fix: Hugging Face sync, routing, dashboard, and agent isolation bugs

src/app.py

@@ -92,6 +92,8 @@ def create_app() -> Flask:
 
     # 4. Flask app + blueprints
     flask_app = Flask(__name__)
+    from werkzeug.middleware.proxy_fix import ProxyFix
+    flask_app.wsgi_app = ProxyFix(flask_app.wsgi_app, x_proto=1, x_host=1, x_port=1, x_prefix=1)
     from routes import register_blueprints
     register_blueprints(flask_app)
 

src/functions.py

@@ -3494,6 +3494,10 @@ def folder_graph_build(kv: StateKV) -> Dict[str, Any]:
     Edges are deduplicated on (source, target, type).
     """
     index_entries = kv.list(KV.folders)
+    if is_agent_scope_isolated():
+        aid = get_agent_id()
+        if aid:
+            index_entries = [e for e in index_entries if e.get("agentId") == aid]
 
     # --- Build folder_map and collect obs text per (folder, agent) pair ---
     # folder_map: folderPath -> {"folderPath", "agentIds": set, "obsCount", "color"}

src/routes/graph.py

@@ -59,55 +59,9 @@ def api_graph_stats():
         return auth_err
 
     kv = _get_kv()
-    sessions = functions.list_sessions(kv)
-    memories = kv.list(KV.memories)
-
-    folders = set()
-    concepts_by_folder = {}
-
-    for s in sessions:
-        project = s.get("project", "").strip()
-        if project:
-            folders.add(project)
-
-    for m in memories:
-        project = m.get("project", "").strip()
-        if project:
-            folders.add(project)
-            concepts = m.get("concepts", [])
-            if concepts:
-                if project not in concepts_by_folder:
-                    concepts_by_folder[project] = set()
-                for c in concepts:
-                    if isinstance(c, str):
-                        concepts_by_folder[project].add(c.lower())
-
-    node_count = len(folders)
-    edge_count = 0
-    folder_list = list(folders)
-
-    for i in range(len(folder_list)):
-        for j in range(i + 1, len(folder_list)):
-            f1 = folder_list[i]
-            f2 = folder_list[j]
-
-            c1 = concepts_by_folder.get(f1, set())
-            c2 = concepts_by_folder.get(f2, set())
-            shared = c1.intersection(c2)
-
-            p1 = [p for p in f1.replace("\\", "/").split("/") if p]
-            p2 = [p for p in f2.replace("\\", "/").split("/") if p]
-            common_subdirs = 0
-            for k in range(min(len(p1), len(p2))):
-                if p1[k].lower() == p2[k].lower():
-                    p_low = p1[k].lower()
-                    if p_low not in ("c:", "d:", "downloads", "projects", "other projects"):
-                        common_subdirs += 1
-                else:
-                    break
-
-            if len(shared) > 0 or common_subdirs > 0:
-                edge_count += 1
+    g = functions.folder_graph_build(kv)
+    node_count = len(g.get("nodes", []))
+    edge_count = len(g.get("edges", []))
 
     return jsonify({"nodes": node_count, "edges": edge_count, "success": True}), 200
 

src/routes/mcp.py

@@ -247,6 +247,12 @@ def mcp_tools_call():
             limit = int(args.get("limit") or 10)
             folder_path = args.get("folderPath")
             agent_id = args.get("agentId")
+            if functions.is_agent_scope_isolated():
+                current_aid = functions.get_agent_id()
+                if current_aid:
+                    if agent_id and agent_id != current_aid:
+                        return jsonify({"error": "Unauthorized: Agent scope is isolated"}), 403
+                    agent_id = current_aid
             res = functions.folder_search(kv, q, limit, folder_path=folder_path, agent_id=agent_id)
             text_out = json.dumps(res, indent=2)
 
@@ -269,6 +275,12 @@ def mcp_tools_call():
             limit = int(args.get("limit") or 10)
             folder_path = args.get("folderPath")
             agent_id = args.get("agentId")
+            if functions.is_agent_scope_isolated():
+                current_aid = functions.get_agent_id()
+                if current_aid:
+                    if agent_id and agent_id != current_aid:
+                        return jsonify({"error": "Unauthorized: Agent scope is isolated"}), 403
+                    agent_id = current_aid
             res = functions.folder_search(kv, q, limit, folder_path=folder_path, agent_id=agent_id)
             text_out = json.dumps(res, indent=2)
 
@@ -313,6 +325,13 @@ def mcp_tools_call():
                     or "agent"
                 )
 
+            if functions.is_agent_scope_isolated():
+                current_aid = functions.get_agent_id()
+                if current_aid:
+                    if agent_id and agent_id != current_aid:
+                        return jsonify({"error": "Unauthorized: Agent scope is isolated"}), 403
+                    agent_id = current_aid
+
             if not text:
                 return jsonify({"error": "text (or content) is required"}), 400
 
