superlocalmemory 3.7.0 → 3.7.1

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to SuperLocalMemory V3 will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.7.1] - 2026-07-16 — Installer-parity hotfix
+
+### Fixed
+
+- Included the full `plugin-src/` build inputs in the npm artifact so the npm-owned Python runtime can build with the same Codex skill data files as the PyPI artifact.
+- Added a release gate that fails when any Python `data-files` build source is absent from `npm pack` output.
+- Corrected first-run configuration metadata to use the installed runtime version instead of a stale historical version.
+- Kept background reranker warmup informational on first run; fallback retrieval remains explicit and `slm doctor` remains the diagnostic path.
+
 ## [3.7.0] - 2026-07-16 — Release package
 
 V3.7 packages the audit-hardening stream: fail-closed release promotion,

package/README.md

@@ -2,10 +2,10 @@
   <img src="https://superlocalmemory.com/assets/logo-mark.png" alt="SuperLocalMemory" width="200"/>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.7</h1>
+<h1 align="center">SuperLocalMemory V3.7.1</h1>
 <p align="center"><strong>Cache. Compress. Remember. Three surfaces — proxy, MCP tools, or skill. Every setup covered.</strong><br/>
 <em>Local-first agent memory with explicit operating modes, auditable retrieval, and optional Optimize tools.</em></p>
-<p align="center"><code>v3.7.0</code> — <strong>Release package; registry publication gate pending.</strong><br/>
+<p align="center"><code>v3.7.1</code> — <strong>Installer-parity hotfix; release witnesses required before outreach.</strong><br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 public research preprints</strong> (arXiv + Zenodo archives) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",
@@ -77,7 +77,7 @@
     "scripts/preuninstall.js",
     ".claude-plugin/",
     "plugin/",
-    "plugin-src/rules/AGENTS.md",
+    "plugin-src/",
     "docs/pi-dev-integration.md",
     "pyproject.toml",
     "README.md",

package/plugin/.claude-plugin/plugin.json

@@ -16,5 +16,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.7.0"
+  "version": "3.7.1"
 }

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.7.0
+superlocalmemory==3.7.1

package/plugin-src/.mcp.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "superlocalmemory": {
+      "command": "${CLAUDE_PLUGIN_ROOT}/scripts/slm-launch",
+      "args": [],
+      "env": {
+        "SLM_MCP_PROFILE": "code",
+        "SLM_DATA_DIR": "${CLAUDE_PLUGIN_DATA}"
+      }
+    }
+  }
+}

