superlocalmemory 3.4.19 → 3.4.21

package/CHANGELOG.md

@@ -10,6 +10,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [3.4.21] - 2026-04-18
+
+Hardening release — correctness, stability, and security fixes.
+
+### Added
+- `slm benchmark` plus escape-hatch commands (`disable`, `enable`,
+  `clear-cache`, `reconfigure`).
+- One-time upgrade banner on first boot after install.
+
+### Changed
+- Tighter defaults for the interactive installer.
+- Licence: AGPL-3.0-or-later.
+- Node.js prerequisite: ≥ 18.
+
+### Security
+- Hardened redaction, path validation, and token handling per internal
+  audit. No end-user-visible behaviour change.
+
+### Compatibility
+- Fully backward compatible. `atomic_facts` is never modified by any
+  migration. All upgrades are additive.
+
+---
+
 ## [3.4.19] - 2026-04-17
 
 ### Fixed

package/README.md

@@ -3,12 +3,12 @@
 </p>
 
 <h1 align="center">SuperLocalMemory V3.4</h1>
-<p align="center"><strong>Every other AI forgets. Yours won't.</strong><br/><em>Infinite memory for Claude Code, Cursor, Windsurf & 17+ AI tools.</em></p>
-<p align="center"><code>v3.4.11</code> — Install once. Every session remembers the last. Automatically.</p>
-<p align="center"><strong>Backed by 3 peer-reviewed research papers</strong> · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
+<p align="center"><strong>Every other AI forgets. Yours won't.</strong><br/><em>Infinite memory for Claude Code, Cursor, Windsurf, and any MCP-compatible AI client.</em></p>
+<p align="center"><code>v3.4.21</code> — Install once. Every session remembers the last. Automatically.</p>
+<p align="center"><strong>Backed by 3 published research papers</strong> (arXiv preprints + Zenodo-archived) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 
 <p align="center">
-  <code>+16pp vs Mem0 (zero cloud)</code> &nbsp;·&nbsp; <code>85% Open-Domain (best of any system)</code> &nbsp;·&nbsp; <code>EU AI Act Ready</code>
+  <code>+10.6pp vs Mem0 zero-LLM</code> &nbsp;·&nbsp; <code>85% Open-Domain (best zero-LLM score)</code> &nbsp;·&nbsp; <code>EU AI Act Ready</code>
 </p>
 
 <p align="center">
@@ -16,7 +16,7 @@
   <a href="https://pypi.org/project/superlocalmemory/"><img src="https://img.shields.io/pypi/v/superlocalmemory?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"/></a>
   <a href="https://www.npmjs.com/package/superlocalmemory"><img src="https://img.shields.io/npm/v/superlocalmemory?style=for-the-badge&logo=npm&logoColor=white" alt="npm"/></a>
   <a href="https://www.gnu.org/licenses/agpl-3.0"><img src="https://img.shields.io/badge/License-AGPL_v3-blue.svg?style=for-the-badge" alt="AGPL v3"/></a>
-  <a href="#eu-ai-act-compliance"><img src="https://img.shields.io/badge/EU_AI_Act-Compliant-brightgreen?style=for-the-badge" alt="EU AI Act"/></a>
+  <a href="#eu-ai-act-compliance"><img src="https://img.shields.io/badge/EU_AI_Act-Design_Compliant-brightgreen?style=for-the-badge" alt="EU AI Act Design Compliant"/></a>
   <a href="https://superlocalmemory.com"><img src="https://img.shields.io/badge/Web-superlocalmemory.com-ff6b35?style=for-the-badge" alt="Website"/></a>
   <a href="#dual-interface-mcp--cli"><img src="https://img.shields.io/badge/MCP-Native-blue?style=for-the-badge" alt="MCP Native"/></a>
   <a href="#dual-interface-mcp--cli"><img src="https://img.shields.io/badge/CLI-Agent--Native-green?style=for-the-badge" alt="CLI Agent-Native"/></a>
@@ -30,22 +30,25 @@
 
 ## Why SuperLocalMemory?
 
-Every major AI memory system — Mem0, Zep, Letta, EverMemOS — sends your data to cloud LLMs for core operations. That means latency on every query, cost on every interaction, and after **August 2, 2026**, a compliance problem under the EU AI Act.
+Every **hosted** AI memory platform — Mem0 Cloud, Zep Cloud, Letta Cloud, EverMemOS Cloud — sends your data to cloud LLMs by default. Their self-hosted variants exist (Mem0 OpenMemory, Letta self-hosted, Graphiti) but require Docker + a separate graph DB or Ollama config, and most still default to OpenAI until you flip env vars. After **August 2, 2026**, any of those cloud paths becomes a compliance problem under the EU AI Act.
 
