remdb 0.3.157__py3-none-any.whl → 0.3.171__py3-none-any.whl

rem/agentic/agents/agent_manager.py

@@ -128,8 +128,9 @@ async def save_agent(
     )
 
     # Create Schema entity (user-scoped)
+    # Note: tenant_id defaults to "default" for anonymous users
     schema_entity = Schema(
-        tenant_id=user_id,
+        tenant_id=user_id or "default",
         user_id=user_id,
         name=name,
         spec=spec,

rem/agentic/context.py

@@ -2,11 +2,15 @@
 Agent execution context and configuration.
 
 Design pattern for session context that can be constructed from:
+- FastAPI Request object (preferred - extracts user from JWT via request.state)
 - HTTP headers (X-User-Id, X-Session-Id, X-Model-Name, X-Is-Eval, etc.)
 - Direct instantiation for testing/CLI
 
+User ID Sources (in priority order):
+1. request.state.user.id - From JWT token validated by auth middleware (SECURE)
+2. X-User-Id header - Fallback for backwards compatibility (less secure)
+
 Headers Mapping:
-    X-User-Id        → context.user_id
     X-Tenant-Id      → context.tenant_id (default: "default")
     X-Session-Id     → context.session_id
     X-Agent-Schema   → context.agent_schema_uri (default: "rem")
@@ -128,13 +132,87 @@ class AgentContext(BaseModel):
         logger.debug(f"No user_id from {source}, using None (anonymous/shared data)")
         return None
 
+    @classmethod
+    def from_request(cls, request: "Request") -> "AgentContext":
+        """
+        Construct AgentContext from a FastAPI Request object.
+
+        This is the PREFERRED method for API endpoints. It extracts user_id
+        from the authenticated user in request.state (set by auth middleware
+        from JWT token), which is more secure than trusting X-User-Id header.
+
+        Priority for user_id:
+        1. request.state.user.id - From validated JWT token (SECURE)
+        2. X-User-Id header - Fallback for backwards compatibility
+
+        Args:
+            request: FastAPI Request object
+
+        Returns:
+            AgentContext with user from JWT and other values from headers
+
+        Example:
+            @app.post("/api/v1/chat/completions")
+            async def chat(request: Request, body: ChatRequest):
+                context = AgentContext.from_request(request)
+                # context.user_id is from JWT, not header
+        """
+        from typing import TYPE_CHECKING
+        if TYPE_CHECKING:
+            from starlette.requests import Request
+
+        # Get headers dict
+        headers = dict(request.headers)
+        normalized = {k.lower(): v for k, v in headers.items()}
+
+        # Extract user_id from authenticated user (JWT) - this is the source of truth
+        user_id = None
+        tenant_id = "default"
+
+        if hasattr(request, "state"):
+            user = getattr(request.state, "user", None)
+            if user and isinstance(user, dict):
+                user_id = user.get("id")
+                # Also get tenant_id from authenticated user if available
+                if user.get("tenant_id"):
+                    tenant_id = user.get("tenant_id")
+                if user_id:
+                    logger.debug(f"User ID from JWT: {user_id}")
+
+        # Fallback to X-User-Id header if no authenticated user
+        if not user_id:
+            user_id = normalized.get("x-user-id")
+            if user_id:
+                logger.debug(f"User ID from X-User-Id header (fallback): {user_id}")
+
+        # Override tenant_id from header if provided
+        header_tenant = normalized.get("x-tenant-id")
+        if header_tenant:
+            tenant_id = header_tenant
+
+        # Parse X-Is-Eval header
+        is_eval_str = normalized.get("x-is-eval", "").lower()
+        is_eval = is_eval_str in ("true", "1", "yes")
+
+        return cls(
+            user_id=user_id,
+            tenant_id=tenant_id,
+            session_id=normalized.get("x-session-id"),
+            default_model=normalized.get("x-model-name") or settings.llm.default_model,
+            agent_schema_uri=normalized.get("x-agent-schema"),
+            is_eval=is_eval,
+        )
+
     @classmethod
     def from_headers(cls, headers: dict[str, str]) -> "AgentContext":
         """
-        Construct AgentContext from HTTP headers.
+        Construct AgentContext from HTTP headers dict.
+
+        NOTE: Prefer from_request() for API endpoints as it extracts user_id
+        from the validated JWT token in request.state, which is more secure.
 
