ci: ensure python 3.14 compatibility

.github/workflows/release.yml

@@ -340,7 +340,6 @@ jobs:
         retention-days: 1
 
   release-docker-images:
-    name: Release Docker (${{ matrix.image_name }}${{ matrix.tag_suffix }})
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -350,28 +349,10 @@ jobs:
         include:
           - target: api-only
             image_name: hindsight-api
-            tag_suffix: ""
-            build_args: ""
-          - target: api-only
-            image_name: hindsight-api
-            tag_suffix: "-slim"
-            build_args: |
-              INCLUDE_LOCAL_MODELS=false
-              PRELOAD_ML_MODELS=false
           - target: cp-only
             image_name: hindsight-control-plane
-            tag_suffix: ""
-            build_args: ""
           - target: standalone
             image_name: hindsight
-            tag_suffix: ""
-            build_args: ""
-          - target: standalone
-            image_name: hindsight
-            tag_suffix: "-slim"
-            build_args: |
-              INCLUDE_LOCAL_MODELS=false
-              PRELOAD_ML_MODELS=false
 
     steps:
     - uses: actions/checkout@v4
@@ -409,9 +390,6 @@ jobs:
       uses: docker/metadata-action@v5
       with:
         images: ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}
-        flavor: |
-          latest=auto
-          suffix=${{ matrix.tag_suffix }}
         tags: |
           type=semver,pattern={{version}},value=${{ steps.get_version.outputs.VERSION }}
           type=semver,pattern={{major}}.{{minor}},value=${{ steps.get_version.outputs.VERSION }}
@@ -437,7 +415,7 @@ jobs:
     # - name: Smoke test - verify container starts
     #   env:
     #     GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
-    #   run: ./docker/test-image.sh "${{ matrix.image_name }}:test" "${{ matrix.target }}"
+    #   run: ./scripts/docker-smoke-test.sh "${{ matrix.image_name }}:test" "${{ matrix.target }}"
 
     # Build multi-platform and push to release tags
     - name: Build and push release images
@@ -446,7 +424,6 @@ jobs:
         context: .
         file: docker/standalone/Dockerfile
         target: ${{ matrix.target }}
-        build-args: ${{ matrix.build_args }}
         push: true
         platforms: linux/amd64,linux/arm64
         tags: ${{ steps.meta.outputs.tags }}

.github/workflows/test.yml

@@ -277,35 +277,16 @@ jobs:
       run: helm lint helm/hindsight
 
   build-docker-images:
-    name: Build Docker (${{ matrix.name }})
     runs-on: ubuntu-latest
     strategy:
       matrix:
         include:
           - target: api-only
             name: api
-            variant: full
-            build_args: ""
-          - target: api-only
-            name: api-slim
-            variant: slim
-            build_args: |
-              INCLUDE_LOCAL_MODELS=false
-              PRELOAD_ML_MODELS=false
           - target: cp-only
             name: control-plane
-            variant: full
-            build_args: ""
           - target: standalone
             name: standalone
-            variant: full
-            build_args: ""
-          - target: standalone
-            name: standalone-slim
-            variant: slim
-            build_args: |
-              INCLUDE_LOCAL_MODELS=false
-              PRELOAD_ML_MODELS=false
 
     steps:
     - uses: actions/checkout@v4
@@ -324,31 +305,20 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Build ${{ matrix.name }} image (${{ matrix.variant }})
+    - name: Build ${{ matrix.name }} image
       uses: docker/build-push-action@v6
       with:
         context: .
         file: docker/standalone/Dockerfile
         target: ${{ matrix.target }}
-        build-args: ${{ matrix.build_args }}
         push: false
-        load: ${{ matrix.variant == 'slim' }}
-        tags: hindsight-${{ matrix.name }}:test
-        # Removed GitHub Actions cache (type=gha) - it frequently returns 502 errors
-        # causing buildx to fail with "failed to parse error response 502"
-        # Build will be slower but more reliable
+        load: false
 
-    # Only test slim variants to save disk space (they're much smaller)
-    # Slim variants require external embedding providers
-    - name: Smoke test - verify container starts
-      if: matrix.variant == 'slim'
-      env:
-        GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
-        HINDSIGHT_API_EMBEDDINGS_PROVIDER: openai
-        HINDSIGHT_API_EMBEDDINGS_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        HINDSIGHT_API_RERANKER_PROVIDER: cohere
-        HINDSIGHT_API_COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
-      run: ./docker/test-image.sh "hindsight-${{ matrix.name }}:test" "${{ matrix.target }}"
+    # TODO: Re-enable smoke test when disk space issue is resolved
+    # - name: Smoke test - verify container starts
+    #   env:
+    #     GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
+    #   run: ./scripts/docker-smoke-test.sh "hindsight-${{ matrix.name }}:test" "${{ matrix.target }}"
 
   test-api:
     runs-on: ubuntu-latest

README.md

@@ -48,35 +48,21 @@ If you need more control over how and when your agent stores and recalls memorie
 ### Docker (recommended)
 
 ```bash
-export OPENAI_API_KEY=sk-xxx
+export OPENAI_API_KEY=your-key
 
 docker run --rm -it --pull always -p 8888:8888 -p 9999:9999 \
   -e HINDSIGHT_API_LLM_API_KEY=$OPENAI_API_KEY \
+  -e HINDSIGHT_API_LLM_MODEL=o3-mini \
   -v $HOME/.hindsight-docker:/home/hindsight/.pg0 \
   ghcr.io/vectorize-io/hindsight:latest
 ```
 
->API: http://localhost:8888
->UI: http://localhost:9999
-
 You can modify the LLM provider by setting `HINDSIGHT_API_LLM_PROVIDER`. Valid options are `openai`, `anthropic`, `gemini`, `groq`, `ollama`, and `lmstudio`. The documentation provides more details on [supported models](https://hindsight.vectorize.io/developer/models).
 
+API: http://localhost:8888  
+UI: http://localhost:9999
 
-
-### Docker (external PostgreSQL)
-
-```bash
-export OPENAI_API_KEY=sk-xxx
-export HINDSIGHT_DB_PASSWORD=choose-a-password
-cd docker/docker-compose
-docker compose up 
-```
-
-
->API: http://localhost:8888
->UI: http://localhost:9999
-
-### Client
+Install client:
 
 ```bash
 pip install hindsight-client -U
@@ -84,7 +70,7 @@ pip install hindsight-client -U
 npm install @vectorize-io/hindsight-client
 ```
 
-#### Python
+Python example:
 
 ```python
 from hindsight_client import Hindsight
@@ -101,29 +87,7 @@ client.recall(bank_id="my-bank", query="What does Alice do?")
 client.reflect(bank_id="my-bank", query="Tell me about Alice")
 ```
 
-#### Node.js / TypeScript
-
-```bash
-npm install @vectorize-io/hindsight-client
-```
-
-```javascript
-const { HindsightClient } = require('@vectorize-io/hindsight-client');
-
-const main = async () => {
-  const client = new HindsightClient({ baseUrl: 'http://localhost:8888' });
-
-  await client.retain('my-bank', 'Alice loves hiking in Yosemite');
-
-  const results = await client.recall('my-bank', 'What does Alice like?');
-  console.log(results);
-}
-
-main();
-```
-
-
-### Python Embedded (no server required)
+### Python (embedded, no Docker)
 
 ```bash
 pip install hindsight-all -U
@@ -143,6 +107,20 @@ with HindsightServer(
     results = client.recall(bank_id="my-bank", query="Where does Alice work?")
 ```
 
+### Node.js / TypeScript
+
+```bash
+npm install @vectorize-io/hindsight-client
+```
+
+```javascript
+const { HindsightClient } = require('@vectorize-io/hindsight-client');
+
+const client = new HindsightClient({ baseUrl: 'http://localhost:8888' });
+
+await client.retain('my-bank', 'Alice loves hiking in Yosemite');
+await client.recall('my-bank', 'What does Alice like?');
+```
 
 ---
 

docker/docker-compose/docker-compose.yaml

@@ -1,54 +0,0 @@
-# Docker Compose file for Hindsight with PostgreSQL and pgvector
-#
-# Make sure to set the required environment variables before running:
-# - HINDSIGHT_DB_PASSWORD: Password for the PostgreSQL user
-# - Configure LLM provider variables as needed (see below in the hindsight service)
-#
-# Usage:
-# docker compose up -d
-#
-# Optional environment variables with defaults:
-# - HINDSIGHT_VERSION: Hindsight application version (default: latest)
-# - HINDSIGHT_DB_USER: PostgreSQL user (default: hindsight_user)
-# - HINDSIGHT_DB_NAME: PostgreSQL database name (default: hindsight_db)
-# - HINDSIGHT_DB_VERSION: PostgreSQL version (default: 18)
-
-services:
-  db:
-    # Use a PostgreSQL-Image with pgvector extension pre-installed
-    # see https://hub.docker.com/r/pgvector/pgvector 
-    image: pgvector/pgvector:pg${HINDSIGHT_DB_VERSION:-18}
-    container_name: hindsight-db
-    restart: always
-    # Expose PostgreSQL port
-    # ports:
-      # - "5432:5432"
-    environment:
-      POSTGRES_USER: ${HINDSIGHT_DB_USER:-hindsight_user}
-      POSTGRES_PASSWORD: ${HINDSIGHT_DB_PASSWORD:?Please set the HINDSIGHT_DB_PASSWORD env variable}
-      POSTGRES_DB: ${HINDSIGHT_DB_NAME:-hindsight_db}
-    volumes:
-      - pg_data:/var/lib/postgresql/${HINDSIGHT_DB_VERSION:-18}/docker
-    networks:
-      - hindsight-net
-
-  hindsight:
-    image: ghcr.io/vectorize-io/hindsight:${HINDSIGHT_VERSION:-latest}
-    container_name: hindsight-app
-    ports:
-      - "8888:8888"
-      - "9999:9999"
-    environment:
-      - HINDSIGHT_API_LLM_API_KEY=${OPENAI_API_KEY?Please set the OPENAI_API_KEY env variable}
-      - HINDSIGHT_API_DATABASE_URL=postgresql://${HINDSIGHT_DB_USER:-hindsight_user}:${HINDSIGHT_DB_PASSWORD:?Please set the HINDSIGHT_DB_PASSWORD env variable}@db:5432/${HINDSIGHT_DB_NAME:-hindsight_db}
-    depends_on:
-      - db
-    networks:
-      - hindsight-net
-
-networks:
-  hindsight-net:
-    driver: bridge
-
-volumes:
-  pg_data:

docker/test-slim-local.sh

@@ -1,51 +0,0 @@
-#!/bin/bash
-#
-# Local Test Script for Slim Docker Images
-#
-# This script makes it easy to test slim images locally with external providers.
-# It expects API keys to be set in environment variables.
-#
-# Usage:
-#   export GROQ_API_KEY=gsk_xxx
-#   export OPENAI_API_KEY=sk-xxx
-#   export COHERE_API_KEY=xxx
-#   ./docker/test-slim-local.sh
-#
-# Or inline:
-#   GROQ_API_KEY=gsk_xxx OPENAI_API_KEY=sk_xxx COHERE_API_KEY=xxx ./docker/test-slim-local.sh
-#
-
-set -euo pipefail
-
-# Check for required API keys
-if [ -z "${GROQ_API_KEY:-}" ]; then
-    echo "❌ Error: GROQ_API_KEY environment variable is required"
-    echo "Set it with: export GROQ_API_KEY=gsk_xxx"
-    exit 1
-fi
-
-if [ -z "${OPENAI_API_KEY:-}" ]; then
-    echo "❌ Error: OPENAI_API_KEY environment variable is required"
-    echo "Set it with: export OPENAI_API_KEY=sk-xxx"
-    exit 1
-fi
-
-if [ -z "${COHERE_API_KEY:-}" ]; then
-    echo "❌ Error: COHERE_API_KEY environment variable is required"
-    echo "Set it with: export COHERE_API_KEY=xxx"
-    exit 1
-fi
-
-# Configuration
-IMAGE="${1:-hindsight-slim:test}"
-echo "Testing image: $IMAGE"
-echo ""
-
-# Set up external providers
-export HINDSIGHT_API_EMBEDDINGS_PROVIDER=openai
-export HINDSIGHT_API_EMBEDDINGS_OPENAI_API_KEY=$OPENAI_API_KEY
-export HINDSIGHT_API_RERANKER_PROVIDER=cohere
-export HINDSIGHT_API_COHERE_API_KEY=$COHERE_API_KEY
-
-# Run the test
-exec "$(dirname "$0")/test-image.sh" "$IMAGE" standalone

helm/hindsight/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: hindsight
 description: Hindsight helm chart
 type: application
-version: 0.4.10
-appVersion: "0.4.10"
+version: 0.4.9
+appVersion: "0.4.9"
 keywords:
   - ai
   - memory

helm/hindsight/templates/api-deployment.yaml

@@ -33,7 +33,7 @@ spec:
       - name: api
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: "{{ .Values.api.image.repository }}:{{ .Values.api.image.tag | default .Values.version | default .Chart.AppVersion }}"
+        image: "{{ .Values.api.image.repository }}:{{ .Values.api.image.tag | default .Values.version }}"
         imagePullPolicy: {{ .Values.api.image.pullPolicy }}
         ports:
         - name: http
@@ -60,9 +60,6 @@ spec:
         - name: HINDSIGHT_API_WORKER_ENABLED
           value: "false"
         {{- end }}
-        {{- /* Explicitly set port to override K8s service discovery env var (HINDSIGHT_API_PORT) */}}
-        - name: HINDSIGHT_API_PORT
-          value: {{ .Values.api.service.targetPort | quote }}
         {{- range $key, $value := .Values.api.env }}
         - name: {{ $key }}
           value: {{ $value | quote }}

helm/hindsight/templates/controlplane-deployment.yaml

@@ -33,7 +33,7 @@ spec:
       - name: control-plane
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: "{{ .Values.controlPlane.image.repository }}:{{ .Values.controlPlane.image.tag | default .Values.version | default .Chart.AppVersion }}"
+        image: "{{ .Values.controlPlane.image.repository }}:{{ .Values.controlPlane.image.tag | default .Values.version }}"
         imagePullPolicy: {{ .Values.controlPlane.image.pullPolicy }}
         ports:
         - name: http

helm/hindsight/templates/worker-statefulset.yaml

@@ -32,7 +32,7 @@ spec:
       - name: worker
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: "{{ .Values.worker.image.repository }}:{{ .Values.worker.image.tag | default .Values.version | default .Chart.AppVersion }}"
+        image: "{{ .Values.worker.image.repository }}:{{ .Values.worker.image.tag | default .Values.version }}"
         imagePullPolicy: {{ .Values.worker.image.pullPolicy }}
         command: ["hindsight-worker"]
         ports:

helm/hindsight/values.yaml

@@ -1,8 +1,7 @@
 # Default values for hindsight
 
-# Global version override - use this to set a consistent image tag across all components
-# If not set, defaults to Chart.appVersion from Chart.yaml
-# version: ""
+# Chart version - use this to set a consistent image tag across all components
+version: "0.1.1"
 
 # Use an existing secret instead of creating one from values
 # When set, all keys from this secret are injected as environment variables via envFrom
@@ -76,7 +75,7 @@ worker:
   image:
     repository: ghcr.io/vectorize-io/hindsight-api
     pullPolicy: IfNotPresent
-    # tag: ""  # defaults to .Values.version, then Chart.appVersion if not specified
+    # tag defaults to .Values.version if not specified
 
   service:
     # Service for metrics scraping (headless for StatefulSet)

hindsight-api/hindsight_api/__init__.py

@@ -46,4 +46,4 @@ __all__ = [
     "RemoteTEICrossEncoder",
     "LLMConfig",
 ]
-__version__ = "0.4.10"
+__version__ = "0.4.9"

hindsight-api/hindsight_api/alembic/versions/w8r9s0t1u2v3_fix_mental_models_pk_isolation.py