package/plugin-src/agents/slm-memory-advisor.md

@@ -0,0 +1,44 @@
+---
+name: slm-memory-advisor
+description: >
+  Advises the main agent on using SuperLocalMemory well — when to call
+  session_init, remember, recall, and search; how to phrase queries; and how
+  to keep memory clean. Delegate here for any "should I save/recall this?"
+  decision or when memory results look wrong.
+tools: session_init, recall, search, remember, update_memory, forget, list_recent, Read
+model: inherit
+---
+
+# Role
+You are the SuperLocalMemory (SLM) memory advisor. You help the main agent use the local-first memory system correctly across a session. You do not do the user's primary task — you make memory usage disciplined: the right thing saved, the right thing recalled, nothing duplicated, nothing lost between sessions. Core memory tools run against the configured local data root; optional providers, connectors, backup, and downloads have separate network behavior.
+
+# When to act
+When the main agent: starts a session and hasn't loaded project context; is about to or just made a decision worth persisting; asks "what did we decide about X"; gets recall results that look irrelevant/empty.
+
+# Tools you may use (real SLM MCP tools, core profile)
+- `session_init(project_path, query, max_results, max_age_days)` — ONCE at session start; returns recent decisions + relevant memories.
+- `recall(query, limit, session_id, fast, include_global, include_shared)` — multi-channel semantic retrieval (default limit 10). Leave `include_global`/`include_shared` unset — recall is private-by-default (v3.6.15).
+- `search(query, limit, profile_id)` — exact keyword / FTS5 BM25.
+- `remember(content, tags, project, importance, session_id, scope, shared_with)` — store atomic fact; importance 1-10. Leave `scope` unset (defaults to `personal`/private).
+- `update_memory(fact_id, content)` — correct by exact id.
+- `forget(profile_id, dry_run)` — decay cycle; ALWAYS dry_run=True first, report, never apply blind.
+- `list_recent(limit)` — newest first.
+- `Read` — inspect a file before deciding what to remember.
+
+# Decision rules
+1. SESSION_INIT FIRST — once, before any recall/remember in a fresh session. Never skip; never twice.
+2. RECALL BEFORE REMEMBER — if it exists, update_memory instead of duplicating.
+3. REMEMBER ATOMIC DURABLE FACTS ONLY — decisions/conventions/constraints/gotchas/stable prefs; one per call; add tags+project; importance 7-10 for blockers/security/architecture.
+4. QUERY PHRASING — concept phrases not vague words; pass session_id when available.
+5. recall vs search — recall for conceptual; search for literal keyword.
+6. EMPTY/LOW results → broaden, try search, or list_recent; never fabricate.
+7. SESSION END — close_session(session_id) when work meaningfully complete.
+8. SCOPE IS OPT-IN (v3.6.15) — every memory is `personal` (private to this profile) by default, and recall returns only this profile's facts. Do NOT set `scope="shared"/"global"` or `include_global`/`include_shared` on your own. Use them ONLY when the user EXPLICITLY asks to share memories across local profiles or to read other profiles' shared/global facts. Default behaviour is identical to single-profile SLM.
+
+# CLI fallback (MCP unavailable)
+recall→`slm recall "<q>" --limit N` (add `--include-global`/`--include-shared` only on explicit user request) · search→`slm search "<q>"` · remember→`slm remember "<c>" --tags a,b` (project/importance are MCP-only, NOT CLI flags; `--scope shared --shared-with a,b` only when the user asks to share) · list→`slm list --limit N` · forget→`slm forget` (preview first) · status→`slm status`. session_init/close_session are daemon-implicit (no CLI verb) — skip on MCP-down.
+
+# What NOT to do
+Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit.
+
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/agents/slm-optimize-advisor.md

@@ -0,0 +1,38 @@
+---
+name: slm-optimize-advisor
+description: >
+  Applies SuperLocalMemory's context-optimization rules — reversible
+  compression of large tool output and KV-caching of repeated reads/searches —
+  to stretch the context window with no proxy. Delegate here when context is
+  filling up or the same files/searches are read repeatedly. Strictly advisory
+  and fail-open: optimization must never block the primary task.
+tools: slm_compress, slm_retrieve, slm_cache_set, slm_cache_get, slm_optimize_stats, Read, Bash
+model: inherit
+---
+
+# Role
+You are the SLM optimize advisor. You reduce context-window pressure using Surface-B tools: reversible compression (CCR) and a per-agent KV cache. No proxy; full 1M window preserved on any plan. You apply the same rules as the slm-compress and slm-cache skills. You cannot cache the primary Claude turn (needs a proxy) — only content the agent routes through SLM.
+
+# When to act
+Tool/file read >~2000 chars; same file or bash/web search about to be re-read; user asks how much context saved; context tight with large outputs sitting in window.
+
+# Tools (real SLM MCP tools, code profile)
+slm_compress(content,mode,reversible,ttl_seconds)→compressed,lossy,ccr_id (mode normalize|auto|aggressive); slm_retrieve(ccr_id); slm_cache_set(key,value,ttl_seconds); slm_cache_get(key)→hit,value; slm_optimize_stats(); Read/Bash to fetch content.
+
+# Decision rules (the 8 — apply automatically)
+1. CLAUDE.md >3000 chars → slm_compress(mode="normalize", reversible=False), use compressed IN CONTEXT ONLY; never modify the file.
+2. Tool output >2000 chars → slm_compress(mode="auto", reversible=True); work from compressed; keep ccr_id if lossy.
+3. Repeated file reads → slm_cache_get("file:<path>") first; on miss Read then slm_cache_set("file:<path>", ttl 1800); invalidate on Edit/Write.
+4. Repeated bash/web → slm_cache_set("bash:<cmd[:64]>", ttl 600); web ttl 3600.
+5. Retrieve original only when byte-identical needed.
+6. NEVER compress/cache: code for Edit/Write; JSON to parse; secrets/keys/tokens; ccr_ids; <500 chars.
+7. Stats → slm_optimize_stats() (KV this-session; proxy/compress daemon-persisted).
+8. FAIL-OPEN: ok:false → continue with original, no retry, don't surface unless asked. Never block the task.
+
+# CLI fallback
+stats→`slm optimize status`/`savings` · compress→`slm compress` · cache→`slm cache ...`. If CLI also fails, drop optimization silently (rule 8).
+
+# What NOT to do
+Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %.
+
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/hooks/hooks.json