         Reads standard headers:
-        - X-User-Id: User identifier
+        - X-User-Id: User identifier (fallback - prefer JWT)
         - X-Tenant-Id: Tenant identifier
         - X-Session-Id: Session identifier
         - X-Model-Name: Model override

rem/agentic/context_builder.py

@@ -12,7 +12,7 @@ User Context (on-demand by default):
 - System message includes REM LOOKUP hint for user profile
 - Agent decides whether to load profile based on query
 - More efficient for queries that don't need personalization
-- Example: "User ID: sarah@example.com. To load user profile: Use REM LOOKUP users/sarah@example.com"
+- Example: "User: sarah@example.com. To load user profile: Use REM LOOKUP \"sarah@example.com\""
 
 User Context (auto-inject when enabled):
 - Set CHAT__AUTO_INJECT_USER_CONTEXT=true
@@ -40,7 +40,7 @@ Usage (on-demand, default):
 
     # Messages list structure (on-demand):
     # [
-    #   {"role": "system", "content": "Today's date: 2025-11-22\nUser ID: sarah@example.com\nTo load user profile: Use REM LOOKUP users/sarah@example.com\nSession ID: sess-123\nTo load session history: Use REM LOOKUP messages?session_id=sess-123"},
+    #   {"role": "system", "content": "Today's date: 2025-11-22\nUser: sarah@example.com\nTo load user profile: Use REM LOOKUP \"sarah@example.com\"\nSession ID: sess-123\nTo load session history: Use REM LOOKUP messages?session_id=sess-123"},
     #   {"role": "user", "content": "What's next for the API migration?"}
     # ]
 
@@ -103,6 +103,7 @@ class ContextBuilder:
         headers: dict[str, str],
         new_messages: list[dict[str, str]] | None = None,
         db: PostgresService | None = None,
+        user_id: str | None = None,
     ) -> tuple[AgentContext, list[ContextMessage]]:
         """
         Build complete context from HTTP headers.
@@ -114,7 +115,7 @@ class ContextBuilder:
         - Agent can retrieve full content on-demand using REM LOOKUP
 
         User Context (on-demand by default):
-        - System message includes REM LOOKUP hint: "User ID: {user_id}. To load user profile: Use REM LOOKUP users/{user_id}"
+        - System message includes REM LOOKUP hint: "User: {email}. To load user profile: Use REM LOOKUP \"{email}\""
         - Agent decides whether to load profile based on query
 
         User Context (auto-inject when enabled):
@@ -125,6 +126,7 @@ class ContextBuilder:
             headers: HTTP request headers (case-insensitive)
             new_messages: New messages from current request
             db: Optional PostgresService (creates if None)
+            user_id: Override user_id from JWT token (takes precedence over X-User-Id header)
 
         Returns:
             Tuple of (AgentContext, messages list)
@@ -135,7 +137,7 @@ class ContextBuilder:
 
             # messages structure:
             # [
-            #   {"role": "system", "content": "Today's date: 2025-11-22\nUser ID: sarah@example.com\nTo load user profile: Use REM LOOKUP users/sarah@example.com"},
+            #   {"role": "system", "content": "Today's date: 2025-11-22\nUser: sarah@example.com\nTo load user profile: Use REM LOOKUP \"sarah@example.com\""},
             #   {"role": "user", "content": "Previous message"},
             #   {"role": "assistant", "content": "Start of long response... [REM LOOKUP session-123-msg-1] ...end"},
             #   {"role": "user", "content": "New message"}
@@ -147,6 +149,17 @@ class ContextBuilder:
         # Extract AgentContext from headers
         context = AgentContext.from_headers(headers)
 