@@ -1,60 +0,0 @@
-"""Fix mental_models primary key to be scoped per bank
-
-Revision ID: w8r9s0t1u2v3
-Revises: v7q8r9s0t1u2
-Create Date: 2026-02-05
-
-This migration fixes a critical bank isolation bug where mental_models.id was
-globally unique across all banks instead of being scoped per bank. This caused
-conflicts when different banks tried to use the same custom ID.
-
-CRITICAL FIX: Changes primary key from (id) to (bank_id, id) to ensure proper isolation.
-"""
-
-from collections.abc import Sequence
-
-from alembic import context, op
-
-revision: str = "w8r9s0t1u2v3"
-down_revision: str | Sequence[str] | None = "v7q8r9s0t1u2"
-branch_labels: str | Sequence[str] | None = None
-depends_on: str | Sequence[str] | None = None
-
-
-def _get_schema_prefix() -> str:
-    """Get schema prefix for table names (required for multi-tenant support)."""
-    schema = context.config.get_main_option("target_schema")
-    return f'"{schema}".' if schema else ""
-
-
-def upgrade() -> None:
-    """Change mental_models primary key from (id) to (bank_id, id) for proper bank isolation."""
-    schema = _get_schema_prefix()
-
-    # Drop the old primary key constraint (just id)
-    # Note: The constraint might be named differently on different DBs
-    # Try both old names (pinned_reflections_pkey from original, mental_models_pkey from rename)
-    op.execute(f"ALTER TABLE {schema}mental_models DROP CONSTRAINT IF EXISTS pinned_reflections_pkey")
-    op.execute(f"ALTER TABLE {schema}mental_models DROP CONSTRAINT IF EXISTS mental_models_pkey")
-
-    # Create the new composite primary key (bank_id, id)
-    # This ensures IDs are scoped per bank, not globally
-    op.execute(f"""
-        ALTER TABLE {schema}mental_models
-        ADD CONSTRAINT mental_models_pkey PRIMARY KEY (bank_id, id)
-    """)
-
-
-def downgrade() -> None:
-    """Revert mental_models primary key from (bank_id, id) to (id)."""
-    schema = _get_schema_prefix()
-
-    # Drop the composite primary key
-    op.execute(f"ALTER TABLE {schema}mental_models DROP CONSTRAINT IF EXISTS mental_models_pkey")
-
-    # Restore the old primary key (just id)
-    # WARNING: This downgrade will fail if there are duplicate IDs across banks
-    op.execute(f"""
-        ALTER TABLE {schema}mental_models
-        ADD CONSTRAINT mental_models_pkey PRIMARY KEY (id)
-    """)

hindsight-api/hindsight_api/api/__init__.py

@@ -72,24 +72,22 @@ def create_app(
 
     # Mount MCP server and chain its lifespan if enabled
     if mcp_app is not None:
-        # Get both MCP apps' underlying Starlette apps for lifespan access
-        multi_bank_starlette_app = mcp_app.multi_bank_app
-        single_bank_starlette_app = mcp_app.single_bank_app
+        # Get the MCP app's underlying Starlette app for lifespan access
+        mcp_starlette_app = mcp_app.mcp_app
 
         # Store the original lifespan
         original_lifespan = app.router.lifespan_context
 
         @asynccontextmanager
         async def chained_lifespan(app_instance: FastAPI):
-            """Chain both MCP lifespans with the main app lifespan."""
-            # Start both MCP lifespans (multi-bank and single-bank)
-            async with multi_bank_starlette_app.router.lifespan_context(multi_bank_starlette_app):
-                async with single_bank_starlette_app.router.lifespan_context(single_bank_starlette_app):
-                    logger.info("MCP lifespans started (multi-bank and single-bank)")
-                    # Then start the original app lifespan
-                    async with original_lifespan(app_instance):
-                        yield
-                logger.info("MCP lifespans stopped")
+            """Chain the MCP lifespan with the main app lifespan."""
+            # Start MCP lifespan first
+            async with mcp_starlette_app.router.lifespan_context(mcp_starlette_app):
+                logger.info("MCP lifespan started")
+                # Then start the original app lifespan
+                async with original_lifespan(app_instance):
+                    yield
+            logger.info("MCP lifespan stopped")
 
         # Replace the app's lifespan with the chained version
         app.router.lifespan_context = chained_lifespan

hindsight-api/hindsight_api/api/http.py

@@ -523,9 +523,7 @@ class ReflectFact(BaseModel):
     )
 
     id: str | None = None
-    text: str = Field(
-        description="Fact text. When type='observation', this contains markdown-formatted consolidated knowledge"
-    )
+    text: str
     type: str | None = None  # fact type: world, experience, observation
     context: str | None = None
     occurred_start: str | None = None
@@ -590,7 +588,7 @@ class ReflectResponse(BaseModel):
     model_config = ConfigDict(
         json_schema_extra={
             "example": {
-                "text": "## AI Overview\n\nBased on my understanding, AI is a **transformative technology**:\n\n- Used extensively in healthcare\n- Discussed in recent conversations\n- Continues to evolve rapidly",
+                "text": "Based on my understanding, AI is a transformative technology...",
                 "based_on": {
                     "memories": [
                         {"id": "123", "text": "AI is used in healthcare", "type": "world"},
@@ -618,9 +616,7 @@ class ReflectResponse(BaseModel):
         }
     )
 
-    text: str = Field(
-        description="The reflect response as well-formatted markdown (headers, lists, bold/italic, code blocks, etc.)"
-    )
+    text: str
     based_on: ReflectBasedOn | None = Field(
         default=None,
         description="Evidence used to generate the response. Only present when include.facts is set.",
@@ -1118,9 +1114,7 @@ class MentalModelResponse(BaseModel):
     bank_id: str
     name: str
     source_query: str
-    content: str = Field(
-        description="The mental model content as well-formatted markdown (auto-generated from reflect endpoint)"
-    )
+    content: str
     tags: list[str] = Field(default_factory=list)
     max_tokens: int = Field(default=2048)
     trigger: MentalModelTrigger = Field(default_factory=MentalModelTrigger)
@@ -1432,12 +1426,6 @@ def create_app(
             poller_task = asyncio.create_task(poller.run())
             logging.info(f"Worker poller started (worker_id={worker_id})")
 
-        # Call tenant extension startup hook (e.g. JWKS fetch for Supabase)
-        tenant_extension = memory.tenant_extension
-        if tenant_extension:
-            await tenant_extension.on_startup()
-            logging.info("Tenant extension started")
-
         # Call HTTP extension startup hook
         if http_extension:
             await http_extension.on_startup()
@@ -1456,11 +1444,6 @@ def create_app(
                     pass
             logging.info("Worker poller stopped")
 
-        # Call tenant extension shutdown hook
-        if tenant_extension:
-            await tenant_extension.on_shutdown()
-            logging.info("Tenant extension stopped")
-
         # Call HTTP extension shutdown hook
         if http_extension:
             await http_extension.on_shutdown()

hindsight-api/hindsight_api/api/mcp.py

@@ -8,11 +8,7 @@ from contextvars import ContextVar
 from fastmcp import FastMCP
 
 from hindsight_api import MemoryEngine
-from hindsight_api.engine.memory_engine import _current_schema
-from hindsight_api.extensions import MCPExtension, load_extension
-from hindsight_api.extensions.tenant import AuthenticationError
 from hindsight_api.mcp_tools import MCPToolsConfig, register_mcp_tools
-from hindsight_api.models import RequestContext
 
 # Configure logging from HINDSIGHT_API_LOG_LEVEL environment variable
 _log_level_str = os.environ.get("HINDSIGHT_API_LOG_LEVEL", "info").lower()
@@ -33,8 +29,7 @@ logger = logging.getLogger(__name__)
 # Default bank_id from environment variable
 DEFAULT_BANK_ID = os.environ.get("HINDSIGHT_MCP_BANK_ID", "default")
 
-# Legacy MCP authentication token (for backwards compatibility)
-# If set, this token is checked first before TenantExtension auth
+# MCP authentication token (optional - if set, Bearer token auth is required)
 MCP_AUTH_TOKEN = os.environ.get("HINDSIGHT_API_MCP_AUTH_TOKEN")
 
 # Context variable to hold the current bank_id
@@ -54,14 +49,12 @@ def get_current_api_key() -> str | None:
     return _current_api_key.get()
 
 
-def create_mcp_server(memory: MemoryEngine, multi_bank: bool = True) -> FastMCP:
+def create_mcp_server(memory: MemoryEngine) -> FastMCP:
     """
     Create and configure the Hindsight MCP server.
 
     Args:
         memory: MemoryEngine instance (required)
-        multi_bank: If True, expose all tools with bank_id parameters (default).
-                   If False, only expose bank-scoped tools without bank_id parameters.
 
     Returns:
         Configured FastMCP server instance with stateless_http enabled
@@ -73,50 +66,29 @@ def create_mcp_server(memory: MemoryEngine, multi_bank: bool = True) -> FastMCP:
     config = MCPToolsConfig(
         bank_id_resolver=get_current_bank_id,
         api_key_resolver=get_current_api_key,  # Propagate API key for tenant auth
-        include_bank_id_param=multi_bank,
-        tools=None if multi_bank else {"retain", "recall", "reflect"},  # Scoped tools for single-bank mode
+        include_bank_id_param=True,  # HTTP MCP supports multi-bank via parameter
+        tools=None,  # All tools
         retain_fire_and_forget=False,  # HTTP MCP supports sync/async modes
     )
 
     register_mcp_tools(mcp, memory, config)
 
-    # Load and register additional tools from MCP extension if configured
-    mcp_extension = load_extension("MCP", MCPExtension)
-    if mcp_extension:
-        logger.info(f"Loading MCP extension: {mcp_extension.__class__.__name__}")
-        mcp_extension.register_tools(mcp, memory)
-
     return mcp
 
 
 class MCPMiddleware:
-    """ASGI middleware that handles authentication and routes to appropriate MCP server.
+    """ASGI middleware that handles authentication and extracts bank_id from header or path.
 
     Authentication:
-        1. If HINDSIGHT_API_MCP_AUTH_TOKEN is set (legacy), validates against that token
-        2. Otherwise, uses TenantExtension.authenticate_mcp() from the MemoryEngine
-           - DefaultTenantExtension: no auth required (local dev)
-           - ApiKeyTenantExtension: validates against env var
+        If HINDSIGHT_API_MCP_AUTH_TOKEN is set, all requests must include a valid
+        Authorization header with Bearer token or direct token matching the configured value.
 
-    Two modes based on URL structure:
+    Bank ID can be provided via:
+    1. X-Bank-Id header (recommended for Claude Code)
+    2. URL path: /mcp/{bank_id}/
+    3. Environment variable HINDSIGHT_MCP_BANK_ID (fallback default)
 
-    1. Multi-bank mode (for /mcp/ root endpoint):
-       - Exposes all tools: retain, recall, reflect, list_banks, create_bank
-       - All tools include optional bank_id parameter for cross-bank operations
-       - Bank ID from: X-Bank-Id header or HINDSIGHT_MCP_BANK_ID env var
-
-    2. Single-bank mode (for /mcp/{bank_id}/ endpoints):
-       - Exposes bank-scoped tools only: retain, recall, reflect
-       - No bank_id parameter (comes from URL)
-       - No bank management tools (list_banks, create_bank)
-       - Recommended for agent isolation
-
-    Examples:
-        # Single-bank mode (recommended for agent isolation)
-        claude mcp add --transport http my-agent http://localhost:8888/mcp/my-agent-bank/ \\
-            --header "Authorization: Bearer <token>"
-
-        # Multi-bank mode (for cross-bank operations)
+    For Claude Code, configure with:
         claude mcp add --transport http hindsight http://localhost:8888/mcp \\
             --header "X-Bank-Id: my-bank" --header "Authorization: Bearer <token>"
     """
@@ -124,24 +96,10 @@ class MCPMiddleware:
     def __init__(self, app, memory: MemoryEngine):
         self.app = app
         self.memory = memory
-        self.tenant_extension = memory._tenant_extension
-
-        # Create two server instances:
-        # 1. Multi-bank server (for /mcp/ root endpoint)
-        self.multi_bank_server = create_mcp_server(memory, multi_bank=True)
-        self.multi_bank_app = self.multi_bank_server.http_app(path="/")
-
-        # 2. Single-bank server (for /mcp/{bank_id}/ endpoints)
-        self.single_bank_server = create_mcp_server(memory, multi_bank=False)
-        self.single_bank_app = self.single_bank_server.http_app(path="/")
-
-        # Backward compatibility: expose multi_bank_app as mcp_app
-        self.mcp_app = self.multi_bank_app
-
-        # Expose the lifespan for the parent app to chain (use multi-bank as default)
-        self.lifespan = (
-            self.multi_bank_app.lifespan_handler if hasattr(self.multi_bank_app, "lifespan_handler") else None
-        )
+        self.mcp_server = create_mcp_server(memory)
+        self.mcp_app = self.mcp_server.http_app(path="/")
+        # Expose the lifespan for the parent app to chain
+        self.lifespan = self.mcp_app.lifespan_handler if hasattr(self.mcp_app, "lifespan_handler") else None
 
     def _get_header(self, scope: dict, name: str) -> str | None:
         """Extract a header value from ASGI scope."""
@@ -153,7 +111,7 @@ class MCPMiddleware:
 
     async def __call__(self, scope, receive, send):
         if scope["type"] != "http":
-            await self.multi_bank_app(scope, receive, send)
+            await self.mcp_app(scope, receive, send)
             return
 
         # Extract auth token from header (for tenant auth propagation)
@@ -163,30 +121,14 @@ class MCPMiddleware:
             # Support both "Bearer <token>" and direct token
             auth_token = auth_header[7:].strip() if auth_header.startswith("Bearer ") else auth_header.strip()
 
-        # Authenticate: check legacy MCP_AUTH_TOKEN first, then TenantExtension
-        tenant_context = None
+        # Authenticate if MCP_AUTH_TOKEN is configured
         if MCP_AUTH_TOKEN:
-            # Legacy authentication mode - validate against static token
             if not auth_token:
                 await self._send_error(send, 401, "Authorization header required")
                 return
             if auth_token != MCP_AUTH_TOKEN:
                 await self._send_error(send, 401, "Invalid authentication token")
                 return
-            # Legacy mode doesn't use tenant schemas
-            tenant_context = None
-        else:
-            # Use TenantExtension.authenticate_mcp() for auth
-            try:
-                tenant_context = await self.tenant_extension.authenticate_mcp(RequestContext(api_key=auth_token))
-            except AuthenticationError as e:
-                await self._send_error(send, 401, str(e))
-                return
-
-        # Set schema from tenant context so downstream DB queries use the correct schema
-        schema_token = (
-            _current_schema.set(tenant_context.schema_name) if tenant_context and tenant_context.schema_name else None
-        )
 
         path = scope.get("path", "")
 
@@ -201,13 +143,8 @@ class MCPMiddleware:
         elif path == "/mcp":
             path = "/"
 
-        # Ensure path has leading slash (needed after stripping mount path)
-        if path and not path.startswith("/"):
-            path = "/" + path
-
         # Try to get bank_id from header first (for Claude Code compatibility)
         bank_id = self._get_header(scope, "X-Bank-Id")
-        bank_id_from_path = False
 
         # MCP endpoint paths that should not be treated as bank_ids
         MCP_ENDPOINTS = {"sse", "messages"}
@@ -220,7 +157,6 @@ class MCPMiddleware:
             if parts[0] and parts[0] not in MCP_ENDPOINTS:
                 # First segment looks like a bank_id
                 bank_id = parts[0]
-                bank_id_from_path = True
                 new_path = "/" + parts[1] if len(parts) > 1 else "/"
 
         # Fall back to default bank_id
@@ -228,11 +164,6 @@ class MCPMiddleware:
             bank_id = DEFAULT_BANK_ID
             logger.debug(f"Using default bank_id: {bank_id}")
 
-        # Select the appropriate MCP app based on how bank_id was provided:
-        # - Path-based bank_id → single-bank app (no bank_id param, scoped tools)
-        # - Header/env bank_id → multi-bank app (bank_id param, all tools)
-        target_app = self.single_bank_app if bank_id_from_path else self.multi_bank_app
-
         # Set bank_id and api_key context
         bank_id_token = _current_bank_id.set(bank_id)
         # Store the auth token for tenant extension to validate
@@ -245,7 +176,7 @@ class MCPMiddleware:
 
             # Wrap send to rewrite the SSE endpoint URL to include bank_id if using path-based routing
             async def send_wrapper(message):
-                if message["type"] == "http.response.body" and bank_id_from_path:
+                if message["type"] == "http.response.body":
                     body = message.get("body", b"")
                     if body and b"/messages" in body:
                         # Rewrite /messages to /{bank_id}/messages in SSE endpoint event
@@ -253,13 +184,11 @@ class MCPMiddleware:
                         message = {**message, "body": body}
                 await send(message)
 
-            await target_app(new_scope, receive, send_wrapper)
+            await self.mcp_app(new_scope, receive, send_wrapper)
         finally:
             _current_bank_id.reset(bank_id_token)
             if api_key_token is not None:
                 _current_api_key.reset(api_key_token)
-            if schema_token is not None:
-                _current_schema.reset(schema_token)
 
     async def _send_error(self, send, status: int, message: str):
         """Send an error response."""
@@ -281,23 +210,16 @@ class MCPMiddleware:
 
 def create_mcp_app(memory: MemoryEngine):
     """
-    Create an ASGI app that handles MCP requests with dynamic tool exposure.
+    Create an ASGI app that handles MCP requests.
 
