superlocalmemory 3.6.22 → 3.7.0

package/src/superlocalmemory/optimize/storage/db.py

@@ -38,9 +38,9 @@ import dataclasses
 import json
 import logging
 import os
+import platform
 import re
 import sqlite3
-import struct
 import time
 import uuid
 import zlib
@@ -49,12 +49,13 @@ from pathlib import Path
 from typing import Any
 
 from cryptography.exceptions import InvalidTag
+from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
-from cryptography.hazmat.primitives import hashes
 
-from superlocalmemory.storage.database import DatabaseManager
+from superlocalmemory.infra.data_root import DynamicStatePath, state_path
 from superlocalmemory.optimize.storage import schema as _schema
+from superlocalmemory.storage.database import DatabaseManager
 
 logger = logging.getLogger(__name__)
 
@@ -88,7 +89,7 @@ MID_FILENAME: str = ".llmcache_key"
 SALT_PREFIX: str = "salt:"
 
 # C-06: persisted AES key — survives machine-id changes after first run
-_KEY_FILE: Path = Path.home() / LLMCACHE_DIRNAME / "opt-key.bin"
+_KEY_FILE = DynamicStatePath("opt-key.bin")
 
 _FORBIDDEN_MEMORY_TABLES: frozenset[str] = frozenset({
     "memories", "atomic_facts", "profiles", "canonical_entities",
@@ -198,7 +199,7 @@ class CacheDB:
 
     def __init__(self, db_path: Path | None = None) -> None:
         if db_path is None:
-            db_path = Path.home() / LLMCACHE_DIRNAME / LLMCACHE_DBNAME
+            db_path = state_path(LLMCACHE_DBNAME)
         self._db_path = Path(db_path)
         self._db_path.parent.mkdir(parents=True, exist_ok=True)
         # If the file exists but is not a valid SQLite database (e.g. user
@@ -285,11 +286,10 @@ class CacheDB:
 
     def _get_machine_id(self) -> str:
         """Return a stable machine identifier for AES key derivation."""
-        system = os.uname().sysname
+        system = platform.system()
         mid: str | None = None
         if system == "Darwin":
             try:
-                import plistlib
                 import subprocess
                 out = subprocess.run(
                     ["ioreg", "-rd1", "-c", "IOPlatformExpertDevice"],
@@ -310,7 +310,7 @@ class CacheDB:
             except OSError:
                 mid = None
         if not mid:
-            mid_file = Path.home() / LLMCACHE_DIRNAME / MID_FILENAME
+            mid_file = state_path(MID_FILENAME)
             if mid_file.exists():
                 try:
                     mid = mid_file.read_text(encoding="utf-8").strip()
@@ -334,9 +334,10 @@ class CacheDB:
         so changing the underlying machine-id string cannot invalidate existing
         cache entries.
         """
+        key_file = Path(_KEY_FILE)
         try:
-            if _KEY_FILE.exists():
-                key = _KEY_FILE.read_bytes()
+            if key_file.exists():
+                key = key_file.read_bytes()
                 if len(key) == 32:
                     return key
         except Exception as exc:
@@ -346,9 +347,9 @@ class CacheDB:
         machine_id = self._get_machine_id()
         key = self._derive_aes_key(machine_id, salt)
         try:
-            _KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
-            _KEY_FILE.write_bytes(key)
-            os.chmod(_KEY_FILE, 0o600)
+            key_file.parent.mkdir(parents=True, exist_ok=True)
+            key_file.write_bytes(key)
+            os.chmod(key_file, 0o600)
         except Exception as exc:
             logger.warning("CacheDB: could not persist AES key (fail-open): %s", exc)
         return key

package/src/superlocalmemory/retrieval/agentic.py

@@ -15,7 +15,7 @@ Design decisions:
 - Mode C: LLM sufficiency judgment with 3-way classification
 
 Part of Qualixar | Author: Varun Pratap Bhardwaj
-License: Elastic-2.0
+License: AGPL-3.0-or-later
 """
 from __future__ import annotations
 

package/src/superlocalmemory/retrieval/ann_index.py

@@ -12,7 +12,7 @@ scale we target (up to 100K facts). At that scale, a single cosine
 scan takes ~5ms on CPU which is well within our latency budget.
 
 Part of Qualixar | Author: Varun Pratap Bhardwaj
-License: Elastic-2.0
+License: AGPL-3.0-or-later
 """
 
 from __future__ import annotations

package/src/superlocalmemory/retrieval/bm25_channel.py

@@ -12,7 +12,7 @@ the entire index. This version persists tokens to the DB via
 store_bm25_tokens / get_all_bm25_tokens and cold-loads on init.
 