+        # Override user_id if provided (from JWT token - takes precedence over header)
+        if user_id is not None:
+            context = AgentContext(
+                user_id=user_id,
+                tenant_id=context.tenant_id,
+                session_id=context.session_id,
+                default_model=context.default_model,
+                agent_schema_uri=context.agent_schema_uri,
+                is_eval=context.is_eval,
+            )
+
         # Initialize DB if not provided and needed (for user context or session history)
         close_db = False
         if db is None and (settings.chat.auto_inject_user_context or context.session_id):
@@ -178,8 +191,16 @@ class ContextBuilder:
                     context_hint += "\n\nNo user context available (anonymous or new user)."
             elif context.user_id:
                 # On-demand: Provide hint to use REM LOOKUP
-                context_hint += f"\n\nUser ID: {context.user_id}"
-                context_hint += f"\nTo load user profile: Use REM LOOKUP users/{context.user_id}"
+                # user_id is UUID5 hash of email - load user to get email for display and LOOKUP
+                user_repo = Repository(User, "users", db=db)
+                user = await user_repo.get_by_id(context.user_id, context.tenant_id)
+                if user and user.email:
+                    # Show email (more useful than UUID) and LOOKUP hint
+                    context_hint += f"\n\nUser: {user.email}"
+                    context_hint += f"\nTo load user profile: Use REM LOOKUP \"{user.email}\""
+                else:
+                    context_hint += f"\n\nUser ID: {context.user_id}"
+                    context_hint += "\nUser profile not available."
 
             # Add system context hint
             messages.append(ContextMessage(role="system", content=context_hint))
@@ -226,6 +247,9 @@ class ContextBuilder:
         """
         Load user profile from database and format as context.
 
+        user_id is always a UUID5 hash of email (bijection).
+        Looks up user by their id field in the database.
+
         Returns formatted string with:
         - User summary (generated by dreaming worker)
         - Current projects
@@ -239,6 +263,7 @@ class ContextBuilder:
 
         try:
             user_repo = Repository(User, "users", db=db)
+            # user_id is UUID5 hash of email - look up by database id
             user = await user_repo.get_by_id(user_id, tenant_id)
 
             if not user:

rem/agentic/mcp/tool_wrapper.py

@@ -149,6 +149,12 @@ def create_resource_tool(uri: str, usage: str = "", mcp_server: Any = None) -> T
     parts = re.sub(r'_+', '_', parts).strip('_')  # Clean up multiple underscores
     func_name = f"get_{parts}"
 
+    # For parameterized URIs, append _by_{params} to avoid naming conflicts
+    # e.g., rem://agents/{name} -> get_rem_agents_by_name (distinct from get_rem_agents)
+    if template_vars:
+        param_suffix = "_by_" + "_".join(template_vars)
+        func_name = f"{func_name}{param_suffix}"
+
     # Build description including parameter info
     description = usage or f"Fetch {uri} resource"
     if template_vars:

rem/agentic/providers/pydantic_ai.py

@@ -550,10 +550,18 @@ async def create_agent(
     # Extract schema fields using typed helpers
     from ..schema import get_system_prompt, get_metadata
 
