superlocalmemory 2.8.5 → 3.0.0

package/bin/aider-smart

@@ -1,72 +0,0 @@
-#!/bin/bash
-# aider-smart - Aider with SuperLocalMemory context injection
-#
-# Copyright (c) 2026 Varun Pratap Bhardwaj
-# Licensed under MIT License
-#
-# Automatically injects relevant project context from SuperLocalMemory
-# when launching Aider CLI for AI-assisted coding.
-
-set -e
-
-SLM_DIR="${HOME}/.claude-memory"
-
-# Check if Aider is installed
-if ! command -v aider &> /dev/null; then
-    echo "Error: Aider not found. Install: pip install aider-chat"
-    exit 1
-fi
-
-# Check if SuperLocalMemory is installed
-if [ ! -d "$SLM_DIR" ]; then
-    echo "Error: SuperLocalMemory V2 not installed"
-    echo "Install from: https://github.com/varun369/SuperLocalMemoryV2"
-    exit 1
-fi
-
-# Generate context from current project
-project=$(basename "$PWD")
-CONTEXT_FILE="/tmp/slm-aider-context-$$.txt"
-
-echo "🧠 Gathering project context from SuperLocalMemory..."
-echo ""
-
-# Get recent project memories
-if command -v slm &> /dev/null; then
-    # Use slm command if available
-    slm context > "$CONTEXT_FILE" 2>/dev/null || {
-        "$SLM_DIR/bin/superlocalmemoryv2-recall" "$project" --limit 5 > "$CONTEXT_FILE" 2>/dev/null || true
-    }
-else
-    # Fallback to direct command
-    "$SLM_DIR/bin/superlocalmemoryv2-recall" "$project" --limit 5 > "$CONTEXT_FILE" 2>/dev/null || true
-fi
-
-# Get coding patterns if available
-if [ -f "$SLM_DIR/pattern_learner.py" ]; then
-    echo "" >> "$CONTEXT_FILE"
-    echo "## Your Coding Patterns:" >> "$CONTEXT_FILE"
-    python3 "$SLM_DIR/pattern_learner.py" context 0.6 >> "$CONTEXT_FILE" 2>/dev/null || true
-fi
-
-# Launch Aider with context
-if [ -s "$CONTEXT_FILE" ] && [ "$(wc -l < "$CONTEXT_FILE")" -gt 1 ]; then
-    echo "✓ Context loaded from SuperLocalMemory"
-    echo ""
-
-    # Pass context to Aider
-    aider \
-        --read "$CONTEXT_FILE" \
-        --message "Context from SuperLocalMemory V2 loaded. I have access to your project's memory and coding patterns." \
-        "$@"
-else
-    echo "⚠ No context found for project: $project"
-    echo "  Use: slm remember \"project info\" to save context"
-    echo ""
-
-    # Launch Aider without context
-    aider "$@"
-fi
-
-# Cleanup
-rm -f "$CONTEXT_FILE"

package/bin/superlocalmemoryv2-learning

@@ -1,4 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Learning System Status
-SLM_DIR="${HOME}/.claude-memory"
-exec "${SLM_DIR}/bin/slm" learning "${@:-status}"

package/bin/superlocalmemoryv2-list

@@ -1,3 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - List Recent Memories Command Wrapper
-node ~/.claude-memory/hooks/memory-list-skill.js "$@"

package/bin/superlocalmemoryv2-patterns

@@ -1,4 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Show Learned Patterns
-SLM_DIR="${HOME}/.claude-memory"
-exec "${SLM_DIR}/bin/slm" patterns list "$@"

package/bin/superlocalmemoryv2-profile

@@ -1,3 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Profile Management Command Wrapper
-node ~/.claude-memory/hooks/memory-profile-skill.js "$@"

package/bin/superlocalmemoryv2-recall

@@ -1,3 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Recall (Search Memories) Command Wrapper
-node ~/.claude-memory/hooks/memory-recall-skill.js "$@"

package/bin/superlocalmemoryv2-remember

@@ -1,3 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Remember (Save Memory) Command Wrapper
-node ~/.claude-memory/hooks/memory-remember-skill.js "$@"

package/bin/superlocalmemoryv2-reset

@@ -1,3 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Reset Command Wrapper
-node ~/.claude-memory/hooks/memory-reset-skill.js "$@"

