vectr 1.0.2__tar.gz → 1.1.0__tar.gz

{vectr-1.0.2/vectr.egg-info → vectr-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vectr
-Version: 1.0.2
+Version: 1.1.0
 Summary: Semantic codebase search + persistent working memory for AI code editors. Local, zero-config, MCP. No API key.
 Author-email: Swapnanil Saha <swapnanilsaha26@gmail.com>
 License: MIT
@@ -43,6 +43,12 @@ Requires-Dist: pytest-asyncio==1.3.0; extra == "dev"
 Requires-Dist: anyio==4.13.0; extra == "dev"
 Dynamic: license-file
 
+<!-- mcp-name: io.github.swapnanil/vectr -->
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/swapnanil/vectr/main/assets/banner.svg" alt="vectr — semantic codebase search + persistent working memory for AI code editors" width="560">
+</p>
+
 # Vectr
 
 > **Semantic search and persistent memory for AI code editors.**
@@ -50,10 +56,10 @@ Dynamic: license-file
 [![CI](https://github.com/swapnanil/vectr/actions/workflows/ci.yml/badge.svg)](https://github.com/swapnanil/vectr/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Python 3.14+](https://img.shields.io/badge/python-3.14%2B-blue.svg)](https://www.python.org/downloads/)
-[![Version 1.0.0](https://img.shields.io/badge/version-1.0.0-blue.svg)](CHANGELOG.md)
+[![Version 1.1.0](https://img.shields.io/badge/version-1.1.0-blue.svg)](CHANGELOG.md)
 [![MCP: 14 tools](https://img.shields.io/badge/MCP-14%20tools-blue.svg)](#14-mcp-tools)
 
-Version 1.0.0 · Last updated 2026-07-08 · [CHANGELOG](CHANGELOG.md)
+Version 1.1.0 · Last updated 2026-07-11 · [CHANGELOG](CHANGELOG.md)
 
 Vectr gives AI code editors two things they lack: **semantic codebase search** and **persistent working memory** — both served over MCP with zero configuration.
 
@@ -155,7 +161,7 @@ vectr start
 - Ubuntu/Debian: `sudo add-apt-repository ppa:deadsnakes/ppa && sudo apt install python3.14 python3.14-venv`
 - Windows: [python.org/downloads](https://www.python.org/downloads/)
 
-`vectr start` returns immediately. Indexing runs in the background — run `vectr status` to check progress. On first run the embedding model downloads once (~440 MB). Restart your AI code editor once to pick up the new MCP config.
+`vectr start` returns immediately. Indexing runs in the background — run `vectr status` to check progress. On first run the embedding model downloads once (~290 MB). Restart your AI code editor once to pick up the new MCP config.
 
 **Docker (CI/servers)**
 
@@ -335,7 +341,7 @@ HTTP routes (Flask/FastAPI decorators, Express `app.get()`, Spring `@GetMapping`
 
 | | Cost |
 |---|---|
-| Embedding model | $0.00 — one-time ~440 MB download, cached at `~/.cache/vectr/` |
+| Embedding model | $0.00 — one-time ~290 MB download, cached at `~/.cache/vectr/` |
 | Re-index (10k files, first run) | ~10 min on CPU; <5 sec on subsequent runs (mtime cache) |
 | Incremental re-index per changed file | ~0.5 sec |
 | vectr_search / vectr_recall | $0.00 — local inference only |
@@ -344,15 +350,52 @@ HTTP routes (Flask/FastAPI decorators, Express `app.get()`, Spring `@GetMapping`
 
