superlocalmemory 4.0.6 → 4.0.8

package/src/superlocalmemory/server/recall_serializer.py

@@ -170,6 +170,7 @@ def serialize_recall_response(
     total_max: int = 12000,
     full: bool = False,
     include_source: bool = False,
+    include_marker: bool = False,
 ) -> tuple[list[dict], bool]:
     """Convert a RecallResponse into budgeted, source-disciplined dicts.
 
@@ -185,10 +186,33 @@ def serialize_recall_response(
         total_max:      Total content char budget before stubs (config-driven).
         full:           Bypass clamping/stubs (additive escape hatch).
         include_source: Return full source_content (else ≤280-char preview).
+        include_marker: Emit each result's HMAC usage marker. See below.
 
     Returns:
         (results, no_confident_match) — results is a list of dicts; the bool
         is the evidence-floor signal lifted from the response (additive).
+
+    THE MARKER, AND WHY IT WAS MISSING
+    ----------------------------------
+    ``run_recall`` sets ``result.marker`` on every result — an HMAC of the
+    fact id, computed on the hot path already. Until 4.0.8 **no serialiser
+    ever read it**, so the value was computed and discarded on every recall.
+
+    That one omission broke the entire closed learning loop. The
+    ``post_tool_outcome`` hook settles an outcome by finding a validated
+    ``slm:fact:<id>:<hmac8>`` marker in a later tool response; with markers
+    never reaching the agent it found nothing, every outcome settled at the
+    formula's 0.5 base, and the consequences were visible all the way out to
+    the dashboard: 162 outcomes at the default label, all 294 source-quality
+    observations at exactly 0.5, therefore ``alpha == beta`` for all 18
+    sources and "no quality signal has settled", and 165 bandit arms with 4
+    plays between them.
+
+    Off by default, and gated by the caller on ``session_id``. A marker costs
+    roughly 33 characters of the agent's context per result, and it can only
+    buy a signal when a ``pending_outcomes`` row exists to settle — which
+    happens only for session-bearing recalls. Spending context on an ad-hoc
+    recall that could never learn from it is pure waste.
     """
     memory_map = memory_map or {}
     # T-inject: one shared "now" so every result's age label is consistent.
@@ -200,7 +224,7 @@ def serialize_recall_response(
         _created = getattr(fact, "created_at", "") or ""
         fact_type = getattr(fact, "fact_type", None)
         lifecycle = getattr(fact, "lifecycle", None)
-        raw.append({
+        entry = {
             "fact_id": fact.fact_id,
             "memory_id": fact.memory_id,
             "content": fact.content or "",
@@ -235,7 +259,15 @@ def serialize_recall_response(
             # weigh recency without doing date math. "" when undated.
             "age_label": relative_age(_created, _now),
             "evidence_chain": list(getattr(r, "evidence_chain", []) or []),
-        })
+        }
+        # Only when asked, and only when the engine actually produced one —
+        # an empty key would be indistinguishable from a marker that failed
+        # to compute, and the hook validates before trusting anything anyway.
+        if include_marker:
+            marker = getattr(r, "marker", "") or ""
+            if marker:
+                entry["marker"] = marker
+        raw.append(entry)
 
     # F-3 source discipline, then F-2 budget — order matters (discipline first
     # so the template firewall runs before any preview slicing).

