@frontmcp/plugin-remember 1.8.2 → 1.8.3

package/esm/index.mjs

@@ -31,6 +31,7 @@ import {
 
 // plugins/plugin-remember/src/providers/remember-accessor.provider.ts
 import {
+  getRunningTool,
   Provider,
   ProviderScope,
   STATELESS_SESSION_ID
@@ -535,6 +536,9 @@ var RememberAccessor = class {
   // ─────────────────────────────────────────────────────────────────────────────
   /**
    * Get the session ID from context.
+   *
+   * This is the id the request carries, which under MCP 2026-07-28 the client chooses; it is not
+   * proof of identity. Session and tool memory are namespaced by the verified session instead.
    */
   get sessionId() {
     return this.ctx.sessionId;
@@ -556,18 +560,34 @@ var RememberAccessor = class {
     return this.buildScopePrefix(scope) + key;
   }
   /**
-   * The identity that namespaces session- and tool-scoped storage
-   * (GHSA-225p-f8jh-f3rh).
+   * The session id the server verified for this request, or undefined when there is none.
    *
-   * In stateless mode the transport injects the literal session id `__stateless__` into every
-   * request, so using it as a namespace put every client's memory under the same keys. A
-   * stateless request carries no session identity: the authenticated principal is the only
-   * per-client identity available, and where there is none the request has no business
-   * reading or writing per-client memory at all.
+   * Read from the verified auth info (`authInfo.sessionId` from the transport, `extra.sessionId`
+   * from session verification), the same rule CONTEXT providers are cached by. Never
+   * `FrontMcpContext.sessionId` alone: under MCP 2026-07-28 that is whatever `mcp-session-id` the
+   * caller sent, including another caller's. The stateless transport's shared `__stateless__` id
+   * identifies no one.
+   */
+  get verifiedSessionId() {
+    const authInfo = this.ctx.authInfo;
+    return [authInfo?.sessionId, authInfo?.extra?.["sessionId"]].find(
+      (candidate) => typeof candidate === "string" && candidate.length > 0 && candidate !== STATELESS_SESSION_ID
+    );
+  }
+  /**
+   * The identity that namespaces session- and tool-scoped storage.
+   *
+   * Only a session the server verified identifies one client across requests. Keying on the
+   * session id a request merely carries let a caller read or overwrite another caller's memory by
+   * sending that caller's `mcp-session-id` (MCP 2026-07-28), and put every stateless client under
+   * the shared `__stateless__` id (GHSA-225p-f8jh-f3rh). A request without a verified session
+   * (stateless transport, MCP 2026-07-28, or a session id the server did not verify) falls back to
+   * the authenticated principal, the only per-client identity it has; with neither, it has no
+   * business reading or writing per-client memory at all.
    */
   resolveSessionIdentity() {
-    const sessionId = this.ctx.sessionId;
-    if (sessionId !== STATELESS_SESSION_ID) {
+    const sessionId = this.verifiedSessionId;
+    if (sessionId) {
       return sessionId;
     }
     const userId = this.userId;
@@ -575,9 +595,18 @@ var RememberAccessor = class {
       return `stateless-user:${userId}`;
     }
     throw new RememberIdentityError(
-      `Remember cannot use session or tool scope for an unauthenticated stateless request: every such request shares the session id "${STATELESS_SESSION_ID}", so the data would be shared across all clients. Authenticate the request, use a stateful transport, or choose the 'global' scope if the data really is shared.`
+      `Remember cannot use session or tool scope for an unauthenticated request without a verified session: a stateless request shares the session id "${STATELESS_SESSION_ID}", and an mcp-session-id the server did not verify could belong to any caller, so the data would be shared across clients. Authenticate the request, use a stateful transport, or choose the 'global' scope if the data really is shared.`
     );
   }
+  /**
+   * The tool that tool-scoped memory belongs to: the tool whose `execute()` is running (its
+   * owner-qualified name). Read when the memory is used, not when this accessor was built (it can
+   * serve several calls), so a tool that calls other tools still gets its own. Outside a tool,
+   * `'unknown'`.
+   */
+  get toolName() {
+    return getRunningTool()?.fullName ?? this.ctx.flow?.name ?? "unknown";
+  }
   /**
    * Build the scope-specific prefix.
    *
@@ -599,10 +628,8 @@ var RememberAccessor = class {
         }
         return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:user:${encodeKeyPart(userId)}:`;
       }
-      case "tool": {
-        const toolName = this.ctx.flow?.name ?? "unknown";
-        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:tool:${encodeKeyPart(toolName)}:${encodeKeyPart(this.resolveSessionIdentity())}:`;
-      }
+      case "tool":
+        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:tool:${encodeKeyPart(this.toolName)}:${encodeKeyPart(this.resolveSessionIdentity())}:`;
       case "global":
         return `${this.keyPrefix}global:`;
     }
@@ -615,7 +642,7 @@ var RememberAccessor = class {
     return getKeySourceForScope(scope, {
       sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
       userId: this.userId,
-      toolName: this.ctx.flow?.name
+      toolName: scope === "tool" ? this.toolName : void 0
     });
   }
   /**

