superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/server/routes/brain.py

@@ -30,6 +30,14 @@ Design notes (LLD-04 §7 hard rules):
   never spell those names anywhere in this module.
 * **U6** — install token required on ``/api/v3/brain`` and all
   deprecated shim routes. See ``require_install_token`` below.
+
+  External API consumers (L1): the dashboard auto-fetches the token from
+  ``GET /internal/token`` (loopback + same-origin only) and sends it as the
+  ``X-Install-Token`` header. Non-browser callers (scripts, IDE adapters,
+  third-party integrations) instead read the token from
+  ``~/.superlocalmemory/.install_token`` and send the same header:
+  ``curl -H "X-Install-Token: $(cat ~/.superlocalmemory/.install_token)" \
+  http://127.0.0.1:8765/api/v3/brain``.
 * **U10** — feature count surfaced from ``features.FEATURE_DIM``;
   stratum total from module constant ``_STRATA_TOTAL`` (48 = 4×3×4).
 """
@@ -52,6 +60,7 @@ from superlocalmemory.core.security_primitives import (
 from superlocalmemory.learning.database import LearningDatabase
 from superlocalmemory.learning.features import FEATURE_DIM
 from superlocalmemory.infra.data_root import canonical_data_root
+from .helpers import get_active_profile
 
 logger = logging.getLogger("superlocalmemory.routes.brain")
 
@@ -894,13 +903,47 @@ def _action_outcomes_count(lrn_db: LearningDatabase,
         return 0
 
 
+def _compute_action_outcomes_preview(profile_id: str) -> dict:
+    """Count profile-scoped action outcomes from their canonical database."""
+    empty = {
+        "action_outcomes_rows": 0,
+        "source": "memory.db:action_outcomes",
+        "is_real": True,
+    }
+    db_path = _memory_db_path()
+    if not db_path.exists():
+        return empty
+    try:
+        conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True, timeout=1.0)
+        try:
+            row = conn.execute(
+                "SELECT COUNT(*) FROM action_outcomes WHERE profile_id = ?",
+                (profile_id,),
+            ).fetchone()
+        finally:
+            conn.close()
+    except sqlite3.Error:
+        return empty
+    return {**empty, "action_outcomes_rows": int(row[0] or 0) if row else 0}
+
+
 # ---------------------------------------------------------------------------
 # Routes
 # ---------------------------------------------------------------------------
 
 
+def _authorized_profile(request: Request, profile_id: str | None) -> str:
+    """Resolve and authorize the exact Brain profile requested by the caller."""
+    from superlocalmemory.access.rbac import Permission
+    from superlocalmemory.server.rbac_enforce import require_permission
+
+    effective_profile = profile_id or get_active_profile()
+    require_permission(request, Permission.READ, profile=effective_profile)
+    return effective_profile
+
+
 @router.get("/brain", dependencies=[Depends(require_install_token)])
-async def get_brain(profile_id: str = "default") -> dict:
+async def get_brain(request: Request, profile_id: str | None = None) -> dict:
     """Unified Brain endpoint — LLD-04 §3.1.
 
     Fan-out: each section is a synchronous SQLite reader. Running them
@@ -915,11 +958,14 @@ async def get_brain(profile_id: str = "default") -> dict:
     """
     import asyncio
 
+    # Default to the ACTIVE profile (request runtime truth), never literal
+    # "default" — the Brain must reflect whichever profile is active.
+    profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
 