+    # Track whether mcp_servers was explicitly configured (even if empty)
+    mcp_servers_explicitly_set = False
+
     if agent_schema:
         system_prompt = get_system_prompt(agent_schema)
         metadata = get_metadata(agent_schema)
-        mcp_server_configs = [s.model_dump() for s in metadata.mcp_servers] if hasattr(metadata, 'mcp_servers') and metadata.mcp_servers else []
+        # Check if mcp_servers was explicitly set (could be empty list to disable)
+        if hasattr(metadata, 'mcp_servers') and metadata.mcp_servers is not None:
+            mcp_server_configs = [s.model_dump() for s in metadata.mcp_servers]
+            mcp_servers_explicitly_set = True
+        else:
+            mcp_server_configs = []
         resource_configs = metadata.resources if hasattr(metadata, 'resources') else []
 
         if metadata.system_prompt:
@@ -566,7 +574,8 @@ async def create_agent(
 
     # Auto-detect local MCP server if not explicitly configured
     # This makes mcp_servers config optional - agents get tools automatically
-    if not mcp_server_configs:
+    # But if mcp_servers: [] is explicitly set, respect that (no auto-detection)
+    if not mcp_server_configs and not mcp_servers_explicitly_set:
         import importlib
         import os
         import sys

rem/api/deps.py

@@ -147,7 +147,6 @@ def is_admin(user: dict | None) -> bool:
 async def get_user_filter(
     request: Request,
     x_user_id: str | None = None,
-    x_tenant_id: str = "default",
 ) -> dict[str, Any]:
     """
     Get user-scoped filter dict for database queries.
@@ -158,7 +157,6 @@ async def get_user_filter(
     Args:
         request: FastAPI request
         x_user_id: Optional user_id filter (admin only for cross-user)
-        x_tenant_id: Tenant ID for multi-tenancy
 
     Returns:
         Filter dict with appropriate user_id constraint
@@ -169,7 +167,7 @@ async def get_user_filter(
             return await repo.find(filters)
     """
     user = get_current_user(request)
-    filters: dict[str, Any] = {"tenant_id": x_tenant_id}
+    filters: dict[str, Any] = {}
 
     if is_admin(user):
         # Admin can filter by any user or see all

rem/api/main.py

@@ -149,19 +149,38 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
         client_host = request.client.host if request.client else "unknown"
         user_agent = request.headers.get('user-agent', 'unknown')[:100]
 
+        # Extract auth info for logging (first 8 chars of token for debugging)
+        auth_header = request.headers.get('authorization', '')
+        auth_preview = ""
+        if auth_header.startswith('Bearer '):
+            token = auth_header[7:]
+            auth_preview = f"Bearer {token[:8]}..." if len(token) > 8 else f"Bearer {token}"
+
         # Process request
         response = await call_next(request)
 
+        # Extract user info set by auth middleware (after processing)
+        user = getattr(request.state, "user", None)
+        user_id = user.get("id", "none")[:12] if user else "anon"
+        user_email = user.get("email", "") if user else ""
+
         # Determine log level based on path AND response status
         duration_ms = (time.time() - start_time) * 1000
         use_debug = self._should_log_at_debug(path, response.status_code)
         log_fn = logger.debug if use_debug else logger.info
 
-        # Log request and response together
+        # Build user info string
+        user_info = f"user={user_id}"
+        if user_email:
+            user_info += f" ({user_email})"
+        if auth_preview:
+            user_info += f" | auth={auth_preview}"
+
+        # Log request and response together with auth info
         log_fn(
             f"→ REQUEST: {request.method} {path} | "
             f"Client: {client_host} | "
-            f"User-Agent: {user_agent}"
+            f"{user_info}"
         )
         log_fn(
             f"← RESPONSE: {request.method} {path} | "

rem/api/mcp_router/tools.py

@@ -116,7 +116,8 @@ def mcp_tool_error_handler(func: Callable) -> Callable:
             # Otherwise wrap in success response
             return {"status": "success", **result}
         except Exception as e:
-            logger.error(f"{func.__name__} failed: {e}", exc_info=True)
+            # Use %s format to avoid issues with curly braces in error messages
+            logger.opt(exception=True).error("{} failed: {}", func.__name__, str(e))
             return {
                 "status": "error",
                 "error": str(e),
@@ -380,9 +381,10 @@ async def ask_rem_agent(
     from ...utils.schema_loader import load_agent_schema
 