package/bin/superlocalmemoryv2-status

@@ -1,3 +0,0 @@
-#!/bin/bash
-# SuperLocalMemory V2 - Quick Status Check
-node ~/.claude-memory/hooks/memory-reset-skill.js status

package/configs/chatgpt-desktop-mcp.json

@@ -1,16 +0,0 @@
-{
-  "_README": "ChatGPT Integration — SuperLocalMemory V2 as ChatGPT Connector",
-  "_requires": "ChatGPT Pro/Plus/Business/Enterprise with Developer Mode enabled",
-  "_tools": "search(query) and fetch(id) — required by OpenAI MCP spec for Connectors",
-  "_setup": {
-    "step1": "Start MCP server: slm serve --port 8417",
-    "step2": "Expose via tunnel: ngrok http 8417",
-    "step3": "Copy the HTTPS URL from ngrok (e.g. https://abc123.ngrok.app)",
-    "step4": "In ChatGPT: Settings → Connectors → Advanced → Enable Developer Mode",
-    "step5": "Create new Connector → paste URL with /sse/ suffix (e.g. https://abc123.ngrok.app/sse/)",
-    "step6": "Name it 'SuperLocalMemory' and click Create",
-    "step7": "In any chat, click + → More → select SuperLocalMemory connector"
-  },
-  "_alternative_transport": "For Streamable HTTP (recommended): slm serve --transport streamable-http --port 8417",
-  "_note": "100% local — your MCP server runs on YOUR machine. The tunnel just makes it reachable by ChatGPT servers. All data stays in ~/.claude-memory/memory.db"
-}

package/configs/cursor-mcp.json

@@ -1,15 +0,0 @@
-{
-  "mcpServers": {
-    "superlocalmemory-v2": {
-      "command": "python3",
-      "args": [
-        "{{INSTALL_DIR}}/mcp_server.py"
-      ],
-      "cwd": "{{INSTALL_DIR}}",
-      "env": {
-        "PYTHONPATH": "{{INSTALL_DIR}}"
-      },
-      "description": "SuperLocalMemory V2 - Local memory system with knowledge graphs and pattern learning"
-    }
-  }
-}