 ## Security
 
-Vectr v1 is designed for a **solo developer on a personal machine**.
-
-- MCP server binds to `127.0.0.1` only — not reachable from other hosts
-- CORS restricted to localhost origins
-- Each workspace gets its own isolated DB directory, port, and process
-- No API key authentication in v1 — any local process can query
-- Index and notes persist locally in `~/.cache/vectr/`
-
-Multi-user, authentication, and encryption at rest are out of scope for v1.
+The default is unchanged and stays the headline: **local, no API key, zero
+config** — a solo developer on a personal machine. Out of the box, the daemon
+binds to `127.0.0.1` only, CORS is restricted to localhost origins, each
+workspace gets its own isolated DB directory, port, and process (owner-only
+`0700` on POSIX), and the index and notes persist locally in `~/.cache/vectr/`.
+
+Everything below is **opt-in**; enabling nothing changes nothing.
+
+**Authentication** — set `VECTR_API_KEY` and every request to `/v1/*` and
+`/mcp` must carry it (`X-Api-Key: <key>` or `Authorization: Bearer <key>`;
+constant-time comparison; `/v1/health` stays open for liveness probes).
+Generate a key with `vectr key`. When the key is set at start time, the editor
+MCP configs vectr writes include the header automatically. Those files
+(`.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`) then hold the key in
+plaintext — treat them as secrets and keep them out of shared or public
+version control.
+
+**Encryption at rest** — set `VECTR_ENCRYPT_KEY` (or store a passphrase in the
+OS keychain: service `vectr`, username `encrypt-key`; requires
+`pip install vectr[encryption]`) and note content, note titles, and snapshot
+payloads are encrypted (Fernet, PBKDF2-derived key). Honest boundary: the
+**code index is not encrypted** — the search engine needs readable chunk text
+and vectors; protect it with OS full-disk encryption. Note tags/metadata stay
+plaintext, and note embedding vectors (a lossy projection of note text) are
+kept for semantic recall unless you set
+`VECTR_ENCRYPT_DISABLE_NOTE_VECTORS=1`.
+
+**Retention and audit** — notes are kept until you delete them; set
+`VECTR_NOTES_TTL_DAYS` to auto-purge older notes at startup.
+`vectr_forget(all=true)` / `vectr forget --all` delete notes, snapshots, and
+note vectors — everything means everything. Set `VECTR_AUDIT_LOG=<path>` for a
+rotating local log of index/search/remember/recall events (off by default; it
+records query text — that is its purpose — and is never transmitted). Full
+policy: [docs/data-handling.md](docs/data-handling.md).
+
+**Team mode (shared instance)** — one central daemon can serve a team on one
+repo: `VECTR_API_KEY=<key> vectr start --host 0.0.0.0` on the server (a
+non-loopback bind **refuses to start without a key**), then
+`vectr connect --url http://<host>:<port> --api-key <key> --label <you>` on
+each client to point the editor at it. Working memory is shared: a note one
+agent stores, every connected agent can recall; `--label` attributes notes and
+audit lines. Plain limits: one shared key means every holder is an equal,
+trusted peer (no roles, no per-user permissions); the server operator can read
+everything; search results reference the **server's** checkout, which may
+differ from your local tree; vectr speaks plain HTTP — put TLS at a reverse
+proxy or tunnel if the network isn't trusted.
 
 ---
 

{vectr-1.0.2 → vectr-1.1.0}/README.md

@@ -1,3 +1,9 @@
+<!-- mcp-name: io.github.swapnanil/vectr -->
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/swapnanil/vectr/main/assets/banner.svg" alt="vectr — semantic codebase search + persistent working memory for AI code editors" width="560">
+</p>
+
 # Vectr
 
 > **Semantic search and persistent memory for AI code editors.**
@@ -5,10 +11,10 @@
 [![CI](https://github.com/swapnanil/vectr/actions/workflows/ci.yml/badge.svg)](https://github.com/swapnanil/vectr/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Python 3.14+](https://img.shields.io/badge/python-3.14%2B-blue.svg)](https://www.python.org/downloads/)
-[![Version 1.0.0](https://img.shields.io/badge/version-1.0.0-blue.svg)](CHANGELOG.md)
+[![Version 1.1.0](https://img.shields.io/badge/version-1.1.0-blue.svg)](CHANGELOG.md)
 [![MCP: 14 tools](https://img.shields.io/badge/MCP-14%20tools-blue.svg)](#14-mcp-tools)
 
-Version 1.0.0 · Last updated 2026-07-08 · [CHANGELOG](CHANGELOG.md)
+Version 1.1.0 · Last updated 2026-07-11 · [CHANGELOG](CHANGELOG.md)
 
 Vectr gives AI code editors two things they lack: **semantic codebase search** and **persistent working memory** — both served over MCP with zero configuration.
 
