superlocalmemory 4.0.10 → 4.1.2

package/src/superlocalmemory/server/routes/config_api.py

@@ -136,7 +136,11 @@ class ForgettingConfigUpdate(BaseModel):
     forget_threshold: Optional[float] = Field(None, ge=0.0, le=1.0)
     learning_rate: Optional[float] = Field(None, gt=0.0)
     forgetting_drift_scale: Optional[float] = Field(None, gt=0.0)
-    trust_kappa: Optional[float] = Field(None, gt=0.0)
+    # ge, not gt: zero is a meaningful setting — it turns trust-modulated decay
+    # off, so every memory fades at the same rate regardless of where it came
+    # from. A greater-than bound made the one value that disables the feature
+    # the one value the API refused.
+    trust_kappa: Optional[float] = Field(None, ge=0.0)
     scheduler_interval_minutes: Optional[int] = Field(None, ge=1)
     core_memory_immune: Optional[StrictBool] = None
 
@@ -169,7 +173,7 @@ _FORGETTING_DEFAULTS: dict = {
 
 
 @router.get("/storage/config")
-def get_storage_config():
+def get_storage_config(request: Request = None):  # noqa: B008 - FastAPI idiom
     """Return current storage backend configuration.
 
     base_dir is read-only — it is derived from the process namespace and
@@ -177,9 +181,27 @@ def get_storage_config():
     """
     try:
         data = _read_config()
+        declared_graph = data.get("graph_backend", "auto")
+        declared_vector = data.get("vector_backend", "auto")
+        active_graph, active_vector = _active_backends(declared_graph, declared_vector)
         return {
-            "graph_backend": data.get("graph_backend", "auto"),
-            "vector_backend": data.get("vector_backend", "auto"),
+            "graph_backend": declared_graph,
+            "vector_backend": declared_vector,
+            # What is actually answering queries. A store can be configured for
+            # a backend it never successfully promoted to, and then the setting
+            # describes an intention rather than the system.
+            "graph_backend_active": active_graph,
+            "vector_backend_active": active_vector,
+            "backend_matches_configuration": (
+                active_graph == declared_graph and active_vector == declared_vector
+            ),
+            "scale_engine_state": data.get("scale_engine_state", "local_core"),
+            # What the last start did about moving this store onto the graph
+            # and vector backends. A store that could not be moved says why
+            # here rather than looking like one that was never asked.
+            "automatic_promotion": getattr(
+                request.app.state, "scale_autopromotion", None,
+            ) if request is not None else None,
             "base_dir": data.get("base_dir", str(MEMORY_DIR)),
         }
     except Exception:
@@ -187,6 +209,43 @@ def get_storage_config():
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
 