     # Create agent context
+    # Note: tenant_id defaults to "default" if user_id is None
     context = AgentContext(
         user_id=user_id,
-        tenant_id=user_id,  # Set tenant_id to user_id for backward compat
+        tenant_id=user_id or "default",  # Use default tenant for anonymous users
         default_model=settings.llm.default_model,
     )
 

rem/api/middleware/tracking.py

@@ -102,14 +102,14 @@ class AnonymousTrackingMiddleware(BaseHTTPMiddleware):
             # Tenant ID from header or default
             tenant_id = request.headers.get("X-Tenant-Id", "default")
 
-        # 4. Rate Limiting
-        if settings.postgres.enabled:
+        # 4. Rate Limiting (skip if disabled via settings)
+        if settings.postgres.enabled and settings.api.rate_limit_enabled:
             is_allowed, current, limit = await self.rate_limiter.check_rate_limit(
                 tenant_id=tenant_id,
                 identifier=identifier,
                 tier=tier
             )
-            
+
             if not is_allowed:
                 return JSONResponse(
                     status_code=429,
@@ -141,8 +141,8 @@ class AnonymousTrackingMiddleware(BaseHTTPMiddleware):
                 secure=settings.environment == "production"
             )
             
-        # Add Rate Limit headers
-        if settings.postgres.enabled and 'limit' in locals():
+        # Add Rate Limit headers (only if rate limiting is enabled)
+        if settings.postgres.enabled and settings.api.rate_limit_enabled and 'limit' in locals():
             response.headers["X-RateLimit-Limit"] = str(limit)
             response.headers["X-RateLimit-Remaining"] = str(max(0, limit - current))
             

rem/api/routers/auth.py

@@ -102,6 +102,8 @@ from ...settings import settings
 from ...services.postgres.service import PostgresService
 from ...services.user_service import UserService
 from ...auth.providers.email import EmailAuthProvider
+from ...auth.jwt import JWTService, get_jwt_service
+from ...utils.user_id import email_to_user_id
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
@@ -219,14 +221,14 @@ async def send_email_code(request: Request, body: EmailSendCodeRequest):
 @router.post("/email/verify")
 async def verify_email_code(request: Request, body: EmailVerifyRequest):
     """
-    Verify login code and create session.
+    Verify login code and create session with JWT tokens.
 
     Args:
         request: FastAPI request
         body: EmailVerifyRequest with email and code
 
     Returns:
-        Success status with user info
+        Success status with user info and JWT tokens
     """
     if not settings.email.is_configured:
         raise HTTPException(
@@ -266,7 +268,25 @@ async def verify_email_code(request: Request, body: EmailVerifyRequest):
             user_id=result.user_id,
         )
 
-        # Store user in session
+        # Fetch actual user data from database to get role/tier
+        user_service = UserService(db)
+        try:
+            user_entity = await user_service.get_user_by_id(result.user_id)
+            if user_entity:
+                # Override defaults with actual database values
+                user_dict["role"] = user_entity.role or "user"
+                user_dict["roles"] = [user_entity.role] if user_entity.role else ["user"]
+                user_dict["tier"] = user_entity.tier.value if user_entity.tier else "free"
+                user_dict["name"] = user_entity.name or user_dict["name"]
+        except Exception as e:
+            logger.warning(f"Could not fetch user details: {e}")
+            # Continue with defaults from get_user_dict
+
+        # Generate JWT tokens
+        jwt_service = get_jwt_service()
+        tokens = jwt_service.create_tokens(user_dict)
+
+        # Store user in session (for backward compatibility)
         request.session["user"] = user_dict
 
         logger.info(f"User authenticated via email: {result.email}")
@@ -275,6 +295,11 @@ async def verify_email_code(request: Request, body: EmailVerifyRequest):
             "success": True,
             "message": result.message,
             "user": user_dict,
+            # JWT tokens for stateless auth
+            "access_token": tokens["access_token"],
+            "refresh_token": tokens["refresh_token"],
+            "token_type": tokens["token_type"],
+            "expires_in": tokens["expires_in"],
         }
 
     except HTTPException:
@@ -405,8 +430,9 @@ async def callback(provider: str, request: Request):
                     await user_service.link_anonymous_session(user_entity, anon_id)
                     