@@ -0,0 +1,23 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "slm hook mandate 2>/dev/null || true",
+            "timeout": 5000
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/scripts/ensure-venv.sh\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugin-src/manifest.json

@@ -0,0 +1,25 @@
+{
+  "version": "3.7.1",
+  "pluginName": "superlocalmemory",
+  "displayName": "SuperLocalMemory",
+  "repository": "https://github.com/qualixar/superlocalmemory",
+  "keywords": ["memory", "mcp", "agents", "local-first", "context-compression"],
+  "skills": [
+    { "name": "slm-cache", "hasReadme": false },
+    { "name": "slm-compress", "hasReadme": false },
+    { "name": "slm-graph", "hasReadme": false },
+    { "name": "slm-recall", "hasReadme": false },
+    { "name": "slm-remember", "hasReadme": false },
+    { "name": "slm-session", "hasReadme": false },
+    { "name": "slm-status", "hasReadme": false }
+  ],
+  "targets": {
+    "plugin": "plugin/.claude-plugin/plugin.json"
+  },
+  "marketplace": {
+    "owner": "qualixar",
+    "ownerEmail": "varun.pratap.bhardwaj@gmail.com",
+    "repo": "superlocalmemory",
+    "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 20-tool code profile with graph intelligence."
+  }
+}

package/plugin-src/requirements.txt

@@ -0,0 +1 @@
+superlocalmemory==3.7.1

package/plugin-src/rules/CLAUDE.md.fragment

@@ -0,0 +1,44 @@
+<!-- BEGIN SuperLocalMemory v3.6.18 -->
+
+## SuperLocalMemory (SLM) — Agent Rules
+
+SLM is local-first memory for agents. All tools run on the user's machine; no cloud calls.
+
+### Session start
+Call `session_init(project_path, query)` ONCE per fresh session before any recall/remember. Never twice.
+
+### Remember
+- Atomic durable facts only (decisions, conventions, constraints, gotchas). One fact per call.
+- Recall-before-remember: `recall(query, 5)` first; use `update_memory` if near-match found.
+- Always supply tags + project + importance (7–10 for blockers/security/architecture).
+- Never dump a whole file; never claim "saved" without success:true.
+- Scope is opt-in (v3.6.15): writes are `personal`/private by default. Only use `scope="shared"/"global"` (or recall's `include_global`/`include_shared`) when the user explicitly asks to share across local profiles.
+
+### Recall
+- `recall` for conceptual/semantic queries; `search` for exact keywords.
+- Phrase as concepts; pass session_id when available. Never fabricate.
+
+### Optimize (fail-open)
+- Output >2000 chars → `slm_compress(mode="auto", reversible=True)`; keep ccr_id if lossy.
+- Repeated reads → `slm_cache_get("file:<path>")` first; on miss cache with ttl=1800.
+- NEVER compress/cache: code-for-edit, JSON-to-parse, secrets, ccr_ids, <500 chars.
+- If ok:false → continue with original; never block the task.
+
+### Session end
+`close_session(session_id)` when work is meaningfully complete.
+
+### CLI fallback (MCP down)
+`slm recall "<q>" --limit N` · `slm search "<q>"` · `slm remember "<c>" --tags t` · `slm list --limit N` · `slm forget` (preview first) · `slm status` · `slm optimize status`
+
+### Skills
+slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-compress · slm-graph
+
+### Commands
+/superlocalmemory:slm-recall · /superlocalmemory:slm-remember · /superlocalmemory:slm-session · /superlocalmemory:slm-status · /superlocalmemory:slm-cache · /superlocalmemory:slm-compress · /superlocalmemory:slm-graph
+
+### Subagents
+slm-memory-advisor (memory decisions, session hygiene) · slm-optimize-advisor (context compression + KV cache)
+
+<!-- END SuperLocalMemory v3.6.18 -->
+
+SuperLocalMemory v3.6.18 · Qualixar · AGPL-3.0-or-later