 Part of Qualixar | Author: Varun Pratap Bhardwaj
-License: Elastic-2.0
+License: AGPL-3.0-or-later
 """
 
 from __future__ import annotations
@@ -23,6 +23,8 @@ from typing import TYPE_CHECKING
 
 from rank_bm25 import BM25Plus
 
+from superlocalmemory.storage.database import _scope_where
+
 if TYPE_CHECKING:
     from superlocalmemory.storage.database import DatabaseManager
 
@@ -72,6 +74,7 @@ class BM25Channel:
         self._bm25: BM25Plus | None = None
         self._dirty: bool = False
         self._loaded_profiles: set[str] = set()
+        self._loaded_scope_key: tuple[str, bool, bool] | None = None
 
     @property
     def document_count(self) -> int:
@@ -82,18 +85,31 @@ class BM25Channel:
 
         Idempotent: subsequent calls for the same profile are no-ops.
         """
-        if profile_id in self._loaded_profiles:
+        include_global = bool(getattr(self, "include_global", False))
+        include_shared = bool(getattr(self, "include_shared", False))
+        scope_key = (profile_id, include_global, include_shared)
+        if scope_key == self._loaded_scope_key:
             return
 
-        token_map = self._db.get_all_bm25_tokens(profile_id)
-        _inc_global = getattr(self, 'include_global', False)
-        _inc_shared = getattr(self, 'include_shared', False)
+        # A legacy in-memory index is a visibility-specific view. Reusing a
+        # corpus warmed under another profile/scope leaks private documents or
+        # omits newly enabled global/shared documents.
+        self._corpus = []
+        self._fact_ids = []
+        self._fact_id_set = set()
+        self._raw_texts = []
+        self._bm25 = None
+        token_map = self._db.get_all_bm25_tokens(
+            profile_id,
+            include_global=include_global,
+            include_shared=include_shared,
+        )
         if not token_map:
             # Fallback: tokenize facts directly if no pre-stored tokens
             facts = self._db.get_all_facts(
                 profile_id,
-                include_global=_inc_global,
-                include_shared=_inc_shared,
+                include_global=include_global,
+                include_shared=include_shared,
             )
             for fact in facts:
                 if fact.fact_id in self._fact_id_set:
@@ -112,8 +128,8 @@ class BM25Channel:
             try:
                 facts = self._db.get_all_facts(
                     profile_id,
-                    include_global=_inc_global,
-                    include_shared=_inc_shared,
+                    include_global=include_global,
+                    include_shared=include_shared,
                 )
                 fact_content_map = {f.fact_id: f.content for f in facts}
             except Exception:
@@ -128,6 +144,7 @@ class BM25Channel:
 
         self._dirty = True
         self._loaded_profiles.add(profile_id)
+        self._loaded_scope_key = scope_key
         logger.debug(
             "BM25 cold-loaded %d documents for profile=%s",
             len(token_map) if token_map else 0, profile_id,
@@ -176,14 +193,20 @@ class BM25Channel:
         # Quote each token so query punctuation can't break FTS5 MATCH syntax;
         # OR-join for high recall (any token may match).
         match_expr = " OR ".join('"' + t.replace('"', "") + '"' for t in tokens)
+        where, params = _scope_where(
+            profile_id,
+            include_global=bool(getattr(self, "include_global", False)),
+            include_shared=bool(getattr(self, "include_shared", False)),
+            prefix="af",
+        )
         sql = (
             "SELECT af.fact_id AS fact_id, bm25(atomic_facts_fts) AS rank "
             "FROM atomic_facts_fts "
             "JOIN atomic_facts af ON af.rowid = atomic_facts_fts.rowid "
-            "WHERE atomic_facts_fts MATCH ? AND af.profile_id = ? "
+            f"WHERE atomic_facts_fts MATCH ? AND {where} "
             "ORDER BY rank LIMIT ?"
         )
-        rows = self._db.execute(sql, (match_expr, profile_id, int(top_k)))
+        rows = self._db.execute(sql, (match_expr, *params, int(top_k)))
         out: list[tuple[str, float]] = []
         for r in rows:
             d = dict(r)
@@ -263,3 +286,4 @@ class BM25Channel:
         self._bm25 = None
         self._dirty = False
         self._loaded_profiles = set()
+        self._loaded_scope_key = None

package/src/superlocalmemory/retrieval/bridge_discovery.py

@@ -22,14 +22,18 @@ Parameters:
 - typed mu: entity=1.2, causal=1.3, semantic=0.8, temporal=0.9
 
 Part of Qualixar | Author: Varun Pratap Bhardwaj
-License: Elastic-2.0
+License: AGPL-3.0-or-later
 """
 from __future__ import annotations
 
 import logging
-import re
 from typing import TYPE_CHECKING
 
+from superlocalmemory.retrieval.scope_policy import (
+    authorized_fact_ids,
+    filter_authorized_results,
+)
+
 if TYPE_CHECKING:
     from superlocalmemory.storage.database import DatabaseManager
 
@@ -64,6 +68,9 @@ class BridgeDiscovery:
         seed_ids: list[str],
         profile_id: str,
         max_bridges: int = 10,
+        *,
+        include_global: bool = False,
+        include_shared: bool = False,
     ) -> list[tuple[str, float]]:
         """Find bridge facts connecting seed results.
 