@@ -110,7 +116,7 @@ vectr start
 - Ubuntu/Debian: `sudo add-apt-repository ppa:deadsnakes/ppa && sudo apt install python3.14 python3.14-venv`
 - Windows: [python.org/downloads](https://www.python.org/downloads/)
 
-`vectr start` returns immediately. Indexing runs in the background — run `vectr status` to check progress. On first run the embedding model downloads once (~440 MB). Restart your AI code editor once to pick up the new MCP config.
+`vectr start` returns immediately. Indexing runs in the background — run `vectr status` to check progress. On first run the embedding model downloads once (~290 MB). Restart your AI code editor once to pick up the new MCP config.
 
 **Docker (CI/servers)**
 
@@ -290,7 +296,7 @@ HTTP routes (Flask/FastAPI decorators, Express `app.get()`, Spring `@GetMapping`
 
 | | Cost |
 |---|---|
-| Embedding model | $0.00 — one-time ~440 MB download, cached at `~/.cache/vectr/` |
+| Embedding model | $0.00 — one-time ~290 MB download, cached at `~/.cache/vectr/` |
 | Re-index (10k files, first run) | ~10 min on CPU; <5 sec on subsequent runs (mtime cache) |
 | Incremental re-index per changed file | ~0.5 sec |
 | vectr_search / vectr_recall | $0.00 — local inference only |
@@ -299,15 +305,52 @@ HTTP routes (Flask/FastAPI decorators, Express `app.get()`, Spring `@GetMapping`
 
 ## Security
 
-Vectr v1 is designed for a **solo developer on a personal machine**.
-
-- MCP server binds to `127.0.0.1` only — not reachable from other hosts
-- CORS restricted to localhost origins
-- Each workspace gets its own isolated DB directory, port, and process
-- No API key authentication in v1 — any local process can query
-- Index and notes persist locally in `~/.cache/vectr/`
-
-Multi-user, authentication, and encryption at rest are out of scope for v1.
+The default is unchanged and stays the headline: **local, no API key, zero
+config** — a solo developer on a personal machine. Out of the box, the daemon
+binds to `127.0.0.1` only, CORS is restricted to localhost origins, each
+workspace gets its own isolated DB directory, port, and process (owner-only
+`0700` on POSIX), and the index and notes persist locally in `~/.cache/vectr/`.
+
+Everything below is **opt-in**; enabling nothing changes nothing.
+
+**Authentication** — set `VECTR_API_KEY` and every request to `/v1/*` and
+`/mcp` must carry it (`X-Api-Key: <key>` or `Authorization: Bearer <key>`;
+constant-time comparison; `/v1/health` stays open for liveness probes).
+Generate a key with `vectr key`. When the key is set at start time, the editor
+MCP configs vectr writes include the header automatically. Those files
+(`.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`) then hold the key in
+plaintext — treat them as secrets and keep them out of shared or public
+version control.
+
+**Encryption at rest** — set `VECTR_ENCRYPT_KEY` (or store a passphrase in the
+OS keychain: service `vectr`, username `encrypt-key`; requires
+`pip install vectr[encryption]`) and note content, note titles, and snapshot
+payloads are encrypted (Fernet, PBKDF2-derived key). Honest boundary: the
+**code index is not encrypted** — the search engine needs readable chunk text
+and vectors; protect it with OS full-disk encryption. Note tags/metadata stay
+plaintext, and note embedding vectors (a lossy projection of note text) are
+kept for semantic recall unless you set
+`VECTR_ENCRYPT_DISABLE_NOTE_VECTORS=1`.
+
+**Retention and audit** — notes are kept until you delete them; set
+`VECTR_NOTES_TTL_DAYS` to auto-purge older notes at startup.
+`vectr_forget(all=true)` / `vectr forget --all` delete notes, snapshots, and
+note vectors — everything means everything. Set `VECTR_AUDIT_LOG=<path>` for a
+rotating local log of index/search/remember/recall events (off by default; it
+records query text — that is its purpose — and is never transmitted). Full
+policy: [docs/data-handling.md](docs/data-handling.md).
+
+**Team mode (shared instance)** — one central daemon can serve a team on one
+repo: `VECTR_API_KEY=<key> vectr start --host 0.0.0.0` on the server (a
+non-loopback bind **refuses to start without a key**), then
+`vectr connect --url http://<host>:<port> --api-key <key> --label <you>` on
+each client to point the editor at it. Working memory is shared: a note one
+agent stores, every connected agent can recall; `--label` attributes notes and
+audit lines. Plain limits: one shared key means every holder is an equal,
+trusted peer (no roles, no per-user permissions); the server operator can read
+everything; search results reference the **server's** checkout, which may
+differ from your local tree; vectr speaks plain HTTP — put TLS at a reverse
+proxy or tunnel if the network isn't trusted.
 