package/src/superlocalmemory/server/routes/agents.py

@@ -106,24 +106,68 @@ async def get_agent_memory_activity(
         conn = get_read_connection(DB_PATH)
         try:
             try:
-                rows = conn.execute(
-                    "SELECT CASE WHEN trusted_actor_id='' THEN 'unknown' "
-                    "ELSE trusted_actor_id END AS agent_id, "
+                # Group by the agent's OWN identity, not by the capability that
+                # authorised the write.
+                #
+                # This grouped by ``trusted_actor_id``, which on a real store is
+                # a capability digest — 43 distinct agents rendered as 43 rows of
+                # ``daemon-capability:923b7d6e616f46d3...`` and not one readable
+                # name. For a pane whose entire purpose is telling agents apart,
+                # that is the same as showing nothing.
+                #
+                # The real name was already being stored the whole time: writers
+                # pass ``agent_id`` and it lands in ``raw_metadata_json``. On this
+                # store that yields claude-desktop, claude, gemini, codex, grok
+                # and mcp_client. Capability digests remain available per row for
+                # audit — they answer "what was allowed to write this", which is a
+                # different and also useful question, just not this pane's.
+                # raw_metadata_json is absent on stores predating it. Try the
+                # identity query and fall back to capability grouping if the
+                # column is missing — without this, the OperationalError is
+                # caught below and an older install shows ZERO agents while
+                # having plenty. Deliberately not PRAGMA table_info: this
+                # handler is on the dashboard read path, which is gated against
+                # anything that parses as DDL.
+                _tail = (
                     "COUNT(*) AS cnt, MAX(created_at) AS last_active, "
-                    "GROUP_CONCAT(DISTINCT source_type) AS sources "
+                    "GROUP_CONCAT(DISTINCT source_type) AS sources, "
+                    "COUNT(DISTINCT NULLIF(trusted_actor_id, '')) AS capabilities "
                     "FROM ingestion_operations WHERE profile_id=? "
                     "GROUP BY agent_id ORDER BY cnt DESC, agent_id ASC "
-                    "LIMIT 500",
-                    (pid,),
-                ).fetchall()
+                    "LIMIT 500"
+                )
+                try:
+                    rows = conn.execute(
+                        "SELECT COALESCE("
+                        "  NULLIF(json_extract(raw_metadata_json, '$.agent_id'), ''),"
+                        "  NULLIF(trusted_actor_id, ''),"
+                        "  'unknown'"
+                        ") AS agent_id, " + _tail,
+                        (pid,),
+                    ).fetchall()
+                except sqlite3.OperationalError:
+                    rows = conn.execute(
+                        "SELECT COALESCE(NULLIF(trusted_actor_id, ''), 'unknown')"
+                        " AS agent_id, " + _tail,
+                        (pid,),
+                    ).fetchall()
                 for r in rows:
+                    name = r["agent_id"]
                     agents.append({
-                        "agent_id": r["agent_id"],
+                        "agent_id": name,
                         "count": r["cnt"],
                         "last_active": r["last_active"],
                         "source_types": (
                             [s for s in (r["sources"] or "").split(",") if s]
                         ),
+                        # How many distinct capabilities this agent wrote under.
+                        "capability_count": r["capabilities"],
+                        # True when we fell back to a digest — the UI can then say
+                        # "this writer did not identify itself" instead of
+                        # presenting a hash as though it were a name.
+                        "identified": not str(name).startswith(
+                            ("daemon-capability:", "local-capability:")
+                        ) and name != "unknown",
                     })
                     total += r["cnt"]
             except sqlite3.OperationalError:

