superlocalmemory 3.7.6 → 3.7.8

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to SuperLocalMemory V3 will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.7.8] - 2026-07-20 — Profile-isolation leak fix, loopback auth opt-in, hardening
+
+### Fixed
+
+- **Cross-profile recall leak (critical).** After a profile switch, the dashboard Chat, memory-facts, and cluster-summary routes read from a long-lived `WorkerPool` subprocess that cached the previous profile for up to 120 seconds, so those views could return the prior profile's memories while the UI reported the new one. Those routes now read the daemon's resident, lease-protected engine — which `commit_daemon_profile_switch` rebinds synchronously on every switch, exactly as the `/recall` and `/remember` endpoints already do — so recall always reflects the current profile. Added full-daemon isolation regression tests that store under one profile, switch, and assert the other profile's data is never returned.
+- Removed a dead consolidation-trigger fast path (`WorkerPool.send_command`, a method that never existed and silently fell through on every call) and placed the remaining direct-consolidation path under the profile-runtime lease so a concurrent switch cannot commit mid-consolidation.
+- The MCP `switch_profile` tool now synchronizes local engine state only to the profile the daemon actually acknowledged, and re-validates that the profile exists locally before adopting it, instead of trusting the response body.
+
+### Added
+
+- `SLM_REQUIRE_API_KEY_LOOPBACK` opt-in. When set together with a configured `api_key` file, uncredentialed loopback writes must also present a matching `X-SLM-API-Key`, restoring the strict posture for shared-host operators. Default behavior is unchanged (local-first): the flag is a no-op unless explicitly enabled. This is a single, explicit control rather than overloading "an api_key file exists" with two meanings — the overload that caused the 3.7.6 write-auth regressions.
+
+### Changed
+
+- Removed the dead `V32_VEC0_DDL` schema constant and retired the now-inert unconditional `check_api_key` write gate (repurposed as the sole enforcement point for the loopback opt-in). The legacy `api.py`/`ui.py` app factories are documented as not served by the daemon.
+
+## [3.7.7] - 2026-07-20 — Profile isolation and runtime integrity
+
+### Fixed
+
+- Fixes daemon-aware profile switching and profile-isolated CLI reads/writes. Profile transitions now drain admitted operations, atomically rebind the resident engine, persist only after a successful transition, and return a generation-stamped acknowledgement to CLI, dashboard/API, and MCP callers without restarting the daemon.
+- Dashboard mode, provider, embedding, and memory-visibility changes now take effect through the same daemon-owned runtime transition boundary. Existing custom embedding settings survive setup-mode changes, and Optimize cache vectors follow the configured embedding dimension instead of assuming 768 dimensions.
+- Migration reconciliation now accepts only explicitly allowlisted historical hashes and verifies the complete required schema before updating migration metadata; unknown or structurally incomplete drift fails closed.
+- Restored cross-platform UI test discovery and added dependency and high-severity static security gates to CI.
+- Upgraded the audited web, MCP, cryptography, and Transformers dependency stack to patched releases. Three narrowly scoped NLTK, setuptools, and PyTorch advisories are tracked as exact, dated exceptions; PyTorch remains on the proven 2.11 runtime because the combined native/ML upgrade produced a full-suite process crash and could not be attributed safely to one package.
+
+### Added
+
+- Dashboard controls and API/CLI configuration support for the default write scope and explicit shared/global recall opt-ins. Personal-only recall remains the default.
+
 ## [3.7.6] - 2026-07-19 — Auth, upgrade, and embedding-dimension fixes
 
