superlocalmemory 4.1.13 → 4.1.14

package/src/superlocalmemory/hooks/post_tool_async_hook.py

@@ -1,183 +0,0 @@
-# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
-# Licensed under AGPL-3.0-or-later - see LICENSE file
-# Part of SuperLocalMemory v3.4.22 — LLD-01 §4.4
-
-"""PostToolUse async:true hook — fire-and-forget prewarm via stdlib urllib.
-
-
-HARD RULES (enforced by tests):
-  - stdlib only — ``urllib.request``, NOT ``httpx`` / ``requests``.
-  - Always emits ``{"async": true}`` and exits 0 — even on daemon-down,
-    missing token, or broken payload.
-  - Includes ``X-SLM-Hook-Token`` header from ``~/.superlocalmemory/.install_token``
-    when available. Without a token, the POST is skipped (daemon would
-    reject anyway) but we still emit ``{"async": true}``.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import sys
-import urllib.error
-import urllib.request
-from pathlib import Path
-
-from superlocalmemory.infra.data_root import state_path
-
-
-_ALLOWED_DAEMON_HOSTS: frozenset[str] = frozenset({
-    "127.0.0.1", "localhost", "::1", "[::1]",
-})
-
-_DEFAULT_DAEMON_PORT = 8765
-
-
-def _port_file_url() -> str:
-    """Loopback daemon URL from the per-user port file (default 8765).
-
-    On a shared host each user runs their own daemon on a different port,
-    written to ``~/.superlocalmemory/daemon.port`` at startup. Falling back
-    to this instead of a hard-coded ``8765`` keeps the hook pointed at the
-    caller's own daemon. Stdlib only.
-    """
-    port = _DEFAULT_DAEMON_PORT
-    try:
-        port = int(state_path("daemon.port").read_text().strip())
-    except Exception:
-        pass
-    return f"http://127.0.0.1:{port}"
-
-
-def _sanitised_daemon_url() -> str:
-    """Return the configured daemon URL only if it's loopback-scoped.
-
-    S8-SEC-02: without this guard, a hostile env (e.g. a compromised
-    shell profile) could set ``SLM_HOOK_DAEMON_URL`` to a remote host
-    and exfiltrate the install token via the ``X-SLM-Hook-Token``
-    header. We refuse any non-loopback URL and fall back to the local
-    daemon (resolved via the per-user port file, not a hard-coded port).
-    """
-    raw = os.environ.get("SLM_HOOK_DAEMON_URL", "").strip()
-    if not raw:
-        return _port_file_url()
-    try:
-        from urllib.parse import urlparse
-        parsed = urlparse(raw)
-    except Exception:  # pragma: no cover — urllib always importable
-        return _port_file_url()
-    if parsed.scheme not in ("http", "https"):
-        return _port_file_url()
-    host = (parsed.hostname or "").lower()
-    if host not in _ALLOWED_DAEMON_HOSTS:
-        return _port_file_url()
-    # Preserve the scheme + port (user may bind daemon on a non-default port).
-    port = f":{parsed.port}" if parsed.port else ""
-    return f"{parsed.scheme}://{host}{port}"
-
-
-DAEMON_URL: str = _sanitised_daemon_url()
-DAEMON_TIMEOUT: float = float(os.environ.get("SLM_HOOK_DAEMON_TIMEOUT", "0.5"))
-PREWARM_PATH: str = "/internal/prewarm"
-
-_INPUT_CAP: int = 2000
-_OUTPUT_CAP: int = 4000
-
-
-def _install_token() -> str:
-    """Read the install token. Returns '' on any problem."""
-    path = state_path(".install_token")
-    if not path.exists():
-        return ""
-    try:
-        return path.read_text(encoding="utf-8").strip()
-    except OSError:  # pragma: no cover — FS transient failure
-        return ""
-
-
-def _summarize(obj, cap: int) -> str:
-    """Stringify with size cap."""
