@contextableai/openclaw-memory-rebac 0.3.8 → 0.4.0

package/dist/backends/evermemos.js

@@ -0,0 +1,404 @@
+/**
+ * EverMemOSBackend — MemoryBackend implementation backed by the EverMemOS FastAPI REST server.
+ *
+ * EverMemOS communicates via standard HTTP REST endpoints on port 1995.
+ * Messages are processed through the MemCell pipeline: boundary detection →
+ * parallel LLM extraction of episodic memories, foresight, event logs, and profiles.
+ *
+ * store() returns immediately with a generated message_id as the fragment anchor.
+ * With @timeout_to_background(), store may return 202 Accepted for background processing.
+ *
+ * discoverFragmentIds() polls a custom trace overlay endpoint to resolve the message_id
+ * to actual MongoDB ObjectIds of derived memories. These ObjectIds are what search
+ * results return, enabling fragment-level SpiceDB authorization (involves, share).
+ *
+ * resolveAnchors() provides lazy resolution at recall time: if discoverFragmentIds()
+ * timed out during store, unresolved anchors can be resolved later when someone
+ * actually tries to recall the involved fragments.
+ */
+import { randomUUID } from "node:crypto";
+import { request as undiciRequest } from "undici";
+/**
+ * Map EverMemOS memory types to the SearchResult type union.
+ *
+ * episodic_memory → "chunk"  (narrative text chunks)
+ * profile         → "summary" (distilled user characteristics)
+ * foresight       → "summary" (future-oriented predictions)
+ * event_log       → "fact"    (discrete factual events)
+ */
+function mapMemoryType(memoryType) {
+    switch (memoryType) {
+        case "episodic_memory": return "chunk";
+        case "event_log": return "fact";
+        case "profile":
+        case "foresight":
+            return "summary";
+        default: return "chunk";
+    }
+}
+/**
+ * Build a context prefix from the EverMemOS memory type.
+ * This allows downstream consumers to distinguish memory kinds.
+ */
+function contextPrefix(memoryType) {
+    switch (memoryType) {
+        case "episodic_memory": return "episode";
+        case "profile": return "profile";
+        case "foresight": return "foresight";
+        case "event_log": return "event";
+        default: return memoryType;
+    }
+}
+/**
+ * Extract the primary content from an EverMemOS memory based on its type.
+ * Each memory type stores its content in a different field.
+ */
+function extractContent(m) {
+    switch (m.memory_type) {
+        case "episodic_memory": return m.episode ?? m.summary ?? "";
+        case "foresight": return m.foresight ?? "";
+        case "event_log": return m.summary ?? "";
+        case "profile": return m.summary ?? "";
+        default: return m.summary ?? m.episode ?? "";
+    }
+}
+export class EverMemOSBackend {
+    config;
+    name = "evermemos";
+    requestTimeoutMs;
+    /**
+     * Tracks pending stores: messageId → groupId.
+     * Populated by store(), consumed by discoverFragmentIds().
+     */
+    pendingStores = new Map();
+    constructor(config) {
+        this.config = config;
+        this.requestTimeoutMs = config.requestTimeoutMs ?? 30000;
+    }
+    // --------------------------------------------------------------------------
+    // REST transport
+    // --------------------------------------------------------------------------
+    async restCall(method, path, body, queryParams) {
+        let url = `${this.config.endpoint}${path}`;
+        if (queryParams) {
+            const params = new URLSearchParams(queryParams);
+            url += `?${params.toString()}`;
+        }
+        // Node.js fetch rejects body on GET requests (per spec). EverMemOS's
+        // search endpoint is GET-only with a JSON request body, so we use
+        // undici.request which permits body on any method.
+        if (method === "GET" && body !== undefined) {
+            const res = await undiciRequest(url, {
+                method: "GET",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(this.requestTimeoutMs),
+            });
+            if (res.statusCode < 200 || res.statusCode >= 300) {
+                const text = await res.body.text().catch(() => "");
+                throw new Error(`EverMemOS REST ${method} ${path} failed: ${res.statusCode} ${text}`);
+            }
+            const ct = res.headers["content-type"] ?? "";
+            if (ct.includes("application/json")) {
+                return (await res.body.json());
+            }
+            return {};
+        }
+        const opts = {
+            method,
+            headers: { "Content-Type": "application/json" },
+            signal: AbortSignal.timeout(this.requestTimeoutMs),
+        };
+        if (body !== undefined) {
+            opts.body = JSON.stringify(body);
+        }
+        const response = await fetch(url, opts);
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`EverMemOS REST ${method} ${path} failed: ${response.status} ${text}`);
+        }
+        const ct = response.headers.get("content-type") ?? "";
+        if (ct.includes("application/json")) {
+            return (await response.json());
+        }
+        return {};
+    }
+    // --------------------------------------------------------------------------
+    // MemoryBackend implementation
+    // --------------------------------------------------------------------------
+    async store(params) {
+        const messageId = randomUUID();
+        const request = {
+            message_id: messageId,
+            create_time: new Date().toISOString(),
+            sender: this.config.defaultSenderId,
+            content: params.content,
+            group_id: params.groupId,
+            role: "user",
+            refer_list: [],
