loop-memory 0.4.21__tar.gz → 0.4.22__tar.gz

{loop_memory-0.4.21 → loop_memory-0.4.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: loop-memory
-Version: 0.4.21
+Version: 0.4.22
 Summary: A general-purpose, local memory system for every AI agent you run. Loop Memory auto-captures conversations from Codex / Claude / Hermes / OpenClaw, scores them by importance × recency × usage × feedback, distils them into a curated wiki, and serves everything from a single web UI.
 Author: Loop Memory contributors <loop-memory@users.noreply.github.com>
 License-Expression: MIT
@@ -67,13 +67,14 @@ Dynamic: license-file
 
 ---
 
-> **What's new in 0.4.21** — **the remote SDK can finally authenticate, and it refuses to send memory data over a plaintext connection** (audit 2026-11-08, weekly ecosystem sync). The audit for this release (2026-11-08) turned up a real hole rather than a hypothetical one. `MemoryClient.http(base_url=...)` had **no transport guard at all**: point it at `http://mem.example.com` and it opened a plain socket and shipped the user's memory text across the network — and because the HTTP backend had **no way to send the bearer token** (`sqlite_store.py` even carried the comment *"header when `MemoryClient.http(..., token=...)` is given"* for a parameter that did not exist), the only way for a remote client to talk to a token-protected `loop-memory serve` was to turn auth **off** — exactly the configuration in which both the memory text and the token cross the network in cleartext. Two upstream projects closed the same hole in the same week: `rohitg00/agentmemory` v0.9.32 (2026-11-04, Apache-2.0) made *"hooks send nothing to a remote plain `http://` server; use HTTPS for a remote server"* a **breaking change**, and `topoteretes/cognee` v1.6.7 (2026-11-06, Apache-2.0) refuses *"server file paths over HTTP"* by default — both are pattern references only, no code copied. **What shipped:** a new `loop_memory.security.transport` that classifies a base URL and refuses plaintext `http://` to a **non-loopback** host (plaintext to a **loopback** address stays allowed — that traffic never leaves the host, and it is the default deployment), refuses a URL with embedded credentials, and refuses an unsupported scheme; `Authorization: Bearer` support in the SDK and in the shared `http_*_json` helpers, so the documented remote path works against a protected server instead of requiring auth to be turned off; a redirect guard that refuses an `https://` → `http://` downgrade (urllib's stock handler follows it, which would undo the TLS guarantee one hop from the server) and refuses a cross-origin redirect while a token is attached (urllib replays the `Authorization` header onto the redirect request); and the server half — `loop-memory serve` records its bind address and a new `loop-memory doctor` check (`plaintext_exposure`) warns when the API is reachable from the network over plaintext. The rule is about the *destination*, not the scheme: a private tunnel or a VPN'd LAN is a legitimate deployment, so `allow_insecure=True` (or `LOOP_MEMORY_ALLOW_INSECURE=1`) exists — but it is never silent, it warns on every construction. 37 new regression cases; suite at **1041 passed / 4 skipped**. See [`docs/transport-security.md`](./docs/transport-security.md) for the full contract. [Full CHANGELOG →](./CHANGELOG.md#0421---2026-11-08)
+> **What's new in 0.4.22** — **the agent-namespace filter now works, and it is enforced in the query instead of on top of the answer** (audit 2026-11-15, weekly ecosystem sync). The audit for this release (2026-11-15) turned up a real hole rather than a hypothetical one. `GET /api/v1/recall?agent_id=X` was documented as *"Unified recall filtered to a single Agent namespace"* — but the filter was applied to the store's **output**, and it had two separate failure modes. **On the legacy path it was a silent no-op:** `MemoryStore.recall()` never returned the `agent_id` / `user_id` columns, so the route's predicate read `None`/`None` for every row, decided every row was "global", and let all of them through — **an agent that explicitly asked for its own namespace was handed every other agent's memories as well.** **On the hybrid path it ran after the `LIMIT`:** the filter worked, but it ran on the store's already-trimmed result set, so a foreign namespace could spend the caller's *entire* result budget — an agent asking for 5 hits could get **zero**, while its own matching rows sat further down the ranking. Both failures have the same root cause: **the predicate was in the caller instead of in the query** — exactly what the upstream projects in this window converged on. `plastic-labs/honcho` v3.6.0 (2026-11-10, AGPL-3.0) made `tenant_id` lead every primary key, with Postgres row-level security scoping **every read and write**, and refused to hand a tenant an empty namespace; `EverMind-AI/EverOS` v1.6.0 (2026-11-11) made deletion owner-scoped and answered `503 SESSION_BUSY` rather than deleting half of a session; `thedotmack/claude-mem` (v15.16.x) gave each scope its own project by default and made *"an explicitly empty project selection show nothing instead of observations from every project"* (#5866); `vectorize-io/hindsight` v1.2.1 stopped a bank clone from taking over another bank's alias (#6280) — pattern references only, no code copied, and the two AGPL-3.0 projects contributed nothing but an idea. **What shipped:** a single predicate builder (`_scope_clause()`) that every retrieval channel builds its query from, so the namespace lives in the **SQL** of the BM25 channel (both the FTS5 query and the `LIKE` backstop), the semantic channel, the entity channel, `recall()`, `recall_hybrid()` and `recall_as_of()` — the fused ranking, and the `limit` that trims it, now only ever sees the caller's own rows; every hit now reports its `agent_id` / `user_id`, which is what makes the legacy no-op impossible to reintroduce silently; all four public surfaces expose it — `GET /api/v1/recall` and `GET /api/recall` accept `agent_id` / `user_id`, the MCP `recall` tool scopes to `LOOP_MEMORY_AGENT_ID` / `LOOP_MEMORY_USER_ID` (the MCP server is started once per client, so the environment already identifies the caller) and accepts explicit overrides, and `loop-memory recall` gained `--agent-id` / `--user-id`; and a client that **writes** into a namespace now **reads** from it — `MemoryClient.memory(store, agent_id="x")` and `MemoryClient.http(url, agent_id="x")` fall back to that identity on `recall()`, which is precisely the asymmetry that hid the leak (pass `agent_id=""` for the explicit escape hatch). A memory with no `agent_id` stays **global** and visible to everyone, because the ingest pipeline, the consolidator and the dream job all write global rows. 43 new regression cases; suite at **1084 passed / 4 skipped**. See [`docs/namespace-isolation.md`](./docs/namespace-isolation.md) for the full contract. [Full CHANGELOG →](./CHANGELOG.md#0422---2026-11-15)
 
