feat(memory): add scope_mode config and strictAgentIsolation for full agent memory isolation

[gaomind]

Summary

Adds memory.scope_mode on the server side and strictAgentIsolation on the OpenClaw plugin side, enabling full inter-agent memory isolation in multi-agent deployments.

Currently, user-level memory categories (PROFILE, PREFERENCES, ENTITIES, EVENTS) are routed to shared user scope, meaning different agents on the same account can see each other's profile. This PR adds an opt-in "isolated" mode that routes all categories to agent scope.

Related: #1069, #954

What Changed

Server side

• memory_config.py: Added scope_mode field (Literal["default", "isolated"], default "default") with field_validator
• memory_extractor.py: _get_owner_space(), create_memory(), _append_to_profile() now accept and respect scope_mode
• compressor.py: Reads scope_mode from config and passes it through the extraction pipeline

Plugin side (examples/openclaw-plugin)

• config.ts: Added strictAgentIsolation boolean config option
• index.ts: When enabled, memory_recall and auto-recall only search viking://agent/memories
• openclaw.plugin.json: Schema and UI hints for the new option

Documentation

• Updated English and Chinese configuration guides
• Clarified relationship between scope_mode and agent_scope_mode

Tests

• tests/session/test_memory_scope_mode.py: 10 tests (owner_space routing + config validation)
• examples/openclaw-plugin/__tests__/strict-agent-isolation.test.ts: 6 tests (config parsing)

Behavior

Default behavior is unchanged. When scope_mode is set to "isolated", all categories route to viking://agent/{agent_space}/memories/.

scope_mode vs agent_scope_mode

Config	Controls	Default
agent_scope_mode	How agent space hash is computed	"user+agent"
scope_mode	Which categories route to agent vs user scope	"default"

These are independent. Typical combinations:

scope_mode	agent_scope_mode	Result
default	user+agent	Original behavior
isolated	user+agent	Full isolation per user per agent
isolated	agent	Full isolation, shared across users of same agent

Example

Server (ov.conf):

{
  "memory": {
    "scope_mode": "isolated"
  }
}

Plugin (openclaw.json):

{
  "plugins": {
    "entries": {
      "openviking": {
        "config": {
          "strictAgentIsolation": true
        }
      }
    }
  }
}

Testing

python -m pytest tests/session/test_memory_scope_mode.py -v
cd examples/openclaw-plugin && npx vitest run __tests__/strict-agent-isolation.test.ts

Checklist

• Code follows the project's coding style
• Self-reviewed
• Documentation updated
• Tests added and passing
• No new warnings
• Backward compatible (default behavior unchanged)

[CLAassistant]

All committers have signed the CLA.

[github-actions]

Failed to generate code suggestions for PR