Fix/stop hook tool turn parsing#27
Merged
Merged
Conversation
extract_all_exchanges paired each user prompt with messages[i+1] — the
assistant's short preamble ("I'll fetch that repository...") — and threw
away the real answer that follows the tool calls. Tool results are type
"user" with no text block, so they filter out and the preamble wins the
pairing. Every tool-using turn (most turns) therefore posted a
fact-free exchange to /auto-store and stored nothing, silently.
Join every assistant text block up to the next real user message, and
truncate to the TAIL of the 4000-char budget so a long turn keeps the
answer (last) over the progress notes (first).
Because setup COPIES hooks into ~/.claude/hooks and registers those
copies, upgrading the package alone would not fix installed users. Add
src/services/hook_sync.py, run from server startup (which always ships
the current templates), to refresh stale hook copies by content hash. It
never creates hooks a user lacks and never touches settings.json.
Tests: tests/test_store_hook.py (parser), tests/test_hook_sync.py (sync).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Turns the advisory access checks into real enforcement. New require_caller() dependency resolves a trusted identity from the ym_ API key (Authorization: Bearer / X-YourMemory-Key); effective_user() locks userId/ memberId to that identity so a caller can't act as anyone else. Two postures via YOURMEMORY_AUTH: - off (default): unchanged behaviour — no key works, client-supplied id honoured (keeps every local install / MCP hook working; safe because loopback-bound). - required: every request needs a valid key; missing/invalid -> 401; identity is taken from the key, ignoring any client-claimed userId/memberId. Wired into memory routes (add/update/delete/list), /retrieve (incl. its pool union path, which already filters by the now-trusted user_id), and pool write/list/retrieve. Also fixes a latent bug: validate_api_key() did dict(row), which only worked on postgres (RealDictCursor) and crashed on DuckDB/SQLite tuples — so agent-key auth was broken on the default backend. Now maps the row by column. tests/test_auth.py proves both modes: off works keyless; required blocks cross-user reads, id spoofing, and unauthorized pool writes (8/8). Existing pool suite still 10/10; live server in off mode unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.