superlocalmemory 3.7.6 → 3.7.8

package/src/superlocalmemory/server/routes/profiles.py

@@ -10,6 +10,7 @@ Routes: /api/profiles, /api/profiles/{name}/switch,
 SQLite is the single source of truth for profiles. profiles.json
 is kept in sync as a cache for backward compatibility.
 """
+import asyncio
 import logging
 from datetime import datetime, timezone
 
@@ -21,9 +22,13 @@ from .helpers import (
     get_db_connection, validate_profile_name,
     ProfileSwitch, DB_PATH,
     sync_profiles, ensure_profile_in_db, ensure_profile_in_json,
-    set_active_profile_everywhere, delete_profile_from_db,
+    delete_profile_from_db,
     _load_profiles_json, _save_profiles_json,
 )
+from superlocalmemory.server.profile_runtime import (
+    commit_daemon_profile_switch,
+    get_profile_runtime,
+)
 
 logger = logging.getLogger("superlocalmemory.routes.profiles")
 router = APIRouter()
@@ -54,12 +59,11 @@ def _get_memory_count(profile: str) -> int:
 
 
 @router.get("/api/profiles")
-async def list_profiles():
+async def list_profiles(request: Request):
     """List available memory profiles (synced from SQLite + profiles.json)."""
     try:
         merged = sync_profiles()
-        json_config = _load_profiles_json()
-        active = json_config.get('active_profile', 'default')
+        active = get_profile_runtime(request.app.state).snapshot.profile_id
 
         profiles = []
         for p in merged:
@@ -108,14 +112,17 @@ async def switch_profile(name: str, request: Request):
             source_agent_id="http-profile-switch",
             profile_id=name,
         )
-        previous = _load_profiles_json().get('active_profile', 'default')
-        set_active_profile_everywhere(name)
-
-        # Update last_used in profiles.json
-        json_config = _load_profiles_json()
-        if name in json_config.get('profiles', {}):
-            json_config['profiles'][name]['last_used'] = datetime.now(timezone.utc).isoformat()
-            _save_profiles_json(json_config)
+        runtime = get_profile_runtime(request.app.state)
+        previous = runtime.snapshot.profile_id
+        snapshot = await asyncio.to_thread(
+            runtime.transition,
+            name,
+            lambda prior, target: commit_daemon_profile_switch(
+                request.app.state,
+                prior,
+                target,
+            ),
+        )
 
         count = _get_memory_count(name)
 
@@ -130,6 +137,7 @@ async def switch_profile(name: str, request: Request):
         return {
             "success": True, "active_profile": name,
             "previous_profile": previous, "memory_count": count,
+            "generation": snapshot.generation,
             "message": f"Switched to profile '{name}' ({count} memories).",
         }
 
@@ -184,10 +192,12 @@ async def delete_profile(name: str, request: Request):
         if name not in merged_ids:
             raise HTTPException(status_code=404, detail=f"Profile '{name}' not found")
 
-        json_config = _load_profiles_json()
-        if json_config.get('active_profile') == name:
+        runtime = get_profile_runtime(request.app.state)
+        if runtime.snapshot.profile_id == name:
             raise HTTPException(status_code=400, detail="Cannot delete active profile.")
 
+        json_config = _load_profiles_json()
+
         authorization = authorize_route_mutation(
             request,
             operation="delete",

package/src/superlocalmemory/server/routes/v3_api.py

@@ -19,6 +19,27 @@ logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/api/v3", tags=["v3"])
 
 
+async def _apply_runtime_config(request: Request, config, *, mode_change: bool) -> None:
+    """Persist and hot-swap config only after the daemon transition succeeds."""
+    import asyncio
+
+    authorization = authorize_route_mutation(
+        request,
+        operation="update",
+        source_agent_id="dashboard-config",
+        profile_id=getattr(config, "active_profile", "default"),
+    )
+    from superlocalmemory.server.profile_runtime import reconfigure_daemon_engine
+
+    await asyncio.to_thread(
+        reconfigure_daemon_engine,
+        request.app.state,
+        config,
+        mode_change=mode_change,
+    )
+    authorization.complete()
+
+
 # ── Dashboard ────────────────────────────────────────────────
 