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-remember",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "Remember plugin for FrontMCP - encrypted session memory with approval system for secure tool authorization",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,12 +49,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.2",
-    "@frontmcp/utils": "1.8.2",
+    "@frontmcp/sdk": "1.8.3",
+    "@frontmcp/utils": "1.8.3",
     "ioredis": "^5.8.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.2",
+    "@frontmcp/lazy-zod": "1.8.3",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/index.js

@@ -558,6 +558,9 @@ var RememberAccessor = class {
   // ─────────────────────────────────────────────────────────────────────────────
   /**
    * Get the session ID from context.
+   *
+   * This is the id the request carries, which under MCP 2026-07-28 the client chooses; it is not
+   * proof of identity. Session and tool memory are namespaced by the verified session instead.
    */
   get sessionId() {
     return this.ctx.sessionId;
@@ -579,18 +582,34 @@ var RememberAccessor = class {
     return this.buildScopePrefix(scope) + key;
   }
   /**
-   * The identity that namespaces session- and tool-scoped storage
-   * (GHSA-225p-f8jh-f3rh).
+   * The session id the server verified for this request, or undefined when there is none.
    *
-   * In stateless mode the transport injects the literal session id `__stateless__` into every
-   * request, so using it as a namespace put every client's memory under the same keys. A
-   * stateless request carries no session identity: the authenticated principal is the only
-   * per-client identity available, and where there is none the request has no business
-   * reading or writing per-client memory at all.
+   * Read from the verified auth info (`authInfo.sessionId` from the transport, `extra.sessionId`
+   * from session verification), the same rule CONTEXT providers are cached by. Never
+   * `FrontMcpContext.sessionId` alone: under MCP 2026-07-28 that is whatever `mcp-session-id` the
+   * caller sent, including another caller's. The stateless transport's shared `__stateless__` id
+   * identifies no one.
+   */
+  get verifiedSessionId() {
+    const authInfo = this.ctx.authInfo;
+    return [authInfo?.sessionId, authInfo?.extra?.["sessionId"]].find(
+      (candidate) => typeof candidate === "string" && candidate.length > 0 && candidate !== import_sdk.STATELESS_SESSION_ID
+    );
+  }
+  /**
+   * The identity that namespaces session- and tool-scoped storage.
+   *
+   * Only a session the server verified identifies one client across requests. Keying on the
+   * session id a request merely carries let a caller read or overwrite another caller's memory by
+   * sending that caller's `mcp-session-id` (MCP 2026-07-28), and put every stateless client under
+   * the shared `__stateless__` id (GHSA-225p-f8jh-f3rh). A request without a verified session
+   * (stateless transport, MCP 2026-07-28, or a session id the server did not verify) falls back to
+   * the authenticated principal, the only per-client identity it has; with neither, it has no
+   * business reading or writing per-client memory at all.
    */
   resolveSessionIdentity() {
-    const sessionId = this.ctx.sessionId;
-    if (sessionId !== import_sdk.STATELESS_SESSION_ID) {
+    const sessionId = this.verifiedSessionId;
+    if (sessionId) {
       return sessionId;
     }
     const userId = this.userId;
@@ -598,9 +617,18 @@ var RememberAccessor = class {
       return `stateless-user:${userId}`;
     }
     throw new RememberIdentityError(
-      `Remember cannot use session or tool scope for an unauthenticated stateless request: every such request shares the session id "${import_sdk.STATELESS_SESSION_ID}", so the data would be shared across all clients. Authenticate the request, use a stateful transport, or choose the 'global' scope if the data really is shared.`
+      `Remember cannot use session or tool scope for an unauthenticated request without a verified session: a stateless request shares the session id "${import_sdk.STATELESS_SESSION_ID}", and an mcp-session-id the server did not verify could belong to any caller, so the data would be shared across clients. Authenticate the request, use a stateful transport, or choose the 'global' scope if the data really is shared.`
     );
   }
+  /**
+   * The tool that tool-scoped memory belongs to: the tool whose `execute()` is running (its
+   * owner-qualified name). Read when the memory is used, not when this accessor was built (it can
+   * serve several calls), so a tool that calls other tools still gets its own. Outside a tool,
+   * `'unknown'`.
+   */
+  get toolName() {
+    return (0, import_sdk.getRunningTool)()?.fullName ?? this.ctx.flow?.name ?? "unknown";
+  }
   /**
    * Build the scope-specific prefix.
    *
@@ -622,10 +650,8 @@ var RememberAccessor = class {
         }
         return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:user:${encodeKeyPart(userId)}:`;
       }
-      case "tool": {
-        const toolName = this.ctx.flow?.name ?? "unknown";
-        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:tool:${encodeKeyPart(toolName)}:${encodeKeyPart(this.resolveSessionIdentity())}:`;
-      }
+      case "tool":
+        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:tool:${encodeKeyPart(this.toolName)}:${encodeKeyPart(this.resolveSessionIdentity())}:`;
       case "global":
         return `${this.keyPrefix}global:`;
     }
@@ -638,7 +664,7 @@ var RememberAccessor = class {
     return getKeySourceForScope(scope, {
       sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
       userId: this.userId,
-      toolName: this.ctx.flow?.name
+      toolName: scope === "tool" ? this.toolName : void 0
     });
   }
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-remember",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "Remember plugin for FrontMCP - encrypted session memory with approval system for secure tool authorization",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,12 +49,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.2",
-    "@frontmcp/utils": "1.8.2",
+    "@frontmcp/sdk": "1.8.3",
+    "@frontmcp/utils": "1.8.3",
     "ioredis": "^5.8.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.2",
+    "@frontmcp/lazy-zod": "1.8.3",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/providers/remember-accessor.provider.d.ts

