fix(tools): keep model-supplied containerTag inside the configured scope (2.3.1)

[MaheshtheDev]

Security backport for the @supermemory/tools 2.x line. Targets release/tools-2.x, which points at d0f53b0d, the exact commit npm's provenance attestation records for 2.3.0. This does not touch main: Tools 3.x (#1773) already removed model-selected scope.

Problem

In 2.x, getProfile, documentList, memoryForget and documentDelete accept an optional containerTag from the model and use it unchecked as the request scope. So a model, or a prompt-injected input, can name another tenant's tag and read their profile, list their documents, forget their memories, or delete their documents.

Fix

• Adds resolveConfiguredContainerTag to tools-shared.ts. A model-supplied tag must be one of the tags the developer configured (containerTags, the projectId-derived tag, or the default). Otherwise the call fails with Container tag "…" is outside the configured scope. before any request is sent. When no tag is supplied, the old defaults still apply: the first configured tag for profile and forget, the configured union for list and delete.
• Applied to all four tools on both surfaces, ai-sdk.ts and openai/tools.ts. The other tools (searchMemories, addMemory, documentAdd) don't accept a model-supplied scope. The middleware, Mastra, VoltAgent and Claude memory surfaces take their scope only from developer options.
• Bumps the version to 2.3.1. The package has no changelog.

Provenance

Ported from two closed external PRs, which were closed only because 3.x superseded them:

• fix(tools): enforce configured container scope #1504 by @abhinav7x94 (commits co-authored by @shamAnimates): the resolver plus profile, list and forget, with tests. Its call sites are adapted to the 2.3.0 code, where list and delete use a [string, ...string[]] scope union.
• fix(tools): reject out-of-scope containerTag in documentDelete #1758 by @Atharvsinh-codez: documentDelete. It now goes through the same resolver instead of an inline check, so the error message matches.

The regression tests are carried over from both PRs: tools-shared.test.ts, the configured container scope block in tool-operations.test.ts, and document-delete-scope.test.ts, which is now added to test:unit. One adaptation: in 2.3.0, getContainerTags already rejects containerTags: [] when the tool is constructed, so the "fails closed when the configured scope is empty" case asserts the throw at construction. #1755 adapted the test the same way.

Verification

Run in packages/tools:

• bun run test:unit: 114/114 pass. The 2.3.0 base passes 101/101.
• With only the source changes reverted, 5 ported tests fail: 2 in configured container scope and 3 in documentDelete configured container scope. All pass with the fix.
• bun run build: passes.
• bun run check-types: 146 errors both before and after. These are pre-existing AI SDK tool() overload errors, and the normalized error set is identical, so this change adds none.
• bunx biome ci packages/tools/src: no new findings. The 3 warnings are pre-existing, in claude-memory-simple-example.ts.

Release

publish-tools.yml triggers only on pushes to main, and with npm ≥11 a plain npm publish of 2.3.1 is refused while latest is 3.1.2. So this release needs a manual or one-off publish with --tag, run after merge. The thread report has the steps.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	f9a0964	Oct 16 2026, 10:30 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	f9a0964	Commit Preview URL Branch Preview URL	Oct 16 2026, 10:31 PM