@@ -338,6 +357,14 @@ def mcp_tools_call():
             mem_type = args.get("type") or "fact"
             concepts = _parse_mcp_list_arg(args.get("concepts"))
             files = _parse_mcp_list_arg(args.get("files"))
+
+            if functions.is_agent_scope_isolated():
+                current_aid = functions.get_agent_id()
+                if current_aid:
+                    if agent_id and agent_id != current_aid:
+                        return jsonify({"error": "Unauthorized: Agent scope is isolated"}), 403
+                    agent_id = current_aid
+
             if not content:
                 return jsonify({"error": "content is required"}), 400
             payload = {
@@ -357,6 +384,10 @@ def mcp_tools_call():
                 key=lambda x: x.get("lastUpdated", ""),
                 reverse=True,
             )
+            if functions.is_agent_scope_isolated():
+                aid = functions.get_agent_id()
+                if aid:
+                    pairs = [p for p in pairs if p.get("agentId") == aid]
             text_out = json.dumps(pairs, indent=2)
 
         elif name == "memory_folder_observations":
@@ -364,6 +395,10 @@ def mcp_tools_call():
             aid = args.get("agentId", "")
             if not fp or not aid:
                 return jsonify({"error": "folderPath and agentId are required"}), 400
+            if functions.is_agent_scope_isolated():
+                current_aid = functions.get_agent_id()
+                if current_aid and aid != current_aid:
+                    return jsonify({"error": "Unauthorized: Agent scope is isolated"}), 403
             obs = sorted(
                 kv.list(KV.folder_obs(fp, aid)),
                 key=lambda x: x.get("timestamp", ""),
@@ -372,11 +407,18 @@ def mcp_tools_call():
             text_out = json.dumps(obs, indent=2)
 
         elif name == "memory_timeline":
+            request_aid = args.get("agentId")
+            if functions.is_agent_scope_isolated():
+                current_aid = functions.get_agent_id()
+                if current_aid:
+                    if request_aid and request_aid != current_aid:
+                        return jsonify({"error": "Unauthorized: Agent scope is isolated"}), 403
+                    request_aid = current_aid
             res = functions.folder_timeline(
                 kv,
                 limit=int(args.get("limit", 100)),
                 folder_path=args.get("folderPath"),
-                agent_id=args.get("agentId"),
+                agent_id=request_aid,
                 before=args.get("before"),
                 after=args.get("after"),
             )

src/routes/observations.py

@@ -57,7 +57,8 @@ def api_observe():
         body = request.get_json(force=True) or {}
 
         # Compat shim: accept both folder-based and legacy session-based payloads.
-        # Old clients send sessionId/project/cwd; new clients send folderPath/agentId.
+        # Old clients send sessionId/project/cwd + data{tool_input/output}
+        # New clients send folderPath/agentId/text
         folder_path = (
             body.get("folderPath")
             or body.get("cwd")
@@ -72,7 +73,22 @@ def api_observe():
             or os.getenv("AGENT_ID")
             or "agent"
         )
+
+        # Build text from whichever field the client used
         text = body.get("text") or body.get("content") or ""
+        if not text:
+            # Legacy clients put content in a nested 'data' dict
+            data = body.get("data")
+            if isinstance(data, dict):
+                parts = [str(v) for k, v in data.items()
+                         if v and k in ("tool_input", "tool_output", "prompt",
+                                        "response", "tool_name", "content")]
+                text = " | ".join(parts) if parts else str(data)
+            elif isinstance(data, str):
+                text = data
+        if not text:
+            # Last resort: use hookType as a minimal marker so we don't 400
+            text = body.get("hookType") or "observation"
 
         payload = {
             "folderPath": folder_path,
@@ -89,9 +105,9 @@ def api_observe():
         return jsonify(res), 201
     except Exception as e:
         import traceback
-        print(f"[observe] 400 — keys={list(body.keys())} {type(e).__name__}: {e}")
-        print(traceback.format_exc())
-        return jsonify({"error": str(e), "detail": type(e).__name__}), 400
+        tb = traceback.format_exc()
+        print(f"[observe] 400 — keys={list(body.keys())} {type(e).__name__}: {e}\n{tb}")
+        return jsonify({"error": str(e), "detail": type(e).__name__, "keys": list(body.keys()), "tb": tb}), 400
 
 
 # ---------------------------------------------------------------------------
@@ -155,6 +171,10 @@ def api_folders():
         key=lambda x: x.get("lastUpdated", ""),
         reverse=True,
     )
+    if functions.is_agent_scope_isolated():
+        aid = functions.get_agent_id()
+        if aid:
+            folders = [f for f in folders if f.get("agentId") == aid]
     return jsonify({"folders": folders}), 200
 