 @router.get("/dashboard")
@@ -26,7 +47,10 @@ async def dashboard(request: Request):
     """Dashboard summary: mode, memory count, health score, recent activity."""
     try:
         from superlocalmemory.core.config import SLMConfig
-        config = SLMConfig.load()
+        config = getattr(request.app.state, "config", None) or SLMConfig.load()
+        from superlocalmemory.server.profile_runtime import get_profile_runtime
+
+        active_profile = get_profile_runtime(request.app.state).snapshot.profile_id
 
         # Read stats directly from SQLite (dashboard doesn't load engine)
         import sqlite3
@@ -38,12 +62,24 @@ async def dashboard(request: Request):
                 conn = sqlite3.connect(str(db_path))
                 cursor = conn.cursor()
                 try:
-                    cursor.execute("SELECT COUNT(*) FROM atomic_facts")
+                    cursor.execute(
+                        "SELECT COUNT(*) FROM atomic_facts WHERE profile_id = ?",
+                        (active_profile,),
+                    )
                     fact_count = cursor.fetchone()[0]
                 except Exception:
                     pass
                 try:
-                    cursor.execute("SELECT COUNT(*) FROM memories")
+                    try:
+                        cursor.execute(
+                            "SELECT COUNT(*) FROM memories WHERE profile_id = ?",
+                            (active_profile,),
+                        )
+                    except Exception:
+                        cursor.execute(
+                            "SELECT COUNT(*) FROM memories WHERE profile = ?",
+                            (active_profile,),
+                        )
                     memory_count = cursor.fetchone()[0]
                 except Exception:
                     pass
@@ -58,7 +94,7 @@ async def dashboard(request: Request):
             "model": config.llm.model or "",
             "memory_count": memory_count,
             "fact_count": fact_count,
-            "profile": config.active_profile,
+            "profile": active_profile,
             "base_dir": str(config.base_dir),
             "version": SLM_VERSION,
         }
@@ -69,11 +105,11 @@ async def dashboard(request: Request):
 # ── Mode ─────────────────────────────────────────────────────
 
 @router.get("/mode")
-async def get_mode():
+async def get_mode(request: Request):
     """Get current mode, provider, model — single source of truth for UI."""
     try:
         from superlocalmemory.core.config import SLMConfig
-        config = SLMConfig.load()
+        config = getattr(request.app.state, "config", None) or SLMConfig.load()
         current = config.mode.value
         return {
             "mode": current,
@@ -132,9 +168,10 @@ async def set_mode(request: Request):
         old_config.retrieval = _template.retrieval
         old_config.math = _template.math
         old_config.channel_weights = _template.channel_weights
-        old_config.save(mode_change=True)
         new_config = old_config
 
+        await _apply_runtime_config(request, new_config, mode_change=True)
+
         # Audit the change before we lose context — proves who/when/what.
         # Captures the phantom-write case where `for_mode(C)` auto-defaults
         # the model to "anthropic/claude-sonnet-4" (see core/config.py).
@@ -151,10 +188,6 @@ async def set_mode(request: Request):
             or old_config.embedding.model_name != new_config.embedding.model_name
         )
 
-        # Invalidate engine; next engine-backed request lazy-inits with new config.
-        if hasattr(request.app.state, "engine"):
-            request.app.state.engine = None
-
         return {
             "success": True,
             "mode": new_mode,
@@ -227,7 +260,7 @@ async def set_full_config(request: Request):
 
         # v3.6.12 (settings-1): mode_change=True is required to persist the new
         # mode — save() without it hits a guard that preserves the old mode.
-        config.save(mode_change=True)
+        await _apply_runtime_config(request, config, mode_change=True)
 
         log_mode_change(
             old_mode, new_mode,
@@ -236,16 +269,14 @@ async def set_full_config(request: Request):
             source="POST /api/v3/mode/set",
         )
 
