superlocalmemory 3.6.11 → 3.6.13

package/src/superlocalmemory/server/routes/v3_api.py

@@ -189,12 +189,20 @@ async def set_full_config(request: Request):
         from superlocalmemory.server.routes.helpers import log_mode_change
         old = SLMConfig.load()
         old_mode = old.mode.value
+        # v3.6.12 (settings-2): honor a custom endpoint for ANY provider — the
+        # old code forced api_base="" for everything except ollama, so a
+        # llama.cpp / LM Studio / Azure-OpenAI endpoint configured in the
+        # dashboard could never be saved (Test Connection then probed the wrong
+        # URL → 401). Accept both base_url and endpoint; default ollama locally.
+        _endpoint = (body.get("base_url", "") or body.get("endpoint", "")).strip()
+        if not _endpoint and provider == "ollama":
+            _endpoint = "http://localhost:11434"
         config = SLMConfig.for_mode(
             Mode(new_mode),
             llm_provider=provider if provider != "none" else "",
             llm_model=model,
             llm_api_key=api_key,
-            llm_api_base="http://localhost:11434" if provider == "ollama" else "",
+            llm_api_base=_endpoint,
             embedding_provider=body.get("embedding_provider", ""),
             embedding_endpoint=body.get("embedding_endpoint", ""),
             embedding_key=body.get("embedding_key", ""),
@@ -202,7 +210,10 @@ async def set_full_config(request: Request):
             embedding_dimension=int(body.get("embedding_dimension", 0) or 0),
         )
         config.active_profile = old.active_profile
-        config.save()
+        # v3.6.12 (settings-1): an explicit user-driven mode switch must persist.
+        # save() without mode_change=True hits the guard that PRESERVES the old
+        # mode, so /mode/set silently no-op'd the switch while returning success.
+        config.save(mode_change=True)
 
         log_mode_change(
             old_mode, new_mode,
@@ -410,6 +421,39 @@ async def embed_texts(request: Request):
         return JSONResponse({"error": str(e)}, status_code=500)
 
 
+def _validate_provider_url(url: str, client_host: str) -> str | None:
+    """SSRF guard for outbound provider-test fetches (v3.6.12 ssrf-1).
+
+    Returns an error string if ``url`` is unsafe, else None. ALWAYS blocks
+    non-http(s) and cloud-metadata hosts. A LOOPBACK caller (the local
+    dashboard) may legitimately test local/LAN LLM endpoints, so private IPs
+    are allowed for it. A NON-loopback caller may not make the server fetch
+    private/loopback/link-local/reserved targets — that is the SSRF abuse.
+    """
+    from urllib.parse import urlparse
+    import ipaddress
+    import socket
+    p = urlparse(url)
+    if p.scheme not in ("http", "https"):
+        return "Only http/https endpoints are supported"
+    host = p.hostname or ""
+    if host.lower() in ("169.254.169.254", "metadata.google.internal", "metadata"):
+        return "Cloud metadata endpoints are not allowed"
+    if client_host in ("127.0.0.1", "::1", "localhost"):
+        return None  # local dashboard may target its own local/LAN endpoints
+    try:
+        ip = ipaddress.ip_address(host)
+    except ValueError:
+        try:
+            ip = ipaddress.ip_address(socket.gethostbyname(host))
+        except Exception:
+            return None  # unresolvable — let the HTTP client fail normally
+    if (ip.is_private or ip.is_loopback or ip.is_link_local
+            or ip.is_reserved or ip.is_multicast):
+        return "Internal/private endpoints are not allowed from a remote client"
+    return None
+
+
 @router.post("/provider/test")
 async def test_provider(request: Request):
     """Test connectivity to an LLM provider."""
@@ -419,9 +463,13 @@ async def test_provider(request: Request):
         provider = body.get("provider", "")
         model = body.get("model", "")
         api_key = body.get("api_key", "")
+        _client_host = request.client.host if request.client else ""
 
