basic-memory 0.14.2__py3-none-any.whl → 0.14.4__py3-none-any.whl

basic_memory/mcp/async_client.py

@@ -1,8 +1,28 @@
 from httpx import ASGITransport, AsyncClient
+from loguru import logger
 
 from basic_memory.api.app import app as fastapi_app
+from basic_memory.config import ConfigManager
+
+
+def create_client() -> AsyncClient:
+    """Create an HTTP client based on configuration.
+
+    Returns:
+        AsyncClient configured for either local ASGI or remote HTTP transport
+    """
+    config_manager = ConfigManager()
+    config = config_manager.load_config()
+
+    if config.api_url:
+        # Use HTTP transport for remote API
+        logger.info(f"Creating HTTP client for remote Basic Memory API: {config.api_url}")
+        return AsyncClient(base_url=config.api_url)
+    else:
+        # Use ASGI transport for local API
+        logger.debug("Creating ASGI client for local Basic Memory API")
+        return AsyncClient(transport=ASGITransport(app=fastapi_app), base_url="http://test")
 
-BASE_URL = "http://test"
 
 # Create shared async client
-client = AsyncClient(transport=ASGITransport(app=fastapi_app), base_url=BASE_URL)
+client = create_client()

basic_memory/mcp/project_session.py

@@ -8,7 +8,7 @@ from dataclasses import dataclass
 from typing import Optional
 from loguru import logger
 
-from basic_memory.config import ProjectConfig, get_project_config, config_manager
+from basic_memory.config import ProjectConfig, get_project_config, ConfigManager
 
 
 @dataclass
@@ -23,7 +23,7 @@ class ProjectSession:
     current_project: Optional[str] = None
     default_project: Optional[str] = None
 
-    def initialize(self, default_project: str) -> None:
+    def initialize(self, default_project: str) -> "ProjectSession":
         """Set the default project from config on startup.
 
         Args:
@@ -32,6 +32,7 @@ class ProjectSession:
         self.default_project = default_project
         self.current_project = default_project
         logger.info(f"Initialized project session with default project: {default_project}")
+        return self
 
     def get_current_project(self) -> str:
         """Get the currently active project name.
@@ -72,7 +73,7 @@ class ProjectSession:
         via CLI or API to ensure MCP session stays in sync.
         """
         # Reload config to get latest default project
-        current_config = config_manager.load_config()
+        current_config = ConfigManager().config
         new_default = current_config.default_project
 
         # Reinitialize with new default
@@ -102,7 +103,8 @@ def get_active_project(project_override: Optional[str] = None) -> ProjectConfig:
         return project
 
     current_project = session.get_current_project()
-    return get_project_config(current_project)
+    active_project = get_project_config(current_project)
+    return active_project
 
 
 def add_project_metadata(result: str, project_name: str) -> str:

basic_memory/mcp/prompts/__init__.py

@@ -10,12 +10,10 @@ from basic_memory.mcp.prompts import continue_conversation
 from basic_memory.mcp.prompts import recent_activity
 from basic_memory.mcp.prompts import search
 from basic_memory.mcp.prompts import ai_assistant_guide
-from basic_memory.mcp.prompts import sync_status
 
 __all__ = [
     "ai_assistant_guide",
     "continue_conversation",
     "recent_activity",
     "search",
-    "sync_status",
 ]

basic_memory/mcp/server.py

@@ -7,25 +7,10 @@ from contextlib import asynccontextmanager
 from dataclasses import dataclass
 from typing import AsyncIterator, Optional, Any
 
-from dotenv import load_dotenv
 from fastmcp import FastMCP
-from fastmcp.utilities.logging import configure_logging as mcp_configure_logging
-from mcp.server.auth.settings import AuthSettings
 
