fix(memory): pass user_id through prefetch + scope per-user — Codex PR#33 P1

[dizhaky]

Summary

• Pass user_id through prefetch_all and all provider prefetch() calls, enabling per-user memory scoping
• Update MemoryProvider base class and all 9 plugins (mem0, honcho, hindsight, memgw, holographic, retaindb, supermemory, openviking, byterover) with the user_id parameter
• Scope memgw prefetch results by user_id so cross-user memory contamination is impossible
• Refresh agent identity on cached-agent reuse (Codex P1 finding)

Supersedes #36 (was behind main after #37 merged; rebased onto latest main).

Fixes DAN-xxx — Codex PR#33 P1 cross-user identity + prefetch scoping.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes identity and memory scoping on shared sessions and prefetch caches; incorrect user_id handling could leak or mis-attribute memories, though the memgw guard and gateway refresh directly target that risk.

Overview
Per-user memory prefetch now threads user_id from the agent through MemoryManager.prefetch_all() into every memory provider’s prefetch() hook, so recall can be scoped to the current caller instead of sharing one anonymous session.

On gateway cached-agent reuse, caller identity (_user_id, names, chat/thread ids) is refreshed each turn so shared-thread sessions (thread_sessions_per_user=False) don’t keep serving the previous user’s identity into memory or the loop.

memgw tags background prefetch results with the requesting user_id and drops cached prefetch when a different user reads it, blocking cross-user context leaks. mem0 sync_turn writes with user_id from the turn (or the configured default) via explicit user_id/agent_id on client.add.

^{Reviewed by Cursor Bugbot for commit 16e73b0. Configure here.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

🔎 Lint report: dan/codex-p1-memory-scoping vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 8649 on HEAD, 8649 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 4570 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[dizhaky]

Closing: all commits were unsigned (cursor-agent origin). Replacing with a single signed squash commit in #41.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Mem0 sync prefetch scope split
  • Mem0 queue_prefetch now searches with the runtime effective_user_id and tags cached results so prefetch() discards buffers from a different user.
• ✅ Fixed: Memgw prefetch discard skips empty
  • Memgw prefetch now discards cached results whenever _prefetch_result_user != user_id, including when the requesting user_id is an empty string.

Or push these changes by commenting:

@cursor push bcf492821a

Preview (bcf492821a)

diff --git a/plugins/memory/mem0/__init__.py b/plugins/memory/mem0/__init__.py
--- a/plugins/memory/mem0/__init__.py
+++ b/plugins/memory/mem0/__init__.py
@@ -128,6 +128,7 @@
         self._agent_id = "hermes"
         self._rerank = True
         self._prefetch_result = ""
+        self._prefetch_result_user: str = ""
         self._prefetch_lock = threading.Lock()
         self._prefetch_thread = None
         self._sync_thread = None
@@ -235,11 +236,16 @@
         )
 
     def prefetch(self, query: str, *, session_id: str = "", user_id: str = "") -> str:
+        effective_user_id = user_id or self._user_id
         if self._prefetch_thread and self._prefetch_thread.is_alive():
             self._prefetch_thread.join(timeout=3.0)
         with self._prefetch_lock:
+            if self._prefetch_result_user != effective_user_id:
+                self._prefetch_result = ""
+                self._prefetch_result_user = ""
             result = self._prefetch_result
             self._prefetch_result = ""
+            self._prefetch_result_user = ""
         if not result:
             return ""
         return f"## Mem0 Memory\n{result}"
@@ -248,12 +254,14 @@
         if self._is_breaker_open():
             return
 
+        effective_user_id = user_id or self._user_id
+
         def _run():
             try:
                 client = self._get_client()
                 results = self._unwrap_results(client.search(
                     query=query,
-                    filters=self._read_filters(),
+                    filters={"user_id": effective_user_id},
                     rerank=self._rerank,
                     top_k=5,
                 ))
@@ -261,6 +269,7 @@
                     lines = [r.get("memory", "") for r in results if r.get("memory")]
                     with self._prefetch_lock:
                         self._prefetch_result = "\n".join(f"- {l}" for l in lines)
+                        self._prefetch_result_user = effective_user_id
                 self._record_success()
             except Exception as e:
                 self._record_failure()

diff --git a/plugins/memory/memgw/__init__.py b/plugins/memory/memgw/__init__.py
--- a/plugins/memory/memgw/__init__.py
+++ b/plugins/memory/memgw/__init__.py
@@ -290,7 +290,7 @@
             self._prefetch_thread.join(timeout=3.0)
         with self._prefetch_lock:
             # Discard a result queued for a different user to prevent cross-user leak.
-            if user_id and self._prefetch_result_user and self._prefetch_result_user != user_id:
+            if self._prefetch_result_user != user_id:
                 self._prefetch_result = ''
                 self._prefetch_result_user = ''
             result = self._prefetch_result

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 16e73b0. Configure here.}

[cursor]

Mem0 sync prefetch scope split

High Severity

When a memgw agent is reused, queue_prefetch may perform memory recall using a stale self._user_id (from agent initialization) instead of the current user_id provided. This can lead to a user receiving prefetched memory content belonging to a different user, as the prefetch guard checks the intended user for the result, not the user actually used for the recall.

Additional Locations (1)

• plugins/memory/memgw/__init__.py#L287-L301

 

^{Reviewed by Cursor Bugbot for commit 16e73b0. Configure here.}

[dizhaky]

Addressed in subsequent merged PRs:

• PR fix(memory): pass user_id through prefetch + scope per-user (Codex PR#33 P1) #41 (fix(memory): pass user_id through prefetch + scope per-user) — queue_prefetch now receives and forwards the per-turn user_id.
• PR fix(mem0): scope prefetch search and result cache by user_id #44 (fix(mem0): scope prefetch search and result cache by user_id) — both Mem0 and memgw queue_prefetch use the kwarg user_id for their search/recall, not self._user_id.

This PR (#39) was superseded by #41 and closed without merging.

Reviewed and confirmed by Claude Code.

---

Generated by Claude Code

[cursor]

Memgw prefetch discard skips empty

Medium Severity

The new cross-user prefetch guard only clears cached results when both the current user_id and _prefetch_result_user are truthy. If the active turn has an empty user_id, a buffer tagged for another user can still be returned from prefetch().

 

^{Reviewed by Cursor Bugbot for commit 16e73b0. Configure here.}

[dizhaky]

Addressed in PR #44 (fix(mem0): scope prefetch search and result cache by user_id): the guard now also discards cached results when user_id is empty or falsy (or not cached[1]), preventing a stale result from leaking into an anonymous/empty-user turn.

Reviewed and confirmed by Claude Code.

---

Generated by Claude Code