         if provider == "ollama":
             endpoint = body.get("endpoint", "http://localhost:11434")
+            _err = _validate_provider_url(endpoint, _client_host)
+            if _err:
+                return {"success": False, "error": _err}
             with httpx.Client(timeout=httpx.Timeout(5.0)) as c:
                 resp = c.get(f"{endpoint}/api/tags")
                 resp.raise_for_status()
@@ -448,6 +496,9 @@ async def test_provider(request: Request):
             # V3.5.9: custom/local endpoint — api_key is optional (llama.cpp, LM Studio etc.)
             custom_endpoint = body.get("base_url", "").strip() or body.get("endpoint", "").strip()
             if custom_endpoint:
+                _err = _validate_provider_url(custom_endpoint, _client_host)
+                if _err:
+                    return {"success": False, "error": _err}
                 headers_test = {"Content-Type": "application/json"}
                 if api_key:
                     headers_test["Authorization"] = f"Bearer {api_key}"
@@ -730,23 +781,38 @@ async def trust_dashboard(request: Request):
 async def math_health(request: Request):
     """Mathematical layer health: Fisher, sheaf, Langevin status. Queries DB directly."""
     try:
-        engine = None  # Engine runs in subprocess; query DB directly below
-
+        # v3.6.12 (math-1): report CONFIG-DERIVED status, not a hardcoded
+        # "active"/"healthy" for every layer. The old code had a dead `if engine:`
+        # (engine was always None) and returned all-green unconditionally — a
+        # false-assurance pane. We can't probe the recall subprocess from here,
+        # so report the real configured mode/threshold/temperature and label the
+        # status "configured" (or "unknown" if config can't load).
+        from superlocalmemory.core.config import SLMConfig
+        config = SLMConfig.load()
+        math = getattr(config, "math", None)
+        _status = "configured" if math is not None else "unknown"
         health = {
-            "fisher": {"status": "active", "description": "Fisher-Rao information geometry for similarity"},
-            "sheaf": {"status": "active", "description": "Sheaf cohomology for consistency detection"},
-            "langevin": {"status": "active", "description": "Riemannian Langevin dynamics for lifecycle"},
+            "fisher": {
+                "status": _status,
+                "description": "Fisher-Rao information geometry for similarity",
+                "mode": getattr(math, "fisher_mode", None) if math else None,
+            },
+            "sheaf": {
+                "status": _status,
+                "description": "Sheaf cohomology for consistency detection",
+                "threshold": getattr(math, "sheaf_contradiction_threshold", None) if math else None,
+            },
+            "langevin": {
+                "status": _status,
+                "description": "Riemannian Langevin dynamics for lifecycle",
+                "temperature": getattr(math, "langevin_temperature", None) if math else None,
+            },
+        }
+        return {
+            "health": health,
+            "overall": _status,
+            "note": "config-derived; not a live runtime probe",
         }
-
-        # Check if math layers are configured
-        if engine:
-            from superlocalmemory.core.config import SLMConfig
-            config = SLMConfig.load()
-            health["fisher"]["mode"] = config.math.fisher_mode
-            health["sheaf"]["threshold"] = config.math.sheaf_contradiction_threshold
-            health["langevin"]["temperature"] = config.math.langevin_temperature
-
-        return {"health": health, "overall": "healthy"}
     except Exception as e:
         return JSONResponse({"error": str(e)}, status_code=500)
 

package/src/superlocalmemory/server/ui.py

@@ -82,12 +82,20 @@ def create_app() -> FastAPI:
     # Rate limiting (graceful)
     try:
         from superlocalmemory.infra.rate_limiter import RateLimiter
-        _write_limiter = RateLimiter(max_requests=30, window_seconds=60)
-        _read_limiter = RateLimiter(max_requests=120, window_seconds=60)
+        from superlocalmemory.core.remote_mode import (
+            rate_limit_config,
+            is_rate_limit_exempt,
+        )
+        # v3.6.12 (issue #40): env-tunable thresholds (defaults unchanged).
+        _rl_write, _rl_read, _rl_window = rate_limit_config()
+        _write_limiter = RateLimiter(max_requests=_rl_write, window_seconds=_rl_window)
+        _read_limiter = RateLimiter(max_requests=_rl_read, window_seconds=_rl_window)
 
