th-memory-mcp 2.2.2 → 2.2.3

package/README.md

@@ -4,10 +4,11 @@
 [![npm downloads](https://img.shields.io/npm/dm/th-memory-mcp.svg)](https://www.npmjs.com/package/th-memory-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org)
-
+[![th-memory-mcp MCP server](https://glama.ai/mcp/servers/worakorn-prince/th-memory-mcp/badges/card.svg)](https://glama.ai/mcp/servers/worakorn-prince/th-memory-mcp)
 Long-term memory MCP server for OpenCode — stores preferences, lessons, and usage history in a single local SQLite file (100% local, no external API) so the AI can "remember and adapt" to the user through context-based learning.
+[![Listed on mcpservers.org](https://mcpservers.org/badge.svg)](https://mcpservers.org/servers/worakorn-prince/th-memory-mcp)
 
-**Status:** v2.2.2 — a temporal, conflict-aware, hybrid-retrieval memory engine. 16 MCP tools, 20 passing test suites. Non-destructive schema migration from v1 (all v1 data preserved). New in v2: lifecycle states, temporal validity, conflict/dedup resolution with USER/SESSION/PROJECT/GLOBAL scope, hybrid FTS+vector retrieval (RRF), memory graph, `get_context` assembly, periodic consolidation, and `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`.
+**Status:** v2.2.3 — a temporal, conflict-aware, hybrid-retrieval memory engine. 16 MCP tools, 25 passing test suites. Non-destructive schema migration from v1 (all v1 data preserved). New in v2.2: lifecycle states, temporal validity, conflict/dedup resolution with USER/SESSION/PROJECT/GLOBAL scope, hybrid FTS+vector retrieval (RRF), memory graph, `get_context` assembly, periodic consolidation, and `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`. New in v2.2.3: scope-enforced retrieval, graph scope isolation, export/import round-trip, hardened import path (realpath), strict import validation, N+1 query elimination, cold/ablation benchmark, and `MEMORY_RETRIEVAL_MODE` switch.
 
 ## Requirements
 

package/README.th.md

@@ -7,7 +7,7 @@
 
 MCP server ความจำระยะยาวสำหรับ OpenCode — เก็บ preferences, lessons, ประวัติการใช้งาน ลง SQLite ไฟล์เดียว (local 100%, ไม่มี external API) เพื่อให้ AI "จำและปรับตัว" กับผู้ใช้ผ่าน context-based learning
 
-**สถานะ:** v2.2.2 — engine ความจำแบบ temporal, conflict-aware, hybrid-retrieval 16 MCP tools, 20 ชุดเทสผ่าน อัปเกรด schema แบบ non-destructive จาก v1 (ข้อมูล v1 ทั้งหมดถูกเก็บรักษา) ฟีเจอร์ใหม่ใน v2: lifecycle states, temporal validity, การแก้ conflict/dedup พร้อม scope USER/SESSION/PROJECT/GLOBAL, hybrid FTS+vector retrieval (RRF), memory graph, ประกอบ `get_context`, consolidation, และ `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`
+**สถานะ:** v2.2.3 — engine ความจำแบบ temporal, conflict-aware, hybrid-retrieval 16 MCP tools, 25 ชุดเทสผ่าน อัปเกรด schema แบบ non-destructive จาก v1 (ข้อมูล v1 ทั้งหมดถูกเก็บรักษา) ฟีเจอร์ใหม่ใน v2.2: lifecycle states, temporal validity, การแก้ conflict/dedup พร้อม scope USER/SESSION/PROJECT/GLOBAL, hybrid FTS+vector retrieval (RRF), memory graph, ประกอบ `get_context`, consolidation, และ `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories` ใหม่ใน v2.2.3: บังคับ scope ใน retrieval, แยก scope ใน graph, export/import แบบ round-trip, ป้องกัน symlink ด้วย realpath, ตรวจ import เข้มงวด, เลิก N+1 query, benchmark cold/ablation และสวิตช์ `MEMORY_RETRIEVAL_MODE`
 
