Skip to content

v1.5.2 - Security Fix: Memory Isolation

Choose a tag to compare

View all tags
@blackms blackms released this 28 Jan 16:56
· 74 commits to main since this release
v1.5.2
88b9301

馃敀 Security Fix

This release fixes a critical security vulnerability (Issue #7) where agents in different sessions could access each other's memory.

Changes

Memory Access Control

  • Added session-based memory isolation layer (src/memory/access-control.ts)
  • All memory operations now enforce session boundaries
  • Cross-session access attempts are blocked and logged

Session Cleanup

  • Session end now automatically cleans up session memory
  • All agents in a session are stopped when the session ends

API Changes

  • MCP Tools: All memory tools (memory_store, memory_search, memory_get, memory_list, memory_delete) now require sessionId parameter
  • REST Endpoints: POST and DELETE operations on /api/v1/memory now require sessionId

Test Coverage

  • 34+ new tests for access control and session isolation
  • 100% coverage on modified core files

Migration Notes

If you're using MCP memory tools, you'll need to update your calls to include sessionId:

// Before
await memory_store({ key: 'my-key', content: 'data' });

// After
await memory_store({ sessionId: 'your-session-id', key: 'my-key', content: 'data' });

Full Changelog: v1.5.1...v1.5.2

Assets 2
Loading