-from basic_memory.config import app_config
+from basic_memory.config import ConfigManager
 from basic_memory.services.initialization import initialize_app
-from basic_memory.mcp.auth_provider import BasicMemoryOAuthProvider
-from basic_memory.mcp.project_session import session
-from basic_memory.mcp.external_auth_provider import (
-    create_github_provider,
-    create_google_provider,
-)
-from basic_memory.mcp.supabase_auth_provider import SupabaseOAuthProvider
-
-# mcp console logging
-mcp_configure_logging(level="ERROR")
-
-load_dotenv()
 
 
 @dataclass
@@ -36,7 +21,11 @@ class AppContext:
 
 @asynccontextmanager
 async def app_lifespan(server: FastMCP) -> AsyncIterator[AppContext]:  # pragma: no cover
-    """Manage application lifecycle with type-safe context"""
+    """ """
+    # defer import so tests can monkeypatch
+    from basic_memory.mcp.project_session import session
+
+    app_config = ConfigManager().config
     # Initialize on startup (now returns migration_manager)
     migration_manager = await initialize_app(app_config)
 
@@ -50,60 +39,8 @@ async def app_lifespan(server: FastMCP) -> AsyncIterator[AppContext]:  # pragma:
         pass
 
 
-# OAuth configuration function
-def create_auth_config() -> tuple[AuthSettings | None, Any | None]:
-    """Create OAuth configuration if enabled."""
-    # Check if OAuth is enabled via environment variable
-    import os
-
-    if os.getenv("FASTMCP_AUTH_ENABLED", "false").lower() == "true":
-        from pydantic import AnyHttpUrl
-
-        # Configure OAuth settings
-        issuer_url = os.getenv("FASTMCP_AUTH_ISSUER_URL", "http://localhost:8000")
-        required_scopes = os.getenv("FASTMCP_AUTH_REQUIRED_SCOPES", "read,write")
-        docs_url = os.getenv("FASTMCP_AUTH_DOCS_URL") or "http://localhost:8000/docs/oauth"
-
-        auth_settings = AuthSettings(
-            issuer_url=AnyHttpUrl(issuer_url),
-            service_documentation_url=AnyHttpUrl(docs_url),
-            required_scopes=required_scopes.split(",") if required_scopes else ["read", "write"],
-        )
-
-        # Create OAuth provider based on type
-        provider_type = os.getenv("FASTMCP_AUTH_PROVIDER", "basic").lower()
-
-        if provider_type == "github":
-            auth_provider = create_github_provider()
-        elif provider_type == "google":
-            auth_provider = create_google_provider()
-        elif provider_type == "supabase":
-            supabase_url = os.getenv("SUPABASE_URL")
-            supabase_anon_key = os.getenv("SUPABASE_ANON_KEY")
-            supabase_service_key = os.getenv("SUPABASE_SERVICE_KEY")
-
-            if not supabase_url or not supabase_anon_key:
-                raise ValueError("SUPABASE_URL and SUPABASE_ANON_KEY must be set for Supabase auth")
-
-            auth_provider = SupabaseOAuthProvider(
-                supabase_url=supabase_url,
-                supabase_anon_key=supabase_anon_key,
-                supabase_service_key=supabase_service_key,
-                issuer_url=issuer_url,
-            )
-        else:  # default to "basic"
-            auth_provider = BasicMemoryOAuthProvider(issuer_url=issuer_url)
-
-        return auth_settings, auth_provider
-
-    return None, None
-
-
-# Create auth configuration
-auth_settings, auth_provider = create_auth_config()
-
-# Create the shared server instance
+# Create the shared server instance with custom Stytch auth
 mcp = FastMCP(
     name="Basic Memory",
-    auth=auth_provider,
+    lifespan=app_lifespan,
 )

basic_memory/mcp/tools/build_context.py

@@ -15,6 +15,7 @@ from basic_memory.schemas.memory import (
     memory_url_path,
 )
 