 ---
 

vectr-1.1.0/agent/fs_permissions.py

@@ -0,0 +1,33 @@
+"""Filesystem permission helpers for vectr's local state directories.
+
+On a shared host, vectr's cache and state directories hold a plaintext code
+index and working-memory notes. Restricting them to owner-only (0700) stops
+other OS users on the same machine from reading them at the filesystem level —
+the concrete defense for the scope-isolation model on multi-user hosts.
+
+Best-effort and POSIX-scoped: on Windows, os.chmod cannot express a POSIX 0700
+mode, so the chmod is effectively a near-no-op there and full-disk encryption /
+NTFS ACLs are the right tool instead. A permission-tightening failure must never
+stop the daemon, so every call here is guarded.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def secure_dir(path: str | Path, mode: int = 0o700) -> Path:
+    """Create `path` (and parents) if needed, then restrict it to `mode`.
+
+    Idempotent and safe to call on every startup; never raises. Returns the
+    Path so callers can chain. Tightens pre-existing directories too.
+    """
+    p = Path(path)
+    try:
+        p.mkdir(parents=True, exist_ok=True)
+    except OSError:
+        return p
+    try:
+        p.chmod(mode)
+    except OSError:
+        pass  # e.g. Windows, or a dir we do not own — best effort only
+    return p

{vectr-1.0.2 → vectr-1.1.0}/agent/instance_registry.py

@@ -53,7 +53,10 @@ class InstanceRegistry:
             return {}
 
     def _write(self, data: dict[str, Any]) -> None:
-        self._path.parent.mkdir(parents=True, exist_ok=True)
+        # ~/.vectr holds the instance registry, logs, and (opt-in) audit log —
+        # owner-only on POSIX hosts (see agent/fs_permissions.py).
+        from agent.fs_permissions import secure_dir
+        secure_dir(self._path.parent)
         tmp = self._path.with_suffix(".tmp")
         tmp.write_text(json.dumps(data, indent=2))
         os.rename(tmp, self._path)

{vectr-1.0.2 → vectr-1.1.0}/agent/working_context_store/__init__.py

@@ -36,6 +36,8 @@ from __future__ import annotations
 from agent.working_context_store._audit import (
     _get_audit_logger,
     audit,
+    reset_audit_client,
+    set_audit_client,
 )
 
