refactor: update memory skill loader, plugin config, and add privacy docs (#4905)

2026-04-22 17:15:19 +05:30
parent 32b74e18b7
commit f5dc825d47
21 changed files with 1734 additions and 189 deletions
@@ -16,7 +16,7 @@ The plugin provides:
 2. **Auto-Capture** — After the agent responds, the exchange is sent to Mem0 which decides what's worth keeping
 3. **Agent Tools** — Eight tools for explicit memory operations during conversations

-Both auto-recall and auto-capture run silently with no manual configuration required.
+Both auto-recall and auto-capture are opt-in (`autoRecall: true`, `autoCapture: true` in config). Once enabled, they run silently with no manual intervention required.

 ## Requirements

@@ -147,7 +147,81 @@ OpenClaw treats memory plugins as an exclusive slot. Installing the plugin alone

 ### Open-Source Mode (Self-hosted)

-No Mem0 key needed. Requires `OPENAI_API_KEY` for default embeddings/LLM.
+No Mem0 key needed. Defaults use OpenAI (`gpt-5-mini` for LLM, `text-embedding-3-small` for embeddings) — requires `OPENAI_API_KEY`. For a fully local setup, use Ollama for both.
+
+#### Option 1: Interactive Wizard (Recommended)
+
+Run the guided 4-step wizard:
+
+```bash
+openclaw mem0 init --mode open-source
+```
+
+The wizard walks you through:
+
+<Steps>
+  <Step title="LLM provider">
+    Choose OpenAI (`gpt-5-mini`), Ollama (`llama3.1:8b`, fully local), or Anthropic (`claude-sonnet-4-5-20250514`). Provide an API key or base URL as needed.
+  </Step>
+  <Step title="Embedding provider">
+    Choose OpenAI (`text-embedding-3-small`) or Ollama (`nomic-embed-text`, local). If the same provider was chosen for LLM, the API key and URL are reused automatically.
+  </Step>
+  <Step title="Vector store">
+    Choose Qdrant (`http://localhost:6333`) or PGVector (PostgreSQL). Connectivity is verified before proceeding.
+  </Step>
+  <Step title="User ID">
+    Set your memory namespace identifier.
+  </Step>
+</Steps>
+
+#### Option 2: Non-Interactive Setup
+
+For CI/CD, scripts, or agent-driven setup — pass all options as flags:
+
+```bash
+# Fully local with Ollama + Qdrant
+openclaw mem0 init --mode open-source \
+  --oss-llm ollama --oss-embedder ollama --oss-vector qdrant
+
+# OpenAI + Qdrant
+openclaw mem0 init --mode open-source \
+  --oss-llm openai --oss-llm-key <key> \
+  --oss-embedder openai --oss-embedder-key <key> \
+  --oss-vector qdrant
+
+# Anthropic LLM + OpenAI embeddings + PGVector
+openclaw mem0 init --mode open-source \
+  --oss-llm anthropic --oss-llm-key <key> \
+  --oss-embedder openai --oss-embedder-key <key> \
+  --oss-vector pgvector --oss-vector-user postgres --oss-vector-password secret
+```
+
+Add `--json` for machine-readable output (useful when an LLM agent is driving the setup).
+
+<Accordion title="All --oss-* flags">
+| Flag | Description |
+|------|-------------|
+| `--oss-llm <provider>` | `openai`, `ollama`, or `anthropic` |
+| `--oss-llm-key <key>` | API key for LLM provider |
+| `--oss-llm-model <model>` | Override default LLM model |
+| `--oss-llm-url <url>` | Base URL (Ollama only) |
+| `--oss-embedder <provider>` | `openai` or `ollama` |
+| `--oss-embedder-key <key>` | API key for embedder |
+| `--oss-embedder-model <model>` | Override default embedder model |
+| `--oss-embedder-url <url>` | Base URL (Ollama only) |
+| `--oss-vector <provider>` | `qdrant` or `pgvector` |
+| `--oss-vector-url <url>` | Qdrant server URL (default: `http://localhost:6333`) |
+| `--oss-vector-host <host>` | PGVector host |
+| `--oss-vector-port <port>` | PGVector port |
+| `--oss-vector-user <user>` | PGVector user |
+| `--oss-vector-password <pw>` | PGVector password |
+| `--oss-vector-dbname <db>` | PGVector database name |
+| `--oss-vector-dims <n>` | Override embedding dimensions |
+</Accordion>
+
+#### Option 3: Manual Config
+
+Minimal config — uses OpenAI defaults:

 ```json5
 {
@@ -168,7 +242,7 @@ No Mem0 key needed. Requires `OPENAI_API_KEY` for default embeddings/LLM.
 }
 ```