+type StringOrInt = str | int
 
 @mcp.tool(
     description="""Build context from a memory:// URI to continue conversations naturally.
@@ -35,7 +36,7 @@ from basic_memory.schemas.memory import (
 )
 async def build_context(
     url: MemoryUrl,
-    depth: Optional[int] = 1,
+    depth: Optional[StringOrInt] = 1,
     timeframe: Optional[TimeFrame] = "7d",
     page: int = 1,
     page_size: int = 10,
@@ -80,6 +81,15 @@ async def build_context(
         build_context("memory://specs/search", project="work-project")
     """
     logger.info(f"Building context from {url}")
+    
+    # Convert string depth to integer if needed
+    if isinstance(depth, str):
+        try:
+            depth = int(depth)
+        except ValueError:
+            from mcp.server.fastmcp.exceptions import ToolError
+            raise ToolError(f"Invalid depth parameter: '{depth}' is not a valid integer")
+    
     # URL is already validated and normalized by MemoryUrl type annotation
 
     # Get the active project first to check project-specific sync status
@@ -101,7 +111,7 @@ async def build_context(
             metadata=MemoryMetadata(
                 depth=depth or 1,
                 timeframe=timeframe,
-                generated_at=datetime.now(),
+                generated_at=datetime.now().astimezone(),
                 primary_count=0,
                 related_count=0,
                 uri=migration_status,  # Include status in metadata

basic_memory/mcp/tools/move_note.py

@@ -11,6 +11,7 @@ from basic_memory.mcp.tools.utils import call_post, call_get
 from basic_memory.mcp.project_session import get_active_project
 from basic_memory.schemas import EntityResponse
 from basic_memory.schemas.project_info import ProjectList
+from basic_memory.utils import validate_project_path
 
 
 async def _detect_cross_project_move_attempt(
@@ -47,18 +48,7 @@ async def _detect_cross_project_move_attempt(
                     identifier, destination_path, current_project, matching_project
                 )
 
-        # Check if the destination path looks like it might be trying to reference another project
-        # (e.g., contains common project-like patterns)
-        if any(keyword in dest_lower for keyword in ["project", "workspace", "repo"]):
-            # This might be a cross-project attempt, but we can't be sure
-            # Return a general guidance message
-            available_projects = [
-                p.name for p in project_list.projects if p.name != current_project
-            ]
-            if available_projects:
-                return _format_potential_cross_project_guidance(
-                    identifier, destination_path, current_project, available_projects
-                )
+        # No other cross-project patterns detected
 
     except Exception as e:
         # If we can't detect, don't interfere with normal error handling
@@ -404,6 +394,28 @@ async def move_note(
     active_project = get_active_project(project)
     project_url = active_project.project_url
 
+    # Validate destination path to prevent path traversal attacks
+    project_path = active_project.home
+    if not validate_project_path(destination_path, project_path):
+        logger.warning(
+            "Attempted path traversal attack blocked",
+            destination_path=destination_path,
+            project=active_project.name,
+        )
+        return f"""# Move Failed - Security Validation Error
+
+The destination path '{destination_path}' is not allowed - paths must stay within project boundaries.
+
+## Valid path examples:
+- `notes/my-file.md`
+- `projects/2025/meeting-notes.md`
+- `archive/old-notes.md`
+
+## Try again with a safe path:
+```
+move_note("{identifier}", "notes/{destination_path.split("/")[-1] if "/" in destination_path else destination_path}")
+```"""
+
     # Check for potential cross-project move attempts
     cross_project_error = await _detect_cross_project_move_attempt(
         identifier, destination_path, active_project.name

basic_memory/mcp/tools/project_management.py

@@ -221,8 +221,10 @@ async def set_default_project(project_name: str, ctx: Context | None = None) ->
     if ctx:  # pragma: no cover
         await ctx.info(f"Setting default project to: {project_name}")
 
-    # Call API to set default project
-    response = await call_put(client, f"/projects/{project_name}/default")
+    # Call API to set default project using URL encoding for special characters
+    from urllib.parse import quote
+    encoded_name = quote(project_name, safe='')
+    response = await call_put(client, f"/projects/{encoded_name}/default")
     status_response = ProjectStatusResponse.model_validate(response.json())
 
     result = f"✓ {status_response.message}\n\n"
@@ -323,16 +325,29 @@ async def delete_project(project_name: str, ctx: Context | None = None) -> str:
     response = await call_get(client, "/projects/projects")
     project_list = ProjectList.model_validate(response.json())
 