     (
         preferences, learning, usage, bandit_snap, cache,
-        cross_platform, outcomes_rows, evolution,
+        cross_platform, outcomes_preview, evolution,
     ) = await asyncio.gather(
         asyncio.to_thread(_compute_preferences, profile_id),
         asyncio.to_thread(_compute_learning_status, profile_id, lrn_db),
@@ -927,7 +973,7 @@ async def get_brain(profile_id: str = "default") -> dict:
         asyncio.to_thread(_compute_bandit_snapshot, profile_id, lrn_db),
         asyncio.to_thread(_compute_cache_stats),
         asyncio.to_thread(_compute_cross_platform),
-        asyncio.to_thread(_action_outcomes_count, lrn_db, profile_id),
+        asyncio.to_thread(_compute_action_outcomes_preview, profile_id),
         asyncio.to_thread(
             _compute_evolution_timeseries, profile_id, lrn_db,
             days=_EVOLUTION_DEFAULT_DAYS,
@@ -965,11 +1011,11 @@ async def get_brain(profile_id: str = "default") -> dict:
             "is_real": True, "source": "learning_signals",
             "days": _EVOLUTION_DEFAULT_DAYS, "total_signals": 0, "points": [],
         }),
-        "outcomes_preview": {
-            "action_outcomes_rows":
-                0 if isinstance(outcomes_rows, Exception) else outcomes_rows,
-            "ships_in": "3.4.22",
-        },
+        "outcomes_preview": _ok(outcomes_preview, {
+            "action_outcomes_rows": 0,
+            "source": "memory.db:action_outcomes",
+            "is_real": True,
+        }),
         # S9-defer H-22: live tile data for the Reward / Shadow /
         # Evolution-Cost dashboard tiles. Each block is a honest-empty
         # default when the underlying table is missing (fresh install
@@ -1176,7 +1222,8 @@ def _compute_evolution_cost_preview(profile_id: str) -> dict:
 @router.get("/brain/evolution-timeseries",
             dependencies=[Depends(require_install_token)])
 async def get_brain_evolution_timeseries(
-    profile_id: str = "default",
+    request: Request,
+    profile_id: str | None = None,
     days: int = _EVOLUTION_DEFAULT_DAYS,
 ) -> dict:
     """Daily learning-signal counts for ``profile_id`` over the last ``days``.
@@ -1186,6 +1233,7 @@ async def get_brain_evolution_timeseries(
     """
     import asyncio
 
+    profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
     result = await asyncio.to_thread(
         _compute_evolution_timeseries, profile_id, lrn_db, days=days,
@@ -1201,7 +1249,10 @@ async def get_brain_evolution_timeseries(
 
 @router.get("/learning/stats",
             dependencies=[Depends(require_install_token)])
-async def learning_stats_deprecated(profile_id: str = "default") -> dict:
+async def learning_stats_deprecated(
+    request: Request, profile_id: str | None = None,
+) -> dict:
+    profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
     return {
         "deprecated": True,
@@ -1212,7 +1263,10 @@ async def learning_stats_deprecated(profile_id: str = "default") -> dict:
 
 @router.get("/patterns",
             dependencies=[Depends(require_install_token)])
-async def patterns_deprecated(profile_id: str = "default") -> dict:
+async def patterns_deprecated(
+    request: Request, profile_id: str | None = None,
+) -> dict:
+    profile_id = _authorized_profile(request, profile_id)
     return {
         "deprecated": True,
         "use_instead": "/api/v3/brain",
@@ -1222,7 +1276,10 @@ async def patterns_deprecated(profile_id: str = "default") -> dict:
 
 @router.get("/behavioral",
             dependencies=[Depends(require_install_token)])
-async def behavioral_deprecated(profile_id: str = "default") -> dict:
+async def behavioral_deprecated(
+    request: Request, profile_id: str | None = None,
+) -> dict:
+    profile_id = _authorized_profile(request, profile_id)
     return {
         "deprecated": True,
         "use_instead": "/api/v3/brain",

package/src/superlocalmemory/server/routes/chat.py

@@ -101,8 +101,9 @@ async def _stream_chat(
         memories = await loop.run_in_executor(
             None, _recall_memories, app_state, query, limit,
         )
-    except Exception as exc:
-        yield _sse_event("error", json.dumps({"message": f"Retrieval failed: {exc}"}))
+    except Exception:
+        logger.exception("chat: memory retrieval failed")
+        yield _sse_event("error", json.dumps({"message": "Memory retrieval failed"}))
         yield _sse_event("done", "")
         return
 