 # Types and constants
@@ -61,6 +63,8 @@ __all__ = [
     # Audit
     "_get_audit_logger",
     "audit",
+    "set_audit_client",
+    "reset_audit_client",
     # Types and constants
     "DEFAULT_KIND",
     "VALID_KINDS",

vectr-1.1.0/agent/working_context_store/_audit.py

@@ -0,0 +1,102 @@
+"""Opt-in rotating audit logger for vectr working-context and index events.
+
+OFF BY DEFAULT. Enable by setting VECTR_AUDIT_LOG to a file path; when unset,
+nothing is recorded (a NullHandler). When enabled, logs remember/recall/forget/
+purge/index/search events to that local file — never transmitted anywhere.
+Rotates at 10 MB; keeps 3 backups.
+
+In team mode, each line optionally carries a `client=<label>` attribution taken
+from the connecting client's X-Vectr-Client header (see set_audit_client), so
+the operator can see what each client indexed/recalled — still a local file on
+the server host only.
+"""
+from __future__ import annotations
+
+import logging
+import logging.handlers
+import os
+import threading
+from contextvars import ContextVar
+from pathlib import Path
+
+# Guards lazy handler initialization: without it, two threads auditing
+# concurrently can both see an empty handler list and both attach a file
+# handler, duplicating every subsequent line.
+_init_lock = threading.Lock()
+
+
+# Per-request client attribution label (team mode). Set at the MCP dispatch
+# boundary from the X-Vectr-Client header; read by audit() so every event a
+# request triggers is attributed. A ContextVar (not a global) so concurrent
+# requests never bleed each other's label.
+_audit_client: ContextVar[str] = ContextVar("vectr_audit_client", default="")
+
+
+def set_audit_client(label: str):
+    """Set the client-attribution label for audit lines emitted on this task.
+    Returns the ContextVar token so the caller can reset() it afterwards."""
+    return _audit_client.set(label or "")
+
+
+def reset_audit_client(token) -> None:
+    """Restore the previous client-attribution label."""
+    try:
+        _audit_client.reset(token)
+    except Exception:
+        pass
+
+
+def _get_audit_logger() -> logging.Logger:
+    """Return the vectr audit logger (lazy-initialised, singleton per process).
+
+    Disabled unless VECTR_AUDIT_LOG names a file path (opt-in)."""
+    name = "vectr.audit"
+    log = logging.getLogger(name)
+    if log.handlers:
+        return log
+
+    with _init_lock:
+        if log.handlers:  # another thread initialized while we waited
+            return log
+        return _init_audit_logger(log)
+
+
+def _init_audit_logger(log: logging.Logger) -> logging.Logger:
+    """Attach the configured handler to `log` (caller holds _init_lock)."""
+    log_path_str = os.getenv("VECTR_AUDIT_LOG", "")  # opt-in: unset ⇒ disabled
+    if not log_path_str:
+        log.addHandler(logging.NullHandler())
+        return log
+
+    log_path = Path(log_path_str)
+    # The audit file records query text — keep its directory owner-only (0700)
+    # on POSIX hosts, same as the rest of vectr's state.
+    try:
+        from agent.fs_permissions import secure_dir
+        secure_dir(log_path.parent)
+    except Exception:
+        log_path.parent.mkdir(parents=True, exist_ok=True)
+
+    handler = logging.handlers.RotatingFileHandler(
+        str(log_path), maxBytes=10 * 1024 * 1024, backupCount=3, encoding="utf-8",
+    )
+    handler.setFormatter(logging.Formatter("%(asctime)s %(message)s", datefmt="%Y-%m-%dT%H:%M:%SZ"))
+    log.addHandler(handler)
+    log.setLevel(logging.INFO)
+    log.propagate = False
+    return log
+
+
+def audit(event: str, **kwargs) -> None:
+    """Write one audit log entry: `event key=val key=val …` (no-op when disabled).
+
+    A non-empty client-attribution label (set_audit_client) is appended as
+    `client=<label>`."""
+    try:
+        parts = [event] + [f"{k}={v}" for k, v in kwargs.items()]
+        client = _audit_client.get()
+        if client:
+            parts.append(f"client={client}")
+        _get_audit_logger().info(" ".join(parts))
+    except Exception:
+        pass  # audit failures must never crash the main path