         @application.middleware("http")
         async def rate_limit_middleware(request, call_next):
             client_ip = request.client.host if request.client else "unknown"
+            if is_rate_limit_exempt(client_ip):
+                return await call_next(request)
             is_write = request.method in ("POST", "PUT", "DELETE", "PATCH")
             limiter = _write_limiter if is_write else _read_limiter
             allowed, remaining = limiter.is_allowed(client_ip)
@@ -165,8 +173,11 @@ def create_app() -> FastAPI:
         try:
             _mod = __import__(f"superlocalmemory.server.routes.{_module_name}", fromlist=["router"])
             application.include_router(_mod.router)
-        except (ImportError, Exception):
-            pass
+        except (ImportError, Exception) as _exc:
+            # v3.6.12 (settings-3): was a silent `pass` — a transient import
+            # error in learning.py alone 404s 3 dashboard panes (Learning,
+            # Patterns, Feedback) with no trace. Log it like the chat loop above.
+            logger.warning("Optional router %s failed: %s", _module_name, _exc)
 
     # Wire WebSocket manager into routes that need broadcast capability
     import superlocalmemory.server.routes.profiles as _profiles_mod

package/src/superlocalmemory/server/unified_daemon.py

@@ -1257,6 +1257,32 @@ def create_app() -> FastAPI:
                     allowed_origins=[f"http://{h}" for h in _hosts],
                 )
             logger.info("MCP transport security: allowed_hosts=%r", _mcp_allowed)
+        # v3.6.12 (issue #39): stateless MCP transport for distributed/gateway
+        # deployments. SLM's Streamable-HTTP is stateful by default — every call
+        # must replay the Mcp-Session-Id from the initialize handshake. A gateway
+        # (MCP Hub, LAN forwarder) that doesn't replay it gets "-32600 Session
+        # not found" (the mesh-tools symptom in #39). Stateless mode treats each
+        # request independently so any forwarder works. Default OFF (loopback
+        # clients keep full stateful sessions); enabled by SLM_REMOTE=1 or
+        # SLM_MCP_STATELESS=1. Per-agent /mcp/{agent_id} routing is unaffected
+        # (path-based, not session-based).
+        from superlocalmemory.core.remote_mode import mcp_stateless, is_remote_mode
+        if mcp_stateless():
+            _mcp_fastmcp.settings.stateless_http = True
+            _mcp_fastmcp.settings.json_response = True
+            if is_remote_mode():
+                logger.warning(
+                    "MCP transport: STATELESS mode ON (SLM_REMOTE) — LAN "
+                    "gateways/hubs may forward tool calls without a session id. "
+                    "Per-session isolation is relaxed; intended for trusted networks."
+                )
+            else:
+                logger.warning(
+                    "MCP transport: STATELESS mode ON (SLM_MCP_STATELESS alone) "
+                    "— session isolation relaxed for LOOPBACK clients. Intended "
+                    "for a local gateway/hub (e.g. MCP Hub) on 127.0.0.1 only; "
+                    "the token endpoint stays loopback-only without SLM_REMOTE."
+                )
         global _mcp_app
         _mcp_app = _mcp_fastmcp.streamable_http_app()
 
@@ -1285,20 +1311,30 @@ def _register_dashboard_routes(application: FastAPI) -> None:
     # Rate limiting (graceful)
     try:
         from superlocalmemory.infra.rate_limiter import RateLimiter
-        _write_limiter = RateLimiter(max_requests=30, window_seconds=60)
-        _read_limiter = RateLimiter(max_requests=120, window_seconds=60)
+        from superlocalmemory.core.remote_mode import (
+            rate_limit_config,
+            is_rate_limit_exempt,
+        )
+        # v3.6.12 (issue #40): thresholds are env-tunable (SLM_RATE_LIMIT_WRITE/
+        # READ/WINDOW) so distributed/LAN operators can raise them. Defaults
+        # unchanged (30 writes / 120 reads per 60s) for the local case.
+        _rl_write, _rl_read, _rl_window = rate_limit_config()
+        _write_limiter = RateLimiter(max_requests=_rl_write, window_seconds=_rl_window)
+        _read_limiter = RateLimiter(max_requests=_rl_read, window_seconds=_rl_window)
 