-    # Check if project exists
-    project_exists = any(p.name == project_name for p in project_list.projects)
-    if not project_exists:
+    # Find the project by name (case-insensitive) or permalink - same logic as switch_project
+    project_permalink = generate_permalink(project_name)
+    target_project = None
+    for p in project_list.projects:
+        # Match by permalink (handles case-insensitive input)
+        if p.permalink == project_permalink:
+            target_project = p
+            break
+        # Also match by name comparison (case-insensitive)
+        if p.name.lower() == project_name.lower():
+            target_project = p
+            break
+    
+    if not target_project:
         available_projects = [p.name for p in project_list.projects]
         raise ValueError(
             f"Project '{project_name}' not found. Available projects: {', '.join(available_projects)}"
         )
 
-    # Call API to delete project
-    response = await call_delete(client, f"/projects/{project_name}")
+    # Call API to delete project using URL encoding for special characters
+    from urllib.parse import quote
+    encoded_name = quote(target_project.name, safe='')
+    response = await call_delete(client, f"/projects/{encoded_name}")
     status_response = ProjectStatusResponse.model_validate(response.json())
 
     result = f"✓ {status_response.message}\n\n"

basic_memory/mcp/tools/read_content.py

@@ -17,6 +17,7 @@ from basic_memory.mcp.async_client import client
 from basic_memory.mcp.tools.utils import call_get
 from basic_memory.mcp.project_session import get_active_project
 from basic_memory.schemas.memory import memory_url_path
+from basic_memory.utils import validate_project_path
 
 
 def calculate_target_params(content_length):
@@ -188,6 +189,21 @@ async def read_content(path: str, project: Optional[str] = None) -> dict:
     project_url = active_project.project_url
 
     url = memory_url_path(path)
+
+    # Validate path to prevent path traversal attacks
+    project_path = active_project.home
+    if not validate_project_path(url, project_path):
+        logger.warning(
+            "Attempted path traversal attack blocked",
+            path=path,
+            url=url,
+            project=active_project.name,
+        )
+        return {
+            "type": "error",
+            "error": f"Path '{path}' is not allowed - paths must stay within project boundaries",
+        }
+
     response = await call_get(client, f"{project_url}/resource/{url}")
     content_type = response.headers.get("content-type", "application/octet-stream")
     content_length = int(response.headers.get("content-length", 0))

basic_memory/mcp/tools/read_note.py

@@ -11,6 +11,7 @@ from basic_memory.mcp.tools.search import search_notes
 from basic_memory.mcp.tools.utils import call_get
 from basic_memory.mcp.project_session import get_active_project
 from basic_memory.schemas.memory import memory_url_path
+from basic_memory.utils import validate_project_path
 
 
 @mcp.tool(
@@ -55,6 +56,20 @@ async def read_note(
     # Get the active project first to check project-specific sync status
     active_project = get_active_project(project)
 
+    # Validate identifier to prevent path traversal attacks
+    # We need to check both the raw identifier and the processed path
+    processed_path = memory_url_path(identifier)
+    project_path = active_project.home
+    
+    if not validate_project_path(identifier, project_path) or not validate_project_path(processed_path, project_path):
+        logger.warning(
+            "Attempted path traversal attack blocked",
+            identifier=identifier,
+            processed_path=processed_path,
+            project=active_project.name,
+        )
+        return f"# Error\n\nIdentifier '{identifier}' is not allowed - paths must stay within project boundaries"
+
     # Check migration status and wait briefly if needed
     from basic_memory.mcp.tools.utils import wait_for_migration_or_return_status
 
@@ -124,7 +139,7 @@ def format_not_found_message(identifier: str) -> str:
     return dedent(f"""
         # Note Not Found: "{identifier}"
         
