feat(memory): authorize scoped note access and durable cleanup (#9096)

* feat(memory): authorize scoped access and durable cleanup

* refactor(memory): distinguish scoped note access controls

Rename the scoped-note control kind from memory_access to
memory_notes_access so it is distinct from graph memory_scope. The HTTP
path, delegation audience sim:memory-access, and semantic operation id
are unchanged.

* chore(audits): exempt Mothership contract copies from the relative-import rule

contracts:sync copies these files byte for byte from the worker, whose
sibling imports are relative, so they cannot use the app's aliases.
Exempt only files in lib/mothership/generated that carry the sync header,
and drop their baseline entries.

* fix(memory): read-lock note authorization, redact legacy tool calls, skip keyless cleanup

Project note checks took the Project lock exclusively while already holding
it shared, so overlapping workspace checks could deadlock; they now read
under the shared Project lock and the permission-group read lock, as
Project Files does. Exports also redact remember calls stored in the
legacy top-level toolCalls list. A Sim without COPILOT_API_KEY never
reached a worker, so it queues no memory cleanup it could not deliver.

* test(memory): use the shared env and outbox mocks for cleanup enqueue

Author: mzxchandra

apps/sim/app/api/mothership/memories/access/route.ts

@@ -0,0 +1,25 @@
+import { resolveMemoryNotesAccessContract } from '@/lib/api/contracts/mothership-memories'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+} from '@/lib/api/server/routes'
+import { internalCopilotAuth } from '@/lib/mothership/auth/internal'
+import {
+  MEMORY_NOTES_ACCESS_AUDIENCE,
+  resolveMemoryNotesAccess,
+  resolveMemoryNotesAccessOperation,
+} from '@/lib/mothership/memories/application/resolve-access'
+
+export const POST = defineInternalJsonRoute({
+  contract: resolveMemoryNotesAccessContract,
+  auth: internalCopilotAuth(MEMORY_NOTES_ACCESS_AUDIENCE, { organization: true }),
+  operation: resolveMemoryNotesAccessOperation,
+  rateLimit: internalRateLimits.none({
+    reason:
+      'Private worker preflight rechecks live memory authority without reading or writing note content.',
+  }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: resolveMemoryNotesAccess,
+})

apps/sim/lib/api/contracts/mothership-assistant-tools.ts

@@ -404,12 +404,26 @@ export const listWorkspacesResultSchema = z.object({
   nextCursor: z.uuid().nullable(),
   storedNotes: z
     .array(
-      z.object({
-        id: z.string(),
-        kind: z.enum(['user_pref', 'workspace_fact']),
-        content: z.string(),
-        updatedAt: z.iso.datetime(),
-      })
+      z
+        .object({
+          id: z.string(),
+          content: z.string(),
+          updatedAt: z.iso.datetime(),
+          by: z.enum(['this user', 'another workspace member', 'another user']).optional(),
+          chat: z.enum(['this chat', 'another chat']).optional(),
+        })
+        .and(
+          z.union([
+            z.object({ kind: z.enum(['user_pref', 'workspace_fact']) }),
+            z.object({
+              scope: z.enum(['personal', 'project', 'workspace']),
+              visibility: z.enum(['private', 'shared']),
+              projectId: z.uuid().nullable(),
+              workspaceId: z.uuid().nullable(),
+              revision: z.number().int().positive(),
+            }),
+          ])
+        )
     )
     .optional(),
 })

apps/sim/lib/api/contracts/mothership-memories.ts

@@ -0,0 +1,12 @@
+import { defineRouteContract } from '@/lib/api/contracts/types'
+import {
+  MemoryNotesAccessInput,
+  MemoryNotesAccessResult,
+} from '@/lib/mothership/generated/memory-notes-access'
+
+export const resolveMemoryNotesAccessContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/mothership/memories/access',
+  body: MemoryNotesAccessInput,
+  response: { mode: 'json', schema: MemoryNotesAccessResult },
+})