         # S9-DASH-09: loopback (127.0.0.1 / ::1) is always the dashboard
         # itself — it legitimately makes many rapid reads (Brain + tabs +
         # polling). Rate-limiting our own UI produces 429s that cascade
         # into blank panels. CORS already restricts origins to localhost,
         # so we don't lose the anti-abuse posture for external callers.
-        _LOOPBACK_IPS = frozenset({"127.0.0.1", "::1", "localhost"})
+        # v3.6.12 (issue #40): in SLM_REMOTE mode an allowlisted LAN browser is
+        # the user's own dashboard doing the same rapid polling, so it is exempt
+        # too (is_rate_limit_exempt) — otherwise normal polling trips 429.
 
         @application.middleware("http")
         async def rate_limit_middleware(request, call_next):
             client_ip = request.client.host if request.client else "unknown"
-            if client_ip in _LOOPBACK_IPS:
+            if is_rate_limit_exempt(client_ip):
                 return await call_next(request)
             is_write = request.method in ("POST", "PUT", "DELETE", "PATCH")
             limiter = _write_limiter if is_write else _read_limiter
@@ -1313,8 +1349,11 @@ def _register_dashboard_routes(application: FastAPI) -> None:
             response = await call_next(request)
             response.headers["X-RateLimit-Remaining"] = str(remaining)
             return response
-    except (ImportError, Exception):
-        pass
+    except Exception as _rl_exc:
+        # v3.6.12 (failopen-4): don't silently swallow — a missing rate limiter
+        # is anti-abuse degradation worth a log line (unlike auth, this may
+        # fail-open: rate limiting is not a security boundary).
+        logger.warning("Rate-limit middleware not installed (%s)", _rl_exc)
 
     # Auth middleware (graceful)
     try:
@@ -1336,6 +1375,28 @@ def _register_dashboard_routes(application: FastAPI) -> None:
                 return await call_next(request)
             is_write = request.method in ("POST", "PUT", "DELETE", "PATCH")
             headers = dict(request.headers)
+            # v3.6.12 (csrf-1): defense-in-depth CSRF/DNS-rebinding guard on
+            # state-changing requests. A cross-origin browser Origin is rejected;
+            # loopback origins (the local dashboard) always pass, and LAN origins
+            # pass only when explicitly allowlisted in SLM_REMOTE mode. Non-browser
+            # clients (CLI/MCP/curl) send no Origin and are unaffected.
+            if is_write:
+                _origin = headers.get("origin", "") or headers.get("Origin", "")
+                if _origin:
+                    _ok_origin = any(_origin.startswith(p) for p in (
+                        "http://127.0.0.1", "https://127.0.0.1",
+                        "http://localhost", "https://localhost",
+                        "http://[::1]", "https://[::1]",
+                    ))
+                    if not _ok_origin:
+                        from superlocalmemory.core.remote_mode import is_remote_origin_allowed
+                        _ok_origin = is_remote_origin_allowed(_origin)
+                    if not _ok_origin:
+                        from fastapi.responses import JSONResponse
+                        return JSONResponse(
+                            status_code=403,
+                            content={"error": "cross-origin request rejected"},
+                        )
             if not check_api_key(headers, is_write=is_write):
                 from fastapi.responses import JSONResponse
                 return JSONResponse(
@@ -1343,8 +1404,35 @@ def _register_dashboard_routes(application: FastAPI) -> None:
                     content={"error": "Invalid or missing API key."},
                 )
             return await call_next(request)
-    except (ImportError, Exception):
-        pass
+    except Exception as _auth_exc:
+        # v3.6.12 (failopen-1): security middleware must NEVER fail open silently.
+        # The old `except (ImportError, Exception): pass` meant any failure to
+        # install the auth gate left ALL write endpoints unauthenticated. Instead
+        # log critically and install a fail-CLOSED fallback: writes from
+        # non-loopback clients are rejected (loopback dashboard keeps working).
+        logger.critical(
+            "Auth middleware failed to install (%s) — installing fail-CLOSED "
+            "fallback; non-loopback writes will be rejected.", _auth_exc,
+        )
+        try:
+            from superlocalmemory.hooks.prewarm_auth import is_loopback as _is_lb
+        except Exception:
+            def _is_lb(h: str) -> bool:
+                return h in ("127.0.0.1", "::1", "localhost")
+
+        @application.middleware("http")
+        async def _failclosed_auth(request, call_next):
+            if request.url.path.startswith(("/v1/", "/v1beta/", "/mcp")):
+                return await call_next(request)
+            is_write = request.method in ("POST", "PUT", "DELETE", "PATCH")
+            client_host = request.client.host if request.client else ""
+            if is_write and not _is_lb(client_host):
+                from fastapi.responses import JSONResponse
+                return JSONResponse(
+                    status_code=503,
+                    content={"error": "Auth subsystem unavailable; writes disabled."},
+                )
+            return await call_next(request)
 