 ### Fixed

package/README.md

@@ -5,10 +5,10 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.7.5</h1>
+<h1 align="center">SuperLocalMemory V3.7.8</h1>
 <p align="center"><strong>Cache. Compress. Remember. Three surfaces — proxy, MCP tools, or skill. Every setup covered.</strong><br/>
 <em>Local-first agent memory with explicit operating modes, auditable retrieval, and optional Optimize tools.</em></p>
-<p align="center"><code>v3.7.5</code> — <strong>Scale Engine graph and vector projection parity, durable promotion recovery, and honest runtime status.</strong><br/>
+<p align="center"><code>v3.7.8</code> — <strong>Profile-isolation leak fix, opt-in loopback write auth, and fresh-install acceptance verification.</strong><br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 public research preprints</strong> (arXiv + Zenodo archives) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.7.6",
+  "version": "3.7.8",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",
@@ -51,7 +51,7 @@
     "prepack": "node scripts/build-plugin.mjs && node scripts/prepack.js",
     "postinstall": "node scripts/postinstall.js",
     "preuninstall": "node scripts/preuninstall.js",
-    "test": "node --test 'tests/ui/*.mjs'"
+    "test": "node scripts/run-ui-tests.mjs"
   },
   "engines": {
     "node": ">=18.0.0",

package/plugin/.claude-plugin/plugin.json

@@ -16,5 +16,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.7.6"
+  "version": "3.7.8"
 }

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.7.6
+superlocalmemory==3.7.8

package/plugin-src/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.7.6",
+  "version": "3.7.8",
   "pluginName": "superlocalmemory",
   "displayName": "SuperLocalMemory",
   "repository": "https://github.com/qualixar/superlocalmemory",

package/plugin-src/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.7.6
+superlocalmemory==3.7.8

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "3.7.6"
+version = "3.7.8"
 description = "Local-first agent memory with auditable hybrid retrieval"
 readme = "README.md"
 license = "AGPL-3.0-or-later"
@@ -37,12 +37,12 @@ dependencies = [
     "numpy==2.4.4",
     "scipy==1.17.1",
     "networkx==3.6.1",
-    "mcp==1.27.1",
+    "mcp==1.28.1",
     "python-dateutil==2.9.0.post0",
     "rank-bm25==0.2.2",
     "vadersentiment==3.3.2",
     "einops==0.8.2",
-    "fastapi[all]==0.136.1",
+    "fastapi[all]==0.139.2",
     "uvicorn==0.46.0",
     "websockets==16.0",
     "zeroconf>=0.140",
@@ -59,7 +59,7 @@ dependencies = [
     "psutil==7.2.2",
     "structlog==25.5.0",
     "portalocker==3.2.0",
-    "cryptography==45.0.2",
+    "cryptography==48.0.1",
     # Semantic search + cross-encoder reranker. Do NOT use
     # sentence-transformers[onnx] — its extras pull optimum which
     # overrides the sentence-transformers pin via transitive deps.
@@ -67,8 +67,8 @@ dependencies = [
     "sentence-transformers==5.3.0",
     "optimum==2.1.0",
     "onnxruntime==1.24.4",
-    "transformers==4.57.6",
-    "huggingface_hub==0.36.2",
+    "transformers==5.5.4",
+    "huggingface_hub==1.5.0",
     "torch==2.11.0",
     "scikit-learn==1.8.0",
     # Vector KNN extension for the semantic channel.
@@ -97,7 +97,6 @@ search = [
     "einops==0.8.2",
     "torch==2.11.0",
     "scikit-learn==1.8.0",
-    "geoopt>=0.5.0",
     "onnxruntime==1.24.4",
 ]
 ui = [

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "3.7.6"
+__version__ = "3.7.8"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/cli/commands.py

@@ -612,6 +612,8 @@ def cmd_config(args: Namespace) -> None:
             "evolution.enabled", "evolution.backend", "evolution.max_evolutions_per_cycle",
             "mesh_enabled", "daemon_idle_timeout", "entity_compilation_enabled",
             "graph_backend", "vector_backend", "scale_engine_state",
+            "scope.default_scope", "scope.recall_include_global",
+            "scope.recall_include_shared",
         }
         if key not in _ALLOWED_CONFIG_KEYS:
             if use_json:
@@ -650,6 +652,60 @@ def cmd_config(args: Namespace) -> None:
                 except ValueError:
                     parsed_value = value
 