 > English: [README.md](README.md)
 

package/design.md

@@ -4,9 +4,9 @@
 สเปคฉบับเต็มอยู่ที่ `ARCHITECTURE_v2.md` (canonical spec) ไฟล์นี้สรุปภาพรวมและสถานะปัจจุบันเพื่อความสะดวก
 
 ## สถานะปัจจุบัน
-- **เวอร์ชัน:** `package.json` = `2.2.0`
+- **เวอร์ชัน:** `package.json` = `2.2.3`
 - **MCP tools:** 16 tools (`remember`, `recall`, `get_context`, `link_memory`, `merge_memory`, `update_memory`, `import_memory`, `extract_memories`, `consolidate`, `forget`, `history`, `recent_interactions`, `profile`, `lesson`, `memory_stats`, `export_memory`)
-- **ชุดเทสต์:** 20 suites ผ่านหมด (0 fail) — รันผ่าน `npm test` (มี CI บน GitHub Actions)
+- **ชุดเทสต์:** 25 suites ผ่านหมด (0 fail) — รันผ่าน `npm test` (มี CI บน GitHub Actions)
 
 ## องค์ประกอบหลัก (src/)
 - `db/` — better-sqlite3 (WAL mode), migrations เชิงเส้น (M001–M007), repositories (`memories`, `users`, `preferences`, `lessons`)
@@ -57,3 +57,4 @@
 - v2.0.0 ปล่อยแล้ว (npm, GitHub Release, Official MCP Registry, Glama)
 - v2.2.0 — ปล่อยครบ: tag + GitHub Release, **npm publish เรียบร้อย**, Official MCP Registry ดึงจาก npm อัตโนมัติ (ไม่ต้องรัน mcp-publisher แยก), Glama Sync เรียบร้อย
 - v2.2.1 — แก้ Glama quality: เพิ่ม `pnpm.onlyBuiltDependencies: ["better-sqlite3"]` ให้ pnpm รันสคริปต์ดาวน์โหลด native binary สำหรับ Node 24, ขยับ better-sqlite3 เป็น `^12.9.0`, เพิ่ม override `ip-address@^10.2.0` (npm+pnpm) อุดช่องโหว่ XSS ผ่าน MCP SDK ไม่มีการเปลี่ยนโค้ด รอ `npm publish` + Glama ทดสอบใหม่
+- v2.2.3 — ชุดแก้ความปลอดภัย + ประสิทธิภาพตาม `report_checkup.md`: บังคับ scope filtering (ไม่คืน foreign USER/SESSION), กรอง graph ไม่ข้าม scope, ห้าม link ข้าม scope, export/import แบบ round-trip, ใช้ `realpath` กัน symlink, ตรวจ import เข้มงวด (enum/0..1/ISO), เลิก N+1 query (vector JOIN, bulk fetch, cap consolidation), benchmark cold/ablation และสวิตช์ `MEMORY_RETRIEVAL_MODE`, เพิ่ม 5 เทสต์ใหม่เป็น 25/25, benchmark รันครบทุก suite

