superlocalmemory 3.7.6 → 3.7.8

package/src/superlocalmemory/mcp/tools_core.py

@@ -25,6 +25,27 @@ from superlocalmemory.mcp.shared import authorize_mcp_mutation
 
 logger = logging.getLogger(__name__)
 
+
+async def _runtime_profile(get_engine: Callable, explicit: str = "") -> str:
+    """Resolve an MCP default profile from daemon runtime truth."""
+    if explicit:
+        return explicit
+    import asyncio
+
+    try:
+        from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
+
+        if await asyncio.to_thread(is_daemon_running):
+            status = await asyncio.to_thread(daemon_request, "GET", "/status")
+            if isinstance(status, dict) and status.get("profile"):
+                return str(status["profile"])
+            raise RuntimeError("resident daemon did not report its active profile")
+    except RuntimeError:
+        raise
+    except Exception as exc:
+        logger.debug("daemon profile resolution failed: %s", exc)
+    return str(get_engine().profile_id)
+
 def _emit_event(event_type: str, payload: dict | None = None,
                 source_agent: str = "mcp_client") -> None:
     """Emit an event to the EventBus (best-effort, never raises)."""
@@ -42,6 +63,7 @@ def _record_recall_hits(
     query: str,
     results: list[dict],
     *,
+    profile_id: str = "",
     query_id: str = "",
     fact_ids_candidates: list[str] | None = None,
 ) -> None:
@@ -63,7 +85,7 @@ def _record_recall_hits(
         )
 
         engine = get_engine()
-        pid = engine.profile_id
+        pid = profile_id or engine.profile_id
         slm_dir = canonical_data_root()
 
         shown_ids = [r.get("fact_id", "") for r in results[:10]
@@ -335,7 +357,12 @@ def register_core_tools(server, get_engine: Callable) -> None:
             if result.get("ok"):
                 # Record implicit feedback: every returned result is a recall_hit
                 try:
-                    _record_recall_hits(get_engine, query, result.get("results", []))
+                    _record_recall_hits(
+                        get_engine,
+                        query,
+                        result.get("results", []),
+                        profile_id=str(result.get("profile", "")),
+                    )
                 except Exception:
                     pass  # Feedback is non-critical, never block recall
                 _emit_event("memory.recalled", {
@@ -370,7 +397,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
         """Full-text search across memories using FTS5 with BM25 ranking."""
         try:
             engine = get_engine()
-            pid = profile_id or engine.profile_id
+            pid = await _runtime_profile(get_engine, profile_id)
             facts = engine._db.search_facts_fts(query, pid, limit=limit)
             items = []
             for f in facts:
@@ -392,7 +419,8 @@ def register_core_tools(server, get_engine: Callable) -> None:
         try:
             engine = get_engine()
             ids = [fid.strip() for fid in fact_ids.split(",") if fid.strip()]
-            facts = engine._db.get_facts_by_ids(ids, engine.profile_id)
+            pid = await _runtime_profile(get_engine)
+            facts = engine._db.get_facts_by_ids(ids, pid)
             items = []
             for f in facts:
                 items.append({
@@ -417,7 +445,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
         """List most recently stored memories, newest first."""
         try:
             engine = get_engine()
-            pid = profile_id or engine.profile_id