+        };
+        await this.restCall("POST", "/api/v1/memories", request);
+        // EverMemOS processes messages asynchronously through its MemCell pipeline.
+        // customPrompt is ignored — EverMemOS handles extraction internally.
+        //
+        // We return our generated message_id as the fragment anchor for SpiceDB.
+        // discoverFragmentIds() will resolve this to actual MongoDB ObjectIds via
+        // the trace overlay endpoint, enabling fragment-level involves/share.
+        this.pendingStores.set(messageId, { groupId: params.groupId });
+        return { fragmentId: Promise.resolve(messageId) };
+    }
+    async searchGroup(params) {
+        const { query, groupId, limit } = params;
+        const body = {
+            query,
+            group_id: groupId,
+            top_k: limit,
+            retrieve_method: this.config.retrieveMethod,
+            memory_types: this.config.memoryTypes,
+        };
+        const response = await this.restCall("GET", "/api/v1/memories/search", body);
+        // Response nests memories under group-id keys:
+        //   result.memories: [{ "group-a": [mem1, mem2, ...] }]
+        //   result.scores:   [{ "group-a": [0.95, 0.87, ...] }]
+        const memoryGroups = response.result?.memories ?? [];
+        const scoreGroups = response.result?.scores ?? [];
+        const flat = [];
+        for (let gi = 0; gi < memoryGroups.length; gi++) {
+            const groupObj = memoryGroups[gi];
+            const scoreObj = scoreGroups[gi] ?? {};
+            for (const [gid, mems] of Object.entries(groupObj)) {
+                const scores = scoreObj[gid] ?? [];
+                for (let mi = 0; mi < mems.length; mi++) {
+                    flat.push({ mem: mems[mi], score: scores[mi] ?? 0 });
+                }
+            }
+        }
+        return flat.map(({ mem: m, score }, index) => ({
+            type: mapMemoryType(m.memory_type),
+            uuid: m.id,
+            group_id: m.group_id ?? groupId,
+            summary: extractContent(m),
+            context: `${contextPrefix(m.memory_type)}: ${m.subject ?? ""}`.trim(),
+            created_at: m.timestamp ?? m.created_at ?? "",
+            score: score || 1.0 - index / Math.max(flat.length, 1),
+        }));
+    }
+    // searchGroups intentionally not implemented — search.ts fan-out handles multi-group.
+    // EverMemOS has no native cross-group ranking.
+    async enrichSession(params) {
+        const meta = {
+            group_id: params.groupId,
+            user_details: {
+                [this.config.defaultSenderId]: {
+                    role: "user",
+                    last_message: params.userMsg.slice(0, 200),
+                },
+            },
+        };
+        try {
+            await this.restCall("POST", "/api/v1/memories/conversation-meta", meta);
+        }
+        catch {
+            // Best-effort — conversation metadata enrichment is non-critical
+        }
+    }
+    async getConversationHistory(sessionId, lastN = 10) {
+        const sessionGroup = `session-${sessionId.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
+        try {
+            const queryParams = {
+                group_id: sessionGroup,
+                memory_type: "episodic_memory",
+                user_id: this.config.defaultSenderId,
+                top_k: String(lastN),
+            };
+            const response = await this.restCall("GET", "/api/v1/memories", undefined, queryParams);
+            const memories = response.memories ?? [];
+            return memories.map((m) => ({
+                query: "",
+                answer: m.episode ?? m.summary ?? "",
+                created_at: m.created_at,
+            }));
+        }
+        catch {
+            return [];
+        }
+    }
+    async healthCheck() {
+        try {
+            const response = await fetch(`${this.config.endpoint}/health`, { signal: AbortSignal.timeout(5000) });
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async getStatus() {
+        return {
+            backend: "evermemos",
+            endpoint: this.config.endpoint,
+            retrieveMethod: this.config.retrieveMethod,
+            memoryTypes: this.config.memoryTypes,
+            healthy: await this.healthCheck(),
+        };
+    }
+    async deleteGroup(groupId) {
+        // LIMITATION: EverMemOS DELETE only soft-deletes MemCells. Derived memories
+        // (episodic, foresight, event_log) remain searchable. See:
+        // https://github.com/EverMind-AI/EverMemOS/issues/148
+        await this.restCall("DELETE", "/api/v1/memories", {
+            event_id: "__all__",
+            user_id: "__all__",
+            group_id: groupId,
+        });
+    }
+    async listGroups() {
+        // EverMemOS has no list-groups API
+        return [];
+    }
+    async deleteFragment(uuid, _type) {
+        // LIMITATION: EverMemOS DELETE only soft-deletes MemCells, not derived memories.
+        // The uuid from search results is a derived memory _id (episodic/foresight/event_log),
+        // not a MemCell _id, so the API will return "not found" for most fragment deletes.
+        // See: https://github.com/EverMind-AI/EverMemOS/issues/148
+        try {
+            await this.restCall("DELETE", "/api/v1/memories", {
+                event_id: uuid,
+                user_id: "__all__",
+                group_id: "__all__",
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    // --------------------------------------------------------------------------
+    // Fragment discovery via trace overlay
+    // --------------------------------------------------------------------------
+    /**
