superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/loops/rules.py

@@ -0,0 +1,52 @@
+"""Pure decision predicates for the bounded-loop engine.
+
+Every function here is a pure function of its arguments: same inputs give the
+same output, and nothing is mutated. The engine calls these to decide whether
+to stop, halt, or keep going; adapters never call them directly.
+
+Imports are limited to the standard library and the loop models.
+"""
+
+from __future__ import annotations
+
+from typing import Sequence
+
+from superlocalmemory.loops.models import Bounds, Rung, Verdict
+
+
+def stop_condition_met(verdict: Verdict) -> bool:
+    """Return True when the gate verdict means the loop may exit.
+
+    The rule is deliberately conservative: a loop is eligible to finish only
+    when the independent gate reports ``passed``. The agent's own opinion is
+    never consulted here — it is not even an argument.
+    """
+    return verdict.passed
+
+
+def no_progress(lap_changes: Sequence[bool], window: int) -> bool:
+    """Return True when the last ``window`` laps all made no change.
+
+    ``lap_changes`` is the ordered history of each lap's ``changed`` flag,
+    most-recent last. A window of ``0`` disables the check (a spinning agent
+    is then bounded only by the iteration cap). Fewer laps than the window
+    means "not enough evidence yet" and returns False.
+    """
+    if window <= 0:
+        return False
+    tail = lap_changes[-window:]
+    if len(tail) < window:
+        return False
+    return all(changed is False for changed in tail)
+
+
+def rung_requires_approval(rung: Rung, bounds: Bounds) -> bool:
+    """Return True when a human must approve a passing gate before DONE.
+
+    An explicit ``bounds.require_approval`` wins outright. When it is ``None``
+    the posture is derived from the rung: L1 exits without approval, while
+    L2 and L3 require it.
+    """
+    if bounds.require_approval is not None:
+        return bounds.require_approval
+    return rung in (Rung.L2, Rung.L3)

package/src/superlocalmemory/mcp/_daemon_proxy.py

@@ -43,6 +43,7 @@ class DaemonPoolProxy:
         fast: bool = False,
         include_global: bool | None = None,
         include_shared: bool | None = None,
+        window: str | None = None,
     ) -> dict[str, Any]:
         _params: dict[str, Any] = {
             "q": query,
@@ -57,6 +58,8 @@ class DaemonPoolProxy:
             _params["include_global"] = "true" if include_global else "false"
         if include_shared is not None:
             _params["include_shared"] = "true" if include_shared else "false"
+        if window:
+            _params["window"] = window
         params = urllib.parse.urlencode(_params)
         try:
             from superlocalmemory.cli.daemon import daemon_request

package/src/superlocalmemory/mcp/_pool_adapter.py

@@ -104,6 +104,8 @@ def pool_recall(query: str, limit: int = 10, **kwargs: Any) -> PoolRecallRespons
         _recall_kwargs["include_global"] = kwargs["include_global"]
     if "include_shared" in kwargs:
         _recall_kwargs["include_shared"] = kwargs["include_shared"]
+    if kwargs.get("window"):
+        _recall_kwargs["window"] = kwargs["window"]
     raw = _pool().recall(**_recall_kwargs)
     _unwrap_error(raw, "recall")
     items = raw.get("results", []) if isinstance(raw, dict) else []

