[phernandez]

Why

The memory context endpoints accepted any depth. ContextService doubles it, and the relation CTE blocks cycles only per path, so on a densely linked project a deep traversal walks every simple path. One build_context(depth=40) or recent_activity(depth=40) call could run until the cloud client timed out, and any authenticated caller, including a read-only API key, could repeat it. /memory/recent also had no bound on page_size, page, or max_related. Reported in basicmachines-co/basic-memory-cloud#2640.

What

• schemas/memory.py: new MAX_CONTEXT_DEPTH = 5 and MAX_RECENT_ACTIVITY_PAGE_SIZE = 100.
  • 5 matches the prompt API's existing depth cap (schemas/prompt.py) and keeps the documented "1-3 recommended" range well inside it.
  • 100 is the recent_activity tool's existing page_size cap.
• GET /v2/{project}/memory/{uri}: depth is Query(1, ge=1, le=5).
• GET /v2/{project}/memory/recent: depth bounded the same way; page >= 1, 1 <= page_size <= 100, 0 <= max_related <= 100 (the same bounds /memory/{uri} already used for page and max_related).
• build_context and recent_activity MCP tools raise a clear ValueError for out-of-range depth before calling the API, the same way they already guard page_size. depth=0 keeps meaning "default" in both tools, as before. Docstrings name the maximums.

Defaults are unchanged. CLI bm tool build-context --depth and web/hosted callers all use depth 1-2.

How tested

• tests/api/v2/test_memory_router.py: over-limit depth, depth=0, and the new /memory/recent bounds return 422; the inclusive maximums (depth=5, page_size=100 / 50) return 200.
• tests/mcp/test_tool_build_context.py, tests/mcp/test_tool_recent_activity.py: depth 6, "6", and -1 raise; depth=5 round-trips.
• Load-bearing check: with the router Query bounds and the tool guards reverted, all 11 new rejection cases fail; restored, they pass.
• Targeted files (SQLite): 79 passed. just lint clean. just typecheck reports only the pre-existing pymilvus unresolved imports (optional extra not installed locally).

Follow-up

The cloud side (server-side statement_timeout on tenant connections) is basicmachines-co/basic-memory-cloud PR for #2640. The cloud core pin bump follows this merge.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T12:26:55.920976Z	b980eb1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[phernandez]

Fixed the stale generated parameter manuals in b980eb1. just man-regen updated build-context(3) and recent-activity(3); uv run --no-sync pytest tests/test_man_pages.py -q --no-cov: 55 passed. CI/current-head review pending.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: b980eb1ada

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".