superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/server/routes/agents.py

@@ -19,6 +19,12 @@ from .helpers import DB_PATH
 logger = logging.getLogger("superlocalmemory.routes.agents")
 router = APIRouter()
 
+
+def _internal_error(detail: str = "Internal server error") -> HTTPException:
+    """SEC-H-02: log full traceback server-side; return a generic message to the client."""
+    logger.exception("agents route error")
+    return HTTPException(status_code=500, detail=detail)
+
 # Feature flag: V3 trust scorer
 TRUST_AVAILABLE = False
 try:
@@ -56,8 +62,8 @@ async def get_agents(
             "count": len(agents),
             "stats": {"total_agents": len(agents)},
         }
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Agent registry error: {str(e)}")
+    except Exception:
+        raise _internal_error("Agent registry error")
 
 
 @router.get("/api/agents/stats")
@@ -69,8 +75,91 @@ async def get_agent_stats(request: Request):
         registry = AgentRegistry(persist_path=_registry_path())
         agents = registry.list_agents()
         return {"total_agents": len(agents)}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Agent stats error: {str(e)}")
+    except Exception:
+        raise _internal_error("Agent stats error")
+
+
+@router.get("/api/agents/memory-activity")
+async def get_agent_memory_activity(
+    request: Request,
+    limit: int = Query(20, ge=1, le=100),
+):
+    """Per-agent memory attribution for the multi-agent memory view.
+
+    Reports how many memories each writing agent contributed, when each was
+    last active, which ingestion sources they used, and the most recent
+    entries — grouped by ``ingestion_operations.trusted_actor_id`` (the agent
+    that wrote the memory). Profile-scoped. Uses a direct DB read because the
+    dashboard runs without the engine subprocess. Never raises to the client;
+    returns empty structures if the operations table is absent.
+    """
+    import sqlite3
+
+    from .helpers import get_active_profile
+
+    pid = get_active_profile()
+    agents: list[dict] = []
+    recent: list[dict] = []
+    total = 0
+
+    if DB_PATH.exists():
+        conn = sqlite3.connect(str(DB_PATH))
+        conn.row_factory = sqlite3.Row
+        try:
+            try:
+                rows = conn.execute(
+                    "SELECT CASE WHEN trusted_actor_id='' THEN 'unknown' "
+                    "ELSE trusted_actor_id END AS agent_id, "
+                    "COUNT(*) AS cnt, MAX(created_at) AS last_active, "
+                    "GROUP_CONCAT(DISTINCT source_type) AS sources "
+                    "FROM ingestion_operations WHERE profile_id=? "
+                    "GROUP BY agent_id ORDER BY cnt DESC, agent_id ASC "
+                    "LIMIT 500",
+                    (pid,),
+                ).fetchall()
+                for r in rows:
+                    agents.append({
+                        "agent_id": r["agent_id"],
+                        "count": r["cnt"],
+                        "last_active": r["last_active"],
+                        "source_types": (
+                            [s for s in (r["sources"] or "").split(",") if s]
+                        ),
+                    })
+                    total += r["cnt"]
+            except sqlite3.OperationalError:
+                pass
+
+            try:
+                rows = conn.execute(
+                    "SELECT CASE WHEN trusted_actor_id='' THEN 'unknown' "
+                    "ELSE trusted_actor_id END AS agent_id, "
+                    "substr(raw_content, 1, 160) AS snippet, "
+                    "created_at, source_type, session_id "
+                    "FROM ingestion_operations WHERE profile_id=? "
+                    "ORDER BY created_at DESC, rowid DESC LIMIT ?",
+                    (pid, int(limit)),
+                ).fetchall()
+                recent = [{
+                    "agent_id": r["agent_id"],
+                    "content": r["snippet"],
+                    "created_at": r["created_at"],
+                    "source_type": r["source_type"],
+                    "session_id": r["session_id"],
+                } for r in rows]
+            except sqlite3.OperationalError:
+                pass
+        finally:
+            conn.close()
+
+    return {
+        "ok": True,
+        "profile_id": pid,
+        "total_memories": total,
+        "agent_count": len(agents),
+        "agents": agents,
+        "recent": recent,
+    }
 