package/src/superlocalmemory/mcp/profiles.py

@@ -0,0 +1,103 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+
+"""MCP profile definitions — pure data, no side effects.
+
+Extracted from mcp/server.py (v3.8.0) so the daemon can import profile
+metadata without triggering FastMCP tool registration or engine warmup.
+
+server.py re-exports all names from this module for backward compatibility.
+Do NOT import FastMCP, MemoryEngine, or any heavy dependency here.
+"""
+
+from __future__ import annotations
+
+# ---------------------------------------------------------------------------
+# v3.6.14 WP-01: Named profile definitions
+# ---------------------------------------------------------------------------
+
+_PROFILE_CORE: frozenset[str] = frozenset({  # 14
+    "remember", "recall", "search", "fetch", "list_recent", "update_memory", "forget",
+    "session_init", "close_session",
+    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+})
+
+_PROFILE_CODE: frozenset[str] = _PROFILE_CORE | frozenset({  # 24
+    "build_code_graph", "get_blast_radius", "query_graph",
+    "semantic_search_code", "get_review_context", "detect_changes",
+    # switch_profile lets a plugin/IDE session change the active workspace over
+    # MCP (the plugin ships SLM_MCP_PROFILE=code, so it must be here). The
+    # underlying route is RBAC member-gated, so company-mode isolation holds.
+    "switch_profile",
+    # v3.8.0: bounded loops on the MCP surface. Coding agents (the /slm-loop
+    # command's audience) run gated, bounded loops and inspect the ledger.
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
+})
+
+_PROFILE_FULL_MESH: frozenset[str] = frozenset({  # 8
+    "mesh_summary", "mesh_peers", "mesh_send", "mesh_inbox",
+    "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
+})
+
+_PROFILE_FULL: frozenset[str] = frozenset({  # 34 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
+    "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
+    "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
+    "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
+    "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
+    "evolve_skill", "skill_health", "skill_lineage", "switch_profile",
+    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+    # v3.8.0: bounded-loop tools (CLI + /slm-loop command + MCP).
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
+}) | _PROFILE_FULL_MESH  # 42
+
+_PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 54
+    "get_version", "get_mode", "health", "consistency_check", "recall_trace",
+    "get_lifecycle_status", "set_retention_policy", "compact_memories",
+    "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
+})
+
+_PROFILE_MESH: frozenset[str] = _PROFILE_FULL_MESH  # 8
+
+# Canonical name → frozenset mapping.  "whole" is intentionally absent —
+# it maps to the raw server (all tools, D-2 LOCKED).
+_PROFILE_DEFINITIONS: dict[str, frozenset[str]] = {
+    "core": _PROFILE_CORE,
+    "code": _PROFILE_CODE,
+    "full": _PROFILE_FULL,
+    "power": _PROFILE_POWER,
+    "mesh": _PROFILE_MESH,
+}
+
+# Compatibility aliases published by the v3.6 README.  Stale client
+# configurations have one deterministic meaning; migration warnings fire
+# at server startup.  Any other value is a configuration error (fail closed).
+_PROFILE_ALIASES: dict[str, str] = {
+    "core14": "core",
+    # 3.8.0: switch_profile (+1) then bounded-loop tools (+3) grew code/full/
+    # power. Every historical count-suffixed name is kept so a v3.6/3.7/early-
+    # 3.8 config still resolves (back-compat); new 3.8.0 counts added alongside.
+    "code20": "code",
+    "code21": "code",
+    "code24": "code",
+    "full38": "full",
+    "full39": "full",
+    "full42": "full",
+    "power50": "power",
+    "power51": "power",
+    "power54": "power",
+    "mesh8": "mesh",
+    "whole81": "whole",
+    "whole84": "whole",
+}
+
+# Plain-English descriptions for UI display.
+# Rules: no internal jargon (no POMDP, Fisher-Rao, TurboQuant, etc.),
+# one sentence, user-facing language only.
+PROFILE_DESCRIPTIONS: dict[str, str] = {
+    "core": "Essential memory: store, recall, search, sessions",
+    "code": "Core + code-graph tools + profile switching (default for IDE coding agents)",
+    "full": "All everyday memory, optimization, and mesh tools",
+    "power": "Everything in full plus advanced governance/behavioral tools",
+    "mesh": "Cross-device mesh coordination only",
+}

package/src/superlocalmemory/mcp/server.py

@@ -75,13 +75,13 @@ def reset_engine():
 
 # Register tools and resources -------------------------------------------------
 #
-# Essential-only default: 25 base tools + 8 mesh tools = 33 registered
+# Essential-only default: 34 base tools + 8 mesh tools = 42 registered
 # when mesh is enabled. Set ``SLM_MCP_ALL_TOOLS=1`` to expose the full
 # toolset. Rationale: IDEs cap at 50-100 tools total (Cursor,
 # Antigravity, Windsurf) and a maximal SLM registration crowds out
 # other MCP servers the user may have installed.
 # Admin/diagnostics tools remain available via CLI (`slm <command>`).
-# Set SLM_MCP_ALL_TOOLS=1 to enable all 38 tools (power users).
+# Set SLM_MCP_ALL_TOOLS=1 to enable all 84 tools (power users).
 
