fix: update tests and fix bugs for project-prefixed permalinks

- Fix update_entity overwriting project-prefixed permalink with
  non-prefixed one during metadata merge
- Fix memory:// URL path traversal validation bypass in read_note
  and read_content tools
- Fix pyright type error in claude_projects_importer
- Update test assertions across 12 test files to use project-prefixed
  permalinks (test-project/path instead of path)
- Fix monkeypatch in search test to use resolve_project_and_path
  instead of removed get_active_project

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

src/basic_memory/importers/claude_projects_importer.py

@@ -71,7 +71,8 @@ async def import_data(
                     )
                     permalink, file_path = self.build_import_paths(prompt_path)
                     prompt_entity = self._format_prompt_markdown(project, permalink)
-                    await self.write_entity(prompt_entity, file_path)
+                    if prompt_entity:
+                        await self.write_entity(prompt_entity, file_path)
                     prompts_imported += 1
 
                 # Import project documents

src/basic_memory/mcp/tools/read_content.py

@@ -19,6 +19,7 @@
 from basic_memory.mcp.server import mcp
 from basic_memory.mcp.async_client import get_client
 from basic_memory.mcp.tools.utils import call_get, resolve_entity_id
+from basic_memory.schemas.memory import memory_url_path
 from basic_memory.utils import validate_project_path
 
 
@@ -205,8 +206,13 @@ async def read_content(
         active_project, url, _ = await resolve_project_and_path(client, path, project, context)
 
         # Validate path to prevent path traversal attacks
+        # For memory:// URLs, validate the extracted path (not the raw URL which
+        # has a scheme prefix that confuses path validation)
+        raw_path = memory_url_path(path) if path.startswith("memory://") else path
         project_path = active_project.home
-        if not validate_project_path(url, project_path):
+        if not validate_project_path(raw_path, project_path) or not validate_project_path(
+            url, project_path
+        ):
             logger.warning(
                 "Attempted path traversal attack blocked",
                 path=path,

src/basic_memory/mcp/tools/read_note.py

@@ -10,6 +10,7 @@
 from basic_memory.mcp.project_context import resolve_project_and_path
 from basic_memory.mcp.server import mcp
 from basic_memory.mcp.tools.search import search_notes
+from basic_memory.schemas.memory import memory_url_path
 from basic_memory.utils import validate_project_path
 
 
@@ -83,11 +84,13 @@ async def read_note(
         )
 
         # Validate identifier to prevent path traversal attacks
-        # We need to check both the raw identifier and the processed path
+        # For memory:// URLs, validate the extracted path (not the raw URL which
+        # has a scheme prefix that confuses path validation)
+        raw_path = memory_url_path(identifier) if identifier.startswith("memory://") else identifier
         processed_path = entity_path
         project_path = active_project.home
 
-        if not validate_project_path(identifier, project_path) or not validate_project_path(
+        if not validate_project_path(raw_path, project_path) or not validate_project_path(
             processed_path, project_path
         ):
             logger.warning(

src/basic_memory/services/entity_service.py

@@ -42,7 +42,7 @@
 )
 from basic_memory.services.link_resolver import LinkResolver
 from basic_memory.services.search_service import SearchService
-from basic_memory.utils import build_canonical_permalink, generate_permalink
+from basic_memory.utils import build_canonical_permalink
 
 
 class EntityService(BaseService[EntityModel]):
@@ -346,9 +346,12 @@ async def update_entity(self, entity: EntityModel, schema: EntitySchema) -> Enti
         # Merge new metadata with existing metadata
         existing_markdown.frontmatter.metadata.update(post.metadata)
 
-        # Ensure the permalink in the metadata is the resolved one
-        if new_permalink != entity.permalink:
-            existing_markdown.frontmatter.metadata["permalink"] = new_permalink
+        # Always ensure the permalink in the metadata is the canonical one from the database.
+        # The schema_to_markdown call above uses EntitySchema.permalink which computes a
+        # non-prefixed permalink (e.g., "test/note"). The metadata merge on the previous line
+        # would overwrite the project-prefixed permalink (e.g., "project/test/note") stored
+        # in the existing file. Setting it unconditionally preserves the correct value.
+        existing_markdown.frontmatter.metadata["permalink"] = new_permalink
 
         # Create a new post with merged metadata
         merged_post = frontmatter.Post(post.content, **existing_markdown.frontmatter.metadata)

tests/api/v2/test_knowledge_router.py

@@ -171,7 +171,7 @@ async def test_create_entity(client: AsyncClient, file_service, v2_project_url):
     assert isinstance(entity.id, int)
     assert entity.api_version == "v2"
 