     Authentication:
-        Uses the TenantExtension from the MemoryEngine (same auth as REST API).
+        Set HINDSIGHT_API_MCP_AUTH_TOKEN to require Bearer token authentication.
+        If not set, MCP endpoint is open (for local development).
 
-    Two modes based on URL structure:
-
-    1. Single-bank mode (recommended for agent isolation):
-       - URL: /mcp/{bank_id}/
-       - Tools: retain, recall, reflect (no bank_id parameter)
-       - Example: claude mcp add --transport http my-agent http://localhost:8888/mcp/my-agent-bank/
-
-    2. Multi-bank mode (for cross-bank operations):
-       - URL: /mcp/
-       - Tools: retain, recall, reflect, list_banks, create_bank (all with bank_id parameter)
-       - Bank ID from: X-Bank-Id header or HINDSIGHT_MCP_BANK_ID env var (default: "default")
-       - Example: claude mcp add --transport http hindsight http://localhost:8888/mcp --header "X-Bank-Id: my-bank"
+    Bank ID can be provided via:
+    1. X-Bank-Id header: claude mcp add --transport http hindsight http://localhost:8888/mcp --header "X-Bank-Id: my-bank"
+    2. URL path: /mcp/{bank_id}/
+    3. Environment variable HINDSIGHT_MCP_BANK_ID (fallback, default: "default")
 
     Args:
         memory: MemoryEngine instance

hindsight-api/hindsight_api/banner.py

@@ -4,8 +4,6 @@ Banner display for Hindsight API startup.
 Shows the logo and tagline with gradient colors.
 """
 
-from .utils import mask_network_location
-
 # Gradient colors: #0074d9 -> #009296
 GRADIENT_START = (0, 116, 217)  # #0074d9
 GRADIENT_END = (0, 146, 150)  # #009296
@@ -92,7 +90,7 @@ def print_startup_info(
     if version:
         print(f"  {dim('Version:')} {color(f'v{version}', 0.1)}")
     print(f"  {dim('URL:')} {color(f'http://{host}:{port}', 0.2)}")
-    print(f"  {dim('Database:')} {color(mask_network_location(database_url), 0.4)}")
+    print(f"  {dim('Database:')} {color(database_url, 0.4)}")
     print(f"  {dim('LLM:')} {color(f'{llm_provider} / {llm_model}', 0.6)}")
     print(f"  {dim('Embeddings:')} {color(embeddings_provider, 0.8)}")
     print(f"  {dim('Reranker:')} {color(reranker_provider, 1.0)}")

hindsight-api/hindsight_api/config.py

@@ -447,22 +447,6 @@ class HindsightConfig:
     # Reflect agent settings
     reflect_max_iterations: int
 
-    def validate(self) -> None:
-        """Validate configuration values and raise errors for invalid combinations."""
-        # RETAIN_MAX_COMPLETION_TOKENS must be greater than RETAIN_CHUNK_SIZE
-        # to ensure the LLM has enough output capacity to extract facts from chunks
-        if self.retain_max_completion_tokens <= self.retain_chunk_size:
-            raise ValueError(
-                f"Invalid configuration: HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS "
-                f"({self.retain_max_completion_tokens}) must be greater than "
-                f"HINDSIGHT_API_RETAIN_CHUNK_SIZE ({self.retain_chunk_size}). "
-                f"\n\nYou have two options to fix this:"
-                f"\n  1. Increase HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS to a value > {self.retain_chunk_size}"
-                f"\n  2. Use a model that supports at least {self.retain_max_completion_tokens} output tokens"
-                f"\n     (current model: {self.retain_llm_model or self.llm_model}, "
-                f"provider: {self.retain_llm_provider or self.llm_provider})"
-            )
-
     @classmethod
     def from_env(cls) -> "HindsightConfig":
         """Create configuration from environment variables."""
@@ -470,7 +454,7 @@ class HindsightConfig:
         llm_provider = os.getenv(ENV_LLM_PROVIDER, DEFAULT_LLM_PROVIDER)
         llm_model = os.getenv(ENV_LLM_MODEL) or _get_default_model_for_provider(llm_provider)
 
-        config = cls(
+        return cls(
             # Database
             database_url=os.getenv(ENV_DATABASE_URL, DEFAULT_DATABASE_URL),
             database_schema=os.getenv(ENV_DATABASE_SCHEMA, DEFAULT_DATABASE_SCHEMA),
@@ -647,8 +631,6 @@ class HindsightConfig:
             # Reflect agent settings
             reflect_max_iterations=int(os.getenv(ENV_REFLECT_MAX_ITERATIONS, str(DEFAULT_REFLECT_MAX_ITERATIONS))),
         )
-        config.validate()
-        return config
 
     def get_llm_base_url(self) -> str:
         """Get the LLM base URL, with provider-specific defaults."""

hindsight-api/hindsight_api/engine/consolidation/prompts.py

@@ -2,7 +2,7 @@
 
 CONSOLIDATION_SYSTEM_PROMPT = """You are a memory consolidation system. Your job is to convert facts into durable knowledge (observations) and merge with existing knowledge when appropriate.
 
-You must output ONLY valid JSON with no markdown code blocks or additional text. However, the "text" field within each observation should use markdown formatting (headers, lists, bold, etc.) for clarity and readability.
+You must output ONLY valid JSON with no markdown formatting, no code blocks, and no additional text.
 
 ## EXTRACT DURABLE KNOWLEDGE, NOT EPHEMERAL STATE
 Facts often describe events or actions. Extract the DURABLE KNOWLEDGE implied by the fact, not the transient state.
@@ -71,15 +71,10 @@ Instructions:
    - New topic → CREATE new observation
    - Purely ephemeral → return []
 
-Output JSON array of actions (the "text" field should use markdown formatting for structure):
+Output JSON array of actions:
 [
-  {{"action": "update", "learning_id": "uuid-from-observations", "text": "## Updated Knowledge\n\n**Key point**: details here\n\n- Supporting detail 1\n- Supporting detail 2", "reason": "..."}},
-  {{"action": "create", "text": "## New Durable Knowledge\n\nDescription with **emphasis** and proper structure", "reason": "..."}}
+  {{"action": "update", "learning_id": "uuid-from-observations", "text": "updated knowledge", "reason": "..."}},
+  {{"action": "create", "text": "new durable knowledge", "reason": "..."}}
 ]
 
-Return [] if fact contains no durable knowledge.
-
-IMPORTANT: Format the "text" field with markdown for better readability:
-- Use headers, lists, bold/italic, tables where appropriate
-- CRITICAL: Add blank lines before and after block elements (tables, code blocks, lists)
-- Ensure proper spacing for markdown to render correctly"""
+Return [] if fact contains no durable knowledge."""

hindsight-api/hindsight_api/engine/memory_engine.py

@@ -20,7 +20,6 @@ from typing import TYPE_CHECKING, Any
 
 from ..config import get_config
 from ..metrics import get_metrics_collector
-from ..utils import mask_network_location
 from .db_budget import budgeted_operation
 
 # Context variable for current schema (async-safe, per-task isolation)
@@ -467,11 +466,6 @@ class MemoryEngine(MemoryEngineInterface):
             tenant_extension = DefaultTenantExtension(config={})
         self._tenant_extension = tenant_extension
 
-    @property
-    def tenant_extension(self) -> "TenantExtension | None":
-        """The configured tenant extension, if any."""
-        return self._tenant_extension
-
     async def _validate_operation(self, validation_coro) -> None:
         """
         Run validation if an operation validator is configured.
@@ -650,34 +644,19 @@ class MemoryEngine(MemoryEngineInterface):
         generated_content = reflect_result.text or "No content generated"
 
         # Build reflect_response payload to store
-        # based_on contains MemoryFact objects for most types, but plain dicts for directives
-        based_on_serialized: dict[str, list[dict[str, Any]]] = {}
-        for fact_type, facts in reflect_result.based_on.items():
-            serialized_facts = []
-            for fact in facts:
-                if isinstance(fact, dict):
-                    # Plain dict (e.g., directives with id, name, content)
-                    serialized_facts.append(
-                        {
-                            "id": str(fact["id"]),
-                            "text": fact.get("text", fact.get("content", fact.get("name", ""))),
-                            "type": fact_type,
-                        }
-                    )
-                else:
-                    # MemoryFact object with .id and .text attributes
-                    serialized_facts.append(
-                        {
-                            "id": str(fact.id),
-                            "text": fact.text,
-                            "type": fact_type,
-                        }
-                    )
-            based_on_serialized[fact_type] = serialized_facts
-
         reflect_response = {
             "text": reflect_result.text,
-            "based_on": based_on_serialized,
+            "based_on": {
+                fact_type: [
+                    {
+                        "id": str(fact.id),
+                        "text": fact.text,
+                        "type": fact_type,
+                    }
+                    for fact in facts
+                ]
+                for fact_type, facts in reflect_result.based_on.items()
+            },
         }
 
         # Update the mental model with the generated content and reflect_response
@@ -997,7 +976,7 @@ class MemoryEngine(MemoryEngineInterface):
             except Exception as e:
                 logger.warning(f"Failed to run schema migrations: {e}")
 
-        logger.info(f"Connecting to PostgreSQL at {mask_network_location(self.db_url)}")
+        logger.info(f"Connecting to PostgreSQL at {self.db_url}")
 
         # Create connection pool
         # For read-heavy workloads with many parallel think/search operations,
@@ -4755,36 +4734,20 @@ class MemoryEngine(MemoryEngineInterface):
         )
 
         # Build reflect_response payload to store
-        # based_on contains MemoryFact objects for most types, but plain dicts for directives
-        based_on_serialized_payload: dict[str, list[dict[str, Any]]] = {}
-        for fact_type, facts in reflect_result.based_on.items():
-            serialized_facts = []
-            for fact in facts:
-                if isinstance(fact, dict):
-                    # Plain dict (e.g., directives with id, name, content)
-                    serialized_facts.append(
-                        {
-                            "id": str(fact["id"]),
-                            "text": fact.get("text", fact.get("content", fact.get("name", ""))),
-                            "type": fact_type,
-                            "context": fact.get("context", None),
-                        }
-                    )
-                else:
-                    # MemoryFact object with .id, .text, .context attributes
-                    serialized_facts.append(
-                        {
-                            "id": str(fact.id),
-                            "text": fact.text,
-                            "type": fact_type,
-                            "context": fact.context,
-                        }
-                    )
-            based_on_serialized_payload[fact_type] = serialized_facts
-
         reflect_response_payload = {
             "text": reflect_result.text,
-            "based_on": based_on_serialized_payload,
+            "based_on": {
+                fact_type: [
+                    {
+                        "id": str(fact.id),
+                        "text": fact.text,
+                        "type": fact_type,
+                        "context": fact.context,  # Include context to distinguish directives from mental models in UI
+                    }
+                    for fact in facts
+                ]
+                for fact_type, facts in reflect_result.based_on.items()
+            },
             "mental_models": [],  # Mental models are included in based_on["mental-models"]
         }
 

hindsight-api/hindsight_api/engine/providers/mock_llm.py

@@ -65,7 +65,6 @@ class MockLLM(LLMInterface):
         # Storage for test verification
         self._mock_calls: list[dict] = []
         self._mock_response: Any = None
-        self._mock_exception: Exception | None = None
 
     async def verify_connection(self) -> None:
         """
@@ -125,10 +124,6 @@ class MockLLM(LLMInterface):
         self._mock_calls.append(call_record)
         logger.debug(f"Mock LLM call recorded: scope={scope}, model={self.model}")
 
-        # Raise mock exception if configured
-        if self._mock_exception is not None:
-            raise self._mock_exception
-
         # Return mock response
         if self._mock_response is not None:
             result = self._mock_response
@@ -188,10 +183,6 @@ class MockLLM(LLMInterface):
         }
         self._mock_calls.append(call_record)
 
-        # Raise mock exception if configured
-        if self._mock_exception is not None:
-            raise self._mock_exception
-
         if self._mock_response is not None:
             if isinstance(self._mock_response, LLMToolCallResult):
                 return self._mock_response
@@ -224,16 +215,6 @@ class MockLLM(LLMInterface):
         """
         self._mock_response = response
 
-    def set_mock_exception(self, exception: Exception) -> None:
-        """
-        Set an exception to raise from mock calls.
-
-        Args:
-            exception: The exception to raise on the next call.
-                      After raising, the exception is cleared.
-        """
-        self._mock_exception = exception
-
     def get_mock_calls(self) -> list[dict]:
         """
         Get the list of recorded mock calls.
@@ -249,6 +230,5 @@ class MockLLM(LLMInterface):
         return self._mock_calls
 
     def clear_mock_calls(self) -> None:
-        """Clear the recorded mock calls and any set exception."""
+        """Clear the recorded mock calls."""
         self._mock_calls = []
-        self._mock_exception = None

hindsight-api/hindsight_api/engine/reflect/models.py

@@ -31,7 +31,7 @@ class ReflectAction(BaseModel):
         default=None, description="Observation sections for done action (when output_mode=observations)"
     )
     # Plain text answer fields (for output_mode=answer)
-    answer: str | None = Field(default=None, description="Well-formatted markdown answer for done action")
+    answer: str | None = Field(default=None, description="Plain text answer for done action (no markdown)")
     answer_memory_ids: list[str] | None = Field(
         default=None, description="Memory IDs supporting the answer", alias="memory_ids"
     )

hindsight-api/hindsight_api/engine/reflect/prompts.py

@@ -148,15 +148,7 @@ def build_system_prompt_for_tools(
 
     parts = []
 
-    # Anti-hallucination rule at the very top
-    parts.extend(
-        [
-            "CRITICAL: You MUST ONLY use information from retrieved tool results. NEVER make up names, people, events, or entities.",
-            "",
-        ]
-    )
-
-    # Inject directives after anti-hallucination rule
+    # Inject directives at the VERY START for maximum prominence
     if directives:
         parts.append(build_directives_section(directives))
 
@@ -170,7 +162,7 @@ def build_system_prompt_for_tools(
     parts.extend(
         [
             "## CRITICAL RULES",
-            "- ONLY use information from tool results - no external knowledge or guessing",
+            "- You must NEVER fabricate information that has no basis in retrieved data",
             "- You SHOULD synthesize, infer, and reason from the retrieved memories",
             "- You MUST search before saying you don't have information",
             "",
@@ -308,11 +300,9 @@ def build_system_prompt_for_tools(
     parts.extend(
         [
             "",
-            "## Output Format: Well-Formatted Markdown Answer",
-            "Call done() with a well-formatted markdown 'answer' field.",
-            "- USE markdown formatting for structure (headers, lists, bold, italic, code blocks, tables, etc.)",
-            "- CRITICAL: Add blank lines before and after block elements (tables, code blocks, lists)",
-            "- Format for clarity and readability with proper spacing and hierarchy",
+            "## Output Format: Plain Text Answer",
+            "Call done() with a plain text 'answer' field.",
+            "- Do NOT use markdown formatting",
             "- NEVER include memory IDs, UUIDs, or 'Memory references' in the answer text",
             "- Put IDs ONLY in the memory_ids/mental_model_ids/observation_ids arrays, not in the answer",
         ]
@@ -484,30 +474,19 @@ def build_final_prompt(
     return "\n".join(parts)
 
 
-FINAL_SYSTEM_PROMPT = """CRITICAL: You MUST ONLY use information from retrieved tool results. NEVER make up names, people, events, or entities.
-
-You are a thoughtful assistant that synthesizes answers from retrieved memories.
+FINAL_SYSTEM_PROMPT = """You are a thoughtful assistant that synthesizes answers from retrieved memories.
 
 Your approach:
 - Reason over the retrieved memories to answer the question
 - Make reasonable inferences when the exact answer isn't explicitly stated
 - Connect related memories to form a complete picture
 - Be helpful - if you have related information, use it to give the best possible answer
-- ONLY use information from tool results - no external knowledge or guessing
 
 Only say "I don't have information" if the retrieved data is truly unrelated to the question.
-
-FORMATTING: Use proper markdown formatting in your answer:
-- Headers (##, ###) for sections
-- Lists (bullet or numbered) for enumerations
-- Bold/italic for emphasis
-- Tables with proper syntax (ensure blank line before and after)
-- Code blocks where appropriate
-- CRITICAL: Always add blank lines before and after block elements (tables, code blocks, lists)
-- Proper spacing between sections
+Do NOT fabricate information that has no basis in the retrieved data.
 
