Problem

Issue 1: session_search leaks data across users

In multi-user gateway deployments, session_search searches the entire SQLite session database without user filtering. User A can see User B's conversation history.

Root cause: search_messages() and list_sessions_rich() have no user_id parameter. The session_search tool calls these without user scoping.

Issue 2: Hindsight retains messages from platforms without user isolation

The iLink WeChat bot adapter reports from_user_id = bot's own ID for all messages. Different users are indistinguishable. Hindsight stores them all in one memory bank, causing cross-contamination.

Fix

hermes_state.py

• Added user_id: str = None parameter to search_messages() and list_sessions_rich()
• When user_id is provided, adds WHERE s.user_id = ? to filter results
• When user_id is None (default), behavior is unchanged (backward compatible)

tools/session_search_tool.py

• Thread user_id parameter through session_search() and _list_recent_sessions()
• Pass to db.search_messages() and db.list_sessions_rich()

run_agent.py

• Pass user_id=self._user_id in both session_search call sites (~line 7408, ~line 7889)

plugins/memory/hindsight/__init__.py

• Store self._platform from init kwargs
• Skip sync_turn for platforms in _retain_disabled_platforms (default: ('weixin',))

Verification

-- Before: searches ALL sessions
SELECT ... WHERE messages_fts MATCH 'query'

-- After: only searches current user's sessions  
SELECT ... WHERE messages_fts MATCH 'query' AND s.user_id = ?

Tested with 2 Telegram users + 1 WeChat user:

• User A searching "duolingo" → only User A's results ✅
• User B searching "duolingo" → only User B's results ✅

Backward Compatibility

• user_id=None (default) → identical to before
• CLI single-user mode: self._user_id is typically None, no change
• Gateway multi-user mode: each agent has self._user_id, filtering activates

Diff Stats

4 files changed, 27 insertions(+), 3 deletions(-)