v0.2.29

# Release Notes for v0.2.29

This release is a security hardening pass across session lifecycle, tag handling, file ingestion and the Web UI, along with namespace isolation fixes for the AgentCore, LangGraph and Vapi integrations and a refreshed Web UI that matches the landing theme.

## Breaking Changes
- **Re-activating an agent with a live session is rejected** (`memanto/app/routes/sessions.py`)
  - `POST /api/v2/agents/{agent_id}/activate` now returns `409` while the agent already has an active session, which stops one caller from taking over another caller's session. Deactivate the existing session (`POST /api/v2/agents/{agent_id}/deactivate` with its `X-Session-Token`) before activating again.
- **Updating the API key from the Web UI requires the current key** (`memanto/app/ui/routes/ui_router.py`)
  - `PUT /api/ui/api-key` now requires `current_key` when a key is already configured, checked with a constant-time comparison. A missing or wrong `current_key` returns `403`. The bundled UI sends it automatically.
- **AgentCore: ambiguous identities get their own hashed agent id** (`integrations/agentcore/memanto_agentcore/adapter.py`)
  - The readable `tenant-{tenant}-user-{user}-agent-{agent}` id is used only when it maps back to exactly one identity. Emails, dotted or non-Latin user ids, parts that contain `-user-` / `-agent-`, and ids over 64 characters now map to a SHA-256 id and start with empty memory. Their old, possibly shared agent is not adopted automatically. Ids that were already unambiguous are unchanged.
- **Vapi caller scope keeps automatic retention private to the caller** (`integrations/vapi/memanto_vapi/memory.py`)
  - In caller scope, end-of-call memories are extracted only as caller-private memories, and retention is skipped when the call carries no `customer.number` / `customer.externalId`. Raw Vapi call summaries are never written to shared scope.

## New Features
- **LangGraph namespace binding** (`integrations/langgraph/langgraph_memanto/store.py`)
  - New agents record their exact namespace tuple in the agent description, and a different tuple that maps to the same agent id (e.g. `("acme", "bob_x")` vs `("acme_bob", "x")`) is refused instead of sharing memories.
  - New `strict_namespace_binding=True` option on `MemantoStore` refuses legacy agents that have no binding. The default keeps serving them so existing memories stay reachable.
  - `list_namespaces` returns the bound tuple when one is recorded.

## Improvements
- **Web UI restyled to match the landing theme** (`memanto/app/ui/static/index.html`)
- **No scroll jump while UI panels reload** (`memanto/app/ui/static/index.html`)
  - Loading states keep the container's current height, so the page no longer jumps when agents, memories, history, summaries or policy reload.
- **Cross-process session lifecycle locking** (`memanto/app/services/session_service.py`)
  - Session create, end, renew and delete, plus agent activation and deletion (`memanto/app/routes/sessions.py`, `memanto/cli/client/sdk_client.py`, `memanto/cli/client/direct_client.py`), are serialized under a per-agent file lock, so a logout or delete cannot race an in-flight activation or renewal in another worker or process.
  - Cancelled activation requests re
## Security
- **Tag-field prompt-injection bypass closed** (`memanto/app/core.py`, `memanto/app/constants.py`, `memanto/cli/migrate/mappers.py`)
  - Memory tags matching injection directives (`ignore previous instructions`, `system override`, `exfiltrate`, …) or starting with the `#` filter-token prefix are rejected. Extraction and tag validation share one `INJECTION_PATTERNS` set. Bulk-import mappers drop such tags instead of storing them.
- **Conversation extraction breakout hardened** (`memanto/app/services/conversation_memory_extraction_service.py`)
  - Case and whitespace variants of `</conversation_content>` are now neutralized, not just the exact tag.
- **OKF path traversal and symlink escapes** (`memanto/cli/migrate/okf_loader.py`)
  - Bundle paths are resolved and checked with `.resolve().is_relative_to()`, which also blocks Windows NTFS junction escapes.
- **Project `MEMORY.md` export can't follow repository symlinks** (`memanto/cli/client/sdk_client.py`, `memanto/cli/client/direct_client.py`)
  - Exports replace the project file atomically instead of copying through a possibly symlinked path.
- **Private daily reports** (`memanto/app/services/daily_analysis_service.py`, `memanto/app/services/summary_visualization_service.py`)
  - Daily summaries, conflict reports and appended visual insights are written atomically with owner-only permissions.
- **Dashboard attribute injection via client label** (`memanto/app/main.py`, `memanto/app/ui/static/index.html`)
  - The activity label is derived from the normalized `X-Memanto-Client` slug instead of the raw header, and `escHtml` now escapes `"` and `'` as well. Explorer UI DOM construction is context-safe.
- **Policy operations require an active session** (`memanto/cli/client/sdk_client.py`, `memanto/cli/client/direct_client.py`)
  - `get_policy`, `set_policy` and `apply_policy_preset` validate the caller's session for the agent first.
- **Backend authority bound at construction** (`memanto/app/services/agent_service.py`, `memanto/app/services/daily_analysis_service.py`)
  - In-process clients inject their already-authorized backend client. Server routes keep using the server-configured `MOORCHEH_API_KEY`.

## Tests
- `tests/test_unit.py`: injection-shaped tag rejection, structured tags still accepted, migration tag routing.
- `tests/test_tool_sessions.py`, `tests/test_output_path_traversal.py`: updated session lifecycle and output path coverage.
- `integrations/vapi/tests/test_vapi.py`: caller summaries never reach shared scope, summary-only shared calls write nothing, retry de-duplication.
- `integrations/langgraph/tests/test_store.py`: namespace binding coverage.

## Full Changelog
Full Changelog: https://github.com/moorcheh-ai/memanto/compare/v0.2.28...v0.2.29