 CRITICAL: Output ONLY the final synthesized answer. Do NOT include:
 - Meta-commentary about what you're doing ("I'll search...", "Let me analyze...")
 - Explanations of your reasoning process
 - Descriptions of your approach
-Just provide the direct answer with proper markdown formatting."""
+Just provide the direct answer."""

hindsight-api/hindsight_api/engine/reflect/tools_schema.py

@@ -139,7 +139,7 @@ TOOL_DONE_ANSWER = {
             "properties": {
                 "answer": {
                     "type": "string",
-                    "description": "Your response as well-formatted markdown. Use headers, lists, bold/italic, and code blocks for clarity. NEVER include memory IDs, UUIDs, or 'Memory references' in this text - put IDs only in memory_ids array.",
+                    "description": "Your response as plain text. Do NOT use markdown formatting. NEVER include memory IDs, UUIDs, or 'Memory references' in this text - put IDs only in memory_ids array.",
                 },
                 "memory_ids": {
                     "type": "array",
@@ -190,7 +190,7 @@ def _build_done_tool_with_directives(directive_rules: list[str]) -> dict:
                 "properties": {
                     "answer": {
                         "type": "string",
-                        "description": "Your response as well-formatted markdown. Use headers, lists, bold/italic, and code blocks for clarity. NEVER include memory IDs, UUIDs, or 'Memory references' in this text - put IDs only in memory_ids array.",
+                        "description": "Your response as plain text. Do NOT use markdown formatting. NEVER include memory IDs, UUIDs, or 'Memory references' in this text - put IDs only in memory_ids array.",
                     },
                     "memory_ids": {
                         "type": "array",

hindsight-api/hindsight_api/engine/retain/fact_extraction.py

@@ -542,12 +542,7 @@ Output: ONLY 2 facts (skip coffee preference - too trivial):
 QUALITY OVER QUANTITY
 ══════════════════════════════════════════════════════════════════════════
 
-Ask: "Would this be useful to recall in 6 months?" If no, skip it.
-
-IMPORTANT: Sensory/emotional details and observations that provide meaningful context
-about experiences ARE important to remember, even if they seem small (e.g., how food
-tasted, how someone looked, how loud music was). Extract these if they characterize
-an experience or person."""
+Ask: "Would this be useful to recall in 6 months?" If no, skip it."""
 
 # Assembled concise prompt (backward compatible - exact same output as before)
 CONCISE_FACT_EXTRACTION_PROMPT = _BASE_FACT_EXTRACTION_PROMPT.format(
@@ -646,7 +641,6 @@ For EVENTS (fact_kind="event") - MUST SET BOTH occurred_start AND occurred_end:
 - Convert relative dates → absolute using Event Date as reference
 - If Event Date is "Saturday, March 15, 2020", then "yesterday" = Friday, March 14, 2020
 - Dates mentioned in text (e.g., "in March 2020") should use THAT year, not current year
-- CRITICAL: If the content mentions an absolute date (e.g., "March 15, 2024", "2024-03-15"), you MUST extract it and set occurred_start in ISO format
 - Always include the day name (Monday, Tuesday, etc.) in the 'when' field
 - Set occurred_start AND occurred_end to WHEN IT HAPPENED (not when mentioned)
 - For single-day/point events: set occurred_end = occurred_start (same timestamp)
@@ -1011,29 +1005,6 @@ Text:
 
         except BadRequestError as e:
             last_error = e
-            error_str = str(e).lower()
-
-            # Check if error is related to max_tokens/completion_tokens not being supported
-            if any(
-                keyword in error_str
-                for keyword in [
-                    "max_tokens",
-                    "max_completion_tokens",
-                    "maximum context",
-                    "token limit",
-                    "context length",
-                ]
-            ):
-                # Provide helpful error message with configuration suggestions
-                raise ValueError(
-                    f"Model does not support the required output token limit.\n\n"
-                    f"The model '{llm_config.model}' (provider: {llm_config.provider}) failed with: {e}\n\n"
-                    f"You have two options to fix this:\n"
-                    f"  1. Use a different model that supports at least {config.retain_max_completion_tokens} output tokens\n"
-                    f"  2. Decrease HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS to a value your model supports\n"
-                    f"     (current value: {config.retain_max_completion_tokens}, must be > RETAIN_CHUNK_SIZE={config.retain_chunk_size})"
-                ) from e
-
             if "json_validate_failed" in str(e):
                 logger.warning(
                     f"          [1.3.{chunk_index + 1}] Attempt {attempt + 1}/{max_retries} failed with JSON validation error: {e}"
@@ -1376,21 +1347,28 @@ def _convert_causal_relations(relations_from_llm, fact_start_idx: int) -> list[C
 
 def _add_temporal_offsets(facts: list[ExtractedFactType], contents: list[RetainContent]) -> None:
     """
-    Add time offsets to preserve fact ordering across all contents.
+    Add time offsets to preserve fact ordering within each content.
 
-    This allows retrieval to distinguish between facts from different documents/conversations
-    even when they have the same base event_date, and also between facts within the same
-    conversation.
-
-    Uses absolute position across all facts to ensure unique timestamps.
+    This allows retrieval to distinguish between facts that happened earlier vs later
+    in the same conversation, even when the base event_date is the same.
 
     Modifies facts in place.
     """
     from .orchestrator import parse_datetime_flexible
 
+    # Group facts by content_index
+    current_content_idx = 0
+    content_fact_start = 0
+
     for i, fact in enumerate(facts):
-        # Use absolute position across all facts to ensure uniqueness across different contents
-        offset = timedelta(seconds=i * SECONDS_PER_FACT)
+        if fact.content_index != current_content_idx:
+            # Moved to next content
+            current_content_idx = fact.content_index
+            content_fact_start = i
+
+        # Calculate position within this content
+        fact_position = i - content_fact_start
+        offset = timedelta(seconds=fact_position * SECONDS_PER_FACT)
 
         # Apply offset to all temporal fields (handle both datetime objects and ISO strings)
         if fact.occurred_start:

hindsight-api/hindsight_api/engine/search/think_utils.py

@@ -188,7 +188,7 @@ def get_system_message(disposition: DispositionTraits) -> str:
         " ".join(instructions) if instructions else "Balance your disposition traits when interpreting information."
     )
 
-    return f"You are a person with your own thoughts, experiences, opinions, and disposition. When asked a question, respond naturally like a human would - share what you genuinely think based on what you know and have experienced. {disposition_instruction} Be direct, express your views confidently, and use 'I think', 'I believe', 'in my view', etc. Respond in plain text without markdown formatting. CRITICAL: ONLY use the facts and information provided in the prompt - do not make up names, events, or information that weren't mentioned. If you don't have enough information to answer, say so. IMPORTANT: Detect the language of the question and respond in the SAME language. Do not translate to English if the question is in another language."
+    return f"You are a person with your own thoughts, experiences, opinions, and disposition. When asked a question, respond naturally like a human would - share what you genuinely think based on what you know and have experienced. {disposition_instruction} Be direct, express your views confidently, and use 'I think', 'I believe', 'in my view', etc. Respond in plain text without markdown formatting. IMPORTANT: Detect the language of the question and respond in the SAME language. Do not translate to English if the question is in another language."
 
 
 async def reflect(

hindsight-api/hindsight_api/extensions/__init__.py

@@ -16,11 +16,10 @@ with the system (e.g., running migrations for tenant schemas).
 """
 
 from hindsight_api.extensions.base import Extension
-from hindsight_api.extensions.builtin import ApiKeyTenantExtension, SupabaseTenantExtension
+from hindsight_api.extensions.builtin import ApiKeyTenantExtension
 from hindsight_api.extensions.context import DefaultExtensionContext, ExtensionContext
 from hindsight_api.extensions.http import HttpExtension
 from hindsight_api.extensions.loader import load_extension
-from hindsight_api.extensions.mcp import MCPExtension
 from hindsight_api.extensions.operation_validator import (
     # Consolidation operation
     ConsolidateContext,
@@ -58,8 +57,6 @@ __all__ = [
     "DefaultExtensionContext",
     # HTTP Extension
     "HttpExtension",
-    # MCP Extension
-    "MCPExtension",
     # Operation Validator - Core
     "OperationValidationError",
     "OperationValidatorExtension",
@@ -80,7 +77,6 @@ __all__ = [
     "MentalModelRefreshResult",
     # Tenant/Auth
     "ApiKeyTenantExtension",
-    "SupabaseTenantExtension",
     "AuthenticationError",
     "RequestContext",
     "Tenant",

hindsight-api/hindsight_api/extensions/builtin/__init__.py

@@ -6,17 +6,13 @@ They can be used directly or serve as examples for custom implementations.
 
 Available built-in extensions:
     - ApiKeyTenantExtension: Simple API key validation with public schema
-    - SupabaseTenantExtension: Supabase JWT validation with per-user schema isolation
 
 Example usage:
     HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension
-    HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.supabase_tenant:SupabaseTenantExtension
 """
 
-from hindsight_api.extensions.builtin.supabase_tenant import SupabaseTenantExtension
 from hindsight_api.extensions.builtin.tenant import ApiKeyTenantExtension
 