-        # Kill existing worker so next request uses new config
+        # Recycle only out-of-process fallbacks; the resident daemon engine was
+        # already acknowledged and hot-swapped by _apply_runtime_config().
         try:
             from superlocalmemory.core.worker_pool import WorkerPool
             WorkerPool.shared().shutdown()
         except Exception:
             pass
 
-        if hasattr(request.app.state, "engine"):
-            request.app.state.engine = None
-
         return {
             "success": True,
             "mode": new_mode,
@@ -309,7 +340,7 @@ async def set_embedding_config(request: Request):
             api_version=old_emb.api_version,
             deployment_name=old_emb.deployment_name,
         )
-        config.save()
+        await _apply_runtime_config(request, config, mode_change=False)
 
         needs_reindex = (
             old_emb.provider != new_provider
@@ -323,9 +354,6 @@ async def set_embedding_config(request: Request):
             WorkerPool.shared().shutdown()
         except Exception:
             pass
-        if hasattr(request.app.state, "engine"):
-            request.app.state.engine = None
-
         return {
             "success": True,
             "provider": new_provider,
@@ -337,6 +365,55 @@ async def set_embedding_config(request: Request):
         return JSONResponse({"error": str(e)}, status_code=500)
 
 
+@router.get("/scope/config")
+async def get_scope_config(request: Request):
+    """Return runtime multi-scope defaults used by daemon writes and recalls."""
+    try:
+        from superlocalmemory.core.config import SLMConfig
+
+        config = getattr(request.app.state, "config", None) or SLMConfig.load()
+        return {"success": True, **config.scope.as_dict()}
+    except Exception as exc:
+        return JSONResponse({"error": str(exc)}, status_code=500)
+
+
+@router.put("/scope/config")
+async def set_scope_config(request: Request):
+    """Validate, persist, and hot-apply explicit multi-scope defaults."""
+    try:
+        body = await request.json()
+        from superlocalmemory.core.config import SLMConfig, ScopeConfig
+
+        config = SLMConfig.load()
+        current = config.scope
+        default_scope = body.get("default_scope", current.default_scope)
+        if default_scope not in {"personal", "shared", "global"}:
+            return JSONResponse(
+                {"error": "default_scope must be personal, shared, or global"},
+                status_code=400,
+            )
+        include_global = body.get(
+            "recall_include_global", current.recall_include_global,
+        )
+        include_shared = body.get(
+            "recall_include_shared", current.recall_include_shared,
+        )
+        if not isinstance(include_global, bool) or not isinstance(include_shared, bool):
+            return JSONResponse(
+                {"error": "recall scope flags must be booleans"},
+                status_code=400,
+            )
+        config.scope = ScopeConfig(
+            default_scope=default_scope,
+            recall_include_global=include_global,
+            recall_include_shared=include_shared,
+        )
+        await _apply_runtime_config(request, config, mode_change=False)
+        return {"success": True, **config.scope.as_dict()}
+    except Exception as exc:
+        return JSONResponse({"error": str(exc)}, status_code=500)
+
+
 @router.post("/embedding/test")
 async def test_embedding_endpoint(request: Request):
     """Test connectivity to a custom embedding endpoint."""
@@ -1385,7 +1462,8 @@ async def trigger_consolidation(request: Request):
     """Trigger consolidation manually.
 
     Body: {"lightweight": false, "profile": ""}
-    Uses WorkerPool for thread safety (Rule 18).
+    Runs under the daemon's profile-runtime operation lease (Rule 18) so a
+    concurrent profile switch cannot commit mid-consolidation.
     """
     try:
         body = await request.json()
@@ -1401,44 +1479,42 @@ async def trigger_consolidation(request: Request):
             profile_id=pid,
         )
 