 <details>
-<summary><b>Older releases</b> — 0.4.20 and earlier, one line each (the CHANGELOG has the full detail)</summary>
+<summary><b>Older releases</b> — 0.4.21 and earlier, one line each (the CHANGELOG has the full detail)</summary>
 
 | Version | Date | What changed | Full notes |
 | --- | --- | --- | --- |
+| [0.4.21](./CHANGELOG.md#0421---2026-11-08) | 2026-11-08 | The remote SDK can authenticate, and it refuses to send memory data over a plaintext connection |
 | [0.4.20](./CHANGELOG.md#0420---2026-11-01) | 2026-11-01 | The packaging test works on the oldest supported Python (no `tomllib` on 3.10) |
 | [0.4.19](./CHANGELOG.md#0419---2026-11-01) | 2026-11-01 | The wheel ships the whole dashboard and the benchmark fixture (recursive package-data globs) |
 | [0.4.18](./CHANGELOG.md#0418---2026-11-01) | 2026-11-01 | The BM25 channel no longer publishes a score that collapses to zero — plus a retrieval benchmark |
@@ -268,6 +269,7 @@ Hermes, clawx) can read and write, we built this for you.
 | [docs/agent-memory-api.md](docs/agent-memory-api.md) | Stable four-verb SDK / HTTP / MCP contract for any Agent |
 | [docs/universal-agent-memory.md](docs/universal-agent-memory.md) | v7 graph memory, cognitive sleep, portable bundles, namespaces, and MCP/CLI extensions |
 | [docs/transport-security.md](docs/transport-security.md) | How a remote client is allowed to talk to `loop-memory serve` — the transport guard, bearer-token auth, redirect hardening, and the `plaintext_exposure` doctor check (0.4.21) |
+| [docs/namespace-isolation.md](docs/namespace-isolation.md) | Who may read which memory — the agent / user namespace predicate, why it lives in the SQL instead of on top of the answer, and the global-row semantics (0.4.22) |
 | [docs/providers.md](docs/providers.md) | LLM provider reference — built-in providers, defaults, base URLs, and how to add a new one |
 | [docs/auto-capture.md](docs/auto-capture.md) | Hooking Codex / Claude / Hermes / OpenClaw watchers (filesystem, launchd, systemd, cron) |
 | [CONTRIBUTING.md](CONTRIBUTING.md) | Local dev loop, pytest, where secrets live, how to add a provider/source |
@@ -631,12 +633,13 @@ loop_memory/
     memory/types.py            # MemoryItem + 4 tiers
     examples/demo.py           # runnable, zero-API-key demo
     py.typed
-  tests/                       # 1041 unit tests across memory / SDK / serve / CLI / scripts
+  tests/                       # 1084 unit tests across memory / SDK / serve / CLI / scripts
   docs/
     auto-capture.md            # launchd / systemd / cron recipes
     architecture.md            # layered view + 5-stage evolution pipeline
     api.md                     # HTTP API reference
     transport-security.md      # how a remote client may talk to `serve` (0.4.21)
+    namespace-isolation.md     # who may read which memory (0.4.22)
     agent-memory-api.md        # four-verb SDK / HTTP / MCP contract
     universal-agent-memory.md  # v7 graph memory + cognitive sleep + bundles
     providers.md               # LLM provider reference

