "1; SELECT * FROM memories --",
+        "Robert'); DROP TABLE memories;--",
+        "' UNION SELECT * FROM memories --",
+    ]
+
+    def test_sql_injection_in_key(self, store):
+        """SQL injection attempts in the session key must not corrupt the store."""
+        for payload in self.SQL_PAYLOADS:
+            msg = ChatMessage(role=MessageRole.USER, content="safe content")
+            store.add_message(payload, msg)
+
+            # The store should still function — retrieve the message back
+            msgs = store.get_messages(payload)
+            assert len(msgs) == 1
+            assert msgs[0].content == "safe content"
+
+            # Clean up
+            store.delete_messages(payload)
+
+    def test_sql_injection_in_content(self, store):
+        """SQL injection attempts in message content must be stored literally."""
+        for payload in self.SQL_PAYLOADS:
+            msg = ChatMessage(role=MessageRole.USER, content=payload)
+            store.add_message("safe-key", msg)
+
+        msgs = store.get_messages("safe-key")
+        assert len(msgs) == len(self.SQL_PAYLOADS)
+
+        # Verify content is stored literally, not executed
+        for i, payload in enumerate(self.SQL_PAYLOADS):
+            assert msgs[i].content == payload
+
+        # Clean up
+        store.delete_messages("safe-key")
+
+
+# ---------------------------------------------------------------------------
+# XSS Tests
+# ---------------------------------------------------------------------------
+
+
+class TestXSS:
+    """Verify that XSS payloads in content are stored literally (not executed)."""
+
+    XSS_PAYLOADS = [
+        "<script>alert('xss')</script>",
+        '<img src=x onerror=alert(1)>',
+        "javascript:alert(document.cookie)",
+        "<svg/onload=alert('xss')>",
+        '"><script>alert(String.fromCharCode(88,83,83))</script>',
+    ]
+
+    def test_xss_in_content(self, store):
+        """XSS payloads must be stored and retrieved as literal strings."""
+        for payload in self.XSS_PAYLOADS:
+            msg = ChatMessage(role=MessageRole.USER, content=payload)
+            store.add_message("xss-key", msg)
+
+        msgs = store.get_messages("xss-key")
+        assert len(msgs) == len(self.XSS_PAYLOADS)
+
+        for i, payload in enumerate(self.XSS_PAYLOADS):
+            assert msgs[i].content == payload
+
+        store.delete_messages("xss-key")
+
+
+# ---------------------------------------------------------------------------
+# Oversized Content Tests
+# ---------------------------------------------------------------------------
+
+
+class TestOversizedContent:
+    """Verify that oversized payloads are handled without crashing."""
+
+    def test_oversized_content_1mb(self, store):
+        """A 1MB message should be rejected by MemoryStoreV2's validation."""
+        huge = "A" * 1_000_001  # Just over the 1MB limit
+        msg = ChatMessage(role=MessageRole.USER, content=huge)
+
+        # MemoryStoreV2 raises ValueError for content > 1MB
+        with pytest.raises((ValueError, Exception)):
+            store.add_message("huge-key", msg)
+
+    def test_large_but_valid_content(self, store):
+        """A 500KB message should be stored successfully (under 1MB limit)."""
+        large = "B" * 500_000
+        msg = ChatMessage(role=MessageRole.USER, content=large)
+        store.add_message("large-key", msg)
+
+        msgs = store.get_messages("large-key")
+        assert len(msgs) == 1
+        assert len(msgs[0].content) == 500_000
+
+        store.delete_messages("large-key")
+
+
+# ---------------------------------------------------------------------------
+# Edge Case Key Tests
+# ---------------------------------------------------------------------------
+
+
+class TestEdgeCaseKeys:
+    """Verify safe handling of unusual session key values."""
+
+    def test_empty_key(self, store):
+        """An empty string key should still work (tags allow empty strings)."""
+        msg = ChatMessage(role=MessageRole.USER, content="empty key test")
+        store.add_message("", msg)
+
+        msgs = store.get_messages("")
+        assert len(msgs) == 1
+        assert msgs[0].content == "empty key test"
+
+        store.delete_messages("")
+
+    def test_null_bytes_in_key(self, store):
+        """Null bytes in a key should be handled without crash."""
+        key_with_null = "key\x00with\x00nulls"
+        msg = ChatMessage(role=MessageRole.USER, content="null byte key")
+        store.add_message(key_with_null, msg)
+
+        msgs = store.get_messages(key_with_null)
+        assert len(msgs) == 1
+        assert msgs[0].content == "null byte key"
+
+        store.delete_messages(key_with_null)
+
+    def test_very_long_key(self, store):
+        """A very long key (1000 chars) should work."""
+        long_key = "k" * 1000
+        msg = ChatMessage(role=MessageRole.USER, content="long key test")
+        store.add_message(long_key, msg)
+
+        msgs = store.get_messages(long_key)
+        assert len(msgs) == 1
+
+        store.delete_messages(long_key)
+
+    def test_special_characters_in_key(self, store):
+        """Keys with special characters should work."""
+        special_keys = [
+            "user@example.com",
+            "path/to/session",
+            "key with spaces",
+            "key-with-dashes_and_underscores",
+            "unicode-key",
+        ]
+        for key in special_keys:
+            store.add_message(
+                key, ChatMessage(role=MessageRole.USER, content=f"test {key}")
+            )
+
+        for key in special_keys:
+            msgs = store.get_messages(key)
+            assert len(msgs) == 1, f"Failed for key: {key}"
+
+        # Verify all keys are discoverable
+        all_keys = store.get_keys()
+        for key in special_keys:
+            assert key in all_keys, f"Key '{key}' not found in get_keys()"
+
+        for key in special_keys:
+            store.delete_messages(key)
+
+
+# ---------------------------------------------------------------------------
+# Null / None Content Tests
+# ---------------------------------------------------------------------------
+
+
+class TestNullContent:
+    """Verify that null bytes and None-like content are handled safely."""
+
+    def test_null_bytes_in_content(self, store):
+        """Null bytes in content should be stored and retrieved literally."""
+        content_with_null = "before\x00after"
+        msg = ChatMessage(role=MessageRole.USER, content=content_with_null)
+        store.add_message("null-content-key", msg)
+
+        msgs = store.get_messages("null-content-key")
+        assert len(msgs) == 1
+        # The content may or may not preserve null bytes depending on SQLite/JSON
+        # The key requirement is that it doesn't crash
+        assert msgs[0].content is not None
+
+        store.delete_messages("null-content-key")