 import os as _os_reg
 
@@ -107,6 +107,10 @@ _ESSENTIAL_TOOLS: set[str] = {
     "evolve_skill", "skill_health", "skill_lineage",
     # v3.6.11: Surface B Optimize tools (5)
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+    # v3.8.0: bounded-loop tools (3) — CLI + /slm-loop command + MCP. Kept in
+    # the default exposure so any MCP client discovers gated loops, not just
+    # profile=code/full/power sessions.
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
 }
 
 # v3.4.4: Mesh tools — enabled if mesh_enabled in config or SLM_MCP_MESH_TOOLS=1
@@ -138,55 +142,21 @@ _user_allowlist_str = _os_reg.environ.get("SLM_MCP_TOOLS", "").strip()
 
 # ---------------------------------------------------------------------------
 # v3.6.14 WP-01: Named profile definitions
+# Extracted to mcp/profiles.py (v3.8.0) — pure data, no side effects.
+# All names re-exported here for backward compatibility with existing tests
+# and any code that imports them from this module.
 # ---------------------------------------------------------------------------
 
-_PROFILE_CORE = frozenset({  # 14
-    "remember", "recall", "search", "fetch", "list_recent", "update_memory", "forget",
-    "session_init", "close_session",
-    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
-})
-_PROFILE_CODE = _PROFILE_CORE | frozenset({  # 20
-    "build_code_graph", "get_blast_radius", "query_graph",
-    "semantic_search_code", "get_review_context", "detect_changes",
-})
-_PROFILE_FULL_MESH = frozenset({  # 8
-    "mesh_summary", "mesh_peers", "mesh_send", "mesh_inbox",
-    "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
-})
-_PROFILE_FULL = frozenset({  # 30 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
-    "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
-    "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
-    "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
-    "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
-    "evolve_skill", "skill_health", "skill_lineage",
-    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
-}) | _PROFILE_FULL_MESH  # 38
-_PROFILE_POWER = _PROFILE_FULL | frozenset({  # 50
-    "get_version", "get_mode", "health", "consistency_check", "recall_trace",
-    "get_lifecycle_status", "set_retention_policy", "compact_memories",
-    "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
-})
-_PROFILE_MESH = _PROFILE_FULL_MESH  # 8
-
-_PROFILE_DEFINITIONS: dict[str, frozenset[str]] = {
-    "core": _PROFILE_CORE,
-    "code": _PROFILE_CODE,
-    "full": _PROFILE_FULL,
-    "power": _PROFILE_POWER,
-    "mesh": _PROFILE_MESH,
-}  # "whole" intentionally absent — maps to raw server (D-2 LOCKED)
-
-# Compatibility aliases published by the v3.6 README.  Keep these explicit so
-# a stale client configuration has one deterministic meaning and emits a
-# migration warning.  Any other value is a configuration error (fail closed).
-_PROFILE_ALIASES: dict[str, str] = {
-    "core14": "core",
-    "code20": "code",
-    "full38": "full",
-    "power50": "power",
-    "mesh8": "mesh",
-    "whole81": "whole",
-}
+from superlocalmemory.mcp.profiles import (  # noqa: E402 (after env setups above)
+    _PROFILE_CORE,
+    _PROFILE_CODE,
+    _PROFILE_FULL_MESH,
+    _PROFILE_FULL,
+    _PROFILE_POWER,
+    _PROFILE_MESH,
+    _PROFILE_DEFINITIONS,
+    _PROFILE_ALIASES,
+)
 
 _profile = _os_reg.environ.get("SLM_MCP_PROFILE", "").strip().lower()
 
@@ -233,7 +203,7 @@ class _FilteredServer:
     """
     __slots__ = ("_server", "_allowed")
 
-    def __init__(self, real_server: FastMCP, allowed: frozenset[str]) -> None:
+    def __init__(self, real_server: SLMFastMCP, allowed: frozenset[str]) -> None:
         self._server = real_server
         self._allowed = allowed
 