-    if obj is None:
-        return ""
-    if isinstance(obj, str):
-        return obj[:cap]
-    try:
-        return json.dumps(obj, default=str)[:cap]
-    except Exception:  # pragma: no cover — exotic non-serializable object
-        try:
-            return str(obj)[:cap]
-        except Exception:
-            return ""
-
-
-def _post(body: dict, token: str) -> None:
-    """Fire the prewarm POST. Silently swallows all failures."""
-    try:
-        data = json.dumps(body).encode("utf-8")
-        req = urllib.request.Request(
-            f"{DAEMON_URL}{PREWARM_PATH}",
-            data=data,
-            headers={
-                "Content-Type": "application/json",
-                "X-SLM-Hook-Token": token,
-            },
-            method="POST",
-        )
-        resp = urllib.request.urlopen(req, timeout=DAEMON_TIMEOUT)
-        try:
-            resp.read()
-        except Exception:  # pragma: no cover — partial response flush
-            pass
-        try:
-            resp.close()
-        except Exception:  # pragma: no cover — already closed
-            pass
-    except Exception:
-        # Daemon unreachable / timeout / auth rejected — by spec this is
-        # best-effort. Hook still returns {"async": true} upstream.
-        return
-
-
-def main() -> int:
-    """Entry point. Reads stdin JSON, posts to daemon, always prints
-    ``{"async": true}`` and returns 0."""
-    try:
-        raw = sys.stdin.read()
-    except Exception:  # pragma: no cover — stdin unreadable in container
-        sys.stdout.write('{"async": true}')
-        return 0
-
-    if not raw:
-        sys.stdout.write('{"async": true}')
-        return 0
-
-    try:
-        payload = json.loads(raw)
-    except Exception:
-        sys.stdout.write('{"async": true}')
-        return 0
-
-    if not isinstance(payload, dict):
-        sys.stdout.write('{"async": true}')
-        return 0
-
-    try:
-        token = _install_token()
-        if token:
-            body = {
-                "session_id": str(payload.get("session_id", "")),
-                "tool_name": str(payload.get("tool_name", "")),
-                "input_summary": _summarize(payload.get("tool_input"), _INPUT_CAP),
-                "output_summary": _summarize(payload.get("tool_response"), _OUTPUT_CAP),
-            }
-            _post(body, token)
-    except Exception:  # pragma: no cover — defense in depth
-        # Never propagate.
-        pass
-
-    sys.stdout.write('{"async": true}')
-    return 0
-
-
-if __name__ == "__main__":  # pragma: no cover — CLI entry only
-    sys.exit(main())

package/src/superlocalmemory/hooks/post_tool_outcome_hook.py

@@ -1,351 +0,0 @@
-# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
-# Licensed under AGPL-3.0-or-later - see LICENSE file
-# Part of SuperLocalMemory v3.4.22 — Track A.2 (LLD-09 / LLD-00)
-
-"""PostToolUse hook — detect fact usage + write engagement signal.
-
-Flow (hot path, <10 ms typical, <20 ms hard):
-  1. Read Claude Code JSON from stdin.
-  2. Resolve session_id via ``safe_resolve_identifier`` (LLD-00 §4).
-  3. Cap tool_response to 100 KB (bounded scan, LLD-09 §7 failure-mode #4).
-  4. Extract HMAC markers (``slm:fact:<id>:<hmac8>``) — validate each
-     (LLD-00 §3). Bare substring scans are **banned** by the Stage-5b
-     CI gate.
-  5. For each validated fact_id, find a pending_outcomes row where
-     ``session_id`` matches AND ``fact_ids_json`` includes the fact_id
-     AND ``status='pending'`` — call ``register_signal(outcome_id,
-     signal_name, True)``. ``signal_name`` is ``'edit'`` for
-     mutating tools (Edit/Write/NotebookEdit), else ``'dwell_ms'`` with
-     a nominal 3000 ms value.
-  6. Always emit ``{}`` on stdout and return 0. NEVER raise.
-
-Crash-safety (LLD-09 §6):
-  - Outer try/except around every code path. stderr breadcrumb (no
-    stack trace, no payload echo). Always exit 0.
