feat: replace CLI examples with full web-based demo apps by Dhravya · Pull Request #1 · supermemoryai/examples

Dhravya · 2026-04-28T03:14:55Z

Web-Based SMFS Example Apps

Replaces the three CLI-only example scripts with full web-based demo applications.

New Examples

Example	Stack	SDK	Description
Research Assistant	Next.js 15, Tailwind v4, Vercel AI SDK	`@supermemory/bash` (TypeScript)	Upload documents and chat with an AI that can search and cite them. Streaming responses via `streamText`.
Knowledge Base	FastAPI, vanilla HTML/CSS/JS	`supermemory-bash` (Python)	Add notes and chat with an AI that can search your knowledge base. SSE streaming, no frontend build step.
Code Sandbox	Next.js 15, Tailwind v4, E2B SDK	E2B + SMFS mount	Write and run code in an E2B sandbox with persistent AI memory. Three-panel UI (editor + output + chat).

Removed

legal-docs-assistant/ (CLI-only Python script)
docs-answering-agent/ (CLI-only TypeScript script)
customer-support-agent/ (CLI-only Python script)

Key Features

Streaming everywhere: All three apps stream AI responses. Next.js apps use Vercel AI SDK streamText; FastAPI uses Server-Sent Events.
Tool call visualization: All chat UIs show collapsible tool call blocks so users can see what commands the AI is running.
Security: Randomized heredoc delimiters (or printf for Python) prevent content injection. Strict filename sanitization.
Self-contained: Each app has its own package.json/requirements.txt, .env.example, and comprehensive README.

Architecture

Each app follows the same pattern:

User interacts via web UI (chat, file upload, code editor)
Backend creates a supermemory-bash / @supermemory/bash instance (or E2B sandbox with SMFS mount)
AI agent uses bash tool to read/write/search files in the Supermemory container
Responses stream back to the frontend

Quality Loop

Simplify agent identified 30 improvement areas; build agent addressed all high/medium priority items
Review agent found 3 issues (1 critical bug, 2 security); all fixed:
- Critical: code-sandbox execute route had broken heredoc via JSON.stringify -- fixed
- Security: Fixed heredoc injection in research-assistant and knowledge-base (randomized delimiters + printf)
- Security: Added strict filename sanitization in knowledge-base

Testing

TypeScript Compilation

research-assistant/: npx tsc --noEmit passes cleanly
code-sandbox/: npx tsc --noEmit passes cleanly (verified after E2B swap)

Python Syntax

knowledge-base/: python3 -m py_compile server.py passes
knowledge-base/: node --check static/app.js passes

Next.js Build

Both Next.js apps compile successfully (Compiled successfully)
Static page generation fails on internal /_error: /500 page due to non-standard NODE_ENV in the build environment -- this is a pre-existing Next.js 15 environment issue, not related to our code

Cross-App Verification

All .env.example files present with correct variables (2 vars for research-assistant and knowledge-base, 3 for code-sandbox)
All READMEs present with setup instructions (97-184 lines each)
Old CLI examples confirmed deleted
Root README updated with new example table

Integration Testing (attempted -- timed out)

Attempted: The testing subagent was dispatched to install dependencies, verify builds, and run integration checks across all three apps
Partial progress: Dependencies were installed for all three apps. The agent discovered that the supermemory_bash SDK tokenizes << as two separate LT tokens (not a heredoc operator), leading to the printf fix for the knowledge-base app
Failure: Task timed out after 3600s
Unverified: Full end-to-end runtime testing with live API keys was not completed

Session Details

Session: View Session
Requested by: Dhravya Shah (dhravya@supermemory.com)
Address comments on this PR. Add (aside) to your comment to have me ignore it.

Replace CLI-only examples with web-based demo apps. Remove: legal-docs-assistant, docs-answering-agent, customer-support-agent Update: root README with new example table

