superlocalmemory 3.7.7 → 3.8.0

package/src/superlocalmemory/mcp/_pool_adapter.py

@@ -104,6 +104,8 @@ def pool_recall(query: str, limit: int = 10, **kwargs: Any) -> PoolRecallRespons
         _recall_kwargs["include_global"] = kwargs["include_global"]
     if "include_shared" in kwargs:
         _recall_kwargs["include_shared"] = kwargs["include_shared"]
+    if kwargs.get("window"):
+        _recall_kwargs["window"] = kwargs["window"]
     raw = _pool().recall(**_recall_kwargs)
     _unwrap_error(raw, "recall")
     items = raw.get("results", []) if isinstance(raw, dict) else []

package/src/superlocalmemory/mcp/profiles.py

@@ -0,0 +1,103 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+
+"""MCP profile definitions — pure data, no side effects.
+
+Extracted from mcp/server.py (v3.8.0) so the daemon can import profile
+metadata without triggering FastMCP tool registration or engine warmup.
+
+server.py re-exports all names from this module for backward compatibility.
+Do NOT import FastMCP, MemoryEngine, or any heavy dependency here.
+"""
+
+from __future__ import annotations
+
+# ---------------------------------------------------------------------------
+# v3.6.14 WP-01: Named profile definitions
+# ---------------------------------------------------------------------------
+
+_PROFILE_CORE: frozenset[str] = frozenset({  # 14
+    "remember", "recall", "search", "fetch", "list_recent", "update_memory", "forget",
+    "session_init", "close_session",
+    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+})
+
+_PROFILE_CODE: frozenset[str] = _PROFILE_CORE | frozenset({  # 24
+    "build_code_graph", "get_blast_radius", "query_graph",
+    "semantic_search_code", "get_review_context", "detect_changes",
+    # switch_profile lets a plugin/IDE session change the active workspace over
+    # MCP (the plugin ships SLM_MCP_PROFILE=code, so it must be here). The
+    # underlying route is RBAC member-gated, so company-mode isolation holds.
+    "switch_profile",
+    # v3.8.0: bounded loops on the MCP surface. Coding agents (the /slm-loop
+    # command's audience) run gated, bounded loops and inspect the ledger.
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
+})
+
+_PROFILE_FULL_MESH: frozenset[str] = frozenset({  # 8
+    "mesh_summary", "mesh_peers", "mesh_send", "mesh_inbox",
+    "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
+})
+
+_PROFILE_FULL: frozenset[str] = frozenset({  # 34 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
+    "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
+    "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
+    "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
+    "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
+    "evolve_skill", "skill_health", "skill_lineage", "switch_profile",
+    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+    # v3.8.0: bounded-loop tools (CLI + /slm-loop command + MCP).
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
+}) | _PROFILE_FULL_MESH  # 42
+
+_PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 54
+    "get_version", "get_mode", "health", "consistency_check", "recall_trace",
+    "get_lifecycle_status", "set_retention_policy", "compact_memories",
+    "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
+})
+
+_PROFILE_MESH: frozenset[str] = _PROFILE_FULL_MESH  # 8
+
+# Canonical name → frozenset mapping.  "whole" is intentionally absent —
+# it maps to the raw server (all tools, D-2 LOCKED).
+_PROFILE_DEFINITIONS: dict[str, frozenset[str]] = {
+    "core": _PROFILE_CORE,
+    "code": _PROFILE_CODE,
+    "full": _PROFILE_FULL,
+    "power": _PROFILE_POWER,
+    "mesh": _PROFILE_MESH,
+}
+
+# Compatibility aliases published by the v3.6 README.  Stale client
+# configurations have one deterministic meaning; migration warnings fire
+# at server startup.  Any other value is a configuration error (fail closed).
+_PROFILE_ALIASES: dict[str, str] = {
+    "core14": "core",
+    # 3.8.0: switch_profile (+1) then bounded-loop tools (+3) grew code/full/
+    # power. Every historical count-suffixed name is kept so a v3.6/3.7/early-
+    # 3.8 config still resolves (back-compat); new 3.8.0 counts added alongside.
+    "code20": "code",
+    "code21": "code",
+    "code24": "code",
+    "full38": "full",
+    "full39": "full",
+    "full42": "full",
+    "power50": "power",
+    "power51": "power",
+    "power54": "power",
+    "mesh8": "mesh",
+    "whole81": "whole",
+    "whole84": "whole",
+}
+
+# Plain-English descriptions for UI display.
+# Rules: no internal jargon (no POMDP, Fisher-Rao, TurboQuant, etc.),
+# one sentence, user-facing language only.
+PROFILE_DESCRIPTIONS: dict[str, str] = {
+    "core": "Essential memory: store, recall, search, sessions",
+    "code": "Core + code-graph tools + profile switching (default for IDE coding agents)",
+    "full": "All everyday memory, optimization, and mesh tools",
+    "power": "Everything in full plus advanced governance/behavioral tools",
+    "mesh": "Cross-device mesh coordination only",
+}