package/src/superlocalmemory/server/routes/brain.py

@@ -1764,6 +1764,114 @@ async def patterns_deprecated(
     }
 
 
+@router.get("/bounded-loops/evidence",
+            dependencies=[Depends(require_install_token)])
+async def bounded_loops_evidence(
+    request: Request, profile_id: str | None = None, limit: int = 20,
+) -> dict:
+    """Terminal Bounded Loops runs this profile has observed.
+
+    Bounded Loops is a SEPARATE PRODUCT. SLM is one optional consumer of a
+    document any MCP client can request over the published contract
+    ``bounded-loops.dev/slm-bridge/v1``; neither product depends on the other,
+    and installing either alone is complete.
+
+    What travels is deliberately narrow, and the pane must not imply otherwise:
+
+    * **Observation, not authorization.** ``eligible_for_learning`` is a hard
+      field in the contract and is always ``False`` in v1. A SUCCEEDED run is
+      not permission to retrain, re-rank or route on it. Nothing in SLM treats
+      it as such, and this endpoint returns the flag so the UI can say so.
+    * **Digests, not paths.** ``workspace_id`` is a hash precisely so a client's
+      directory name never reaches a memory system. Gate reasons, artifact
+      contents, commands and environment values are excluded at the source.
+    * **``local_hash_chain_only``.** The receipt log is an append-only hash
+      chain on local disk: tampering is detectable by anyone holding an earlier
+      head. That is NOT authentication, notarization or independent audit, and
+      calling it "verified" would claim a guarantee no part of the system
+      provides.
+    * **``demonstration``** separates real execution from a scripted replay. A
+      demo run proves the wiring works and proves nothing about the work.
+
+    Read-only, off the hot path, and empty is a normal answer — most installs
+    have no Bounded Loops at all.
+    """
+    profile_id = _authorized_profile(request, profile_id)
+    limit = max(1, min(int(limit or 20), 100))
+
+    out: dict[str, Any] = {
+        "contract": "bounded-loops.dev/slm-bridge/v1",
+        "control_plane": "observation_only",
+        "runs": [],
+        "total": 0,
+        "demonstration_count": 0,
+        "installed": None,
+    }
+
+    try:
+        out["installed"] = bool(_compute_bounded_loops().get("installed"))
+    except Exception:  # pragma: no cover — presence probe must never 500
+        out["installed"] = None
+
+    db_path = _learning_db_path()
+    if not db_path.exists():
+        return out
+
+    import sqlite3
+
+    try:
+        conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True, timeout=3)
+        conn.row_factory = sqlite3.Row
+        try:
+            rows = conn.execute(
+                "SELECT run_id, run_ref, outcome, run_state, demonstration,"
+                " eligible_for_learning, terminal_at, observed_at,"
+                " receipt_sequence, receipt_trust, workspace_id, contract_id"
+                " FROM external_evidence_receipts WHERE profile_id=?"
+                " ORDER BY observed_at DESC LIMIT ?",
+                (profile_id, limit),
+            ).fetchall()
+            total = conn.execute(
+                "SELECT COUNT(*) AS n FROM external_evidence_receipts"
+                " WHERE profile_id=?", (profile_id,),
+            ).fetchone()["n"]
+            demos = conn.execute(
+                "SELECT COUNT(*) AS n FROM external_evidence_receipts"
+                " WHERE profile_id=? AND demonstration=1", (profile_id,),
+            ).fetchone()["n"]
+        finally:
+            conn.close()
+    except sqlite3.Error as exc:
+        # The table only exists once the bridge has been used. Absent is a
+        # normal state, not an error, and must not surface as a failed pane.
+        logger.debug("bounded-loops evidence unavailable: %s", exc)
+        return out
+
+    out["total"] = total
+    out["demonstration_count"] = demos
+    out["runs"] = [
+        {
+            "run_id": r["run_id"],
+            "run_ref": r["run_ref"],
+            "outcome": r["outcome"],
+            # Both, because the mapping to three buckets loses information: a
+            # HALTED run (budget/policy stop) and a FAILED run (work the gate
+            # rejected) are different events.
+            "run_state": r["run_state"],
+            "demonstration": bool(r["demonstration"]),
+            "eligible_for_learning": bool(r["eligible_for_learning"]),
+            "terminal_at": r["terminal_at"],
+            "observed_at": r["observed_at"],
+            "receipt_sequence": r["receipt_sequence"],
+            "trust": r["receipt_trust"],
+            "workspace_id": r["workspace_id"],
+            "contract": r["contract_id"],
+        }
+        for r in rows
+    ]
+    return out
+
+
 @router.get("/behavioral",
             dependencies=[Depends(require_install_token)])
 async def behavioral_deprecated(

package/src/superlocalmemory/server/routes/memories.py

@@ -747,6 +747,159 @@ async def search_memories(request: Request, body: SearchRequest):
         end_recall()
 