+        if key == "scope.default_scope" and parsed_value not in {
+            "personal", "shared", "global",
+        }:
+            message = "scope.default_scope must be personal, shared, or global"
+            if use_json:
+                from superlocalmemory.cli.json_output import json_print
+                json_print("config", error={
+                    "code": "INVALID_VALUE", "message": message,
+                })
+            else:
+                print(f"Error: {message}")
+            sys.exit(1)
+        if key in {
+            "scope.recall_include_global", "scope.recall_include_shared",
+        } and not isinstance(parsed_value, bool):
+            message = f"{key} must be true or false"
+            if use_json:
+                from superlocalmemory.cli.json_output import json_print
+                json_print("config", error={
+                    "code": "INVALID_VALUE", "message": message,
+                })
+            else:
+                print(f"Error: {message}")
+            sys.exit(1)
+
+        if key.startswith("scope."):
+            from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
+
+            if is_daemon_running():
+                field = key.split(".", 1)[1]
+                result = daemon_request(
+                    "PUT", "/api/v3/scope/config", {field: parsed_value},
+                )
+                if not isinstance(result, dict) or result.get("success") is not True:
+                    message = "resident daemon rejected the scope configuration"
+                    if use_json:
+                        from superlocalmemory.cli.json_output import json_print
+                        json_print("config", error={
+                            "code": "CONFIG_APPLY_FAILED", "message": message,
+                        })
+                    else:
+                        print(f"Error: {message}")
+                    sys.exit(1)
+                old_value = None
+                if use_json:
+                    from superlocalmemory.cli.json_output import json_print
+                    json_print("config", data={
+                        "key": key, "old_value": old_value,
+                        "new_value": result.get(field), "runtime": "daemon",
+                    })
+                else:
+                    print(f"{key}: applied to resident daemon -> {result.get(field)}")
+                return
+
         # Set via dot-notation (e.g. "evolution.enabled" -> cfg["evolution"]["enabled"])
         parts = key.split(".")
         node = cfg
@@ -1579,10 +1635,47 @@ def cmd_status(args: Namespace) -> None:
     from superlocalmemory.core.config import SLMConfig
 
     config = SLMConfig.load()
+    daemon_status = None
+    try:
+        from superlocalmemory.cli.daemon import (
+            daemon_request,
+            is_daemon_running,
+        )
+
+        if is_daemon_running():
+            candidate = daemon_request("GET", "/status")
+            if isinstance(candidate, dict) and candidate.get("profile"):
+                daemon_status = candidate
+    except Exception:
+        logger.debug(
+            "cmd_status: daemon runtime status unavailable; using offline view",
+            exc_info=True,
+        )
 
     if getattr(args, 'json', False):
         from superlocalmemory.cli.json_output import json_print
 
+        if daemon_status is not None:
+            data = {
+                "mode": str(daemon_status.get("mode", "unknown")).upper(),
+                "provider": daemon_status.get("provider", "none"),
+                "profile": daemon_status["profile"],
+                "base_dir": daemon_status.get("base_dir", str(config.base_dir)),
+                "db_path": daemon_status.get("db_path", str(config.db_path)),
+                "db_size_mb": float(daemon_status.get("db_size_mb", 0.0)),
+                "fact_count": int(daemon_status.get("fact_count", 0)),
+                "entity_count": int(daemon_status.get("entity_count", 0)),
+                "edge_count": int(daemon_status.get("edge_count", 0)),
+                "profile_generation": int(
+                    daemon_status.get("profile_generation", 0)
+                ),
+            }
+            json_print("status", data=data, next_actions=[
+                {"command": "slm health --json", "description": "Check math layer health"},
+                {"command": "slm list --json", "description": "List recent memories"},
+            ])
+            return
+
         # WP-02 D8: canonical key set — db_size_mb always present (0.0 if absent).
         db_size_mb = 0.0
         if config.db_path.exists():
@@ -1635,6 +1728,7 @@ def cmd_status(args: Namespace) -> None:
             "fact_count": fact_count,
             "entity_count": entity_count,
             "edge_count": edge_count,
+            "profile_generation": 0,
         }
         json_print("status", data=data, next_actions=[
             {"command": "slm health --json", "description": "Check math layer health"},
@@ -1645,6 +1739,10 @@ def cmd_status(args: Namespace) -> None:
     print("SuperLocalMemory V3")
     print(f"  Mode: {config.mode.value.upper()}")
     print(f"  Provider: {config.llm.provider or 'none'}")
+    print(
+        f"  Profile: "
+        f"{daemon_status.get('profile') if daemon_status else config.active_profile}"
+    )
     print(f"  Base dir: {config.base_dir}")
     print(f"  Database: {config.db_path}")
     if config.db_path.exists():
@@ -1901,7 +1999,7 @@ def cmd_doctor(args: Namespace) -> None:
 
