From fbe62a922acf8c8df6b5f3813582acb0fd6c5e24 Mon Sep 17 00:00:00 2001
From: jaylfc <jaylfc25@gmail.com>
Date: Sun, 2 Aug 2026 20:05:26 +0200
Subject: [PATCH 1/2] fix(desktop): add CSRF protection to memory.ts mutations

Wrap updateMemorySettings, triggerCatalogIndex, and
updateAgentMemoryConfig with withCsrf to prevent CSRF
bypass on mutating requests.
---
 desktop/src/lib/memory.ts | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/desktop/src/lib/memory.ts b/desktop/src/lib/memory.ts
index 71e475820..3d810f384 100644
--- a/desktop/src/lib/memory.ts
+++ b/desktop/src/lib/memory.ts
@@ -2,6 +2,8 @@
 /*  Memory API client                                                  */
 /* ------------------------------------------------------------------ */
 
+import { withCsrf } from "./csrf";
+
 const API = '/api';
 
 async function fetchJson<T>(url: string, fallback: T, init?: RequestInit): Promise<T> {
@@ -87,11 +89,11 @@ export async function fetchMemorySettings(): Promise<Record<string, any>> {
 }
 
 export async function updateMemorySettings(settings: Record<string, any>): Promise<Record<string, any>> {
-  return fetchJson(`${API}/memory/settings`, {}, {
+  return fetchJson(`${API}/memory/settings`, {}, withCsrf({
     method: 'PUT',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(settings),
-  });
+  }));
 }
 
 export async function fetchMemoryEndpoint(): Promise<TaOSmdEndpoint> {
@@ -128,11 +130,11 @@ export async function triggerCatalogIndex(body: {
   end_date?: string;
   force?: boolean;
 }): Promise<any> {
-  return fetchJson(`${API}/memory/catalog/index`, {}, {
+  return fetchJson(`${API}/memory/catalog/index`, {}, withCsrf({
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(body),
-  });
+  }));
 }
 
 export async function fetchCatalogSearch(query: string): Promise<any[]> {
@@ -152,9 +154,9 @@ export async function fetchAgentMemoryConfig(name: string): Promise<Record<strin
 }
 
 export async function updateAgentMemoryConfig(name: string, config: Record<string, any>): Promise<Record<string, any>> {
-  return fetchJson(`${API}/agents/${encodeURIComponent(name)}/memory-config`, {}, {
+  return fetchJson(`${API}/agents/${encodeURIComponent(name)}/memory-config`, {}, withCsrf({
     method: 'PUT',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(config),
-  });
+  }));
 }

From be5adcf1dc975ef838ee5d3760f087ce9a885f12 Mon Sep 17 00:00:00 2001
From: jaylfc <jaylfc25@gmail.com>
Date: Thu, 13 Aug 2026 05:03:52 +0000
Subject: [PATCH 2/2] docs(changelog): add fragment for the memory client CSRF
 fix

The lane shipped the fix with no changelog entry and exited, so doc-gate
stayed red on user-visible-changelog. The behaviour change is
user-visible: without the token these three mutations 403 on a cookie
session.
---
 changelog.d/2385-memory-csrf.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/2385-memory-csrf.md

diff --git a/changelog.d/2385-memory-csrf.md b/changelog.d/2385-memory-csrf.md
new file mode 100644
index 000000000..3c0887b44
--- /dev/null
+++ b/changelog.d/2385-memory-csrf.md
@@ -0,0 +1 @@
+- Fixed memory settings, catalog indexing and per-agent memory-config updates failing with a 403 "CSRF token missing" on a cookie-authenticated session: the three mutating calls in the Memory API client did not send the double-submit token.