fix: reject cross-binding memory forget requests

server/src/__tests__/memory-service.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it, vi } from "vitest";
+import { memoryService } from "../services/memory.js";
+
+describe("memoryService.forget", () => {
+  it("rejects record sets that span multiple bindings", async () => {
+    const rows = [
+      {
+        id: "11111111-1111-4111-8111-111111111111",
+        companyId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        bindingId: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+      },
+      {
+        id: "22222222-2222-4222-8222-222222222222",
+        companyId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        bindingId: "cccccccc-cccc-4ccc-8ccc-cccccccccccc",
+      },
+    ];
+
+    const where = vi.fn().mockResolvedValue(rows);
+    const db = {
+      select: vi.fn().mockReturnValue({
+        from: vi.fn().mockReturnValue({ where }),
+      }),
+      update: vi.fn(),
+    } as any;
+
+    await expect(
+      memoryService(db).forget(
+        "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        {
+          recordIds: rows.map((row) => row.id),
+          scope: {},
+        },
+        {
+          actorType: "user",
+          actorId: "board-user",
+          agentId: null,
+          userId: "board-user",
+          runId: null,
+        },
+      ),
+    ).rejects.toThrow("Memory records must belong to the same binding");
+
+    expect(where).toHaveBeenCalledOnce();
+    expect(db.update).not.toHaveBeenCalled();
+  });
+});

server/src/services/memory.ts

@@ -787,6 +787,10 @@ export function memoryService(db: Db) {
       if (recordIds.length === 0) {
         throw notFound("Memory records not found");
       }
+      const bindingIds = new Set(rows.map((row) => row.bindingId));
+      if (bindingIds.size > 1) {
+        throw unprocessable("Memory records must belong to the same binding");
+      }
       const binding = await getBindingOrThrow(rows[0].bindingId);
       await db
         .update(memoryLocalRecords)