-        I searched for "{identifier}" using multiple methods (direct lookup, title search, and text search) but couldn't find any matching notes. Here are some suggestions:
+        I couldn't find any notes matching "{identifier}". Here are some suggestions:
         
         ## Check Identifier Type
         - If you provided a title, try using the exact permalink instead
@@ -170,7 +185,7 @@ def format_related_results(identifier: str, results) -> str:
     message = dedent(f"""
         # Note Not Found: "{identifier}"
         
-        I searched for "{identifier}" using direct lookup and title search but couldn't find an exact match. However, I found some related notes through text search:
+        I couldn't find an exact match for "{identifier}", but I found some related notes:
         
         """)
 

basic_memory/mcp/tools/sync_status.py

@@ -4,8 +4,10 @@ from typing import Optional
 
 from loguru import logger
 
+from basic_memory.config import ConfigManager
 from basic_memory.mcp.server import mcp
 from basic_memory.mcp.project_session import get_active_project
+from basic_memory.services.sync_status_service import sync_status_tracker
 
 
 def _get_all_projects_status() -> list[str]:
@@ -13,8 +15,7 @@ def _get_all_projects_status() -> list[str]:
     status_lines = []
 
     try:
-        from basic_memory.config import app_config
-        from basic_memory.services.sync_status_service import sync_status_tracker
+        app_config = ConfigManager().config
 
         if app_config.projects:
             status_lines.extend(["", "---", "", "**All Projects Status:**"])

basic_memory/mcp/tools/write_note.py

@@ -10,7 +10,7 @@ from basic_memory.mcp.tools.utils import call_put
 from basic_memory.mcp.project_session import get_active_project
 from basic_memory.schemas import EntityResponse
 from basic_memory.schemas.base import Entity
-from basic_memory.utils import parse_tags
+from basic_memory.utils import parse_tags, validate_project_path
 
 # Define TagType as a Union that can accept either a string or a list of strings or None
 TagType = Union[List[str], str, None]
@@ -75,6 +75,14 @@ async def write_note(
     # Get the active project first to check project-specific sync status
     active_project = get_active_project(project)
 
+    # Validate folder path to prevent path traversal attacks
+    project_path = active_project.home
+    if folder and not validate_project_path(folder, project_path):
+        logger.warning(
+            "Attempted path traversal attack blocked", folder=folder, project=active_project.name
+        )
+        return f"# Error\n\nFolder path '{folder}' is not allowed - paths must stay within project boundaries"
+
     # Check migration status and wait briefly if needed
     from basic_memory.mcp.tools.utils import wait_for_migration_or_return_status
 

basic_memory/models/knowledge.py

@@ -1,6 +1,7 @@
 """Knowledge graph models."""
 
 from datetime import datetime
+from basic_memory.utils import ensure_timezone_aware
 from typing import Optional
 
 from sqlalchemy import (
@@ -73,8 +74,8 @@ class Entity(Base):
     checksum: Mapped[Optional[str]] = mapped_column(String, nullable=True)
 
     # Metadata and tracking
-    created_at: Mapped[datetime] = mapped_column(DateTime)
-    updated_at: Mapped[datetime] = mapped_column(DateTime)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now().astimezone())
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now().astimezone(), onupdate=lambda: datetime.now().astimezone())
 
     # Relationships
     project = relationship("Project", back_populates="entities")
@@ -103,6 +104,16 @@ class Entity(Base):
     def is_markdown(self):
         """Check if the entity is a markdown file."""
         return self.content_type == "text/markdown"
+    
+    def __getattribute__(self, name):
+        """Override attribute access to ensure datetime fields are timezone-aware."""
+        value = super().__getattribute__(name)
+        
+        # Ensure datetime fields are timezone-aware
+        if name in ('created_at', 'updated_at') and isinstance(value, datetime):
+            return ensure_timezone_aware(value)
+        
+        return value
 
     def __repr__(self) -> str:
         return f"Entity(id={self.id}, name='{self.title}', type='{self.entity_type}'"

basic_memory/models/project.py

@@ -1,6 +1,6 @@
 """Project model for Basic Memory."""
 