@@ -291,31 +261,24 @@ register_learning_tools(_target, get_engine)  # v3.4.7: Two-way learning tools
 register_evolution_tools(_target, get_engine)  # v3.4.11: Skill evolution tools
 from superlocalmemory.mcp.tools_optimize import register_optimize_tools
 register_optimize_tools(_target)  # v3.6.11: Surface B Optimize tools (proxy-free)
+from superlocalmemory.mcp.tools_loops import register_loop_tools
+register_loop_tools(_target, get_engine)  # v3.8.0: bounded-loop tools (CLI+command+MCP)
 
 
-# V3.3.21: Eager engine warmup — start initializing BEFORE first tool call.
-# The MCP server process starts when the IDE launches. Previously, the engine
-# was lazy-loaded on first tool call → 23s cold start for the user.
-# Now: engine starts warming in a background thread immediately. By the time
-# the first tool call arrives (1-2s later), the engine is already warm.
-# This applies to ALL IDEs: Claude Code, Cursor, Antigravity, Gemini CLI, etc.
+# Keep stdio MCP processes thin until a tool truly needs a local LIGHT engine.
+# Every open IDE/task owns a stdio process; eagerly opening memory.db in all of
+# them multiplied RAM and SQLite writers on machines with many long-lived
+# sessions. The shared daemon owns model warmup and common remember/recall work.
 def _eager_warmup() -> None:
-    """Pre-warm LIGHT engine + ensure daemon is running + auto-register mesh.
+    """Ensure the shared daemon is running without opening a per-client engine.
 
-    LIGHT engine init is cheap (DB only, ~100 ms). The real reason this
-    stays in a background thread is the follow-on side effects
-    (``ensure_daemon``, ``auto_register_mesh``) which do I/O.
+    Mesh registration is intentionally lazy: a local stdio session is not a
+    remote peer, and heartbeat writes should begin only after a mesh tool is
+    actually used.
     """
-    import logging
     _logger = logging.getLogger(__name__)
-    try:
-        get_engine()
-        _logger.info("MCP engine pre-warmed successfully")
-    except Exception as exc:
-        _logger.warning("MCP engine pre-warmup failed: %s", exc)
 
-    # Measurement / test harnesses set this to skip daemon-start and
-    # mesh-register. The LIGHT engine init above still runs.
+    # Measurement / test harnesses set this to skip daemon-start.
     if _os.environ.get("SLM_DISABLE_WARMUP_SIDE_EFFECTS") == "1":
         return
 
@@ -328,22 +291,12 @@ def _eager_warmup() -> None:
     except Exception as exc:
         _logger.warning("Daemon auto-start failed: %s", exc)
 
-    # V3.4.6: Auto-register this MCP session as a mesh peer immediately.
-    # Previously, registration was lazy (only on first mesh tool call).
-    # Now every Claude session appears on the mesh from startup.
-    try:
-        from superlocalmemory.mcp.tools_mesh import auto_register_mesh
-        auto_register_mesh()
-        _logger.info("Mesh peer auto-registered at startup")
-    except Exception as exc:
-        _logger.warning("Mesh auto-register failed: %s", exc)
-
 import threading
 
 # v3.6.7: Suppress standalone-process behaviours when the MCP server is
 # imported inside the daemon (SLM_MCP_EMBEDDED=1). Three threads are safe
 # to run in a dedicated `slm mcp` subprocess but harmful inside the daemon:
-#   mcp-warmup      — creates a LIGHT engine duplicate; daemon has a FULL one.
+#   mcp-warmup      — ensures the shared daemon only; never creates an engine.
 #   parent-watchdog — calls os._exit(0) if its parent IDE quits, which would
 #                     kill the daemon along with it.
 #   stdin-eof-monitor — monitors stdin pipe; meaningless inside the daemon.

package/src/superlocalmemory/mcp/tools_active.py

@@ -186,12 +186,6 @@ def register_active_tools(server, get_engine: Callable) -> None:
                 relevance score is ≥ 0.70 (architectural decisions that remain
                 permanently relevant still surface). Default: 30.
                 Set to 0 to disable the age gate entirely.
-
-        Scoring: five candidate producers (semantic + BM25 + temporal +
-        spreading_activation + hopfield) feed RRF fusion; the entity graph then
-        applies an optional post-fusion score enhancement. Combined with
-        Ebbinghaus exponential recency decay and FSRS stability strengthening by
-        access frequency.
         """
         try:
             from superlocalmemory.hooks.rules_engine import RulesEngine
@@ -689,7 +683,10 @@ def register_active_tools(server, get_engine: Callable) -> None:
         try:
             engine = get_engine()
             db = engine.db
-            pid = profile_id or engine.profile_id
+            # Isolation: the tenant is ALWAYS the engine's active profile. The
+            # caller-supplied profile_id is ignored — honoring it let any MCP
+            # client read/pin another profile's facts by passing profile_id.
+            pid = engine.profile_id
 