-    assert entity.permalink == "test/test-v2-entity"
+    assert entity.permalink == "test-project/test/test-v2-entity"
     assert entity.file_path == "test/TestV2Entity.md"
     assert entity.entity_type == data["entity_type"]
 

tests/importers/test_conversation_indexing.py

@@ -83,7 +83,7 @@ async def test_imported_conversations_have_correct_permalink_and_title(
     assert "---" in content, "File should have frontmatter markers"
     assert "title: My Test Conversation Title" in content, "File should have title in frontmatter"
     assert (
-        f"permalink: {project_config.name}/conversations/20250115-My_Test_Conversation_Title"
+        f"permalink: {project_config.name}/conversations/20250115-my-test-conversation-title"
         in content
     ), (
         "File should have permalink in frontmatter"
@@ -104,7 +104,7 @@ async def test_imported_conversations_have_correct_permalink_and_title(
     )
     assert (
         entity.permalink
-        == f"{project_config.name}/conversations/20250115-My_Test_Conversation_Title"
+        == f"{project_config.name}/conversations/20250115-my-test-conversation-title"
     ), (
         f"Permalink should be from frontmatter, got: {entity.permalink}"
     )
@@ -121,7 +121,7 @@ async def test_imported_conversations_have_correct_permalink_and_title(
     )
     assert (
         search_result.permalink
-        == f"{project_config.name}/conversations/20250115-My_Test_Conversation_Title"
+        == f"{project_config.name}/conversations/20250115-my-test-conversation-title"
     ), (
         f"Search permalink should not be null, got: {search_result.permalink}"
     )

tests/mcp/test_tool_search.py

@@ -437,8 +437,8 @@ class StubProject:
         id = 1
         external_id = "test-external-id"
 
-    async def fake_get_active_project(*args, **kwargs):
-        return StubProject()
+    async def fake_resolve_project_and_path(*args, **kwargs):
+        return StubProject(), "semantic lookup", False
 
     captured_payload: dict = {}
 
@@ -450,7 +450,7 @@ async def search(self, payload, page, page_size):
             captured_payload.update(payload)
             return SearchResponse(results=[], current_page=page, page_size=page_size)
 
-    monkeypatch.setattr(search_mod, "get_active_project", fake_get_active_project)
+    monkeypatch.setattr(search_mod, "resolve_project_and_path", fake_resolve_project_and_path)
     monkeypatch.setattr(clients_mod, "SearchClient", MockSearchClient)
 
     result = await search_mod.search_notes.fn(

tests/mcp/test_tool_write_note.py

@@ -544,7 +544,7 @@ async def test_write_note_with_custom_entity_type(app, test_project):
     assert "# Created note" in result
     assert f"project: {test_project.name}" in result
     assert "file_path: guides/Test Guide.md" in result
-    assert "permalink: guides/test-guide" in result
+    assert f"permalink: {test_project.name}/guides/test-guide" in result
     assert "## Tags" in result
     assert "- guide, documentation" in result
     assert f"[Session: Using project '{test_project.name}']" in result

tests/mcp/tools/test_chatgpt_tools.py

@@ -38,8 +38,8 @@ async def test_search_successful_results(client, test_project):
     assert content["query"] == "test content"
 
     # Verify individual result format
-    assert any(r["id"] == "docs/test-document-1" for r in content["results"])
-    assert any(r["id"] == "docs/test-document-2" for r in content["results"])
+    assert any(r["id"] == f"{test_project.name}/docs/test-document-1" for r in content["results"])
+    assert any(r["id"] == f"{test_project.name}/docs/test-document-2" for r in content["results"])
 
 
 @pytest.mark.asyncio

tests/services/test_context_service.py

@@ -137,7 +137,7 @@ async def test_find_connected_timeframe(
 @pytest.mark.asyncio
 async def test_build_context(context_service, test_graph):
     """Test exact permalink lookup."""
-    url = memory_url.validate_strings("memory://test/root")
+    url = memory_url.validate_strings("memory://test-project/test/root")
     context_result = await context_service.build_context(url)
 
     # Check metadata
@@ -156,7 +156,7 @@ async def test_build_context(context_service, test_graph):
     assert primary_result.id == test_graph["root"].id
     assert primary_result.type == "entity"
     assert primary_result.title == "Root"
-    assert primary_result.permalink == "test/root"
+    assert primary_result.permalink == "test-project/test/root"
     assert primary_result.file_path == "test/Root.md"
     assert primary_result.created_at is not None
 
@@ -185,7 +185,7 @@ async def test_build_context_with_observations(context_service, test_graph):
     # Let's use those existing observations
 
     # Build context
-    url = memory_url.validate_strings("memory://test/root")
+    url = memory_url.validate_strings("memory://test-project/test/root")
     context_result = await context_service.build_context(url, include_observations=True)
 
     # Check the metadata
@@ -220,9 +220,9 @@ async def test_build_context_not_found(context_service):
 @pytest.mark.asyncio
 async def test_context_metadata(context_service, test_graph):
     """Test metadata is correctly populated."""
-    context = await context_service.build_context("memory://test/root", depth=2)
+    context = await context_service.build_context("memory://test-project/test/root", depth=2)
     metadata = context.metadata
-    assert metadata.uri == "test/root"
+    assert metadata.uri == "test-project/test/root"
     assert metadata.depth == 2
     assert metadata.generated_at is not None
     assert metadata.primary_count > 0