package/dist/core/consolidation-engine.js

@@ -1,4 +1,4 @@
-import { db, getAllEmbeddings } from "../db/index.js";
+import { db } from "../db/index.js";
 import { cosine, deserialize } from "../lib/embed.js";
 import { createMemory } from "../db/repositories/memories.js";
 import { linkMemories } from "./graph-engine.js";
@@ -6,23 +6,24 @@ import { linkMemories } from "./graph-engine.js";
 export function clusterMemories(opts = {}) {
     const threshold = opts.threshold ?? 0.7;
     const minSize = opts.minClusterSize ?? 2;
-    const rows = getAllEmbeddings();
+    const rows = db
+        .prepare(`SELECT e.ref_id as ref_id, e.vec as vec, m.status, m.project_id, m.scope, m.session_id, m.user_id
+       FROM embeddings e
+       JOIN memories m ON m.id = e.ref_id
+       WHERE e.ref_table = 'memories'
+         AND ( ? OR m.status NOT IN ('deleted','archived','superseded'))`)
+        .all(opts.includeArchived ? 1 : 0);
     const valid = rows.filter((r) => {
-        const m = db
-            .prepare("SELECT status, project_id FROM memories WHERE id = ?")
-            .get(r.ref_id);
-        if (!m)
-            return false;
-        if (!opts.includeArchived &&
-            (m.status === "deleted" || m.status === "archived"))
-            return false;
-        if (opts.projectId &&
-            !(m.project_id === opts.projectId || m.project_id === null))
-            return false;
+        if (r.scope === "USER" || r.scope === "SESSION" || r.scope === "PROJECT") {
+            if (opts.projectId && r.project_id !== opts.projectId)
+                return false;
+        }
         return true;
     });
+    const CAP = 2000;
+    const sliced = valid.slice(0, CAP);
     const vecs = new Map();
-    for (const r of valid)
+    for (const r of sliced)
         vecs.set(r.ref_id, deserialize(r.vec));
     const ids = [...vecs.keys()];
     const parent = new Map();

package/dist/core/context-engine.js

@@ -1,6 +1,25 @@
 import { db } from "../db/index.js";
 import { retrieve } from "./retrieval-engine.js";
 import { traverse } from "./graph-engine.js";
+import { resolveUserId } from "../db/repositories/users.js";
+function isScopeVisible(m, opts, uid) {
+    if (m.scope === "USER") {
+        if (opts.userId == null)
+            return false;
+        return m.user_id === uid;
+    }
+    if (m.scope === "SESSION") {
+        if (opts.sessionId == null)
+            return false;
+        return m.session_id === opts.sessionId;
+    }
+    if (m.scope === "PROJECT") {
+        if (opts.projectId == null)
+            return false;
+        return m.project_id === opts.projectId;
+    }
+    return true;
+}
 function isCurrentlyValid(m, now) {
     if (m.valid_from && new Date(m.valid_from) > now)
         return false;
@@ -26,15 +45,35 @@ export function getContext(opts = {}) {
         seedScores.set(s.id, s.final_score);
     const ids = new Set(seeds.map((s) => s.id));
     if (opts.includeGraph) {
+        const uid = opts.userId ? resolveUserId(opts.userId) : null;
         for (const s of seeds) {
-            for (const n of traverse(s.id, { maxDepth: 1 }))
+            for (const n of traverse(s.id, { maxDepth: 1 })) {
+                const m = db
+                    .prepare("SELECT * FROM memories WHERE id = ?")
+                    .get(n.memoryId);
+                if (!m)
+                    continue;
+                if (!opts.includeHistory &&
+                    (m.status === "deleted" ||
+                        m.status === "archived" ||
+                        m.status === "superseded"))
+                    continue;
+                if (!isScopeVisible(m, opts, uid))
+                    continue;
+                if (!opts.includeHistory && !isCurrentlyValid(m, now))
+                    continue;
                 ids.add(n.memoryId);
+            }
         }
     }
+    const resolvedUid = opts.userId ? resolveUserId(opts.userId) : null;
     const all = [...ids]
         .map((id) => db.prepare("SELECT * FROM memories WHERE id = ?").get(id))
         .filter((m) => !!m)
-        .filter((m) => opts.includeHistory || isCurrentlyValid(m, now));
+        .filter((m) => opts.includeHistory || isCurrentlyValid(m, now))
+        .filter((m) => isScopeVisible(m, opts, resolvedUid))
+        .filter((m) => opts.includeHistory ||
+        !(m.status === "deleted" || m.status === "archived" || m.status === "superseded"));
     all.sort((a, b) => (seedScores.get(b.id) ?? 0) - (seedScores.get(a.id) ?? 0));
     let used = 0;
     const out = [];