-  - SQLite ``busy_timeout=50`` → fast-fail on DB contention.
-"""
-
-from __future__ import annotations
-
-import re
-import sys
-import time
-from pathlib import Path
-
-from superlocalmemory.hooks._outcome_common import (
-    emit_empty_json,
-    log_perf,
-    read_stdin_json,
-    session_state_file,
-    summarize_response,
-)
-from superlocalmemory.hooks._outcome_common import (
-    memory_db_path as _memory_db_path_fn,
-)
-
-_HOOK_NAME = "post_tool_outcome"
-
-# Monkey-patchable indirection for tests.
-def _memory_db_path() -> Path:
-    return _memory_db_path_fn()
-
-
-# Tools that imply an "edit" signal (the agent acted on the fact).
-_EDIT_TOOLS = frozenset({"Edit", "Write", "NotebookEdit"})
-
-# Nominal dwell value for non-edit tool uses that hit a marker.
-# The label formula clamps 2s..10s → 0.05..0.15 reward bonus.
-_DEFAULT_DWELL_MS = 3000
-
-# Marker regex — mirrors recall_pipeline._emit_marker but scoped locally
-# so this module has no hot-path import of the full recall pipeline.
-#
-# S-L04 — ``fact_id`` is constrained to a conservative alphabet
-# (alphanumerics, ``-`` and ``_``). The previous ``[^:\s]+`` allowed
-# colons and let a malicious tool response emit markers like
-# ``slm:fact:evil:deadbeef:abcdef01`` that the regex grouped wrong and
-# still handed off to the validator. Defence-in-depth: the HMAC
-# validator already rejects these, but disallowing colons keeps garbage
-# from reaching it in the first place. The HMAC suffix stays lowercase
-# hex (matches ``recall_pipeline._emit_marker``).
-_MARKER_RE = re.compile(r"slm:fact:([A-Za-z0-9_\-]+):([0-9a-f]{8})")
-
-
-def _validate(marker: str) -> str | None:
-    """Delegate to the canonical validator (LLD-00 §3)."""
-    try:
-        from superlocalmemory.core.recall_pipeline import _validate_marker
-    except Exception:
-        return None
-    try:
-        return _validate_marker(marker)
-    except Exception:
-        return None
-
-
-# --- Behavioural telemetry -------------------------------------------------
-# ``tool_events`` is the record of what the agent did, and several readers
-# depend on it: assertion mining, skill-performance mining, and the engagement
-# features that settle a recall against the actions which followed it. Each of
-# those reads the table; none of them writes it. The only writers were an
-# explicit ``log_tool_event`` call and a bulk importer, so on an ordinary
-# install the table simply stopped receiving invocations and every reader
-# quietly aged out with it.
-#
-# This hook already runs on exactly the right edge -- after each tool completes,
-# with the session that ran it -- so it records the invocation here. It happens
-# before the marker scan and independently of it: whether a recalled memory was
-# named in the output decides what a *reward* is worth, not whether the action
-# occurred at all.
-_MAX_SUMMARY_LEN = 500
-
-# Compiled once at import. This path now runs on every tool call rather than
-# only on the ~1-in-5 that carry a marker, so per-call ``re`` compilation or a
-# module import would be paid on the hot path for no benefit.
-_SECRET_PATTERNS = (
-    (re.compile(r"\b(?:sk-|pk-|api[_-]?key[_-]?)[A-Za-z0-9_-]{10,}\b"),
-     "[REDACTED]"),
-    (re.compile(r"\b[A-Za-z0-9+/]{40,}={0,2}\b"), "[REDACTED]"),
-    (re.compile(r"password\s*[=:]\s*\S+", re.IGNORECASE),
-     "password=[REDACTED]"),
-)
-
-
-def _scrub(text: str) -> str:
-    """Strip credential-shaped substrings from telemetry text."""