CRITICAL FIX - code-sandbox/api/execute: the heredoc-wrapped run script was being passed through JSON.stringify, which collapsed real newlines into literal \n escapes — bash never saw a valid heredoc terminator and every code execution failed with a syntax error. Build the script with real newlines and shell-quote it for 'bash -c'. SECURITY - code-sandbox/api/execute, research-assistant/api/ingest, and knowledge-base server.py all used a fixed heredoc delimiter, so user content containing that exact line could prematurely close the heredoc and inject shell input. Switched to per-request randomized delimiters (Math.random / secrets.token_hex) and extracted a shared writeFileViaHeredoc helper in research-assistant/lib/bash-utils.ts. - knowledge-base: replaced loose '/'-only title sanitization with a stricter sanitize_note_title() that rejects '..', '.', NUL/control chars, and shell metacharacters (mirrors code-sandbox's isSafeFilename). DEDUPLICATION - Extracted code-sandbox/lib/daytona.ts (getDaytona) and code-sandbox/lib/env.ts + research-assistant/lib/env.ts (requireEnv) to remove the repeated env-var-check boilerplate from every API route. - Centralized CONTAINER_TAG and MAX_AGENT_STEPS in research-assistant/lib/config.ts; added MAX_AGENT_STEPS = 10 constant in knowledge-base/server.py. CODE-SANDBOX CLEANUP - Removed the dead 'command' array; build the bash script directly. - Removed unused textareaRef in code-editor.tsx. - Hoisted SMFS_VERSION to a top-level constant; rewrote SMFS_INSTALL and STARTER_CODE using template literals. - Replaced fragile 'sleep 3' after 'smfs mount &' with a polling loop that waits for the FUSE mountpoint to become ready (mountpoint -q). - Extracted the SMFS limitation banner string and added a comment noting that beforeunload cleanup is unreliable and production deployments should rely on server-side TTL. - Dropped the unnecessary 'as HTMLFormElement' cast on form.requestSubmit. RESEARCH-ASSISTANT CLEANUP - Split handleUpload into pure helpers (uploadFiles, mergeUploadedFiles, formatUploadSummary) so the JSX-level callback is just orchestration. KNOWLEDGE-BASE CLEANUP - Hoisted the anthropic.Anthropic client to a module-level cached singleton instead of constructing one per chat request. - Split chat_stream into _build_tools, _messages_from_history, and _run_tool_calls helpers; added a comment explaining why the catch-all Exception handler exists in the SSE generator. - Extracted parseSSE async generator in static/app.js so sendMessage becomes a clean for-await loop. Replaced ad-hoc DOM-scraping in getFinalText() with explicit assistantText tracking. Replaced setTimeout(focus, 30) with requestAnimationFrame. - Pinned upper bounds in requirements.txt so the example doesn't break six months from now. OTHER - code-sandbox/.gitignore: ignore tsconfig.tsbuildinfo to match the research-assistant convention and root .gitignore.

- knowledge-base: switch from heredoc to printf '%s' for note writes (supermemory_bash SDK tokenizes << as two LT tokens) - research-assistant: add try/catch and empty file check in ingest route - research-assistant: remove error/global-error/not-found pages (unnecessary for demo, caused build issues in some environments)

socket-security · 2026-04-28T03:15:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
npm/next@15.5.15
npm/@ai-sdk/react@1.2.12
npm/@types/react-dom@19.2.3
npm/@ai-sdk/anthropic@3.0.71 ⏵ 1.2.12		^-4
npm/@types/react@19.2.14
npm/postcss@8.5.12
npm/tailwindcss@4.2.4
npm/react@19.2.5
npm/react@19.0.0
npm/@e2b/code-interpreter@1.5.1
npm/react-dom@19.0.0
npm/react-dom@19.2.5
npm/ai@6.0.168 ⏵ 4.3.19	⁺⁷
pypi/uvicorn@0.39.0
npm/@tailwindcss/postcss@4.2.4
pypi/fastapi@0.119.1

View full report

socket-security · 2026-04-28T03:15:55Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Dhravya and others added 6 commits April 28, 2026 02:02

feat: add knowledge base web app

246b09c

feat: add research assistant web app

0ac9799

feat: add code sandbox web app

8be703f

chore: remove old CLI examples, update root README

9f410ee

Replace CLI-only examples with web-based demo apps. Remove: legal-docs-assistant, docs-answering-agent, customer-support-agent Update: root README with new example table

vorflux Bot mentioned this pull request Apr 28, 2026

docs: SMFS documentation — providers, Python bash tool, examples supermemoryai/supermemory#889

Open

Dhravya added 3 commits April 28, 2026 03:16

fix: bump next to 15.5.15 to resolve CVE-2025-GHSA-9qr9

bc74cd4

feat: swap code-sandbox from Daytona to E2B

9098c17

docs: update root README for E2B swap

6266a20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: replace CLI examples with full web-based demo apps#1

feat: replace CLI examples with full web-based demo apps#1
Dhravya wants to merge 9 commits intovorflux/initial-examplesfrom
vorflux/web-examples

Dhravya commented Apr 28, 2026 •

edited by vorflux Bot

Loading

Uh oh!

socket-security Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Dhravya commented Apr 28, 2026 • edited by vorflux Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Web-Based SMFS Example Apps

New Examples

Removed

Key Features

Architecture

Quality Loop

Testing

TypeScript Compilation

Python Syntax

Next.js Build

Cross-App Verification

Integration Testing (attempted -- timed out)

Uh oh!

socket-security Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Dhravya commented Apr 28, 2026 •

edited by vorflux Bot

Loading

socket-security Bot commented Apr 28, 2026 •

edited

Loading

socket-security Bot commented Apr 28, 2026 •

edited

Loading