package/docs/SECURITY-QUICK-REFERENCE.md

@@ -1,214 +0,0 @@
-# Security Quick Reference — For Developers
-
-**Last Updated:** March 4, 2026
-
-## TL;DR — Safe Coding Patterns
-
-### ✅ DO THIS (Safe)
-
-```javascript
-// Safe: Use textContent for plain text
-element.textContent = userContent;
-
-// Safe: Use escapeHtml() before DOM insertion
-element.innerHTML = escapeHtml(userContent);
-
-// Safe: Create elements programmatically
-const div = document.createElement('div');
-div.textContent = userContent;
-parent.appendChild(div);
-```
-
-### ❌ DON'T DO THIS (Dangerous)
-
-```javascript
-// DANGEROUS: Direct assignment with user content
-element.innerHTML = userContent;  // XSS VULNERABLE
-
-// DANGEROUS: Using code evaluation with user input
-// Never use eval, Function constructor, or similar
-
-// DANGEROUS: Inline event handlers with user content
-element.setAttribute('onclick', userCode);  // XSS VULNERABLE
-```
-
-## Security Checklist — Before Committing
-
-- [ ] No direct innerHTML assignments without escapeHtml()
-- [ ] All user content either uses textContent or is escaped
-- [ ] No code evaluation with user input
-- [ ] No inline event handlers with dynamic content
-- [ ] All API endpoints return explicit Content-Type
-- [ ] SQL queries use parameterized statements (never string concatenation)
-- [ ] No secrets in code or config files
-- [ ] Run security tests: pytest tests/test_security_headers.py -v
-
-## Common Patterns
-
-### Rendering User-Generated Content
-
-**Pattern 1: Plain Text Only**
-```javascript
-const contentDiv = document.getElementById('memory-content');
-contentDiv.textContent = memory.content;  // Automatically safe
-```
-
-**Pattern 2: Mixed Content (HTML Structure + User Text)**
-```javascript
-const html = `
-  <div class="memory-card">
-    <h3>${escapeHtml(memory.title)}</h3>
-    <p>${escapeHtml(memory.content)}</p>
-    <span class="badge">${escapeHtml(memory.category)}</span>
-  </div>
-`;
-container.innerHTML = html;
-```
-
-**Pattern 3: Building DOM Programmatically (Most Secure)**
-```javascript
-const card = document.createElement('div');
-card.className = 'memory-card';
-
-const title = document.createElement('h3');
-title.textContent = memory.title;
-
-const content = document.createElement('p');
-content.textContent = memory.content;
-
-card.appendChild(title);
-card.appendChild(content);
-container.appendChild(card);
-```
-
-### FastAPI Routes
-
-**Safe Pattern:**
-```python
-@router.get("/api/memories")
-async def get_memories():
-    # FastAPI automatically sets Content-Type: application/json
-    return {
-        "memories": memories,  # User content here is safe in JSON
-        "total": len(memories)
-    }
-```
-
-**SQL Queries:**
-```python
-# SAFE: Parameterized query
-cursor.execute("SELECT * FROM memories WHERE id = ?", (memory_id,))
-
-# DANGEROUS: String concatenation (SQL injection)
-# Never use f-strings or concatenation for SQL queries
-```
-
-## Testing XSS Protection
-
-```python
-# Test that XSS payloads are handled safely
-def test_xss_payload():
-    payload = "<script>alert('xss')</script>"
-
-    # This should be safe when:
-    # 1. Returned as JSON with Content-Type: application/json
-    # 2. Rendered with escapeHtml() on client
-    # 3. Protected by CSP headers
-
-    response = client.get(f"/api/memory?content={payload}")
-    assert response.headers["Content-Type"] == "application/json"
-    assert response.headers["X-Content-Type-Options"] == "nosniff"
-```
-
-## Security Headers Reference
-
-All responses include these headers automatically via SecurityHeadersMiddleware:
-
-- X-Content-Type-Options: nosniff
-- X-Frame-Options: DENY
-- X-XSS-Protection: 1; mode=block
-- Content-Security-Policy: (comprehensive policy)
-- Referrer-Policy: strict-origin-when-cross-origin
-- Cache-Control: no-store (API endpoints only)
-
-**Don't override these headers** unless you have a specific security reason and understand the implications.
-
-## CORS Configuration
-
-Current allowed origins:
-- http://localhost:8765
-- http://127.0.0.1:8765
-- http://localhost:8417
-- http://127.0.0.1:8417
-
-**To add a new origin:**
-1. Add to the allow_origins list in ui_server.py
-2. Document why it's needed
-3. Never use wildcard * in production
-
-## When to Update Security
-
-### Add New Route
-- [ ] Verify return type has explicit Content-Type
-- [ ] Test with XSS payloads
-- [ ] Add test case to test_security_headers.py
-
-### Add New JavaScript
-- [ ] Use textContent for plain text
-- [ ] Use escapeHtml() for mixed content
-- [ ] Test rendering with XSS payloads
-
-### Modify Security Headers
-- [ ] Document reason in commit message
-- [ ] Update SECURITY.md
-- [ ] Run full security test suite
-- [ ] Consider security implications
-
-## Resources
-
-- **Full Security Policy:** See SECURITY.md
-- **Security Enhancement Details:** .backup/security-enhancement-2026-03-04.md
-- **Security Tests:** tests/test_security_headers.py
-- **Middleware Source:** security_middleware.py
-- **Client-Side Escaping:** ui/app.js (escapeHtml function)
-
-## Quick Test Commands
-
-```bash
-# Run security tests only
-pytest tests/test_security_headers.py -v
-
-# Run all tests
-pytest tests/ -x -q
-
-# Manual verification (browser)
-python3 ui_server.py
-# Open http://localhost:8765
-# DevTools → Network → Check response headers
-```
-
-## Red Flags — Stop and Review
-
-If you see any of these patterns, STOP and review:
-
-- innerHTML with user content (without escaping)
-- Code evaluation functions anywhere
-- String concatenation in SQL queries
-- CORS with wildcard *
-- User input in event handler attributes
-- Disabling CSP or security headers
-- Secrets or API keys in code
-
-## When in Doubt
-
-**Ask these questions:**
-1. Could a user inject a script tag here?
-2. Is this content escaped before rendering?
-3. Does this SQL query use parameters?
-4. Could this header configuration weaken security?
-
-**If unsure:** Use the safest pattern (textContent or programmatic DOM creation).
-
----
-
-**Remember:** Defense in depth. We have multiple layers (headers, CSP, escaping). Use all of them.