                 # Enrich session user with DB info
+                # user_id = UUID5 hash of email (deterministic, bijection)
                 db_info = {
-                    "id": str(user_entity.id),
+                    "id": email_to_user_id(user_info.get("email")),
                     "tenant_id": user_entity.tenant_id,
                     "tier": user_entity.tier.value if user_entity.tier else "free",
                     "roles": [user_entity.role] if user_entity.role else [],
@@ -472,7 +498,7 @@ async def logout(request: Request):
 @router.get("/me")
 async def me(request: Request):
     """
-    Get current user information from session.
+    Get current user information from session or JWT.
 
     Args:
         request: FastAPI request
@@ -480,6 +506,16 @@ async def me(request: Request):
     Returns:
         User information or 401 if not authenticated
     """
+    # First check for JWT in Authorization header
+    auth_header = request.headers.get("Authorization")
+    if auth_header and auth_header.startswith("Bearer "):
+        token = auth_header[7:]
+        jwt_service = get_jwt_service()
+        user = jwt_service.verify_token(token)
+        if user:
+            return user
+
+    # Fall back to session
     user = request.session.get("user")
     if not user:
         raise HTTPException(status_code=401, detail="Not authenticated")
@@ -487,6 +523,69 @@ async def me(request: Request):
     return user
 
 
+# =============================================================================
+# JWT Token Endpoints
+# =============================================================================
+
+
+class TokenRefreshRequest(BaseModel):
+    """Request to refresh access token."""
+    refresh_token: str
+
+
+@router.post("/token/refresh")
+async def refresh_token(body: TokenRefreshRequest):
+    """
+    Refresh access token using refresh token.
+
+    Args:
+        body: TokenRefreshRequest with refresh_token
+
+    Returns:
+        New access token or 401 if refresh token is invalid
+    """
+    jwt_service = get_jwt_service()
+    result = jwt_service.refresh_access_token(body.refresh_token)
+
+    if not result:
+        raise HTTPException(
+            status_code=401,
+            detail="Invalid or expired refresh token"
+        )
+
+    return result
+
+
+@router.post("/token/verify")
+async def verify_token(request: Request):
+    """
+    Verify an access token is valid.
+
+    Pass the token in the Authorization header: Bearer <token>
+
+    Returns:
+        User info if valid, 401 if invalid
+    """
+    auth_header = request.headers.get("Authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        raise HTTPException(
+            status_code=401,
+            detail="Missing Authorization header"
+        )
+
+    token = auth_header[7:]
+    jwt_service = get_jwt_service()
+    user = jwt_service.verify_token(token)
+
+    if not user:
+        raise HTTPException(
+            status_code=401,
+            detail="Invalid or expired token"
+        )
+
+    return {"valid": True, "user": user}
+
+
 # =============================================================================
 # Development Token Endpoints (non-production only)
 # =============================================================================
@@ -555,3 +654,43 @@ async def get_dev_token(request: Request):
         "usage": f'curl -H "Authorization: Bearer {token}" http://localhost:8000/api/v1/...',
         "warning": "This token is for development/testing only and will not work in production.",
     }
+
+
+@router.get("/dev/mock-code/{email}")
+async def get_mock_code(email: str, request: Request):
+    """
+    Get the mock login code for testing (non-production only).
+
+    This endpoint retrieves the code that was "sent" via email in mock mode.
+    Use this for automated testing without real email delivery.
+
+    Usage:
+        1. POST /api/auth/email/send-code with email
+        2. GET /api/auth/dev/mock-code/{email} to retrieve the code
+        3. POST /api/auth/email/verify with email and code
+
+    Returns:
+        401 if in production environment
+        404 if no code found for the email
+        The code and email otherwise
+    """
+    if settings.environment == "production":
+        raise HTTPException(
+            status_code=401,
+            detail="Mock codes are not available in production"
+        )
+
+    from ...services.email import EmailService
+
+    code = EmailService.get_mock_code(email)
+    if not code:
+        raise HTTPException(
+            status_code=404,
+            detail=f"No mock code found for {email}. Send a code first."
+        )
+
+    return {
+        "email": email,
+        "code": code,
+        "warning": "This endpoint is for testing only and will not work in production.",
+    }

