claude supermemory - Moses Yebei

The Problem

Claude Code sessions are stateless. Every new session starts with no memory of prior work — architecture decisions, conventions, or what was done last week. This plugin gives Claude persistent memory across sessions by storing conversation turns and codebase context in Supermemory, then injecting relevant memories at session start.

What This Does

A Claude Code plugin that captures conversation turns via hooks, indexes codebases on demand, and injects recalled context into each session. The plugin/ directory holds the Claude-side hooks (context-hook.cjs, observation-hook.cjs, prompt-hook.cjs, summary-hook.cjs, add-memory.cjs, search-memory.cjs); src/ holds the shared library — src/lib/supermemory-client.js for API calls, src/lib/settings.js for configuration, src/lib/transcript-formatter.js for parsing captured transcripts.

How It Is Wired

Execution starts in plugin/scripts/add-memory.cjs (execute) and src/add-memory.js (main). main reaches 54 functions and immediately calls loadSettings, which reads ~/.supermemory-claude/settings.json via fs.readFileSync — one hop from entry to the filesystem. From there, calls flow through src/lib/supermemory-client.js, where post (13 callers) and parse (21 callers) carry the widest blast radius; change parse and 21 call sites break. The module graph shows no circular dependencies across 22 modules and 23 edges. src/lib/settings.js is the hub (6 importers), so it is the natural place to change behavior globally. File-by-file: plugin/scripts/*.cjs are thin wrappers routing hook events into src/; src/lib/auth.js owns credential storage (load/save/clear); src/lib/container-tag.js computes project identity via sha256 and getGitRoot; src/lib/compress.js and src/lib/format-context.js handle memory compression and context shaping, both flagged for high branching density.

How To Use It

git clone https://github.com/moses-y/claude-supermemory
cd claude-supermemory
npm install

# Add the plugin marketplace
/plugin marketplace add supermemoryai/claude-supermemory
/plugin install claude-supermemory

# Set your API key
export SUPERMEMORY_CC_API_KEY="sm_..."

Requires a Supermemory Pro subscription. Optional config lives in ~/.supermemory-claude/settings.json (skipTools, captureTools, maxProfileItems, debug). The /claude-supermemory:index command triggers codebase indexing.

Real-World Use

A team working across multiple sessions on the same codebase: session one establishes conventions ("prefer TypeScript, use Bun"). The observation hook captures those turns. Session two starts, context-hook.cjs fetches and injects them as <supermemory-context> blocks, and the agent resumes with that knowledge without re-asking.

Code Health & Issues

Static analysis found 4 medium findings: duplicated 6-line blocks across src/add-memory.js, src/search-memory.js, src/observation-hook.js, src/prompt-hook.js (extract shared helpers); high branching density in src/lib/format-context.js, src/lib/transcript-formatter.js, src/lib/compress.js (31 branch points over 102 lines in one case). SDLC gaps: no test suite across 22 source files (High), no LICENSE file (High), GitHub Actions workflow lacks least-privilege token permissions, Dependabot, dependency scanning, persist-credentials: false, and job timeouts (Medium/Low).

The Bottom Line

A functional plugin with a clean module structure — no cycles, sensible separation between hooks and library code. The missing test suite and license are real blockers for production use; the duplicated logic is manageable. Suitable for teams already on Supermemory Pro who want persistent context without building the integration themselves.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

39 files

JavaScript16
JSON9
Markdown4
HTML2
YAML1

React

Module dependencies

The 10 most depended-upon modules of 22, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_lib_settings["settings"] n1_src_lib_supermemory_client["supermemory-client"] n2_src_lib_container_tag["container-tag"] n3_src_lib_stdin["stdin"] n4_src_lib_auth["auth"] n5_src_lib_format_context["format-context"] n6_src_lib_transcript_formatter["transcript-formatter"] n7_src_lib_validate["validate"] n8_src_context_hook["context-hook"] n9_src_summary_hook["summary-hook"] n8_src_context_hook --> n1_src_lib_supermemory_client n8_src_context_hook --> n2_src_lib_container_tag n8_src_context_hook --> n0_src_lib_settings n8_src_context_hook --> n3_src_lib_stdin n8_src_context_hook --> n4_src_lib_auth n8_src_context_hook --> n5_src_lib_format_context n0_src_lib_settings --> n4_src_lib_auth n1_src_lib_supermemory_client --> n7_src_lib_validate n9_src_summary_hook --> n1_src_lib_supermemory_client n9_src_summary_hook --> n2_src_lib_container_tag n9_src_summary_hook --> n0_src_lib_settings n9_src_summary_hook --> n3_src_lib_stdin n9_src_summary_hook --> n6_src_lib_transcript_formatter

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo LICENSE file - unclear usage/redistribution rights root

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium4

low1

Add a LICENSE; redistribution rights are undefinedhigh

no licence file at the repository root

Fix: Add MIT or Apache-2.0 at the repository root.

Add a test suite; this repository has nonehigh22 occurrences

22 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/ci.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.