cortex-ai-memory 2.2.1__tar.gz → 2.4.0__tar.gz

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/Cargo.lock

@@ -573,7 +573,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-core"
-version = "2.2.1"
+version = "2.4.0"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -606,7 +606,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-http"
-version = "2.2.1"
+version = "2.4.0"
 dependencies = [
  "axum",
  "chrono",
@@ -623,16 +623,19 @@ dependencies = [
 
 [[package]]
 name = "cortex-mcp-server"
-version = "2.2.1"
+version = "2.4.0"
 dependencies = [
+ "axum",
  "chrono",
  "clap",
  "cortex-core",
  "hostname",
+ "libc",
  "rand 0.8.5",
  "serde",
  "serde_json",
  "tokio",
+ "tower",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -640,7 +643,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-python"
-version = "2.2.1"
+version = "2.4.0"
 dependencies = [
  "cortex-core",
  "pyo3",
@@ -649,7 +652,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-wasm"
-version = "2.2.1"
+version = "2.4.0"
 dependencies = [
  "chrono",
  "js-sys",
@@ -3485,6 +3488,7 @@ dependencies = [
  "pin-project-lite",
  "sync_wrapper",
  "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cortex-ai-memory
-Version: 2.2.1
+Version: 2.4.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/cortex-core/Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "cortex-core"
-version = "2.2.1"
+version = "2.4.0"
 edition = "2021"
+rust-version = "1.89"
 
 [features]
 default = ["encrypted-db"]

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/cortex-core/src/export.rs

@@ -117,6 +117,13 @@ pub fn import_all(
     };
 
     if let Some(memories) = data.memories {
+        // The Muse export is consent given on this device. Import never recreates it:
+        // a crafted file could otherwise plant rows Muse would serve. After a restore, the
+        // user re-exports with `gateway allow`.
+        let memories: Vec<_> = memories
+            .into_iter()
+            .filter(|m| m.namespace.as_deref() != Some(crate::types::MUSE_EXPORT_NAMESPACE))
+            .collect();
         report.memories = memories.len();
         for mem in &memories {
             storage.store_memory(mem)?;

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/cortex-core/src/lib.rs

@@ -559,10 +559,17 @@ impl Cortex {
         Ok(())
     }
 
+    /// Embed `text` with the local model, or `None` when embeddings are compiled out,
+    /// disabled via `CORTEX_NO_EMBEDDINGS`, or the model failed to load.
+    pub fn embed_query(&self, text: &str) -> Option<Vec<f32>> {
+        self.auto_embed(text, None)
+    }
+
     /// Auto-generate embedding if embedder is available and none provided.
     /// Lazily initializes the embedding model on first call.
-    #[allow(unused_variables)]
     fn auto_embed(&self, text: &str, embedding: Option<Vec<f32>>) -> Option<Vec<f32>> {
+        #[cfg(not(feature = "embeddings"))]
+        let _ = text;
         if embedding.is_some() {
             return embedding;
         }
@@ -721,6 +728,12 @@ impl Cortex {
         people: &PeopleGraph<'_>,
         pending_hashes: &[String],
     ) -> Result<PrepareOutcome, CortexError> {
+        if namespace == Some(crate::types::MUSE_EXPORT_NAMESPACE) {
+            return Err(CortexError::InvalidInput(format!(
+                "namespace '{}' is reserved for `cortex-mcp-server gateway allow`",
+                crate::types::MUSE_EXPORT_NAMESPACE
+            )));
+        }
         let mut source = MemSource::new(channel);
         let embedding = self.auto_embed(text, embedding);
 