{loop_memory-0.4.21 → loop_memory-0.4.22}/README.md

@@ -22,13 +22,14 @@
 
 ---
 
-> **What's new in 0.4.21** — **the remote SDK can finally authenticate, and it refuses to send memory data over a plaintext connection** (audit 2026-11-08, weekly ecosystem sync). The audit for this release (2026-11-08) turned up a real hole rather than a hypothetical one. `MemoryClient.http(base_url=...)` had **no transport guard at all**: point it at `http://mem.example.com` and it opened a plain socket and shipped the user's memory text across the network — and because the HTTP backend had **no way to send the bearer token** (`sqlite_store.py` even carried the comment *"header when `MemoryClient.http(..., token=...)` is given"* for a parameter that did not exist), the only way for a remote client to talk to a token-protected `loop-memory serve` was to turn auth **off** — exactly the configuration in which both the memory text and the token cross the network in cleartext. Two upstream projects closed the same hole in the same week: `rohitg00/agentmemory` v0.9.32 (2026-11-04, Apache-2.0) made *"hooks send nothing to a remote plain `http://` server; use HTTPS for a remote server"* a **breaking change**, and `topoteretes/cognee` v1.6.7 (2026-11-06, Apache-2.0) refuses *"server file paths over HTTP"* by default — both are pattern references only, no code copied. **What shipped:** a new `loop_memory.security.transport` that classifies a base URL and refuses plaintext `http://` to a **non-loopback** host (plaintext to a **loopback** address stays allowed — that traffic never leaves the host, and it is the default deployment), refuses a URL with embedded credentials, and refuses an unsupported scheme; `Authorization: Bearer` support in the SDK and in the shared `http_*_json` helpers, so the documented remote path works against a protected server instead of requiring auth to be turned off; a redirect guard that refuses an `https://` → `http://` downgrade (urllib's stock handler follows it, which would undo the TLS guarantee one hop from the server) and refuses a cross-origin redirect while a token is attached (urllib replays the `Authorization` header onto the redirect request); and the server half — `loop-memory serve` records its bind address and a new `loop-memory doctor` check (`plaintext_exposure`) warns when the API is reachable from the network over plaintext. The rule is about the *destination*, not the scheme: a private tunnel or a VPN'd LAN is a legitimate deployment, so `allow_insecure=True` (or `LOOP_MEMORY_ALLOW_INSECURE=1`) exists — but it is never silent, it warns on every construction. 37 new regression cases; suite at **1041 passed / 4 skipped**. See [`docs/transport-security.md`](./docs/transport-security.md) for the full contract. [Full CHANGELOG →](./CHANGELOG.md#0421---2026-11-08)
+> **What's new in 0.4.22** — **the agent-namespace filter now works, and it is enforced in the query instead of on top of the answer** (audit 2026-11-15, weekly ecosystem sync). The audit for this release (2026-11-15) turned up a real hole rather than a hypothetical one. `GET /api/v1/recall?agent_id=X` was documented as *"Unified recall filtered to a single Agent namespace"* — but the filter was applied to the store's **output**, and it had two separate failure modes. **On the legacy path it was a silent no-op:** `MemoryStore.recall()` never returned the `agent_id` / `user_id` columns, so the route's predicate read `None`/`None` for every row, decided every row was "global", and let all of them through — **an agent that explicitly asked for its own namespace was handed every other agent's memories as well.** **On the hybrid path it ran after the `LIMIT`:** the filter worked, but it ran on the store's already-trimmed result set, so a foreign namespace could spend the caller's *entire* result budget — an agent asking for 5 hits could get **zero**, while its own matching rows sat further down the ranking. Both failures have the same root cause: **the predicate was in the caller instead of in the query** — exactly what the upstream projects in this window converged on. `plastic-labs/honcho` v3.6.0 (2026-11-10, AGPL-3.0) made `tenant_id` lead every primary key, with Postgres row-level security scoping **every read and write**, and refused to hand a tenant an empty namespace; `EverMind-AI/EverOS` v1.6.0 (2026-11-11) made deletion owner-scoped and answered `503 SESSION_BUSY` rather than deleting half of a session; `thedotmack/claude-mem` (v15.16.x) gave each scope its own project by default and made *"an explicitly empty project selection show nothing instead of observations from every project"* (#5866); `vectorize-io/hindsight` v1.2.1 stopped a bank clone from taking over another bank's alias (#6280) — pattern references only, no code copied, and the two AGPL-3.0 projects contributed nothing but an idea. **What shipped:** a single predicate builder (`_scope_clause()`) that every retrieval channel builds its query from, so the namespace lives in the **SQL** of the BM25 channel (both the FTS5 query and the `LIKE` backstop), the semantic channel, the entity channel, `recall()`, `recall_hybrid()` and `recall_as_of()` — the fused ranking, and the `limit` that trims it, now only ever sees the caller's own rows; every hit now reports its `agent_id` / `user_id`, which is what makes the legacy no-op impossible to reintroduce silently; all four public surfaces expose it — `GET /api/v1/recall` and `GET /api/recall` accept `agent_id` / `user_id`, the MCP `recall` tool scopes to `LOOP_MEMORY_AGENT_ID` / `LOOP_MEMORY_USER_ID` (the MCP server is started once per client, so the environment already identifies the caller) and accepts explicit overrides, and `loop-memory recall` gained `--agent-id` / `--user-id`; and a client that **writes** into a namespace now **reads** from it — `MemoryClient.memory(store, agent_id="x")` and `MemoryClient.http(url, agent_id="x")` fall back to that identity on `recall()`, which is precisely the asymmetry that hid the leak (pass `agent_id=""` for the explicit escape hatch). A memory with no `agent_id` stays **global** and visible to everyone, because the ingest pipeline, the consolidator and the dream job all write global rows. 43 new regression cases; suite at **1084 passed / 4 skipped**. See [`docs/namespace-isolation.md`](./docs/namespace-isolation.md) for the full contract. [Full CHANGELOG →](./CHANGELOG.md#0422---2026-11-15)
 