-SuperLocalMemory V3 takes a different approach: **mathematics instead of cloud compute.** Three techniques from differential geometry, algebraic topology, and stochastic analysis replace the work that other systems need LLMs to do — similarity scoring, contradiction detection, and lifecycle management. The result is an agent memory that runs entirely on your machine, on CPU, with no API keys, and still outperforms funded alternatives.
+SuperLocalMemory V3 takes a different approach: **mathematics instead of cloud compute.** Three techniques from differential geometry, algebraic topology, and stochastic analysis replace the work that other systems need LLMs to do — similarity scoring, contradiction detection, and lifecycle management. The result is an agent memory that ships local-first out of the box — no Docker, no graph DB, no API keys — on CPU.
 
-**The numbers** (evaluated on [LoCoMo](https://arxiv.org/abs/2402.09714), the standard long-conversation memory benchmark):
+**The numbers** (evaluated on [LoCoMo](https://arxiv.org/abs/2402.09714), the standard long-conversation memory benchmark). Published numbers as of April 2026:
 
-| System | Score | Cloud Required | Open Source | Funding |
-|:-------|:-----:|:--------------:|:-----------:|:-------:|
-| EverMemOS | 92.3% | Yes | No | — |
-| Hindsight | 89.6% | Yes | No | — |
-| **SLM V3 Mode C** | **87.7%** | Optional | **Yes (EL2)** | $0 |
-| Zep v3 | 85.2% | Yes | Deprecated | $35M |
-| **SLM V3 Mode A** | **74.8%** | **No** | **Yes (EL2)** | $0 |
-| Mem0 | 64.2% | Yes | Partial | $24M |
+| System | Score | Config | Cloud LLM required? | Open Source | Source |
+|:-------|:-----:|:-------|:-------------------:|:-----------:|:-------|
+| EverMemOS | 93.05% | Cloud (proprietary) | Yes | Core only | [evermind.ai](https://evermind.ai/) (Feb 2026) |
+| Hindsight (LoComo10) | 92.0% | Cloud | Yes | No | [benchmarks.hindsight.vectorize.io](https://benchmarks.hindsight.vectorize.io) (Apr 2026) |
+| Mem0 (token-efficient) | 91.6% | Hybrid (Cohere/OpenAI) | Yes | Partial | [mem0.ai blog](https://mem0.ai/blog/mem0-the-token-efficient-memory-algorithm) (Apr 16 2026) |
+| **SLM V3 Mode C** | **87.7%** | Local + optional LLM | Optional (Ollama OK) | **Yes (AGPL-3.0)** | In-house, repro script in `docs/benchmarks/` |
+| Zep v3 Cloud | 85.2% | Cloud | Yes | Community deprecated | [getzep.com](https://www.getzep.com/) |
+| **SLM V3 Mode A** | **74.8%** | **Local, CPU-only, zero-LLM** | **No** | **Yes (AGPL-3.0)** | In-house, repro script in `docs/benchmarks/` |
+| Mem0 (zero-retrieval-LLM) | 64.2% | Local baseline | No | Partial | Mem0 paper, zero-LLM row |
 
-Mode A scores **74.8% with zero cloud dependency** — outperforming Mem0 by 16 percentage points without a single API call. On open-domain questions, Mode A scores **85.0% — the highest of any system in the evaluation**, including cloud-powered ones. Mode C reaches **87.7%**, matching enterprise cloud systems.
+> **How to read this table.** Scores from different papers use different LoCoMo splits, judge models, and prompt variants. We do NOT claim these numbers are apples-to-apples across rows. The rows we re-ran in-house are marked "In-house"; cited rows link to the vendor's public source and date. Mode A is the only zero-LLM configuration in the list, so the comparison that is apples-to-apples is **Mode A 74.8% vs Mem0 zero-retrieval-LLM 64.2%** (+10.6pp). Mem0's 91.6% and EverMemOS's 93.05% use cloud LLMs; Mode C uses a local LLM (Ollama). BEAM-10M, the emerging successor benchmark, will be added in a future release.
+
+**What Mode A is**: CPU-only, SQLite-only, zero-LLM retrieval pipeline on published LoCoMo questions. To the best of our knowledge it is the only publicly-released local-first memory that clears Mem0's zero-LLM baseline on this benchmark. If another fully-local system hits similar numbers, please open an issue so we can update the table.
 