package/dist/core/retrieval-engine.js

@@ -8,23 +8,57 @@ import { resolveUserId } from "../db/repositories/users.js";
 // Hybrid retrieval pipeline (spec §13): FTS + vector -> RRF fusion -> scoring/rerank -> filter -> topK
 export function retrieve(query, opts = {}) {
     const limit = Math.min(Math.max(opts.limit ?? 10, 1), 50);
+    const mode = (process.env.MEMORY_RETRIEVAL_MODE || "rrf").toLowerCase();
     const fts = ftsSearch(query, opts);
-    const vecRaw = vectorSearch(query, opts);
-    const vec = vecRaw.map((r, i) => ({
-        id: r.id,
-        rank: i + 1,
-    }));
-    const fused = rrfFuse([fts, vec]);
+    let lists = [fts];
+    if (mode === "vector-only") {
+        const vecRaw = vectorSearch(query, opts);
+        lists = [vecRaw.map((r, i) => ({ id: r.id, rank: i + 1 }))];
+    }
+    else if (mode !== "fts-only") {
+        const vecRaw = vectorSearch(query, opts);
+        lists = [fts, vecRaw.map((r, i) => ({ id: r.id, rank: i + 1 }))];
+    }
+    const fused = rrfFuse(lists);
     const now = new Date();
+    const resolvedUid = opts.userId ? resolveUserId(opts.userId) : null;
+    const visible = (m) => {
+        if (m.scope === "USER") {
+            if (opts.userId == null)
+                return false;
+            return m.user_id === resolvedUid;
+        }
+        if (m.scope === "SESSION") {
+            if (opts.sessionId == null)
+                return false;
+            return m.session_id === opts.sessionId;
+        }
+        if (m.scope === "PROJECT") {
+            if (opts.projectId == null)
+                return false;
+            return m.project_id === opts.projectId;
+        }
+        return true;
+    };
+    const ids = [...fused.keys()];
+    if (ids.length === 0)
+        return [];
+    const placeholders = ids.map(() => "?").join(",");
+    const rows = db
+        .prepare(`SELECT * FROM memories WHERE id IN (${placeholders})`)
+        .all(...ids);
+    const byId = new Map(rows.map((r) => [r.id, r]));
     const out = [];
     for (const [id, rrf] of fused.entries()) {
-        const mem = db
-            .prepare("SELECT * FROM memories WHERE id = ?")
-            .get(id);
+        const mem = byId.get(id);
         if (!mem)
             continue;
         if (!opts.includeArchived &&
-            (mem.status === "deleted" || mem.status === "archived"))
+            (mem.status === "deleted" ||
+                mem.status === "archived" ||
+                mem.status === "superseded"))
+            continue;
+        if (!visible(mem))
             continue;
         const recency = recencyFactorFor(mem.type, mem.updated_at, now);
         const scope = scopeFactorFor(mem, {

