feat: add allowedAgents config for memory hooks

[rbutera]

Summary

• add allowedAgents?: string[] to plugin config parsing and schema
• skip auto-capture when the current sessionKey does not match an allowed agent
• skip auto-recall when the current sessionKey does not match an allowed agent
• document the new config option in the README
• add tests covering config parsing and the new capture/recall guards

Closes #27.

Behavior

When allowedAgents is omitted, behavior stays the same as today.

When allowedAgents is set, auto-capture and auto-recall only run for sessions whose sessionKey includes one of the configured agent IDs, for example agent:navi:main.

Test plan

• bun test allowed-agents.test.ts
• bun run check-types
• bun run lint

[rbutera]

Good catch - the bug is real.

When sessionKey is undefined, sessionKey?.includes(agentId) returns undefined. Array.some() treats that as falsy and returns false. The negation flips it to true, triggering the early return. Any session without a sessionKey was being silently dropped regardless of the allowedAgents config.

Fixed in the latest commit by gating the filter on sessionKey being present. Sessions without a sessionKey now fall through and are processed normally, which restores prior behavior. Also added two regression tests covering the undefined sessionKey case to prevent this coming back.

[rbutera]

Hey @Dhravya @Prasanna721, this is ready for review whenever you get a chance. CI is green, and the undefined sessionKey edge case from the Seer review is fixed with regression tests. Would love to get this merged so we can set up per-agent memory isolation. Thanks!

[ved015]

hi @rbutera thank you for your contribution can you pls resolve the conflicts

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​bun@​1.3.14

View full report

[rbutera]

Rebased onto main and resolved the conflicts.

The main thing that shifted underneath this PR: buildCaptureHandler / buildRecallHandler moved sessionKey from a builder argument to the handler ctx, so I re-applied the allowedAgents guard against ctx.sessionKey and dropped the now-redundant third arg in the capture tests (the recall tests already used the ctx form). The prompt -> rawPrompt rename in recall is preserved. I also added @types/bun so the new bun:test file typechecks under tsc --noEmit, since it's the repo's first test file.

bun run check-types, bun run lint, and all 5 allowed-agents.test.ts tests are green. The undefined-sessionKey guard (no silent data loss) is intact.

@Dhravya @Prasanna721 @ved015 ready for another look whenever you get a chance, thanks for the patience.