{vectr-1.0.2 → vectr-1.1.0}/agent/working_context_store/_encryption.py

@@ -48,9 +48,28 @@ class _NoteEncryptor:
             return stored
 
 
+def _key_from_keyring() -> str:
+    """Read the encryption passphrase from the OS keychain, if the optional
+    `keyring` dependency is installed and a value is stored under
+    service "vectr", username "encrypt-key". Returns "" on any failure —
+    keychain sourcing is a best-effort convenience, never a hard requirement.
+    """
+    try:
+        import keyring  # optional dependency (pip install vectr[encryption])
+    except Exception:
+        return ""
+    try:
+        return keyring.get_password("vectr", "encrypt-key") or ""
+    except Exception:
+        return ""
+
+
 def _build_encryptor() -> _NoteEncryptor | None:
-    """Return a _NoteEncryptor if VECTR_ENCRYPT_KEY is set, else None."""
-    key = os.getenv("VECTR_ENCRYPT_KEY", "")
+    """Return a _NoteEncryptor when an encryption passphrase is available, else
+    None (encryption off — the default). Sourcing precedence: the
+    VECTR_ENCRYPT_KEY environment variable wins; if it is unset, the OS keychain
+    is consulted (env or OS keychain, per the security design)."""
+    key = os.getenv("VECTR_ENCRYPT_KEY", "") or _key_from_keyring()
     return _NoteEncryptor(key) if key else None
 
 

{vectr-1.0.2 → vectr-1.1.0}/agent/working_context_store/_store.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import json
 import logging
+import os
 import sqlite3
 import time
 from pathlib import Path
@@ -30,6 +31,11 @@ _NOTES_EMBED_MODEL_KEY = "embed_model"
 # embed_fn per call during a one-time startup migration.
 _NOTES_REEMBED_BATCH_SIZE = 256
 
+# SQLite busy-wait for a contended write lock (team mode: concurrent clients +
+# the CLI can share one workspace's notes DB). Intentionally NOT in config.yaml
+# — a robustness/timeout knob, same category as the throughput constants above.
+_SQLITE_BUSY_TIMEOUT_S = 5.0
+
 
 class WorkingContextStore:
     """
@@ -80,7 +86,16 @@ class WorkingContextStore:
         self._embed_query_fn = embed_query_fn or embed_fn  # query-mode embed, defaults to embed_fn
         self._embed_model = embed_model  # current model name, for the embed-model stamp/migration
         self._notes_col = None
-        if embed_fn is not None and notes_chroma_client is not None:
+        # Strict encryption posture (VECTR_ENCRYPT_DISABLE_NOTE_VECTORS): when
+        # encryption is on, the note embedding vectors are a lossy plaintext
+        # projection of note content living in the Chroma store. Setting this
+        # omits them entirely — recall falls back to lexical SQL LIKE — so no
+        # representation of note content leaves the encrypted SQLite column.
+        strict_no_vectors = (
+            self._encryptor is not None
+            and os.getenv("VECTR_ENCRYPT_DISABLE_NOTE_VECTORS", "") == "1"
+        )
+        if embed_fn is not None and notes_chroma_client is not None and not strict_no_vectors:
             try:
                 self._notes_col = notes_chroma_client.get_or_create_collection(
                     name="working_memory",
@@ -101,9 +116,15 @@ class WorkingContextStore:
                 )
 
     def _conn(self) -> sqlite3.Connection:
-        conn = sqlite3.connect(str(self._db_path))
+        conn = sqlite3.connect(str(self._db_path), timeout=_SQLITE_BUSY_TIMEOUT_S)
         conn.row_factory = sqlite3.Row
         conn.execute("PRAGMA journal_mode=WAL")
+        # Team mode: several clients (and the CLI) can hit one workspace's notes
+        # DB concurrently. WAL allows concurrent readers + one writer; busy_timeout
+        # makes a would-be second writer wait for the lock instead of immediately
+        # raising "database is locked". note_id is AUTOINCREMENT, so IDs stay
+        # unique under concurrent inserts once writes are serialized by the lock.
+        conn.execute(f"PRAGMA busy_timeout={int(_SQLITE_BUSY_TIMEOUT_S * 1000)}")
         return conn
 
