fix(plugin): drop API-key-derived user_id, restore $USER fallback

The deterministic resolver from #5076 silently rebucketed every user
who hadn't set MEM0_USER_ID. With MEM0_API_KEY present (the normal
case — hooks early-exit without it), the resolver picked
"mem0-<sha256(api_key)[:12]>" instead of $USER, so an existing
"deshraj" bucket suddenly became "mem0-f34dd1cba657" on update with
no migration. The old memories aren't reachable from the plugin
anymore, and the user gets a fresh empty bucket without warning.

Resolution priority is now back to:
  1. MEM0_USER_ID env var
  2. \$USER, else "default"

The ~/.mem0/identity.json cache is no longer written or read; any
existing cache file becomes inert. Users on multiple machines who
want a single bucket can still set MEM0_USER_ID explicitly — that's
the supported path, not silent derivation.

Also dropped the "regardless of which machine you're on" line from
the session bootstrap header since it no longer applies.

mem0-plugin/scripts/_identity.py

@@ -1,59 +1,17 @@
-"""Resolve mem0 user_id with deterministic priority.
+"""Resolve mem0 user_id.
 
 Resolution priority:
   1. MEM0_USER_ID env var (explicit override)
-  2. ~/.mem0/identity.json cache (pinned to current MEM0_API_KEY fingerprint)
-  3. Derived: "mem0-" + sha256(MEM0_API_KEY)[:12]
-  4. Fallback: $USER, else "default"
-
-Same MEM0_API_KEY across machines yields the same user_id, which fixes
-the "47 user buckets per account" symptom from running on multiple
-laptops with different $USER values.
+  2. $USER, else "default"
 """
 
 from __future__ import annotations
 
-import hashlib
-import json
 import os
-from datetime import datetime, timezone
-
-_CACHE_PATH = os.path.expanduser("~/.mem0/identity.json")
 
 
 def resolve_user_id() -> str:
     explicit = os.environ.get("MEM0_USER_ID", "").strip()
     if explicit:
         return explicit
-
-    api_key = os.environ.get("MEM0_API_KEY", "").strip()
-    if api_key:
-        digest = hashlib.sha256(api_key.encode("utf-8")).hexdigest()
-        fingerprint = digest[:8]
-
-        try:
-            with open(_CACHE_PATH, "r") as f:
-                cached = json.load(f)
-            if cached.get("api_key_fingerprint") == fingerprint and cached.get("user_id"):
-                return cached["user_id"]
-        except (OSError, json.JSONDecodeError):
-            pass
-
-        derived = "mem0-" + digest[:12]
-        try:
-            os.makedirs(os.path.dirname(_CACHE_PATH), exist_ok=True)
-            with open(_CACHE_PATH, "w") as f:
-                json.dump(
-                    {
-                        "user_id": derived,
-                        "source": "api_key",
-                        "api_key_fingerprint": fingerprint,
-                        "resolved_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
-                    },
-                    f,
-                )
-        except OSError:
-            pass
-        return derived
-
     return os.environ.get("USER") or "default"

mem0-plugin/scripts/_identity.sh

@@ -2,54 +2,13 @@
 #
 # Resolution priority:
 #   1. MEM0_USER_ID env var (explicit override)
-#   2. ~/.mem0/identity.json cache (pinned to current MEM0_API_KEY fingerprint)
-#   3. Derived: "mem0-" + sha256(MEM0_API_KEY)[:12]
-#   4. Fallback: $USER, else "default"
-#
-# Same MEM0_API_KEY across machines yields the same user_id, which fixes
-# the "47 user buckets per account" symptom from running on multiple
-# laptops with different $USER values.
-
-_mem0_sha256() {
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum | cut -d' ' -f1
-  else
-    shasum -a 256 | cut -d' ' -f1
-  fi
-}
+#   2. $USER, else "default"
 
 _mem0_resolve_identity() {
   if [ -n "${MEM0_USER_ID:-}" ]; then
     printf '%s' "$MEM0_USER_ID"
     return
   fi
-
-  local api_key="${MEM0_API_KEY:-}"
-  local cache="$HOME/.mem0/identity.json"
-
-  if [ -n "$api_key" ]; then
-    local digest
-    digest=$(printf '%s' "$api_key" | _mem0_sha256)
-    local fp="${digest:0:8}"
-
-    if [ -f "$cache" ]; then
-      local cached_fp cached_id
-      cached_fp=$(jq -r '.api_key_fingerprint // ""' "$cache" 2>/dev/null)
-      cached_id=$(jq -r '.user_id // ""' "$cache" 2>/dev/null)
-      if [ "$cached_fp" = "$fp" ] && [ -n "$cached_id" ]; then
-        printf '%s' "$cached_id"
-        return
-      fi
-    fi
-
-    local derived="mem0-${digest:0:12}"
-    mkdir -p "$HOME/.mem0" 2>/dev/null && \
-      printf '{"user_id":"%s","source":"api_key","api_key_fingerprint":"%s","resolved_at":"%s"}\n' \
-        "$derived" "$fp" "$(date -u +%FT%TZ)" > "$cache" 2>/dev/null
-    printf '%s' "$derived"
-    return
-  fi
-
   printf '%s' "${USER:-default}"
 }
 

mem0-plugin/scripts/on_session_start.sh

@@ -36,7 +36,7 @@ echo "## Mem0 Identity"
 echo ""
 echo "Active user_id: \`$MEM0_RESOLVED_USER_ID\`"
 echo ""
-echo "Always include \`{\"user_id\": \"$MEM0_RESOLVED_USER_ID\"}\` (wrapped in an \`AND\` clause) in every \`search_memories\` filter and as \`user_id\` on every \`add_memory\` call. This keeps memories under one bucket regardless of which machine you're on."
+echo "Always include \`{\"user_id\": \"$MEM0_RESOLVED_USER_ID\"}\` (wrapped in an \`AND\` clause) in every \`search_memories\` filter and as \`user_id\` on every \`add_memory\` call. This keeps the agent's MCP calls aligned with the bucket the hooks write to."
 echo ""
 
 if [ "$SOURCE" = "startup" ]; then