package/src/superlocalmemory/mcp/server.py

@@ -75,13 +75,13 @@ def reset_engine():
 
 # Register tools and resources -------------------------------------------------
 #
-# Essential-only default: 25 base tools + 8 mesh tools = 33 registered
+# Essential-only default: 34 base tools + 8 mesh tools = 42 registered
 # when mesh is enabled. Set ``SLM_MCP_ALL_TOOLS=1`` to expose the full
 # toolset. Rationale: IDEs cap at 50-100 tools total (Cursor,
 # Antigravity, Windsurf) and a maximal SLM registration crowds out
 # other MCP servers the user may have installed.
 # Admin/diagnostics tools remain available via CLI (`slm <command>`).
-# Set SLM_MCP_ALL_TOOLS=1 to enable all 38 tools (power users).
+# Set SLM_MCP_ALL_TOOLS=1 to enable all 84 tools (power users).
 
 import os as _os_reg
 
@@ -107,6 +107,10 @@ _ESSENTIAL_TOOLS: set[str] = {
     "evolve_skill", "skill_health", "skill_lineage",
     # v3.6.11: Surface B Optimize tools (5)
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+    # v3.8.0: bounded-loop tools (3) — CLI + /slm-loop command + MCP. Kept in
+    # the default exposure so any MCP client discovers gated loops, not just
+    # profile=code/full/power sessions.
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
 }
 
 # v3.4.4: Mesh tools — enabled if mesh_enabled in config or SLM_MCP_MESH_TOOLS=1
@@ -138,55 +142,21 @@ _user_allowlist_str = _os_reg.environ.get("SLM_MCP_TOOLS", "").strip()
 
 # ---------------------------------------------------------------------------
 # v3.6.14 WP-01: Named profile definitions
+# Extracted to mcp/profiles.py (v3.8.0) — pure data, no side effects.
+# All names re-exported here for backward compatibility with existing tests
+# and any code that imports them from this module.
 # ---------------------------------------------------------------------------
 
-_PROFILE_CORE = frozenset({  # 14
-    "remember", "recall", "search", "fetch", "list_recent", "update_memory", "forget",
-    "session_init", "close_session",
-    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
-})
-_PROFILE_CODE = _PROFILE_CORE | frozenset({  # 20
-    "build_code_graph", "get_blast_radius", "query_graph",
-    "semantic_search_code", "get_review_context", "detect_changes",
-})
-_PROFILE_FULL_MESH = frozenset({  # 8
-    "mesh_summary", "mesh_peers", "mesh_send", "mesh_inbox",
-    "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
-})
-_PROFILE_FULL = frozenset({  # 30 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
-    "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
-    "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
-    "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
-    "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
-    "evolve_skill", "skill_health", "skill_lineage",
-    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
-}) | _PROFILE_FULL_MESH  # 38
-_PROFILE_POWER = _PROFILE_FULL | frozenset({  # 50
-    "get_version", "get_mode", "health", "consistency_check", "recall_trace",
-    "get_lifecycle_status", "set_retention_policy", "compact_memories",
-    "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
-})
-_PROFILE_MESH = _PROFILE_FULL_MESH  # 8
-
-_PROFILE_DEFINITIONS: dict[str, frozenset[str]] = {
-    "core": _PROFILE_CORE,
-    "code": _PROFILE_CODE,
-    "full": _PROFILE_FULL,
-    "power": _PROFILE_POWER,
-    "mesh": _PROFILE_MESH,
-}  # "whole" intentionally absent — maps to raw server (D-2 LOCKED)
-
-# Compatibility aliases published by the v3.6 README.  Keep these explicit so
-# a stale client configuration has one deterministic meaning and emits a
-# migration warning.  Any other value is a configuration error (fail closed).
-_PROFILE_ALIASES: dict[str, str] = {
-    "core14": "core",
-    "code20": "code",
-    "full38": "full",
-    "power50": "power",
-    "mesh8": "mesh",
-    "whole81": "whole",
-}
+from superlocalmemory.mcp.profiles import (  # noqa: E402 (after env setups above)
+    _PROFILE_CORE,
+    _PROFILE_CODE,
+    _PROFILE_FULL_MESH,
+    _PROFILE_FULL,
+    _PROFILE_POWER,
+    _PROFILE_MESH,
+    _PROFILE_DEFINITIONS,
+    _PROFILE_ALIASES,
+)
 