package/plugin-src/scripts/ensure-venv.bat

@@ -0,0 +1,122 @@
+@echo off
+:: ensure-venv.bat — WP-F SuperLocalMemory plugin venv bootstrap (Windows)
+::
+:: Windows equivalent of ensure-venv.sh. Called by Claude Code SessionStart hook
+:: on Windows hosts. Idempotent: fast-path exits quickly when requirements.txt
+:: is unchanged (sentinel file guards reinstall).
+::
+:: Environment (set by Claude Code plugin runtime):
+::   CLAUDE_PLUGIN_ROOT  — plugin installation dir (ephemeral, contains scripts\ + requirements.txt)
+::   CLAUDE_PLUGIN_DATA  — persistent data dir (venv lives here, survives plugin updates)
+::
+:: Exit codes: 0 = venv ready   non-0 = failure (logged to stderr)
+:: All informational output goes to stderr (stdout reserved for MCP stdio protocol).
+::
+:: Requires: Python 3.11+ on PATH, pip, standard Windows cmd.exe
+
+setlocal EnableDelayedExpansion
+
+:: ---------------------------------------------------------------------------
+:: Guard: required env vars must be set
+:: ---------------------------------------------------------------------------
+if not defined CLAUDE_PLUGIN_ROOT (
+    echo ERROR: CLAUDE_PLUGIN_ROOT must be set ^(plugin installation directory^) >&2
+    exit /b 1
+)
+if not defined CLAUDE_PLUGIN_DATA (
+    echo ERROR: CLAUDE_PLUGIN_DATA must be set ^(plugin persistent data directory^) >&2
+    exit /b 1
+)
+
+:: ---------------------------------------------------------------------------
+:: Python >= 3.11 guard
+:: ---------------------------------------------------------------------------
+python -c "import sys; sys.exit(0 if sys.version_info >= (3, 11) else 1)" 2>nul
+if errorlevel 1 (
+    for /f "tokens=*" %%v in ('python --version 2^>^&1') do set PY_VER=%%v
+    echo ERROR: SuperLocalMemory plugin requires Python ^>= 3.11, found: !PY_VER! >&2
+    echo Install Python 3.11+ and ensure it is first on PATH. >&2
+    exit /b 1
+)
+
+:: ---------------------------------------------------------------------------
+:: Paths
+:: ---------------------------------------------------------------------------
+set "REQ=%CLAUDE_PLUGIN_ROOT%\requirements.txt"
+set "VENV=%CLAUDE_PLUGIN_DATA%\venv"
+set "VENV_SCRIPTS=%VENV%\Scripts"
+set "SENTINEL=%CLAUDE_PLUGIN_DATA%\.venv-reqs.sha256"
+set "VENV_TMP=%CLAUDE_PLUGIN_DATA%\venv.tmp"
+
+:: ---------------------------------------------------------------------------
+:: Compute sha256 of requirements.txt using PowerShell (built-in on Windows 10+)
+:: Output: hex string of SHA256 hash
+:: ---------------------------------------------------------------------------
+for /f "usebackq tokens=*" %%h in (
+    `powershell -NoProfile -Command "(Get-FileHash -Algorithm SHA256 '%REQ%').Hash.ToLower()"`
+) do set "NEW_HASH=%%h"
+
+if "!NEW_HASH!"=="" (
+    echo ERROR: Could not compute sha256 of requirements.txt >&2
+    exit /b 1
+)
+
+:: ---------------------------------------------------------------------------
+:: Fast-path: venv Scripts\python.exe exists AND sentinel matches
+:: ---------------------------------------------------------------------------
+set "VENV_PYTHON=%VENV_SCRIPTS%\python.exe"
+if exist "%VENV_PYTHON%" (
+    if exist "%SENTINEL%" (
+        set /p "CURRENT_HASH=" < "%SENTINEL%"
+        if "!CURRENT_HASH!"=="!NEW_HASH!" (
+            echo SLM plugin: venv up-to-date, skipping install. >&2
+            exit /b 0
+        )
+    )
+)
+
+:: ---------------------------------------------------------------------------
+:: Rebuild venv atomically: install to venv.tmp, rename to venv, write sentinel LAST
+:: ---------------------------------------------------------------------------
+echo SLM plugin: bootstrapping Python venv at %VENV% ... >&2
+echo   requirements: %REQ% >&2
+
+:: Clean up any partial previous attempt
+if exist "%VENV_TMP%" rmdir /s /q "%VENV_TMP%"
+
+:: Create fresh venv
+python -m venv "%VENV_TMP%"
+if errorlevel 1 (
+    echo ERROR: python -m venv failed >&2
+    exit /b 1
+)
+
+:: Upgrade pip first
+"%VENV_TMP%\Scripts\pip.exe" install --upgrade pip --prefer-binary --quiet
+if errorlevel 1 (
+    echo ERROR: pip upgrade failed >&2
+    exit /b 1
+)
+
+:: Install requirements
+"%VENV_TMP%\Scripts\pip.exe" install --require-virtualenv --prefer-binary --quiet -r "%REQ%"
+if errorlevel 1 (
+    echo ERROR: pip install requirements failed >&2
+    exit /b 1
+)
+
+echo SLM plugin: install complete, activating venv. >&2
+
+:: Atomic swap: remove old venv (if any), rename tmp into place
+if exist "%VENV%" rmdir /s /q "%VENV%"
+move "%VENV_TMP%" "%VENV%"
+if errorlevel 1 (
+    echo ERROR: Could not move venv.tmp to venv >&2
+    exit /b 1
+)
+
+:: Write sentinel LAST — guarantees that a crash before this line triggers rebuild
+echo !NEW_HASH!>"%SENTINEL%"
+
+echo SLM plugin: venv ready at %VENV%\Scripts\slm.exe >&2
+exit /b 0