package/dist/retrieval/fts.js

@@ -1,22 +1,43 @@
 import { db, buildFtsMatch } from "../db/index.js";
+import { resolveUserId } from "../db/repositories/users.js";
 export function ftsSearch(query, opts = {}) {
     const limit = Math.min(Math.max(opts.limit ?? 50, 1), 200);
     const statusClause = opts.includeArchived
         ? ""
-        : "AND m.status NOT IN ('deleted','archived')";
-    const projectClause = opts.projectId
-        ? "AND (m.project_id = @projectId OR m.project_id IS NULL)"
-        : "";
+        : "AND m.status NOT IN ('deleted','archived','superseded')";
     const rows = db
         .prepare(`SELECT m.id FROM memories m
        JOIN search_index ON search_index.ref_table = 'memories' AND search_index.ref_id = m.id
-       WHERE search_index MATCH @match ${statusClause} ${projectClause}
+       WHERE search_index MATCH @match ${statusClause}
        ORDER BY rank
        LIMIT @limit`)
         .all({
         match: buildFtsMatch(query),
         limit,
-        projectId: opts.projectId,
     });
-    return rows.map((r, i) => ({ id: r.id, rank: i + 1 }));
+    const filtered = rows.filter(({ id }) => {
+        const m = db
+            .prepare("SELECT scope, project_id, session_id, user_id FROM memories WHERE id = ?")
+            .get(id);
+        if (!m)
+            return false;
+        if (m.scope === "USER") {
+            if (opts.userId == null)
+                return false;
+            const uid = resolveUserId(opts.userId);
+            return m.user_id === uid;
+        }
+        if (m.scope === "SESSION") {
+            if (opts.sessionId == null)
+                return false;
+            return m.session_id === opts.sessionId;
+        }
+        if (m.scope === "PROJECT") {
+            if (opts.projectId == null)
+                return false;
+            return m.project_id === opts.projectId;
+        }
+        return true;
+    });
+    return filtered.map((r, i) => ({ id: r.id, rank: i + 1 }));
 }

package/dist/retrieval/vector.js

@@ -1,29 +1,39 @@
 import { db } from "../db/index.js";
 import { embed, cosine, deserialize } from "../lib/embed.js";
+import { resolveUserId } from "../db/repositories/users.js";
 export function vectorSearch(query, opts = {}) {
     const limit = Math.min(Math.max(opts.limit ?? 50, 1), 200);
     const floor = opts.floor ?? 0.15;
     const topicVec = embed(query);
     const rows = db
-        .prepare("SELECT ref_id, vec FROM embeddings WHERE ref_table = 'memories'")
-        .all();
-    const statusOk = (id) => {
-        const m = db
-            .prepare("SELECT status, project_id FROM memories WHERE id = ?")
-            .get(id);
-        if (!m)
-            return false;
-        if (!opts.includeArchived &&
-            (m.status === "deleted" || m.status === "archived"))
-            return false;
-        if (opts.projectId &&
-            !(m.project_id === opts.projectId || m.project_id === null))
-            return false;
-        return true;
-    };
+        .prepare(`SELECT e.ref_id as id, e.vec as vec, m.status, m.scope, m.project_id, m.session_id, m.user_id
+       FROM embeddings e
+       JOIN memories m ON m.id = e.ref_id
+       WHERE e.ref_table = 'memories'
+         AND ( ? OR m.status NOT IN ('deleted','archived','superseded'))`)
+        .all(opts.includeArchived ? 1 : 0);
+    const uid = opts.userId ? resolveUserId(opts.userId) : null;
     return rows
-        .map((r) => ({ id: r.ref_id, score: cosine(topicVec, deserialize(r.vec)) }))
-        .filter((r) => r.score >= floor && statusOk(r.id))
+        .filter((r) => {
+        if (r.scope === "USER") {
+            if (opts.userId == null)
+                return false;
+            return r.user_id === uid;
+        }
+        if (r.scope === "SESSION") {
+            if (opts.sessionId == null)
+                return false;
+            return r.session_id === opts.sessionId;
+        }
+        if (r.scope === "PROJECT") {
+            if (opts.projectId == null)
+                return false;
+            return r.project_id === opts.projectId;
+        }
+        return true;
+    })
+        .map((r) => ({ id: r.id, score: cosine(topicVec, deserialize(r.vec)) }))
+        .filter((r) => r.score >= floor)
         .sort((a, b) => b.score - a.score)
         .slice(0, limit);
 }

