superlocalmemory 3.6.18 → 3.6.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.6.18",
+  "version": "3.6.20",
   "description": "Information-geometric agent memory with mathematical guarantees. 4-channel retrieval, Fisher-Rao similarity, zero-LLM mode, EU AI Act compliant. Works with Claude, Cursor, Windsurf, and 17+ AI tools.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -16,5 +16,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.6.18"
+  "version": "3.6.20"
 }

package/plugin/hooks/hooks.json

@@ -1,6 +1,15 @@
 {
   "hooks": {
     "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "slm hook mandate 2>/dev/null || true",
+            "timeout": 5000
+          }
+        ]
+      },
       {
         "hooks": [
           {

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.6.18
+superlocalmemory==3.6.20

package/plugin-src/hooks/hooks.json

@@ -1,6 +1,15 @@
 {
   "hooks": {
     "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "slm hook mandate 2>/dev/null || true",
+            "timeout": 5000
+          }
+        ]
+      },
       {
         "hooks": [
           {

package/plugin-src/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.6.18",
+  "version": "3.6.20",
   "pluginName": "superlocalmemory",
   "displayName": "SuperLocalMemory",
   "repository": "https://github.com/qualixar/superlocalmemory",

package/plugin-src/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.6.18
+superlocalmemory==3.6.20

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "3.6.18"
+version = "3.6.20"
 description = "Information-geometric agent memory with mathematical guarantees"
 readme = "README.md"
 license = {text = "AGPL-3.0-or-later"}

package/scripts/build-plugin.js

@@ -30,7 +30,7 @@ import process from 'node:process';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
-const VERSION = '3.6.18';
+const VERSION = '3.6.19';
 const MANIFEST_REL = 'plugin-src/manifest.json';
 const GENERATED_BANNER = `# _GENERATED — DO NOT HAND-EDIT
 

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "3.6.18"
+__version__ = "3.6.20"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/server/routes/mesh.py

@@ -87,24 +87,18 @@ def _get_broker(request: Request):
         client_host = request.client.host if request.client else ""
         if client_host not in ("127.0.0.1", "::1", "localhost"):
             import hmac
-            presented = request.headers.get("x-mesh-secret", "")
-            if not hmac.compare_digest(presented, secret):
+            # Accept X-Mesh-Secret (undocumented legacy header, v3.6.12 regression) OR
+            # Authorization: Bearer <secret> (RFC 7617 — canonical; what remote_sync.py
+            # sends and what the docs specify). Both are constant-time compared.
+            presented = (
+                request.headers.get("x-mesh-secret")
+                or request.headers.get("authorization", "").removeprefix("Bearer ").strip()
+            )
+            if not presented or not hmac.compare_digest(presented, secret):
                 raise HTTPException(401, detail="invalid or missing mesh secret")
     return broker
 
 
-def _validate_remote_auth(request: Request, broker) -> None:
-    """Validate bearer token for cross-machine requests."""
-    if not broker._is_remote:
-        return  # local mode — no auth needed
-    secret = broker._shared_secret
-    if not secret:
-        return
-    auth = request.headers.get("Authorization", "")
-    if auth != f"Bearer {secret}":
-        raise HTTPException(401, detail="Unauthorized")
-
-
 # -- Routes --
 
 @router.post("/register")
@@ -130,7 +124,6 @@ async def deregister(req: DeregisterRequest, request: Request):
 @router.get("/peers")
 async def peers(request: Request):
     broker = _get_broker(request)
-    _validate_remote_auth(request, broker)
     return {"peers": broker.list_all_peers()}
 
 

package/src/superlocalmemory.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superlocalmemory
-Version: 3.6.18
+Version: 3.6.20
 Summary: Information-geometric agent memory with mathematical guarantees
 Author-email: Varun Pratap Bhardwaj <admin@superlocalmemory.com>
 License: AGPL-3.0-or-later