@@ -804,8 +817,19 @@ impl Cortex {
             return None;
         }
         let emb = embedding.as_ref()?;
-        if let Some((existing_id, sim)) = self.index.search(emb, 1).first().copied() {
-            if sim >= self.dedup_config.near_dedup_threshold {
+        // A Muse export copy is not the user's memory: merging into it would drop the new
+        // ingest (and a later `gateway revoke` would lose the only copy). Skip export copies
+        // and keep looking at the next-nearest neighbours instead of giving up.
+        const NEAR_DEDUP_CANDIDATES: usize = 8;
+        let is_export_copy = |id: Uuid| {
+            matches!(self.storage.get_memory(id),
+                Ok(Some(m)) if m.namespace.as_deref() == Some(crate::types::MUSE_EXPORT_NAMESPACE))
+        };
+        for (existing_id, sim) in self.index.search(emb, NEAR_DEDUP_CANDIDATES) {
+            if sim < self.dedup_config.near_dedup_threshold {
+                break; // results are ordered by similarity
+            }
+            if !is_export_copy(existing_id) {
                 return Some(NearDup::Existing(existing_id));
             }
         }
@@ -1442,6 +1466,13 @@ impl Cortex {
             .storage
             .get_memory(id)?
             .ok_or_else(|| CortexError::NotFound(format!("memory {id}")))?;
+        // Muse export copies are local-only consent records; they must never reach sync.
+        if privacy.is_syncable() && mem.namespace.as_deref() == Some(crate::types::MUSE_EXPORT_NAMESPACE) {
+            return Err(CortexError::InvalidInput(format!(
+                "memories in the reserved '{}' namespace cannot be made syncable",
+                crate::types::MUSE_EXPORT_NAMESPACE
+            )));
+        }
         let was_syncable = mem.privacy.is_syncable();
         mem.privacy = privacy;
         self.storage.update_memory(&mem)?;

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/cortex-core/src/sync/crypto.rs

@@ -113,6 +113,25 @@ pub struct EncryptionManifest {
     pub hmac_salt: Option<String>, // base64-encoded salt for HMAC key derivation
     #[serde(skip_serializing_if = "Option::is_none")]
     pub hmac: Option<String>, // base64-encoded HMAC of manifest content (computed without hmac and hmac_salt fields)
+    /// The snapshot new devices must bootstrap from. Covered by the manifest HMAC, so an
+    /// attacker without the passphrase can neither replay an older snapshot (same name, older
+    /// content) nor make restore fall back to one. Omitted when `None`, which keeps the HMAC
+    /// input of manifests written before this field existed byte-identical.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub latest_snapshot: Option<SnapshotPointer>,
+    /// Monotonic counter bumped on every manifest write (first creation = 1). Covered by the
+    /// HMAC; devices remember the highest value they accepted and reject lower ones, so a
+    /// replayed older manifest (with its older snapshot pointer or key version) is detected.
+    /// Absent in legacy manifests (treated as 0); omitted when `None` for HMAC compatibility.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub generation: Option<u64>,
+}
+
+/// Names the authoritative encrypted snapshot: its file name and its `HMAC:` line value.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SnapshotPointer {
+    pub file: String,
+    pub mac: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -140,6 +159,8 @@ pub fn new_encryption_manifest() -> EncryptionManifest {
         key_version: Some(0), // Start at version 0; higher versions for rotated keys
         hmac_salt: None,      // Will be computed during sync initialization
         hmac: None,           // HMAC will be computed during sync initialization
+        latest_snapshot: None,
+        generation: None,
     }
 }
 
@@ -285,6 +306,19 @@ pub fn decrypt_line(ctx: &CryptoContext, encrypted_line: &str) -> Result<Vec<u8>
     }
 }
 