package/dist/tools/import_memory.js

@@ -1,11 +1,12 @@
 import { z } from "zod";
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { join, dirname, resolve, sep } from "node:path";
-import { DB_PATH, ok, err } from "../db/index.js";
+import { db, DB_PATH, nowISO, syncSearchIndex, upsertEmbedding, ok, err, } from "../db/index.js";
 import { createMemory } from "../db/repositories/memories.js";
 import { deduplicate } from "../memory/deduplicator.js";
-import { MEMORY_TYPES } from "../memory/types.js";
+import { MEMORY_TYPES, SOURCE_TYPES } from "../memory/types.js";
 import { EXPORTS_DIRNAME } from "../lib/config.js";
+import { embed } from "../lib/embed.js";
 export const importMemoryInput = {
     file: z
         .string()
@@ -25,6 +26,23 @@ export const importMemoryInput = {
         .optional()
         .describe("Scope imported memories to a user (USER scope)"),
 };
+function isIsoDateString(s) {
+    if (typeof s !== "string")
+        return false;
+    const d = Date.parse(s);
+    if (Number.isNaN(d))
+        return false;
+    try {
+        const iso = new Date(s).toISOString();
+        return iso.length >= 10;
+    }
+    catch {
+        return false;
+    }
+}
+function isValidSource(s) {
+    return SOURCE_TYPES.includes(s);
+}
 export function importMemoryHandler(args) {
     try {
         let raw;
@@ -34,12 +52,25 @@ export function importMemoryHandler(args) {
         else if (args.file) {
             const exportDir = join(dirname(DB_PATH), EXPORTS_DIRNAME);
             const full = resolve(args.file);
-            const allowed = resolve(exportDir);
-            if (!full.startsWith(allowed + sep))
+            let realExportDir;
+            try {
+                realExportDir = realpathSync(exportDir);
+            }
+            catch {
+                realExportDir = resolve(exportDir);
+            }
+            let realFull;
+            try {
+                realFull = realpathSync(full);
+            }
+            catch {
+                return err(`file not found: ${full}`);
+            }
+            if (!realFull.startsWith(realExportDir + sep) && realFull !== realExportDir)
                 return err(`file must be inside ${exportDir}`);
-            if (!full.endsWith(".json"))
+            if (!realFull.endsWith(".json"))
                 return err("file must end with .json");
-            raw = readFileSync(full, "utf8");
+            raw = readFileSync(realFull, "utf8");
         }
         else {
             return err("provide either file or json");
@@ -51,22 +82,85 @@ export function importMemoryHandler(args) {
         catch {
             return err("invalid JSON");
         }
-        const items = Array.isArray(parsed)
-            ? parsed
-            : Array.isArray(parsed.memories)
-                ? (parsed.memories)
-                : [];
+        let memoryItems = [];
+        let exportPrefs = null;
+        let exportLessons = null;
+        let exportProfile = null;
+        if (Array.isArray(parsed)) {
+            memoryItems = parsed;
+        }
+        else if (parsed &&
+            typeof parsed === "object" &&
+            Array.isArray(parsed.memories)) {
+            memoryItems = parsed.memories;
+        }
+        else if (parsed &&
+            typeof parsed === "object" &&
+            ("preferences" in parsed ||
+                "lessons" in parsed ||
+                "profile" in parsed)) {
+            const p = parsed;
+            if (Array.isArray(p.preferences))
+                exportPrefs = p.preferences;
+            if (Array.isArray(p.lessons))
+                exportLessons = p.lessons;
+            if (Array.isArray(p.profile))
+                exportProfile = p.profile;
+            if (Array.isArray(p.memories))
+                memoryItems = p.memories;
+        }
+        else {
+            memoryItems = [];
+        }
         let wouldImport = 0;
         let skipped = 0;
         let invalid = 0;
         const log = [];
-        for (const it of items) {
+        for (const it of memoryItems) {
             if (!it ||
                 typeof it.content !== "string" ||
+                it.content.length === 0 ||
+                it.content.length > 2000 ||
                 !MEMORY_TYPES.includes(it.type)) {
                 invalid++;
                 continue;
             }
