feat(tools): SDK-level cross-source memory deduplication

[Dhravya]

Stack Context

This stack moves memory deduplication out of the playground UI and into the SDKs themselves, so every integration injects a single, deduplicated, self-replacing memory block. Three PRs:

1. sdk-dedup/tools-ts (this PR) — TypeScript SDK core + integrations
2. sdk-dedup/python — Python SDKs
3. sdk-dedup/playground — playground debug view reflects the SDK-owned block

What?

Move profile deduplication into the SDK middleware for the TypeScript tools package.

• Facts are normalized (strip leading [YYYY-MM-DD], trim, collapse whitespace, casefold) and deduplicated in static > dynamic > search priority within a single request.
• The result is injected as one owned <supermemory> block that replaces the previous block instead of accumulating a new one each turn.
• Dedup is mode-aware: in query mode, search results are not dropped against a profile that isn't being injected.
• Deduplication is request-local — no global/browser Set. Safe for multiple users, concurrent requests, and Cloudflare Worker isolates.

Covers AI SDK, OpenAI (Chat + Responses), Mastra, and VoltAgent. New shared/memory-context.ts owns the block-replacement logic.

Why?

The earlier "conversation-scoped deduplication" was only a playground browser Set — a UI debug affordance that did not change what the SDK sent to the model, and would have been unsafe as server-side global state. Real cross-source dedup belongs in the SDK, applied fresh per stateless model request.

Testing

• bun run test in packages/tools: 145 passed (the one failing suite, claude-memory.test.ts, is a pre-existing broken import unrelated to this change).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how system prompts and instructions are built across all TypeScript integrations; behavior is well-covered by unit tests but incorrect strip/replace logic could drop or duplicate context in production prompts.

Overview
Moves cross-source memory deduplication and owned prompt injection into @supermemory/tools so every integration sends one deduplicated memory block per request instead of growing context each turn.

Deduplication: Facts are normalized via normalizeMemoryFact (strip [YYYY-MM-DD], trim, collapse whitespace, lowercase) and deduplicated with static → dynamic → search priority. deduplicateMemoriesForMode keeps search hits in query mode when the profile is not injected.

Owned <supermemory> block: New shared/memory-context.ts wraps memories in <supermemory context="user-memories" readonly>, strips stale blocks, and replaces prior SDK context while preserving caller system instructions. Applied in AI SDK (injectMemoriesIntoParams), OpenAI Chat/Responses middleware, Mastra input processor (wrapMemoryContext), and VoltAgent hooks.

Tests: Unit coverage for block replacement (with-supermemory, OpenAI, VoltAgent), Mastra wrapper tag assertion, normalized dedup variants, and concurrent containerTag isolation.

^{Reviewed by Cursor Bugbot for commit 2fa2e0d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @ved015's task in 1m 52s —— View job

---

Code Review Complete

• Get PR diff and review existing comments
• Analyze core deduplication logic (tools-shared.ts, memory-context.ts)
• Review middleware implementations (OpenAI, VoltAgent, Mastra, Vercel)
• Check for edge cases, security issues, and potential bugs
• Submit review

Summary

Reviewed the SDK-level memory deduplication implementation across all TypeScript integrations. The implementation is solid:

• Request isolation — Per-request seenMemories Set and per-context memoryCache prevent cross-user leakage
• Safe regex — Non-greedy matching with fixed anchors avoids ReDoS
• Tag injection prevention — Memory content properly escaped to prevent breaking out of SDK-owned blocks
• Mode-aware dedup — Query mode correctly preserves search results that duplicate profile facts (since profile isn't injected)
• Good test coverage — Block replacement, user isolation, and normalized deduplication all tested

Score: 10/10 — No issues found, ready to ship.

[Dhravya]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(sdk-playground): reflect SDK-owned memory block in debug view #1533
• feat(python-sdks): SDK-level cross-source memory deduplication #1532
• feat(tools): SDK-level cross-source memory deduplication #1531 👈 (View in Graphite)
• feat(sdk-playground): interactive SDK chat playground #1437
• chore(ci): wire JS tools unit tests into CI #1436
• docs(skills): refresh Supermemory skill for 7-tool parity #1435
• fix(python-sdks): v4 API migration for integration packages #1434
• feat(ai-sdk): re-export 7-tool surface #1433
• feat(tools): 7-tool parity and description refresh #1432
• chore(ci): Python SDK pytest workflow #1431
• feat(openai-sdk-python): 7-tool parity #1430
• fix(openai-sdk-python): migrate to v4 Supermemory APIs #1429
• main

---

How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

Overview: Moves memory deduplication from the playground UI into the SDK middleware, implementing request-scoped context block replacement across all TypeScript SDK integrations (AI SDK, OpenAI, Mastra, VoltAgent).

Issues found: None — this looks good to ship.

Details:

The implementation is solid:

1. Request isolation is correct — The seenMemories Set in deduplicateMemories() is created fresh per call, and the injected flag in the middleware map() callbacks is closure-scoped per request. No global state that could cause cross-user leakage.

2. Context block regex is safe — The pattern /<supermemory context="user-memories" readonly>[\s\S]*?<\/supermemory>/ uses non-greedy matching with fixed anchors, avoiding ReDoS concerns. The specific attribute match (context="user-memories" readonly) ensures user-authored supermemory tags with different attributes won't be stripped.

3. Normalization logic is sound — normalizeMemoryFact() strips date prefixes, collapses whitespace, and lowercases for comparison while preserving the original memory string for output. The priority order (static > dynamic > search) is maintained correctly.

4. Edge cases handled — Empty memories return early without injecting content. Multiple system messages get the context injected into only the first one, with stale blocks stripped from subsequent ones.

5. Good test coverage — Tests verify context replacement (not accumulation), cross-user isolation, and normalized deduplication.

Score: 10/10

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	be97748	Aug 24 2026, 04:26 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	be97748	Commit Preview URL Branch Preview URL	Aug 24 2026, 04:27 PM

[claude]

Overview: Moves memory deduplication from the playground UI into SDK middleware, implementing request-scoped context block replacement across all TypeScript integrations (AI SDK, OpenAI Chat/Responses, Mastra, VoltAgent).

Issues found: None — this looks good to ship.

Details:

The implementation is solid:

1. Request isolation is correct — The seenMemories Set in deduplicateMemories() is created fresh per call, and the memoryCache in each middleware context is per-request/per-user. No global state that could cause cross-user leakage in Cloudflare Worker isolates or concurrent requests.

2. Context block regex is safe — The pattern /<supermemory context="user-memories" readonly>[\s\S]*?<\/supermemory>/g uses non-greedy matching with fixed anchors, avoiding ReDoS. The specific attribute match ensures user-authored supermemory tags with different attributes won't be stripped.

3. Tag injection prevented — escapeMemoryContextDelimiters() escapes < and > in memory content, preventing injection attacks where memory text containing </supermemory> could break out of the SDK-owned block.

4. Mode-aware deduplication handles edge cases — In "query" mode, the profile isn't injected, so search results correctly skip deduplication against the profile. A memory appearing in both profile and search results survives in search results, preventing legitimate context from disappearing.

5. Normalization logic is sound — normalizeMemoryFact() strips [YYYY-MM-DD] date prefixes, [recent] tags, collapses whitespace, and lowercases for comparison while preserving the original memory string for output.

6. Good test coverage — Tests verify block replacement (stale → fresh), no accumulation (single <supermemory> tag), cross-user isolation, normalized deduplication variants, and query mode search result preservation.

Score: 10/10