+            pid = await _runtime_profile(get_engine, profile_id)
             # v3.6.12 (search-2): push the limit into the query — was loading the
             # ENTIRE facts table (deserializing every 768-float embedding) just
             # to return the top N. get_all_facts preserves created_at DESC order.
@@ -440,7 +468,37 @@ def register_core_tools(server, get_engine: Callable) -> None:
     async def get_status() -> dict:
         """Get memory system status: fact count, entity count, mode, profile, db size."""
         try:
+            import asyncio
             import os
+
+            from superlocalmemory.cli.daemon import (
+                daemon_request,
+                is_daemon_running,
+            )
+
+            if await asyncio.to_thread(is_daemon_running):
+                daemon_status = await asyncio.to_thread(
+                    daemon_request,
+                    "GET",
+                    "/status",
+                )
+                if isinstance(daemon_status, dict) and daemon_status.get("profile"):
+                    return {
+                        "success": True,
+                        "mode": daemon_status.get("mode", "unknown"),
+                        "provider": daemon_status.get("provider", "none"),
+                        "profile": daemon_status["profile"],
+                        "base_dir": daemon_status.get("base_dir", ""),
+                        "db_path": daemon_status.get("db_path", ""),
+                        "db_size_mb": float(daemon_status.get("db_size_mb", 0.0)),
+                        "fact_count": int(daemon_status.get("fact_count", 0)),
+                        "entity_count": int(daemon_status.get("entity_count", 0)),
+                        "edge_count": int(daemon_status.get("edge_count", 0)),
+                        "profile_generation": int(
+                            daemon_status.get("profile_generation", 0)
+                        ),
+                    }
+
             engine = get_engine()
             pid = engine.profile_id
             fact_count = engine._db.get_fact_count(pid)
@@ -474,6 +532,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 "fact_count": fact_count,
                 "entity_count": entity_count,
                 "edge_count": edge_count,
+                "profile_generation": 0,
             }
         except Exception as exc:
             logger.exception("get_status failed")
@@ -484,7 +543,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
         """Rebuild knowledge graph edges for all facts in the active profile."""
         try:
             engine = get_engine()
-            pid = profile_id or engine.profile_id
+            pid = await _runtime_profile(get_engine, profile_id)
             authorization = authorize_mcp_mutation(
                 engine,
                 "update",
@@ -511,6 +570,8 @@ def register_core_tools(server, get_engine: Callable) -> None:
     async def switch_profile(profile_id: str) -> dict:
         """Switch the active memory profile. All operations scope to this profile."""
         try:
+            import asyncio
+
             engine = get_engine()
             old = engine.profile_id
             authorization = authorize_mcp_mutation(
@@ -520,18 +581,95 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 profile_id=profile_id,
                 content_preview=f"{old} -> {profile_id}",
             )
-            engine.profile_id = profile_id
+            from superlocalmemory.cli.daemon import (
+                daemon_request,
+                is_daemon_running,
+            )
 