     def _init_db(self) -> None:
@@ -214,7 +235,15 @@ class WorkingContextStore:
                 if stripped:
                     title = stripped[:80]
                     break
-        stored_content = self._encryptor.encrypt(content) if self._encryptor else content
+        # Encrypt BOTH content and the (possibly content-derived) title: the
+        # default title is the first content line, so a plaintext title column
+        # would leak the very text encryption is meant to protect.
+        if self._encryptor:
+            stored_content = self._encryptor.encrypt(content)
+            stored_title = self._encryptor.encrypt(title)
+        else:
+            stored_content = content
+            stored_title = title
 
         with self._conn() as conn:
             # conflict resolution: if another note anchors the same code block, supersede it
@@ -241,7 +270,7 @@ class WorkingContextStore:
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1.0, ?, 1.0, ?, NULL, ?, ?)
                 """,
                 (workspace, stored_content, tags_json, priority, kind, now, now, session_id,
-                 author_id, now, code_hash, title),
+                 author_id, now, code_hash, stored_title),
             )
             note_id = cur.lastrowid
 
@@ -751,11 +780,17 @@ class WorkingContextStore:
         return row[0] if row else 0
 
     def forget_all(self, workspace: str) -> int:
-        """Clear all notes for a workspace."""
+        """Clear all notes AND snapshots for a workspace.
+
+        Snapshots embed full note contents in their payload, so a purge that
+        deleted only the notes table would silently keep every note's text
+        alive in `snapshots` — "delete everything" must mean everything,
+        including the note embedding vectors in the Chroma collection."""
         with self._conn() as conn:
             deleted = conn.execute(
                 "DELETE FROM notes WHERE workspace = ?", (workspace,)
             ).rowcount
+            conn.execute("DELETE FROM snapshots WHERE workspace = ?", (workspace,))
         if deleted > 0 and self._notes_col is not None:
             try:
                 existing_ids = self._notes_col.get(include=[])["ids"]
@@ -767,13 +802,23 @@ class WorkingContextStore:
         return deleted
 
     def forget_all_workspaces(self) -> int:
-        """Delete ALL notes across ALL workspaces in this SQLite file.
+        """Delete ALL notes, snapshots, and note vectors across ALL workspaces
+        in this SQLite file.
 
-        Used by `vectr forget --all` to give a global clean slate.
+        Used by `vectr forget --all` to give a global clean slate — the same
+        "everything means everything" contract as forget_all above.
         Audit entry logged per deletion.
         """
         with self._conn() as conn:
             deleted = conn.execute("DELETE FROM notes").rowcount
+            conn.execute("DELETE FROM snapshots")
+        if self._notes_col is not None:
+            try:
+                existing_ids = self._notes_col.get(include=[])["ids"]
+                if existing_ids:
+                    self._notes_col.delete(ids=existing_ids)
+            except Exception:
+                pass
         audit("FORGET_ALL_WORKSPACES", deleted=deleted)
         return deleted
 
@@ -846,6 +891,11 @@ class WorkingContextStore:
             "retrieved_chunks": retrieved_chunks or [],
             "session_id": session_id,
         })
+        # The payload embeds decrypted note contents (recall() decrypts), so a
+        # plaintext snapshots table would bypass note encryption entirely.
+        # Encrypt the whole payload under the same key as note content.
+        if self._encryptor:
+            payload = self._encryptor.encrypt(payload)
         with self._conn() as conn:
             conn.execute(
                 "INSERT OR REPLACE INTO snapshots (snapshot_id, workspace, label, payload, created_at) VALUES (?, ?, ?, ?, ?)",
@@ -868,7 +918,18 @@ class WorkingContextStore:
             ).fetchone()
         if row is None:
             return None
-        return json.loads(row["payload"])
+        payload = row["payload"]
+        if self._encryptor:
+            # Tolerant decrypt: snapshots written before payload encryption (or
+            # before a key was configured) pass through unchanged.
+            payload = self._encryptor.decrypt(payload)
+        try:
+            return json.loads(payload)
+        except (json.JSONDecodeError, TypeError):
+            # Ciphertext without the (correct) key configured — unreadable by
+            # design; treat as not restorable rather than crashing the caller.
+            logger.warning("snapshot %s payload is not readable (encrypted with a different key?)", snapshot_id)
+            return None
 
