fix: encode dynamic URL path segments (#5963)

Co-authored-by: kartik-mem0 <kartik.labhshetwar@mem0.ai>

cli/node/src/backend/platform.ts

@@ -17,6 +17,10 @@ import {
 	type SearchOptions,
 } from "./base.js";
 
+function encodePathSegment(value: unknown): string {
+	return encodeURIComponent(String(value));
+}
+
 export class PlatformBackend implements Backend {
 	private baseUrl: string;
 	private headers: Record<string, string>;
@@ -218,9 +222,13 @@ export class PlatformBackend implements Backend {
 	}
 
 	async get(memoryId: string): Promise<Record<string, unknown>> {
-		return (await this._request("GET", `/v1/memories/${memoryId}/`, {
-			params: { source: "CLI" },
-		})) as Record<string, unknown>;
+		return (await this._request(
+			"GET",
+			`/v1/memories/${encodePathSegment(memoryId)}/`,
+			{
+				params: { source: "CLI" },
+			},
+		)) as Record<string, unknown>;
 	}
 
 	async listMemories(
@@ -277,9 +285,13 @@ export class PlatformBackend implements Backend {
 		if (content) payload.text = content;
 		if (metadata) payload.metadata = metadata;
 		payload.source = "CLI";
-		return (await this._request("PUT", `/v1/memories/${memoryId}/`, {
-			json: payload,
-		})) as Record<string, unknown>;
+		return (await this._request(
+			"PUT",
+			`/v1/memories/${encodePathSegment(memoryId)}/`,
+			{
+				json: payload,
+			},
+		)) as Record<string, unknown>;
 	}
 
 	async delete(
@@ -297,9 +309,13 @@ export class PlatformBackend implements Backend {
 			})) as Record<string, unknown>;
 		}
 		if (memoryId) {
-			return (await this._request("DELETE", `/v1/memories/${memoryId}/`, {
-				params: { source: "CLI" },
-			})) as Record<string, unknown>;
+			return (await this._request(
+				"DELETE",
+				`/v1/memories/${encodePathSegment(memoryId)}/`,
+				{
+					params: { source: "CLI" },
+				},
+			)) as Record<string, unknown>;
 		}
 		throw new Error("Either memoryId or --all is required");
 	}
@@ -323,7 +339,7 @@ export class PlatformBackend implements Backend {
 		for (const [entityType, entityId] of entities) {
 			results[entityType] = (await this._request(
 				"DELETE",
-				`/v2/entities/${entityType}/${entityId}/`,
+				`/v2/entities/${encodePathSegment(entityType)}/${encodePathSegment(entityId)}/`,
 				{ params: { source: "CLI" } },
 			)) as Record<string, unknown>;
 		}
@@ -386,9 +402,9 @@ export class PlatformBackend implements Backend {
 	}
 
 	async getEvent(eventId: string): Promise<Record<string, unknown>> {
-		return (await this._request("GET", `/v1/event/${eventId}/`)) as Record<
-			string,
-			unknown
-		>;
+		return (await this._request(
+			"GET",
+			`/v1/event/${encodePathSegment(eventId)}/`,
+		)) as Record<string, unknown>;
 	}
 }

cli/node/tests/platform-backend.test.ts

@@ -2,7 +2,7 @@
  * Tests for the Platform backend (mem0 Platform API client).
  */
 
-import { describe, it, expect, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import { PlatformBackend } from "../src/backend/platform.js";
 import { createDefaultConfig } from "../src/config.js";
 
@@ -12,6 +12,22 @@ function makeBackend(): PlatformBackend {
   return new PlatformBackend(createDefaultConfig().platform);
 }
 
+function mockFetch() {
+  const fetchMock = vi.fn().mockResolvedValue({
+    ok: true,
+    status: 200,
+    headers: { get: vi.fn().mockReturnValue(null) },
+    json: vi.fn().mockResolvedValue({ message: "ok" }),
+  });
+  vi.stubGlobal("fetch", fetchMock);
+  return fetchMock;
+}
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
 describe("deleteEntities", () => {
   it("returns all results keyed by entity type for a multi-entity delete", async () => {
     const backend = makeBackend();
@@ -50,3 +66,35 @@ describe("deleteEntities", () => {
     );
   });
 });
+
+describe("PlatformBackend path encoding", () => {
+  it("encodes memory IDs before interpolating them into paths", async () => {
+    const fetchMock = mockFetch();
+    const backend = makeBackend();
+
+    await backend.get("mem/a?b#c");
+    await backend.update("mem/a?b#c", "updated");
+    await backend.delete("mem/a?b#c");
+
+    const urls = fetchMock.mock.calls.map((call) => call[0]);
+    expect(urls).toEqual([
+      "https://api.mem0.ai/v1/memories/mem%2Fa%3Fb%23c/?source=CLI",
+      "https://api.mem0.ai/v1/memories/mem%2Fa%3Fb%23c/",
+      "https://api.mem0.ai/v1/memories/mem%2Fa%3Fb%23c/?source=CLI",
+    ]);
+  });
+
+  it("encodes entity and event IDs before interpolating them into paths", async () => {
+    const fetchMock = mockFetch();
+    const backend = makeBackend();
+
+    await backend.deleteEntities({ userId: "org/team?active#frag" });
+    await backend.getEvent("evt/a?b#c");
+
+    const urls = fetchMock.mock.calls.map((call) => call[0]);
+    expect(urls).toEqual([
+      "https://api.mem0.ai/v2/entities/user/org%2Fteam%3Factive%23frag/?source=CLI",
+      "https://api.mem0.ai/v1/event/evt%2Fa%3Fb%23c/",
+    ]);
+  });
+});