+     * Poll the trace overlay endpoint to discover MongoDB ObjectIds of derived
+     * memories (episodic, foresight, event_log) produced from a stored message.
+     *
+     * Called by index.ts after store() resolves the fragmentId Promise.
+     * Returns ObjectIds that match what search results return, enabling
+     * fragment-level SpiceDB authorization (involves, share/unshare).
+     */
+    async discoverFragmentIds(messageId) {
+        const pending = this.pendingStores.get(messageId);
+        if (!pending)
+            return [];
+        this.pendingStores.delete(messageId);
+        const pollInterval = this.config.discoveryPollIntervalMs ?? 3000;
+        const timeout = this.config.discoveryTimeoutMs ?? 120000;
+        const maxAttempts = Math.ceil(timeout / pollInterval);
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            await new Promise((r) => setTimeout(r, pollInterval));
+            try {
+                const trace = await this.restCall("GET", `/api/v1/memories/trace/${encodeURIComponent(messageId)}`);
+                if (trace.status === "not_found")
+                    return [];
+                if (trace.status === "complete" && trace.all_ids.length > 0) {
+                    return trace.all_ids;
+                }
+                // status === "processing" → keep polling
+            }
+            catch {
+                // Trace endpoint may not be available (older image) — keep trying
+            }
+        }
+        return []; // Timeout — fallback writes the messageId anchor to SpiceDB
+    }
+    /**
+     * Lazy resolution: resolve unmatched SpiceDB anchor UUIDs to actual
+     * searchable fragment IDs. Called during recall when viewable fragment IDs
+     * from SpiceDB don't match any search results.
+     */
+    async resolveAnchors(anchorIds) {
+        const result = new Map();
+        for (const anchor of anchorIds) {
+            try {
+                const trace = await this.restCall("GET", `/api/v1/memories/trace/${encodeURIComponent(anchor)}`);
+                if (trace.status === "complete" && trace.all_ids.length > 0) {
+                    result.set(anchor, trace.all_ids);
+                }
+            }
+            catch {
+                // anchor may not be a message_id (e.g. already an ObjectId) — skip
+            }
+        }
+        return result;
+    }
+    // --------------------------------------------------------------------------
+    // Backend-specific CLI commands
+    // --------------------------------------------------------------------------
+    registerCliCommands(cmd) {
+        cmd
+            .command("foresight")
+            .description("[evermemos] List foresight entries for a group")
+            .option("--group <id>", "Group ID")
+            .option("--last <n>", "Number of results", "10")
+            .action(async (opts) => {
+            const groupId = opts.group ?? this.config.defaultGroupId;
+            try {
+                const body = {
+                    query: "",
+                    group_id: groupId,
+                    top_k: Number(opts.last),
+                    retrieve_method: "keyword",
+                    memory_types: ["foresight"],
+                };
+                const response = await this.restCall("GET", "/api/v1/memories/search", body);
+                // Flatten group-keyed response
+                const flat = (response.result?.memories ?? [])
+                    .flatMap((g) => Object.values(g).flat());
+                console.log(JSON.stringify(flat, null, 2));
+            }
+            catch (err) {
+                console.error(`Failed to fetch foresight: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        });
+        cmd
+            .command("conversation-meta")
+            .description("[evermemos] View conversation metadata for a group")
+            .option("--group <id>", "Group ID")
+            .action(async (opts) => {
+            const groupId = opts.group ?? this.config.defaultGroupId;
+            try {
+                const queryParams = { group_id: groupId };
+                const response = await this.restCall("GET", "/api/v1/memories/conversation-meta", undefined, queryParams);
+                console.log(JSON.stringify(response, null, 2));
+            }
+            catch (err) {
+                console.error(`Failed to fetch conversation metadata: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        });
+        cmd
+            .command("clear-memories")
+            .description("[evermemos] Clear all memories for a group")
+            .option("--group <id...>", "Group ID(s)")
+            .option("--confirm", "Required safety flag", false)
+            .action(async (opts) => {
+            if (!opts.confirm) {
+                console.log("Destructive operation. Pass --confirm to proceed.");
+                return;
+            }
+            const groups = opts.group ?? [];
+            if (groups.length === 0) {
+                console.log("No groups specified. Use --group <id> to specify groups.");
+                return;
+            }
+            for (const g of groups) {
+                await this.deleteGroup(g);
+                console.log(`Cleared group: ${g}`);
+            }
+        });
+    }
+}
+// ============================================================================
+// Backend module exports (used by backends/registry.ts)
+// ============================================================================
+import everMemOSDefaults from "./evermemos.defaults.json" with { type: "json" };
+export const defaults = everMemOSDefaults;
+export function create(config) {
+    return new EverMemOSBackend(config);
+}