@@ -226,8 +227,9 @@ async def _stream_mode_bc(
                 yield _sse_event("token", token)
     except httpx.ConnectError:
         yield _sse_event("token", f"\n\n[Connection failed — is {provider} running?]")
-    except Exception as exc:
-        yield _sse_event("token", f"\n\n[LLM error: {exc}]")
+    except Exception:
+        logger.exception("chat: LLM streaming error")
+        yield _sse_event("token", "\n\n[LLM error: request failed]")
 
 
 # ── Ollama Streaming (/api/chat with messages) ───────────────────
@@ -359,7 +361,10 @@ def _recall_via_resident_engine(app_state, query: str, limit: int) -> list:
             if r.fact.memory_id
         })
         memory_map = (
-            engine._db.get_memory_content_batch(memory_ids) if memory_ids else {}
+            engine._db.get_memory_content_batch(
+                memory_ids, engine.profile_id,
+                include_global=True, include_shared=True,
+            ) if memory_ids else {}
         )
         from superlocalmemory.server.recall_serializer import (
             serialize_recall_response,

package/src/superlocalmemory/server/routes/compliance.py

@@ -13,14 +13,20 @@ import logging
 import sqlite3
 from typing import Optional
 
-from fastapi import APIRouter, Query
+from fastapi import APIRouter, Query, Request
+from fastapi.responses import JSONResponse
 
-from .helpers import get_active_profile, MEMORY_DIR, DB_PATH
+from .helpers import get_active_profile, get_engine_lazy, MEMORY_DIR, DB_PATH
+from superlocalmemory.server.route_mutations import authorize_route_mutation
 
 logger = logging.getLogger("superlocalmemory.routes.compliance")
 router = APIRouter()
 
-AUDIT_DB = MEMORY_DIR / "audit.db"
+# The engine's audit post-hooks write to <data_root>/audit_chain.db
+# (core/engine_wiring.py). The route MUST read that same file — an earlier
+# "audit.db" path pointed at a file nothing ever wrote, so the Compliance tab
+# always showed zero events.
+AUDIT_DB = MEMORY_DIR / "audit_chain.db"
 
 # Feature detection
 COMPLIANCE_AVAILABLE = False
@@ -28,6 +34,7 @@ try:
     from superlocalmemory.compliance.audit import AuditChain
     from superlocalmemory.compliance.retention import RetentionEngine
     from superlocalmemory.compliance.abac import ABACEngine
+    from superlocalmemory.compliance.gdpr import GDPRCompliance
     COMPLIANCE_AVAILABLE = True
 except ImportError:
     logger.info("V3 compliance engine not available")
@@ -42,22 +49,24 @@ async def compliance_status():
     try:
         profile = get_active_profile()
 
-        # Audit events
+        # Audit events (hash-chained, from the engine's live audit_chain.db).
+        # Scope the count + recent list to the active profile.
         audit_events_count = 0
         recent_audit_events = []
         try:
             audit = AuditChain(str(AUDIT_DB))
-            audit_events_count = audit.count_events()
-            recent_audit_events = audit.get_recent_events(limit=30)
+            recent_audit_events = audit.query(profile_id=profile, limit=30)
+            # get_stats() is global; count this profile's rows for the header.
+            audit_events_count = len(audit.query(profile_id=profile, limit=100000))
         except Exception as exc:
             logger.debug("audit chain: %s", exc)
 
-        # Retention policies
+        # Retention policies (scoped to the active profile)
         retention_policies = []
         try:
             conn = sqlite3.connect(str(DB_PATH))
             engine = RetentionEngine(conn)
-            retention_policies = engine.list_rules()
+            retention_policies = engine.list_rules(profile)
             conn.close()
         except Exception as exc:
             logger.debug("retention engine: %s", exc)
@@ -78,13 +87,14 @@ async def compliance_status():
             "retention_policies": retention_policies,
             "abac_policies_count": abac_policies_count,
         }
-    except Exception as e:
-        logger.error("compliance_status error: %s", e)
-        return {"available": False, "error": str(e)}
+    except Exception:
+        logger.exception("compliance_status error")
+        return {"available": False, "error": "Internal server error"}
 