 
+@router.get("/api/summary")
+async def get_summary(request: Request, kind: str = "day", target: str = ""):
+    """Readable summary of memories: a day, a project, or one session (#113).
+
+    The dashboard surface for the summary layer. 4.0.6 shipped the generators
+    with no caller, 4.0.7 added the CLI, 4.0.8 adds this and the MCP tool — the
+    "no command, tool or endpoint" gap, closed at the third point.
+
+    Always returns ``coverage`` and ``source_fact_ids``: a summary that hides how
+    much it covered is the opaque generic summary issue #113 warned against.
+    Reads memory.db directly; never runs during remember or recall.
+    """
+    from datetime import date as _date, timedelta as _timedelta
+
+    kind = (kind or "day").strip().lower()
+    if kind not in ("day", "project", "session"):
+        raise HTTPException(status_code=400, detail=f"unknown summary kind '{kind}'")
+
+    profile = get_active_profile()
+    from superlocalmemory.infra.data_root import state_path
+    db_path = state_path("memory.db")
+    if not db_path.exists():
+        raise HTTPException(status_code=404, detail="no memory database")
+
+    # Pass the loaded config so Mode B/C write the summary. Omitting it silently
+    # forces the extractive path for every caller regardless of mode.
+    try:
+        from superlocalmemory.core.config import SLMConfig
+        cfg = SLMConfig.load()
+    except Exception:
+        cfg = None
+
+    try:
+        if kind == "day":
+            from superlocalmemory.summaries import generate_daily_reflection
+            day = (target or "").strip() or _date.today().isoformat()
+            if day == "today":
+                day = _date.today().isoformat()
+            elif day == "yesterday":
+                day = (_date.today() - _timedelta(days=1)).isoformat()
+            result = generate_daily_reflection(db_path, day, profile, cfg)
+        elif kind == "project":
+            if not (target or "").strip():
+                raise HTTPException(status_code=400, detail="project requires target")
+            from superlocalmemory.summaries import generate_project_work_log
+            result = generate_project_work_log(db_path, target.strip(), profile, cfg)
+        else:
+            if not (target or "").strip():
+                raise HTTPException(status_code=400, detail="session requires target")
+            from superlocalmemory.summaries import generate_session_summary
+            result = generate_session_summary(db_path, target.strip(), profile, cfg)
+    except HTTPException:
+        raise
+    except Exception:
+        raise _internal_error("Summary generation error")
+
+    return {
+        "kind": result.kind,
+        "profile_id": result.profile_id,
+        "summary": result.content,
+        "coverage": result.coverage,
+        "generated_by": result.generated_by,
+        "source_fact_ids": result.source_fact_ids,
+        "source_count": len(result.source_fact_ids),
+        "metadata": result.metadata,
+    }
+
+
+@router.get("/api/summary/projects")
+async def get_summary_projects(request: Request):
+    """Projects SuperLocalMemory has actually observed, for the summary picker.
+
+    WHY THIS EXISTS
+    ---------------
+    SLM is installed globally and the dashboard is a browser tab — it has no
+    working directory, so there is no such thing as "this project" from the
+    server's point of view. 4.0.8 shipped a "This project" button that sent an
+    empty target and produced "project requires target" every time. A button
+    that cannot know its own answer is the wrong control; a list of the projects
+    we have seen is the right one.
+
+    Scope comes from ``tool_events.project_path`` — the directory an agent was
+    working in when it called SLM. Deliberately NOT ``entity_profiles.
+    project_name``, which has exactly one distinct value on a real store (see
+    the note at the top of summaries/project_work_log.py).
+
+    ``tool_events`` is a bounded ring buffer, so this lists recently active
+    projects rather than every project in history. ``truncated`` says so
+    honestly instead of implying the list is exhaustive.
+    """
+    profile = get_active_profile()
+    try:
+        conn = get_db_connection()
+        # get_db_connection() hands back a SHARED read connection, and other
+        # handlers set row_factory on it. Never index these rows positionally —
+        # whichever handler ran last decides whether r[0] is a column or a
+        # KeyError. Name the columns and read them by name.
+        conn.row_factory = dict_factory
+        cursor = conn.cursor()
+        cursor.execute(
+            """
+            SELECT project_path AS path, COUNT(*) AS events
+              FROM tool_events
+             WHERE project_path IS NOT NULL AND project_path != ''
+               AND profile_id = ?
+             GROUP BY project_path
+             ORDER BY events DESC
+             LIMIT 50
+            """,
+            (profile,),
+        )
+        rows = cursor.fetchall()
+        total = cursor.execute(
+            "SELECT COUNT(*) AS n FROM tool_events"
+        ).fetchone()["n"]
+    except Exception:
+        raise _internal_error("Project list error")
+
+    projects = [
+        {
+            "path": r["path"],
+            "events": r["events"],
+            "label": _project_label(r["path"]),
+        }
+        for r in rows
+    ]
+    return {
+        "projects": projects,
+        "profile_id": profile,
+        # Surfaced so the UI can explain an unexpectedly short list rather than
+        # leaving the user to assume their project was never recorded.
+        "truncated": total >= _TOOL_EVENT_RING_SIZE,
+        "event_rows": total,
+    }
+
+
+#: tool_events is capped; at the cap the project list is a recent window, not history.
+_TOOL_EVENT_RING_SIZE = 2000
+
+
+def _project_label(path: str) -> str:
+    """Short, human label for a project path.
+
+    Full paths are long and share prefixes ("/Users/x/Documents/official/..."),
+    so a dropdown of raw paths is unreadable. Last two segments keep sibling
+    projects distinguishable without the noise.
+    """
+    parts = [p for p in str(path).replace("\\", "/").split("/") if p]
+    if not parts:
+        return str(path)
+    return "/".join(parts[-2:]) if len(parts) > 1 else parts[-1]
+
+
 @router.get("/api/clusters")
 async def get_clusters(request: Request):
     """Get cluster information with member counts and statistics."""
@@ -1061,6 +1214,7 @@ async def get_fact_detail(request: Request, fact_id: str):
             )
         except Exception:
             row["canonical_entities"] = []
+        row["code_links"] = _code_links_for_fact(fact_id)
         return row
     except HTTPException:
         raise
@@ -1068,6 +1222,66 @@ async def get_fact_detail(request: Request, fact_id: str):
         raise _internal_error("Fact detail error")
 