package/dist/backends/registry.js

@@ -7,6 +7,8 @@
  *   3. Import and register it here
  */
 import * as graphiti from "./graphiti.js";
+import * as evermemos from "./evermemos.js";
 export const backendRegistry = {
     graphiti,
+    evermemos,
 };

package/dist/config.d.ts

@@ -18,6 +18,8 @@ export type RebacMemoryConfig = {
     subjectId: string;
     /** Maps agent IDs to their owner person IDs (e.g., Slack user IDs). */
     identities: Record<string, string>;
+    /** Maps group IDs to their owner person IDs (for admin-level sharing). */
+    groupOwners: Record<string, string[]>;
     autoCapture: boolean;
     autoRecall: boolean;
     maxCaptureMessages: number;

package/dist/config.js

@@ -56,7 +56,7 @@ export const rebacMemoryConfigSchema = {
         // Top-level allowed keys: shared keys + the backend name key
         assertAllowedKeys(cfg, [
             "backend", "spicedb",
-            "subjectType", "subjectId", "identities",
+            "subjectType", "subjectId", "identities", "groupOwners",
             "autoCapture", "autoRecall", "maxCaptureMessages", "sessionFilter",
             backendName,
         ], "openclaw-memory-rebac config");
@@ -79,6 +79,19 @@ export const rebacMemoryConfigSchema = {
                 }
             }
         }
+        // Parse groupOwners: { "slack-engineering": ["U0123", "U0456"] }
+        const groupOwnersRaw = cfg.groupOwners;
+        const groupOwners = {};
+        if (groupOwnersRaw && typeof groupOwnersRaw === "object" && !Array.isArray(groupOwnersRaw)) {
+            for (const [groupId, owners] of Object.entries(groupOwnersRaw)) {
+                if (Array.isArray(owners)) {
+                    groupOwners[groupId] = owners.filter((o) => typeof o === "string" && o.trim() !== "");
+                }
+                else if (typeof owners === "string" && owners.trim()) {
+                    groupOwners[groupId] = [owners.trim()];
+                }
+            }
+        }
         return {
             backend: backendName,
             spicedb: {
@@ -94,6 +107,7 @@ export const rebacMemoryConfigSchema = {
             subjectType,
             subjectId,
             identities,
+            groupOwners,
             autoCapture: cfg.autoCapture !== false,
             autoRecall: cfg.autoRecall !== false,
             maxCaptureMessages: typeof cfg.maxCaptureMessages === "number" && cfg.maxCaptureMessages > 0