package/plugin-src/scripts/ensure-venv.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# ensure-venv.sh — WP-06 SuperLocalMemory plugin venv bootstrap
+#
+# Called by Claude Code SessionStart hook. Idempotent: fast-path exits in <100ms
+# on repeat invocations when requirements.txt is unchanged.
+#
+# Environment (set by Claude Code plugin runtime):
+#   CLAUDE_PLUGIN_ROOT  — plugin installation dir (ephemeral, contains scripts/ + requirements.txt)
+#   CLAUDE_PLUGIN_DATA  — persistent data dir (venv lives here, survives plugin updates)
+#
+# Exit codes: 0 = venv ready   non-0 = failure (logged to stderr)
+# All output goes to stderr only (stdout reserved for MCP stdio protocol).
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# :? guard — fail loudly if required env vars are unset or empty
+# ---------------------------------------------------------------------------
+: "${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT must be set (plugin installation directory)}"
+: "${CLAUDE_PLUGIN_DATA:?CLAUDE_PLUGIN_DATA must be set (plugin persistent data directory)}"
+
+# ---------------------------------------------------------------------------
+# Redirect all output to stderr (MCP uses stdout for protocol messages)
+# ---------------------------------------------------------------------------
+exec 1>&2
+
+# ---------------------------------------------------------------------------
+# Python >= 3.11 guard
+# ---------------------------------------------------------------------------
+if ! python3 -c "import sys; sys.exit(0 if sys.version_info >= (3, 11) else 1)" 2>/dev/null; then
+    PY_VER=$(python3 --version 2>&1 || echo "unknown")
+    echo "ERROR: SuperLocalMemory plugin requires Python >= 3.11, found: ${PY_VER}" >&2
+    echo "Install Python 3.11+ and ensure it is first on PATH." >&2
+    exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# Paths
+# ---------------------------------------------------------------------------
+REQ="${CLAUDE_PLUGIN_ROOT}/requirements.txt"
+VENV="${CLAUDE_PLUGIN_DATA}/venv"
+SENTINEL="${CLAUDE_PLUGIN_DATA}/.venv-reqs.sha256"
+VENV_TMP="${CLAUDE_PLUGIN_DATA}/venv.tmp"
+
+# ---------------------------------------------------------------------------
+# Compute sha256 of requirements.txt (cross-platform: prefer sha256sum, fall back to shasum -a 256)
+# ---------------------------------------------------------------------------
+hash_req() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "${REQ}" | awk '{print $1}'
+    else
+        shasum -a 256 "${REQ}" | awk '{print $1}'
+    fi
+}
+
+NEW_HASH=$(hash_req)
+
+# ---------------------------------------------------------------------------
+# Fast-path: venv python exists AND sentinel matches current requirements hash
+# venv/bin/python3 (or python) is always present after `python3 -m venv`;
+# the sentinel guards against stale requirements.
+# In production, superlocalmemory also installs venv/bin/slm; both checks pass.
+# ---------------------------------------------------------------------------
+VENV_PYTHON="${VENV}/bin/python3"
+if [ ! -x "${VENV_PYTHON}" ]; then
+    VENV_PYTHON="${VENV}/bin/python"
+fi
+if [ -x "${VENV_PYTHON}" ] && [ -f "${SENTINEL}" ] && [ "$(cat "${SENTINEL}")" = "${NEW_HASH}" ]; then
+    echo "SLM plugin: venv up-to-date (sha256=${NEW_HASH:0:12}…), skipping install." >&2
+    exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# Rebuild venv atomically: install to venv.tmp, rename to venv, write sentinel LAST
+# ---------------------------------------------------------------------------
+echo "SLM plugin: bootstrapping Python venv at ${VENV} …" >&2
+echo "  requirements: ${REQ}" >&2
+echo "  python3: $(python3 --version 2>&1)" >&2
+
+# Clean up any partial previous attempt
+rm -rf "${VENV_TMP}"
+
+# Create fresh venv
+python3 -m venv "${VENV_TMP}"
+
+# Upgrade pip first (prefer binary to avoid source builds)
+"${VENV_TMP}/bin/pip" install --upgrade pip --prefer-binary --quiet
+
+# Install requirements
+"${VENV_TMP}/bin/pip" install \
+    --require-virtualenv \
+    --prefer-binary \
+    --quiet \
+    -r "${REQ}"
+
+echo "SLM plugin: install complete, activating venv." >&2
+
+# Atomic swap: remove old venv (if any), rename tmp into place
+rm -rf "${VENV}"
+mv "${VENV_TMP}" "${VENV}"
+
+# Write sentinel LAST — guarantees that a crash before this line triggers rebuild
+echo "${NEW_HASH}" > "${SENTINEL}"
+
+echo "SLM plugin: venv ready at ${VENV}/bin/slm" >&2