+def _active_backends(declared_graph: str, declared_vector: str) -> tuple[str, str]:
+    """Which backends are really serving queries, not which were requested.
+
+    A promotion writes the chosen backend into the configuration before the
+    directory that holds it exists, and a promotion that never completed leaves
+    the setting saying ``cozo`` while every query is answered by SQLite. The
+    dashboard read the setting, so it agreed with the mistake.
+
+    Resolved from the two things that must both be true for a backend to serve:
+    its library imports, and its data directory is on disk.
+    """
+    def usable(module: str, directory: str) -> bool:
+        # Importing it, not merely finding it. A package whose native extension
+        # no longer matches the interpreter is present on disk and raises on
+        # import, and "the file is there" would report it as serving queries it
+        # cannot answer.
+        import importlib
+
+        if not (MEMORY_DIR / directory).is_dir():
+            return False
+        try:
+            importlib.import_module(module)
+        except Exception:  # noqa: BLE001 - any import failure means unusable
+            return False
+        return True
+
+    graph = "sqlite"
+    if declared_graph in ("cozo", "auto") and usable("pycozo", "cozo"):
+        graph = "cozo"
+
+    vector = "sqlite-vec"
+    if declared_vector in ("lancedb", "auto") and usable("lancedb", "lance"):
+        vector = "lancedb"
+
+    return graph, vector
+
+
 # ---------------------------------------------------------------------------
 # PUT /api/v3/storage/config
 # ---------------------------------------------------------------------------
@@ -519,3 +578,126 @@ def put_graph_config(request: Request, body: GraphPruningConfigUpdate):
     except Exception:
         logger.exception("put_graph_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
+
+
+# ---------------------------------------------------------------------------
+# Ollama model selection
+# ---------------------------------------------------------------------------
+
+
+class OllamaModelCheck(BaseModel):
+    """A model a user is considering, and what they want to use it for."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    model_name: str = Field(..., min_length=1, max_length=200)
+    role: str = Field("embedding", pattern="^(embedding|generation)$")
+
+
+@router.get("/ollama/models")
+def get_ollama_models():
+    """Which Ollama models are installed, and which two are in use.
+
+    A user picking a model should be picking from a list, not typing a name and
+    finding out later that they typed it wrong.
+    """
+    from superlocalmemory.core.ollama_validator import DEFAULT_BASE_URL
+
+    try:
+        data = _read_config()
+        embedding = data.get("embedding") or {}
+        llm = data.get("llm") or {}
+        base_url = llm.get("base_url") or DEFAULT_BASE_URL
+
+        installed: list[dict] = []
+        reachable = True
+        detail = ""
+        try:
+            import httpx
+
+            response = httpx.get(f"{base_url.rstrip('/')}/api/tags", timeout=3.0)
+            if response.status_code == 200:
+                for entry in response.json().get("models", []):
+                    installed.append({
+                        "name": entry.get("name", ""),
+                        "size": entry.get("size", 0),
+                    })
+            else:
+                reachable = False
+                detail = f"Ollama answered {response.status_code}."
+        except Exception as exc:  # noqa: BLE001 - reported, not raised
+            reachable = False
+            detail = f"Ollama is not running at {base_url}. Start it with: ollama serve ({exc})"
+
+        return {
+            "reachable": reachable,
+            "detail": detail,
+            "base_url": base_url,
+            "installed": sorted(installed, key=lambda m: m["name"]),
+            "embedding_model": embedding.get("ollama_model", ""),
+            "generation_model": llm.get("model", "") if llm.get("provider") == "ollama" else "",
+            "stored_dimension": _stored_dimension(),
+        }
+    except Exception:
+        logger.exception("get_ollama_models failed")
+        return JSONResponse({"error": "Internal server error"}, status_code=500)
+
+
+@router.post("/ollama/validate")
+def post_ollama_validate(request: Request, body: OllamaModelCheck):
+    """Ask the server to actually use the model, before anything is saved.
+
+    For the embedding role this also decides whether the switch is safe for this
+    store: two vector widths cannot be compared, and a store holding both
+    answers similarity questions with noise rather than failing.
+    """
+    _require_admin(request)
+    from superlocalmemory.core.ollama_validator import (
+        DEFAULT_BASE_URL,
+        EMBEDDING,
+        check_embedding_model_change,
+        validate_ollama_model,
+    )
+
+    try:
+        data = _read_config()
+        llm = data.get("llm") or {}
+        embedding = data.get("embedding") or {}
+        base_url = llm.get("base_url") or DEFAULT_BASE_URL
+
+        if body.role != EMBEDDING:
+            probe = validate_ollama_model(body.model_name, body.role, base_url=base_url)
+            return {
+                "ok": probe.ok,
+                "message": probe.message,
+                "role": body.role,
+                "model_name": body.model_name,
+                "dimension": probe.dimension,
+                "safe_to_apply": probe.ok,
+            }
+
+        decision = check_embedding_model_change(
+            body.model_name,
+            db_path=MEMORY_DIR / "memory.db",
+            current_model=embedding.get("ollama_model", "")
+                or embedding.get("model_name", ""),
+            base_url=base_url,
+        )
+        return {
+            "ok": decision.allowed,
+            "message": decision.message,
+            "role": body.role,
+            "model_name": body.model_name,
+            "dimension": decision.new_dimension,
+            "stored_dimension": decision.stored_dimension,
+            "safe_to_apply": decision.allowed,
+        }
+    except Exception:
+        logger.exception("post_ollama_validate failed")
+        return JSONResponse({"error": "Internal server error"}, status_code=500)
+
+
+def _stored_dimension() -> int | None:
+    from superlocalmemory.core.ollama_validator import stored_embedding_dimension
+
+    return stored_embedding_dimension(MEMORY_DIR / "memory.db")