 
 @router.get("/api/trust/stats")
@@ -102,38 +191,39 @@ async def get_trust_stats(request: Request):
             conn = sqlite3.connect(str(DB_PATH))
             conn.row_factory = sqlite3.Row
             try:
-                # Count trust signals
-                row = conn.execute(
-                    "SELECT COUNT(*) AS cnt FROM trust_signals "
-                    "WHERE profile_id = ?", (pid,),
-                ).fetchone()
-                total_signals = row["cnt"] if row else 0
-            except sqlite3.OperationalError:
-                pass
-
-            try:
-                # Average trust score
-                row = conn.execute(
-                    "SELECT AVG(trust_score) AS avg_ts FROM trust_scores "
-                    "WHERE profile_id = ?", (pid,),
-                ).fetchone()
-                if row and row["avg_ts"] is not None:
-                    avg_trust_score = round(float(row["avg_ts"]), 3)
-            except sqlite3.OperationalError:
-                pass
+                try:
+                    # Count trust signals
+                    row = conn.execute(
+                        "SELECT COUNT(*) AS cnt FROM trust_signals "
+                        "WHERE profile_id = ?", (pid,),
+                    ).fetchone()
+                    total_signals = row["cnt"] if row else 0
+                except sqlite3.OperationalError:
+                    pass
 
-            try:
-                # Signal breakdown by type
-                rows = conn.execute(
-                    "SELECT signal_type, COUNT(*) AS cnt "
-                    "FROM trust_signals WHERE profile_id = ? "
-                    "GROUP BY signal_type", (pid,),
-                ).fetchall()
-                by_signal_type = {r["signal_type"]: r["cnt"] for r in rows}
-            except sqlite3.OperationalError:
-                pass
+                try:
+                    # Average trust score
+                    row = conn.execute(
+                        "SELECT AVG(trust_score) AS avg_ts FROM trust_scores "
+                        "WHERE profile_id = ?", (pid,),
+                    ).fetchone()
+                    if row and row["avg_ts"] is not None:
+                        avg_trust_score = round(float(row["avg_ts"]), 3)
+                except sqlite3.OperationalError:
+                    pass
 
-            conn.close()
+                try:
+                    # Signal breakdown by type
+                    rows = conn.execute(
+                        "SELECT signal_type, COUNT(*) AS cnt "
+                        "FROM trust_signals WHERE profile_id = ? "
+                        "GROUP BY signal_type", (pid,),
+                    ).fetchall()
+                    by_signal_type = {r["signal_type"]: r["cnt"] for r in rows}
+                except sqlite3.OperationalError:
+                    pass
+            finally:
+                conn.close()
 
         # Enforcement status: SLM uses "Silent Collection" by default
         enforcement = "Silent Collection"
@@ -144,8 +234,8 @@ async def get_trust_stats(request: Request):
             "enforcement": enforcement,
             "by_signal_type": by_signal_type,
         }
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Trust stats error: {str(e)}")
+    except Exception:
+        raise _internal_error("Trust stats error")
 
 
 @router.get("/api/trust/signals/{agent_id}")
@@ -167,5 +257,5 @@ async def get_agent_trust_signals(
                 "signals": signals, "count": len(signals),
             }
         return {"agent_id": agent_id, "signals": [], "count": 0}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Trust signals error: {str(e)}")
+    except Exception:
+        raise _internal_error("Trust signals error")

package/src/superlocalmemory/server/routes/backup.py

@@ -24,6 +24,13 @@ from .helpers import BackupConfigRequest, DB_PATH, MEMORY_DIR
 logger = logging.getLogger("superlocalmemory.routes.backup")
 router = APIRouter()
 