     # 3. Search deps
     search_mods = {"sentence_transformers": "sentence-transformers", "torch": "torch",
-                   "sklearn": "scikit-learn", "geoopt": "geoopt"}
+                   "sklearn": "scikit-learn"}
     search_ok = []
     for mod, pkg in search_mods.items():
         try:
@@ -1910,7 +2008,7 @@ def cmd_doctor(args: Namespace) -> None:
         except Exception:  # dependency import may fail after module discovery
             pass
     if len(search_ok) == len(search_mods):
-        _check("Search deps", "PASS", "sentence-transformers, torch, sklearn, geoopt")
+        _check("Search deps", "PASS", "sentence-transformers, torch, sklearn")
     else:
         missing = set(search_mods) - set(search_ok)
         _check("Search deps", "WARN", f"Missing: {', '.join(missing)}",
@@ -2522,6 +2620,42 @@ def cmd_dashboard(args: Namespace) -> None:
 # -- Profiles (supports --json) -------------------------------------------
 
 
+def _switch_profile_runtime(config, profile_name: str) -> dict:
+    """Switch through the resident daemon, or persist an offline fallback."""
+    from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
+
+    if is_daemon_running():
+        result = daemon_request(
+            "POST",
+            f"/api/profiles/{profile_name}/switch",
+        )
+        if not result or not result.get("success"):
+            raise RuntimeError(
+                "resident daemon did not acknowledge the profile switch"
+            )
+        acknowledged = str(result.get("active_profile", ""))
+        if acknowledged != profile_name:
+            raise RuntimeError(
+                "resident daemon acknowledged a different active profile"
+            )
+        return {
+            "action": "switched",
+            "profile": acknowledged,
+            "generation": int(result.get("generation", 0)),
+            "runtime": "daemon",
+        }
+
+    from superlocalmemory.server.profile_runtime import persist_active_profile
+
+    persist_active_profile(profile_name)
+    config.active_profile = profile_name
+    return {
+        "action": "switched",
+        "profile": profile_name,
+        "runtime": "offline",
+    }
+
+
 def cmd_profile(args: Namespace) -> None:
     """Profile management (list, switch, create).
 
@@ -2532,7 +2666,7 @@ def cmd_profile(args: Namespace) -> None:
     from superlocalmemory.storage.database import DatabaseManager
     from superlocalmemory.storage import schema
     from superlocalmemory.server.routes.helpers import (
-        ensure_profile_in_json, set_active_profile_everywhere,
+        ensure_profile_in_json,
     )
 