     # Static files
     from fastapi.staticfiles import StaticFiles
@@ -1463,158 +1551,6 @@ def _register_dashboard_routes(application: FastAPI) -> None:
             })
         return {"providers": providers}
 
-    @application.get("/api/v3/mode")
-    async def v3_get_mode():
-        """Get current mode and available modes."""
-        from superlocalmemory.core.config import SLMConfig
-        from superlocalmemory.storage.models import Mode as _M
-        _base = Path.home() / ".superlocalmemory"
-        current = SLMConfig.read_current_mode(_base)
-        modes = {}
-        for _m in (_M.A, _M.B, _M.C):
-            _name = _m.value.lower()
-            _path = SLMConfig._mode_config_path(_base, _m)
-            _cfg = None
-            if _path.exists():
-                try:
-                    _cfg = SLMConfig.load(_path)
-                except Exception:
-                    pass
-            modes[_name] = {
-                "label": {"a": "Zero-Cloud", "b": "Local AI", "c": "Cloud Power"}[_name],
-                "config_exists": _path.exists(),
-                "embedding_provider": getattr(_cfg.embedding, "provider", "") if _cfg else "",
-                "embedding_model": getattr(_cfg.embedding, "model_name", "") if _cfg else "",
-                "llm_provider": getattr(_cfg.llm, "provider", "") if _cfg else "",
-                "llm_model": getattr(_cfg.llm, "model", "") if _cfg else "",
-                "reranker": _cfg.retrieval.use_cross_encoder if _cfg else True,
-            }
-        return {"current_mode": current, "modes": modes}
-
-    @application.post("/api/v3/mode/set")
-    async def v3_set_mode(request: Request):
-        """Switch mode and optionally update provider/model. Body matches
-        the auto-settings.js saveSettings() payload."""
-        from superlocalmemory.core.config import SLMConfig
-        try:
-            body = await request.json()
-            new_mode = (body.get("mode") or body.get("settings_mode") or "").lower().strip()
-            if new_mode not in ("a", "b", "c"):
-                return JSONResponse(
-                    {"ok": False, "error": "mode must be a, b, or c"},
-                    status_code=400,
-                )
-            config = SLMConfig.switch_mode(new_mode)
-
-            # If provider/model were sent, update the saved config
-            provider = body.get("provider", "").strip()
-            if provider and new_mode != "a":
-                _base = Path.home() / ".superlocalmemory"
-                from superlocalmemory.core.config import LLMConfig, EmbeddingConfig
-                # Update LLM
-                model = body.get("model", "").strip()
-                api_key = body.get("api_key", "").strip()
-                endpoint = body.get("endpoint", "").strip()
-                if provider or model:
-                    config.llm = LLMConfig(
-                        provider=provider or config.llm.provider,
-                        model=model or config.llm.model,
-                        api_key=api_key or config.llm.api_key,
-                        api_base=endpoint or config.llm.api_base,
-                    )
-                # Update embedding
-                emb_provider = body.get("embedding_provider", "").strip()
-                emb_model = body.get("embedding_model", "").strip()
-                emb_key = body.get("embedding_key", "").strip()
-                if emb_provider or emb_model:
-                    config.embedding = EmbeddingConfig(
-                        provider=emb_provider or config.embedding.provider,
-                        model_name=emb_model or config.embedding.model_name,
-                        dimension=config.embedding.dimension,
-                        api_key=emb_key or config.embedding.api_key,
-                    )
-                config.save(mode_change=True)
-
-            return {
-                "ok": True, "mode": new_mode,
-                "embedding": f"{config.embedding.provider}/{config.embedding.model_name}",