 <details>
-<summary><b>Older releases</b> — 0.4.20 and earlier, one line each (the CHANGELOG has the full detail)</summary>
+<summary><b>Older releases</b> — 0.4.21 and earlier, one line each (the CHANGELOG has the full detail)</summary>
 
 | Version | Date | What changed | Full notes |
 | --- | --- | --- | --- |
+| [0.4.21](./CHANGELOG.md#0421---2026-11-08) | 2026-11-08 | The remote SDK can authenticate, and it refuses to send memory data over a plaintext connection |
 | [0.4.20](./CHANGELOG.md#0420---2026-11-01) | 2026-11-01 | The packaging test works on the oldest supported Python (no `tomllib` on 3.10) |
 | [0.4.19](./CHANGELOG.md#0419---2026-11-01) | 2026-11-01 | The wheel ships the whole dashboard and the benchmark fixture (recursive package-data globs) |
 | [0.4.18](./CHANGELOG.md#0418---2026-11-01) | 2026-11-01 | The BM25 channel no longer publishes a score that collapses to zero — plus a retrieval benchmark |
@@ -223,6 +224,7 @@ Hermes, clawx) can read and write, we built this for you.
 | [docs/agent-memory-api.md](docs/agent-memory-api.md) | Stable four-verb SDK / HTTP / MCP contract for any Agent |
 | [docs/universal-agent-memory.md](docs/universal-agent-memory.md) | v7 graph memory, cognitive sleep, portable bundles, namespaces, and MCP/CLI extensions |
 | [docs/transport-security.md](docs/transport-security.md) | How a remote client is allowed to talk to `loop-memory serve` — the transport guard, bearer-token auth, redirect hardening, and the `plaintext_exposure` doctor check (0.4.21) |
+| [docs/namespace-isolation.md](docs/namespace-isolation.md) | Who may read which memory — the agent / user namespace predicate, why it lives in the SQL instead of on top of the answer, and the global-row semantics (0.4.22) |
 | [docs/providers.md](docs/providers.md) | LLM provider reference — built-in providers, defaults, base URLs, and how to add a new one |
 | [docs/auto-capture.md](docs/auto-capture.md) | Hooking Codex / Claude / Hermes / OpenClaw watchers (filesystem, launchd, systemd, cron) |
 | [CONTRIBUTING.md](CONTRIBUTING.md) | Local dev loop, pytest, where secrets live, how to add a provider/source |
@@ -586,12 +588,13 @@ loop_memory/
     memory/types.py            # MemoryItem + 4 tiers
     examples/demo.py           # runnable, zero-API-key demo
     py.typed
-  tests/                       # 1041 unit tests across memory / SDK / serve / CLI / scripts
+  tests/                       # 1084 unit tests across memory / SDK / serve / CLI / scripts
   docs/
     auto-capture.md            # launchd / systemd / cron recipes
     architecture.md            # layered view + 5-stage evolution pipeline
     api.md                     # HTTP API reference
     transport-security.md      # how a remote client may talk to `serve` (0.4.21)
+    namespace-isolation.md     # who may read which memory (0.4.22)
     agent-memory-api.md        # four-verb SDK / HTTP / MCP contract
     universal-agent-memory.md  # v7 graph memory + cognitive sleep + bundles
     providers.md               # LLM provider reference

{loop_memory-0.4.21 → loop_memory-0.4.22}/loop_memory/cli/commands/read.py

@@ -62,10 +62,14 @@ def run_recall(args) -> int:
     caller can ask "what did we know about this query at that
     moment?". The wiki and entity sections are unchanged — only
     the raw-memory block grows the new line.
+
+    ``--agent-id`` / ``--user-id`` (audit 2026-11-15, loop-memory
+    0.4.22) restrict the answer to one namespace. Memories written
+    without an agent or user id are global and stay visible.
     """
     from ...storage.sqlite_store import MemoryStore
     if not args:
-        return die("usage: loop-memory recall <query> [--verbose] [--limit N]")
+        return die("usage: loop-memory recall <query> [--verbose] [--limit N] [--agent-id <id>] [--user-id <id>]")
     # Parse the small flag subset we expose. Keep it dumb-on-purpose:
     # we don't want argparse to swallow a token that happens to start
     # with "--" inside the user's query (e.g. ``recall --foo bar``).
@@ -80,6 +84,11 @@ def run_recall(args) -> int:
     level = 1
     # Audit 2026-10-25 (loop-memory 0.4.16) -- latest-only mode.
     latest_only = False
+    # Audit 2026-11-15 (loop-memory 0.4.22) -- agent / user
+    # namespace. ``None`` means "no restriction", which keeps the
+    # legacy see-everything behaviour.
+    agent_id: str | None = None
+    user_id: str | None = None
     qargs: list[str] = []
     i = 0
     while i < len(args):
@@ -158,6 +167,17 @@ def run_recall(args) -> int:
             except ValueError:
                 return die(f"--level must be 0, 1, or 2, got {args[i + 1]!r}")
             i += 2
+        elif a == "--agent-id" and i + 1 < len(args):
+            # Audit 2026-11-15 (loop-memory 0.4.22) -- restrict the
+            # answer to one agent namespace. Memories with no agent
+            # id are global and stay visible.
+            agent_id = args[i + 1].strip() or None
+            i += 2
+        elif a == "--user-id" and i + 1 < len(args):
+            # Audit 2026-11-15 (loop-memory 0.4.22) -- restrict the
+            # answer to one user namespace.
+            user_id = args[i + 1].strip() or None
+            i += 2
         elif a == "--limit" and i + 1 < len(args):
             try:
                 limit = int(args[i + 1])
@@ -170,13 +190,14 @@ def run_recall(args) -> int:
             qargs.append(a)
             i += 1
     if not qargs:
-        return die("usage: loop-memory recall <query> [--verbose] [--outline] [--as-of <ISO|epoch>] [--latest-only] [--limit N] [--max-chars N] [--level 0|1|2]")
+        return die("usage: loop-memory recall <query> [--verbose] [--outline] [--as-of <ISO|epoch>] [--latest-only] [--agent-id <id>] [--user-id <id>] [--limit N] [--max-chars N] [--level 0|1|2]")
     store = MemoryStore(default_db_path())
     query = " ".join(qargs)
     if as_of is not None:
         try:
             r = store.recall_as_of(query, as_of, limit=limit,
-                                    max_chars=max_chars, level=level)
+                                    max_chars=max_chars, level=level,
+                                    agent_id=agent_id, user_id=user_id)
         except ValueError as e:
             return die(str(e))
     elif outline:
@@ -190,7 +211,11 @@ def run_recall(args) -> int:
                           # "everything" semantics.
                           as_of_ts=validity_at,
                           # Audit 2026-10-25: one answer per fact.
-                          latest_only=latest_only)
+                          latest_only=latest_only,
+                          # Audit 2026-11-15: namespace predicate in
+                          # SQL -- the limit counts only the caller's
+                          # own rows.
+                          agent_id=agent_id, user_id=user_id)
     has = False
     if r["wiki"]:
         has = True

{loop_memory-0.4.21 → loop_memory-0.4.22}/loop_memory/mcp/__init__.py

@@ -77,7 +77,27 @@ def tool_recall(arguments: dict[str, Any]) -> list[dict[str, Any]]:
     if not query:
         return [_err("missing 'query' argument")]
     store = _store()
-    source = arguments.get("source") or _agent_context()[0]
+    ctx_agent, ctx_user = _agent_context()
+    source = arguments.get("source") or ctx_agent
+    # Audit 2026-11-15 (loop-memory 0.4.22): namespace isolation.
+    # The MCP server is started once per client (Codex, Claude Code,
+    # Hermes, ...), so ``LOOP_MEMORY_AGENT_ID`` / ``LOOP_MEMORY_USER_ID``
+    # already identify the caller. The recall tool now scopes the
+    # answer to that namespace -- inside the store's SQL, so a foreign
+    # namespace can neither leak a row nor eat the result budget.
+    # An explicit ``agent_id`` / ``user_id`` argument overrides the
+    # environment; passing an empty string means "no restriction",
+    # which keeps the legacy see-everything behaviour reachable.
+    agent_id = arguments.get("agent_id")
+    if agent_id is None:
+        agent_id = ctx_agent
+    elif not str(agent_id).strip():
+        agent_id = None
+    user_id = arguments.get("user_id")
+    if user_id is None:
+        user_id = ctx_user
+    elif not str(user_id).strip():
+        user_id = None
     # Audit 2026-10-05: thread ``max_chars`` (token / char budget cap)
     # + ``level`` (tiered-loader) through the MCP tool so an MCP-aware
     # agent loop can ask for a bounded retrieval inline. ``None`` and
@@ -98,7 +118,8 @@ def tool_recall(arguments: dict[str, Any]) -> list[dict[str, Any]]:
     except (TypeError, ValueError):
         level = 1
     r = store.recall(query, limit=limit, source=source,
-                     max_chars=max_chars, level=level)
+                     max_chars=max_chars, level=level,
+                     agent_id=agent_id, user_id=user_id)
     n_mem = len(r["memories"])
     n_wiki = len(r["wiki"])
     n_ent = len(r["entities"])
@@ -528,6 +549,22 @@ TOOLS = [
             "properties": {
                 "query": {"type": "string", "description": "Free-text query"},
                 "limit": {"type": "integer", "description": "Max results (default 8, max 50)"},
+                "agent_id": {
+                    "type": "string",
+                    "description": (
+                        "Agent namespace to scope the answer to "
+                        "(overrides LOOP_MEMORY_AGENT_ID). Empty string "
+                        "means no restriction."
+                    ),
+                },
+                "user_id": {
+                    "type": "string",
+                    "description": (
+                        "User namespace to scope the answer to "
+                        "(overrides LOOP_MEMORY_USER_ID). Empty string "
+                        "means no restriction."
+                    ),
+                },
             },
             "required": ["query"],
         },

{loop_memory-0.4.21 → loop_memory-0.4.22}/loop_memory/sdk.py

@@ -298,6 +298,14 @@ class MemoryClient(MemoryClientExt, AbstractContextManager):
         validity window are dropped, subject-key slots collapse to
         their newest live row, and near-duplicate texts collapse to
         the newest one.
+
+        ``agent_id`` / ``user_id`` (audit 2026-11-15, loop-memory
+        0.4.22) restrict the answer to one namespace. A client built
+        with ``MemoryClient.memory(..., agent_id=...)`` /
+        ``MemoryClient.http(..., agent_id=...)`` falls back to that
+        identity, so a client that *writes* into a namespace also
+        *reads* from it. Memories written without an agent / user id
+        are global and stay visible to everyone.
         """
         raise NotImplementedError
 
@@ -416,12 +424,28 @@ class _InProcessClient(MemoryClient):
         # the legacy LIKE-based ``recall`` if a stale DB doesn't have
         # it (older installs, tests).
         wanted = tuple(s.strip() for s in include.split(",") if s.strip())
+        # Audit 2026-11-15 (loop-memory 0.4.22): the namespace the
+        # client was built with is the namespace it reads from. The
+        # predicate is applied inside the store's SQL so the limit
+        # counts only the caller's own rows.
+        # An explicit empty string means "no restriction"; ``None``
+        # falls back to the identity the client was built with.
+        if agent_id is None:
+            scope_agent = self._default_agent_id
+        else:
+            scope_agent = (str(agent_id).strip() or None)
+        if user_id is None:
+            scope_user = self._default_user_id
+        else:
+            scope_user = (str(user_id).strip() or None)
         if hasattr(self._store, "recall_hybrid"):
             r = self._store.recall_hybrid(
                 query, limit=limit, include=wanted,
                 bump_signals=True, source=source, level=level,
                 max_chars=max_chars,
                 latest_only=latest_only,
+                agent_id=scope_agent,
+                user_id=scope_user,
             )
         else:
             r = self._store.recall(
@@ -432,9 +456,13 @@ class _InProcessClient(MemoryClient):
                 max_chars=max_chars,
                 level=level,
                 latest_only=latest_only,
+                agent_id=scope_agent,
+                user_id=scope_user,
             )
-        # Optional post-filter: even if the store returned hits, the
-        # caller may want only their agent's namespace.
+        # Defence in depth: the store already applied the namespace
+        # predicate inside its SQL, so this can only ever remove a
+        # row the SQL should not have returned anyway. It is kept so
+        # a future regression in the SQL cannot leak a row.
         def _own(h: dict[str, Any]) -> bool:
             ag = h.get("agent_id")
             ur = h.get("user_id")
@@ -443,9 +471,9 @@ class _InProcessClient(MemoryClient):
             # match the caller's filter or be unset on the memory.
             if ag is None and ur is None:
                 return True
-            if agent_id is not None and ag not in (None, agent_id):
+            if scope_agent is not None and ag not in (None, scope_agent):
                 return False
-            if user_id is not None and ur not in (None, user_id):
+            if scope_user is not None and ur not in (None, scope_user):
                 return False
             return True
         return RecallResult(
@@ -780,10 +808,24 @@ class _HttpClient(MemoryClient):
             params["latest_only"] = "1"
         if max_chars is not None:
             params["max_chars"] = int(max_chars)
-        if agent_id is not None:
-            params["agent_id"] = agent_id
-        if user_id is not None:
-            params["user_id"] = user_id
+        # Audit 2026-11-15 (loop-memory 0.4.22): a client built with
+        # ``MemoryClient.http(..., agent_id=...)`` writes into that
+        # namespace, so it reads from it too. The server applies the
+        # namespace predicate inside its SQL.
+        # An explicit empty string means "no restriction"; ``None``
+        # falls back to the identity the client was built with.
+        if agent_id is None:
+            scope_agent = self._default_agent_id
+        else:
+            scope_agent = (str(agent_id).strip() or None)
+        if user_id is None:
+            scope_user = self._default_user_id
+        else:
+            scope_user = (str(user_id).strip() or None)
+        if scope_agent is not None:
+            params["agent_id"] = scope_agent
+        if scope_user is not None:
+            params["user_id"] = scope_user
         qs = urllib.parse.urlencode({k: v for k, v in params.items() if v != ""})
         resp = self._request("GET", f"/api/v1/recall?{qs}")
         return RecallResult(

{loop_memory-0.4.21 → loop_memory-0.4.22}/loop_memory/serve/routes/memories.py

@@ -307,6 +307,24 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None)
         "global" and visible to every caller (matches the SDK
         semantics).
 
+        Audit 2026-11-15 (loop-memory 0.4.22) -- the namespace
+        predicate is now applied **inside** the store's SQL, not on
+        top of its output. Before this release the filter ran after
+        the store had already applied its ``LIMIT``, which meant:
+
+        * in ``hybrid`` mode a foreign namespace could spend the
+          caller's whole result budget, so an agent could get zero
+          hits while its own matching rows sat further down the
+          ranking; and
+        * in ``legacy`` mode the filter was a **silent no-op** --
+          ``store.recall()`` did not return ``agent_id`` /
+          ``user_id``, so every row looked "global" and *every*
+          namespace saw *every* other namespace's memories.
+
+        The Python filter below is kept as a defence-in-depth net so
+        a future regression in the SQL cannot leak a row; the SQL is
+        what makes the ``limit`` meaningful.
+
         ``latest_only=1`` collapses the answer to one row per logical
         fact: rows outside their validity window are dropped, subject
         key slots collapse to their newest live row, and near-duplicate
@@ -315,6 +333,10 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None)
         wanted = tuple(s.strip() for s in include.split(",") if s.strip())
         if not wanted:
             wanted = ("memories", "wiki", "entities")
+        # Audit 2026-11-15 (loop-memory 0.4.22): a blank namespace
+        # means "not specified" -- never "match nothing".
+        agent_id = (agent_id or "").strip() or None
+        user_id = (user_id or "").strip() or None
         if mode == "legacy" or not hasattr(store, "recall_hybrid"):
             r = store.recall(
                 q,
@@ -323,12 +345,16 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None)
                 bump_signals=True,
                 source=source,
                 latest_only=bool(latest_only),
+                agent_id=agent_id,
+                user_id=user_id,
             )
         else:
             r = store.recall_hybrid(
                 q, limit=limit, include=wanted,
                 bump_signals=True, source=source, level=1,
                 latest_only=bool(latest_only),
+                agent_id=agent_id,
+                user_id=user_id,
             )
         if agent_id is not None or user_id is not None:
             def _own(m: dict) -> bool:

{loop_memory-0.4.21 → loop_memory-0.4.22}/loop_memory/serve/routes/system.py

@@ -403,7 +403,14 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None,
               # their validity window are dropped, subject-key slots
               # collapse to their newest live row, and near-duplicate
               # texts collapse to the newest one.
-              latest_only: int = 0):
+              latest_only: int = 0,
+              # Audit 2026-11-15 (loop-memory 0.4.22): optional
+              # agent / user namespace. The predicate is applied in
+              # the store's SQL, so the ``limit`` counts only the
+              # caller's own rows. Unset (the default) keeps the
+              # dashboard's "see everything" behaviour.
+              agent_id: str | None = None,
+              user_id: str | None = None):
         """Unified recall — wiki + memories + entities in one ranked stream.
 
         ``mode`` is 'hybrid' (default) for BM25+semantic+entity RRF,
@@ -437,7 +444,16 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None,
         vectorize-io/hindsight v0.10.2 "concise extraction by
         default" + aiming-lab/SimpleMem ICML'26 semantic-lossless-
         compression.
+
+        ``agent_id`` / ``user_id`` (audit 2026-11-15, loop-memory
+        0.4.22) restrict the answer to one agent / user namespace.
+        Rows with a NULL ``agent_id`` / ``user_id`` are global and
+        stay visible to everyone.
         """
+        # Audit 2026-11-15 (loop-memory 0.4.22): a blank namespace
+        # means "not specified" -- never "match nothing".
+        agent_id = (agent_id or "").strip() or None
+        user_id = (user_id or "").strip() or None
         wanted = tuple(s.strip() for s in include.split(",") if s.strip())
         if not wanted:
             wanted = ("memories", "wiki", "entities")
@@ -461,6 +477,8 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None,
                     source=source,
                     max_chars=max_chars,
                     level=level,
+                    agent_id=agent_id,
+                    user_id=user_id,
                 )
                 recall_mode = "as_of"
             except ValueError as e:
@@ -481,6 +499,9 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None,
                     as_of_ts=(validity_at if (validity_at and str(validity_at).strip()) else None),
                     # Audit 2026-10-25: one answer per fact.
                     latest_only=bool(latest_only),
+                    # Audit 2026-11-15: namespace predicate in SQL.
+                    agent_id=agent_id,
+                    user_id=user_id,
                 )
             except ValueError as e:
                 # Invalid ``validity_at`` -> 400 (audit 2026-10-18)
@@ -496,6 +517,9 @@ def register(app: FastAPI, store: MemoryStore, scheduler: Optional[Any] = None,
                     as_of_ts=(validity_at if (validity_at and str(validity_at).strip()) else None),
                     # Audit 2026-10-25: one answer per fact.
                     latest_only=bool(latest_only),
+                    # Audit 2026-11-15: namespace predicate in SQL.
+                    agent_id=agent_id,
+                    user_id=user_id,
                 )
             except ValueError as e:
                 raise HTTPException(400, str(e))

{loop_memory-0.4.21 → loop_memory-0.4.22}/loop_memory/storage/retrieval.py

@@ -90,6 +90,11 @@ def bm25_search(
     kind: str = "memories",
     limit: int = 50,
     source_filter: str | None = None,
+    # Audit 2026-11-15 (loop-memory 0.4.22): agent / user namespace.
+    # Applied inside the SQL so a foreign namespace cannot consume
+    # this channel's ``LIMIT`` budget.
+    agent_id: str | None = None,
+    user_id: str | None = None,
 ) -> list[dict]:
     """Run an FTS5 query and return a list of ``{"id": ..., "_score": bm25}``.
 
@@ -105,6 +110,13 @@ def bm25_search(
     AND total length <3, FTS5 returns nothing; we then issue a
     ``LIKE '%<q>%'`` over the source table as a backstop. For our
     scale (<10k memories, <1k wiki) LIKE is well under 5 ms.
+
+    ``agent_id`` / ``user_id`` (audit 2026-11-15, loop-memory
+    0.4.22) restrict the ``memories`` branch to one namespace. The
+    predicate is applied in SQL -- both on the FTS5 query and on the
+    ``LIKE`` backstop -- so the row budget is spent on the caller's
+    own memories. Rows with a NULL ``agent_id`` / ``user_id`` are
+    global and stay visible to everyone.
     """
     import re as _re
     fts_q = _escape_fts(query)
@@ -128,15 +140,19 @@ def bm25_search(
                 # answer. Without this filter the BM25 channel
                 # happily returned both versions of a fact, which
                 # broke the new ``latest_only`` semantics.
+                scope_sql, scope_params = store._scope_clause(
+                    agent_id, user_id, alias="m"
+                )
                 sql = (
                     f"SELECT m.id AS id, {score_col} AS s "
                     f"FROM {table} t "
                     f"JOIN memories m ON m.rowid = t.rowid "
                     f"WHERE {table} MATCH ? "
                     f"  AND m.superseded_by IS NULL "
+                    f"  {scope_sql} "
                     f"ORDER BY s LIMIT ?"
                 )
-                rows = c.execute(sql, (fts_q, limit)).fetchall()
+                rows = c.execute(sql, (fts_q, *scope_params, limit)).fetchall()
             else:
                 # Wiki: also join back to wiki_pages so we can apply the
                 # per-source scope filter at the SQL layer. We negate
@@ -158,7 +174,8 @@ def bm25_search(
     # lists are merged by id; LIKE rows get a synthetic importance
     # score so the RRF caller can rank them alongside BM25.
     like_rows = _like_fallback(store, query, kind=kind, limit=limit,
-                               source_filter=source_filter)
+                               source_filter=source_filter,
+                               agent_id=agent_id, user_id=user_id)
     merged: dict[str, dict] = {}
     for r in (rows or []):
         # ``_fts_score`` keeps the raw SQLite score for diagnostics.
@@ -250,6 +267,8 @@ def _like_fallback(
     kind: str,
     limit: int,
     source_filter: str | None = None,
+    agent_id: str | None = None,
+    user_id: str | None = None,
 ) -> list:
     """Brute-force LIKE fallback used when FTS5 trigram can't index
     a query -- short strings, all-CJK with <3 chars, or the FTS5
@@ -273,13 +292,20 @@ def _like_fallback(
     pat = f"%{q}%"
     with store._conn() as c:
         if kind == "memories":
+            scope_sql, scope_params = store._scope_clause(
+                agent_id, user_id, alias="m"
+            )
             sql = (
                 "SELECT m.id AS id, m.importance AS importance "
                 "FROM memories m WHERE LOWER(text) LIKE LOWER(?) "
                 "  AND m.superseded_by IS NULL "
+                f"  {scope_sql} "
                 "ORDER BY m.importance DESC, m.created_at DESC LIMIT ?"
             )
-            whole = [dict(r) for r in c.execute(sql, (pat, limit)).fetchall()]
+            whole = [
+                dict(r)
+                for r in c.execute(sql, (pat, *scope_params, limit)).fetchall()
+            ]
             if whole:
                 return whole
             # Per-token OR pass -- at least one query word must hit.
@@ -293,9 +319,15 @@ def _like_fallback(
                 "SELECT m.id AS id, m.importance AS importance "
                 f"FROM memories m WHERE ({placeholders}) "
                 "  AND m.superseded_by IS NULL "
+                f"  {scope_sql} "
                 "ORDER BY m.importance DESC, m.created_at DESC LIMIT ?"
             )
-            return [dict(r) for r in c.execute(sql_t, (*params, limit)).fetchall()]
+            return [
+                dict(r)
+                for r in c.execute(
+                    sql_t, (*params, *scope_params, limit)
+                ).fetchall()
+            ]
         sql = (
             "SELECT w.id AS id, w.importance AS importance, w.scope AS scope "
             "FROM wiki_pages w "