apps/sim/lib/core/outbox/handlers.ts

@@ -33,6 +33,7 @@ import {
 import { KNOWLEDGE_DOCUMENT_RECOVERY_OUTBOX_EVENT } from '@/lib/knowledge/documents/processing-recovery-event'
 import { KNOWLEDGE_STORAGE_CLEANUP_EVENT } from '@/lib/knowledge/documents/storage-cleanup-event'
 import { INBOX_CLEANUP_EVENT } from '@/lib/mothership/inbox/cleanup-event'
+import { MEMORY_CLEANUP_EVENT } from '@/lib/mothership/memories/cleanup-event'
 import { ORGANIZATION_RESOURCE_CLEANUP_EVENT } from '@/lib/organizations/resource-cleanup-event'
 import {
   PROJECT_FILE_DOCUMENT_RETIRE_EVENT,
@@ -68,6 +69,15 @@ import { FORK_CONTENT_COPY_EVENT } from '@/ee/workspace-forking/application/cont
  * export of the module as used.
  */
 export const OUTBOX_HANDLER_GROUPS: readonly LazyOutboxHandlerGroup[] = [
+  {
+    events: [MEMORY_CLEANUP_EVENT],
+    load: async () => {
+      const { memoryCleanupOutboxHandlers } = await import(
+        '@/lib/mothership/memories/cleanup-outbox'
+      )
+      return memoryCleanupOutboxHandlers
+    },
+  },
   {
     events: [SLACK_SEARCH_TURN_EVENT],
     load: async () => {

apps/sim/lib/data-drains/sources/copilot-chats.ts

@@ -1,5 +1,7 @@
 import { copilotChats, copilotMessages } from '@sim/db/schema'
+import { isRecordLike, omit } from '@sim/utils/object'
 import { and, asc, eq, inArray, isNull, or, sql } from 'drizzle-orm'
+import { persistedContentBlockSchema } from '@/lib/api/contracts/copilot-messages'
 import { assertKnownSizeWithinLimit } from '@/lib/core/utils/stream-limits'
 import { DATA_DRAIN_LIMITS } from '@/lib/data-drains/limits'
 import {
@@ -11,6 +13,7 @@ import {
 } from '@/lib/data-drains/sources/cursor'
 import { readBoundedSourcePage, workspaceInOrganization } from '@/lib/data-drains/sources/helpers'
 import type { Cursor, DrainSource, SourcePageInput } from '@/lib/data-drains/types'
+import { stripToolResultOutput } from '@/lib/mothership/chat/persisted-message'
 
 /**
  * The transcript no longer lives on `copilot_chats.messages` — it is assembled
@@ -141,6 +144,47 @@ async function* pages(input: SourcePageInput): AsyncIterable<CopilotChatRow[]> {
   }
 }
 
+/** A message written before content blocks keeps its tool calls in a top-level `toolCalls` list. */
+function projectLegacyToolCall(call: unknown): unknown {
+  if (!isRecordLike(call) || call.name !== 'remember') return call
+  return {
+    name: 'remember',
+    ...(typeof call.id === 'string' ? { id: call.id } : {}),
+    ...(typeof call.status === 'string' ? { status: call.status } : {}),
+  }
+}
+
+/** Tool payloads can contain private notes even when their mutation failed or targeted a shared note. */
+function projectExportMessage(message: unknown): unknown {
+  if (!isRecordLike(message)) return message
+  const projected = Array.isArray(message.toolCalls)
+    ? { ...message, toolCalls: message.toolCalls.map(projectLegacyToolCall) }
+    : message
+  if (!Array.isArray(projected.contentBlocks)) return projected
+  return {
+    ...projected,
+    contentBlocks: projected.contentBlocks.map((block: unknown) => {
+      if (!isRecordLike(block) || !isRecordLike(block.toolCall)) return block
+      if (block.toolCall.name !== 'remember') {
+        if (!isRecordLike(block.toolCall.result) || !('output' in block.toolCall.result))
+          return block
+        const parsed = persistedContentBlockSchema.safeParse(block)
+        if (!parsed.success) return { ...block, toolCall: omit(block.toolCall, ['result']) }
+        const projected = stripToolResultOutput({ contentBlocks: [parsed.data] }).contentBlocks[0]
+        return { ...block, toolCall: { ...block.toolCall, result: projected.toolCall?.result } }
+      }
+      return {
+        type: 'tool',
+        toolCall: {
+          name: 'remember',
+          ...(typeof block.toolCall.id === 'string' ? { id: block.toolCall.id } : {}),
+          ...(typeof block.toolCall.state === 'string' ? { state: block.toolCall.state } : {}),
+        },
+      }
+    }),
+  }
+}
+
 export const copilotChatsSource: DrainSource<CopilotChatRow> = {
   type: 'copilot_chats',
   displayName: 'Chats',
@@ -153,7 +197,7 @@ export const copilotChatsSource: DrainSource<CopilotChatRow> = {
       workspaceId: row.workspaceId,
       type: row.type,
       title: row.title,
-      messages: row.messages,
+      messages: row.messages.map(projectExportMessage),
       model: row.model,
       conversationId: row.conversationId,
       previewYaml: row.previewYaml,

apps/sim/lib/data-drains/sources/coverage.integration.ts

@@ -113,6 +113,98 @@ describe('Drain source coverage and payload safety in PostgreSQL', () => {
     expect(runs).toEqual([runId])
   })
 