             if action == "pin":
                 if not fact_id:

package/src/superlocalmemory/mcp/tools_code_graph.py

@@ -14,10 +14,16 @@ All tools return {"success": bool, ...} envelope. Never raise.
 from __future__ import annotations
 
 import logging
+import os
 import time
 from pathlib import Path
 from typing import Any, Callable
 
+from superlocalmemory.core.security_primitives import (
+    PathTraversalError,
+    safe_resolve,
+)
+
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
@@ -118,7 +124,14 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             exclude_patterns: Comma-separated glob patterns to exclude.
         """
         try:
-            repo = Path(repo_path)
+            # SEC: contain the untrusted repo_path under $HOME (same guard as
+            # update_code_graph) so repo_path="/" cannot ingest the whole
+            # filesystem into the code-graph DB.
+            from superlocalmemory.core.security_primitives import PathTraversalError
+            try:
+                repo = safe_resolve(Path.home(), repo_path)
+            except (PathTraversalError, OSError, ValueError) as exc:
+                return _error_response(f"Invalid repo_path: {exc}")
             if not repo.exists():
                 return _error_response(
                     f"Repository path does not exist: {repo_path}"
@@ -250,6 +263,22 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             svc = _get_service()
             db = svc.db
 
+            # SEC 3.7.9 (B1): contain untrusted repo_path under $HOME and confirm
+            # it is a real git repo BEFORE any git subprocess runs with it as cwd.
+            # Blocks RCE via attacker-controlled .git config/hooks (core.fsmonitor,
+            # core.hooksPath) that git would otherwise execute in a hostile repo.
+            if repo_path:
+                try:
+                    repo = safe_resolve(Path.home(), repo_path)
+                except PathTraversalError as exc:
+                    return _error_response(f"Invalid repo_path: {exc}")
+                if not (repo / ".git").exists():
+                    return _error_response(
+                        f"Not a git repository (no .git dir): {repo_path}"
+                    )
+            else:
+                repo = svc.config.repo_root
+
             files_list = [
                 f.strip() for f in changed_files.split(",") if f.strip()
             ] if changed_files else []
@@ -258,11 +287,22 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
                 # Auto-detect via git
                 try:
                     import subprocess
-                    repo = Path(repo_path) if repo_path else svc.config.repo_root
+                    # repo is the safe_resolve-contained path computed above.
+                    # Harden git: disable hooks + fsmonitor + system config so a
+                    # hostile repo cannot execute code via the git invocation (B1).
                     result = subprocess.run(
-                        ["git", "diff", "--name-only", "HEAD~1", "HEAD"],
+                        [
+                            "git", "-c", "core.hooksPath=/dev/null",
+                            "-c", "core.fsmonitor=",
+                            "diff", "--name-only", "HEAD~1", "HEAD",
+                        ],
                         capture_output=True, text=True, timeout=30,
                         cwd=str(repo),
+                        env={
+                            **os.environ,
+                            "GIT_CONFIG_NOSYSTEM": "1",
+                            "GIT_TERMINAL_PROMPT": "0",
+                        },
                     )
                     files_list = [
                         f.strip() for f in result.stdout.strip().split("\n")
@@ -289,13 +329,19 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             config = svc.config
             parser = CodeParser(config)
             store = GraphStore(db)
-            repo = Path(repo_path) if repo_path else config.repo_root
+            # repo already contained via safe_resolve above (B1).
 
             nodes_before = db.get_node_count()
             edges_before = db.get_edge_count()
 
             for fp in files_list:
-                full = repo / fp
+                # fp comes from caller-supplied changed_files; contain it under
+                # the (already safe-resolved) repo so "../../.ssh/id_rsa" cannot
+                # be read into the graph.
+                try:
+                    full = safe_resolve(repo, fp)
+                except Exception:
+                    continue
                 if not full.exists():
                     store.remove_file(fp)
                     continue

package/src/superlocalmemory/mcp/tools_core.py

@@ -84,8 +84,9 @@ def _record_recall_hits(
             enqueue_shown_flip,
         )
 