package/dist/index.js

@@ -21,7 +21,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { rebacMemoryConfigSchema, createBackend, defaultGroupId } from "./config.js";
 import { SpiceDbClient } from "./spicedb.js";
-import { lookupAuthorizedGroups, lookupViewableFragments, lookupFragmentSourceGroups, lookupAgentOwner, writeFragmentRelationships, deleteFragmentRelationships, canDeleteFragment, canWriteToGroup, ensureGroupMembership, } from "./authorization.js";
+import { lookupAuthorizedGroups, lookupViewableFragments, lookupFragmentSourceGroups, lookupAgentOwner, writeFragmentRelationships, deleteFragmentRelationships, canDeleteFragment, canWriteToGroup, ensureGroupMembership, ensureGroupOwnership, canShareFragment, shareFragment, unshareFragment, } from "./authorization.js";
 import { searchAuthorizedMemories, formatDualResults, } from "./search.js";
 import { registerCommands } from "./cli.js";
 // ============================================================================
@@ -218,6 +218,40 @@ const rebacMemoryPlugin = {
                                         // Post-filter: only keep results the owner is authorized to view
                                         const viewableSet = new Set(newIds);
                                         ownerFragmentResults = candidateResults.filter(r => viewableSet.has(r.uuid));
+                                        // Lazy resolution: if post-filter found nothing but we had viewable
+                                        // fragment IDs and candidate results, the IDs may be unresolved
+                                        // anchors (e.g. messageId UUIDs from a timed-out discoverFragmentIds).
+                                        // Try resolving them to actual searchable IDs via the backend.
+                                        if (ownerFragmentResults.length === 0 && candidateResults.length > 0 && backend.resolveAnchors) {
+                                            const resolved = await backend.resolveAnchors(newIds);
+                                            if (resolved.size > 0) {
+                                                const resolvedSet = new Set([...resolved.values()].flat());
+                                                ownerFragmentResults = candidateResults.filter(r => resolvedSet.has(r.uuid));
+                                                // Background: update SpiceDB so future recalls are fast
+                                                if (ownerFragmentResults.length > 0) {
+                                                    void (async () => {
+                                                        try {
+                                                            for (const [, objectIds] of resolved) {
+                                                                for (const objId of objectIds) {
+                                                                    const wt = await writeFragmentRelationships(spicedb, {
+                                                                        fragmentId: objId,
+                                                                        groupId: newGroups[0],
+                                                                        sharedBy: ownerSubject,
+                                                                        involves: [ownerSubject],
+                                                                    });
+                                                                    if (wt)
+                                                                        state.lastWriteToken = wt;
+                                                                }
+                                                            }
+                                                            api.logger.info(`openclaw-memory-rebac: lazy-resolved ${resolved.size} anchor(s) to ${ownerFragmentResults.length} fragment(s)`);
+                                                        }
+                                                        catch (lazyErr) {
+                                                            api.logger.warn(`openclaw-memory-rebac: lazy SpiceDB update failed: ${String(lazyErr)}`);
+                                                        }
+                                                    })();
+                                                }
+                                            }
+                                        }
                                     }
                                 }
                             }
@@ -326,6 +360,11 @@ const rebacMemoryPlugin = {
                 // has a stable episode UUID.  Discover extracted fact UUIDs and write
                 // per-fact relationships so that fragment-level permissions (view, delete)
                 // resolve correctly against the IDs returned by memory_recall.
+                //
+                // Graphiti: polls /episodes/{id}/edges for fact UUIDs.
+                // EverMemOS: polls trace overlay for MongoDB ObjectIds of derived memories.
+                // If discovery times out, fallback writes the episode UUID itself — lazy
+                // resolution at recall time (resolveAnchors) handles the recovery.
                 result.fragmentId
                     .then(async (episodeId) => {
                     const factIds = backend.discoverFragmentIds
@@ -444,6 +483,93 @@ const rebacMemoryPlugin = {
                 };
             },
         }), { name: "memory_forget" });
+        api.registerTool((ctx) => ({
+            name: "memory_share",
+            label: "Memory Share",
+            description: "Share a specific memory with one or more people/agents, granting them view access. " +
+                "Use type-prefixed IDs from memory_recall (e.g. 'fact:UUID', 'chunk:UUID'). " +
+                "Only the memory's creator or a group admin can share.",