+            if (it.summary != null && (typeof it.summary !== "string" || it.summary.length > 2000)) {
+                invalid++;
+                continue;
+            }
+            if (it.source != null && typeof it.source === "string" && !isValidSource(it.source)) {
+                invalid++;
+                continue;
+            }
+            if (it.confidence != null && (typeof it.confidence !== "number" || it.confidence < 0 || it.confidence > 1)) {
+                invalid++;
+                continue;
+            }
+            if (it.importance != null && (typeof it.importance !== "number" || it.importance < 0 || it.importance > 1)) {
+                invalid++;
+                continue;
+            }
+            if (it.projectId != null && (typeof it.projectId !== "string" || it.projectId.length === 0 || it.projectId.length > 200)) {
+                invalid++;
+                continue;
+            }
+            if (it.sessionId != null && (typeof it.sessionId !== "string" || it.sessionId.length === 0 || it.sessionId.length > 200)) {
+                invalid++;
+                continue;
+            }
+            if (it.userId != null && (typeof it.userId !== "string" || it.userId.length === 0 || it.userId.length > 200)) {
+                invalid++;
+                continue;
+            }
+            if (it.validFrom != null && (typeof it.validFrom !== "string" || !isIsoDateString(it.validFrom))) {
+                invalid++;
+                continue;
+            }
+            if (it.validUntil != null && (typeof it.validUntil !== "string" || !isIsoDateString(it.validUntil))) {
+                invalid++;
+                continue;
+            }
             const dup = deduplicate(it.type, it.content);
             if (dup.verdict === "duplicate") {
                 skipped++;
@@ -95,6 +189,88 @@ export function importMemoryHandler(args) {
                 });
             }
         }
+        if (exportPrefs != null || exportLessons != null || exportProfile != null) {
+            const prefArr = Array.isArray(exportPrefs) ? exportPrefs : [];
+            const lessonArr = Array.isArray(exportLessons) ? exportLessons : [];
+            const profileArr = Array.isArray(exportProfile) ? exportProfile : [];
+            const validCat = new Set(["work_style", "coding_pref", "language", "domain", "other"]);
+            let prefOk = 0;
+            let prefInvalid = 0;
+            let lessonOk = 0;
+            let lessonInvalid = 0;
+            let profileOk = 0;
+            const selectPref = db.prepare("SELECT id FROM preferences WHERE category = ? AND key = ?");
+            const insertPref = db.prepare("INSERT INTO preferences (category, key, value, confidence, source, updated_at) VALUES (?, ?, ?, ?, ?, ?)");
+            const updatePref = db.prepare("UPDATE preferences SET value = ?, confidence = ?, source = ?, updated_at = ? WHERE category = ? AND key = ?");
+            const insertLesson = db.prepare("INSERT INTO lessons (situation, mistake, correction, created_at) VALUES (?, ?, ?, ?)");
+            const upsertProfile = db.prepare("INSERT INTO profile (section, content, updated_at) VALUES (?, ?, ?) ON CONFLICT(section) DO UPDATE SET content = excluded.content, updated_at = excluded.updated_at");
+            for (const p of prefArr) {
+                if (!p ||
+                    typeof p.category !== "string" ||
+                    !validCat.has(p.category) ||
+                    typeof p.key !== "string" ||
+                    p.key.length === 0 ||
+                    p.key.length > 200 ||
+                    typeof p.value !== "string" ||
+                    p.value.length === 0 ||
+                    p.value.length > 2000 ||
+                    (p.confidence != null && (typeof p.confidence !== "number" || p.confidence < 0 || p.confidence > 1))) {
+                    prefInvalid++;
+                    continue;
+                }
+                prefOk++;
+                if (args.apply === true) {
+                    const existing = selectPref.get(p.category, p.key);
+                    const conf = typeof p.confidence === "number" ? p.confidence : 0.5;
+                    const src = typeof p.source === "string" ? p.source : "imported";
+                    const ts = typeof p.updated_at === "string" && isIsoDateString(p.updated_at) ? p.updated_at : nowISO();