+
+def _internal_error(detail: str = "Internal server error") -> HTTPException:
+    """SEC-H-02: log full traceback server-side; return a generic message to the client."""
+    logger.exception("backup route error")
+    return HTTPException(status_code=500, detail=detail)
+
+
 # Feature flags
 BACKUP_AVAILABLE = False
 CLOUD_AVAILABLE = False
@@ -79,8 +86,8 @@ async def backup_status():
         else:
             status["cloud_destinations"] = []
         return status
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Backup status error: {str(e)}")
+    except Exception:
+        raise _internal_error("Backup status error")
 
 
 @router.post("/api/backup/create")
@@ -98,8 +105,8 @@ async def backup_create():
                 "status": manager.get_status(),
             }
         return {"success": False, "message": "Backup failed"}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Backup create error: {str(e)}")
+    except Exception:
+        raise _internal_error("Backup create error")
 
 
 @router.post("/api/backup/configure")
@@ -115,21 +122,30 @@ async def backup_configure(request: BackupConfigRequest):
             enabled=request.enabled,
         )
         return {"success": True, "message": "Backup configuration updated", "status": result}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Backup configure error: {str(e)}")
+    except Exception:
+        raise _internal_error("Backup configure error")
 
 
 @router.get("/api/backup/list")
-async def backup_list():
+async def backup_list(request: Request):
     """List all available backups."""
     if not BACKUP_AVAILABLE:
         return {"backups": [], "count": 0, "message": "Backup module not available"}
+    # This GET is not covered by the mutation middleware. The local machine
+    # owner (loopback) is trusted; a remote caller must present a credential;
+    # non-loopback uncredentialed callers fail closed. Using the mutation-actor
+    # boundary (not require_write_actor) so the same-origin dashboard — whose
+    # fetch wrapper only attaches the install token to mutating requests — can
+    # still read its own backup list.
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+    require_http_mutation_actor(request, getattr(request.app.state, "daemon_descriptor", None),
+                                actor_kind="backup-list")
     try:
         manager = _get_backup_manager()
         backups = manager.list_backups()
         return {"backups": backups, "count": len(backups)}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Backup list error: {str(e)}")
+    except Exception:
+        raise _internal_error("Backup list error")
 
 
 # ---- Cloud destination routes (v3.4.10) -----------------------------------
@@ -228,10 +244,18 @@ async def sync_cloud():
 # ---- Export / Download route (v3.4.10) ------------------------------------
 
 @router.get("/api/backup/export")
-async def export_backup():
+async def export_backup(request: Request):
     """Create and download a compressed backup archive."""
     if not BACKUP_AVAILABLE:
         raise HTTPException(status_code=501, detail="Backup module not available")
+    # Full-database download. This GET is not covered by the mutation
+    # middleware and is triggered by a top-level navigation (window.location),
+    # which cannot carry a custom credential header — so it uses the
+    # loopback-trusted mutation-actor boundary: the local owner may export,
+    # a non-loopback caller without a credential fails closed.
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+    require_http_mutation_actor(request, getattr(request.app.state, "daemon_descriptor", None),
+                                actor_kind="backup-export")
 
     manager = _get_backup_manager()
     filename = manager.create_backup(label="export")

package/src/superlocalmemory/server/routes/behavioral.py

@@ -90,8 +90,8 @@ async def behavioral_status():
             },
         }
     except Exception as e:
-        logger.error("behavioral_status error: %s", e)
-        return {"available": False, "error": str(e)}
+        logger.exception("behavioral_status error")
+        return {"available": False, "error": "Internal server error"}
 
 
 @router.post("/api/behavioral/report-outcome")
@@ -173,8 +173,8 @@ async def report_outcome(data: dict):
             ),
         }
     except Exception as e:
-        logger.error("report_outcome error: %s", e)
-        return {"success": False, "error": str(e)}
+        logger.exception("report_outcome error")
+        return {"success": False, "error": "Internal server error"}
 
