Memory-off /v1 turns: memory_remember's answer can echo the user's name and stored memories

オープン
  • 何か問題がありますか？
#547 コメント 2 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@hskl18 がすでに取り組んでいます。

2026年11月2日 から。

  • #548 @hskl18 による — オープン

評価

難易度
3/5
見積もり時間
1〜3時間
初心者へのやさしさ
42/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
python
領域
ai, security

調査の方向性

Start in sentient/memory/facts.py: FactStore.remember runs name_the_user before saving and _hold returns the existing fact's id and content on a SKIP, and both results reach the memory_remember tool. Check how Agent.memory_allowed is passed into that tool's context. The change is to return only a neutral status when ctx.memory_allowed is false, including for helpers. Done when tests/test_openai_api.py has a memory-off test asserting the response contains no renamed text and no stored id or content.

索引モデルが issue の本文から書いたものです。

説明

area: memory bug priority: P2 size: S

Found while testing #479 (OpenAI-compatible API) on a real engine.

What happens. In a /v1 turn with "Let connected apps use my memories" off (openai_api.allow_memory: false), the memory read tools are gone (as designed, Agent.memory_allowed, #529), but memory_remember stays so the app can still suggest facts for review. Its answer goes back to the model, and through the model to the app, and it can carry things the turn isn't supposed to see:

  1. The user's name. FactStore.remember runs name_the_user (#475) before saving, and the tool returns the rewritten text. In the real test, a helper started from a memory-off /v1 turn called memory_remember("The user works at a tech startup in Bangalore.") and got back {"action": "ADD", "content": "Maya works at a tech startup in Bangalore.", "status": "pending", ...}. The turn's prompt leaves the configured name out, so this is the only way the app learned it.
  2. An existing memory's text. _hold (sentient/memory/facts.py) answers a near-duplicate with {"action": "SKIP", "id": <existing id>, "content": <the existing fact's text>}. An app can guess a fact close to a stored one and read the stored wording back. The bar is memory.duplicate_similarity (0.98) plus same_subject, so it's a narrow oracle, but #339 shows short facts in one script can score that close with real embedding models.

Suggested fix. When ctx.memory_allowed is false, memory_remember answers without stored content: the fact as the app gave it (not renamed), and no id or text of another fact (for example {"saved": "for review", "status": "pending"}, or {"status": "skipped"} for a duplicate). Same for helpers the turn starts (they inherit the decision). A test in tests/test_openai_api.py next to the existing memory-off tests.

Not a blocker for #479: the memory switch is off by default and the key is made by the user for apps on their own computer, but the switch should mean what it says.

主要言語
Python
スター
716
フォーク
132
平均マージ
16時間 34分
マージ済み PR（30日）
215

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

existence-master/Sentient のほかの issue

existence-master/Sentient の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。