 
+def _code_links_for_fact(fact_id: str) -> list[dict]:
+    """Code entities this fact mentions, from the code graph.
+
+    Fail-open by design: this is a display extra on a detail popup. No code graph
+    built, bridge switched off, or database missing all mean "no section shown",
+    never an error on the fact itself. A user who has never touched the code
+    graph must not see a failure because of a feature they do not use.
+
+    Reads code_graph.db, which is a separate database from memory.db and is never
+    opened by the recall path — so nothing here can affect recall.
+    """
+    try:
+        from superlocalmemory.code_graph.config import CodeGraphConfig
+
+        cfg = CodeGraphConfig.load()
+        if not (cfg.enabled and cfg.bridge_enabled):
+            return []
+        db_path = cfg.get_db_path()
+        if not db_path.exists():
+            return []
+
+        import sqlite3
+
+        conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True)
+        try:
+            conn.row_factory = dict_factory
+            rows = conn.execute(
+                "SELECT cml.link_type, cml.confidence, cml.is_stale, "
+                "       cml.enriched_description, "
+                "       gn.name, gn.qualified_name, gn.kind, gn.file_path "
+                "FROM code_memory_links cml "
+                "LEFT JOIN graph_nodes gn ON gn.node_id = cml.code_node_id "
+                "WHERE cml.slm_fact_id = ? "
+                "ORDER BY cml.confidence DESC, gn.qualified_name",
+                (fact_id,),
+            ).fetchall()
+        finally:
+            conn.close()
+
+        return [
+            {
+                "name": r.get("name") or "",
+                "qualified_name": r.get("qualified_name") or "",
+                "kind": r.get("kind") or "",
+                "file_path": r.get("file_path") or "",
+                "link_type": r.get("link_type") or "mentions",
+                "confidence": r.get("confidence"),
+                "is_stale": bool(r.get("is_stale")),
+                "description": r.get("enriched_description") or "",
+            }
+            for r in rows
+            # A link whose node is gone (LEFT JOIN produced no row) is a stale
+            # pointer, not something to render as a blank entry.
+            if r.get("qualified_name")
+        ]
+    except Exception:
+        logger.debug("code links unavailable for %s", fact_id, exc_info=True)
+        return []
+
+
 @router.delete("/api/memories/{fact_id}")
 async def delete_memory(request: Request, fact_id: str):
     """Delete a specific memory (atomic fact) by ID."""

