memorix 1.2.2 → 1.2.3

package/dist/memcode-runtime/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.3] - 2026-07-25
+
+### Fixed
+- **Session context now respects observation visibility** -- Automatic session handoff and manual session-context reads in the CLI, MCP server, and Workbench apply the caller's project, team, and personal-memory reader. A new identity cannot receive another agent's personal observations through session startup.
+- **Identity before handoff** -- CLI and MCP coordination sessions establish their explicit identity before assembling prior context, so an owner's own personal records remain available while a newly joined agent fails closed.
+- **Graph-side disclosure guard** -- Agent-facing session handoff no longer derives graph-neighbor hints from graph relations that do not yet carry observation visibility metadata.
+
 ## [1.2.2] - 2026-07-25
 
 ### Added

package/dist/sdk.js

@@ -15346,7 +15346,7 @@ async function startSession(projectDir2, projectId, opts) {
     status: "active",
     agent: opts?.agent
   };
-  const previousContext = await getSessionContext(projectDir2, projectId);
+  const previousContext = await getSessionContext(projectDir2, projectId, 3, opts?.reader);
   const sessionStore = getSessionStore();
   const aliasSet = await resolveProjectIds(projectId);
   await sessionStore.atomicRolloverInsert(session, [...aliasSet], now3);
@@ -15364,23 +15364,27 @@ async function endSession(projectDir2, sessionId, summary) {
   await sessionStore.update(session);
   return session;
 }
-async function getSessionContext(projectDir2, projectId, limit = 3) {
+async function getSessionContext(projectDir2, projectId, limit = 3, reader) {
   const aliasSet = await resolveProjectIds(projectId);
   const [sessions, allObs] = await Promise.all([
     loadAliasSessions(aliasSet),
     loadAliasActiveObservations(aliasSet)
   ]);
+  const readableObs = reader ? allObs.filter((observation) => {
+    const observationReader = reader.projectId && aliasSet.has(observation.projectId) ? { ...reader, projectId: observation.projectId } : reader;
+    return canReadObservation(observation, observationReader);
+  }) : allObs;
   const isNoisySummary = (summary) => {
     if (!summary) return false;
     return NOISE_PATTERNS2.some((p) => p.test(summary)) || SYSTEM_SELF_PATTERNS.some((p) => p.test(summary));
   };
   const projectSessions = sessions.filter((session) => session.status === "completed").filter((session) => !isNoisySummary(session.summary)).sort((a, b) => new Date(b.endedAt || b.startedAt).getTime() - new Date(a.endedAt || a.startedAt).getTime()).slice(0, limit);
-  if (projectSessions.length === 0 && allObs.length === 0) {
+  if (projectSessions.length === 0 && readableObs.length === 0) {
     return "";
   }
   const lines = [];
   const projectTokens = tokenizeProjectId(projectId);
-  const projectObs = allObs.filter((obs) => !isNoiseObservation(obs) && !isSystemSelfObservation(obs));
+  const projectObs = readableObs.filter((obs) => !isNoiseObservation(obs) && !isSystemSelfObservation(obs));
   const l2Scored = projectObs.filter((obs) => PRIORITY_TYPES.has(obs.type) && classifyLayer(obs) === "L2").map((obs) => ({ obs, score: scoreObservationForSessionContext(obs, projectTokens) })).sort((a, b) => {
     if (b.score !== a.score) return b.score - a.score;
     return new Date(b.obs.createdAt).getTime() - new Date(a.obs.createdAt).getTime();
@@ -15406,7 +15410,7 @@ async function getSessionContext(projectDir2, projectId, limit = 3) {
   const hasL1Content = l1HookObs.length > 0 || l3GitCount > 0;
   if (hasL1Content) {
     let graphNeighbors = [];
-    if (activeEntities.length > 0) {
+    if (!reader && activeEntities.length > 0) {
       try {
         const graphMgr = new KnowledgeGraphManager(projectDir2);
         await graphMgr.init();
@@ -15532,6 +15536,7 @@ var init_session = __esm({
     init_session_store();
     init_graph();
     init_secret_filter();
+    init_visibility();
     PRIORITY_TYPES = /* @__PURE__ */ new Set(["gotcha", "decision", "problem-solution", "trade-off", "discovery"]);
     TYPE_EMOJI = {
       "gotcha": "[DISCOVERY]",
@@ -26915,7 +26920,7 @@ The path should point to a directory containing a .git folder.`
   };
   const server = existingServer ?? new McpServer({
     name: "memorix",
-    version: true ? "1.2.2" : "1.0.1"
+    version: true ? "1.2.3" : "1.0.1"
   });
   const originalRegisterTool = server.registerTool.bind(server);
   server.registerTool = ((name, ...args) => {
@@ -29416,7 +29421,6 @@ Ensure the path points to a directory containing a .git folder (or a subdirector
       const unresolved = requireResolvedProject("start a project session");
       if (unresolved) return unresolved;
       const { startSession: startSession2 } = await Promise.resolve().then(() => (init_session(), session_exports));
-      const result = await startSession2(projectDir2, project.id, { sessionId, agent });
       const llmStatus = isLLMEnabled() ? `LLM enhanced mode: ${getLLMConfig()?.provider}/${getLLMConfig()?.model} (fact extraction + auto-dedup active)` : "LLM mode: off (set MEMORIX_LLM_API_KEY to enable enhanced memory quality)";
       const shouldJoinTeam = !!joinTeam;
       let registeredAgent = null;
@@ -29473,6 +29477,11 @@ Ensure the path points to a directory containing a .git folder (or a subdirector
         }
       } catch {
       }
+      const result = await startSession2(projectDir2, project.id, {
+        sessionId,
+        agent,
+        reader: getObservationReader()
+      });
       const lines = [
         `[OK] Session started: ${result.session.id}`,
         `Project: ${project.name} (${project.id})`,
@@ -29595,7 +29604,7 @@ ${summary ? "Summary saved for next session context injection." : "No summary pr
     async ({ limit }) => {
       const safeLimit = limit != null ? coerceNumber(limit, 3) : 3;
       const { getSessionContext: getSessionContext2, listSessions: listSessions2 } = await Promise.resolve().then(() => (init_session(), session_exports));
-      const context = await getSessionContext2(projectDir2, project.id, safeLimit);
+      const context = await getSessionContext2(projectDir2, project.id, safeLimit, getObservationReader());
       const sessions = await listSessions2(projectDir2, project.id);
       const activeSessions = sessions.filter((s) => s.status === "active");
       const completedSessions = sessions.filter((s) => s.status === "completed");