fix: encode dynamic URL path segments (#5963)

Co-authored-by: kartik-mem0 <kartik.labhshetwar@mem0.ai>

cli/node/src/backend/platform.ts

@@ -17,6 +17,10 @@ import {
 	type SearchOptions,
 } from "./base.js";
 
+function encodePathSegment(value: unknown): string {
+	return encodeURIComponent(String(value));
+}
+
 export class PlatformBackend implements Backend {
 	private baseUrl: string;
 	private headers: Record<string, string>;
@@ -218,9 +222,13 @@ export class PlatformBackend implements Backend {
 	}
 
 	async get(memoryId: string): Promise<Record<string, unknown>> {
-		return (await this._request("GET", `/v1/memories/${memoryId}/`, {
-			params: { source: "CLI" },
-		})) as Record<string, unknown>;
+		return (await this._request(
+			"GET",
+			`/v1/memories/${encodePathSegment(memoryId)}/`,
+			{
+				params: { source: "CLI" },
+			},
+		)) as Record<string, unknown>;
 	}
 
 	async listMemories(
@@ -277,9 +285,13 @@ export class PlatformBackend implements Backend {
 		if (content) payload.text = content;
 		if (metadata) payload.metadata = metadata;
 		payload.source = "CLI";
-		return (await this._request("PUT", `/v1/memories/${memoryId}/`, {
-			json: payload,
-		})) as Record<string, unknown>;
+		return (await this._request(
+			"PUT",
+			`/v1/memories/${encodePathSegment(memoryId)}/`,
+			{
+				json: payload,
+			},
+		)) as Record<string, unknown>;
 	}
 
 	async delete(
@@ -297,9 +309,13 @@ export class PlatformBackend implements Backend {
 			})) as Record<string, unknown>;
 		}
 		if (memoryId) {
-			return (await this._request("DELETE", `/v1/memories/${memoryId}/`, {
-				params: { source: "CLI" },
-			})) as Record<string, unknown>;
+			return (await this._request(
+				"DELETE",
+				`/v1/memories/${encodePathSegment(memoryId)}/`,
+				{
+					params: { source: "CLI" },
+				},
+			)) as Record<string, unknown>;
 		}
 		throw new Error("Either memoryId or --all is required");
 	}
@@ -323,7 +339,7 @@ export class PlatformBackend implements Backend {
 		for (const [entityType, entityId] of entities) {
 			results[entityType] = (await this._request(
 				"DELETE",
-				`/v2/entities/${entityType}/${entityId}/`,
+				`/v2/entities/${encodePathSegment(entityType)}/${encodePathSegment(entityId)}/`,
 				{ params: { source: "CLI" } },
 			)) as Record<string, unknown>;
 		}
@@ -386,9 +402,9 @@ export class PlatformBackend implements Backend {
 	}
 
 	async getEvent(eventId: string): Promise<Record<string, unknown>> {
-		return (await this._request("GET", `/v1/event/${eventId}/`)) as Record<
-			string,
-			unknown
-		>;
+		return (await this._request(
+			"GET",
+			`/v1/event/${encodePathSegment(eventId)}/`,
+		)) as Record<string, unknown>;
 	}
 }

cli/node/tests/platform-backend.test.ts

@@ -2,7 +2,7 @@
  * Tests for the Platform backend (mem0 Platform API client).
  */
 
-import { describe, it, expect, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import { PlatformBackend } from "../src/backend/platform.js";
 import { createDefaultConfig } from "../src/config.js";
 
@@ -12,6 +12,22 @@ function makeBackend(): PlatformBackend {
   return new PlatformBackend(createDefaultConfig().platform);
 }
 
+function mockFetch() {
+  const fetchMock = vi.fn().mockResolvedValue({
+    ok: true,
+    status: 200,
+    headers: { get: vi.fn().mockReturnValue(null) },
+    json: vi.fn().mockResolvedValue({ message: "ok" }),
+  });
+  vi.stubGlobal("fetch", fetchMock);
+  return fetchMock;
+}
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
 describe("deleteEntities", () => {
   it("returns all results keyed by entity type for a multi-entity delete", async () => {
     const backend = makeBackend();
@@ -50,3 +66,35 @@ describe("deleteEntities", () => {
     );
   });
 });
+
+describe("PlatformBackend path encoding", () => {
+  it("encodes memory IDs before interpolating them into paths", async () => {
+    const fetchMock = mockFetch();
+    const backend = makeBackend();
+
+    await backend.get("mem/a?b#c");
+    await backend.update("mem/a?b#c", "updated");
+    await backend.delete("mem/a?b#c");
+
+    const urls = fetchMock.mock.calls.map((call) => call[0]);
+    expect(urls).toEqual([
+      "https://api.mem0.ai/v1/memories/mem%2Fa%3Fb%23c/?source=CLI",
+      "https://api.mem0.ai/v1/memories/mem%2Fa%3Fb%23c/",
+      "https://api.mem0.ai/v1/memories/mem%2Fa%3Fb%23c/?source=CLI",
+    ]);
+  });
+
+  it("encodes entity and event IDs before interpolating them into paths", async () => {
+    const fetchMock = mockFetch();
+    const backend = makeBackend();
+
+    await backend.deleteEntities({ userId: "org/team?active#frag" });
+    await backend.getEvent("evt/a?b#c");
+
+    const urls = fetchMock.mock.calls.map((call) => call[0]);
+    expect(urls).toEqual([
+      "https://api.mem0.ai/v2/entities/user/org%2Fteam%3Factive%23frag/?source=CLI",
+      "https://api.mem0.ai/v1/event/evt%2Fa%3Fb%23c/",
+    ]);
+  });
+});