-        engine = get_engine()
-        pid = profile_id or engine.profile_id
+        pid = profile_id
+        if not pid:
+            pid = get_engine().profile_id
         slm_dir = canonical_data_root()
 
         shown_ids = [r.get("fact_id", "") for r in results[:10]
@@ -121,7 +122,7 @@ def _record_recall_hits(
 def register_core_tools(server, get_engine: Callable) -> None:
     """Register the 13 core MCP tools on *server*."""
 
-    @server.tool(annotations=ToolAnnotations(idempotentHint=True))
+    @server.tool()
     async def remember(
         content: str, tags: str = "", project: str = "",
         importance: int = 5, session_id: str = "",
@@ -284,10 +285,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         session_id: str = "", fast: bool = False,
         include_global: bool | None = None,
         include_shared: bool | None = None,
+        window: str = "",
     ) -> dict:
         """Search memories through hybrid retrieval, RRF fusion, and reranking.
 
-        S9-DASH-02: optional ``session_id`` threads through to the
+        Optional ``session_id`` threads through to the
         engine's outcome-queue so PostToolUse / Stop hooks can attach
         engagement signals to this recall. Claude Code should pass its
         ``CLAUDE_SESSION_ID``. Omitting it degrades to "no closed-loop
@@ -297,6 +299,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         scopes participate in retrieval. Leave them unset (``None``) to use the
         configured default — shared memory is OPT-IN, so by default recall
         returns only this profile's own facts. Pass ``True`` to opt in per call.
+
+        Time window: optional ``window`` restricts results to a event-time
+        range. Accepts a relative span (``"24h"``, ``"7d"``, ``"30d"``,
+        ``"1y"``) or an explicit range (``"2026-07-01..2026-07-31"``). Empty =
+        no time filter.
         """
         # v3.6.10: resolve "mcp_client" sentinel → URL path (HTTP) or env var (stdio)
         if agent_id == "mcp_client":
@@ -353,6 +360,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 fast=bool(fast),
                 include_global=include_global,
                 include_shared=include_shared,
+                window=window or None,
             )
             if result.get("ok"):
                 # Record implicit feedback: every returned result is a recall_hit

package/src/superlocalmemory/mcp/tools_evolution.py

@@ -98,11 +98,14 @@ def register_evolution_tools(server, get_engine: Callable) -> None:
             engine = get_engine()
             profile_id = engine.profile_id if engine else "default"
 
-            evolver._store.reset_cycle()
-            outcome = evolver._process_candidate(candidate, profile_id)
+            evolver._store.reset_cycle(profile_id)
+            # audit-10 fix: go through evolve_candidate so the manual/MCP path
+            # runs under a budget cycle and honours the LLM-call / wall-time /
+            # per-day caps (previously _process_candidate ran uncapped here).
+            outcome = evolver.evolve_candidate(candidate, profile_id)
 
             # Fetch the latest record for this skill to return details
-            recent = evolver._store.get_skill_history(skill_name, limit=1)
+            recent = evolver._store.get_skill_history(skill_name, profile_id, limit=1)
             record_info = {}
             if recent:
                 r = recent[0]

package/src/superlocalmemory/mcp/tools_learning.py

@@ -143,7 +143,7 @@ def register_learning_tools(server, get_engine: Callable) -> None:
             logger.debug("get_assertions failed: %s", exc)
             return {"assertions": [], "count": 0, "error": str(exc)}
 
-    @server.tool(annotations=ToolAnnotations(idempotentHint=True))
+    @server.tool()
     async def reinforce_assertion(assertion_id: str) -> dict:
         """Reinforce a behavioral assertion (increase confidence).
 
@@ -171,7 +171,7 @@ def register_learning_tools(server, get_engine: Callable) -> None:
         except Exception as exc:
             return {"success": False, "error": str(exc)}
 
-    @server.tool(annotations=ToolAnnotations(idempotentHint=True))
+    @server.tool()
     async def contradict_assertion(assertion_id: str) -> dict:
         """Contradict a behavioral assertion (decrease confidence).