package/plugin-src/scripts/slm-launch

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# slm-launch — WP-F SuperLocalMemory MCP launcher (POSIX)
+#
+# Cross-platform counterpart: slm-launch.bat (Windows)
+# Referenced by plugin/.mcp.json as the MCP server command.
+#
+# Resolves the correct venv binary for POSIX:
+#   ${CLAUDE_PLUGIN_DATA}/venv/bin/slm mcp
+#
+# On Windows, Claude Code invokes slm-launch.bat instead (same-stem, .bat extension).
+#
+# Environment:
+#   CLAUDE_PLUGIN_DATA — persistent data dir where venv lives
+
+exec "${CLAUDE_PLUGIN_DATA}/venv/bin/slm" mcp

package/plugin-src/scripts/slm-launch.bat

@@ -0,0 +1,17 @@
+@echo off
+:: slm-launch.bat — WP-F SuperLocalMemory MCP launcher (Windows)
+::
+:: Cross-platform counterpart: slm-launch (POSIX bash)
+:: Referenced by plugin/.mcp.json as the MCP server command (Windows picks .bat automatically).
+::
+:: Resolves the correct venv binary for Windows:
+::   %CLAUDE_PLUGIN_DATA%\venv\Scripts\slm.exe mcp
+::
+:: On Windows, Python venv places entry points in Scripts\ (not bin\ like POSIX).
+:: This launcher bridges the path difference so ONE .mcp.json command field works
+:: cross-platform.
+::
+:: Environment:
+::   CLAUDE_PLUGIN_DATA — persistent data dir where venv lives
+
+"%CLAUDE_PLUGIN_DATA%\venv\Scripts\slm.exe" mcp

package/plugin-src/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "mcp__superlocalmemory__remember",
+      "mcp__superlocalmemory__recall",
+      "mcp__superlocalmemory__search",
+      "mcp__superlocalmemory__session_init",
+      "mcp__superlocalmemory__slm_compress",
+      "mcp__superlocalmemory__slm_retrieve",
+      "mcp__superlocalmemory__slm_cache_get",
+      "mcp__superlocalmemory__slm_cache_set",
+      "mcp__superlocalmemory__slm_optimize_stats",
+      "Bash(slm:*)"
+    ]
+  }
+}