 Mathematical layers contribute **+12.7 percentage points** on average across 6 conversations (n=832 questions), with up to **+19.9pp on the most challenging dialogues**. This isn't more compute — it's better math.
 
@@ -53,7 +56,8 @@ Mathematical layers contribute **+12.7 percentage points** on average across 6 c
 
 ---
 
-## What's New in V3.3 — The Living Brain Evolves
+<details>
+<summary><strong>What's New in V3.3 — The Living Brain Evolves</strong> (click to expand)</summary>
 
 > V3.3 gives your memory a lifecycle. Memories strengthen when used, fade when neglected, compress when idle, and consolidate into reusable patterns — all automatically, all locally. Your agent gets smarter the longer it runs.
 
@@ -102,9 +106,9 @@ slm reap
 |:-------|:----:|:----:|:------:|
 | RAM usage (Mode A/B) | ~4GB | ~40MB | **100x reduction** |
 | Retrieval channels | 5 | 6 | +Hopfield completion |
-| MCP tools | 29 | 35 | +6 new |
+| MCP tools (default) | 29 | 33 | +4 new (mesh set) |
 | CLI commands | 21 | 26 | +5 new |
-| Dashboard tabs | 20 | 23 | +3 new |
+| Dashboard tabs | 17 | 17 | (H-22: Reward / Shadow / EvolutionCost tiles deferred to next cycle — data exposed via API today, see [DASHBOARD-COVERAGE.md](docs/DASHBOARD-COVERAGE.md)) |
 | API endpoints | 9 | 16 | +7 new |
 
 Embedding migration happens automatically when you switch modes — no manual steps needed.
@@ -139,6 +143,8 @@ slm config set v33_features.all true
 
 **Fully backward compatible.** All existing MCP tools, CLI commands, and configs work unchanged. New tables are created automatically on first run. No migration needed.
 
+</details>
+
 ---
 
 <details>
@@ -197,11 +203,11 @@ slm status
 }
 ```
 
-35 MCP tools + 7 resources available. Works with Claude Code, Cursor, Windsurf, VS Code Copilot, Continue, Cody, ChatGPT Desktop, Gemini CLI, JetBrains, Zed, and 17+ AI tools. **V3.3: Adaptive lifecycle, smart compression, and pattern learning.**
+33 MCP tools by default (+42 optional behind `SLM_MCP_ALL_TOOLS=1`) + 7 resources. Works with any MCP-compatible client — we ship templated configs for Claude Code, Cursor, Windsurf, VS Code Copilot, Continue, Cody, ChatGPT Desktop, Gemini CLI, JetBrains, Zed, and Antigravity (15 IDE configs in `ide/configs/`). **V3.3: Adaptive lifecycle, smart compression, and pattern learning.**
 
 ### Dual Interface: MCP + CLI
 
-SLM works everywhere -- from IDEs to CI pipelines to Docker containers. The only AI memory system with both MCP and agent-native CLI.
+SLM works everywhere — from IDEs to CI pipelines to Docker containers. Both the MCP server and the agent-native CLI are first-class, so the same backend serves IDE-side integrations and scripted automations.
 
 | Need | Use | Example |
 |------|-----|---------|
@@ -241,20 +247,19 @@ slm mode b   # Local Ollama
 slm mode c   # Cloud LLM
 ```
 
-**Mode A** is the only agent memory that operates with **zero cloud dependency** while achieving competitive retrieval accuracy on a standard benchmark. All data stays on your device. No API keys. No GPU. Runs on 2 vCPUs + 4GB RAM.
+**Mode A** is, to the best of our knowledge, the only publicly-released agent memory that runs with zero cloud calls while clearing Mem0's published LoCoMo score. All data stays on your device. No API keys. No GPU. Runs on 2 vCPUs + 4GB RAM. If another fully-local system hits similar numbers, please open an issue — we'll update this line.
 