package/hooks/memory-list-skill.js

@@ -1,139 +0,0 @@
-#!/usr/bin/env node
-/**
- * Memory List CLI Skill
- * List recent memories with sorting and filtering
- */
-
-const { execFile } = require('child_process');
-const { promisify } = require('util');
-const path = require('path');
-
-const execFileAsync = promisify(execFile);
-
-async function memoryListSkill() {
-  const memoryScript = path.join(process.env.HOME, '.claude-memory', 'memory_store_v2.py');
-  const args = process.argv.slice(2);
-
-  // Show help if --help
-  if (args.includes('--help') || args.includes('-h')) {
-    console.log(`
-╔══════════════════════════════════════════════════════════╗
-║                                                          ║
-║     SuperLocalMemory V2 - List Recent Memories           ║
-║                                                          ║
-╚══════════════════════════════════════════════════════════╝
-
-Display recent memories with optional sorting and limits.
-Quick overview of what's stored in your memory database.
-
-Usage: memory-list [options]
-
-Options:
-  --limit <n>            Number of memories to show (default: 20)
-  --sort <field>         Sort by: recent, accessed, importance
-                         • recent: Latest created first (default)
-                         • accessed: Most recently accessed
-                         • importance: Highest importance first
-  --full                 Show complete content without truncation
-
-Examples:
-  memory-list
-
-  memory-list --limit 50
-
-  memory-list --sort importance
-
-  memory-list --limit 10 --sort accessed --full
-
-Output Format:
-  • ID, Content (smart truncated), Tags, Importance
-  • Creation timestamp
-  • Access count and last accessed time
-
-Notes:
-  • Default shows last 20 memories
-  • Smart truncation: full content if <5000 chars, preview if ≥5000 chars
-  • Use --full flag to always show complete content
-  • Sort by 'accessed' to find frequently used memories
-`);
-    return;
-  }
-
-  // Parse options
-  let limit = 20;
-  let sortBy = 'recent';
-  let showFull = false;
-
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-
-    if (arg === '--limit' && i + 1 < args.length) {
-      const parsedLimit = parseInt(args[i + 1]);
-      if (parsedLimit > 0 && parsedLimit <= 1000) {
-        limit = parsedLimit;
-      } else {
-        console.error('❌ ERROR: Limit must be between 1-1000');
-        return;
-      }
-      i++;
-    } else if (arg === '--sort' && i + 1 < args.length) {
-      const validSorts = ['recent', 'accessed', 'importance'];
-      if (validSorts.includes(args[i + 1])) {
-        sortBy = args[i + 1];
-      } else {
-        console.error(`❌ ERROR: Sort must be one of: ${validSorts.join(', ')}`);
-        return;
-      }
-      i++;
-    } else if (arg === '--full') {
-      showFull = true;
-    }
-  }
-
-  // Build Python command based on sort type
-  // Note: V1 store only supports 'recent' and 'list' commands without sort flags
-  let pythonArgs = [];
-
-  if (sortBy === 'recent' || sortBy === 'accessed') {
-    pythonArgs = ['recent', limit.toString()];
-  } else {
-    // Default to list for importance or other sorts
-    pythonArgs = ['list', limit.toString()];
-  }
-
-  // Add --full flag if requested
-  if (showFull) {
-    pythonArgs.push('--full');
-  }
-
-  try {
-    const { stdout, stderr } = await execFileAsync('python3', [memoryScript, ...pythonArgs]);
-
-    if (stderr) {
-      console.error('⚠️  Warning:', stderr);
-    }
-
-    console.log(`
-╔══════════════════════════════════════════════════════════╗
-║     Recent Memories (${sortBy} | limit: ${limit})
-╚══════════════════════════════════════════════════════════╝
-`);
-
-    console.log(stdout);
-
-    // Show helpful next steps
-    console.log(`
-Next steps:
-  • Use \`memory-recall <query>\` to search memories
-  • Use \`memory-remember <content>\` to add new memories
-  • Use \`memory-list --sort <field>\` to change sort order
-`);
-
-  } catch (error) {
-    console.error('❌ Error listing memories:', error.message);
-    if (error.stdout) console.log(error.stdout);
-    if (error.stderr) console.error(error.stderr);
-  }
-}
-
-memoryListSkill();