+                    if (existing)
+                        updatePref.run(p.value, conf, src, ts, p.category, p.key);
+                    else
+                        insertPref.run(p.category, p.key, p.value, conf, src, ts);
+                    const row = db.prepare("SELECT id FROM preferences WHERE category = ? AND key = ?").get(p.category, p.key);
+                    if (row) {
+                        syncSearchIndex("preferences", row.id, `${p.category}/${p.key}`, `${p.key}: ${p.value}`);
+                        upsertEmbedding("preferences", row.id, embed(`${p.category} ${p.key} ${p.value}`));
+                    }
+                }
+            }
+            for (const l of lessonArr) {
+                if (!l ||
+                    typeof l.situation !== "string" ||
+                    l.situation.length === 0 ||
+                    l.situation.length > 1000 ||
+                    typeof l.mistake !== "string" ||
+                    l.mistake.length === 0 ||
+                    l.mistake.length > 1000 ||
+                    typeof l.correction !== "string" ||
+                    l.correction.length === 0 ||
+                    l.correction.length > 1000) {
+                    lessonInvalid++;
+                    continue;
+                }
+                lessonOk++;
+                if (args.apply === true) {
+                    const ts = typeof l.created_at === "string" && isIsoDateString(l.created_at) ? l.created_at : nowISO();
+                    const res = insertLesson.run(l.situation, l.mistake, l.correction, ts);
+                    const id = Number(res.lastInsertRowid);
+                    syncSearchIndex("lessons", id, l.situation.slice(0, 80), `${l.situation} | mistake: ${l.mistake} -> correction: ${l.correction}`);
+                    upsertEmbedding("lessons", id, embed(`${l.situation} ${l.mistake} ${l.correction}`));
+                }
+            }
+            for (const pr of profileArr) {
+                if (!pr || typeof pr.section !== "string" || pr.section.length === 0 || typeof pr.content !== "string" || pr.content.length === 0)
+                    continue;
+                profileOk++;
+                if (args.apply === true) {
+                    const ts = typeof pr.updated_at === "string" && isIsoDateString(pr.updated_at) ? pr.updated_at : nowISO();
+                    upsertProfile.run(pr.section, pr.content, ts);
+                }
+            }
+            const mode = args.apply === true ? "applied" : "dry-run";
+            const summary = `import ${mode}: ${wouldImport} memories to import, ${skipped} duplicate(s) skipped, ${invalid} invalid memories; preferences ${prefOk} ok ${prefInvalid} invalid; lessons ${lessonOk} ok ${lessonInvalid} invalid; profile ${profileOk} ok`;
+            return ok(summary);
+        }
         const mode = args.apply === true ? "applied" : "dry-run";
         const summary = `import ${mode}: ${wouldImport} to import, ${skipped} duplicate(s) skipped, ${invalid} invalid`;
         return ok(log.length ? `${summary}\n${log.join("\n")}` : summary);

package/dist/tools/link_memory.js

@@ -22,6 +22,16 @@ export function linkMemoryHandler(args) {
             return err("cannot link deleted memories");
         if (src.id === tgt.id)
             return err("cannot link a memory to itself");
+        if ((src.scope === "USER" || tgt.scope === "USER") &&
+            src.user_id !== tgt.user_id)
+            return err("cannot link memories across different users");
+        if ((src.scope === "SESSION" || tgt.scope === "SESSION") &&
+            src.session_id !== tgt.session_id)
+            return err("cannot link memories across different sessions");
+        if (src.scope === "PROJECT" &&
+            tgt.scope === "PROJECT" &&
+            src.project_id !== tgt.project_id)
+            return err("cannot link memories across different projects");
         linkMemories(args.sourceId, args.targetId, args.relation);
         return ok(`linked memory ${args.sourceId} -[${args.relation}]-> ${args.targetId}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "th-memory-mcp",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "mcpName": "io.github.worakorn-prince/th-memory-mcp",
   "description": "Adaptive Memory MCP server - SQLite-backed memory for OpenCode",
   "author": "worakorn-prince",