 ---
 
 ## Architecture
 
 ```
-Query  ──►  Strategy Classifier  ──►  6 Parallel Channels:
+Query  ──►  Strategy Classifier  ──►  5 Parallel Channels:
                                        ├── Semantic (Fisher-Rao geodesic distance)
                                        ├── BM25 (keyword matching)
                                        ├── Entity Graph (spreading activation, 3 hops)
                                        ├── Temporal (date-aware retrieval)
-                                       ├── Associative (multi-hop spreading activation)
-                                       └── Hopfield (partial query completion)
+                                       └── Hopfield (partial-query completion / associative recall)
                                                     │
                                        RRF Fusion (k=60)
                                                     │
@@ -269,9 +274,9 @@ Query  ──►  Strategy Classifier  ──►  6 Parallel Channels:
 
 Three novel contributions replace cloud LLM dependency with mathematical guarantees:
 
-1. **Fisher-Rao Retrieval Metric** — Similarity scoring derived from the Fisher information structure of diagonal Gaussian families. Graduated ramp from cosine to geodesic distance over the first 10 accesses. The first application of information geometry to agent memory retrieval.
+1. **Fisher-Rao Retrieval Metric** — Similarity scoring derived from the Fisher information structure of diagonal Gaussian families. Graduated ramp from cosine to geodesic distance over the first 10 accesses. To the best of our knowledge, the first public application of information geometry specifically to agent memory retrieval — if prior work exists please open an issue so we can credit it.
 
-2. **Sheaf Cohomology for Consistency** — Algebraic topology detects contradictions by computing coboundary norms on the knowledge graph. The first algebraic guarantee for contradiction detection in agent memory.
+2. **Sheaf Cohomology for Consistency** — Algebraic topology detects contradictions by computing coboundary norms on the knowledge graph. We are not aware of a prior production agent-memory system that computes sheaf-cohomology coboundary norms this way; corrections welcome.
 
 3. **Riemannian Langevin Lifecycle** — Memory positions evolve on the Poincare ball via discretized Langevin SDE. Frequently accessed memories stay active; neglected memories self-archive. No hardcoded thresholds.
 
@@ -343,7 +348,10 @@ Built-in compliance tools: GDPR Article 15/17 export + complete erasure, tamper-
 slm dashboard    # Opens at http://localhost:8765
 ```
 
-**v3.4.4 "Neural Glass":** 21-tab sidebar dashboard with light + dark theme. Knowledge Graph (Sigma.js WebGL, community detection), Health Monitor, Entity Explorer (1,300+ entities), Mesh Peers (P2P agent communication), Ingestion Status (Gmail/Calendar/Transcript management), Privacy blur mode. Always-on daemon with auto-start. 8 mesh MCP tools built-in. Cross-platform: macOS + Windows + Linux. All data stays local.
+**v3.4.4 "Neural Glass":** 17-tab sidebar dashboard with light + dark theme. Knowledge Graph (Sigma.js WebGL, community detection), Health Monitor, Entity Explorer (1,300+ entities), Mesh Peers (P2P agent communication), Ingestion Status (Gmail/Calendar/Transcript management), Privacy blur mode. Always-on daemon with auto-start. 8 mesh MCP tools built-in. Cross-platform: macOS + Windows + Linux. All data stays local.
+
+<!-- UX-M1: link dashboard-coverage so users can find deferred Living Brain Evolution tiles -->
+> **Living Brain Evolution visibility:** v3.4.21 ships the reward model, shadow test + online retrain, and evolution cost log via the REST API and `slm status --json`; the dedicated dashboard tiles are deferred to the next cycle. See [docs/DASHBOARD-COVERAGE.md](docs/DASHBOARD-COVERAGE.md) for endpoints and workarounds.
 
 ---
 
@@ -363,7 +371,7 @@ Auto-capture hooks: `slm hooks install` + `slm observe` + `slm session-context`.
 ## Features
 
 ### Retrieval
-- 6-channel hybrid: Semantic (Fisher-Rao) + BM25 + Entity Graph + Temporal + Associative + Hopfield
+- 5-channel hybrid: Semantic (Fisher-Rao) + BM25 + Entity Graph + Temporal + Hopfield (associative / partial-query completion)
 - RRF fusion + cross-encoder reranking
 - Agentic sufficiency verification (auto-retry on weak results)
 - Adaptive ranking with LightGBM (learns from usage)
@@ -400,9 +408,9 @@ Auto-capture hooks: `slm hooks install` + `slm observe` + `slm session-context`.
 - Tamper-proof hash-chain audit trail (SHA-256 linked entries)
 
 ### Infrastructure
-- 23-tab web dashboard with real-time visualization
+- 17-tab web dashboard with real-time visualization
 - 17+ IDE integrations (Claude, Cursor, Windsurf, VS Code, JetBrains, Zed, etc.)
-- 38 MCP tools + 7 MCP resources
+- 33 default MCP tools (+42 optional via `SLM_MCP_ALL_TOOLS=1`) + 7 MCP resources
 - Profile isolation (independent memory spaces)
 - 2,900+ tests, AGPL v3, cross-platform (Mac/Linux/Windows)
 - CPU-only — no GPU required
@@ -440,7 +448,7 @@ Auto-capture hooks: `slm hooks install` + `slm observe` + `slm session-context`.
 