-            # Persist to both config stores so CLI and Dashboard stay in sync
-            try:
-                from superlocalmemory.server.routes.helpers import (
-                    ensure_profile_in_db, set_active_profile_everywhere,
+            generation = 0
+            # Only the profile_id explicitly confirmed by this process
+            # (daemon-acknowledged + locally-validated, or locally
+            # validated directly) is ever synced into engine state.
+            confirmed_profile_id = None
+            if await asyncio.to_thread(is_daemon_running):
+                result = await asyncio.to_thread(
+                    daemon_request,
+                    "POST",
+                    f"/api/profiles/{profile_id}/switch",
+                )
+                if not result or not result.get("success"):
+                    return {
+                        "success": False,
+                        "error": "resident daemon rejected the profile switch",
+                    }
+                acknowledged = str(result.get("active_profile", ""))
+                if not acknowledged or acknowledged != profile_id:
+                    return {
+                        "success": False,
+                        "error": "resident daemon acknowledged a different profile",
+                    }
+                # Local consistency guard (SEC-H-01): the daemon's HTTP
+                # acknowledgement alone is not sufficient — this MCP
+                # process must also confirm the profile exists in its
+                # own local DB handle before syncing local state to it.
+                # Mirrors the existence check the no-daemon branch already
+                # performs below.
+                local_rows = engine._db.execute(
+                    "SELECT 1 FROM profiles WHERE profile_id = ?",
+                    (profile_id,),
+                )
+                if not local_rows:
+                    return {
+                        "success": False,
+                        "error": (
+                            f"resident daemon acknowledged profile "
+                            f"'{acknowledged}' but it does not exist in "
+                            f"this process's local profile store"
+                        ),
+                    }
+                generation = int(result.get("generation", 0))
+                # Sync target is the DAEMON-CONFIRMED value, never the raw
+                # caller-supplied profile_id, even though they are equal
+                # here by construction (checked above).
+                confirmed_profile_id = acknowledged
+            else:
+                rows = engine._db.execute(
+                    "SELECT 1 FROM profiles WHERE profile_id = ?",
+                    (profile_id,),
+                )
+                if not rows:
+                    return {
+                        "success": False,
+                        "error": f"Profile '{profile_id}' does not exist.",
+                    }
+                from superlocalmemory.server.profile_runtime import (
+                    persist_active_profile,
                 )
-                ensure_profile_in_db(profile_id)
-                set_active_profile_everywhere(profile_id)
-            except ImportError:
-                # Dashboard not installed — profile switch still works for MCP/CLI
-                logger.debug("Dashboard routes not available, profile set in engine only")
+
+                persistence = persist_active_profile(profile_id)
+                try:
+                    engine.profile_id = profile_id
+                    engine._config.active_profile = profile_id
+                except BaseException:
+                    engine.profile_id = old
+                    engine._config.active_profile = old
+                    persistence.rollback()
+                    raise
+                confirmed_profile_id = profile_id
+
+            if not confirmed_profile_id:
+                # Defensive: should be unreachable — every path above
+                # either returns an error or sets confirmed_profile_id.
+                return {
+                    "success": False,
+                    "error": "profile switch could not be confirmed",
+                }
+
+            # Synchronize this MCP process only after confirmation
+            # (daemon-acknowledged + locally-validated, or directly
+            # locally-validated in the no-daemon branch above).
+            engine.profile_id = confirmed_profile_id
+            engine._config.active_profile = confirmed_profile_id
 