package/src/superlocalmemory/server/routes/v3_api.py

@@ -1932,55 +1932,33 @@ async def trigger_consolidation(request: Request):
             profile_id=pid,
         )
 
-        # v3.7.8 SEC-M-01: the prior "WorkerPool" fast path called
-        # ``pool.send_command(...)``, a method that does not exist on
-        # WorkerPool — every call raised AttributeError, was silently
-        # swallowed by the bare ``except``, and fell through to this direct
-        # path unconditionally. That dead branch is removed; consolidation
-        # always runs directly against a lease-protected DB connection so a
-        # concurrent profile switch cannot commit mid-consolidation.
-        #
-        # v3.4.64: ConsolidationEngine.consolidate() is CPU/IO bound (seconds
-        # to minutes). Calling it directly in an async route blocks the ASGI
-        # event loop.  Moved into asyncio.to_thread() so the event loop stays
-        # live.  The runtime.operation() lease is acquired INSIDE the thread —
-        # blocking a thread is fine; blocking the event loop is not.
-        import asyncio as _asyncio
-        from superlocalmemory.core.config import SLMConfig
-        from superlocalmemory.storage.database import DatabaseManager
-        from superlocalmemory.storage import schema as _schema
-        from superlocalmemory.core.consolidation_engine import ConsolidationEngine
-        from superlocalmemory.server.profile_runtime import get_profile_runtime
-
-        _app_state = request.app.state
+        # 4.0.8: the body of this handler moved to server/consolidation_runner
+        # so the periodic daemon trigger and this endpoint run the SAME code
+        # under the SAME lock. Two copies would be two definitions of
+        # "consolidated", and only one of them would get maintained.
+        from superlocalmemory.server.consolidation_runner import (
+            run_full_consolidation,
+        )
 
-        def _run_consolidation() -> dict:
-            runtime = get_profile_runtime(_app_state)
-            with runtime.operation():
-                config = SLMConfig.load()
-                db = DatabaseManager(config.db_path)
-                db.initialize(_schema)
-                engine = ConsolidationEngine(
-                    db=db, config=config.consolidation, slm_config=config,
+        # background=true returns as soon as the pass is scheduled. The
+        # session-end hook needs this: a full consolidation runs for seconds to
+        # minutes, and a hook that waits for it either blocks the user's shell
+        # or times out and wrongly concludes the run failed.
+        if body.get("background"):
+            import asyncio as _asyncio
+
+            _app_state = request.app.state
+            _asyncio.create_task(
+                run_full_consolidation(
+                    _app_state, pid, lightweight=lightweight, trigger="hook",
                 )
-                res = engine.consolidate(profile_id=pid, lightweight=lightweight)
-                # v3.4.1: Auto-trigger behavioral pattern mining after consolidation
-                try:
-                    from superlocalmemory.learning.consolidation_worker import (
-                        ConsolidationWorker,
-                    )
-                    learning_db = config.base_dir / "learning.db"
-                    cw = ConsolidationWorker(str(config.db_path), str(learning_db))
-                    pattern_count = cw._generate_patterns(pid, False)
-                    res["patterns_mined"] = pattern_count
-                    logger.info(
-                        "Auto-mined %d patterns after consolidation", pattern_count
-                    )
-                except Exception as exc:
-                    logger.debug("Pattern mining after consolidation failed: %s", exc)
-            return res
+            )
+            authorization.complete()
+            return {"success": True, "started": True, "background": True}
 
-        result = await _asyncio.to_thread(_run_consolidation)
+        result = await run_full_consolidation(
+            request.app.state, pid, lightweight=lightweight, trigger="http",
+        )
         authorization.complete()
         return {"success": True, **result}
     except HTTPException: