memgres 0.11.0__tar.gz → 0.12.1__tar.gz

{memgres-0.11.0 → memgres-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgres
-Version: 0.11.0
+Version: 0.12.1
 Summary: Drop-in memory for AI agents: one Postgres, lexical + semantic recall, diff-versioned history, GDPR-erasable.
 Author: mozgsml
 License-Expression: MIT
@@ -216,6 +216,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
 | `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
+| `MEMGRES_REQUIRED_FIELDS` | — | comma-separated fields a content-storing write must carry (`source`, `reason`), refused by name when absent. A policy about a corpus, not a property of the software: a scratch database wants none, a corporate one wants `source`. `move`/`retag` are exempt. Announced in `server_info.write_requirements` |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |
 | `MEMGRES_REQUIRE_PARENT` | `false` | `true` = a node's parent path must already exist |
 | `MEMGRES_HISTORY` | `true` | keep the hash-chained diff history (deleted with the record) |

{memgres-0.11.0 → memgres-0.12.1}/README.md

@@ -180,6 +180,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
 | `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
+| `MEMGRES_REQUIRED_FIELDS` | — | comma-separated fields a content-storing write must carry (`source`, `reason`), refused by name when absent. A policy about a corpus, not a property of the software: a scratch database wants none, a corporate one wants `source`. `move`/`retag` are exempt. Announced in `server_info.write_requirements` |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |
 | `MEMGRES_REQUIRE_PARENT` | `false` | `true` = a node's parent path must already exist |
 | `MEMGRES_HISTORY` | `true` | keep the hash-chained diff history (deleted with the record) |

{memgres-0.11.0 → memgres-0.12.1}/memgres/__init__.py

@@ -23,7 +23,7 @@ from .schema import migrate, SchemaMismatch, SCHEMA_VERSION
 from .search import Hit, recall
 from .blame import annotate, annotate_grouped, reconstruct, replay
 from .store import (Store, Memory, Conflict, NotFound, TooLarge, NoParent,
-                    MissingTitle)
+                    MissingTitle, MissingField)
 from .identity import (
     Principal, AuthError, SpaceNotFound,
     resolve, resolve_space, new_token, valid_format,
@@ -38,6 +38,7 @@ __all__ = [
     "Config", "load_config",
     "Store", "Memory", "Conflict", "NotFound", "TooLarge", "NoParent",
     "MissingTitle",
+    "MissingField",
     "make_diff", "apply_diff", "content_hash", "DiffConflict",
     "Embedder", "get_embedder",
     "migrate", "SchemaMismatch", "SCHEMA_VERSION",

{memgres-0.11.0 → memgres-0.12.1}/memgres/_version.py

@@ -8,4 +8,4 @@ here at release; nowhere else carries the number.
 PEP 440: a ``.devN`` suffix marks an unreleased build ahead of the last tag.
 """
 
-__version__ = "0.11.0"
+__version__ = "0.12.1"

{memgres-0.11.0 → memgres-0.12.1}/memgres/config.py

@@ -79,6 +79,8 @@ class Config:
     # organization
     tree_enabled: bool           # ltree path column + GiST index for fast subtree selection
     require_title: bool          # True = a write that stores CONTENT must caption it
+    required_fields: tuple       # extra fields a content-storing write must carry
+                                 # (MEMGRES_REQUIRED_FIELDS=source), refused when absent
     require_parent: bool         # False = sparse paths (create food.apple with no food row);
                                  # True = a node's parent path must already exist as a memory
     # history
@@ -222,6 +224,10 @@ def load() -> Config:
         token_sink=_str("MEMGRES_TOKEN_SINK", ""),
         tree_enabled=_bool("MEMGRES_TREE", True),
         require_title=_bool("MEMGRES_REQUIRE_TITLE", True),
+        required_fields=tuple(
+            f for f in (x.strip().lower()
+                        for x in _str("MEMGRES_REQUIRED_FIELDS", "").split(","))
+            if f),
         require_parent=_bool("MEMGRES_REQUIRE_PARENT", False),
         history_enabled=_bool("MEMGRES_HISTORY", True),
         fts_language=_str("MEMGRES_FTS_LANGUAGE", "simple"),

{memgres-0.11.0 → memgres-0.12.1}/memgres/info.py

@@ -65,6 +65,14 @@ def server_info(cfg: Config, embed_dim: Optional[int] = None) -> dict:
             "renew_on_read": bool(days > 0 and cfg.renew_on_read),
             "policy": _retention_policy(days, cfg.renew_on_read),
         },
+        # What a write MUST carry here. Announced rather than discovered from a
+        # refusal: a client that learns the rule by being rejected has already
+        # composed the memory, and a rule nobody can see before writing is a rule
+        # that gets satisfied with junk on the second attempt.
+        "write_requirements": {
+            "title": cfg.require_title,
+            "fields": list(cfg.required_fields),
+        },
         "recall_modes": ["lexical"] if lexical_only
         else ["lexical", "semantic", "hybrid", "auto"],
         "vector_backend": cfg.vector_backend,

{memgres-0.11.0 → memgres-0.12.1}/memgres/links.py

@@ -52,10 +52,11 @@ from typing import Dict, List, Optional
 # edges so they are visible, never resolved — we do not own the address space.
 KNOWN_SCHEMES = ("idea", "file")
 
-# An ltree path: labels of [A-Za-z0-9_] joined by dots. Deliberately strict —
-# this is what tells a path apart from a slug belonging to another store, and
-# from prose that happens to sit in double brackets.
-_PATH = re.compile(r"^[A-Za-z0-9_]+(\.[A-Za-z0-9_]+)*$")
+# What a path is lives in `paths.py`, so the parser and the store cannot drift
+# apart again — that drift is exactly what dropped every hyphenated link before
+# 0.12.0. Kept under the old name because the rest of this module reads better
+# with it.
+from .paths import PATH_RE as _PATH
 
 _LINK = re.compile(r"\[\[([^\[\]\n]+)\]\]")
 _FENCE = re.compile(r"```.*?```|~~~.*?~~~", re.S)
@@ -82,8 +83,58 @@ class Link:
     end: int = 0
 
 
+def _blank_indented(original: str, text: str) -> str:
+    """Blank markdown's OTHER code block: a run of lines indented by four spaces
+    (or a tab), opened by a blank line.
+
+    Fences are not the only way to show code, and the indented form is what a
+    hand-written example tends to use. A frp config pasted that way put
+    ``[[proxies]]`` — a TOML array-of-tables header, and a perfectly well-formed
+    path — into the link graph as a dangling edge to a memory nobody will ever
+    write. The parser must ignore code wherever markdown says code is.
+
+    A blank line inside the block does not end it; the first non-blank line back
+    at the margin does. Opening on a blank line is what keeps an ordinary list
+    item or a wrapped line — indented, but not preceded by a blank — from being
+    read as code.
+
+    🔴 Which lines are code is decided from `original`, and the blanking applied
+    to `text` — the copy where spans and fences are already spaces. Deciding from
+    the blanked copy instead made every line that STARTED with an inline code
+    span look indented: "`[[a]]` but [[b]] counts" became four-plus leading
+    spaces, the whole line was swallowed as a block, and a real link next to a
+    code span disappeared. Both strings are length-preserving, so their lines
+    correspond one to one.
+    """
+    def blank(line: str) -> str:
+        return "".join(" " if c != "\n" else "\n" for c in line)
+
+    src = original.splitlines(keepends=True)
+    dst = text.splitlines(keepends=True)
+    out, in_block, prev_blank = [], False, True
+    for i, line in enumerate(src):
+        stripped = line.strip("\n")
+        is_blank = not stripped.strip()
+        indented = stripped.startswith("    ") or stripped.startswith("\t")
+        current = dst[i] if i < len(dst) else line
+        if in_block:
+            if is_blank or indented:
+                out.append(current if is_blank else blank(current))
+            else:
+                in_block = False
+                out.append(current)
+        elif indented and prev_blank:
+            in_block = True
+            out.append(blank(current))
+        else:
+            out.append(current)
+        prev_blank = is_blank
+    return "".join(out)
+
+
 def _blank_code(body: str) -> str:
-    """Replace code spans and fenced blocks with spaces of the same length.
+    """Replace code spans and code blocks — fenced AND indented — with spaces of
+    the same length.
 
     Same length, not removal, so every offset in the returned text still lines up
     with the original — the parser does not need that today, but an anchor
@@ -92,7 +143,7 @@ def _blank_code(body: str) -> str:
     """
     def blank(m: re.Match) -> str:
         return "".join(" " if c != "\n" else "\n" for c in m.group(0))
-    return _CODE_SPAN.sub(blank, _FENCE.sub(blank, body))
+    return _blank_indented(body, _CODE_SPAN.sub(blank, _FENCE.sub(blank, body)))
 
 
 def _classify(target: str) -> Optional[str]:

{memgres-0.11.0 → memgres-0.12.1}/memgres/mcp_server.py

@@ -32,8 +32,10 @@ from typing_extensions import Annotated
 
 try:  # mcp SDK >= 2.0 renamed the module fastmcp -> mcpserver
     from mcp.server.mcpserver import Context
+    from mcp.server.mcpserver.exceptions import ToolError
 except ImportError:  # mcp SDK 1.x
     from mcp.server.fastmcp import Context
+    from mcp.server.fastmcp.exceptions import ToolError
 
 from . import admin, identity
 from .config import Config, load
@@ -269,6 +271,40 @@ def _mcp(name: str, instructions: Optional[str] = None):
     return server
 
 
+# Refusals whose text is written FOR the caller and safe to show them: what is
+# missing, which namespace to name, why the diff did not apply, what they may
+# not do. Everything else — a psycopg error, a bug — stays masked, because those
+# messages carry schema and internals rather than instructions.
+_SPEAKABLE = (ValueError, PermissionError, LookupError)
+
+
+def _speaking(fn):
+    """Re-raise a domain refusal as the SDK's own error type, which is the only
+    kind whose message reaches the client.
+
+    Everything else the SDK catches becomes `Error executing tool <name>` with no
+    detail — and that is what the caller sees. The refusals here are written to
+    be read: "this deployment requires `source` … as an ADDRESS", "you can reach
+    2 namespaces, name the one you mean". Masking them turns a fixable mistake
+    into a mystery, and an agent that cannot see the reason repeats the same call
+    — which is exactly what happened: five identical edits in a row, then the
+    same on reads, against a server that was explaining itself into the void.
+    """
+    import functools
+
+    @functools.wraps(fn)
+    def wrapper(*args, **kwargs):
+        try:
+            return fn(*args, **kwargs)
+        except ToolError:
+            raise
+        except _SPEAKABLE as e:
+            # `from e` keeps the original in the server log, where the traceback
+            # belongs; the client gets the sentence, not the stack.
+            raise ToolError(str(e)) from e
+    return wrapper
+
+
 def _mem(m) -> dict:
     return m.to_dict(stringify_dates=True)      # MCP layer needs plain strings
 
@@ -292,6 +328,12 @@ def build_server(cfg: Optional[Config] = None):
     _worker, cfg, backend = wire_server(cfg, embedder)
     mcp = _mcp("memgres", instructions=_instruction_text())
 
+    def tool(*d_args, **d_kwargs):
+        """`mcp.tool()`, but the refusal text survives the trip to the client."""
+        def deco(fn):
+            return mcp.tool(*d_args, **d_kwargs)(_speaking(fn))
+        return deco
+
     import os as _os
 
     # The control-plane tools. `auto` registers them wherever there are
@@ -389,7 +431,7 @@ def build_server(cfg: Optional[Config] = None):
         """
         return identity.resolve(conn, cfg, token)
 
-    @mcp.tool()
+    @tool()
     def memory_write(body: Optional[str] = None, id: Optional[str] = None,
                      at: Optional[str] = None,
                      if_moved: IfMovedArg = "error",
@@ -445,7 +487,7 @@ def build_server(cfg: Optional[Config] = None):
                 reason=reason, valid_at=valid_at, space=space,
                 space_id=space_id))
 
-    @mcp.tool()
+    @tool()
     def memory_get(id: Optional[str] = None, at: Optional[str] = None,
                    if_moved: Literal["follow", "error"] = "follow",
                    lines: Optional[str] = None,
@@ -471,7 +513,7 @@ def build_server(cfg: Optional[Config] = None):
                                          if_moved=if_moved, lines=lines,
                                          space=space, space_id=space_id))
 
-    @mcp.tool()
+    @tool()
     def memory_recall(query: str, k: int = 10,
                       mode: Literal["lexical", "semantic", "hybrid", "auto"] = "auto",
                       match: Optional[Literal["any", "all"]] = None,
@@ -515,7 +557,7 @@ def build_server(cfg: Optional[Config] = None):
                         snippet=snippet, full_body=full_body, bodies=bodies,
                         match_tags=match_tags, space=space, space_id=space_id)]
 
-    @mcp.tool()
+    @tool()
     def memory_list(path_prefix: Optional[str] = None,
                     tags: Optional[List[str]] = None, limit: int = 50,
                     offset: int = 0, bodies: bool = False,
@@ -543,7 +585,7 @@ def build_server(cfg: Optional[Config] = None):
                 limit=limit, offset=offset, bodies=bodies,
                 match_tags=match_tags, space=space, space_id=space_id)
 
-    @mcp.tool()
+    @tool()
     def memory_tags(prefix: Optional[str] = None, k: int = 50,
                     space: Spaces = None, space_id: Spaces = None,
                     ctx: Context = None) -> List[dict]:
@@ -558,7 +600,7 @@ def build_server(cfg: Optional[Config] = None):
             return _store(conn).tags(_token(ctx), prefix=prefix, k=k,
                                      space=space, space_id=space_id)
 
-    @mcp.tool()
+    @tool()
     def memory_links(id: Optional[str] = None, at: Optional[str] = None,
                      direction: Literal["in", "out", "both"] = "both",
                      space: Optional[str] = None, space_id: Optional[str] = None,
@@ -579,7 +621,7 @@ def build_server(cfg: Optional[Config] = None):
                                       at=at or None, direction=direction,
                                       space=space, space_id=space_id)
 
-    @mcp.tool()
+    @tool()
     def memory_server_info(ctx: Context = None) -> dict:
         """The server's version + schema_version and its effective limits and
         capabilities (write ceilings, embed provider/model/dim, available recall
@@ -589,7 +631,7 @@ def build_server(cfg: Optional[Config] = None):
         dim = embedder.dim if embedder is not None else None
         return server_info(cfg, embed_dim=dim)
 
-    @mcp.tool()
+    @tool()
     def memory_blame(id: Optional[str] = None, at: Optional[str] = None,
                      grouped: bool = True, lines: Optional[str] = None,
                      space: Optional[str] = None, space_id: Optional[str] = None,
@@ -609,7 +651,7 @@ def build_server(cfg: Optional[Config] = None):
             return s.annotate(tok, id, lines=want, at=at, space=space,
                               space_id=space_id)
 
-    @mcp.tool()
+    @tool()
     def memory_history(id: Optional[str] = None, at: Optional[str] = None,
                        space: Optional[str] = None,
                        space_id: Optional[str] = None,
@@ -622,7 +664,7 @@ def build_server(cfg: Optional[Config] = None):
             return _store(conn).history(_token(ctx), id, at=at,
                                         space=space, space_id=space_id)
 
-    @mcp.tool()
+    @tool()
     def memory_move(new_path: str, id: Optional[str] = None,
                     at: Optional[str] = None,
                     if_moved: Literal["error", "follow"] = "error",
@@ -638,7 +680,7 @@ def build_server(cfg: Optional[Config] = None):
                                           reason=reason, space=space,
                                           space_id=space_id))
 
-    @mcp.tool()
+    @tool()
     def memory_forget(id: Optional[str] = None, at: Optional[str] = None,
                       space: Optional[str] = None,
                       space_id: Optional[str] = None,
@@ -652,7 +694,7 @@ def build_server(cfg: Optional[Config] = None):
                 _token(ctx), id, at=at, space=space, space_id=space_id)}
 
     # ─── identity: spaces & tokens (open/managed modes) ─────────────────────
-    @mcp.tool()
+    @tool()
     def memory_list_spaces(ctx: Context = None) -> List[dict]:
         """List the namespaces you can reach — your own plus any shared with you —
         with each one's id, name, description, permission, and your `alias` for it
@@ -661,7 +703,7 @@ def build_server(cfg: Optional[Config] = None):
         with pool.connection() as conn, conn.transaction():
             return identity.list_spaces(conn, _uid(conn, _token(ctx)))
 
-    @mcp.tool()
+    @tool()
     def memory_create_space(name: str, description: str = "",
                             instruction: str = "",
                             ctx: Context = None) -> dict:
@@ -675,7 +717,7 @@ def build_server(cfg: Optional[Config] = None):
                 description=description, instruction=instruction)
         return {"id": nsid, "name": name}
 
-    @mcp.tool()
+    @tool()
     def memory_set_alias(alias: str, space_id: str,
                          ctx: Context = None) -> dict:
         """Give a namespace a name of your own, for when a bare name is ambiguous
@@ -688,7 +730,7 @@ def build_server(cfg: Optional[Config] = None):
             identity.create_alias(conn, uid, alias, space_id)
         return {"alias": alias, "space_id": space_id}
 
-    @mcp.tool()
+    @tool()
     def memory_drop_alias(alias: str,
                           ctx: Context = None) -> dict:
         """Remove one of your namespace aliases. The namespace itself is
@@ -698,7 +740,7 @@ def build_server(cfg: Optional[Config] = None):
             return {"dropped": identity.drop_alias(conn, uid, alias)}
 
     if cfg.key_mode == "managed":
-        @mcp.tool()
+        @tool()
         def memory_enroll(key: EnrollKeyArg, ctx: Context = None) -> dict:
             """Claim an account with a one-time enrollment key.
 
@@ -734,7 +776,7 @@ def build_server(cfg: Optional[Config] = None):
                            "tools you can now use are not showing yet.")
             return out
 
-    @mcp.tool()
+    @tool()
     def memory_issue_token(permission: str = "write", space: Optional[str] = None,
                            space_id: Optional[str] = None, label: str = "",
                            expires_days: Optional[int] = None,
@@ -789,7 +831,7 @@ def build_server(cfg: Optional[Config] = None):
         out.update({"permission": permission, "namespace_id": nsid})
         return out
 
-    @mcp.tool()
+    @tool()
     def memory_request_access(space_id: str, permission: str = "read",
                               ctx: Context = None) -> dict:
         """Ask the owner of a namespace to let you in.
@@ -804,14 +846,14 @@ def build_server(cfg: Optional[Config] = None):
                                         namespace_id=space_id,
                                         permission=permission)
 
-    @mcp.tool()
+    @tool()
     def memory_list_tokens(ctx: Context = None) -> List[dict]:
         """List your tokens (metadata only — never the secret)."""
         with pool.connection() as conn, conn.transaction():
             out = identity.list_tokens(conn, _admin_uid(conn, _token(ctx)))
         return _iso(out, *_TOKEN_TIMES)
 
-    @mcp.tool()
+    @tool()
     def memory_revoke_token(token_id: str,
                             ctx: Context = None) -> dict:
         """Revoke one of your tokens by id (kills it immediately)."""
@@ -822,7 +864,7 @@ def build_server(cfg: Optional[Config] = None):
                 raise identity.AuthError("not your token")
             return {"revoked": identity.revoke_token(conn, token_id)}
 
-    @mcp.tool()
+    @tool()
     def memory_whoami(ctx: Context = None) -> dict:
         """Who you are and what you may do: user id, service role, this
         credential's permission ceiling and namespace scope, plus the
@@ -834,7 +876,7 @@ def build_server(cfg: Optional[Config] = None):
     # ─── control plane: provisioning (authorized in `admin`, not here) ───────
     if admin_surface:
 
-        @mcp.tool()
+        @tool()
         def memory_admin_list_users(role: Optional[str] = None, limit: int = 50,
                                     offset: int = 0,
                                     ctx: Context = None) -> List[dict]:
@@ -846,7 +888,7 @@ def build_server(cfg: Optional[Config] = None):
                                        role=role, limit=limit, offset=offset)
             return _iso(out, "created_at")
 
-        @mcp.tool()
+        @tool()
         def memory_admin_create_user(name: str = "", description: str = "",
                                      role: str = "user",
                                      can_create_namespace: bool = False,
@@ -872,7 +914,7 @@ def build_server(cfg: Optional[Config] = None):
                                         department=department, position=position)
             return {"id": uid}
 
-        @mcp.tool()
+        @tool()
         def memory_admin_edit_user(user_id: str,
                                    name: Optional[str] = None,
                                    description: Optional[str] = None,
@@ -891,7 +933,7 @@ def build_server(cfg: Optional[Config] = None):
                     conn, _principal(conn, _token(ctx)), user_id=user_id,
                     **{k: v for k, v in fields.items() if v is not None})
 
-        @mcp.tool()
+        @tool()
         def memory_admin_set_can_create_namespace(user_id: str, allowed: bool,
                                                   ctx: Context = None) -> dict:
             """Grant or withdraw a user's right to create namespaces. Without it
@@ -902,7 +944,7 @@ def build_server(cfg: Optional[Config] = None):
                     conn, _principal(conn, _token(ctx)),
                     user_id=user_id, allowed=allowed)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_set_role(user_id: str, role: str,
                                   ctx: Context = None) -> dict:
             """Set a user's service role (user | user_manager | superadmin).
@@ -912,7 +954,7 @@ def build_server(cfg: Optional[Config] = None):
                 return admin.set_role(conn, _principal(conn, _token(ctx)),
                                       user_id=user_id, role=role)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_list_namespaces(owner_user_id: Optional[str] = None,
                                          limit: int = 50, offset: int = 0,
                                          ctx: Context = None) -> List[dict]:
@@ -925,7 +967,7 @@ def build_server(cfg: Optional[Config] = None):
                     owner_user_id=owner_user_id, limit=limit, offset=offset)
             return _iso(out, "created_at")
 
-        @mcp.tool()
+        @tool()
         def memory_admin_create_namespace(name: str, owner_user_id: str,
                                           description: str = "",
                                           instruction: str = "",
@@ -940,7 +982,7 @@ def build_server(cfg: Optional[Config] = None):
                     description=description, instruction=instruction)
             return {"id": nsid}
 
-        @mcp.tool()
+        @tool()
         def memory_admin_edit_namespace(space_id: str,
                                         description: Optional[str] = None,
                                         instruction: Optional[str] = None,
@@ -959,7 +1001,7 @@ def build_server(cfg: Optional[Config] = None):
                     namespace_id=space_id, description=description,
                     instruction=instruction, name=name)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_count_orphans(ctx: Context = None) -> dict:
             """How many memories are stranded in the pre-identity namespace.
             `single` mode stores everything under one nameless namespace; after a
@@ -969,7 +1011,7 @@ def build_server(cfg: Optional[Config] = None):
             with pool.connection() as conn:
                 return admin.count_orphans(conn, _principal(conn, _token(ctx)))
 
-        @mcp.tool()
+        @tool()
         def memory_admin_adopt_orphans(space_id: str,
                                        ctx: Context = None) -> dict:
             """Move every stranded `single`-mode memory into a real namespace.
@@ -981,7 +1023,7 @@ def build_server(cfg: Optional[Config] = None):
                     conn, _principal(conn, _token(ctx)),
                     namespace_id=space_id, vectors=backend)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_add_member(space_id: str, user_id: str,
                                     permission: str = "read",
                                     ctx: Context = None) -> dict:
@@ -994,7 +1036,7 @@ def build_server(cfg: Optional[Config] = None):
                                         namespace_id=space_id, user_id=user_id,
                                         permission=permission)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_remove_member(space_id: str, user_id: str,
                                        ctx: Context = None) -> dict:
             """Take a shared namespace away again. `removed: false` means they
@@ -1009,7 +1051,7 @@ def build_server(cfg: Optional[Config] = None):
                 return admin.remove_member(conn, _principal(conn, _token(ctx)),
                                            namespace_id=space_id, user_id=user_id)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_transfer_namespace(
                 space_id: str, new_owner_user_id: str,
                 keep_previous_owner: Optional[str] = "admin",
@@ -1028,7 +1070,7 @@ def build_server(cfg: Optional[Config] = None):
                     new_owner_user_id=new_owner_user_id,
                     keep_previous_owner=keep_previous_owner)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_list_requests(space_id: str,
                                        ctx: Context = None) -> List[dict]:
             """Pending requests to join a namespace you administer — who asked,
@@ -1038,7 +1080,7 @@ def build_server(cfg: Optional[Config] = None):
                                           namespace_id=space_id)
             return _iso(out, "created_at")
 
-        @mcp.tool()
+        @tool()
         def memory_admin_decide_access(request_id: str, approve: bool = True,
                                        expect_permission: Optional[str] = None,
                                        ctx: Context = None) -> dict:
@@ -1056,7 +1098,7 @@ def build_server(cfg: Optional[Config] = None):
                                     expect_permission=expect_permission)
             return {"request_id": request_id, "approved": approve}
 
-        @mcp.tool()
+        @tool()
         def memory_admin_set_disabled(user_id: str, disabled: bool = True,
                                       ctx: Context = None) -> dict:
             """Switch an account off, or back on.
@@ -1070,7 +1112,7 @@ def build_server(cfg: Optional[Config] = None):
                 return admin.set_disabled(conn, _principal(conn, _token(ctx)),
                                           user_id=user_id, disabled=disabled)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_list_members(space_id: str,
                                       ctx: Context = None) -> List[dict]:
             """Who can reach a namespace — the owner first, then everyone shared
@@ -1080,7 +1122,7 @@ def build_server(cfg: Optional[Config] = None):
                                          namespace_id=space_id)
             return _iso(out, "created_at")
 
-        @mcp.tool()
+        @tool()
         def memory_admin_issue_token(user_id: str, permission: str = "write",
                                      space_id: Optional[str] = None,
                                      label: str = "",
@@ -1112,7 +1154,7 @@ def build_server(cfg: Optional[Config] = None):
                 out["warning"] = minted["warning"]
             return out
 
-        @mcp.tool()
+        @tool()
         def memory_admin_create_enrollment(
                 user_id: str, permission: str = "write",
                 space_id: Optional[str] = None, label: str = "",
@@ -1146,7 +1188,7 @@ def build_server(cfg: Optional[Config] = None):
             out["expires_at"] = out["expires_at"].isoformat()
             return admin.deliver_key(out, cfg.token_sink)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_list_enrollments(user_id: Optional[str] = None,
                                           ctx: Context = None) -> List[dict]:
             """Enrollment keys and what became of them — `state` is pending,
@@ -1158,7 +1200,7 @@ def build_server(cfg: Optional[Config] = None):
                                              user_id=user_id)
             return _iso(out, "created_at", "expires_at", "used_at", "revoked_at")
 
-        @mcp.tool()
+        @tool()
         def memory_admin_revoke_enrollment(enrollment_id: str,
                                            ctx: Context = None) -> dict:
             """Kill an unredeemed enrollment key. False means it was already
@@ -1169,7 +1211,7 @@ def build_server(cfg: Optional[Config] = None):
                     conn, _principal(conn, _token(ctx)),
                     enrollment_id=enrollment_id)}
 
-        @mcp.tool()
+        @tool()
         def memory_admin_list_tokens(user_id: str,
                                      ctx: Context = None) -> List[dict]:
             """A user's tokens — metadata only, never the secret."""
@@ -1178,7 +1220,7 @@ def build_server(cfg: Optional[Config] = None):
                                         user_id=user_id)
             return _iso(out, *_TOKEN_TIMES)
 
-        @mcp.tool()
+        @tool()
         def memory_admin_revoke_token(token_id: str,
                                       ctx: Context = None) -> dict:
             """Kill any user's token immediately. False means it was already

memgres-0.12.1/memgres/migrations/0023_relink_after_parser_fix.sql

@@ -0,0 +1,16 @@
+-- Re-derive the link graph, because the PARSER changed, not the schema.
+--
+-- Until now `_PATH` rejected the hyphen, so every `[[infra.servers.video-production]]`
+-- was classified as prose and dropped — not stored as a dangling edge, dropped —
+-- while `[[proxies]]` from a TOML example indented as code was stored as a real
+-- one. Both halves are fixed in `links.py`; neither fix reaches a body that is
+-- already written, since edges are derived on write.
+--
+-- Clearing the flag makes the existing one-time backfill (`relink.rebuild`, run
+-- at startup by `maybe_backfill`) do the pass again over every body. It rewrites
+-- only the edge table: bodies, history and the hash chain are untouched, so this
+-- is repeatable and costs nothing but a scan.
+--
+-- Additive by nature — an older client reading this database is no worse off
+-- than it was, so the compatibility floor does not move.
+UPDATE memgres_meta SET links_built = false;