             # v3.6.12 (search-3): recall/delete run in a separate worker
             # subprocess that caches its engine (and profile_id) at init. Recycle
@@ -547,6 +685,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 "success": True,
                 "previous_profile": old,
                 "current_profile": profile_id,
+                "generation": generation,
             }
         except Exception as exc:
             logger.exception("switch_profile failed")
@@ -569,7 +708,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
         """Get memory usage breakdown by fact type and lifecycle state."""
         try:
             engine = get_engine()
-            pid = engine.profile_id
+            pid = await _runtime_profile(get_engine)
             facts = engine._db.get_all_facts(pid)
             by_type: dict[str, int] = {}
             by_lifecycle: dict[str, int] = {}
@@ -594,11 +733,12 @@ def register_core_tools(server, get_engine: Callable) -> None:
         """Get learned behavioral patterns (interests, refinements, archival habits)."""
         try:
             engine = get_engine()
+            pid = await _runtime_profile(get_engine)
             from superlocalmemory.learning.behavioral import BehavioralPatternStore
             store = BehavioralPatternStore(engine._db.db_path)
             ptype = pattern_type if pattern_type else None
             patterns = store.get_patterns(
-                engine.profile_id, pattern_type=ptype, limit=limit,
+                pid, pattern_type=ptype, limit=limit,
             )
             return {"success": True, "patterns": patterns, "count": len(patterns)}
         except Exception as exc:
@@ -610,18 +750,19 @@ def register_core_tools(server, get_engine: Callable) -> None:
         """Correct or annotate a learned behavioral pattern to improve retrieval."""
         try:
             engine = get_engine()
+            pid = await _runtime_profile(get_engine)
             authorization = authorize_mcp_mutation(
                 engine,
                 "update",
                 mutation_source="mcp-correct-pattern",
-                profile_id=engine.profile_id,
+                profile_id=pid,
                 fact_id=pattern_id,
                 content_preview=correction,
             )
             from superlocalmemory.learning.behavioral import BehavioralPatternStore
             store = BehavioralPatternStore(engine._db.db_path)
             store.record(
-                engine.profile_id,
+                pid,
                 pattern_type="correction",
                 pattern_key=pattern_id,
                 metadata={"correction": correction},
@@ -649,6 +790,34 @@ def register_core_tools(server, get_engine: Callable) -> None:
             from superlocalmemory.mcp.agent_context import get_current_agent_id
             agent_id = get_current_agent_id()
         try:
+            import asyncio
+            import urllib.parse
+
+            from superlocalmemory.cli.daemon import (
+                daemon_request,
+                is_daemon_running,
+            )
+
+            if await asyncio.to_thread(is_daemon_running):
+                path = "/api/memories/" + urllib.parse.quote(fact_id, safe="")
+                result = await asyncio.to_thread(
+                    daemon_request, "DELETE", path,
+                )
+                if isinstance(result, dict) and result.get("success"):
+                    _emit_event("memory.deleted", {
+                        "fact_id": fact_id,
+                        "agent_id": agent_id,
+                    }, source_agent=agent_id)
+                    return {
+                        "success": True, "deleted": fact_id,
+                        "agent_id": agent_id,
+                    }
+                return {
+                    "success": False,
+                    "retryable": True,
+                    "error": "resident daemon rejected the delete operation",
+                }
+
             from superlocalmemory.core.worker_pool import WorkerPool
             pool = WorkerPool.shared()
             result = pool._send({
@@ -691,6 +860,33 @@ def register_core_tools(server, get_engine: Callable) -> None:
         try:
             if not content or not content.strip():
                 return {"success": False, "error": "content cannot be empty"}
+            import asyncio
+            import urllib.parse
+
+            from superlocalmemory.cli.daemon import (
+                daemon_request,
+                is_daemon_running,
+            )
+
+            if await asyncio.to_thread(is_daemon_running):
+                path = "/api/memories/" + urllib.parse.quote(fact_id, safe="")
+                result = await asyncio.to_thread(
+                    daemon_request,
+                    "PATCH",
+                    path,
+                    {"content": content.strip()},
+                )
+                if isinstance(result, dict) and result.get("success"):
+                    return {
+                        "success": True, "fact_id": fact_id,
+                        "content": content.strip(),
+                    }
+                return {
+                    "success": False,
+                    "retryable": True,
+                    "error": "resident daemon rejected the update operation",
+                }
+
             from superlocalmemory.core.worker_pool import WorkerPool
             pool = WorkerPool.shared()
             result = pool._send({