-                "llm": f"{config.llm.provider}/{config.llm.model}",
-                "message": f"Switched to Mode {new_mode.upper()}. Run slm restart to apply.",
-            }
-        except Exception as exc:
-            return JSONResponse({"ok": False, "error": str(exc)}, status_code=500)
-
-    @application.get("/api/v3/ollama/status")
-    async def v3_ollama_status():
-        """Check if Ollama is running and list available models."""
-        try:
-            import httpx as _hx
-            _r = _hx.get("http://localhost:11434/api/tags", timeout=3.0)
-            if _r.status_code == 200:
-                _data = _r.json()
-                return {
-                    "running": True,
-                    "models": [{"name": m["name"], "size": m.get("size", 0)}
-                               for m in _data.get("models", [])],
-                }
-        except Exception:
-            pass
-        return {"running": False, "models": []}
-
-    @application.post("/api/v3/provider/test")
-    async def v3_provider_test(request: Request):
-        """Test a provider connection. Body: {provider, api_key, endpoint}."""
-        try:
-            body = await request.json()
-            provider = body.get("provider", "")
-            api_key = body.get("api_key", "")
-            endpoint = body.get("endpoint", "")
-            if provider == "ollama":
-                import httpx as _hx
-                _r = _hx.get(f"{endpoint or 'http://localhost:11434'}/api/tags", timeout=3.0)
-                return {"ok": _r.status_code == 200, "message": "Ollama reachable" if _r.status_code == 200 else f"HTTP {_r.status_code}"}
-            if provider in ("openai", "openrouter"):
-                import httpx as _hx
-                _url = f"{endpoint or 'https://api.openai.com/v1'}/models"
-                _headers = {"Authorization": f"Bearer {api_key}"}
-                _r = _hx.get(_url, headers=_headers, timeout=5.0)
-                return {"ok": _r.status_code == 200, "message": "API key valid" if _r.status_code == 200 else f"HTTP {_r.status_code}: {_r.text[:200]}"}
-            return {"ok": False, "message": f"Unknown provider: {provider}"}
-        except Exception as exc:
-            return {"ok": False, "message": str(exc)}
-
-    @application.get("/api/v3/embedding/config")
-    async def v3_get_embedding_config():
-        """Get current embedding configuration."""
-        engine = getattr(application.state, "engine", None)
-        if engine is None:
-            return JSONResponse({"ok": False, "error": "engine not initialized"}, status_code=503)
-        config = getattr(engine, "_config", None)
-        if config is None:
-            return JSONResponse({"ok": False, "error": "no config loaded"}, status_code=503)
-        return {
-            "provider": getattr(config.embedding, "provider", ""),
-            "model_name": getattr(config.embedding, "model_name", ""),
-            "dimension": getattr(config.embedding, "dimension", 0),
-        }
-
-    @application.post("/api/v3/embedding/test")
-    async def v3_embedding_test(request: Request):
-        """Test embedding with current config. Body: {text: \"test\"}."""
-        try:
-            body = await request.json()
-            text = body.get("text", "test embedding")
-            engine = getattr(application.state, "engine", None)
-            if engine is None:
-                return {"ok": False, "error": "engine not initialized"}
-            embedder = getattr(engine, "_embedder", None)
-            if embedder is None:
-                return {"ok": False, "error": "embedder not available"}
-            vec = embedder.embed(text)
-            return {"ok": True, "dimensions": len(vec) if vec else 0}
-        except Exception as exc:
-            return {"ok": False, "error": str(exc)}
-
     @application.get("/", response_class=HTMLResponse)
     async def root():
         index_path = UI_DIR / "index.html"