 _profile = _os_reg.environ.get("SLM_MCP_PROFILE", "").strip().lower()
 
@@ -291,6 +261,8 @@ register_learning_tools(_target, get_engine)  # v3.4.7: Two-way learning tools
 register_evolution_tools(_target, get_engine)  # v3.4.11: Skill evolution tools
 from superlocalmemory.mcp.tools_optimize import register_optimize_tools
 register_optimize_tools(_target)  # v3.6.11: Surface B Optimize tools (proxy-free)
+from superlocalmemory.mcp.tools_loops import register_loop_tools
+register_loop_tools(_target, get_engine)  # v3.8.0: bounded-loop tools (CLI+command+MCP)
 
 
 # V3.3.21: Eager engine warmup — start initializing BEFORE first tool call.

package/src/superlocalmemory/mcp/tools_active.py

@@ -186,12 +186,6 @@ def register_active_tools(server, get_engine: Callable) -> None:
                 relevance score is ≥ 0.70 (architectural decisions that remain
                 permanently relevant still surface). Default: 30.
                 Set to 0 to disable the age gate entirely.
-
-        Scoring: five candidate producers (semantic + BM25 + temporal +
-        spreading_activation + hopfield) feed RRF fusion; the entity graph then
-        applies an optional post-fusion score enhancement. Combined with
-        Ebbinghaus exponential recency decay and FSRS stability strengthening by
-        access frequency.
         """
         try:
             from superlocalmemory.hooks.rules_engine import RulesEngine
@@ -689,7 +683,10 @@ def register_active_tools(server, get_engine: Callable) -> None:
         try:
             engine = get_engine()
             db = engine.db
-            pid = profile_id or engine.profile_id
+            # Isolation: the tenant is ALWAYS the engine's active profile. The
+            # caller-supplied profile_id is ignored — honoring it let any MCP
+            # client read/pin another profile's facts by passing profile_id.
+            pid = engine.profile_id
 
             if action == "pin":
                 if not fact_id:

package/src/superlocalmemory/mcp/tools_code_graph.py

@@ -14,10 +14,16 @@ All tools return {"success": bool, ...} envelope. Never raise.
 from __future__ import annotations
 
 import logging
+import os
 import time
 from pathlib import Path
 from typing import Any, Callable
 
+from superlocalmemory.core.security_primitives import (
+    PathTraversalError,
+    safe_resolve,
+)
+
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
@@ -118,7 +124,14 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             exclude_patterns: Comma-separated glob patterns to exclude.
         """
         try:
-            repo = Path(repo_path)
+            # SEC: contain the untrusted repo_path under $HOME (same guard as
+            # update_code_graph) so repo_path="/" cannot ingest the whole
+            # filesystem into the code-graph DB.
+            from superlocalmemory.core.security_primitives import PathTraversalError
+            try:
+                repo = safe_resolve(Path.home(), repo_path)
+            except (PathTraversalError, OSError, ValueError) as exc:
+                return _error_response(f"Invalid repo_path: {exc}")
             if not repo.exists():
                 return _error_response(
                     f"Repository path does not exist: {repo_path}"
@@ -250,6 +263,22 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             svc = _get_service()
             db = svc.db
 