     # ------------------------------------------------------------------
     # Eviction hints — which chunks can vectr re-retrieve in <50ms?
@@ -995,9 +1056,13 @@ class WorkingContextStore:
 
     def _row_to_note(self, row: sqlite3.Row) -> WorkingNote:
         content = row["content"]
+        keys = row.keys()
+        title = row["title"] if "title" in keys else ""
         if self._encryptor:
             content = self._encryptor.decrypt(content)
-        keys = row.keys()
+            # Tolerant decrypt: titles written before title-encryption (or before
+            # encryption was enabled at all) are returned unchanged.
+            title = self._encryptor.decrypt(title)
         return WorkingNote(
             note_id=row["note_id"],
             workspace=row["workspace"],
@@ -1017,7 +1082,7 @@ class WorkingContextStore:
             code_hash=row["code_hash"] if "code_hash" in keys else "",
             superseded_by=row["superseded_by"] if "superseded_by" in keys else None,
             superseded_at=row["superseded_at"] if "superseded_at" in keys else None,
-            title=row["title"] if "title" in keys else "",
+            title=title,
         )
 
     def format_notes_for_llm(

{vectr-1.0.2 → vectr-1.1.0}/api.py

@@ -1,6 +1,7 @@
 """FastAPI application entry point. Port: 8765."""
 from __future__ import annotations
 
+import hmac
 import logging
 import os
 
@@ -56,7 +57,7 @@ app = FastAPI(
         "(search/locate/trace/map) plus a working-memory store (remember/recall/"
         "snapshot) that survives context compaction and session boundaries."
     ),
-    version="1.0.2",
+    version="1.0.3",
     lifespan=lifespan,
 )
 
@@ -65,15 +66,16 @@ app.add_middleware(
     allow_origins=["http://localhost", "http://127.0.0.1"],
     allow_origin_regex=r"http://(localhost|127\.0\.0\.1)(:\d+)?",
     allow_methods=["GET", "POST"],
-    allow_headers=["Content-Type", "Authorization", "X-Api-Key"],
+    allow_headers=["Content-Type", "Authorization", "X-Api-Key", "X-Vectr-Client", "X-Session-ID"],
 )
 
 
 # Optional API key enforcement — only active when VECTR_API_KEY is set.
 # Solo dev / personal machine: no key required by default.
-# For shared/enterprise use: set VECTR_API_KEY and communicate it to IDE users.
-# Middleware reads the env var at request time (not import time) so the key can
-# be changed without restarting and tests can patch os.environ cleanly.
+# For shared-host or team (central instance) use: set VECTR_API_KEY and share it
+# with connecting clients. Middleware reads the env var at request time (not
+# import time) so the key can be changed without restarting and tests can patch
+# os.environ cleanly.
 @app.middleware("http")
 async def require_api_key(request: Request, call_next) -> Response:
     api_key = os.getenv("VECTR_API_KEY", "")
@@ -89,7 +91,10 @@ async def require_api_key(request: Request, call_next) -> Response:
         request.headers.get("X-Api-Key", "")
         or request.headers.get("Authorization", "").removeprefix("Bearer ").strip()
     )
-    if provided != api_key:
+    # Constant-time comparison — never a plain `==`/`!=`, which leaks the key
+    # length and prefix via response timing. compare_digest requires both
+    # operands be the same type; encode to bytes so a unicode key is handled.
+    if not hmac.compare_digest(provided.encode("utf-8"), api_key.encode("utf-8")):
         return Response(
             content='{"error":"unauthorized","detail":"Set X-Api-Key or Authorization: Bearer <VECTR_API_KEY>"}',
             status_code=401,