-        # Use WorkerPool to run consolidation in the worker subprocess (Rule 18)
-        try:
-            from superlocalmemory.core.worker_pool import WorkerPool
-            pool = WorkerPool.shared()
-            result = pool.send_command({
-                "action": "consolidate",
-                "profile_id": pid,
-                "lightweight": lightweight,
-            })
-            if result and result.get("ok"):
-                authorization.complete()
-                return {"success": True, **result}
-        except Exception:
-            pass
-
-        # Fallback: direct consolidation if WorkerPool unavailable
+        # v3.7.8 SEC-M-01: the prior "WorkerPool" fast path called
+        # ``pool.send_command(...)``, a method that does not exist on
+        # WorkerPool — every call raised AttributeError, was silently
+        # swallowed by the bare ``except``, and fell through to this direct
+        # path unconditionally. That dead branch is removed; consolidation
+        # always runs directly against a lease-protected DB connection so a
+        # concurrent profile switch cannot commit mid-consolidation.
         from superlocalmemory.core.config import SLMConfig
         from superlocalmemory.storage.database import DatabaseManager
         from superlocalmemory.storage import schema as _schema
         from superlocalmemory.core.consolidation_engine import ConsolidationEngine
+        from superlocalmemory.server.profile_runtime import get_profile_runtime
 
-        config = SLMConfig.load()
-        db = DatabaseManager(config.db_path)
-        db.initialize(_schema)
+        runtime = get_profile_runtime(request.app.state)
+        with runtime.operation():
+            config = SLMConfig.load()
+            db = DatabaseManager(config.db_path)
+            db.initialize(_schema)
 
-        engine = ConsolidationEngine(db=db, config=config.consolidation, slm_config=config)
-        result = engine.consolidate(profile_id=pid, lightweight=lightweight)
+            engine = ConsolidationEngine(
+                db=db, config=config.consolidation, slm_config=config,
+            )
+            result = engine.consolidate(profile_id=pid, lightweight=lightweight)
 
-        # v3.4.1: Auto-trigger behavioral pattern mining after consolidation
-        try:
-            from superlocalmemory.learning.consolidation_worker import ConsolidationWorker
-            learning_db = config.base_dir / "learning.db"
-            cw = ConsolidationWorker(str(config.db_path), str(learning_db))
-            pattern_count = cw._generate_patterns(pid, False)
-            result["patterns_mined"] = pattern_count
-            logger.info("Auto-mined %d patterns after consolidation", pattern_count)
-        except Exception as exc:
-            logger.debug("Pattern mining after consolidation failed: %s", exc)
+            # v3.4.1: Auto-trigger behavioral pattern mining after consolidation
+            try:
+                from superlocalmemory.learning.consolidation_worker import (
+                    ConsolidationWorker,
+                )
+                learning_db = config.base_dir / "learning.db"
+                cw = ConsolidationWorker(str(config.db_path), str(learning_db))
+                pattern_count = cw._generate_patterns(pid, False)
+                result["patterns_mined"] = pattern_count
+                logger.info("Auto-mined %d patterns after consolidation", pattern_count)
+            except Exception as exc:
+                logger.debug("Pattern mining after consolidation failed: %s", exc)
 
         authorization.complete()
         return {"success": True, **result}

package/src/superlocalmemory/server/ui.py

@@ -15,6 +15,16 @@ All route handlers live in routes/ directory:
     routes/events.py    -- /events/stream (SSE), /api/events [v2.5]
     routes/agents.py    -- /api/agents, /api/trust [v2.5]
     routes/ws.py        -- /ws/updates (WebSocket)
+
+v3.7.8 (WS3 F4): ``create_app()`` in this module is a standalone/legacy app
+factory, NOT the app the running daemon serves -- that is
+``superlocalmemory.server.unified_daemon:create_app`` (see that module's
+uvicorn config). This module's ``auth_middleware`` keeps the older,
+unconditional ``check_api_key``-only write gate (no daemon-capability /
+install-token identity layer, no ``SLM_REQUIRE_API_KEY_LOOPBACK`` opt-in --
+see ``infra/auth_middleware.py`` for that). Treat this file as a standalone
+entry point only; the production write-auth boundary lives in
+``unified_daemon.py``.
 """
 
 import logging