+  it('omits memory payloads from exports without changing owner history or visible replies', async () => {
+    const messageId = generateId()
+    const content = {
+      role: 'assistant',
+      content: 'Visible reply',
+      toolCalls: [
+        {
+          id: 'legacy',
+          name: 'remember',
+          status: 'success',
+          params: { content: 'hidden-memory-legacy-args' },
+          result: 'hidden-memory-legacy-result',
+          error: 'hidden-memory-legacy-error',
+        },
+        {
+          id: 'legacy-read',
+          name: 'read',
+          status: 'success',
+          params: { path: 'visible-legacy-path' },
+        },
+      ],
+      contentBlocks: [
+        { type: 'text', content: 'Visible reply' },
+        {
+          type: 'tool',
+          toolCall: {
+            id: 'discovery',
+            name: 'list_workspaces',
+            state: 'success',
+            result: {
+              success: true,
+              output: {
+                stdout: JSON.stringify({ storedNotes: [{ content: 'hidden-memory-discovery' }] }),
+              },
+            },
+          },
+        },
+        ...['private', 'shared', 'unknown'].map((visibility) => ({
+          type: 'tool',
+          content: 'hidden-memory-content',
+          error: 'hidden-memory-error',
+          toolCall: {
+            id: visibility,
+            name: 'remember',
+            state: 'success',
+            params: { visibility, content: 'hidden-memory-args' },
+            result: { success: true, output: 'hidden-memory-result' },
+            activityDescription: 'hidden-memory-activity',
+            display: { title: 'hidden-memory-title' },
+          },
+        })),
+        {
+          type: 'tool',
+          toolCall: {
+            id: 'other',
+            name: 'read',
+            state: 'success',
+            params: { path: 'visible-path' },
+          },
+        },
+      ],
+    }
+    await runtime.db.insert(runtime.schema.copilotMessages).values({
+      id: messageId,
+      messageId,
+      chatId,
+      role: 'assistant',
+      content,
+      createdAt: old,
+    })
+    try {
+      const exported: unknown[] = []
+      for await (const rows of runtime.copilotChatsSource.pages(input())) {
+        exported.push(...rows.map((row) => runtime.copilotChatsSource.serialize(row)))
+      }
+      const wire = JSON.stringify(exported)
+      expect(wire).not.toContain('hidden-memory')
+      expect(wire).toContain('Visible reply')
+      expect(wire).toContain('visible-path')
+      expect(wire).toContain('visible-legacy-path')
+      const [stored] = await runtime.db
+        .select({ content: runtime.schema.copilotMessages.content })
+        .from(runtime.schema.copilotMessages)
+        .where(runtime.eq(runtime.schema.copilotMessages.id, messageId))
+      expect(stored.content).toEqual(content)
+    } finally {
+      await runtime.db
+        .delete(runtime.schema.copilotMessages)
+        .where(runtime.eq(runtime.schema.copilotMessages.id, messageId))
+    }
+  })
+
   it('exports correlation metadata without internal controller tokens or billing receipts', async () => {
     const [row] = await runtime.db
       .select()

apps/sim/lib/mothership/chat/persisted-message.ts

@@ -141,7 +141,9 @@ export interface PersistedMessage {
  * reference when there is nothing to strip, preserving memoized identity for
  * read-side consumers.
  */
-export function stripToolResultOutput(message: PersistedMessage): PersistedMessage {
+export function stripToolResultOutput<T extends Pick<PersistedMessage, 'contentBlocks'>>(
+  message: T
+): T {
   if (!message.contentBlocks?.length) return message
   let changed = false
   const contentBlocks = message.contentBlocks.map((block) => {