-    for pattern, replacement in _SECRET_PATTERNS:
-        text = pattern.sub(replacement, text)
-    return text
-
-
-def _summary(raw: object) -> str:
-    """Truncate-then-scrub ``raw`` for a summary column.
-
-    Truncation comes first so the regex cost is bounded by
-    ``_MAX_SUMMARY_LEN`` and not by the size of a tool response.
-    """
-    if raw is None:
-        return ""
-    if not isinstance(raw, str):
-        try:
-            import json as _json
-            raw = _json.dumps(raw, default=str)
-        except Exception:
-            try:
-                raw = str(raw)
-            except Exception:
-                return ""
-    return _scrub(raw[:_MAX_SUMMARY_LEN])
-
-
-def _record_tool_event(
-    session_id: str,
-    tool_name: str,
-    payload: dict,
-    response_text: str,
-) -> bool:
-    """Append one ``tool_events`` row. Never raises; returns whether it wrote.
-
-    Failure is silent by design: telemetry must never be the reason a tool call
-    reports a problem to the user, and the hook contract is to exit 0 whatever
-    happens.
-    """
-    if not tool_name:
-        return False
-    try:
-        import sqlite3
-        from datetime import datetime, timezone
-
-        try:
-            from superlocalmemory.hooks.session_registry import (
-                resolve_active_profile,
-            )
-            profile_id = resolve_active_profile() or "default"
-        except Exception:
-            profile_id = "default"
-
-        project_path = ""
-        raw_cwd = payload.get("cwd")
-        if isinstance(raw_cwd, str):
-            project_path = raw_cwd[:_MAX_SUMMARY_LEN]
-
-        conn = sqlite3.connect(str(_memory_db_path()), timeout=0.05)
-        try:
-            conn.execute("PRAGMA busy_timeout=50")
-            conn.execute(
-                "INSERT INTO tool_events "
-                "(session_id, profile_id, project_path, tool_name, event_type,"
-                " input_summary, output_summary, duration_ms, metadata,"
-                " created_at) "
-                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
-                (
-                    session_id,
-                    profile_id,
-                    project_path,
-                    tool_name,
-                    "complete",
-                    _summary(payload.get("tool_input")),
-                    _summary(response_text),
-                    0,
-                    "{}",
-                    datetime.now(timezone.utc).isoformat(),
-                ),
-            )
-            conn.commit()
-        finally:
-            conn.close()
-        return True
-    except Exception:
-        return False
-
-
-def _inner_main() -> str:
-    """Return an ``outcome`` string (for perf log); never raises."""
-    payload = read_stdin_json()
-    if payload is None:
-        return "invalid_payload"
-
-    session_id = payload.get("session_id")
-    tool_name = payload.get("tool_name") or ""
-    if not isinstance(session_id, str) or not session_id:
-        return "no_session"
-
-    # S9-DASH-10: keep registry fresh on every PostToolUse so the MCP
-    # server can pick up the current session even mid-turn.
-    try:
-        from superlocalmemory.hooks.session_registry import (
-            mark_active,
-            resolve_active_profile,
-        )
-        mark_active(
-            session_id,
-            agent_type="claude",
-            profile_id=resolve_active_profile(),
-        )
-    except Exception:
-        pass
-
-    # Path-escape defence (SEC-C-02) — any unsafe session_id means we
-    # must not touch the filesystem for this invocation. We still want
-    # to safely query the DB (it uses parameterised SQL), so we only
-    # gate the filesystem branch.
-    _ = session_state_file(session_id)  # None → caller skips FS writes
-    # Note: for post_tool_outcome we do NOT need to write session state.
-    # Rehash / stop hooks are the writers/readers.
-
-    # Response scan — capped BEFORE regex (bound O(cap)).
-    response_text = summarize_response(payload.get("tool_response"))
-
-    # The invocation is recorded before anything is decided about markers. An
-    # action the agent took is a fact about the session on its own terms; the
-    # marker only decides whether it also settles a pending recall.
-    _record_tool_event(session_id, tool_name, payload, response_text)
-
-    if not response_text:
-        return "no_response"
-
-    # Fast pre-check: if the HMAC prefix is absent, no marker can exist.