package/src/superlocalmemory/storage/database.py

@@ -590,12 +590,21 @@ class DatabaseManager:
 
     def search_facts_fts(self, query: str, profile_id: str, limit: int = 20) -> list[AtomicFact]:
         """Full-text search via FTS5, joined to facts table for reconstruction."""
+        # v3.6.12 (search-1): the raw query was passed straight into FTS5 MATCH,
+        # so any '?', '-', quote, or trailing boolean keyword (AND/OR/NOT) raised
+        # an FTS5 syntax error. Tokenize to word characters, quote each token,
+        # and OR-join — mirrors the recall BM25 channel's safe MATCH expression.
+        import re as _re
+        tokens = [t for t in _re.findall(r"\w+", query.lower()) if t]
+        if not tokens:
+            return []
+        match_expr = " OR ".join(f'"{t}"' for t in tokens)
         rows = self.execute(
             """SELECT f.* FROM atomic_facts_fts AS fts
                JOIN atomic_facts AS f ON f.fact_id = fts.fact_id
                WHERE fts.atomic_facts_fts MATCH ? AND f.profile_id = ?
                ORDER BY fts.rank LIMIT ?""",
-            (query, profile_id, limit),
+            (match_expr, profile_id, limit),
         )
         return [self._row_to_fact(r) for r in rows]
 

package/src/superlocalmemory/ui/js/auto-settings.js

@@ -170,6 +170,20 @@ async function loadModeSettings() {
         // Show provider panel and populate model dropdown
         updateModeUI();
 
+        // v3.6.12 (issue #39/#40): populate the endpoint field from the SAVED
+        // config endpoint. updateProviderUI() above sets the field to the
+        // provider's DEFAULT (e.g. https://api.openai.com/v1), which hides the
+        // user's real custom endpoint (llama.cpp/LM Studio) and makes Test
+        // Connection probe the wrong URL → 401. Override with data.endpoint here.
+        if (data.endpoint) {
+            setTimeout(function() {
+                var epEl = document.getElementById('settings-endpoint');
+                if (epEl) epEl.value = data.endpoint;
+                var epRow = document.getElementById('settings-endpoint-row');
+                if (epRow) epRow.style.display = 'block';
+            }, 0);
+        }
+
         // After provider UI updates, set the saved model value
         if (model) {
             setTimeout(function() {
@@ -314,6 +328,11 @@ async function testConnection() {
     var provider = document.getElementById('settings-provider')?.value || '';
     var model = document.getElementById('settings-model')?.value || '';
     var apiKey = document.getElementById('settings-api-key')?.value || '';
+    // v3.6.12 (issue #39): include the configured custom endpoint. Without this
+    // the backend never sees base_url, treats a custom llama.cpp/LM-Studio server
+    // as official OpenAI, and 401s on an empty key. Was the real cause of the
+    // "Test Connection fails / API key required" report against Mode B.
+    var endpoint = document.getElementById('settings-endpoint')?.value || '';
     var resultEl = document.getElementById('settings-test-result');
 