package/{skills → ide/skills}/slm-build-graph/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-build-graph
 description: Build or rebuild the knowledge graph from existing memories using TF-IDF entity extraction and Leiden clustering. Use when search results seem poor, after bulk imports, or to optimize performance. Automatically discovers relationships between memories and creates topic clusters.
-version: "2.1.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2 installed at ~/.claude-memory/, optional dependencies: python-igraph, leidenalg"
+compatibility: "Requires SuperLocalMemory V3 installed at ~/.superlocalmemory/, optional dependencies: python-igraph, leidenalg"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: Build Knowledge Graph
@@ -315,7 +315,7 @@ slm build-graph --verbose
 slm build-graph  # No --clustering flag
 
 # Check disk space
-df -h ~/.claude-memory/
+df -h ~/.superlocalmemory/
 ```
 
 ### "Edges seem wrong"
@@ -416,8 +416,8 @@ Each profile has separate graph
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/{skills → ide/skills}/slm-list-recent/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-list-recent
 description: List most recent memories in chronological order. Use when the user wants to see what was recently saved, review recent conversations, check what they worked on today, or browse memory history. Shows memories sorted by creation time (newest first).
-version: "2.1.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2 installed at ~/.claude-memory/"
+compatibility: "Requires SuperLocalMemory V3 installed at ~/.superlocalmemory/"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: List Recent
@@ -341,8 +341,8 @@ date
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/{skills → ide/skills}/slm-recall/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-recall
 description: Search and retrieve memories using semantic similarity, knowledge graph relationships, and full-text search. Use when the user asks to recall information, search memories, find past decisions, or query stored knowledge. Returns ranked results with relevance scores.
-version: "2.1.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2 installed at ~/.claude-memory/"
+compatibility: "Requires SuperLocalMemory V3 installed at ~/.superlocalmemory/"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: Recall
@@ -319,8 +319,8 @@ slm recall "query" --format csv
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/{skills → ide/skills}/slm-remember/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-remember
 description: Save content to SuperLocalMemory with intelligent indexing and knowledge graph integration. Use when the user wants to remember information, save context, store coding decisions, or persist knowledge for future sessions. Automatically indexes, graphs, and learns patterns.
-version: "2.1.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2 installed at ~/.claude-memory/"
+compatibility: "Requires SuperLocalMemory V3 installed at ~/.superlocalmemory/"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: Remember
@@ -88,7 +88,7 @@ Next steps:
 
 ## What Happens Behind the Scenes
 
-1. **Content Storage:** Saved to SQLite (`~/.claude-memory/memory.db`)
+1. **Content Storage:** Saved to SQLite (`~/.superlocalmemory/memory.db`)
 2. **Semantic Indexing:** TF-IDF vectors generated for similarity search
 3. **Knowledge Graph:** Entities extracted and nodes/edges created
 4. **Pattern Learning:** Analyzes content for coding preferences (frameworks, style, testing)
@@ -187,8 +187,8 @@ slm remember "Commit: $commit_msg (${commit_hash:0:7})" \
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/{skills → ide/skills}/slm-show-patterns/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-show-patterns
 description: Show what SuperLocalMemory has learned about your preferences, workflow patterns, and project context. Use when the user asks "what have you learned about me?" or wants to see their coding identity patterns. Shows tech preferences, workflow sequences, and engagement health.