 
 # --------------------------------------------------------------------------
@@ -214,8 +214,8 @@ async def get_assertions(min_confidence: float = 0.0, category: str = "", limit:
             "active_profile": profile,
         }
     except Exception as e:
-        logger.debug("get_assertions error: %s", e)
-        return {"assertions": [], "count": 0, "error": str(e)}
+        logger.exception("get_assertions error")
+        return {"assertions": [], "count": 0, "error": "Internal server error"}
 
 
 @router.get("/api/behavioral/tool-events")
@@ -247,8 +247,8 @@ async def get_tool_events(tool_name: str = "", limit: int = 100):
         finally:
             conn.close()
     except Exception as e:
-        logger.debug("get_tool_events error: %s", e)
-        return {"events": [], "count": 0, "error": str(e)}
+        logger.exception("get_tool_events error")
+        return {"events": [], "count": 0, "error": "Internal server error"}
 
 
 @router.get("/api/behavioral/soft-prompts")
@@ -269,8 +269,8 @@ async def get_soft_prompts():
              "token_count", "active", "version", "created_at"], r
         )) for r in rows], "count": len(rows)}
     except Exception as e:
-        logger.debug("get_soft_prompts error: %s", e)
-        return {"prompts": [], "count": 0, "error": str(e)}
+        logger.exception("get_soft_prompts error")
+        return {"prompts": [], "count": 0, "error": "Internal server error"}
 
 
 @router.post("/api/v3/tool-event")
@@ -322,5 +322,6 @@ async def log_tool_event_api(data: dict):
         finally:
             conn.close()
         return {"ok": True}
-    except Exception as e:
-        return {"ok": False, "error": str(e)}
+    except Exception:
+        logger.exception("behavioral route error")
+        return {"ok": False, "error": "Internal server error"}

package/src/superlocalmemory/server/routes/brain.py

@@ -30,6 +30,14 @@ Design notes (LLD-04 §7 hard rules):
   never spell those names anywhere in this module.
 * **U6** — install token required on ``/api/v3/brain`` and all
   deprecated shim routes. See ``require_install_token`` below.
+
+  External API consumers (L1): the dashboard auto-fetches the token from
+  ``GET /internal/token`` (loopback + same-origin only) and sends it as the
+  ``X-Install-Token`` header. Non-browser callers (scripts, IDE adapters,
+  third-party integrations) instead read the token from
+  ``~/.superlocalmemory/.install_token`` and send the same header:
+  ``curl -H "X-Install-Token: $(cat ~/.superlocalmemory/.install_token)" \
+  http://127.0.0.1:8765/api/v3/brain``.
 * **U10** — feature count surfaced from ``features.FEATURE_DIM``;
   stratum total from module constant ``_STRATA_TOTAL`` (48 = 4×3×4).
 """
@@ -52,6 +60,7 @@ from superlocalmemory.core.security_primitives import (
 from superlocalmemory.learning.database import LearningDatabase
 from superlocalmemory.learning.features import FEATURE_DIM
 from superlocalmemory.infra.data_root import canonical_data_root
+from .helpers import get_active_profile
 
 logger = logging.getLogger("superlocalmemory.routes.brain")
 
@@ -900,7 +909,7 @@ def _action_outcomes_count(lrn_db: LearningDatabase,
 
 
 @router.get("/brain", dependencies=[Depends(require_install_token)])
-async def get_brain(profile_id: str = "default") -> dict:
+async def get_brain(profile_id: str | None = None) -> dict:
     """Unified Brain endpoint — LLD-04 §3.1.
 