 __all__ = [
     "ApiKeyTenantExtension",
-    "SupabaseTenantExtension",
 ]

hindsight-api/hindsight_api/extensions/builtin/supabase_tenant.py

@@ -1,433 +0,0 @@
-"""
-Supabase Tenant Extension for Hindsight
-
-Validates Supabase JWTs and maps authenticated users to isolated memory banks.
-Each user gets their own PostgreSQL schema based on their Supabase user ID.
-
-This extension enables multi-tenant memory isolation for applications using
-Supabase Auth - each authenticated user's memories are stored in a separate
-schema, ensuring complete data isolation.
-
-Features:
-    - Local JWT Verification: Validates tokens locally using JWKS public keys
-      (no network call per request)
-    - Automatic Schema Isolation: Each user gets {prefix}_{user_id} schema
-    - Zero User Management: Leverages your existing Supabase Auth setup
-    - Production Ready: Includes health checks, timeouts, key rotation handling,
-      and error handling
-    - Built-in: Ships with Hindsight, no extra installation needed
-    - Legacy Support: Falls back to /auth/v1/user endpoint for HS256 projects
-
-JWT Verification Strategy:
-    By default, JWTs are verified locally using public keys from the Supabase
-    JWKS endpoint (/auth/v1/.well-known/jwks.json). This is the Supabase-recommended
-    approach: no network call per request, fast, and secure.
-
-    If JWKS keys are unavailable (e.g., legacy HS256 projects), the extension
-    falls back to calling /auth/v1/user per request for validation. This requires
-    the service_role key to be configured.
-
-Configuration via environment variables:
-    HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.supabase_tenant:SupabaseTenantExtension
-    HINDSIGHT_API_TENANT_SUPABASE_URL=https://your-project.supabase.co
-
-    # Optional - only required for legacy HS256 projects or health checks
-    HINDSIGHT_API_TENANT_SUPABASE_SERVICE_KEY=your-service-role-key
-
-    # Optional
-    HINDSIGHT_API_TENANT_SCHEMA_PREFIX=user  # Default: "user" (creates user_<uuid> schemas)
-
-Usage:
-    Clients pass their Supabase JWT in the Authorization header:
-
-    curl -H "Authorization: Bearer <supabase_jwt>" \\
-        https://your-hindsight-server/v1/default/banks/my-bank/memories/recall
-
-Author: BrighterBalance (https://brighterbalance.app)
-License: MIT
-"""
-
-from __future__ import annotations
-
-import logging
-import re
-import time
-
-import httpx
-import jwt as pyjwt
-from jwt import PyJWK
-
-from hindsight_api.extensions.tenant import AuthenticationError, Tenant, TenantContext, TenantExtension
-from hindsight_api.models import RequestContext
-
-logger = logging.getLogger(__name__)
-
-__all__ = ["SupabaseTenantExtension"]
-
-# Minimum expected JWT length (JWTs are typically 100+ characters)
-MIN_TOKEN_LENGTH = 20
-
-# Timeout for Supabase API calls
-REQUEST_TIMEOUT_SECONDS = 10.0
-
-# JWKS cache TTL — Supabase Edge caches JWKS for 10 minutes, so we match that
-JWKS_CACHE_TTL_SECONDS = 600
-
-# Minimum interval between JWKS refreshes to avoid hammering the endpoint
-JWKS_MIN_REFRESH_INTERVAL_SECONDS = 30
-
-# Algorithms supported by Supabase Auth for asymmetric JWT signing
-SUPPORTED_ALGORITHMS = ["RS256", "ES256"]
-
-# Supabase user IDs are UUIDs — validate before using in schema names
-_UUID_RE = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE)
-
-# Schema prefix must be a valid Postgres identifier component (letters, digits, underscores)
-_SCHEMA_PREFIX_RE = re.compile(r"^[a-zA-Z_][a-zA-Z0-9_]*$")
-
-
-class SupabaseTenantExtension(TenantExtension):
-    """
-    TenantExtension that validates Supabase JWTs for multi-tenant isolation.
-
-    Each authenticated user gets their own PostgreSQL schema, ensuring complete
-    memory isolation between users. The schema name is derived from the user's
-    Supabase user ID (the ``sub`` claim in the JWT).
-
-    JWT verification uses JWKS (local, no network call per request) when
-    asymmetric keys are configured in Supabase, and falls back to the
-    ``/auth/v1/user`` endpoint for legacy HS256 projects.
-
-    Example:
-        User with ID "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
-        gets schema "user_a1b2c3d4_e5f6_7890_abcd_ef1234567890"
-    """
-
-    def __init__(self, config: dict[str, str]) -> None:
-        """
-        Initialize with configuration from environment variables.
-
-        Config keys are derived from HINDSIGHT_API_TENANT_* env vars:
-        - HINDSIGHT_API_TENANT_SUPABASE_URL -> config["supabase_url"] (required)
-        - HINDSIGHT_API_TENANT_SUPABASE_SERVICE_KEY -> config["supabase_service_key"] (optional)
-        - HINDSIGHT_API_TENANT_SCHEMA_PREFIX -> config["schema_prefix"] (optional)
-
-        Args:
-            config: Dictionary of configuration values from environment
-
-        Raises:
-            ValueError: If required configuration is missing
-        """
-        super().__init__(config)
-
-        self.supabase_url = (config.get("supabase_url") or "").rstrip("/")
-        self.supabase_service_key = config.get("supabase_service_key")
-        self.schema_prefix = config.get("schema_prefix", "user")
-
-        # Track initialized schemas to avoid redundant migrations
-        self._initialized_schemas: set[str] = set()
-
-        # Reusable HTTP client (created on startup)
-        self._http_client: httpx.AsyncClient | None = None
-
-        # JWKS state
-        self._jwks_keys: dict[str, PyJWK] = {}
-        self._jwks_last_fetched: float = 0
-        self._use_jwks: bool = False
-
-        if not self.supabase_url:
-            raise ValueError(
-                "HINDSIGHT_API_TENANT_SUPABASE_URL is required. "
-                "Set it to your Supabase project URL (e.g., https://xxx.supabase.co)"
-            )
-
-        if not _SCHEMA_PREFIX_RE.match(self.schema_prefix):
-            raise ValueError(
-                f"Invalid schema_prefix '{self.schema_prefix}'. "
-                "Must be a valid Postgres identifier (letters, digits, underscores, starting with a letter or underscore)."
-            )
-
-    # ------------------------------------------------------------------
-    # Lifecycle
-    # ------------------------------------------------------------------
-
-    async def on_startup(self) -> None:
-        """
-        Called when Hindsight starts.
-
-        Creates a reusable HTTP client, fetches JWKS for local JWT verification,
-        and optionally verifies connectivity to Supabase.
-        """
-        logger.info("Initializing Supabase tenant extension")
-        logger.info("Supabase URL: %s", self.supabase_url)
-        logger.info("Schema prefix: %s_", self.schema_prefix)
-
-        self._http_client = httpx.AsyncClient(timeout=REQUEST_TIMEOUT_SECONDS)
-
-        # Attempt to fetch JWKS for fast local JWT verification
-        await self._try_init_jwks()
-
-        # Optional health check using service key
-        if self.supabase_service_key:
-            await self._health_check()
-
-    async def on_shutdown(self) -> None:
-        """Called when Hindsight shuts down. Closes the HTTP client."""
-        logger.info("Shutting down Supabase tenant extension")
-        if self._http_client:
-            await self._http_client.aclose()
-            self._http_client = None
-
-    # ------------------------------------------------------------------
-    # JWKS management
-    # ------------------------------------------------------------------
-
-    async def _try_init_jwks(self) -> None:
-        """Fetch JWKS and decide verification mode (local JWKS vs legacy endpoint)."""
-        try:
-            await self._fetch_jwks()
-            if self._jwks_keys:
-                self._use_jwks = True
-                logger.info(
-                    "JWKS loaded — using local JWT verification with %d key(s)",
-                    len(self._jwks_keys),
-                )
-                return
-
-            # JWKS endpoint returned no keys — project likely uses legacy HS256
-            logger.warning(
-                "JWKS endpoint returned no signing keys. "
-                "Falling back to /auth/v1/user endpoint for JWT verification. "
-                "For better performance, enable asymmetric JWT signing in your "
-                "Supabase dashboard (Project Settings → Auth → JWT Algorithm)."
-            )
-        except Exception as e:
-            logger.warning(
-                "Could not fetch JWKS (%s). Falling back to /auth/v1/user endpoint for JWT verification.",
-                e,
-            )
-
-        # Legacy mode requires service key
-        if not self.supabase_service_key:
-            raise ValueError(
-                "HINDSIGHT_API_TENANT_SUPABASE_SERVICE_KEY is required when JWKS "
-                "is not available. Either enable asymmetric JWT signing in your "
-                "Supabase project or provide the service_role key."
-            )
-        self._use_jwks = False
-
-    async def _fetch_jwks(self) -> None:
-        """Fetch public signing keys from the Supabase JWKS endpoint."""
-        if self._http_client is None:
-            raise RuntimeError("HTTP client not initialized")
-
-        url = f"{self.supabase_url}/auth/v1/.well-known/jwks.json"
-        response = await self._http_client.get(url)
-        response.raise_for_status()
-
-        jwks_data = response.json()
-        keys: dict[str, PyJWK] = {}
-        for key_data in jwks_data.get("keys", []):
-            kid = key_data.get("kid")
-            if kid:
-                keys[kid] = PyJWK(key_data)
-
-        self._jwks_keys = keys
-        self._jwks_last_fetched = time.monotonic()
-
-    async def _get_signing_key(self, token: str) -> PyJWK:
-        """
-        Resolve the signing key for a token from the JWKS cache.
-
-        If the key ID (``kid``) is not in the cache, triggers one JWKS refresh
-        to handle key rotation before raising an error.
-        """
-        header = pyjwt.get_unverified_header(token)
-        kid = header.get("kid")
-        if not kid:
-            raise AuthenticationError("Token missing key ID (kid) header")
-
-        # Refresh cache if stale
-        now = time.monotonic()
-        if now - self._jwks_last_fetched > JWKS_CACHE_TTL_SECONDS:
-            logger.debug("JWKS cache expired, refreshing")
-            await self._fetch_jwks()
-
-        if kid in self._jwks_keys:
-            return self._jwks_keys[kid]
-
-        # Key not found — try one forced refresh to handle key rotation,
-        # but only if we haven't just refreshed
-        if now - self._jwks_last_fetched > JWKS_MIN_REFRESH_INTERVAL_SECONDS:
-            logger.info("Signing key %s not in cache, refreshing JWKS for possible key rotation", kid)
-            await self._fetch_jwks()
-            if kid in self._jwks_keys:
-                return self._jwks_keys[kid]
-
-        raise AuthenticationError("Unable to find signing key for token")
-
-    # ------------------------------------------------------------------
-    # Authentication
-    # ------------------------------------------------------------------
-
-    async def authenticate(self, context: RequestContext) -> TenantContext:
-        """
-        Validate a Supabase JWT and return tenant context.
-
-        Uses local JWKS verification when available (no network call per
-        request), falling back to the ``/auth/v1/user`` endpoint for legacy
-        HS256 projects.
-
-        Args:
-            context: Request context containing the API key (JWT)
-
-        Returns:
-            TenantContext with schema_name set to ``{prefix}_{user_uuid}``
-
-        Raises:
-            AuthenticationError: If token is missing, invalid, or expired
-        """
-        token = context.api_key
-
-        if not token:
-            raise AuthenticationError("Missing Authorization header. Expected: Bearer <supabase_jwt>")
-
-        if len(token) < MIN_TOKEN_LENGTH:
-            raise AuthenticationError("Invalid token format")
-
-        if self._http_client is None:
-            raise AuthenticationError("Extension not initialized")
-
-        # Verify the JWT and extract user ID
-        if self._use_jwks:
-            user_id = await self._verify_token_jwks(token)
-        else:
-            user_id = await self._verify_token_legacy(token)
-
-        # Validate user ID format before using in schema name
-        if not _UUID_RE.match(user_id):
-            raise AuthenticationError("Invalid user ID format in token")
-
-        # Build isolated schema name — hyphens to underscores for Postgres compatibility
-        safe_user_id = user_id.replace("-", "_")
-        schema_name = f"{self.schema_prefix}_{safe_user_id}"
-
-        # Initialize schema on first access
-        if schema_name not in self._initialized_schemas:
-            await self._initialize_schema(schema_name)
-
-        return TenantContext(schema_name=schema_name)
-
-    async def _verify_token_jwks(self, token: str) -> str:
-        """
-        Verify a JWT locally using cached JWKS public keys.
-
-        Validates signature, expiration, issuer, and audience. Returns the
-        user ID from the ``sub`` claim.
-
-        Raises:
-            AuthenticationError: If the token is invalid or expired.
-        """
-        try:
-            signing_key = await self._get_signing_key(token)
-            payload = pyjwt.decode(
-                token,
-                signing_key.key,
-                algorithms=SUPPORTED_ALGORITHMS,
-                audience="authenticated",
-                issuer=f"{self.supabase_url}/auth/v1",
-            )
-        except pyjwt.ExpiredSignatureError:
-            raise AuthenticationError("Token has expired")
-        except pyjwt.InvalidAudienceError:
-            raise AuthenticationError("Invalid token audience")
-        except pyjwt.InvalidIssuerError:
-            raise AuthenticationError("Invalid token issuer")
-        except pyjwt.DecodeError:
-            raise AuthenticationError("Invalid token")
-        except AuthenticationError:
-            raise
-        except Exception as e:
-            raise AuthenticationError(f"Token verification failed: {e!s}")
-
-        user_id = payload.get("sub")
-        if not user_id:
-            raise AuthenticationError("Token valid but missing subject (sub) claim")
-        return user_id
-
-    async def _verify_token_legacy(self, token: str) -> str:
-        """
-        Verify a JWT by calling the Supabase ``/auth/v1/user`` endpoint.
-
-        This is the fallback for projects using legacy HS256 JWT signing.
-        Adds a network round-trip per request.
-
-        Raises:
-            AuthenticationError: If the token is invalid or the request fails.
-        """
-        try:
-            response = await self._http_client.get(
-                f"{self.supabase_url}/auth/v1/user",
-                headers={
-                    "Authorization": f"Bearer {token}",
-                    "apikey": self.supabase_service_key,
-                },
-            )
-
-            if response.status_code == 401:
-                raise AuthenticationError("Invalid or expired token")
-
-            if response.status_code != 200:
-                raise AuthenticationError(f"Authentication failed: {response.status_code}")
-
-            user_data = response.json()
-            user_id = user_data.get("id")
-
-            if not user_id:
-                raise AuthenticationError("Token valid but no user ID found")
-
-            return user_id
-
-        except AuthenticationError:
-            raise
-        except httpx.TimeoutException:
-            raise AuthenticationError("Authentication timeout - please retry")
-        except httpx.RequestError as e:
-            raise AuthenticationError(f"Connection error: {e!s}")
-
-    # ------------------------------------------------------------------
-    # Schema management
-    # ------------------------------------------------------------------
-
-    async def _initialize_schema(self, schema_name: str) -> None:
-        """Run migrations for a new tenant schema and cache the result."""
-        logger.info("Initializing schema: %s", schema_name)
-        try:
-            await self.context.run_migration(schema_name)
-            self._initialized_schemas.add(schema_name)
-            logger.info("Schema ready: %s", schema_name)
-        except Exception as e:
-            logger.error("Schema initialization failed for %s: %s", schema_name, e)
-            raise AuthenticationError(f"Failed to initialize tenant: {e!s}")
-
-    async def list_tenants(self) -> list[Tenant]:
-        """Return all tenant schemas that have been initialized."""
-        return [Tenant(schema=schema) for schema in self._initialized_schemas]
-
-    # ------------------------------------------------------------------
-    # Health check
-    # ------------------------------------------------------------------
-
-    async def _health_check(self) -> None:
-        """Verify connectivity to Supabase using the auth health endpoint."""
-        try:
-            response = await self._http_client.get(
-                f"{self.supabase_url}/auth/v1/health",
-                headers={"apikey": self.supabase_service_key},
-            )
-            if response.status_code == 200:
-                logger.info("Supabase connection verified")
-            else:
-                logger.warning("Supabase health check returned %d", response.status_code)
-        except Exception as e:
-            logger.warning("Could not verify Supabase connection: %s", e)

hindsight-api/hindsight_api/extensions/builtin/tenant.py

@@ -54,7 +54,6 @@ class ApiKeyTenantExtension(TenantExtension):
         HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension
         HINDSIGHT_API_TENANT_API_KEY=your-secret-key
         HINDSIGHT_API_DATABASE_SCHEMA=your-schema (optional, defaults to 'public')
-        HINDSIGHT_API_TENANT_MCP_AUTH_DISABLED=true (optional, disable auth for MCP endpoints)
 
     For multi-tenant setups with separate schemas per tenant, implement a custom
     TenantExtension that looks up the schema based on the API key or token claims.
@@ -65,8 +64,6 @@ class ApiKeyTenantExtension(TenantExtension):
         self.expected_api_key = config.get("api_key")
         if not self.expected_api_key:
             raise ValueError("HINDSIGHT_API_TENANT_API_KEY is required when using ApiKeyTenantExtension")
-        # Allow disabling MCP auth for backwards compatibility
-        self.mcp_auth_disabled = config.get("mcp_auth_disabled", "").lower() in ("true", "1", "yes")
 
     async def authenticate(self, context: RequestContext) -> TenantContext:
         """Validate API key and return configured schema context."""
@@ -77,14 +74,3 @@ class ApiKeyTenantExtension(TenantExtension):
     async def list_tenants(self) -> list[Tenant]:
         """Return configured schema for single-tenant setup."""
         return [Tenant(schema=get_config().database_schema)]
-
-    async def authenticate_mcp(self, context: RequestContext) -> TenantContext:
-        """
-        Authenticate MCP requests.
-
-        If mcp_auth_disabled is set, skip authentication for backwards compatibility.
-        Otherwise, delegate to authenticate().
-        """
-        if self.mcp_auth_disabled:
-            return TenantContext(schema_name=get_config().database_schema)
-        return await self.authenticate(context)

hindsight-api/hindsight_api/extensions/mcp.py

@@ -1,42 +0,0 @@
-"""MCP Extension for registering additional MCP tools.
-
-This extension allows external packages (like hindsight-cloud) to register
-additional MCP tools on the Hindsight MCP server.
-
-Example:
-    HINDSIGHT_API_MCP_EXTENSION=hindsight_cloud.extensions:CloudMCPExtension
-"""
-
-import logging
-from abc import abstractmethod
-
-from fastmcp import FastMCP
-
-from hindsight_api import MemoryEngine
-from hindsight_api.extensions.base import Extension
-
-logger = logging.getLogger(__name__)
-
-
-class MCPExtension(Extension):
-    """Base class for MCP extensions that register additional tools.
-
-    Subclass this to add MCP tools in extension packages.
-
-    Example:
-        class CloudMCPExtension(MCPExtension):
-            def register_tools(self, mcp: FastMCP, memory: MemoryEngine) -> None:
-                @mcp.tool()
-                async def my_custom_tool(query: str) -> str:
-                    return "result"
-    """
-
-    @abstractmethod
-    def register_tools(self, mcp: FastMCP, memory: MemoryEngine) -> None:
-        """Register additional MCP tools.
-
-        Args:
-            mcp: FastMCP server instance to register tools on
-            memory: MemoryEngine instance for accessing memory operations
-        """
-        pass

hindsight-api/hindsight_api/extensions/tenant.py

@@ -87,22 +87,3 @@ class TenantExtension(Extension, ABC):
             For single-tenant setups, return [Tenant(schema="public")].
         """
         ...
-
-    async def authenticate_mcp(self, context: RequestContext) -> TenantContext:
-        """
-        Authenticate MCP requests.
-
-        By default, this calls authenticate(). Override this method to provide
-        different authentication behavior for MCP endpoints (e.g., to disable
-        auth for backwards compatibility with existing MCP servers).
-
-        Args:
-            context: The action context containing API key and other auth data.
-
-        Returns:
-            TenantContext with the schema_name for database operations.
-
-        Raises:
-            AuthenticationError: If authentication fails.
-        """
-        return await self.authenticate(context)

hindsight-api/hindsight_api/migrations.py

@@ -25,8 +25,6 @@ from alembic.config import Config
 from alembic.script.revision import ResolutionError
 from sqlalchemy import create_engine, text
 
-from .utils import mask_network_location
-
 logger = logging.getLogger(__name__)
 
 # Advisory lock ID for migrations (arbitrary unique number)
@@ -56,7 +54,7 @@ def _run_migrations_internal(database_url: str, script_location: str, schema: st
     """
     schema_name = schema or "public"
     logger.info(f"Running database migrations to head for schema '{schema_name}'...")
-    logger.info(f"Database URL: {mask_network_location(database_url)}")
+    logger.info(f"Database URL: {database_url}")
     logger.info(f"Script location: {script_location}")
 
     # Create Alembic configuration programmatically (no alembic.ini needed)

hindsight-api/hindsight_api/utils.py

@@ -1,13 +0,0 @@
-from urllib.parse import urlparse, urlunparse
-
-
-def mask_network_location(url):
-    if not url:
-        return url
-    parsed_url = urlparse(url)
-    masked_network_location = parsed_url.hostname or ""
-    if parsed_url.port:
-        masked_network_location += f":{parsed_url.port}"
-    if parsed_url.username or parsed_url.password:
-        masked_network_location = f"***:***@{masked_network_location}"
-    return urlunparse(parsed_url._replace(netloc=masked_network_location))

hindsight-api/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hindsight-api"
-version = "0.4.10"
+version = "0.4.9"
 description = "Hindsight: Agent Memory That Works Like Human Memory"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -25,7 +25,6 @@ dependencies = [
     "psycopg2-binary>=2.9.11",
     "tiktoken>=0.12.0",
     "httpx>=0.27.0",
-    "PyJWT[crypto]>=2.8.0",
     "fastmcp>=2.14.0", # CVE-2025-66416
     "pg0-embedded>=0.11.0",
     "python-dateutil>=2.8.0",

hindsight-api/tests/test_config_validation.py

@@ -1,109 +0,0 @@
-"""
-Tests for configuration validation.
-
-Verifies that config validation catches invalid parameter combinations.
-"""
-
-import os
-
-import pytest
-
-
-@pytest.fixture(autouse=True)
-def setup_test_env():
-    """Set up environment for each test, restoring original values after."""
-    from hindsight_api.config import clear_config_cache
-
-    # Save original environment values
-    env_vars_to_save = [
-        "HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS",
-        "HINDSIGHT_API_RETAIN_CHUNK_SIZE",
-        "HINDSIGHT_API_LLM_PROVIDER",
-        "HINDSIGHT_API_LLM_MODEL",
-    ]
-
-    # Save original values
-    original_values = {}
-    for key in env_vars_to_save:
-        original_values[key] = os.environ.get(key)
-
-    clear_config_cache()
-
-    yield
-
-    # Restore original environment
-    for key, original_value in original_values.items():
-        if original_value is None:
-            os.environ.pop(key, None)
-        else:
-            os.environ[key] = original_value
-
-    clear_config_cache()
-
-
-def test_retain_max_completion_tokens_must_be_greater_than_chunk_size():
-    """Test that RETAIN_MAX_COMPLETION_TOKENS > RETAIN_CHUNK_SIZE validation works."""
-    from hindsight_api.config import HindsightConfig
-
-    # Set invalid config: max_completion_tokens <= chunk_size
-    os.environ["HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS"] = "1000"
-    os.environ["HINDSIGHT_API_RETAIN_CHUNK_SIZE"] = "2000"
-    os.environ["HINDSIGHT_API_LLM_PROVIDER"] = "mock"
-
-    # Should raise ValueError with helpful message
-    with pytest.raises(ValueError) as exc_info:
-        HindsightConfig.from_env()
-
-    error_message = str(exc_info.value)
-
-    # Verify error message contains helpful information
-    assert "HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS" in error_message
-    assert "1000" in error_message
-    assert "HINDSIGHT_API_RETAIN_CHUNK_SIZE" in error_message
-    assert "2000" in error_message
-    assert "must be greater than" in error_message
-    assert "You have two options to fix this:" in error_message
-    assert "Increase HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS" in error_message
-    assert "Use a model that supports" in error_message
-
-
-def test_retain_max_completion_tokens_equal_to_chunk_size_fails():
-    """Test that RETAIN_MAX_COMPLETION_TOKENS == RETAIN_CHUNK_SIZE also fails."""
-    from hindsight_api.config import HindsightConfig
-
-    # Set invalid config: max_completion_tokens == chunk_size
-    os.environ["HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS"] = "3000"
-    os.environ["HINDSIGHT_API_RETAIN_CHUNK_SIZE"] = "3000"
-    os.environ["HINDSIGHT_API_LLM_PROVIDER"] = "mock"
-
-    # Should raise ValueError
-    with pytest.raises(ValueError) as exc_info:
-        HindsightConfig.from_env()
-
-    error_message = str(exc_info.value)
-    assert "must be greater than" in error_message
-
-
-def test_valid_retain_config_succeeds():
-    """Test that valid config with max_completion_tokens > chunk_size works."""
-    from hindsight_api.config import HindsightConfig
-
-    # Set valid config: max_completion_tokens > chunk_size
-    os.environ["HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS"] = "64000"
-    os.environ["HINDSIGHT_API_RETAIN_CHUNK_SIZE"] = "3000"
-    os.environ["HINDSIGHT_API_LLM_PROVIDER"] = "mock"
-
-    # Should not raise
-    config = HindsightConfig.from_env()
-    assert config.retain_max_completion_tokens == 64000
-    assert config.retain_chunk_size == 3000
-
-
-# Note: The BadRequestError wrapping is implemented in fact_extraction.py
-# but requires a complex integration test setup. The functionality is
-# straightforward: when a BadRequestError containing keywords like
-# "max_tokens", "max_completion_tokens", or "maximum context" is caught,
-# it's wrapped in a ValueError with helpful guidance.
-#
-# The config validation tests above ensure users get early feedback
-# about invalid configurations before runtime errors occur.