     config = SLMConfig.load()
@@ -2552,10 +2686,25 @@ def cmd_profile(args: Namespace) -> None:
                            {"command": "slm profile switch <name> --json", "description": "Switch profile"},
                        ])
         elif args.action == "switch":
-            set_active_profile_everywhere(args.name)
-            config.active_profile = args.name
-            config.save()
-            json_print("profile", data={"action": "switched", "profile": args.name})
+            rows = db.execute(
+                "SELECT 1 FROM profiles WHERE profile_id = ?",
+                (args.name,),
+            )
+            if not rows:
+                json_print("profile", error={
+                    "code": "PROFILE_NOT_FOUND",
+                    "message": f"Profile '{args.name}' does not exist.",
+                })
+                sys.exit(1)
+            try:
+                result = _switch_profile_runtime(config, args.name)
+            except Exception as exc:
+                json_print("profile", error={
+                    "code": "PROFILE_SWITCH_FAILED",
+                    "message": str(exc),
+                })
+                sys.exit(1)
+            json_print("profile", data=result)
         elif args.action == "create":
             db.execute(
                 "INSERT OR IGNORE INTO profiles (profile_id, name) VALUES (?, ?)",
@@ -2576,10 +2725,21 @@ def cmd_profile(args: Namespace) -> None:
             d = dict(r)
             print(f"  - {d['profile_id']}: {d.get('name', '')}")
     elif args.action == "switch":
-        set_active_profile_everywhere(args.name)
-        config.active_profile = args.name
-        config.save()
-        print(f"Switched to profile: {args.name}")
+        rows = db.execute(
+            "SELECT 1 FROM profiles WHERE profile_id = ?",
+            (args.name,),
+        )
+        if not rows:
+            print(f"Profile '{args.name}' does not exist.", file=sys.stderr)
+            sys.exit(1)
+        try:
+            result = _switch_profile_runtime(config, args.name)
+        except Exception as exc:
+            print(f"Profile switch failed: {exc}", file=sys.stderr)
+            sys.exit(1)
+        generation = result.get("generation")
+        suffix = f" (generation {generation})" if generation is not None else ""
+        print(f"Switched to profile: {args.name}{suffix}")
     elif args.action == "create":
         db.execute(
             "INSERT OR IGNORE INTO profiles (profile_id, name) VALUES (?, ?)",

package/src/superlocalmemory/cli/setup_wizard.py

@@ -251,6 +251,23 @@ def _embedding_is_remote(config: Any) -> bool:
     return provider in ("openai", "openai-compatible", "remote") or bool(endpoint)
 
 
+def _build_wizard_config(mode):
+    """Apply mode-owned presets without erasing existing user-owned blocks."""
+    from superlocalmemory.core.config import SLMConfig
+    from superlocalmemory.infra.data_root import state_path
+
+    template = SLMConfig.for_mode(mode)
+    if not state_path("config.json").exists():
+        return template
+    existing = SLMConfig.load()
+    existing.mode = mode
+    existing.llm = template.llm
+    existing.retrieval = template.retrieval
+    existing.math = template.math
+    existing.channel_weights = template.channel_weights
+    return existing
+
+
 # ---------------------------------------------------------------------------
 # Verification
 # ---------------------------------------------------------------------------
@@ -397,7 +414,7 @@ def run_wizard(auto: bool = False) -> None:
     from superlocalmemory.storage.models import Mode
 
     mode_map = {"a": Mode.A, "b": Mode.B, "c": Mode.C}
-    config = SLMConfig.for_mode(mode_map[choice])
+    config = _build_wizard_config(mode_map[choice])
 
     # -- Multi-scope (shared memory) opt-in — v3.6.15 --
     # OFF by default: your memories stay private to this profile (3.6.14 behaviour).

package/src/superlocalmemory/infra/auth_middleware.py

@@ -1,12 +1,12 @@
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later - see LICENSE file
 # Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
-"""Opt-in API-key authentication middleware.
+"""API-key primitives used by the unified identity boundary.
 
-When ``~/.superlocalmemory/api_key`` exists, write endpoints require the
-``X-SLM-API-Key`` header.  Read endpoints remain open for backward
-compatibility.  If the key file is absent auth is completely disabled --
-all requests pass.
+A configured key authorizes remote callers that present ``X-SLM-API-Key``.
+The unified daemon separately trusts exact-process capabilities, the
+same-origin dashboard install token, and uncredentialed loopback peers as the
+local OS-user boundary. Read endpoints remain open for backward compatibility.
 