cli/python/src/mem0_cli/backend/platform.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from typing import Any
+from urllib.parse import quote
 
 import httpx
 
@@ -11,6 +12,10 @@ from mem0_cli.backend.base import Backend
 from mem0_cli.config import PlatformConfig
 
 
+def _encode_path_segment(value: Any) -> str:
+    return quote(str(value), safe="")
+
+
 class PlatformBackend(Backend):
     """Backend that talks to the mem0 Platform API."""
 
@@ -196,7 +201,11 @@ class PlatformBackend(Backend):
         )
 
     def get(self, memory_id: str) -> dict:
-        return self._request("GET", f"/v1/memories/{memory_id}/", params={"source": "CLI"})
+        return self._request(
+            "GET",
+            f"/v1/memories/{_encode_path_segment(memory_id)}/",
+            params={"source": "CLI"},
+        )
 
     def list_memories(
         self,
@@ -250,7 +259,11 @@ class PlatformBackend(Backend):
         if metadata:
             payload["metadata"] = metadata
         payload["source"] = "CLI"
-        return self._request("PUT", f"/v1/memories/{memory_id}/", json=payload)
+        return self._request(
+            "PUT",
+            f"/v1/memories/{_encode_path_segment(memory_id)}/",
+            json=payload,
+        )
 
     def delete(
         self,
@@ -274,7 +287,11 @@ class PlatformBackend(Backend):
                 params["run_id"] = run_id
             return self._request("DELETE", "/v1/memories/", params=params)
         elif memory_id:
-            return self._request("DELETE", f"/v1/memories/{memory_id}/", params={"source": "CLI"})
+            return self._request(
+                "DELETE",
+                f"/v1/memories/{_encode_path_segment(memory_id)}/",
+                params={"source": "CLI"},
+            )
         else:
             raise ValueError("Either memory_id or --all is required")
 
@@ -302,7 +319,9 @@ class PlatformBackend(Backend):
         results: dict = {}
         for entity_type, entity_id in entities.items():
             results[entity_type] = self._request(
-                "DELETE", f"/v2/entities/{entity_type}/{entity_id}/", params={"source": "CLI"}
+                "DELETE",
+                f"/v2/entities/{_encode_path_segment(entity_type)}/{_encode_path_segment(entity_id)}/",
+                params={"source": "CLI"},
             )
         return results
 
@@ -348,7 +367,7 @@ class PlatformBackend(Backend):
         return result if isinstance(result, list) else result.get("results", [])
 
     def get_event(self, event_id: str) -> dict:
-        return self._request("GET", f"/v1/event/{event_id}/")
+        return self._request("GET", f"/v1/event/{_encode_path_segment(event_id)}/")
 
 
 class AuthError(Exception):

cli/python/tests/test_platform_backend_paths.py

@@ -0,0 +1,43 @@
+from unittest.mock import MagicMock
+
+from mem0_cli.backend.platform import PlatformBackend
+
+
+def _backend(sample_config):
+    backend = PlatformBackend(sample_config.platform)
+    backend._client = MagicMock()
+    backend._client.request.return_value = MagicMock(
+        status_code=200,
+        json=lambda: {"message": "ok"},
+        headers={},
+        raise_for_status=lambda: None,
+    )
+    return backend
+
+
+def test_memory_id_path_segments_are_encoded(sample_config):
+    backend = _backend(sample_config)
+
+    backend.get("mem/a?b#c")
+    backend.update("mem/a?b#c", content="updated")
+    backend.delete("mem/a?b#c")
+
+    paths = [call.args[1] for call in backend._client.request.call_args_list]
+    assert paths == [
+        "/v1/memories/mem%2Fa%3Fb%23c/",
+        "/v1/memories/mem%2Fa%3Fb%23c/",
+        "/v1/memories/mem%2Fa%3Fb%23c/",
+    ]
+
+
+def test_entity_and_event_path_segments_are_encoded(sample_config):
+    backend = _backend(sample_config)
+
+    backend.delete_entities(user_id="org/team?active#frag")
+    backend.get_event("evt/a?b#c")
+
+    paths = [call.args[1] for call in backend._client.request.call_args_list]
+    assert paths == [
+        "/v2/entities/user/org%2Fteam%3Factive%23frag/",
+        "/v1/event/evt%2Fa%3Fb%23c/",
+    ]