-    if "slm:fact:" not in response_text:
-        return "no_marker"
-
-    # S9-W2 M-SEC-03: cap marker iteration to prevent adversarial
-    # response_text floods. 5,000 crafted markers × ~5 μs HMAC = 25 ms
-    # of CPU inside a 20 ms hook budget — enough to cascade budget
-    # misses. LLD-09 says ≤10 facts per recall; 100 is ample headroom.
-    _MAX_MARKERS = 100
-    hits: list[str] = []
-    for m in _MARKER_RE.finditer(response_text):
-        if len(hits) >= _MAX_MARKERS:
-            break
-        marker = m.group(0)
-        fact_id = _validate(marker)
-        if fact_id:
-            hits.append(fact_id)
-    if not hits:
-        return "no_validated_marker"
-
-    # Persist signals via the canonical reward model — the DB write is
-    # behind ``register_signal`` which enforces the schema contract and
-    # the pending→settled state machine.
-    try:
-        from superlocalmemory.learning.reward import EngagementRewardModel
-    except Exception:
-        return "import_fail"
-
-    signal_name = "edit" if tool_name in _EDIT_TOOLS else "dwell_ms"
-    signal_value: object = True if signal_name == "edit" else _DEFAULT_DWELL_MS
-
-    # S9-W3 C6: single connection for BOTH the pending-row match AND
-    # the signal writes. Previously the hook opened ``open_memory_db()``
-    # for the SELECT, closed it, then constructed EngagementRewardModel
-    # which cached its own writer — two connects per invocation × 1-4 ms
-    # each × FileVault contention = blown 20 ms hook budget.
-    #
-    # H-SKEP-03 / H-ARC-H4: pending-row window raised back to 50
-    # (SEC-M2 had tightened it to 5 which silently dropped signals on
-    # heavy Claude Code sessions). Outer cap on returned outcome_ids
-    # caps UPDATE amplification at PENDING_WRITE_CAP × 10 by default.
-    try:
-        model = EngagementRewardModel(_memory_db_path())
-    except Exception:
-        return "model_init_fail"
-
-    try:
-        target_outcome_ids = model.match_pending_for_fact_ids(
-            session_id=session_id, fact_ids=hits,
-        )
-        if not target_outcome_ids:
-            # Distinguish "no pending rows exist" from "rows exist but
-            # none matched" for perf-log observability.
-            with model._lock:
-                conn = model._get_conn()
-                has_pending = conn.execute(
-                    "SELECT 1 FROM pending_outcomes "
-                    "WHERE session_id = ? AND status = 'pending' "
-                    "LIMIT 1",
-                    (session_id,),
-                ).fetchone()
-            return "no_match" if has_pending else "no_pending"
-
-        wrote = 0
-        for oid in target_outcome_ids:
-            ok = model.register_signal(
-                outcome_id=oid,
-                signal_name=signal_name,
-                signal_value=signal_value,
-            )
-            if ok:
-                wrote += 1
-        return f"signal_{signal_name}_x{wrote}"
-    finally:
-        try:
-            model.close()
-        except Exception:
-            pass
-
-
-def main() -> int:
-    """Hook entry point — stdin JSON → signals_json update. Always exits 0."""
-    t0 = time.perf_counter()
-    outcome = "exception"
-    try:
-        outcome = _inner_main()
-    except Exception as exc:  # pragma: no cover — defensive
-        try:
-            sys.stderr.write(
-                f"slm-hook {_HOOK_NAME}: {type(exc).__name__}\n"
-            )
-        except Exception:
-            pass
-    finally:
-        duration_ms = (time.perf_counter() - t0) * 1000.0
-        emit_empty_json()
-        try:
-            log_perf(_HOOK_NAME, duration_ms, outcome)
-        except Exception:
-            pass
-    return 0
-
-
-if __name__ == "__main__":  # pragma: no cover — CLI entry only
-    sys.exit(main())