 V3 change: base directory moved from ``~/.claude-memory/`` to
 ``~/.superlocalmemory/``.
@@ -15,6 +15,7 @@ V3 change: base directory moved from ``~/.claude-memory/`` to
 import hashlib
 import hmac
 import logging
+import os
 from pathlib import Path
 from typing import Optional
 
@@ -26,6 +27,13 @@ logger = logging.getLogger("superlocalmemory.auth")
 MEMORY_DIR = DynamicStatePath()
 API_KEY_FILE = DynamicStatePath("api_key")
 
+# v3.7.8 (F1): opt-in env flag that restores the pre-v3.7.6 shared-host
+# posture -- when set AND an api_key file is configured, uncredentialed
+# loopback writes must also present a matching X-SLM-API-Key. Default OFF
+# preserves the v3.7.6 local-first fix (#71/#73/#74): loopback callers are
+# trusted as the local OS-user boundary without needing any credential.
+SLM_REQUIRE_API_KEY_LOOPBACK_ENV = "SLM_REQUIRE_API_KEY_LOOPBACK"
+
 
 def _load_api_key_hash(key_file: Optional[Path] = None) -> Optional[str]:
     """Load and hash the API key from disk.
@@ -96,6 +104,26 @@ def verify_api_key(
     return hmac.compare_digest(actual, expected)
 
 
+def loopback_strict_mode_enabled(key_file: Optional[Path] = None) -> bool:
+    """Whether uncredentialed loopback writes must present the API key.
+
+    v3.7.8 (F1/F2): opt-in via ``SLM_REQUIRE_API_KEY_LOOPBACK`` (any of
+    "1"/"true"/"yes"/"on", case-insensitive). This is the sole enforcement
+    point for the strict shared-host posture -- it is checked ONLY for the
+    uncredentialed-loopback case (a caller presenting none of
+    X-SLM-Daemon-Capability / X-Install-Token / X-SLM-API-Key). Callers who
+    already present a valid capability or install token are unaffected: those
+    are stronger, explicit credentials and this flag never re-litigates them.
+
+    Returns ``False`` (no-op) when the flag is unset/false, OR when no
+    api_key file is configured -- there is nothing to require in that case.
+    """
+    raw = os.environ.get(SLM_REQUIRE_API_KEY_LOOPBACK_ENV, "")
+    if raw.strip().lower() not in ("1", "true", "yes", "on"):
+        return False
+    return _load_api_key_hash(key_file) is not None
+
+
 def authorize_http_mcp_request(
     request_headers: dict,
     *,

package/src/superlocalmemory/mcp/_daemon_proxy.py

@@ -17,10 +17,8 @@ engine state exists in exactly one process: the daemon.
 """
 from __future__ import annotations
 
-import json
 import logging
 import urllib.parse
-import urllib.request
 from typing import Any
 
 logger = logging.getLogger(__name__)
@@ -40,9 +38,6 @@ class DaemonPoolProxy:
         self._port = port
         self._timeout = timeout_s
 
-    def _url(self, path: str) -> str:
-        return f"http://127.0.0.1:{self._port}{path}"
-
     def recall(
         self, query: str, limit: int = 10, session_id: str = "",
         fast: bool = False,
@@ -64,15 +59,18 @@ class DaemonPoolProxy:
             _params["include_shared"] = "true" if include_shared else "false"
         params = urllib.parse.urlencode(_params)
         try:
-            with urllib.request.urlopen(
-                self._url(f"/recall?{params}"), timeout=self._timeout,
-            ) as resp:
-                data = json.loads(resp.read().decode() or "{}")
+            from superlocalmemory.cli.daemon import daemon_request
+
+            data = daemon_request(
+                "GET",
+                f"/recall?{params}",
+                timeout_seconds=self._timeout,
+            )
         except Exception as exc:
             logger.warning("daemon /recall failed: %s", exc)
             return {"ok": False, "error": str(exc)}
         if not isinstance(data, dict):
-            return {"ok": False, "error": "non-dict response"}
+            return {"ok": False, "error": "owned daemon unavailable"}
         data.setdefault("ok", True)
         return data
 

package/src/superlocalmemory/mcp/server.py

@@ -89,6 +89,7 @@ _ESSENTIAL_TOOLS: set[str] = {
     # Core memory operations (8)
     "remember", "recall", "search", "fetch",
     "list_recent", "delete_memory", "update_memory", "get_status",
+    "switch_profile",
     # Session lifecycle (3)
     "session_init", "observe", "close_session",
     # Feedback / learning signals — reachable Dash-Core path for