package/src/superlocalmemory/optimize/cache/centroid_store.py

@@ -32,7 +32,6 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 _VARIANCE_FLOOR: float = 1e-6
-_EMBED_DIM: int = 768
 
 # Stage-9 fix: cap the NUMBER of tenants held in memory.  The per-tenant entry
 # caps (WP-A/B) bound depth, but _centroids/_counts grew once per distinct
@@ -59,11 +58,16 @@ class CentroidStore:
     Centroid update rule (Welford running mean — exact, O(1) per update):
         new_centroid = old_centroid * (n / (n+1)) + new_vec * (1 / (n+1))
     """
-    def __init__(self, max_tenants: int = _MAX_TENANTS) -> None:
+    def __init__(
+        self,
+        max_tenants: int = _MAX_TENANTS,
+        embedding_dimension: int | None = None,
+    ) -> None:
         # OrderedDict for O(1) LRU eviction by tenant count.
         self._centroids: "OrderedDict[str, np.ndarray]" = OrderedDict()  # tenant → vec
         self._counts: "OrderedDict[str, int]" = OrderedDict()            # tenant → count
         self._max_tenants = max_tenants
+        self._embedding_dimension = embedding_dimension
         self._lock = threading.RLock()
 
     def _evict_tenants_if_needed(self) -> None:
@@ -89,7 +93,9 @@ class CentroidStore:
             for _entry_id, blob, _ctx_fp in rows:
                 try:
                     vec = np.frombuffer(blob, dtype=np.float32).copy()
-                    if vec.shape[0] == _EMBED_DIM:
+                    if self._embedding_dimension is None:
+                        self._embedding_dimension = int(vec.shape[0])
+                    if vec.shape[0] == self._embedding_dimension:
                         vectors.append(vec)
                 except Exception:
                     continue
@@ -116,7 +122,17 @@ class CentroidStore:
         """
         try:
             vec = new_vector.astype(np.float32)
+            if vec.ndim != 1 or vec.size == 0:
+                return
             with self._lock:
+                if self._embedding_dimension is None:
+                    self._embedding_dimension = int(vec.shape[0])
+                if vec.shape[0] != self._embedding_dimension:
+                    logger.warning(
+                        "CentroidStore.update skipped dimension %d; expected %d",
+                        vec.shape[0], self._embedding_dimension,
+                    )
+                    return
                 if tenant_id not in self._centroids:
                     self._centroids[tenant_id] = vec.copy()
                     self._counts[tenant_id] = 1
@@ -156,6 +172,8 @@ class CentroidStore:
             if centroid is None or count < 5:
                 return False
             q = query_vector.astype(np.float32)
+            if q.shape != centroid.shape:
+                return False
             sim = _cosine_similarity(q, centroid)
             threshold = 1.0 - distance_floor
             if sim < threshold:

package/src/superlocalmemory/optimize/cache/manager.py

@@ -96,6 +96,12 @@ class _LazySemanticEmbedder:
                     self._service = EmbeddingService(SLMConfig.load().embedding)
         return self._service.embed(text)
 
+    @property
+    def dimension(self) -> int:
+        from superlocalmemory.core.config import SLMConfig
+
+        return int(SLMConfig.load().embedding.dimension)
+
     def close(self) -> None:
         service = self._service
         self._service = None
@@ -492,6 +498,7 @@ class CacheManager:
             db=self._db,
             config=optimize_config,
             embedder=desired_embedder,
+            embedding_dimension=getattr(desired_embedder, "dimension", None),
         ))
 
     # ---- core request path ----

package/src/superlocalmemory/optimize/cache/semantic.py

@@ -43,6 +43,7 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+# Backward-compatible exported default; runtime validation uses _embed_dim.
 _EMBED_DIM: int = 768
 _DEFAULT_MAX_TURNS: int = 6
 _DEFAULT_CONTEXT_WINDOW: int = 3
@@ -79,10 +80,13 @@ class VCacheSemantic(SemanticTier):
         config: "OptimizeConfig",
         *,
         embedder: Callable[[str], list[float] | np.ndarray | None] | None = None,
+        embedding_dimension: int | None = None,
     ) -> None:
         self._db = db
         self._config = config
         self._embedder = embedder
+        self._embed_dim = embedding_dimension
+        self._dimension_lock = threading.Lock()
         # TODO(v3.7): when entry_count > 10_000, promote to sqlite-vec. Config flag: semantic_use_vec.
 
         self._boundary_store = BoundaryStore(
@@ -94,7 +98,9 @@ class VCacheSemantic(SemanticTier):
             step=float(getattr(config, "semantic_boundary_step", 0.01)),
             epsilon=float(getattr(config, "semantic_error_target", _DEFAULT_ERROR_TARGET)),
         )
-        self._centroid_store = CentroidStore()
+        self._centroid_store = CentroidStore(
+            embedding_dimension=embedding_dimension,
+        )
         self._context_key_builder = ContextKeyBuilder(
             window_turns=int(getattr(config, "semantic_context_window_turns", _DEFAULT_CONTEXT_WINDOW))
         )
@@ -145,10 +151,10 @@ class VCacheSemantic(SemanticTier):
                 if embed is None:
                     return None
             vec = np.asarray(embed, dtype=np.float32)
-            if vec.shape[0] != _EMBED_DIM:
+            if not self._accept_dimension(vec):
                 logger.debug(
-                    "VCacheSemantic.lookup: skip — embed dim=%d (expected %d)",
-                    vec.shape[0], _EMBED_DIM,
+                    "VCacheSemantic.lookup: skip — embed dim=%s (expected %s)",
+                    vec.shape, self._embed_dim,
                 )
                 return None
             return self._lookup_inner(req, tenant_id, vec)
@@ -267,6 +273,16 @@ class VCacheSemantic(SemanticTier):
         if callable(close):
             close()
 