 
 @router.get("/api/compliance/audit")
 async def query_audit_trail(
+    request: Request,
     limit: int = Query(default=50, ge=1, le=500),
     event_type: Optional[str] = Query(default=None),
     since: Optional[str] = Query(default=None),
@@ -92,20 +102,33 @@ async def query_audit_trail(
     """Query audit trail events with optional filters."""
     if not COMPLIANCE_AVAILABLE:
         return {"available": False, "error": "Compliance engine not available"}
-
+    # The audit trail reveals operations, actors, and fact_ids. This GET is not
+    # covered by the mutation middleware; the same-origin dashboard reads it via
+    # a plain GET (no token header), so gate on the loopback-trusted mutation
+    # boundary — local owner allowed, remote uncredentialed caller fails closed.
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+    require_http_mutation_actor(request, getattr(request.app.state, "daemon_descriptor", None),
+                                actor_kind="audit-read")
     try:
+        profile = get_active_profile()
         audit = AuditChain(str(AUDIT_DB))
-        events = audit.get_recent_events(
-            limit=limit, event_type=event_type, since=since,
+        events = audit.query(
+            profile_id=profile, operation=event_type, start_date=since,
+            limit=limit,
         )
-
+        chain_ok = True
+        try:
+            chain_ok = audit.verify_integrity()
+        except Exception:
+            pass
         return {
             "available": True, "events": events, "total": len(events),
+            "chain_verified": chain_ok, "active_profile": profile,
             "filters": {"event_type": event_type, "since": since, "limit": limit},
         }
-    except Exception as e:
-        logger.error("query_audit_trail error: %s", e)
-        return {"available": False, "error": str(e)}
+    except Exception:
+        logger.exception("query_audit_trail error")
+        return {"available": False, "error": "Internal server error"}
 