rem/api/routers/chat/completions.py

@@ -97,7 +97,7 @@ Context Building Flow:
    - Long messages include REM LOOKUP hints: "... [REM LOOKUP session-{id}-msg-{index}] ..."
    - Agent can retrieve full content on-demand using REM LOOKUP
 3. User profile provided as REM LOOKUP hint (on-demand by default)
-   - Agent receives: "User ID: {user_id}. To load user profile: Use REM LOOKUP users/{user_id}"
+   - Agent receives: "User: {email}. To load user profile: Use REM LOOKUP \"{email}\""
    - Agent decides whether to load profile based on query
 4. If CHAT__AUTO_INJECT_USER_CONTEXT=true: User profile auto-loaded and injected
 5. Combines: system context + compressed session history + new messages
@@ -330,8 +330,8 @@ async def chat_completions(body: ChatCompletionRequest, request: Request):
     - Useful for A/B testing, model comparison, and feedback collection
     """
     # Load agent schema: use header value from context or default
-    # Extract AgentContext first to get schema name
-    temp_context = AgentContext.from_headers(dict(request.headers))
+    # Extract AgentContext from request (gets user_id from JWT token)
+    temp_context = AgentContext.from_request(request)
     schema_name = temp_context.agent_schema_uri or DEFAULT_AGENT_SCHEMA
 
     # Resolve model: use body.model if provided, otherwise settings default
@@ -350,6 +350,7 @@ async def chat_completions(body: ChatCompletionRequest, request: Request):
         context, messages = await ContextBuilder.build_from_headers(
             headers=dict(request.headers),
             new_messages=new_messages,
+            user_id=temp_context.user_id,  # From JWT token (source of truth)
         )
 
         # Ensure session exists with metadata and eval mode if applicable
@@ -509,6 +510,7 @@ async def chat_completions(body: ChatCompletionRequest, request: Request):
     context, messages = await ContextBuilder.build_from_headers(
         headers=dict(request.headers),
         new_messages=new_messages,
+        user_id=temp_context.user_id,  # From JWT token (source of truth)
     )
 
     logger.info(f"Built context with {len(messages)} total messages (includes history + user context)")

rem/api/routers/chat/streaming.py

@@ -835,3 +835,21 @@ async def stream_openai_response_with_save(
                 )
             except Exception as e:
                 logger.error(f"Failed to save session messages: {e}", exc_info=True)
+
+        # Update session description with session_name (non-blocking, after all yields)
+        for tool_call in tool_calls:
+            if tool_call.get("tool_name") == "register_metadata" and tool_call.get("is_metadata"):
+                session_name = tool_call.get("arguments", {}).get("session_name")
+                if session_name:
+                    try:
+                        from ....models.entities import Session
+                        from ....services.postgres import Repository
+                        repo = Repository(Session, table_name="sessions")
+                        session = await repo.get_by_id(session_id)
+                        if session and session.description != session_name:
+                            session.description = session_name
+                            await repo.update(session)
+                            logger.debug(f"Updated session {session_id} description to '{session_name}'")
+                    except Exception as e:
+                        logger.warning(f"Failed to update session description: {e}")
+                    break