apps/sim/lib/mothership/generated/memory-notes-access.ts

@@ -0,0 +1,58 @@
+// GENERATED — do not edit. Source of truth: mothership worker packages/contracts/src/memory-notes-access.ts
+// Regenerate with `bun run contracts:sync` in the worker.
+
+import { z } from "zod";
+
+const permissionsSchema = z.strictObject({
+  read: z.literal(true),
+  privateMutation: z.literal(true),
+  sharedMutation: z.boolean(),
+});
+const projectSchema = z.strictObject({
+  scope: z.literal("project"),
+  id: z.uuid(),
+  name: z.string(),
+  permissions: permissionsSchema,
+});
+
+export const MemoryNotesAccessInput = z.strictObject({
+  target: z.discriminatedUnion("scope", [
+    z.strictObject({ scope: z.literal("personal") }),
+    z.strictObject({ scope: z.literal("workspace"), workspaceId: z.uuid() }),
+    z.strictObject({ scope: z.literal("project"), projectId: z.uuid() }),
+  ]),
+  action: z.enum(["read", "private_mutation", "shared_mutation"]),
+});
+export type MemoryNotesAccessInput = z.infer<typeof MemoryNotesAccessInput>;
+
+export const MemoryNotesAccessResult = z.strictObject({
+  success: z.literal(true),
+  version: z.literal(1),
+  actor: z.strictObject({ userId: z.string().min(1), chatId: z.uuid() }),
+  target: z.discriminatedUnion("scope", [
+    z.strictObject({
+      scope: z.literal("personal"),
+      permissions: permissionsSchema.extend({ sharedMutation: z.literal(false) }),
+    }),
+    projectSchema,
+    z.strictObject({
+      scope: z.literal("workspace"),
+      id: z.uuid(),
+      name: z.string(),
+      permissions: permissionsSchema,
+      currentProject: projectSchema.nullable(),
+    }),
+  ]),
+});
+export type MemoryNotesAccessResult = z.infer<typeof MemoryNotesAccessResult>;
+
+export const MemoryCleanupInput = z.strictObject({
+  version: z.literal(1),
+  target: z.discriminatedUnion("kind", [
+    z.strictObject({ kind: z.literal("private_owner"), userId: z.string().min(1).max(200) }),
+    z.strictObject({ kind: z.literal("workspace"), workspaceId: z.uuid() }),
+    z.strictObject({ kind: z.literal("project"), projectId: z.uuid() }),
+  ]),
+});
+export type MemoryCleanupInput = z.infer<typeof MemoryCleanupInput>;
+export const MemoryCleanupResult = z.strictObject({ success: z.literal(true) });

apps/sim/lib/mothership/generated/sim-assistant-tools.generated.ts

@@ -424,12 +424,26 @@ export const listWorkspacesResultSchema = z.object({
   nextCursor: z.uuid().nullable(),
   storedNotes: z
     .array(
-      z.object({
-        id: z.string(),
-        kind: z.enum(['user_pref', 'workspace_fact']),
-        content: z.string(),
-        updatedAt: z.iso.datetime(),
-      })
+      z
+        .object({
+          id: z.string(),
+          content: z.string(),
+          updatedAt: z.iso.datetime(),
+          by: z.enum(['this user', 'another workspace member', 'another user']).optional(),
+          chat: z.enum(['this chat', 'another chat']).optional(),
+        })
+        .and(
+          z.union([
+            z.object({ kind: z.enum(['user_pref', 'workspace_fact']) }),
+            z.object({
+              scope: z.enum(['personal', 'project', 'workspace']),
+              visibility: z.enum(['private', 'shared']),
+              projectId: z.uuid().nullable(),
+              workspaceId: z.uuid().nullable(),
+              revision: z.number().int().positive(),
+            }),
+          ])
+        )
     )
     .optional(),
 })

apps/sim/lib/mothership/generated/sim-transport.ts

@@ -3,6 +3,7 @@
 
 import { z } from "zod";
 import { IntegrationCatalogRequest } from "./integration-catalog";
+import { MemoryNotesAccessInput } from "./memory-notes-access";
 import { MemoryScopeRequest } from "./memory-scope";
 import { RunControlRequest } from "./run-control";
 import { TaskWakeRequest, WorkflowWatchRequest } from "./tasks";
@@ -29,6 +30,7 @@ export type SimScope = z.infer<typeof SimScope>;
 
 /** Only idempotent controls use the idle channel; tool effects use the run event log. */
 export const SimControlOperation = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("memory_notes_access"), input: MemoryNotesAccessInput }),
   z.object({ kind: z.literal("memory_scope"), input: MemoryScopeRequest }),
   z.object({ kind: z.literal("run_control"), input: RunControlRequest }),
   z.object({ kind: z.literal("workflow_status"), input: WorkflowWatchRequest }),