+/// Key version of an envelope: `ENC1` is version 0; `ENC2` carries it in its first two
+/// payload bytes. `None` if the line is not a well-formed envelope header. Only the first
+/// base64 quantum is decoded, so this is cheap even for a large snapshot envelope.
+pub fn envelope_version(line: &str) -> Option<u32> {
+    if line.starts_with(ENC_PREFIX) {
+        return Some(0);
+    }
+    let head = line.strip_prefix(ENC2_PREFIX)?.get(..4)?;
+    let bytes = base64::engine::general_purpose::STANDARD.decode(head).ok()?;
+    let version = bytes.get(..VERSION_LEN)?;
+    Some(u16::from_le_bytes([version[0], version[1]]) as u32)
+}
+
 /// Check if a line is encrypted (either envelope version).
 pub fn is_encrypted_line(line: &str) -> bool {
     line.starts_with(ENC_PREFIX) || line.starts_with(ENC2_PREFIX)
@@ -588,4 +622,48 @@ mod tests {
         assert!(is_encrypted_line("ENC1:abc123"));
         assert!(!is_encrypted_line("{\"op_id\":\"...\"}"));
     }
+    #[test]
+    fn test_envelope_version() {
+        let m = test_manifest();
+        let ctx0 = derive_key("pass", &m).unwrap();
+        let ctx3 = derive_key("pass", &manifest_at_version(&m, 3)).unwrap();
+        assert_eq!(envelope_version(&encrypt_line(&ctx0, b"x").unwrap()), Some(0));
+        assert_eq!(envelope_version(&encrypt_line(&ctx3, b"x").unwrap()), Some(3));
+        assert_eq!(envelope_version("ENC2:"), None);
+        assert_eq!(envelope_version("ENC2:!!!!"), None);
+        assert_eq!(envelope_version("{\"op\":1}"), None);
+    }
+
+    /// Adding `latest_snapshot` must not change the HMAC input of manifests that lack it:
+    /// a manifest written before the field existed still verifies after a parse/re-serialize.
+    #[test]
+    fn test_legacy_manifest_without_pointer_still_verifies() {
+        let mut legacy = new_encryption_manifest();
+        legacy.hmac = None;
+        legacy.hmac_salt = None;
+        // Legacy wire form: exactly the pre-pointer field set.
+        let legacy_bytes = format!(
+            r#"{{"algorithm":"{}","kdf":"{}","salt":"{}","kdf_params":{{"time_cost":{},"mem_cost":{},"parallelism":{}}},"key_version":0}}"#,
+            legacy.algorithm,
+            legacy.kdf,
+            legacy.salt,
+            legacy.kdf_params.time_cost,
+            legacy.kdf_params.mem_cost,
+            legacy.kdf_params.parallelism,
+        )
+        .into_bytes();
+        let (hmac, salt) = compute_manifest_hmac(&legacy_bytes, "pass").unwrap();
+
+        let parsed: EncryptionManifest = serde_json::from_slice(&legacy_bytes).unwrap();
+        assert!(parsed.latest_snapshot.is_none());
+        let reserialized = serde_json::to_vec(&parsed).unwrap();
+        assert_eq!(reserialized, legacy_bytes);
+        assert!(verify_manifest_integrity(&reserialized, &hmac, "pass", Some(&salt)).unwrap());
+
+        // With a pointer the bytes (and so the HMAC) change — the pointer is authenticated.
+        let mut pinned = parsed.clone();
+        pinned.latest_snapshot = Some(SnapshotPointer { file: "f".into(), mac: "m".into() });
+        let pinned_bytes = serde_json::to_vec(&pinned).unwrap();
+        assert!(!verify_manifest_integrity(&pinned_bytes, &hmac, "pass", Some(&salt)).unwrap());
+    }
 }

{cortex_ai_memory-2.2.1 → cortex_ai_memory-2.4.0}/cortex-core/src/sync/merge.rs

@@ -38,6 +38,12 @@ pub fn apply_op(
                     "Remote device attempted to sync Private memory — rejected".into(),
                 ));
             }
+            // The Muse export is local consent; a peer must never be able to add to it.
+            if memory.namespace.as_deref() == Some(crate::types::MUSE_EXPORT_NAMESPACE) {
+                return Err(CortexError::InvalidInput(
+                    "Remote device attempted to write the reserved Muse export namespace — rejected".into(),
+                ));
+            }
 
             let entity_type = EntityType::Memory;
             let entity_id = memory.id;
@@ -323,6 +329,26 @@ mod tests {
         ts
     }
 
+    #[test]
+    fn test_peer_cannot_write_muse_export_namespace() {
+        use crate::types::{MemContent, MemObjectBuilder, MemSource, MemoryTier, PrivacyLevel, MUSE_EXPORT_NAMESPACE};
+        let s = SqliteStorage::open_in_memory().unwrap();
+        let idx = MemoryIndex::new();
+        let memory = MemObjectBuilder::new(MemoryTier::Semantic, MemContent::Text("injected".into()), MemSource::new("x"))
+            .privacy(PrivacyLevel::Public)
+            .namespace(MUSE_EXPORT_NAMESPACE)
+            .build();
+        let id = memory.id;
+        let op = SyncOp {
+            op_id: Uuid::new_v4(),
+            hlc: HlcTimestamp::new(100, 0, "dev-evil"),
+            payload: SyncPayload::MemoryUpsert { memory },
+            hmac: None,
+        };
+        assert!(apply_op(&op, &s, &idx).is_err());
+        assert!(s.get_memory(id).unwrap().is_none());
+    }
+
     #[test]
     fn test_belief_upsert_is_idempotent() {
         let s = SqliteStorage::open_in_memory().unwrap();