+    def _accept_dimension(self, vector: np.ndarray) -> bool:
+        """Lock one configured/inferred vector width for this cache instance."""
+        if vector.ndim != 1 or vector.size == 0:
+            return False
+        with self._dimension_lock:
+            if self._embed_dim is None:
+                self._embed_dim = int(vector.shape[0])
+                self._centroid_store._embedding_dimension = self._embed_dim
+            return int(vector.shape[0]) == self._embed_dim
+
     # ------------------------------------------------------------------
     # Internal lookup
     # ------------------------------------------------------------------
@@ -387,7 +403,7 @@ class VCacheSemantic(SemanticTier):
             for entry_id, blob, ctx_fp in rows:  # C-10: unpack persisted context_fp
                 try:
                     v = np.frombuffer(blob, dtype=np.float32).copy()
-                    if v.shape[0] == _EMBED_DIM:
+                    if self._accept_dimension(v):
                         entries.append((entry_id, ctx_fp, v))
                 except Exception:
                     continue
@@ -436,10 +452,11 @@ class VCacheSemantic(SemanticTier):
     ) -> None:
         """Persist vector + boundary record; update in-memory index + centroid."""
         vec = np.asarray(embed, dtype=np.float32)
-        if vec.shape[0] != _EMBED_DIM:
+        if not self._accept_dimension(vec):
             logger.warning(
-                "VCacheSemantic._set_inner: unexpected embedding dim %d (expected %d) "
-                "for entry=%s — skipping", vec.shape[0], _EMBED_DIM, entry_id,
+                "VCacheSemantic._set_inner: unexpected embedding shape %s "
+                "(expected %s) for entry=%s — skipping",
+                vec.shape, self._embed_dim, entry_id,
             )
             return
 
@@ -450,8 +467,8 @@ class VCacheSemantic(SemanticTier):
             tenant_id=tenant_id,
             vector=vec_bytes,
             meta={
-                "model": "nomic-ai/nomic-embed-text-v1.5",
-                "dim": _EMBED_DIM,
+                "model": "configured-embedding-provider",
+                "dim": self._embed_dim,
                 "context_fp": context_fp,
             },
         )

package/src/superlocalmemory/server/api.py

@@ -6,6 +6,23 @@
 SuperLocalMemory V3 - FastAPI API Server
 Provides REST endpoints for memory visualization and exploration.
 Uses V3 MemoryEngine for all operations.
+
+v3.7.8 (WS3 F4): ``create_app()`` in this module is a standalone/legacy app
+factory. The running daemon serves ``superlocalmemory.server.unified_daemon:
+create_app`` (see ``unified_daemon.py``'s uvicorn config); THIS factory is
+reachable only via direct ``python -m superlocalmemory.server.api`` /
+programmatic use and the tests that exercise it directly
+(``tests/test_api/test_api_lifespan_contract.py``,
+``tests/test_security/test_rate_limit_e2e.py``). Its ``auth_middleware``
+below intentionally keeps the older, simpler ``check_api_key``-only gate
+(unconditional per-write check, no daemon-capability / install-token
+identity layer) because it predates and is independent of the unified
+daemon's richer ``write_identity.require_http_mutation_actor`` boundary and
+the ``SLM_REQUIRE_API_KEY_LOOPBACK`` opt-in (see
+``infra/auth_middleware.py``). Do not treat this module's auth posture as
+the production write boundary -- that is ``unified_daemon.py``'s
+``auth_middleware``. ``UI_DIR`` below is still imported by
+``unified_daemon.py`` and must not be removed.
 """
 
 import json