-from datetime import datetime
+from datetime import datetime, UTC
 from typing import Optional
 
 from sqlalchemy import (
@@ -52,9 +52,9 @@ class Project(Base):
     is_default: Mapped[Optional[bool]] = mapped_column(Boolean, default=None, nullable=True)
 
     # Timestamps
-    created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now(UTC))
     updated_at: Mapped[datetime] = mapped_column(
-        DateTime, default=datetime.utcnow, onupdate=datetime.utcnow
+        DateTime(timezone=True), default=lambda: datetime.now(UTC), onupdate=lambda: datetime.now(UTC)
     )
 
     # Define relationships to entities, observations, and relations

basic_memory/repository/entity_repository.py

@@ -57,7 +57,7 @@ class EntityRepository(Repository[Entity]):
         """
         query = (
             self.select()
-            .where(Entity.file_path == str(file_path))
+            .where(Entity.file_path == Path(file_path).as_posix())
             .options(*self.get_load_options())
         )
         return await self.find_one(query)
@@ -68,7 +68,7 @@ class EntityRepository(Repository[Entity]):
         Args:
             file_path: Path to the entity file (will be converted to string internally)
         """
-        return await self.delete_by_fields(file_path=str(file_path))
+        return await self.delete_by_fields(file_path=Path(file_path).as_posix())
 
     def get_load_options(self) -> List[LoaderOption]:
         """Get SQLAlchemy loader options for eager loading relationships."""

basic_memory/repository/project_repository.py

@@ -46,7 +46,7 @@ class ProjectRepository(Repository[Project]):
         Args:
             path: Path to the project directory (will be converted to string internally)
         """
-        query = self.select().where(Project.path == str(path))
+        query = self.select().where(Project.path == Path(path).as_posix())
         return await self.find_one(query)
 
     async def get_default_project(self) -> Optional[Project]:
@@ -83,3 +83,21 @@ class ProjectRepository(Repository[Project]):
                 await session.flush()
                 return target_project
             return None  # pragma: no cover
+
+    async def update_path(self, project_id: int, new_path: str) -> Optional[Project]:
+        """Update project path.
+
+        Args:
+            project_id: ID of the project to update
+            new_path: New filesystem path for the project
+
+        Returns:
+            The updated project if found, None otherwise
+        """
+        async with db.scoped_session(self.session_maker) as session:
+            project = await self.select_by_id(session, project_id)
+            if project:
+                project.path = new_path
+                await session.flush()
+                return project
+            return None

basic_memory/repository/search_repository.py

@@ -6,6 +6,7 @@ import time
 from dataclasses import dataclass
 from datetime import datetime
 from typing import Any, Dict, List, Optional
+from pathlib import Path
 
 from loguru import logger
 from sqlalchemy import Executable, Result, text
@@ -59,8 +60,11 @@ class SearchIndexRow:
         if not self.type == SearchItemType.ENTITY.value and not self.file_path:
             return ""
 
+        # Normalize path separators to handle both Windows (\) and Unix (/) paths
+        normalized_path = Path(self.file_path).as_posix()
+        
         # Split the path by slashes
-        parts = self.file_path.split("/")
+        parts = normalized_path.split("/")
 
         # If there's only one part (e.g., "README.md"), it's at the root
         if len(parts) <= 1:
@@ -523,8 +527,8 @@ class SearchRepository:
         async with db.scoped_session(self.session_maker) as session:
             # Delete existing record if any
             await session.execute(
-                text("DELETE FROM search_index WHERE permalink = :permalink"),
-                {"permalink": search_index_row.permalink},
+                text("DELETE FROM search_index WHERE permalink = :permalink AND project_id = :project_id"),
+                {"permalink": search_index_row.permalink, "project_id": self.project_id},
             )
 
             # Prepare data for insert with project_id