superlocalmemory 4.0.8 → 4.0.10

package/src/superlocalmemory/server/routes/data_io.py

@@ -12,7 +12,7 @@ import gzip
 import hashlib
 import json
 import logging
-from typing import Optional
+from typing import Any, Optional
 from datetime import datetime, timezone
 
 from fastapi import APIRouter, HTTPException, Query, Request, UploadFile, File
@@ -78,7 +78,22 @@ async def export_memories(
             use_v3 = False
 
         if use_v3:
+            # Withheld summaries are excluded, and this is about IMPORT, not
+            # tidiness. Import re-ingests every record through the normal
+            # pipeline, which mints a fresh memory with quarantined = 0 — so an
+            # export taken here and imported anywhere would resurrect all 1,195
+            # model-written rows as though the owner had written them, on a
+            # machine where nothing had gone wrong. The repair would then have
+            # to run again there.
+            #
+            # Nothing the owner wrote is lost: these are derived artefacts, the
+            # consolidator regenerates them from the facts that ARE exported,
+            # and their text is kept in consolidated_summaries. (That table is
+            # not in this export either — it is a view, not a memory. Worth
+            # revisiting when export covers derived state.)
             query = "SELECT * FROM atomic_facts WHERE profile_id = ?"
+            if _has_column(cursor, "atomic_facts", "quarantined"):
+                query += " AND COALESCE(quarantined, 0) = 0"
             params = [active_profile]
             if category:
                 query += " AND fact_type = ?"
@@ -154,6 +169,19 @@ async def export_memories(
         raise _internal_error("Export error")
 
 
+def _has_column(cursor: Any, table: str, column: str) -> bool:
+    """Whether ``table`` carries ``column`` in this database.
+
+    Presence-guarded because ``quarantined`` arrives with a migration and this
+    route must keep working on a store the engine has not opened.
+    """
+    try:
+        cursor.execute(f"PRAGMA table_info({table})")
+        return any(row[1] == column for row in cursor.fetchall())
+    except Exception:  # noqa: BLE001 -- an export must not fail over a probe
+        return False
+
+
 @router.post("/api/import")
 async def import_memories(request: Request, file: UploadFile = File(...)):
     """Import memories from JSON file using V3 engine."""

package/src/superlocalmemory/server/routes/entity.py

@@ -84,7 +84,19 @@ def list_entities(
 
     conn = get_read_connection(engine._config.db_path)
     try:
-        where = ["ce.profile_id = ?"]
+        # Hide the placeholder that dated facts with no recognised entity
+        # attach their temporal events to (core/store_pipeline.py,
+        # _ensure_unresolved_entity). It is a hook for a foreign key, not a
+        # concept, and it would otherwise appear here as a nameless entity and
+        # be counted in the total the owner reads as "entities I have".
+        #
+        # Only the presentation layer needs this. The other readers of
+        # canonical_entities are unaffected on inspection: graph_pruner uses
+        # `NOT IN (SELECT entity_id ...)` to find orphaned edges, where
+        # including it is correct; community_summary builds from graph edges and
+        # the placeholder has none; scale_engine counts for backend sync, not
+        # for display.
+        where = ["ce.profile_id = ?", "ce.entity_type != 'unresolved'"]
         params: list[object] = [profile]
         if entity_type and entity_type.lower() != "all":
             where.append("ce.entity_type = ? COLLATE NOCASE")

package/src/superlocalmemory/server/routes/mesh.py

@@ -408,7 +408,7 @@ def send(req: SendRequest, request: Request):
         if sig_err is not None:
             raise HTTPException(401, detail=sig_err.get("error", "signature error"))
 
-        # Admission gate parity (closes Wave-1 P1 bypass for inbound remote send).
+        # Admission gate parity (closes the P1 bypass for inbound remote send).
         try:
             from superlocalmemory.core.admission import (
                 AdmissionDenied,

package/src/superlocalmemory/server/routes/prewarm.py

@@ -4,10 +4,10 @@
 
 """POST /internal/prewarm — populates the context cache for a session.
 
-S8-SK-02 fix: Wave 2A shipped ``hooks/prewarm_auth.authorize`` (gates
-loopback → origin → install-token → body-size) and unit-tested it, but
-no FastAPI route mounted it. The hot-path ``post_tool_async_hook`` POSTs
-to ``/internal/prewarm`` after every tool call to refresh the
+Bug fix: ``hooks/prewarm_auth.authorize`` (which gates loopback →
+origin → install-token → body-size) was implemented and unit-tested,
+but no FastAPI route mounted it. The hot-path ``post_tool_async_hook``
+POSTs to ``/internal/prewarm`` after every tool call to refresh the
 ``active_brain_cache`` row for the current session/topic. Without a
 route registered here, those POSTs 404'd silently, the cache never
 populated, and every ``UserPromptSubmit`` ended up a structural miss.

package/src/superlocalmemory/server/routes/v3_api.py

@@ -266,7 +266,7 @@ def apply_settings_update(config: "SLMConfig", payload: dict) -> "SLMConfig":
     This is the SINGLE authoritative place where incoming dashboard save payloads
     are merged onto the stored config.  The POST /api/v3/mode/set handler calls
     this function after its HTTP-layer concerns (SSRF guard, auth) are settled,
-    so the acceptance gate (test_wave2_acceptance.py::P3) tests real product
+    so the test suite (test_acceptance_core.py::P3) tests real product
     behaviour — not a reimplementation.
 
     SEC-L-01 PRESERVED:
@@ -444,7 +444,7 @@ async def set_full_config(request: Request):
         # Resolve the effective endpoint value before SSRF validation.
         # Only the Ollama default injection happens here; the fallback to the
         # stored URL (and redacted-echo detection) live inside
-        # apply_settings_update so that the P3 acceptance gate exercises
+        # apply_settings_update so that the P3 test exercises
         # the same code path as the HTTP handler — not a reimplementation.
         _raw_ep: str = "" if clear_base_url else (base_url_input or endpoint_input or "")
         if (

package/src/superlocalmemory/server/ui.py

@@ -231,7 +231,14 @@ def create_app() -> FastAPI:
                 "<p><a href='/api/docs'>API Documentation</a></p>"
                 "</body></html>"
             )
-        return index_path.read_text()
+        from superlocalmemory.server.asset_versions import render_index
+        from superlocalmemory import __version__ as _v
+
+        # __SLM_VERSION__ was substituted only by the unified daemon, so the
+        # dashboard's upgrade detector did nothing when served from here.
+        return render_index(
+            index_path, UI_DIR, substitutions={"__SLM_VERSION__": _v},
+        )
 
     @application.get("/favicon.ico", include_in_schema=False)
     async def favicon():