-version: "2.7.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2.7+ with learning features"
+compatibility: "Requires SuperLocalMemory V3 with learning features"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: Show Patterns
@@ -60,7 +60,7 @@ $ slm learning status
 
 **Output:**
 ```
-SuperLocalMemory v2.7 -- Learning System Status
+SuperLocalMemory V3 -- Learning System Status
 ==================================================
 LightGBM:  installed (4.5.0)
 SciPy:     installed (1.14.1)
@@ -196,7 +196,7 @@ slm engagement
 
 ## Requirements
 
-- SuperLocalMemory V2.7+
+- SuperLocalMemory V3.7+
 - Optional: `lightgbm` and `scipy` for ML-powered ranking
 - Works without optional deps (uses rule-based ranking as fallback)
 
@@ -217,8 +217,8 @@ slm engagement
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/{skills → ide/skills}/slm-status/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-status
 description: Check SuperLocalMemory system status, health, and statistics. Use when the user wants to know memory count, graph stats, patterns learned, database health, or system diagnostics. Shows comprehensive system health dashboard.
-version: "2.1.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2 installed at ~/.claude-memory/"
+compatibility: "Requires SuperLocalMemory V3 installed at ~/.superlocalmemory/"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: Status
@@ -30,7 +30,7 @@ $ slm status
 **Output:**
 ```
 ╔══════════════════════════════════════════════════════╗
-║  SuperLocalMemory V2 - System Status                ║
+║  SuperLocalMemory V3 - System Status                ║
 ╚══════════════════════════════════════════════════════╝
 
 📊 Memory Statistics
@@ -63,7 +63,7 @@ $ slm status
    Last Used:             2026-02-07 14:23
 
 ⚙️  System Info
-   Install Path:          ~/.claude-memory
+   Install Path:          ~/.superlocalmemory
    Database:              memory.db
    Python Version:        3.11.7
    SQLite Version:        3.43.2
@@ -264,7 +264,7 @@ slm status --format json > status.json
 **Solution:**
 ```bash
 # Check for locks
-lsof ~/.claude-memory/memory.db
+lsof ~/.superlocalmemory/memory.db
 
 # Kill hanging processes
 killall python3
@@ -279,7 +279,7 @@ slm status
 **Solution:**
 ```bash
 # Restore from backup
-cp ~/.claude-memory/backups/memory.db.backup.* ~/.claude-memory/memory.db
+cp ~/.superlocalmemory/backups/memory.db.backup.* ~/.superlocalmemory/memory.db
 
 # Verify
 slm status --check-integrity
@@ -356,8 +356,8 @@ slm build-graph
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/{skills → ide/skills}/slm-switch-profile/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: slm-switch-profile
 description: Switch between memory profiles for context isolation and management. Use when the user wants to change profile context, separate work/personal memories, or manage multiple independent memory spaces. Each profile has its own database, graph, and patterns.
-version: "2.1.0"
+version: "3.0.0"
 license: MIT
-compatibility: "Requires SuperLocalMemory V2 installed at ~/.claude-memory/"
+compatibility: "Requires SuperLocalMemory V3 installed at ~/.superlocalmemory/"
 attribution:
   creator: Varun Pratap Bhardwaj
   role: Solution Architect & Original Creator
-  project: SuperLocalMemory V2
+  project: SuperLocalMemory V3
 ---
 
 # SuperLocalMemory: Switch Profile
@@ -69,7 +69,7 @@ $ slm switch-profile client-acme --create
 🆕 Creating new profile: client-acme
 
 Profile created successfully!
-  Location: ~/.claude-memory/profiles/client-acme/
+  Location: ~/.superlocalmemory/profiles/client-acme/
   Database: memory.db (empty)
   Status: Active
 
@@ -216,7 +216,7 @@ slm import-profile team-shared/work-profile.db --name work
 
 **1. Profile Structure:**
 ```
-~/.claude-memory/
+~/.superlocalmemory/
 ├── memory.db               ← Current active profile (symlink)
 ├── profiles/
 │   ├── default/
@@ -239,7 +239,7 @@ $ slm switch-profile work
 - **Step 4:** Notify user to restart AI tools
 