     if (!provider) {
@@ -326,6 +345,7 @@ async function testConnection() {
     try {
         var testBody = {provider: provider, model: model};
         if (apiKey) testBody.api_key = apiKey;
+        if (endpoint) { testBody.base_url = endpoint; testBody.endpoint = endpoint; }
         var resp = await fetch('/api/v3/provider/test', {
             method: 'POST',
             headers: {'Content-Type': 'application/json'},
@@ -348,6 +368,9 @@ async function saveAllSettings() {
     if (mode === 'a') provider = 'none';
     var model = document.getElementById('settings-model')?.value || '';
     var apiKey = document.getElementById('settings-api-key')?.value || '';
+    // v3.6.12 (settings-2): persist the custom endpoint too, else a llama.cpp/
+    // LM-Studio/Azure endpoint can never be saved (backend reads base_url).
+    var endpoint = document.getElementById('settings-endpoint')?.value || '';
 
     var statusEl = document.getElementById('settings-save-status');
     var saveBtn = document.getElementById('settings-save-all');
@@ -358,6 +381,7 @@ async function saveAllSettings() {
         // V3.4.24: Include embedding params in save payload
         var embParams = getEmbeddingParams();
         var payload = Object.assign({mode: mode, provider: provider, model: model, api_key: apiKey}, embParams);
+        if (endpoint) { payload.base_url = endpoint; payload.endpoint = endpoint; }
         var modeResp = await fetch('/api/v3/mode/set', {
             method: 'POST',
             headers: {'Content-Type': 'application/json'},

package/src/superlocalmemory.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superlocalmemory
-Version: 3.6.11
+Version: 3.6.13
 Summary: Information-geometric agent memory with mathematical guarantees
 Author-email: Varun Pratap Bhardwaj <admin@superlocalmemory.com>
 License: AGPL-3.0-or-later
@@ -128,6 +128,8 @@ Dynamic: license-file
 
 > V3.6 is the only local-first layer that SKIPS repeat LLM calls (cache: 100% on a hit), SHRINKS tool outputs and injected context (compress: lossless-by-default, opt-in LLMLingua-2), and DISCOUNTS prefix costs (align: native KV-cache) — and remembers everything — in one install.
 >
+> **v3.6.12 "Distributed-ready":** Run SLM on a server and reach it across your LAN. `SLM_REMOTE=1` (default off) lets the dashboard load from a remote browser, lets MCP gateways/hubs forward tool calls, and makes custom local LLM endpoints (llama.cpp / LM Studio / Azure) configurable right from the dashboard — plus a batch of stability and security fixes. See [`docs/distributed-deployment.md`](docs/distributed-deployment.md).
+>
 > **v3.6.11 "Optimize Everywhere":** Three surfaces. **Proxy** (Surface A) — full-turn cache + compress on transport; needs `ANTHROPIC_BASE_URL`, shrinks the context window. **MCP tools** (Surface B) — `slm_compress`, `slm_retrieve`, `slm_cache_set`, `slm_cache_get`, `slm_optimize_stats`; no proxy, no window shrink, works on any Claude subscription. **Skill** (Surface C) — `slm-optimize` installs in `~/.claude/skills/`; zero-config auto-compress for large tool outputs and CLAUDE.md. No proxy, full 1M window. [See Three Surfaces →](#three-surfaces-proxy--mcp-tools--skill)
 >
 > **v3.6.10:** cache and compression are now **independent runtime switches** (cache-only, compress-only, both, or neither — toggle live from the dashboard, no restart). Compression was rebuilt to be **lossless by default** (the old string/array/code truncation is gone); aggressive mode adds LLMLingua-2 for **prose only** — never code, numbers, structured data, or the current turn.

package/src/superlocalmemory.egg-info/SOURCES.txt

@@ -114,6 +114,7 @@ src/superlocalmemory/core/recall_pipeline.py
 src/superlocalmemory/core/recall_queue.py
 src/superlocalmemory/core/recall_worker.py
 src/superlocalmemory/core/registry.py
+src/superlocalmemory/core/remote_mode.py
 src/superlocalmemory/core/reranker_worker.py
 src/superlocalmemory/core/safe_fs.py
 src/superlocalmemory/core/security_primitives.py