hindsight-api/tests/test_llm_provider.py

@@ -88,7 +88,6 @@ def should_skip_provider(provider: str, model: str = "") -> tuple[bool, str]:
 
 @pytest.mark.parametrize("provider,model", MODEL_MATRIX)
 @pytest.mark.asyncio
-@pytest.mark.timeout(300)  # Increase timeout for slow models like groq gpt-oss-120b
 async def test_llm_provider_api_methods(provider: str, model: str):
     """
     Test all LLM API methods used by Hindsight at runtime.
@@ -142,32 +141,27 @@ async def test_llm_provider_api_methods(provider: str, model: str):
         pytest.fail(f"{provider}/{model} call() plain text failed: {e}")
 
     # Test 3: call() with response_format (structured output)
-    # Skip for models that don't support structured output
-    skip_structured_output = (provider == "groq" and "gpt-oss-120b" in model.lower())
-    if skip_structured_output:
-        print(f"  ⊘ call() structured output: skipped (model doesn't support response_format)")
-    else:
-        try:
-            from pydantic import BaseModel
+    try:
+        from pydantic import BaseModel
 
-            class TestResponse(BaseModel):
-                answer: str
-                confidence: str
+        class TestResponse(BaseModel):
+            answer: str
+            confidence: str
 
-            response = await llm.call(
-                messages=[
-                    {"role": "system", "content": "You are a math assistant."},
-                    {"role": "user", "content": "What is the capital of France?"},
-                ],
-                response_format=TestResponse,
-                max_completion_tokens=100,
-            )
-            assert isinstance(response, TestResponse), f"Expected TestResponse, got {type(response)}"
-            assert hasattr(response, "answer"), "Structured output missing 'answer' field"
-            assert hasattr(response, "confidence"), "Structured output missing 'confidence' field"
-            print(f"  ✓ call() structured output: answer={response.answer}, confidence={response.confidence}")
-        except Exception as e:
-            pytest.fail(f"{provider}/{model} call() structured output failed: {e}")
+        response = await llm.call(
+            messages=[
+                {"role": "system", "content": "You are a math assistant."},
+                {"role": "user", "content": "What is the capital of France?"},
+            ],
+            response_format=TestResponse,
+            max_completion_tokens=100,
+        )
+        assert isinstance(response, TestResponse), f"Expected TestResponse, got {type(response)}"
+        assert hasattr(response, "answer"), "Structured output missing 'answer' field"
+        assert hasattr(response, "confidence"), "Structured output missing 'confidence' field"
+        print(f"  ✓ call() structured output: answer={response.answer}, confidence={response.confidence}")
+    except Exception as e:
+        pytest.fail(f"{provider}/{model} call() structured output failed: {e}")
 
     # Test 4: call_with_tools() (tool calling)
     try:
@@ -195,7 +189,7 @@ async def test_llm_provider_api_methods(provider: str, model: str):
                 {"role": "user", "content": "What's the weather like in Paris?"},
             ],
             tools=tools,
-            max_completion_tokens=500,  # Increased from 200 to give models enough space for tool calls
+            max_completion_tokens=200,
         )
 
         assert result is not None, "call_with_tools() returned None"

hindsight-api/tests/test_mcp_endpoint_routing.py

@@ -1,78 +0,0 @@
-"""Integration test for MCP endpoint routing.
-
-This test verifies that /mcp/ and /mcp/{bank_id}/ expose different tool sets.
-"""
-
-import httpx
-import pytest
-from mcp.client.session import ClientSession
-from mcp.client.streamable_http import streamable_http_client
-
-
-@pytest.mark.asyncio
-async def test_mcp_endpoint_routing_integration(memory):
-    """Test that multi-bank and single-bank endpoints expose different tools using StreamableHTTP.
-
-    This is a regression test for issue #317 where /mcp/{bank_id}/ was incorrectly
-    exposing all tools (including list_banks) and bank_id parameters.
-    """
-    from hindsight_api.api import create_app
-
-    # Create app with MCP enabled
-    app = create_app(memory, mcp_api_enabled=True, initialize_memory=False)
-
-    # Use the app's lifespan context to properly initialize MCP servers
-    async with app.router.lifespan_context(app):
-        # Create an HTTPX client that routes to our ASGI app
-        from httpx import ASGITransport
-
-        async with httpx.AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as http_client:
-            # Test 1: Multi-bank endpoint /mcp/
-            async with streamable_http_client("http://test/mcp/", http_client=http_client) as (
-                read_stream,
-                write_stream,
-                _,
-            ):
-                async with ClientSession(read_stream, write_stream) as session:
-                    await session.initialize()
-                    multi_result = await session.list_tools()
-
-                    multi_tools = {t.name for t in multi_result.tools}
-
-                    # Multi-bank should have all tools including bank management
-                    assert "retain" in multi_tools
-                    assert "recall" in multi_tools
-                    assert "reflect" in multi_tools
-                    assert "list_banks" in multi_tools, "Multi-bank should expose list_banks"
-                    assert "create_bank" in multi_tools, "Multi-bank should expose create_bank"
-
-                    # Multi-bank retain should have bank_id parameter
-                    retain_tool = next((t for t in multi_result.tools if t.name == "retain"), None)
-                    assert retain_tool is not None
-                    multi_params = set(retain_tool.inputSchema.get("properties", {}).keys())
-                    assert "bank_id" in multi_params, "Multi-bank retain should have bank_id parameter"
-
-            # Test 2: Single-bank endpoint /mcp/test-bank/
-            async with streamable_http_client("http://test/mcp/test-bank/", http_client=http_client) as (
-                read_stream,
-                write_stream,
-                _,
-            ):
-                async with ClientSession(read_stream, write_stream) as session:
-                    await session.initialize()
-                    single_result = await session.list_tools()
-
-                    single_tools = {t.name for t in single_result.tools}
-
-                    # Single-bank should only have scoped tools (no bank management)
-                    assert "retain" in single_tools
-                    assert "recall" in single_tools
-                    assert "reflect" in single_tools
-                    assert "list_banks" not in single_tools, "Single-bank should NOT expose list_banks"
-                    assert "create_bank" not in single_tools, "Single-bank should NOT expose create_bank"
-
-                    # Single-bank retain should NOT have bank_id parameter
-                    retain_tool = next((t for t in single_result.tools if t.name == "retain"), None)
-                    assert retain_tool is not None
-                    single_params = set(retain_tool.inputSchema.get("properties", {}).keys())
-                    assert "bank_id" not in single_params, "Single-bank retain should NOT have bank_id parameter"

hindsight-api/tests/test_mcp_extension.py

@@ -1,169 +0,0 @@
-"""Tests for MCPExtension loading and tool registration."""
-
-from unittest.mock import MagicMock, patch
-
-import pytest
-from fastmcp import FastMCP
-
-from hindsight_api import MemoryEngine
-from hindsight_api.extensions.mcp import MCPExtension
-
-
-class MockMCPExtension(MCPExtension):
-    """Test extension that registers a custom tool."""
-
-    def __init__(self, config=None):
-        super().__init__(config)
-        self.register_tools_called = False
-        self.registered_mcp = None
-        self.registered_memory = None
-
-    def register_tools(self, mcp: FastMCP, memory: MemoryEngine) -> None:
-        """Register a test tool to verify extension was called."""
-        self.register_tools_called = True
-        self.registered_mcp = mcp
-        self.registered_memory = memory
-
-        @mcp.tool()
-        async def test_extension_tool(query: str) -> str:
-            """A test tool registered by the extension."""
-            return f"Extension tool received: {query}"
-
-
-class TestMCPExtensionBase:
-    """Tests for MCPExtension base class."""
-
-    def test_mcp_extension_is_abstract(self):
-        """MCPExtension.register_tools is abstract and must be implemented."""
-        with pytest.raises(TypeError, match="abstract method"):
-            MCPExtension()
-
-    def test_subclass_can_be_instantiated(self):
-        """Subclass implementing register_tools can be instantiated."""
-        ext = MockMCPExtension()
-        assert ext is not None
-        assert ext.register_tools_called is False
-
-    def test_register_tools_receives_mcp_and_memory(self):
-        """register_tools receives FastMCP and MemoryEngine instances."""
-        ext = MockMCPExtension()
-        mcp = FastMCP("test")
-        memory = MagicMock(spec=MemoryEngine)
-
-        ext.register_tools(mcp, memory)
-
-        assert ext.register_tools_called is True
-        assert ext.registered_mcp is mcp
-        assert ext.registered_memory is memory
-
-
-class TestMCPExtensionLoading:
-    """Tests for MCPExtension loading in create_mcp_server."""
-
-    @pytest.fixture
-    def mock_memory(self):
-        """Create a mock MemoryEngine."""
-        memory = MagicMock()
-        memory._tenant_extension = MagicMock()
-        memory._tenant_extension.authenticate_mcp = MagicMock()
-        return memory
-
-    def test_create_mcp_server_without_extension(self, mock_memory):
-        """create_mcp_server works without MCPExtension configured."""
-        from hindsight_api.api.mcp import create_mcp_server
-
-        with patch("hindsight_api.api.mcp.load_extension", return_value=None):
-            mcp = create_mcp_server(mock_memory)
-
-        # Core tools should be registered
-        tools = mcp._tool_manager._tools
-        assert "retain" in tools
-        assert "recall" in tools
-        assert "reflect" in tools
-        # Extension tool should NOT be present
-        assert "test_extension_tool" not in tools
-
-    def test_create_mcp_server_with_extension(self, mock_memory):
-        """create_mcp_server loads and calls MCPExtension when configured."""
-        from hindsight_api.api.mcp import create_mcp_server
-
-        mock_ext = MockMCPExtension()
-
-        with patch("hindsight_api.api.mcp.load_extension", return_value=mock_ext):
-            mcp = create_mcp_server(mock_memory)
-
-        # Extension should have been called
-        assert mock_ext.register_tools_called is True
-
-        # Core tools should still be registered
-        tools = mcp._tool_manager._tools
-        assert "retain" in tools
-        assert "recall" in tools
-
-        # Extension tool should also be registered
-        assert "test_extension_tool" in tools
-
-    @pytest.mark.asyncio
-    async def test_extension_tool_is_callable(self, mock_memory):
-        """Tool registered by extension can be called."""
-        from hindsight_api.api.mcp import create_mcp_server
-
-        mock_ext = MockMCPExtension()
-
-        with patch("hindsight_api.api.mcp.load_extension", return_value=mock_ext):
-            mcp = create_mcp_server(mock_memory)
-
-        # Get and call the extension tool
-        tools = mcp._tool_manager._tools
-        test_tool = tools["test_extension_tool"]
-        result = await test_tool.fn(query="hello world")
-
-        assert result == "Extension tool received: hello world"
-
-    def test_load_extension_called_with_correct_args(self, mock_memory):
-        """load_extension is called with 'MCP' prefix and MCPExtension class."""
-        from hindsight_api.api.mcp import create_mcp_server
-
-        with patch("hindsight_api.api.mcp.load_extension") as mock_load:
-            mock_load.return_value = None
-            create_mcp_server(mock_memory)
-
-        mock_load.assert_called_once_with("MCP", MCPExtension)
-
-
-class TestMCPExtensionIntegration:
-    """Integration tests verifying extension tools work end-to-end."""
-
-    @pytest.fixture
-    def mock_memory(self):
-        """Create a mock MemoryEngine with required methods."""
-        memory = MagicMock()
-        memory.retain_batch_async = MagicMock()
-        memory.submit_async_retain = MagicMock(return_value={"operation_id": "test-op"})
-        memory.recall_async = MagicMock(return_value=MagicMock(results=[]))
-        memory.reflect_async = MagicMock(return_value=MagicMock(text="reflection"))
-        memory.list_banks = MagicMock(return_value=[])
-        memory.get_bank_profile = MagicMock(return_value={"id": "test"})
-        memory._tenant_extension = MagicMock()
-        return memory
-
-    def test_extension_tools_coexist_with_core_tools(self, mock_memory):
-        """Extension tools are added alongside core tools, not replacing them."""
-        from hindsight_api.api.mcp import create_mcp_server
-
-        mock_ext = MockMCPExtension()
-
-        with patch("hindsight_api.api.mcp.load_extension", return_value=mock_ext):
-            mcp = create_mcp_server(mock_memory)
-
-        tools = mcp._tool_manager._tools
-        # All core tools present
-        assert "retain" in tools
-        assert "recall" in tools
-        assert "reflect" in tools
-        assert "list_banks" in tools
-        assert "create_bank" in tools
-        # Extension tool also present
-        assert "test_extension_tool" in tools
-        # Total: 5 core + 1 extension = 6 tools
-        assert len(tools) == 6