+            parameters: Type.Object({
+                id: Type.String({ description: "Memory ID to share (e.g. 'fact:da8650cb-...' or bare UUID)" }),
+                share_with: Type.Array(Type.String(), { description: "Person or agent IDs to grant view access" }),
+            }),
+            async execute(_toolCallId, params) {
+                const { id, share_with } = params;
+                if (share_with.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No targets specified." }],
+                        details: { action: "error", id },
+                    };
+                }
+                const subject = resolveSubject(ctx.agentId);
+                const state = getState(ctx.agentId);
+                // Parse type prefix to get bare UUID
+                const colonIdx = id.indexOf(":");
+                const uuid = colonIdx > 0 && colonIdx < 10 ? id.slice(colonIdx + 1) : id;
+                // Check share permission
+                const allowed = await canShareFragment(spicedb, subject, uuid, state.lastWriteToken);
+                if (!allowed) {
+                    return {
+                        content: [{ type: "text", text: `Permission denied: cannot share fragment "${uuid}". Only the creator or a group admin can share.` }],
+                        details: { action: "denied", id },
+                    };
+                }
+                // Write involves relationships for each target
+                const targets = share_with.map((targetId) => ({
+                    type: "person",
+                    id: targetId,
+                }));
+                const writeToken = await shareFragment(spicedb, uuid, targets);
+                if (writeToken)
+                    state.lastWriteToken = writeToken;
+                return {
+                    content: [{ type: "text", text: `Shared memory "${uuid}" with: ${share_with.join(", ")}` }],
+                    details: { action: "shared", id, uuid, targets: share_with },
+                };
+            },
+        }), { name: "memory_share" });
+        api.registerTool((ctx) => ({
+            name: "memory_unshare",
+            label: "Memory Unshare",
+            description: "Revoke view access to a specific memory for one or more people/agents. " +
+                "Removes the 'involves' relationship. Only the memory's creator or a group admin can unshare.",
+            parameters: Type.Object({
+                id: Type.String({ description: "Memory ID to unshare (e.g. 'fact:da8650cb-...' or bare UUID)" }),
+                revoke_from: Type.Array(Type.String(), { description: "Person or agent IDs to revoke view access from" }),
+            }),
+            async execute(_toolCallId, params) {
+                const { id, revoke_from } = params;
+                if (revoke_from.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No targets specified." }],
+                        details: { action: "error", id },
+                    };
+                }
+                const subject = resolveSubject(ctx.agentId);
+                const state = getState(ctx.agentId);
+                // Parse type prefix to get bare UUID
+                const colonIdx = id.indexOf(":");
+                const uuid = colonIdx > 0 && colonIdx < 10 ? id.slice(colonIdx + 1) : id;
+                // Check share permission (same permission governs unshare)
+                const allowed = await canShareFragment(spicedb, subject, uuid, state.lastWriteToken);
+                if (!allowed) {
+                    return {
+                        content: [{ type: "text", text: `Permission denied: cannot unshare fragment "${uuid}".` }],
+                        details: { action: "denied", id },
+                    };
+                }
+                // Remove involves relationships for each target
+                const targets = revoke_from.map((targetId) => ({
+                    type: "person",
+                    id: targetId,
+                }));
+                await unshareFragment(spicedb, uuid, targets);
+                return {
+                    content: [{ type: "text", text: `Revoked access to "${uuid}" from: ${revoke_from.join(", ")}` }],
+                    details: { action: "unshared", id, uuid, targets: revoke_from },
+                };
+            },
+        }), { name: "memory_unshare" });
         api.registerTool((ctx) => ({
             name: "memory_status",
             label: "Memory Status",
@@ -761,6 +887,21 @@ const rebacMemoryPlugin = {
                             api.logger.warn(`openclaw-memory-rebac: failed to write owner for agent:${agentId}: ${err}`);
                         }
                     }
+                    // Write group → owner relationships from groupOwners config
+                    for (const [groupId, ownerIds] of Object.entries(cfg.groupOwners)) {
+                        for (const ownerId of ownerIds) {
+                            try {
+                                const ownerSubject = { type: "person", id: ownerId };
+                                const token = await ensureGroupOwnership(spicedb, groupId, ownerSubject);
+                                if (token)
+                                    defaultState.lastWriteToken = token;
+                                api.logger.info(`openclaw-memory-rebac: set person:${ownerId} as owner of group:${groupId}`);
+                            }
+                            catch (err) {
+                                api.logger.warn(`openclaw-memory-rebac: failed to write owner for group:${groupId}: ${err}`);
+                            }
+                        }
+                    }
                 }
                 api.logger.info(`openclaw-memory-rebac: initialized (backend: ${backend.name} ${backendStatus.healthy ? "OK" : "UNREACHABLE"}, spicedb: ${spicedbOk ? "OK" : "UNREACHABLE"})`);
             },