package/src/superlocalmemory/server/routes/evolution.py

@@ -330,3 +330,181 @@ def evolution_lineage(request: Request, skill_name: str = ""):
     finally:
         if conn is not None:
             conn.close()
+
+
+# ---------------------------------------------------------------------------
+# Approving a quarantined skill
+#
+# A mutation that passes blind verification stops at VERIFIED_QUARANTINED and
+# waits. Nothing moved it from there: auto-approval is off by default, correctly
+# — this system rewrites the instructions an AI follows, and doing that without
+# a person saying yes is not a default anyone should ship. But there was no way
+# for the person to say yes either, so every verified improvement sat in a
+# quarantine directory permanently.
+#
+# This is that path. It does NOT change the default: approval remains explicit,
+# per-candidate, and recorded in the transition chain with who did it.
+# ---------------------------------------------------------------------------
+
+
+class ApproveSkillRequest(BaseModel):
+    """Which candidate to approve. Named by record id, not by skill name.
+
+    A skill can have several candidates over time and only one of them is the
+    one being looked at. Approving "the latest candidate for skill X" would make
+    the outcome depend on when the call happened to arrive.
+    """
+
+    record_id: str
+
+
+_APPROVABLE = ("verified_quarantined", "promoted")
+
+
+@router.post("/api/evolution/approve")
+def evolution_approve(request: Request, body: ApproveSkillRequest):
+    """Activate a quarantined skill mutation after human approval."""
+    _require_manage(request)
+    try:
+        from superlocalmemory.evolution.evolution_store import EvolutionStore
+        from superlocalmemory.evolution.skill_activator import SkillActivator
+        from superlocalmemory.evolution.types import EvolutionStatus
+
+        profile_id = get_active_profile()
+        store = EvolutionStore(str(MEMORY_DIR / "memory.db"))
+
+        record = store.get_record(body.record_id, profile_id)
+        if record is None:
+            return {"success": False, "error": "No such evolution candidate"}
+
+        # Prefer the transition chain over the record's own column: the chain is
+        # the audited history and the column is a cache of its last entry.
+        latest = store.get_latest_status(body.record_id, profile_id)
+        current = (latest.value if latest is not None
+                   else getattr(record.status, "value", ""))
+
+        if current not in _APPROVABLE:
+            # Refusing an already-active candidate matters: activating twice
+            # would overwrite the backup taken the first time with the mutation
+            # itself, and the rollback target would become the thing being
+            # rolled back.
+            return {
+                "success": False,
+                "error": (
+                    f"Candidate is {current!r}; only a verified candidate "
+                    "awaiting approval can be activated"
+                ),
+                "status": current,
+            }
+
+        if not record.quarantine_dir_name:
+            return {
+                "success": False,
+                "error": "Candidate has no quarantined artifact to activate",
+            }
+
+        actor = "dashboard"
+
+        # Approval is recorded BEFORE the file moves, activation after. The
+        # order matters in both directions:
+        #
+        # * recording both afterwards means a successful activation whose log
+        #   write fails leaves the skill live and the record saying it is not —
+        #   so the next approval attempt is allowed, and activating twice
+        #   overwrites the backup that rollback restores from.
+        # * recording both beforehand would claim a mutation is live when the
+        #   file move failed.
+        #
+        # Approved-then-nothing is a state a person can act on. Live-but-unknown
+        # is not.
+        store.append_transition(
+            body.record_id, profile_id,
+            EvolutionStatus(current), EvolutionStatus.APPROVED,
+            actor_id=actor, reason="approved by request",
+        )
+        try:
+            activation = SkillActivator().activate(
+                record.skill_name, record.quarantine_dir_name, actor_id=actor,
+            )
+        except Exception as exc:
+            # The approval stands and the mutation did not go live. Recorded as
+            # such rather than left dangling.
+            store.append_transition(
+                body.record_id, profile_id,
+                EvolutionStatus.APPROVED, EvolutionStatus.REJECTED,
+                actor_id=actor, reason=f"activation failed: {exc}",
+            )
+            raise
+        store.append_transition(
+            body.record_id, profile_id,
+            EvolutionStatus.APPROVED, EvolutionStatus.ACTIVE,
+            actor_id=actor, reason="activated from quarantine",
+            metadata={"content_hash": activation.get("content_hash", "")},
+        )
+
+        return {
+            "success": True,
+            "record_id": body.record_id,
+            "skill_name": record.skill_name,
+            "status": EvolutionStatus.ACTIVE.value,
+            "live_path": activation.get("live_path"),
+            "backup_path": activation.get("backup_path"),
+            "content_hash": activation.get("content_hash"),
+            # So the caller knows how to undo it without reading the source.
+            "rollback": "POST /api/evolution/rollback",
+        }
+    except FileNotFoundError as exc:
+        return {"success": False, "error": f"Quarantined artifact missing: {exc}"}
+    except Exception:
+        logger.exception("evolution_approve error")
+        return {"success": False, "error": "Internal server error"}
+
+
+class RollbackSkillRequest(BaseModel):
+    skill_name: str
+    #: Optional, so the reversal can be recorded against the candidate it
+    #: reverses. Without it the file is restored and the log still says active,
+    #: which reads as "this mutation is live" forever.
+    record_id: str = ""
+
+
+@router.post("/api/evolution/rollback")
+def evolution_rollback(request: Request, body: RollbackSkillRequest):
+    """Restore a skill's previous instructions after an approval goes wrong.
+
+    Approval is reversible, and it has to be: the reason a person is in this
+    loop is that a verified mutation can still be a bad one, and finding that
+    out happens after it is live.
+    """
+    _require_manage(request)
+    try:
+        from superlocalmemory.evolution.evolution_store import EvolutionStore
+        from superlocalmemory.evolution.skill_activator import SkillActivator
+        from superlocalmemory.evolution.types import EvolutionStatus
+
+        result = SkillActivator().rollback(body.skill_name)
+
+        # Record the reversal. A restored file with the log still reading
+        # "active" says the mutation is live when it is not, and that is the
+        # record an audit would read.
+        if body.record_id:
+            try:
+                store = EvolutionStore(str(MEMORY_DIR / "memory.db"))
+                pid = get_active_profile()
+                latest = store.get_latest_status(body.record_id, pid)
+                store.append_transition(
+                    body.record_id, pid,
+                    latest or EvolutionStatus.ACTIVE,
+                    EvolutionStatus.ROLLED_BACK,
+                    actor_id="dashboard", reason="rolled back by request",
+                )
+            except Exception as exc:  # pragma: no cover — the file is restored
+                logger.warning("rollback recorded no transition: %s", exc)
+                result["transition_recorded"] = False
+
+        return {"success": True, **result}
+    except FileNotFoundError as exc:
+        return {"success": False, "error": f"No backup to restore: {exc}"}
+    except Exception:
+        logger.exception("evolution_rollback error")
+        return {"success": False, "error": "Internal server error"}