 
 @router.post("/api/compliance/retention-policy")
@@ -155,6 +178,133 @@ async def create_retention_policy(data: dict):
             "active_profile": profile,
             "message": f"Retention policy '{name}' created ({retention_days}d, {action})",
         }
-    except Exception as e:
-        logger.error("create_retention_policy error: %s", e)
-        return {"success": False, "error": str(e)}
+    except Exception:
+        logger.exception("create_retention_policy error")
+        return {"success": False, "error": "Internal server error"}
+
+
+@router.delete("/api/compliance/retention-policy")
+async def delete_retention_policy(name: str = Query(...)):
+    """Delete a retention policy by name for the active profile."""
+    if not COMPLIANCE_AVAILABLE:
+        return {"success": False, "error": "Compliance engine not available"}
+    try:
+        profile = get_active_profile()
+        conn = sqlite3.connect(str(DB_PATH))
+        engine = RetentionEngine(conn)
+        removed = engine.delete_rule(profile, name)
+        conn.close()
+        if not removed:
+            return {"success": False, "error": f"Policy '{name}' not found"}
+        return {"success": True, "active_profile": profile,
+                "message": f"Retention policy '{name}' deleted"}
+    except Exception:
+        logger.exception("delete_retention_policy error")
+        return {"success": False, "error": "Internal server error"}
+
+
+@router.post("/api/compliance/retention/enforce")
+async def enforce_retention():
+    """Run all retention policies for the active profile now.
+
+    Moves expired facts to their rule's terminal lifecycle zone (archive/
+    tombstone) or counts them (notify). Soft-state only — never a raw delete.
+    """
+    if not COMPLIANCE_AVAILABLE:
+        return {"success": False, "error": "Compliance engine not available"}
+    try:
+        profile = get_active_profile()
+        conn = sqlite3.connect(str(DB_PATH))
+        engine = RetentionEngine(conn)
+        result = engine.enforce(profile)
+        conn.close()
+        return {"success": True, **result}
+    except Exception:
+        logger.exception("enforce_retention error")
+        return {"success": False, "error": "Internal server error"}
+
+
+# ── GDPR Art. 15/20 — Right to Access / Portability ─────────────────────────
+
+@router.get("/api/compliance/gdpr/export")
+async def gdpr_export(request: Request):
+    """Export ALL data for the active profile (GDPR Art. 20 portability).
+
+    Comprehensive 14-table export (memories, facts, entities, edges, trust,
+    feedback, behavioral patterns, provenance, audit, …) as a downloadable
+    JSON attachment. Read-only.
+    """
+    if not COMPLIANCE_AVAILABLE:
+        return {"available": False, "error": "Compliance engine not available"}
+    # A full-workspace data dump is an administrative action. Triggered by a
+    # top-level navigation (a.href) that cannot carry a credential header, so
+    # gate on the loopback-trusted mutation boundary (local owner allowed,
+    # remote uncredentialed fails closed) AND require MANAGE — in company mode
+    # a session cookie flows on navigation, so a non-admin user is still denied;
+    # the machine owner keeps MANAGE.
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+    from superlocalmemory.server.rbac_enforce import require_manage
+    require_http_mutation_actor(request, getattr(request.app.state, "daemon_descriptor", None),
+                                actor_kind="gdpr-export")
+    require_manage(request)
+    try:
+        engine = get_engine_lazy(request.app.state)
+        if engine is None:
+            return {"available": False, "error": "Engine not initialized"}
+        profile = get_active_profile()
+        data = GDPRCompliance(engine._db).export_profile_data(profile)
+        filename = f"slm-export-{profile}.json"
+        return JSONResponse(
+            content=data,
+            headers={"Content-Disposition": f'attachment; filename="{filename}"'},
+        )
+    except Exception:
+        logger.exception("gdpr_export error")
+        return {"available": False, "error": "Internal server error"}
+
+
+# ── GDPR Art. 17 — Right to Erasure ─────────────────────────────────────────
+
+@router.post("/api/compliance/gdpr/erase")
+async def gdpr_erase(request: Request, data: dict = {}):
+    """Permanently erase ALL data for the active profile (GDPR Art. 17).
+
+    IRREVERSIBLE. Requires an explicit ``confirm`` field in the body that
+    exactly matches the active profile name — this is the guard against an
+    accidental one-click wipe. The 'default' profile can never be erased
+    (enforced in GDPRCompliance.forget_profile). Mutation-authorized.
+    """
+    if not COMPLIANCE_AVAILABLE:
+        return {"success": False, "error": "Compliance engine not available"}
+    try:
+        engine = get_engine_lazy(request.app.state)
+        if engine is None:
+            return {"success": False, "error": "Engine not initialized"}
+        profile = get_active_profile()
+        confirm = (data or {}).get("confirm", "")
+        if confirm != profile:
+            return {
+                "success": False,
+                "error": (
+                    "Confirmation required: send {\"confirm\": \"" + profile +
+                    "\"} to erase this profile. This is irreversible."
+                ),
+            }
+        if profile == "default":
+            return {"success": False,
+                    "error": "The 'default' profile cannot be erased."}
+        # Irreversible erasure is admin-only (beyond mutation auth).
+        from superlocalmemory.server.rbac_enforce import require_manage
+        require_manage(request, profile=profile)
+        authorization = authorize_route_mutation(
+            request,
+            operation="delete",
+            source_agent_id="http-gdpr-erase",
+            profile_id=profile,
+        )
+        result = GDPRCompliance(engine._db).forget_profile(profile)
+        authorization.complete()
+        return {"success": True, "active_profile": profile, **(result or {})}
+    except Exception:
+        logger.exception("gdpr_erase error")
+        return {"success": False, "error": "Internal server error"}