packages/server-core/src/handlers/memory.handlers.spec.ts (2)

140-210: ⚖️ Poor tradeoff

Test coverage could be expanded to include mutation and search operations.

The current tests cover read operations and delete well. Consider adding tests for:

• handleSaveMemoryMessages (cross-user message saving)
• handleUpdateMemoryConversation (cross-user updates)
• handleCloneMemoryConversation (cross-user cloning)
• handleSearchMemory (cross-user search filtering)

This would provide complete regression coverage as mentioned in the PR objectives.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/server-core/src/handlers/memory.handlers.spec.ts` around lines 140 -
210, Add tests covering cross-user mutation and search paths: create new it()
cases that call handleSaveMemoryMessages, handleUpdateMemoryConversation,
handleCloneMemoryConversation with deps, victimConversationId and an
authenticatedUser { id: attackerUserId } and assert expectForbidden on the
result and that the original conversation remains unchanged when applicable
(similar to the delete test pattern using handleGetMemoryConversation to verify
owner still can read); also add a test for handleSearchMemory that runs a search
as attackerUserId and verifies results are either forbidden or do not include
victimConversationId (and run the same search as victimUserId to confirm
expected hits), reusing agentId, attackerConversationId, victimConversationId,
attackerUserId, victimUserId variables from the current spec for consistency.

---

4-4: 💤 Low value

Import InMemoryStorageAdapter from @voltagent/core instead of a relative path
packages/server-core/src/handlers/memory.handlers.spec.ts imports InMemoryStorageAdapter from ../../../core/src/..., but @voltagent/core already re-exports InMemoryStorageAdapter, so the test should use:

import { InMemoryStorageAdapter } from "`@voltagent/core`";

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/server-core/src/handlers/memory.handlers.spec.ts` at line 4, The
test imports InMemoryStorageAdapter via a relative path; update the import in
memory.handlers.spec.ts to import { InMemoryStorageAdapter } from
"`@voltagent/core`" instead of
"../../../core/src/memory/adapters/storage/in-memory" so the spec uses the
package re-export; ensure any other tests in the same file referencing that
relative import are updated to the `@voltagent/core` import as well.

packages/serverless-hono/src/routes.ts (1)

132-137: 💤 Low value

Consider extracting shared helper to avoid duplication.

This getAuthenticatedUser helper is identical to the one in packages/server-hono/src/routes/memory.routes.ts (lines 45-50). If both packages share a common dependency, this could be extracted to reduce duplication.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/serverless-hono/src/routes.ts` around lines 132 - 137, The
getAuthenticatedUser helper in packages/serverless-hono/src/routes.ts duplicates
logic from the one in packages/server-hono/src/routes/memory.routes.ts; extract
this function into a shared utility module (e.g., a new helper file in a shared
package or common utilities) and have both modules import it instead of defining
it locally. Move the logic that reads c.get?.("authenticatedUser") and
type-guards to a single exported function (preserving the
MemoryAuthenticatedUser type or exporting that type alongside it), update both
call sites to import and use the shared getAuthenticatedUser, and remove the
duplicate definitions to keep behavior identical.