 ## Research Papers
 
-SuperLocalMemory is backed by three peer-reviewed research papers covering trust, information geometry, and cognitive memory architecture.
+SuperLocalMemory is backed by three published research papers (arXiv preprints + Zenodo DOIs) covering trust, information geometry, and cognitive memory architecture. These are preprints — not conference-accepted or journal-published yet.
 
 ### Paper 3: The Living Brain (V3.3)
 > **SuperLocalMemory V3.3: The Living Brain — Biologically-Inspired Forgetting, Cognitive Quantization, and Multi-Channel Retrieval for Zero-LLM Agent Memory Systems**
@@ -546,7 +554,7 @@ If this project solves a real problem for you, **please star the repo** — it h
 
 ## Part of the Qualixar AI Agent Reliability Platform
 
-Qualixar is building the open-source infrastructure for AI agent reliability engineering. Seven products, seven peer-reviewed papers, one coherent platform. Each tool solves one reliability pillar:
+Qualixar is building the open-source infrastructure for AI agent reliability engineering. Seven products, seven research papers (published as arXiv preprints + Zenodo archives), one coherent platform. Each tool solves one reliability pillar:
 
 | Product | Purpose | Install | Paper |
 |---------|---------|---------|-------|

package/bin/slm

@@ -15,6 +15,17 @@ for arg in "$@"; do
     fi
 done
 
+# LLD-06 §6.3 — prefer the PyInstaller-built binary on the hot hook path.
+# If the onedir binary exists and isn't disabled, run it directly; the
+# binary is stdlib-only and ~30ms cold on Windows. Otherwise fall back
+# to the Python CLI below.
+SLM_HOOK_BIN="${SLM_HOOK_BINARY:-$HOME/.superlocalmemory/bin/slm-hook/slm-hook}"
+if [ "${1:-}" = "hook" ] && [ "${2:-}" = "user_prompt_submit" ] \
+   && [ -x "$SLM_HOOK_BIN" ] \
+   && [ "${SLM_HOOK_BINARY_DISABLED:-0}" != "1" ]; then
+    exec "$SLM_HOOK_BIN"
+fi
+
 # Find Python
 PYTHON=""
 for cmd in python3 python; do

package/bin/slm.bat

@@ -13,6 +13,18 @@ REM Handle --version / -v directly (fast path, no Python needed)
 if "%~1"=="--version" goto :show_version
 if "%~1"=="-v" goto :show_version
 
+REM LLD-06 §6.3 — prefer the PyInstaller-built binary on the hot hook path.
+set "SLM_HOOK_BIN=%USERPROFILE%\.superlocalmemory\bin\slm-hook\slm-hook.exe"
+if defined SLM_HOOK_BINARY set "SLM_HOOK_BIN=%SLM_HOOK_BINARY%"
+if "%~1"=="hook" if "%~2"=="user_prompt_submit" (
+    if exist "%SLM_HOOK_BIN%" (
+        if not "%SLM_HOOK_BINARY_DISABLED%"=="1" (
+            "%SLM_HOOK_BIN%"
+            exit /b %ERRORLEVEL%
+        )
+    )
+)
+
 REM Find Python 3
 where python3 >nul 2>&1
 if %ERRORLEVEL% EQU 0 (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.4.19",
+  "version": "3.4.21",
   "description": "Information-geometric agent memory with mathematical guarantees. 4-channel retrieval, Fisher-Rao similarity, zero-LLM mode, EU AI Act compliant. Works with Claude, Cursor, Windsurf, and 17+ AI tools.",
   "keywords": [
     "ai-memory",
@@ -52,8 +52,8 @@
     "test": "echo \"Run: npm install -g . && slm status\" && exit 0"
   },
   "engines": {
-    "node": ">=14.0.0",
-    "npm": ">=6.0.0"
+    "node": ">=18.0.0",
+    "npm": ">=9.0.0"
   },
   "os": [
     "darwin",
@@ -65,6 +65,7 @@
     "src/",
     "ide/",
     "scripts/",
+    "skills/",
     "pyproject.toml",
     "README.md",
     "LICENSE",