     Fan-out: each section is a synchronous SQLite reader. Running them
@@ -915,6 +924,9 @@ async def get_brain(profile_id: str = "default") -> dict:
     """
     import asyncio
 
+    # Default to the ACTIVE profile (request runtime truth), never literal
+    # "default" — the Brain must reflect whichever profile is active.
+    profile_id = profile_id or get_active_profile()
     lrn_db = LearningDatabase(_learning_db_path())
 
     (
@@ -1176,7 +1188,7 @@ def _compute_evolution_cost_preview(profile_id: str) -> dict:
 @router.get("/brain/evolution-timeseries",
             dependencies=[Depends(require_install_token)])
 async def get_brain_evolution_timeseries(
-    profile_id: str = "default",
+    profile_id: str | None = None,
     days: int = _EVOLUTION_DEFAULT_DAYS,
 ) -> dict:
     """Daily learning-signal counts for ``profile_id`` over the last ``days``.
@@ -1186,6 +1198,7 @@ async def get_brain_evolution_timeseries(
     """
     import asyncio
 
+    profile_id = profile_id or get_active_profile()
     lrn_db = LearningDatabase(_learning_db_path())
     result = await asyncio.to_thread(
         _compute_evolution_timeseries, profile_id, lrn_db, days=days,
@@ -1201,7 +1214,8 @@ async def get_brain_evolution_timeseries(
 
 @router.get("/learning/stats",
             dependencies=[Depends(require_install_token)])
-async def learning_stats_deprecated(profile_id: str = "default") -> dict:
+async def learning_stats_deprecated(profile_id: str | None = None) -> dict:
+    profile_id = profile_id or get_active_profile()
     lrn_db = LearningDatabase(_learning_db_path())
     return {
         "deprecated": True,
@@ -1212,7 +1226,8 @@ async def learning_stats_deprecated(profile_id: str = "default") -> dict:
 
 @router.get("/patterns",
             dependencies=[Depends(require_install_token)])
-async def patterns_deprecated(profile_id: str = "default") -> dict:
+async def patterns_deprecated(profile_id: str | None = None) -> dict:
+    profile_id = profile_id or get_active_profile()
     return {
         "deprecated": True,
         "use_instead": "/api/v3/brain",
@@ -1222,7 +1237,8 @@ async def patterns_deprecated(profile_id: str = "default") -> dict:
 
 @router.get("/behavioral",
             dependencies=[Depends(require_install_token)])
-async def behavioral_deprecated(profile_id: str = "default") -> dict:
+async def behavioral_deprecated(profile_id: str | None = None) -> dict:
+    profile_id = profile_id or get_active_profile()
     return {
         "deprecated": True,
         "use_instead": "/api/v3/brain",

package/src/superlocalmemory/server/routes/chat.py

@@ -101,8 +101,9 @@ async def _stream_chat(
         memories = await loop.run_in_executor(
             None, _recall_memories, app_state, query, limit,
         )
-    except Exception as exc:
-        yield _sse_event("error", json.dumps({"message": f"Retrieval failed: {exc}"}))
+    except Exception:
+        logger.exception("chat: memory retrieval failed")
+        yield _sse_event("error", json.dumps({"message": "Memory retrieval failed"}))
         yield _sse_event("done", "")
         return
 
@@ -226,8 +227,9 @@ async def _stream_mode_bc(
                 yield _sse_event("token", token)
     except httpx.ConnectError:
         yield _sse_event("token", f"\n\n[Connection failed — is {provider} running?]")
-    except Exception as exc:
-        yield _sse_event("token", f"\n\n[LLM error: {exc}]")
+    except Exception:
+        logger.exception("chat: LLM streaming error")
+        yield _sse_event("token", "\n\n[LLM error: request failed]")
 
 
 # ── Ollama Streaming (/api/chat with messages) ───────────────────
@@ -359,7 +361,10 @@ def _recall_via_resident_engine(app_state, query: str, limit: int) -> list:
             if r.fact.memory_id
         })
         memory_map = (
-            engine._db.get_memory_content_batch(memory_ids) if memory_ids else {}
+            engine._db.get_memory_content_batch(
+                memory_ids, engine.profile_id,
+                include_global=True, include_shared=True,
+            ) if memory_ids else {}
         )
         from superlocalmemory.server.recall_serializer import (
             serialize_recall_response,