package/src/superlocalmemory/server/routes/ingest.py

@@ -81,6 +81,14 @@ async def ingest(req: IngestRequest, request: Request):
             request,
             actor_kind="http-ingest",
         )
+        # Machine authentication says which process is calling. It does not say
+        # whether that caller's user may write to this workspace. Every other
+        # write route asks that question; this one did not, so a viewer could
+        # write through it in a workspace that requires a login.
+        from superlocalmemory.access.rbac import Permission
+        from superlocalmemory.server.rbac_enforce import require_permission
+
+        require_permission(request, Permission.WRITE, profile=engine._profile_id)
         command = build_engine_ingestion_command(engine)
         receipt, created = command.submit_with_status(IngestionRequest(
             content=req.content,

package/src/superlocalmemory/server/routes/learning_telemetry.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 import logging
 import sqlite3
 from pathlib import Path
+from superlocalmemory.learning.signal_kinds import FEEDBACK_ONLY_SQL
 
 logger = logging.getLogger("superlocalmemory.routes.learning")
 
@@ -24,7 +25,7 @@ class ReadOnlyRankerStore:
         try:
             row = connection.execute(
                 "SELECT COUNT(*) AS count FROM learning_signals "
-                "WHERE profile_id = ?",
+                f"WHERE profile_id = ?{FEEDBACK_ONLY_SQL}",
                 (profile_id,),
             ).fetchone()
             return int(row["count"] if row else 0)

package/src/superlocalmemory/server/routes/memories.py

@@ -13,6 +13,11 @@ from typing import Optional
 
 from fastapi import APIRouter, HTTPException, Query, Request
 
+from superlocalmemory.core.config import BROWSE_PAGE_SIZE
+from superlocalmemory.storage.database import (
+    visible_fact_clause_for_connection,
+)
+
 from .helpers import (
     SearchRequest,
     dict_factory,
@@ -131,10 +136,20 @@ def _admit_http_mutation(request: Request, operation: str) -> None:
         resolve_principal,
     )
 
+    from superlocalmemory.core.admission import _company_mode_active
+
+    # Both switches, the same rule the other entry points use. Reading
+    # config.toml alone left this path treating a workspace as personal after
+    # the dashboard toggle had turned per-user access on -- so a write refused
+    # everywhere else was admitted here.
     deployment = getattr(request.app.state, "deployment", None)
-    is_enterprise = bool(deployment and deployment.is_enterprise)
-    tier = "enterprise" if is_enterprise else "personal"
-    mode = "company" if is_enterprise else "local"
+    if deployment is None:
+        from superlocalmemory.core.admission import _resolve_deployment
+
+        deployment = _resolve_deployment()
+    company = _company_mode_active(deployment)
+    tier = "enterprise" if company else "personal"
+    mode = "company" if company else "local"
 
     principal_info = resolve_principal(request)
     principal = str(principal_info.get("user_id") or "")
@@ -388,7 +403,7 @@ async def get_memories(
     cluster_id: Optional[int] = None,
     min_importance: Optional[int] = None,
     tags: Optional[str] = None,
-    limit: int = Query(50, ge=1, le=200),
+    limit: int = Query(BROWSE_PAGE_SIZE, ge=1, le=200),
     offset: int = Query(0, ge=0),
     filter: Optional[str] = Query(
         None,
@@ -444,15 +459,24 @@ async def get_memories(
                 scope_where = "profile_id = ?"
                 scope_params = [active_profile]
 