+            # SEC 3.7.9 (B1): contain untrusted repo_path under $HOME and confirm
+            # it is a real git repo BEFORE any git subprocess runs with it as cwd.
+            # Blocks RCE via attacker-controlled .git config/hooks (core.fsmonitor,
+            # core.hooksPath) that git would otherwise execute in a hostile repo.
+            if repo_path:
+                try:
+                    repo = safe_resolve(Path.home(), repo_path)
+                except PathTraversalError as exc:
+                    return _error_response(f"Invalid repo_path: {exc}")
+                if not (repo / ".git").exists():
+                    return _error_response(
+                        f"Not a git repository (no .git dir): {repo_path}"
+                    )
+            else:
+                repo = svc.config.repo_root
+
             files_list = [
                 f.strip() for f in changed_files.split(",") if f.strip()
             ] if changed_files else []
@@ -258,11 +287,22 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
                 # Auto-detect via git
                 try:
                     import subprocess
-                    repo = Path(repo_path) if repo_path else svc.config.repo_root
+                    # repo is the safe_resolve-contained path computed above.
+                    # Harden git: disable hooks + fsmonitor + system config so a
+                    # hostile repo cannot execute code via the git invocation (B1).
                     result = subprocess.run(
-                        ["git", "diff", "--name-only", "HEAD~1", "HEAD"],
+                        [
+                            "git", "-c", "core.hooksPath=/dev/null",
+                            "-c", "core.fsmonitor=",
+                            "diff", "--name-only", "HEAD~1", "HEAD",
+                        ],
                         capture_output=True, text=True, timeout=30,
                         cwd=str(repo),
+                        env={
+                            **os.environ,
+                            "GIT_CONFIG_NOSYSTEM": "1",
+                            "GIT_TERMINAL_PROMPT": "0",
+                        },
                     )
                     files_list = [
                         f.strip() for f in result.stdout.strip().split("\n")
@@ -289,13 +329,19 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             config = svc.config
             parser = CodeParser(config)
             store = GraphStore(db)
-            repo = Path(repo_path) if repo_path else config.repo_root
+            # repo already contained via safe_resolve above (B1).
 
             nodes_before = db.get_node_count()
             edges_before = db.get_edge_count()
 
             for fp in files_list:
-                full = repo / fp
+                # fp comes from caller-supplied changed_files; contain it under
+                # the (already safe-resolved) repo so "../../.ssh/id_rsa" cannot
+                # be read into the graph.
+                try:
+                    full = safe_resolve(repo, fp)
+                except Exception:
+                    continue
                 if not full.exists():
                     store.remove_file(fp)
                     continue

package/src/superlocalmemory/mcp/tools_core.py

@@ -284,10 +284,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         session_id: str = "", fast: bool = False,
         include_global: bool | None = None,
         include_shared: bool | None = None,
+        window: str = "",
     ) -> dict:
         """Search memories through hybrid retrieval, RRF fusion, and reranking.
 
-        S9-DASH-02: optional ``session_id`` threads through to the
+        Optional ``session_id`` threads through to the
         engine's outcome-queue so PostToolUse / Stop hooks can attach
         engagement signals to this recall. Claude Code should pass its
         ``CLAUDE_SESSION_ID``. Omitting it degrades to "no closed-loop
@@ -297,6 +298,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         scopes participate in retrieval. Leave them unset (``None``) to use the
         configured default — shared memory is OPT-IN, so by default recall
         returns only this profile's own facts. Pass ``True`` to opt in per call.
+
+        Time window: optional ``window`` restricts results to a event-time
+        range. Accepts a relative span (``"24h"``, ``"7d"``, ``"30d"``,
+        ``"1y"``) or an explicit range (``"2026-07-01..2026-07-31"``). Empty =
+        no time filter.
         """
         # v3.6.10: resolve "mcp_client" sentinel → URL path (HTTP) or env var (stdio)
         if agent_id == "mcp_client":
@@ -353,6 +359,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 fast=bool(fast),
                 include_global=include_global,
                 include_shared=include_shared,
+                window=window or None,
             )
             if result.get("ok"):
                 # Record implicit feedback: every returned result is a recall_hit
@@ -587,6 +594,10 @@ def register_core_tools(server, get_engine: Callable) -> None:
             )
 