hindsight-api/tests/test_mcp_routing.py

@@ -141,152 +141,3 @@ async def test_mcp_tools_propagate_api_key(mock_memory):
     finally:
         _current_bank_id.reset(bank_token)
         _current_api_key.reset(api_key_token)
-
-
-def test_multi_bank_mode_exposes_all_tools(mock_memory):
-    """Test that multi-bank mode exposes all tools including bank management."""
-    from hindsight_api.api.mcp import create_mcp_server
-
-    # Create server in multi-bank mode (default)
-    mcp_server = create_mcp_server(mock_memory, multi_bank=True)
-    tools = mcp_server._tool_manager._tools
-
-    # Should have all tools
-    assert "retain" in tools
-    assert "recall" in tools
-    assert "reflect" in tools
-    assert "list_banks" in tools
-    assert "create_bank" in tools
-
-
-def test_single_bank_mode_excludes_bank_management_tools(mock_memory):
-    """Test that single-bank mode only exposes bank-scoped tools."""
-    from hindsight_api.api.mcp import create_mcp_server
-
-    # Create server in single-bank mode
-    mcp_server = create_mcp_server(mock_memory, multi_bank=False)
-    tools = mcp_server._tool_manager._tools
-
-    # Should only have bank-scoped tools
-    assert "retain" in tools
-    assert "recall" in tools
-    assert "reflect" in tools
-
-    # Should NOT have bank management tools
-    assert "list_banks" not in tools
-    assert "create_bank" not in tools
-
-
-def test_multi_bank_mode_tools_have_bank_id_param(mock_memory):
-    """Test that multi-bank mode tools include bank_id parameter."""
-    from hindsight_api.api.mcp import create_mcp_server
-    import inspect
-
-    mcp_server = create_mcp_server(mock_memory, multi_bank=True)
-    tools = mcp_server._tool_manager._tools
-
-    # Check that tools have bank_id parameter
-    retain_tool = tools["retain"]
-    retain_sig = inspect.signature(retain_tool.fn)
-    assert "bank_id" in retain_sig.parameters
-
-    recall_tool = tools["recall"]
-    recall_sig = inspect.signature(recall_tool.fn)
-    assert "bank_id" in recall_sig.parameters
-
-    reflect_tool = tools["reflect"]
-    reflect_sig = inspect.signature(reflect_tool.fn)
-    assert "bank_id" in reflect_sig.parameters
-
-
-def test_single_bank_mode_tools_no_bank_id_param(mock_memory):
-    """Test that single-bank mode tools do NOT include bank_id parameter."""
-    from hindsight_api.api.mcp import create_mcp_server
-    import inspect
-
-    mcp_server = create_mcp_server(mock_memory, multi_bank=False)
-    tools = mcp_server._tool_manager._tools
-
-    # Check that tools do NOT have bank_id parameter
-    retain_tool = tools["retain"]
-    retain_sig = inspect.signature(retain_tool.fn)
-    assert "bank_id" not in retain_sig.parameters
-
-    recall_tool = tools["recall"]
-    recall_sig = inspect.signature(recall_tool.fn)
-    assert "bank_id" not in recall_sig.parameters
-
-    reflect_tool = tools["reflect"]
-    reflect_sig = inspect.signature(reflect_tool.fn)
-    assert "bank_id" not in reflect_sig.parameters
-
-
-@pytest.mark.asyncio
-async def test_middleware_handles_both_endpoints(mock_memory):
-    """Test that MCPMiddleware routes to correct server based on URL path."""
-    from hindsight_api.api.mcp import MCPMiddleware
-
-    # Create middleware (single instance)
-    middleware = MCPMiddleware(None, mock_memory)
-
-    # Verify both server instances exist
-    assert middleware.multi_bank_app is not None
-    assert middleware.single_bank_app is not None
-
-    # Verify they expose different tools
-    multi_bank_tools = middleware.multi_bank_server._tool_manager._tools
-    single_bank_tools = middleware.single_bank_server._tool_manager._tools
-
-    # Multi-bank should have all tools
-    assert "retain" in multi_bank_tools
-    assert "recall" in multi_bank_tools
-    assert "list_banks" in multi_bank_tools
-    assert "create_bank" in multi_bank_tools
-
-    # Single-bank should only have scoped tools
-    assert "retain" in single_bank_tools
-    assert "recall" in single_bank_tools
-    assert "list_banks" not in single_bank_tools
-    assert "create_bank" not in single_bank_tools
-
-
-@pytest.mark.asyncio
-async def test_routing_logic_from_url_path():
-    """Test that routing correctly selects server based on URL structure."""
-    from hindsight_api.api.mcp import MCPMiddleware
-    from unittest.mock import AsyncMock
-
-    # Mock memory
-    mock_memory = MagicMock()
-
-    # Create middleware
-    middleware = MCPMiddleware(None, mock_memory)
-
-    # Simulate different URL patterns and verify routing
-    test_cases = [
-        # (path_after_stripping_mcp, expected_bank_id_from_path, expected_bank_id, description)
-        ("/alice/messages", True, "alice", "Bank ID in path with endpoint"),
-        ("/my-agent-123/", True, "my-agent-123", "Bank ID in path with trailing slash"),
-        ("ciccio/messages", True, "ciccio", "Bank ID without leading slash (after mount strip)"),
-        ("bob", True, "bob", "Bank ID only, no leading slash"),
-        ("/messages", False, None, "MCP endpoint, no bank ID"),
-        ("/", False, None, "Root path, no bank ID"),
-    ]
-
-    for path, expected_bank_from_path, expected_bank_id, description in test_cases:
-        # Simulate the path parsing logic with leading slash normalization
-        if path and not path.startswith("/"):
-            path = "/" + path
-
-        bank_id = None
-        bank_id_from_path = False
-        MCP_ENDPOINTS = {"sse", "messages"}
-
-        if path.startswith("/") and len(path) > 1:
-            parts = path[1:].split("/", 1)
-            if parts[0] and parts[0] not in MCP_ENDPOINTS:
-                bank_id = parts[0]
-                bank_id_from_path = True
-
-        assert bank_id_from_path == expected_bank_from_path, f"Failed for: {description} (path={path})"
-        assert bank_id == expected_bank_id, f"Failed bank_id for: {description} (path={path}, got={bank_id})"

hindsight-api/tests/test_mental_models.py

@@ -738,20 +738,12 @@ class TestMentalModelRefreshTagSecurity:
             "Refreshed model should access memories/models with matching tags (user:alice)"
 
         # MUST NOT include Bob's content (security violation)
-        # Use word boundary matching to avoid false positives (e.g., "team" contains "tea")
-        import re
-        def contains_word(text: str, word: str) -> bool:
-            """Check if text contains word as a whole word (not substring)."""
-            return bool(re.search(rf'\b{re.escape(word)}\b', text, re.IGNORECASE))
-
-        assert not contains_word(refreshed_content, "bob") and \
-               not contains_word(refreshed_content, "python") and \
-               not contains_word(refreshed_content, "tea"), \
-            f"SECURITY VIOLATION: Refreshed model accessed memories/models with different tags (user:bob). Content: {refreshed['content']}"
+        assert "bob" not in refreshed_content and "python" not in refreshed_content and "tea" not in refreshed_content, \
+            f"SECURITY VIOLATION: Refreshed model accessed memories/models with different tags (user:bob). Content: {refreshed_content}"
 
         # MUST NOT include untagged content (security violation)
         assert "100 employees" not in refreshed_content and "growing fast" not in refreshed_content, \
-            f"SECURITY VIOLATION: Refreshed model accessed untagged memories/models. Content: {refreshed['content']}"
+            f"SECURITY VIOLATION: Refreshed model accessed untagged memories/models. Content: {refreshed_content}"
 
         # Cleanup
         await memory.delete_bank(bank_id, request_context=request_context)
@@ -852,61 +844,3 @@ class TestMentalModelRefreshTagSecurity:
 
         # Cleanup
         await memory.delete_bank(bank_id, request_context=request_context)
-
-    async def test_refresh_mental_model_with_directives(self, memory: MemoryEngine, request_context):
-        """Test that refreshing a mental model with directives works correctly."""
-        bank_id = f"test-refresh-directives-{uuid.uuid4().hex[:8]}"
-
-        # Ensure bank exists
-        await memory.get_bank_profile(bank_id, request_context=request_context)
-
-        # Create a directive
-        directive = await memory.create_directive(
-            bank_id=bank_id,
-            name="Response Style",
-            content="Always be concise and professional",
-            request_context=request_context,
-        )
-
-        # Create a concept mental model to refresh
-        concept = await memory.create_mental_model(
-            bank_id=bank_id,
-            name="Team Info",
-            source_query="Team information summary",
-            content="Initial team information",
-            request_context=request_context,
-        )
-
-        # Add some memories
-        await memory.retain_batch_async(
-            bank_id=bank_id,
-            contents=[
-                {"content": "Alice is the team lead and handles project planning."},
-                {"content": "Bob is a senior engineer who mentors junior developers."},
-            ],
-            request_context=request_context,
-        )
-
-        # Wait for retain to complete
-        await memory.wait_for_background_tasks()
-
-        # Refresh the concept mental model (this should include directive in based_on)
-        refreshed = await memory.refresh_mental_model(
-            bank_id=bank_id,
-            mental_model_id=concept["id"],
-            request_context=request_context,
-        )
-
-        # Wait for background tasks to complete
-        await memory.wait_for_background_tasks()
-
-        # Verify the refresh completed without errors
-        assert refreshed is not None
-        assert refreshed["content"] is not None
-
-        # Get the updated mental model
-        updated = await memory.get_mental_model(bank_id, concept["id"], request_context=request_context)
-        assert updated["content"] != "Initial team information"
-
-        # Cleanup
-        await memory.delete_bank(bank_id, request_context=request_context)