-Sensible defaults work out of the box. To customize the embedder, vector store, or LLM:
+To customize providers:

 ```json5
 {
@@ -184,8 +258,8 @@ Sensible defaults work out of the box. To customize the embedder, vector store,
          "userId": "your-user-id",
          "oss": {
            "embedder": { "provider": "openai", "config": { "model": "text-embedding-3-small" } },
-            "vectorStore": { "provider": "qdrant", "config": { "host": "localhost", "port": 6333 } },
-            "llm": { "provider": "openai", "config": { "model": "gpt-4o" } }
+            "vectorStore": { "provider": "qdrant", "config": { "url": "http://localhost:6333" } },
+            "llm": { "provider": "openai", "config": { "model": "gpt-5-mini" } }
          }
        }
      }
@@ -225,6 +299,8 @@ The `memory_search` and `memory_list` tools accept a `scope` parameter (`"sessio

 ## CLI Commands

+All commands support `--json` for machine-readable output — useful when an LLM agent drives the CLI programmatically. Run `openclaw mem0 help --json` to discover every command and flag.
+
 ```bash
 # Search all memories (long-term + session)
 openclaw mem0 search "what languages does the user know"
@@ -238,6 +314,10 @@ openclaw mem0 search "what languages does the user know" --scope session
 # List all memories
 openclaw mem0 list
 openclaw mem0 list --user-id alice --top-k 20
+
+# JSON output (any command)
+openclaw mem0 search "preferences" --json
+openclaw mem0 status --json
 ```

 ## Configuration Options
@@ -248,8 +328,8 @@ openclaw mem0 list --user-id alice --top-k 20
 |-----|------|---------|-------------|
 | `mode` | `"platform"` \| `"open-source"` | `"platform"` | Which backend to use |
 | `userId` | `string` | OS username | Scope memories per user |
-| `autoRecall` | `boolean` | `true` | Inject memories before each turn |
-| `autoCapture` | `boolean` | `true` | Store facts after each turn |
+| `autoRecall` | `boolean` | `false` | Inject memories before each turn (opt-in) |
+| `autoCapture` | `boolean` | `false` | Store facts after each turn (opt-in) |
 | `topK` | `number` | `5` | Max memories per recall |
 | `searchThreshold` | `number` | `0.3` | Min similarity (0–1) |

@@ -275,7 +355,7 @@ openclaw mem0 list --user-id alice --top-k 20
 | `oss.historyDbPath` | `string` | — | SQLite path for memory edit history |
 | `oss.disableHistory` | `boolean` | `false` | Disable memory edit history tracking |

-Everything inside `oss` is optional — defaults use OpenAI embeddings (`text-embedding-3-small`), in-memory vector store, and OpenAI LLM.
+Everything inside `oss` is optional — defaults use OpenAI embeddings (`text-embedding-3-small`), in-memory vector store, and OpenAI LLM (`gpt-5-mini`).

 ## Plugin Management

@@ -338,6 +418,64 @@ If `openclaw plugins update` fails:
   openclaw plugins install @mem0/openclaw-mem0
   ```

+## Privacy & Security
+
+### Data Flow
+
+| Mode | Where data goes | Storage |
+|------|----------------|---------|
+| **Platform** | Conversations sent to `api.mem0.ai` for extraction and storage | Mem0 cloud |
+| **Open-source** | Embeddings generated via configured provider (default: OpenAI API). Vectors stored locally. | `~/.mem0/vector_store.db` (SQLite) |
+
+### Enabling Auto-Capture and Auto-Recall
+
+Auto-capture and auto-recall are disabled by default (opt-in). To enable either or both:
+
+```json5
+{
+  "plugins": {
+    "entries": {
+      "openclaw-mem0": {
+        "config": {
+          "autoCapture": true,   // send conversations to Mem0 for extraction
+          "autoRecall": true     // inject relevant memories into context
+        }
+      }
+    }
+  }
+}
+```
+
+Without these enabled, the agent can still use memory tools (`memory_add`, `memory_search`, etc.) explicitly — only the automatic background behavior is off.
+
+### Credential Protection
+
+The plugin never stores API keys, tokens, or secrets as memories. Five independent layers enforce this:
+
+1. **Triage gate** — The extraction prompt rejects values matching known credential patterns (`sk-`, `m0-`, `ghp_`, `AKIA`, `Bearer`, `password=`, `token=`, `secret=`)
+2. **Dream cleanup** — Periodic memory consolidation deletes any memories that slipped through containing credential patterns
+3. **Extraction instructions** — Default extraction rules explicitly instruct the model to store only that a credential was configured, never the value
+4. **Configurable patterns** — Add custom credential patterns via `skills.triage.credentialPatterns`
+5. **CLI redaction** — `openclaw mem0 config show` redacts sensitive fields (`apiKey`, `oss.*.config.apiKey`)
+
+### API Key Storage
+
+Plugin config is stored in `~/.openclaw/openclaw.json` with file permissions `0o600` (owner-read-only). For production deployments, use environment variable references (`${MEM0_API_KEY}`) or SecretRef objects instead of plaintext keys.
+
+### Telemetry
+
+Anonymous usage telemetry (PostHog) is enabled by default to help improve the plugin. No conversation content or memory values are included — only event counts (recall, capture, tool usage, CLI commands).
+
+To opt out, set the environment variable:
+
+```bash
+export MEM0_TELEMETRY=false
+```
+
+### System Prompt Context
+
+The plugin injects memory-related instructions into the agent's system context via OpenClaw's `prependSystemContext` mechanism. This includes the memory triage protocol and recalled memories. This is the standard OpenClaw plugin SDK pattern for memory backends — no user-facing prompts are modified.
+
 ## Key Features

 1. **Zero Configuration** — Auto-recall and auto-capture work out of the box with no prompting required