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "3.4.19"
+version = "3.4.21"
 description = "Information-geometric agent memory with mathematical guarantees"
 readme = "README.md"
 license = {text = "AGPL-3.0-or-later"}
@@ -121,10 +121,11 @@ superlocalmemory = ["ui/**/*"]
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["src"]
-addopts = "-m 'not slow and not ollama'"
+addopts = "-m 'not slow and not ollama and not benchmark'"
 markers = [
     "slow: marks tests as slow — real engine/model loading (run with: pytest -m slow)",
     "ollama: marks tests that require a running Ollama instance",
+    "benchmark: marks CI-only evo-memory benchmark tests (run with: pytest tests/test_benchmarks/ -m benchmark)",
 ]
 filterwarnings = [
     "ignore::DeprecationWarning:vaderSentiment",

package/scripts/build-slm-hook.ps1

@@ -0,0 +1,40 @@
+# LLD-06 §5.1 — Windows PowerShell build script for slm-hook onedir binary.
+# Runs AST generator -> PyInstaller -> smoke test.
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$RepoRoot  = Resolve-Path (Join-Path $ScriptDir "..")
+
+Write-Host "[build-slm-hook] repo: $RepoRoot"
+
+$Py = if ($env:SLM_BUILD_PYTHON) { $env:SLM_BUILD_PYTHON } else { "python" }
+
+& $Py -m pip install --quiet --upgrade `
+    "pyinstaller==6.15.0" "pyinstaller-hooks-contrib==2026.1"
+
+$Dest = Join-Path $RepoRoot "src\superlocalmemory\hook_binary_entry.py"
+& $Py (Join-Path $ScriptDir "build_entry.py") `
+    --repo-root $RepoRoot `
+    --dest $Dest
+Write-Host "[build-slm-hook] entry emitted: $Dest"
+
+Set-Location $RepoRoot
+& $Py -m PyInstaller `
+    (Join-Path $ScriptDir "slm-hook.spec") `
+    --clean --noconfirm `
+    --distpath (Join-Path $RepoRoot "dist") `
+    --workpath (Join-Path $RepoRoot "build\pyi")
+
+$Binary = Join-Path $RepoRoot "dist\slm-hook\slm-hook.exe"
+if (-not (Test-Path $Binary)) {
+    Write-Error "[build-slm-hook] binary not produced at $Binary"
+    exit 2
+}
+
+Write-Host "[build-slm-hook] smoke test ..."
+$out = "" | & $Binary
+if ($out -ne "{}") {
+    Write-Error "[build-slm-hook] expected '{}', got: $out"
+    exit 3
+}
+Write-Host "[build-slm-hook] OK"

package/scripts/build-slm-hook.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# LLD-06 §5.1 — POSIX build script for slm-hook onedir binary.
+# Runs AST generator → PyInstaller → smoke test.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+echo "[build-slm-hook] repo: ${REPO_ROOT}"
+
+PY="${SLM_BUILD_PYTHON:-python3}"
+
+# 1. Ensure PyInstaller is present (pinned in pyproject optional-deps build-hook).
+"${PY}" -m pip install --quiet --upgrade \
+    "pyinstaller==6.15.0" "pyinstaller-hooks-contrib==2026.1"
+
+# 2. AST-extract entry → src/superlocalmemory/hook_binary_entry.py
+DEST="${REPO_ROOT}/src/superlocalmemory/hook_binary_entry.py"
+"${PY}" "${SCRIPT_DIR}/build_entry.py" \
+    --repo-root "${REPO_ROOT}" \
+    --dest "${DEST}"
+echo "[build-slm-hook] entry emitted: ${DEST}"
+
+# 3. Run PyInstaller.
+cd "${REPO_ROOT}"
+"${PY}" -m PyInstaller \
+    "${SCRIPT_DIR}/slm-hook.spec" \
+    --clean --noconfirm \
+    --distpath "${REPO_ROOT}/dist" \
+    --workpath "${REPO_ROOT}/build/pyi"
+
+BINARY="${REPO_ROOT}/dist/slm-hook/slm-hook"
+if [ ! -x "${BINARY}" ]; then
+    echo "[build-slm-hook] ERROR: binary not produced at ${BINARY}" >&2
+    exit 2
+fi
+
+# 4. Smoke test: empty stdin → '{}' exit 0.
+echo "[build-slm-hook] smoke test ..."
+out=$(echo '' | "${BINARY}" || true)
+if [ "${out}" != "{}" ]; then
+    echo "[build-slm-hook] ERROR: expected '{}', got: ${out}" >&2
+    exit 3
+fi
+echo "[build-slm-hook] OK"