@@ -78,13 +85,36 @@ class BridgeDiscovery:
         if len(seed_ids) < 2:
             return []
 
+        allowed_seeds = authorized_fact_ids(
+            self._db,
+            seed_ids,
+            profile_id,
+            include_global=include_global,
+            include_shared=include_shared,
+        )
+        if any(seed_id not in allowed_seeds for seed_id in seed_ids):
+            return []
+
+        try:
+            visible_seed_facts = self._db.get_facts_by_ids(
+                seed_ids,
+                profile_id,
+                include_global=include_global,
+                include_shared=include_shared,
+            )
+        except Exception:
+            return []
+        seed_facts = {fact.fact_id: fact for fact in visible_seed_facts}
+        if any(seed_id not in seed_facts for seed_id in seed_ids):
+            return []
+
         bridges: list[tuple[str, float]] = []
         seen = set(seed_ids)
 
         # Check consecutive pairs for entity overlap
         for i in range(len(seed_ids) - 1):
-            fact_a = self._db.get_fact(seed_ids[i])
-            fact_b = self._db.get_fact(seed_ids[i + 1])
+            fact_a = seed_facts.get(seed_ids[i])
+            fact_b = seed_facts.get(seed_ids[i + 1])
             if not fact_a or not fact_b:
                 continue
 
@@ -98,7 +128,12 @@ class BridgeDiscovery:
             # Strategy 1: Entity bridge (union minus intersection)
             bridge_entities = (entities_a | entities_b) - (entities_a & entities_b)
             for eid in bridge_entities:
-                entity_facts = self._db.get_facts_by_entity(eid, profile_id)
+                entity_facts = self._db.get_facts_by_entity(
+                    eid,
+                    profile_id,
+                    include_global=include_global,
+                    include_shared=include_shared,
+                )
                 for f in entity_facts[:5]:
                     if f.fact_id not in seen:
                         seen.add(f.fact_id)
@@ -112,7 +147,13 @@ class BridgeDiscovery:
                 break
 
         bridges.sort(key=lambda x: x[1], reverse=True)
-        return bridges[:max_bridges]
+        return filter_authorized_results(
+            self._db,
+            bridges,
+            profile_id,
+            include_global=include_global,
+            include_shared=include_shared,
+        )[:max_bridges]
 
     def spreading_activation(
         self,
@@ -120,6 +161,9 @@ class BridgeDiscovery:
         profile_id: str,
         max_depth: int = _MAX_DEPTH,
         budget: int = _NODE_BUDGET,
+        *,
+        include_global: bool = False,
+        include_shared: bool = False,
     ) -> list[tuple[str, float]]:
         """Spreading activation from seed facts through the graph.
 
@@ -135,6 +179,16 @@ class BridgeDiscovery:
         Returns:
             List of (fact_id, activation_score) for activated facts.
         """
+        allowed_seeds = authorized_fact_ids(
+            self._db,
+            seed_ids,
+            profile_id,
+            include_global=include_global,
+            include_shared=include_shared,
+        )
+        if any(seed_id not in allowed_seeds for seed_id in seed_ids):
+            return []
+
         activations: dict[str, float] = {fid: 1.0 for fid in seed_ids}
         frontier = list(seed_ids)
 
@@ -145,7 +199,12 @@ class BridgeDiscovery:
                 if current_activation < 0.01:
                     continue
 
-                edges = self._db.get_edges_for_node(fid, profile_id)
+                edges = self._db.get_edges_for_node(
+                    fid,
+                    profile_id,
+                    include_global=include_global,
+                    include_shared=include_shared,
+                )
                 for edge in edges:
                     other_id = (
                         edge.target_id
@@ -171,4 +230,10 @@ class BridgeDiscovery:
             if fid not in set(seed_ids) and score > 0.01
         ]
         results.sort(key=lambda x: x[1], reverse=True)
-        return results[:budget]
+        return filter_authorized_results(
+            self._db,
+            results,
+            profile_id,
+            include_global=include_global,
+            include_shared=include_shared,
+        )[:budget]