 **3. AI Tools Read:**
-- MCP server reads `~/.claude-memory/memory.db`
+- MCP server reads `~/.superlocalmemory/memory.db`
 - Symlink automatically points to active profile
 - Transparent to AI tools
 
@@ -280,7 +280,7 @@ slm switch-profile client-a --create
 
 **Backup profile:**
 ```bash
-cp -r ~/.claude-memory/profiles/work ~/.claude-memory/backups/work-2026-02-07
+cp -r ~/.superlocalmemory/profiles/work ~/.superlocalmemory/backups/work-2026-02-07
 ```
 
 **Delete profile:**
@@ -435,8 +435,8 @@ slm list-profiles
 ---
 
 **Created by:** [Varun Pratap Bhardwaj](https://github.com/varun369) (Solution Architect)
-**Project:** SuperLocalMemory V2
+**Project:** SuperLocalMemory V3
 **License:** MIT (see [LICENSE](../../LICENSE))
-**Repository:** https://github.com/varun369/SuperLocalMemoryV2
+**Repository:** https://github.com/qualixar/superlocalmemory
 
 *Open source doesn't mean removing credit. Attribution must be preserved per MIT License terms.*

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "superlocalmemory",
-  "version": "2.8.5",
-  "description": "Your AI Finally Remembers You - Local-first intelligent memory system for AI assistants. Works with Claude, Cursor, Windsurf, VS Code/Copilot, Codex, and 17+ AI tools. 100% local, zero cloud dependencies.",
+  "version": "3.0.0",
+  "description": "Information-geometric agent memory with mathematical guarantees. 4-channel retrieval, Fisher-Rao similarity, zero-LLM mode, EU AI Act compliant. Works with Claude, Cursor, Windsurf, and 17+ AI tools.",
   "keywords": [
     "ai-memory",
     "claude-ai",
@@ -29,17 +29,17 @@
   "author": {
     "name": "Varun Pratap Bhardwaj",
     "email": "admin@superlocalmemory.com",
-    "url": "https://github.com/varun369"
+    "url": "https://varunpratap.com"
   },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/varun369/SuperLocalMemoryV2.git"
+    "url": "https://github.com/qualixar/superlocalmemory.git"
   },
   "homepage": "https://superlocalmemory.com",
-  "mcpName": "io.github.varun369/superlocalmemory",
+  "mcpName": "io.github.qualixar/superlocalmemory",
   "bugs": {
-    "url": "https://github.com/varun369/SuperLocalMemoryV2/issues"
+    "url": "https://github.com/qualixar/superlocalmemory/issues"
   },
   "bin": {
     "slm": "./bin/slm-npm",
@@ -63,26 +63,17 @@
   "files": [
     "bin/",
     "src/",
-    "hooks/",
-    "configs/",
-    "skills/",
-    "completions/",
+    "ide/",
     "scripts/",
-    "mcp_server.py",
-    "install.sh",
-    "install.ps1",
-    "install-skills.sh",
+    "ui/",
+    "docs/",
+    "pyproject.toml",
+    "conftest.py",
     "README.md",
     "LICENSE",
+    "NOTICE",
     "ATTRIBUTION.md",
-    "CHANGELOG.md",
-    "docs/",
-    "requirements.txt",
-    "requirements-core.txt",
-    "requirements-learning.txt",
-    "ui/",
-    "ui_server.py",
-    "api_server.py"
+    "CHANGELOG.md"
   ],
   "preferGlobal": true,
   "funding": {