hindsight-api/tests/test_supabase_tenant.py

@@ -1,834 +0,0 @@
-"""Tests for the Supabase Tenant Extension."""
-
-import time
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import httpx
-import jwt as pyjwt
-import pytest
-from jwt import PyJWK
-
-from hindsight_api.extensions.builtin.supabase_tenant import (
-    JWKS_CACHE_TTL_SECONDS,
-    JWKS_MIN_REFRESH_INTERVAL_SECONDS,
-    MIN_TOKEN_LENGTH,
-    SupabaseTenantExtension,
-)
-from hindsight_api.extensions.context import ExtensionContext
-from hindsight_api.extensions.loader import load_extension
-from hindsight_api.extensions.tenant import AuthenticationError, Tenant, TenantContext, TenantExtension
-from hindsight_api.models import RequestContext
-
-# A valid UUID for test user IDs
-VALID_UUID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
-
-# Minimal JWKS response with one RSA key
-MOCK_JWKS_RESPONSE = {
-    "keys": [
-        {
-            "kid": "test-key-1",
-            "kty": "RSA",
-            "alg": "RS256",
-            "use": "sig",
-            "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
-            "e": "AQAB",
-        }
-    ]
-}
-
-
-def _make_extension(
-    supabase_url: str = "https://test.supabase.co",
-    service_key: str | None = "test-service-key",
-    schema_prefix: str | None = None,
-) -> SupabaseTenantExtension:
-    """Helper to create a SupabaseTenantExtension with test config."""
-    config = {
-        "supabase_url": supabase_url,
-    }
-    if service_key is not None:
-        config["supabase_service_key"] = service_key
-    if schema_prefix is not None:
-        config["schema_prefix"] = schema_prefix
-    return SupabaseTenantExtension(config)
-
-
-def _make_mock_response(status_code: int = 200, json_data: dict | None = None) -> MagicMock:
-    """Helper to create a mock httpx.Response."""
-    response = MagicMock(spec=httpx.Response)
-    response.status_code = status_code
-    response.json.return_value = json_data or {}
-    response.raise_for_status = MagicMock()
-    if status_code >= 400:
-        response.raise_for_status.side_effect = httpx.HTTPStatusError("error", request=MagicMock(), response=response)
-    return response
-
-
-def _make_valid_token() -> str:
-    """Return a token that passes the MIN_TOKEN_LENGTH check."""
-    return "a" * (MIN_TOKEN_LENGTH + 10)
-
-
-def _setup_jwks_ext() -> tuple[SupabaseTenantExtension, AsyncMock]:
-    """Create an extension in JWKS mode with mocked internals."""
-    ext = _make_extension()
-    mock_client = AsyncMock(spec=httpx.AsyncClient)
-    ext._http_client = mock_client
-    ext._use_jwks = True
-    ext._jwks_keys = {"test-key-1": MagicMock(spec=PyJWK)}
-    ext._jwks_keys["test-key-1"].key = "mock-public-key"
-    ext._jwks_last_fetched = time.monotonic()
-    return ext, mock_client
-
-
-def _setup_legacy_ext() -> tuple[SupabaseTenantExtension, AsyncMock]:
-    """Create an extension in legacy mode with mocked internals."""
-    ext = _make_extension()
-    mock_client = AsyncMock(spec=httpx.AsyncClient)
-    ext._http_client = mock_client
-    ext._use_jwks = False
-    return ext, mock_client
-
-
-# ======================================================================
-# Initialization
-# ======================================================================
-
-
-class TestSupabaseTenantExtensionInit:
-    """Tests for extension initialization."""
-
-    def test_init_with_valid_config(self):
-        ext = _make_extension()
-        assert ext.supabase_url == "https://test.supabase.co"
-        assert ext.supabase_service_key == "test-service-key"
-        assert ext.schema_prefix == "user"
-        assert ext._initialized_schemas == set()
-        assert ext._http_client is None
-        assert ext._use_jwks is False
-        assert ext._jwks_keys == {}
-
-    def test_init_missing_supabase_url(self):
-        with pytest.raises(ValueError, match="HINDSIGHT_API_TENANT_SUPABASE_URL is required"):
-            SupabaseTenantExtension({})
-
-    def test_init_without_service_key(self):
-        """Service key is optional — JWKS mode doesn't require it."""
-        ext = _make_extension(service_key=None)
-        assert ext.supabase_service_key is None
-
-    def test_init_default_schema_prefix(self):
-        ext = _make_extension()
-        assert ext.schema_prefix == "user"
-
-    def test_init_custom_schema_prefix(self):
-        ext = _make_extension(schema_prefix="tenant")
-        assert ext.schema_prefix == "tenant"
-
-    def test_init_strips_trailing_slash(self):
-        ext = _make_extension(supabase_url="https://test.supabase.co/")
-        assert ext.supabase_url == "https://test.supabase.co"
-
-    def test_init_rejects_invalid_schema_prefix(self):
-        """Schema prefix with special characters should be rejected."""
-        with pytest.raises(ValueError, match="Invalid schema_prefix"):
-            _make_extension(schema_prefix='"; DROP TABLE')
-
-    def test_init_rejects_empty_schema_prefix(self):
-        with pytest.raises(ValueError, match="Invalid schema_prefix"):
-            _make_extension(schema_prefix="")
-
-    def test_init_rejects_schema_prefix_starting_with_digit(self):
-        with pytest.raises(ValueError, match="Invalid schema_prefix"):
-            _make_extension(schema_prefix="123abc")
-
-    def test_init_allows_underscore_prefix(self):
-        ext = _make_extension(schema_prefix="_internal")
-        assert ext.schema_prefix == "_internal"
-
-    def test_is_tenant_extension_subclass(self):
-        ext = _make_extension()
-        assert isinstance(ext, TenantExtension)
-
-
-# ======================================================================
-# Startup — JWKS initialization
-# ======================================================================
-
-
-class TestSupabaseTenantExtensionStartup:
-    """Tests for on_startup behavior."""
-
-    @pytest.mark.asyncio
-    async def test_on_startup_creates_http_client(self):
-        ext = _make_extension()
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-        # JWKS fetch returns keys
-        mock_client.get.return_value = _make_mock_response(200, MOCK_JWKS_RESPONSE)
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            with patch("hindsight_api.extensions.builtin.supabase_tenant.PyJWK"):
-                await ext.on_startup()
-
-        assert ext._http_client is mock_client
-
-    @pytest.mark.asyncio
-    async def test_on_startup_fetches_jwks(self):
-        ext = _make_extension()
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-        mock_client.get.return_value = _make_mock_response(200, MOCK_JWKS_RESPONSE)
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            with patch("hindsight_api.extensions.builtin.supabase_tenant.PyJWK") as mock_pyjwk:
-                mock_pyjwk.return_value = MagicMock(spec=PyJWK)
-                await ext.on_startup()
-
-        assert ext._use_jwks is True
-        # First call: JWKS fetch, second call: health check
-        assert mock_client.get.call_count == 2
-        jwks_call = mock_client.get.call_args_list[0]
-        assert jwks_call.args[0] == "https://test.supabase.co/auth/v1/.well-known/jwks.json"
-
-    @pytest.mark.asyncio
-    async def test_on_startup_falls_back_to_legacy_when_jwks_empty(self):
-        ext = _make_extension()
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-
-        # JWKS returns empty keys, health check succeeds
-        def mock_get(url, **kwargs):
-            if "jwks" in url:
-                return _make_mock_response(200, {"keys": []})
-            return _make_mock_response(200)
-
-        mock_client.get.side_effect = mock_get
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            await ext.on_startup()
-
-        assert ext._use_jwks is False
-
-    @pytest.mark.asyncio
-    async def test_on_startup_falls_back_to_legacy_when_jwks_fetch_fails(self):
-        ext = _make_extension()
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-
-        call_count = 0
-
-        def mock_get(url, **kwargs):
-            nonlocal call_count
-            call_count += 1
-            if call_count == 1:
-                # JWKS fetch fails
-                raise httpx.ConnectError("Connection refused")
-            # health check
-            return _make_mock_response(200)
-
-        mock_client.get.side_effect = mock_get
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            await ext.on_startup()
-
-        assert ext._use_jwks is False
-
-    @pytest.mark.asyncio
-    async def test_on_startup_raises_if_no_jwks_and_no_service_key(self):
-        ext = _make_extension(service_key=None)
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-        mock_client.get.return_value = _make_mock_response(200, {"keys": []})
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            with pytest.raises(ValueError, match="HINDSIGHT_API_TENANT_SUPABASE_SERVICE_KEY is required"):
-                await ext.on_startup()
-
-    @pytest.mark.asyncio
-    async def test_on_startup_health_check_with_service_key(self):
-        ext = _make_extension()
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-        mock_client.get.return_value = _make_mock_response(200, MOCK_JWKS_RESPONSE)
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            with patch("hindsight_api.extensions.builtin.supabase_tenant.PyJWK"):
-                await ext.on_startup()
-
-        # Second call should be health check
-        health_call = mock_client.get.call_args_list[1]
-        assert health_call.args[0] == "https://test.supabase.co/auth/v1/health"
-        assert health_call.kwargs["headers"] == {"apikey": "test-service-key"}
-
-    @pytest.mark.asyncio
-    async def test_on_startup_skips_health_check_without_service_key(self):
-        ext = _make_extension(service_key=None)
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-        mock_client.get.return_value = _make_mock_response(200, MOCK_JWKS_RESPONSE)
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.httpx.AsyncClient", return_value=mock_client):
-            with patch("hindsight_api.extensions.builtin.supabase_tenant.PyJWK"):
-                await ext.on_startup()
-
-        # Only one call: JWKS fetch, no health check
-        assert mock_client.get.call_count == 1
-
-
-# ======================================================================
-# JWKS cache management
-# ======================================================================
-
-
-class TestJWKSCacheManagement:
-    """Tests for JWKS key fetching, caching, and rotation handling."""
-
-    @pytest.mark.asyncio
-    async def test_get_signing_key_from_cache(self):
-        ext, _ = _setup_jwks_ext()
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header:
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            key = await ext._get_signing_key("fake-token")
-
-        assert key is ext._jwks_keys["test-key-1"]
-
-    @pytest.mark.asyncio
-    async def test_get_signing_key_refreshes_stale_cache(self):
-        ext, mock_client = _setup_jwks_ext()
-        # Make cache expired
-        ext._jwks_last_fetched = time.monotonic() - JWKS_CACHE_TTL_SECONDS - 1
-
-        new_key = MagicMock(spec=PyJWK)
-        mock_client.get.return_value = _make_mock_response(200, MOCK_JWKS_RESPONSE)
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.PyJWK", return_value=new_key),
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            key = await ext._get_signing_key("fake-token")
-
-        assert key is new_key
-        mock_client.get.assert_called_once()
-
-    @pytest.mark.asyncio
-    async def test_get_signing_key_handles_key_rotation(self):
-        """When kid not in cache and cache is old enough, refresh once for key rotation."""
-        ext, mock_client = _setup_jwks_ext()
-        # Make cache just old enough to allow a refresh
-        ext._jwks_last_fetched = time.monotonic() - JWKS_MIN_REFRESH_INTERVAL_SECONDS - 1
-
-        rotated_key = MagicMock(spec=PyJWK)
-        mock_client.get.return_value = _make_mock_response(200, MOCK_JWKS_RESPONSE)
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.PyJWK", return_value=rotated_key),
-        ):
-            mock_header.return_value = {"kid": "rotated-key-99", "alg": "RS256"}
-            # The refreshed JWKS won't have "rotated-key-99" either, so this should raise
-            with pytest.raises(AuthenticationError, match="Unable to find signing key"):
-                await ext._get_signing_key("fake-token")
-
-        # Should have attempted one refresh
-        mock_client.get.assert_called_once()
-
-    @pytest.mark.asyncio
-    async def test_get_signing_key_missing_kid_header(self):
-        ext, _ = _setup_jwks_ext()
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header:
-            mock_header.return_value = {"alg": "RS256"}  # no kid
-            with pytest.raises(AuthenticationError, match="Token missing key ID"):
-                await ext._get_signing_key("fake-token")
-
-    @pytest.mark.asyncio
-    async def test_get_signing_key_refresh_network_error(self):
-        """If JWKS refresh fails during key rotation, error should propagate."""
-        ext, mock_client = _setup_jwks_ext()
-        ext._jwks_last_fetched = time.monotonic() - JWKS_MIN_REFRESH_INTERVAL_SECONDS - 1
-
-        mock_client.get.side_effect = httpx.ConnectError("Connection refused")
-
-        with patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header:
-            mock_header.return_value = {"kid": "unknown-key", "alg": "RS256"}
-            with pytest.raises(Exception):
-                await ext._get_signing_key("fake-token")
-
-
-# ======================================================================
-# Authentication — JWKS mode
-# ======================================================================
-
-
-class TestAuthenticateJWKS:
-    """Tests for JWKS-based JWT verification."""
-
-    @pytest.mark.asyncio
-    async def test_authenticate_valid_token(self):
-        ext, _ = _setup_jwks_ext()
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": VALID_UUID, "aud": "authenticated"}
-
-            result = await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        assert isinstance(result, TenantContext)
-        expected_schema = "user_" + VALID_UUID.replace("-", "_")
-        assert result.schema_name == expected_schema
-
-    @pytest.mark.asyncio
-    async def test_authenticate_custom_prefix(self):
-        ext, _ = _setup_jwks_ext()
-        ext.schema_prefix = "org"
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": VALID_UUID}
-
-            result = await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        assert result.schema_name.startswith("org_")
-
-    @pytest.mark.asyncio
-    async def test_authenticate_expired_token(self):
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch(
-                "hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode",
-                side_effect=pyjwt.ExpiredSignatureError(),
-            ),
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-
-            with pytest.raises(AuthenticationError, match="Token has expired"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_invalid_audience(self):
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch(
-                "hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode",
-                side_effect=pyjwt.InvalidAudienceError(),
-            ),
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-
-            with pytest.raises(AuthenticationError, match="Invalid token audience"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_invalid_issuer(self):
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch(
-                "hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode",
-                side_effect=pyjwt.InvalidIssuerError(),
-            ),
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-
-            with pytest.raises(AuthenticationError, match="Invalid token issuer"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_decode_error(self):
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch(
-                "hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode",
-                side_effect=pyjwt.DecodeError(),
-            ),
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-
-            with pytest.raises(AuthenticationError, match="Invalid token"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_missing_sub_claim(self):
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"email": "[email protected]"}  # no sub
-
-            with pytest.raises(AuthenticationError, match="missing subject"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_empty_sub_claim(self):
-        """Empty string sub claim should be treated as missing."""
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": ""}
-
-            with pytest.raises(AuthenticationError, match="missing subject"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_generic_exception(self):
-        """Unexpected exceptions during decode should be caught and wrapped."""
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch(
-                "hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode",
-                side_effect=RuntimeError("unexpected internal error"),
-            ),
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-
-            with pytest.raises(AuthenticationError, match="Token verification failed"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-
-# ======================================================================
-# Authentication — Legacy mode
-# ======================================================================
-
-
-class TestAuthenticateLegacy:
-    """Tests for legacy /auth/v1/user endpoint verification."""
-
-    @pytest.mark.asyncio
-    async def test_authenticate_valid_token(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.return_value = _make_mock_response(200, {"id": VALID_UUID})
-
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        result = await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        assert isinstance(result, TenantContext)
-        expected_schema = "user_" + VALID_UUID.replace("-", "_")
-        assert result.schema_name == expected_schema
-
-    @pytest.mark.asyncio
-    async def test_authenticate_calls_user_endpoint(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.return_value = _make_mock_response(200, {"id": VALID_UUID})
-
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        token = _make_valid_token()
-        await ext.authenticate(RequestContext(api_key=token))
-
-        mock_client.get.assert_called_once_with(
-            "https://test.supabase.co/auth/v1/user",
-            headers={
-                "Authorization": f"Bearer {token}",
-                "apikey": "test-service-key",
-            },
-        )
-
-    @pytest.mark.asyncio
-    async def test_authenticate_expired_token_401(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.return_value = _make_mock_response(401)
-
-        with pytest.raises(AuthenticationError, match="Invalid or expired token"):
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_supabase_error_500(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.return_value = _make_mock_response(500)
-
-        with pytest.raises(AuthenticationError, match="Authentication failed: 500"):
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_no_user_id(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.return_value = _make_mock_response(200, {"email": "[email protected]"})
-
-        with pytest.raises(AuthenticationError, match="no user ID found"):
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_timeout(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.side_effect = httpx.TimeoutException("Request timed out")
-
-        with pytest.raises(AuthenticationError, match="Authentication timeout"):
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_connection_error(self):
-        ext, mock_client = _setup_legacy_ext()
-        mock_client.get.side_effect = httpx.ConnectError("Connection refused")
-
-        with pytest.raises(AuthenticationError, match="Connection error"):
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-
-# ======================================================================
-# Authentication — common (both modes)
-# ======================================================================
-
-
-class TestAuthenticateCommon:
-    """Tests that apply regardless of verification mode."""
-
-    @pytest.mark.asyncio
-    async def test_authenticate_missing_token(self):
-        ext, _ = _setup_jwks_ext()
-
-        with pytest.raises(AuthenticationError, match="Missing Authorization header"):
-            await ext.authenticate(RequestContext(api_key=None))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_empty_token(self):
-        ext, _ = _setup_jwks_ext()
-
-        with pytest.raises(AuthenticationError, match="Missing Authorization header"):
-            await ext.authenticate(RequestContext(api_key=""))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_short_token(self):
-        ext, _ = _setup_jwks_ext()
-
-        with pytest.raises(AuthenticationError, match="Invalid token format"):
-            await ext.authenticate(RequestContext(api_key="short"))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_not_initialized(self):
-        ext = _make_extension()
-        # _http_client is None by default
-
-        with pytest.raises(AuthenticationError, match="Extension not initialized"):
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_rejects_non_uuid_user_id(self):
-        """User IDs that aren't valid UUIDs should be rejected for schema safety."""
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": "not-a-uuid"}
-
-            with pytest.raises(AuthenticationError, match="Invalid user ID format"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-    @pytest.mark.asyncio
-    async def test_authenticate_rejects_malicious_user_id(self):
-        """User IDs with SQL injection attempts should be rejected."""
-        ext, _ = _setup_jwks_ext()
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": "'; DROP TABLE users;--"}
-
-            with pytest.raises(AuthenticationError, match="Invalid user ID format"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-
-# ======================================================================
-# Schema management
-# ======================================================================
-
-
-class TestSupabaseTenantExtensionSchemaManagement:
-    """Tests for schema initialization and caching."""
-
-    @pytest.mark.asyncio
-    async def test_schema_initialized_on_first_access(self):
-        ext, _ = _setup_jwks_ext()
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": VALID_UUID}
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        expected_schema = "user_" + VALID_UUID.replace("-", "_")
-        mock_context.run_migration.assert_called_once_with(expected_schema)
-        assert expected_schema in ext._initialized_schemas
-
-    @pytest.mark.asyncio
-    async def test_schema_cached_on_second_access(self):
-        ext, _ = _setup_jwks_ext()
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": VALID_UUID}
-
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        # run_migration should only be called once
-        expected_schema = "user_" + VALID_UUID.replace("-", "_")
-        mock_context.run_migration.assert_called_once_with(expected_schema)
-
-    @pytest.mark.asyncio
-    async def test_schema_init_failure(self):
-        ext, _ = _setup_jwks_ext()
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock(side_effect=RuntimeError("Migration failed"))
-        ext._context = mock_context
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": VALID_UUID}
-
-            with pytest.raises(AuthenticationError, match="Failed to initialize tenant"):
-                await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        # Schema should NOT be cached on failure
-        expected_schema = "user_" + VALID_UUID.replace("-", "_")
-        assert expected_schema not in ext._initialized_schemas
-
-
-# ======================================================================
-# List tenants
-# ======================================================================
-
-
-class TestSupabaseTenantExtensionListTenants:
-    """Tests for list_tenants behavior."""
-
-    @pytest.mark.asyncio
-    async def test_list_tenants_empty(self):
-        ext = _make_extension()
-        tenants = await ext.list_tenants()
-        assert tenants == []
-
-    @pytest.mark.asyncio
-    async def test_list_tenants_after_auth(self):
-        ext, _ = _setup_jwks_ext()
-        mock_context = AsyncMock(spec=ExtensionContext)
-        mock_context.run_migration = AsyncMock()
-        ext._context = mock_context
-
-        with (
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.get_unverified_header") as mock_header,
-            patch("hindsight_api.extensions.builtin.supabase_tenant.pyjwt.decode") as mock_decode,
-        ):
-            mock_header.return_value = {"kid": "test-key-1", "alg": "RS256"}
-            mock_decode.return_value = {"sub": VALID_UUID}
-            await ext.authenticate(RequestContext(api_key=_make_valid_token()))
-
-        tenants = await ext.list_tenants()
-        assert len(tenants) == 1
-        assert isinstance(tenants[0], Tenant)
-        expected_schema = "user_" + VALID_UUID.replace("-", "_")
-        assert tenants[0].schema == expected_schema
-
-
-# ======================================================================
-# Shutdown
-# ======================================================================
-
-
-class TestSupabaseTenantExtensionShutdown:
-    """Tests for on_shutdown behavior."""
-
-    @pytest.mark.asyncio
-    async def test_on_shutdown_closes_client(self):
-        ext = _make_extension()
-        mock_client = AsyncMock(spec=httpx.AsyncClient)
-        ext._http_client = mock_client
-
-        await ext.on_shutdown()
-
-        mock_client.aclose.assert_called_once()
-        assert ext._http_client is None
-
-    @pytest.mark.asyncio
-    async def test_on_shutdown_no_client(self):
-        ext = _make_extension()
-        # _http_client is None by default — should not raise
-        await ext.on_shutdown()
-
-
-# ======================================================================
-# Extension loader integration
-# ======================================================================
-
-
-class TestSupabaseTenantExtensionLoader:
-    """Tests for loading via the extension loader."""
-
-    def test_load_via_extension_loader(self, monkeypatch):
-        monkeypatch.setenv(
-            "HINDSIGHT_API_TENANT_EXTENSION",
-            "hindsight_api.extensions.builtin.supabase_tenant:SupabaseTenantExtension",
-        )
-        monkeypatch.setenv("HINDSIGHT_API_TENANT_SUPABASE_URL", "https://test.supabase.co")
-        monkeypatch.setenv("HINDSIGHT_API_TENANT_SUPABASE_SERVICE_KEY", "test-key")
-        monkeypatch.setenv("HINDSIGHT_API_TENANT_SCHEMA_PREFIX", "custom")
-
-        ext = load_extension("TENANT", TenantExtension)
-
-        assert ext is not None
-        assert isinstance(ext, SupabaseTenantExtension)
-        assert ext.supabase_url == "https://test.supabase.co"
-        assert ext.supabase_service_key == "test-key"
-        assert ext.schema_prefix == "custom"
-
-    def test_load_without_service_key(self, monkeypatch):
-        """Extension should load without service key — JWKS mode doesn't need it."""
-        monkeypatch.setenv(
-            "HINDSIGHT_API_TENANT_EXTENSION",
-            "hindsight_api.extensions.builtin.supabase_tenant:SupabaseTenantExtension",
-        )
-        monkeypatch.setenv("HINDSIGHT_API_TENANT_SUPABASE_URL", "https://test.supabase.co")
-        monkeypatch.delenv("HINDSIGHT_API_TENANT_SUPABASE_SERVICE_KEY", raising=False)
-
-        ext = load_extension("TENANT", TenantExtension)
-
-        assert ext is not None
-        assert isinstance(ext, SupabaseTenantExtension)
-        assert ext.supabase_service_key is None

hindsight-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hindsight-cli"
-version = "0.4.10"
+version = "0.4.9"
 edition = "2021"
 authors = ["Hindsight Team"]
 description = "A beautiful CLI for Hindsight - semantic memory system"

hindsight-clients/python/hindsight_client_api/__init__.py

@@ -7,7 +7,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/banks_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/directives_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/documents_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/entities_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/memory_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/mental_models_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/monitoring_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api/operations_api.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/api_client.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/configuration.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.
@@ -489,7 +489,7 @@ class Configuration:
         return "Python SDK Debug Report:\n"\
                "OS: {env}\n"\
                "Python Version: {pyversion}\n"\
-               "Version of the API: 0.4.10\n"\
+               "Version of the API: 0.4.9\n"\
                "SDK Package Version: 0.0.7".\
                format(env=sys.platform, pyversion=sys.version)
 

hindsight-clients/python/hindsight_client_api/exceptions.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/__init__.py

@@ -6,7 +6,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/add_background_request.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/async_operation_submit_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/background_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/bank_list_item.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/bank_list_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/bank_profile_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/bank_stats_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/budget.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/cancel_operation_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/chunk_data.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/chunk_include_options.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/chunk_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/consolidation_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/create_bank_request.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/create_directive_request.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/create_mental_model_request.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/create_mental_model_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/delete_document_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/delete_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/directive_list_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/directive_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/disposition_traits.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/document_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_detail_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_include_options.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_input.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_list_item.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_list_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_observation_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/entity_state_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/features_info.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/graph_data_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/http_validation_error.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/include_options.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/list_documents_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/list_memory_units_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/list_tags_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/memory_item.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/mental_model_list_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/mental_model_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.
@@ -17,7 +17,7 @@ import pprint
 import re  # noqa: F401
 import json
 
-from pydantic import BaseModel, ConfigDict, Field, StrictInt, StrictStr
+from pydantic import BaseModel, ConfigDict, StrictInt, StrictStr
 from typing import Any, ClassVar, Dict, List, Optional
 from hindsight_client_api.models.mental_model_trigger import MentalModelTrigger
 from typing import Optional, Set
@@ -31,7 +31,7 @@ class MentalModelResponse(BaseModel):
     bank_id: StrictStr
     name: StrictStr
     source_query: StrictStr
-    content: StrictStr = Field(description="The mental model content as well-formatted markdown (auto-generated from reflect endpoint)")
+    content: StrictStr
     tags: Optional[List[StrictStr]] = None
     max_tokens: Optional[StrictInt] = 2048
     trigger: Optional[MentalModelTrigger] = None

hindsight-clients/python/hindsight_client_api/models/mental_model_trigger.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/operation_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/operation_status_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/operations_list_response.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.

hindsight-clients/python/hindsight_client_api/models/recall_request.py

@@ -5,7 +5,7 @@
 
     HTTP API for Hindsight
 
-    The version of the OpenAPI document: 0.4.10
+    The version of the OpenAPI document: 0.4.9
     Generated by OpenAPI Generator (https://openapi-generator.tech)
 
     Do not edit the class manually.