@@ -93,6 +93,9 @@ export declare class RememberAccessor {
     }): Promise<boolean>;
     /**
      * Get the session ID from context.
+     *
+     * This is the id the request carries, which under MCP 2026-07-28 the client chooses; it is not
+     * proof of identity. Session and tool memory are namespaced by the verified session instead.
      */
     get sessionId(): string;
     /**
@@ -104,16 +107,34 @@ export declare class RememberAccessor {
      */
     private buildStorageKey;
     /**
-     * The identity that namespaces session- and tool-scoped storage
-     * (GHSA-225p-f8jh-f3rh).
+     * The session id the server verified for this request, or undefined when there is none.
+     *
+     * Read from the verified auth info (`authInfo.sessionId` from the transport, `extra.sessionId`
+     * from session verification), the same rule CONTEXT providers are cached by. Never
+     * `FrontMcpContext.sessionId` alone: under MCP 2026-07-28 that is whatever `mcp-session-id` the
+     * caller sent, including another caller's. The stateless transport's shared `__stateless__` id
+     * identifies no one.
+     */
+    private get verifiedSessionId();
+    /**
+     * The identity that namespaces session- and tool-scoped storage.
      *
-     * In stateless mode the transport injects the literal session id `__stateless__` into every
-     * request, so using it as a namespace put every client's memory under the same keys. A
-     * stateless request carries no session identity: the authenticated principal is the only
-     * per-client identity available, and where there is none the request has no business
-     * reading or writing per-client memory at all.
+     * Only a session the server verified identifies one client across requests. Keying on the
+     * session id a request merely carries let a caller read or overwrite another caller's memory by
+     * sending that caller's `mcp-session-id` (MCP 2026-07-28), and put every stateless client under
+     * the shared `__stateless__` id (GHSA-225p-f8jh-f3rh). A request without a verified session
+     * (stateless transport, MCP 2026-07-28, or a session id the server did not verify) falls back to
+     * the authenticated principal, the only per-client identity it has; with neither, it has no
+     * business reading or writing per-client memory at all.
      */
     private resolveSessionIdentity;
+    /**
+     * The tool that tool-scoped memory belongs to: the tool whose `execute()` is running (its
+     * owner-qualified name). Read when the memory is used, not when this accessor was built (it can
+     * serve several calls), so a tool that calls other tools still gets its own. Outside a tool,
+     * `'unknown'`.
+     */
+    private get toolName();
     /**
      * Build the scope-specific prefix.
      *

package/providers/remember-accessor.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAsBzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAKa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAG1C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IAoBjD;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpF;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAkB,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAsBtF;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAsB9G;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;;;;;OAMG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC;IAM9E;;;;;OAKG;IACG,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWhE;;;;;;OAMG;IACG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B/G;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAS/B;IAMD;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IA6BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,UAAU;CAOnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,gBAAgB,CAElB"}
+{"version":3,"file":"remember-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAsBzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAKa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAG1C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IAoBjD;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpF;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAkB,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAsBtF;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAsB9G;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;;;;;OAMG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC;IAM9E;;;;;OAKG;IACG,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWhE;;;;;;OAMG;IACG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B/G;;;;;OAKG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAS/B;IAMD;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACH,OAAO,KAAK,iBAAiB,GAQ5B;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;IACH,OAAO,KAAK,QAAQ,GAEnB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IA0BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,UAAU;CAOnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,gBAAgB,CAElB"}