 
@@ -171,6 +191,10 @@ def api_folder_observations():
     aid = request.args.get("agentId")
     if not fp or not aid:
         return jsonify({"error": "folderPath and agentId are required"}), 400
+    if functions.is_agent_scope_isolated():
+        current_aid = functions.get_agent_id()
+        if current_aid and aid != current_aid:
+            return jsonify({"error": "Unauthorized: Agent scope is isolated to another agent"}), 403
     observations = sorted(
         _get_kv().list(KV.folder_obs(fp, aid)),
         key=lambda x: x.get("timestamp", ""),

start.sh

@@ -60,3 +60,7 @@ export III_REST_PORT=7860
 # Start Flask application in the foreground
 echo "[start] Starting Flask application on port 7860..."
 python3 src/app.py
+
+# Perform a final backup on shutdown
+echo "[start] Flask application exited. Performing final backup..."
+python3 /app/sync.py backup

sync.py

@@ -156,11 +156,28 @@ def _list_repo_prefix(api, prefix):
         return []
 
 
+def _checkpoint_db():
+    """Checkpoint the SQLite WAL file before backing up to ensure all data is in the main DB file."""
+    try:
+        if os.path.exists(DB_PATH):
+            conn = sqlite3.connect(DB_PATH, check_same_thread=False, timeout=10)
+            try:
+                conn.execute("PRAGMA wal_checkpoint(TRUNCATE)")
+                print("[sync] DB checkpoint complete (WAL merged)")
+            finally:
+                conn.close()
+    except Exception as e:
+        print(f"[sync] DB checkpoint failed: {e}")
+
+
 def backup():
     if not HF_TOKEN:
         return
     api = get_api()
 
+    # Checkpoint WAL changes to main DB file before backup
+    _checkpoint_db()
+
     targets = _collect_sync_targets()
     if not targets:
         print("[sync] nothing to backup")
@@ -225,7 +242,6 @@ def backup():
     finally:
         shutil.rmtree(staging, ignore_errors=True)
 
-
 if __name__ == "__main__":
     cmd = sys.argv[1] if len(sys.argv) > 1 else "backup"
     if cmd == "restore":
@@ -235,9 +251,3 @@ if __name__ == "__main__":
     else:
         print(f"[sync] unknown command: {cmd}")
         sys.exit(1)
-
-
-HF_TOKEN = os.environ.get("HF_TOKEN", "")
-REPO_ID  = os.environ.get("AGENTMEMORY_DATASET_REPO", "Yash030/agentmemory-python-data")
-DATA_DIR = os.path.expanduser("~/.agentmemory")
-DB_PATH  = os.path.join(DATA_DIR, "agentmemory.db")

tests/test_properties.py

@@ -76,7 +76,7 @@ def _safe_text():
 # Two distinct (folderPath, agentId) pairs never share observations.
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=50)
+@settings(max_examples=50, deadline=None)
 @given(
     path1=_safe_path(),
     agent1=_safe_agent(),
@@ -106,7 +106,7 @@ def test_property_1_pair_isolation(path1, agent1, path2, agent2, text):
 # meta.obsCount == len(kv.list(folder_obs_scope))
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=50)
+@settings(max_examples=50, deadline=None)
 @given(
     path=_safe_path(),
     agent=_safe_agent(),
@@ -132,7 +132,7 @@ def test_property_2_obs_count_consistency(path, agent, texts):
 # Every written pair has a KV.folders entry.
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=50)
+@settings(max_examples=50, deadline=None)
 @given(
     path=_safe_path(),
     agent=_safe_agent(),
@@ -160,7 +160,7 @@ def test_property_3_index_coverage(path, agent, text):
 # No stored obs text contains raw secrets after folder_observe().
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=30)
+@settings(max_examples=30, deadline=None)
 @given(
     path=_safe_path(),
     agent=_safe_agent(),
@@ -190,7 +190,7 @@ def test_property_4_privacy_invariant(path, agent, prefix):
 # folder_timeline() always returns results sorted newest-first.
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=40)
+@settings(max_examples=40, deadline=None)
 @given(
     path=_safe_path(),
     agent=_safe_agent(),
@@ -220,7 +220,7 @@ def test_property_5_timeline_ordering(path, agent, n):
 # After forget({folderPath, agentId}), all three scopes are empty.
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=40)
+@settings(max_examples=40, deadline=None)
 @given(
     path=_safe_path(),
     agent=_safe_agent(),
@@ -251,7 +251,7 @@ def test_property_6_forget_completeness(path, agent, texts):
 # Superseded memories have parentId; at least one memory is always latest.
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=30, suppress_health_check=[HealthCheck.filter_too_much])
+@settings(max_examples=30, suppress_health_check=[HealthCheck.filter_too_much], deadline=None)
 @given(
     base_content=st.text(
         alphabet="abcdefghijklmnopqrstuvwxyz ",
@@ -292,7 +292,7 @@ def test_property_7_memory_version_uniqueness(base_content, n_variants):
 # normalize(normalize(p)) == normalize(p) for all valid inputs.
 # ---------------------------------------------------------------------------
 
-@settings(max_examples=100)
+@settings(max_examples=100, deadline=None)
 @given(
     path=st.text(
         alphabet="abcdefghijklmnopqrstuvwxyz0123456789/_-.",