             generation = 0
+            # Only the profile_id explicitly confirmed by this process
+            # (daemon-acknowledged + locally-validated, or locally
+            # validated directly) is ever synced into engine state.
+            confirmed_profile_id = None
             if await asyncio.to_thread(is_daemon_running):
                 result = await asyncio.to_thread(
                     daemon_request,
@@ -599,12 +610,35 @@ def register_core_tools(server, get_engine: Callable) -> None:
                         "error": "resident daemon rejected the profile switch",
                     }
                 acknowledged = str(result.get("active_profile", ""))
-                if acknowledged != profile_id:
+                if not acknowledged or acknowledged != profile_id:
                     return {
                         "success": False,
                         "error": "resident daemon acknowledged a different profile",
                     }
+                # Local consistency guard (SEC-H-01): the daemon's HTTP
+                # acknowledgement alone is not sufficient — this MCP
+                # process must also confirm the profile exists in its
+                # own local DB handle before syncing local state to it.
+                # Mirrors the existence check the no-daemon branch already
+                # performs below.
+                local_rows = engine._db.execute(
+                    "SELECT 1 FROM profiles WHERE profile_id = ?",
+                    (profile_id,),
+                )
+                if not local_rows:
+                    return {
+                        "success": False,
+                        "error": (
+                            f"resident daemon acknowledged profile "
+                            f"'{acknowledged}' but it does not exist in "
+                            f"this process's local profile store"
+                        ),
+                    }
                 generation = int(result.get("generation", 0))
+                # Sync target is the DAEMON-CONFIRMED value, never the raw
+                # caller-supplied profile_id, even though they are equal
+                # here by construction (checked above).
+                confirmed_profile_id = acknowledged
             else:
                 rows = engine._db.execute(
                     "SELECT 1 FROM profiles WHERE profile_id = ?",
@@ -628,10 +662,21 @@ def register_core_tools(server, get_engine: Callable) -> None:
                     engine._config.active_profile = old
                     persistence.rollback()
                     raise
+                confirmed_profile_id = profile_id
+
+            if not confirmed_profile_id:
+                # Defensive: should be unreachable — every path above
+                # either returns an error or sets confirmed_profile_id.
+                return {
+                    "success": False,
+                    "error": "profile switch could not be confirmed",
+                }
 
-            # Synchronize this MCP process only after daemon acknowledgement.
-            engine.profile_id = profile_id
-            engine._config.active_profile = profile_id
+            # Synchronize this MCP process only after confirmation
+            # (daemon-acknowledged + locally-validated, or directly
+            # locally-validated in the no-daemon branch above).
+            engine.profile_id = confirmed_profile_id
+            engine._config.active_profile = confirmed_profile_id
 
             # v3.6.12 (search-3): recall/delete run in a separate worker
             # subprocess that caches its engine (and profile_id) at init. Recycle

package/src/superlocalmemory/mcp/tools_evolution.py

@@ -98,11 +98,14 @@ def register_evolution_tools(server, get_engine: Callable) -> None:
             engine = get_engine()
             profile_id = engine.profile_id if engine else "default"
 
-            evolver._store.reset_cycle()
-            outcome = evolver._process_candidate(candidate, profile_id)
+            evolver._store.reset_cycle(profile_id)
+            # audit-10 fix: go through evolve_candidate so the manual/MCP path
+            # runs under a budget cycle and honours the LLM-call / wall-time /
+            # per-day caps (previously _process_candidate ran uncapped here).
+            outcome = evolver.evolve_candidate(candidate, profile_id)
 
             # Fetch the latest record for this skill to return details
-            recent = evolver._store.get_skill_history(skill_name, limit=1)
+            recent = evolver._store.get_skill_history(skill_name, profile_id, limit=1)
             record_info = {}
             if recent:
                 r = recent[0]