package/docker/docker-compose.evermemos.yml

@@ -0,0 +1,21 @@
+###############################################################################
+# openclaw-memory-rebac — Combined stack (EverMemOS + SpiceDB)
+#
+# Brings up the full memory service stack with EverMemOS as the backend:
+#   - EverMemOS FastAPI server + MongoDB + Milvus + Elasticsearch + Redis
+#   - SpiceDB authorization engine + PostgreSQL
+#
+# Usage:
+#   cd docker/evermemos && cp .env.example .env  # configure API keys
+#   cd docker && docker compose -f docker-compose.evermemos.yml up -d
+#
+# EverMemOS endpoint:  http://localhost:1995
+# SpiceDB endpoint:    localhost:50051 (insecure)
+#
+# To use Graphiti instead:
+#   docker compose up -d              # uses docker-compose.yml (Graphiti + SpiceDB)
+###############################################################################
+
+include:
+  - path: ./spicedb/docker-compose.yml
+  - path: ./evermemos/docker-compose.yml

package/docker/{docker-compose.yml → docker-compose.graphiti.yml}

@@ -6,7 +6,7 @@
 #   - SpiceDB authorization engine + PostgreSQL
 #
 # Usage:
-#   docker compose up -d
+#   docker compose -f docker-compose.graphiti.yml up -d
 #
 # Graphiti endpoint:  http://localhost:8000
 # SpiceDB endpoint:   localhost:50051 (insecure)