+            # Withheld rows are excluded from BOTH the page and the total. On
+            # the author's store this list served 24 model-authored summaries
+            # in its first 50 rows and reported 5,218 memories against 3,919
+            # real ones -- the count a user reads, inflated by exactly the
+            # 1,299 rows 4.0.10 withheld.
+            visible = visible_fact_clause_for_connection(conn)
             query = (
                 "SELECT fact_id as id, memory_id, content, fact_type as category, "
                 "confidence as importance, access_count, "
                 "created_at, created_at as updated_at, "
                 "session_id as project_name, scope, shared_with "
-                f"FROM atomic_facts WHERE {scope_where}"
+                f"FROM atomic_facts WHERE {scope_where}{visible}"
             )
             params = list(scope_params)
-            count_base = f"SELECT COUNT(*) as total FROM atomic_facts WHERE {scope_where}"
+            count_base = (
+                "SELECT COUNT(*) as total FROM atomic_facts "
+                f"WHERE {scope_where}{visible}"
+            )
         else:
             query = """
                 SELECT id, content, summary, category, project_name, project_path,
@@ -656,6 +680,11 @@ async def search_memories(request: Request, body: SearchRequest):
                 lambda: engine.recall(
                     body.query, limit=body.limit, fast=True,
                     window=_window or None,
+                    # Name the surface. A recall with no name leaves no record
+                    # an outcome can be matched to, and a search typed into the
+                    # dashboard is one continuous thread of use, not a
+                    # conversation turn.
+                    session_id=f"dashboard:{get_active_profile()}",
                 ),
             )
             # A run_in_executor thread cannot be cancelled, and wait_for() on it
@@ -803,6 +832,13 @@ async def get_summary(request: Request, kind: str = "day", target: str = ""):
     except Exception:
         raise _internal_error("Summary generation error")
 
+    # Say why, not just what. The response already reported that a summary was
+    # assembled rather than written; someone seeing a plainer result than they
+    # expected still had no way to learn that a written one needs a model, and
+    # would reasonably read the feature as broken.
+    from superlocalmemory.core.mode_capability import llm_capability
+
+    generated = str(getattr(result, "generated_by", "") or "")
     return {
         "kind": result.kind,
         "profile_id": result.profile_id,
@@ -812,6 +848,12 @@ async def get_summary(request: Request, kind: str = "day", target: str = ""):
         "source_fact_ids": result.source_fact_ids,
         "source_count": len(result.source_fact_ids),
         "metadata": result.metadata,
+        "capability": llm_capability(
+            cfg,
+            # This call has just been made, so its outcome is the honest answer
+            # about availability -- better than asking the configuration again.
+            llm_reachable=generated.startswith("llm"),
+        ),
     }
 
 
@@ -992,7 +1034,7 @@ async def get_clusters(request: Request):
 async def get_cluster_detail(
     request: Request,
     cluster_id: str,
-    limit: int = Query(50, ge=1, le=200),
+    limit: int = Query(BROWSE_PAGE_SIZE, ge=1, le=200),
 ):
     """Get detailed view of a specific cluster (scene)."""
     try:

package/src/superlocalmemory/server/routes/timeline.py

@@ -17,6 +17,9 @@ import sqlite3
 from fastapi import APIRouter, Query
 from fastapi.responses import JSONResponse
 from superlocalmemory.server.routes.helpers import DB_PATH, get_active_profile, get_read_connection
+from superlocalmemory.storage.database import (
+    visible_fact_clause_for_connection,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -82,6 +85,7 @@ async def get_timeline(
             "confidence, session_id "
             "FROM atomic_facts "
             "WHERE profile_id = ? AND created_at >= ? AND lifecycle = 'active' "
+            f"{visible_fact_clause_for_connection(conn)} "
             "ORDER BY created_at DESC LIMIT ?",
             (pid, start_date, INTERNAL_CEILING),
         ).fetchall()