fix: security hardening, test expansion (640→719), and 5 open issue fixes (#535, #536, #521, #478, #531)

CONTRIBUTING.md

@@ -85,7 +85,6 @@ If you're planning a significant change, open an issue first to discuss the appr
 
 - **Discord**: [Join us](https://discord.com/invite/ycTQQCu6kn)
 - **Issues**: Bug reports and feature requests welcome
-- **Discussions**: For questions and ideas
 
 ## License
 

README.md

@@ -702,7 +702,7 @@ mempalace/
 ## Requirements
 
 - Python 3.9+
-- `chromadb>=0.4.0`
+- `chromadb>=0.5.0,<0.7`
 - `pyyaml>=6.0`
 
 No API key. No internet after install. Everything local.

hooks/mempal_save_hook.sh

@@ -104,6 +104,13 @@ with open(sys.argv[1]) as f:
                 content = msg.get('content', '')
                 if isinstance(content, str) and '<command-message>' in content:
                     continue
+                # Fix #549: skip tool_result messages — they arrive as
+                # role: "user" but aren't human input
+                if isinstance(content, list) and all(
+                    isinstance(b, dict) and b.get('type') == 'tool_result'
+                    for b in content
+                ):
+                    continue
                 count += 1
         except:
             pass

mempalace/cli.py

@@ -33,6 +33,11 @@
 import argparse
 from pathlib import Path
 
+# Fix #535: Windows consoles (cp1251/cp1252) crash on non-ASCII output (✓, CJK, etc.)
+if sys.platform == "win32" and hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+
 from .config import MempalaceConfig
 
 

mempalace/config.py

@@ -135,7 +135,8 @@ def __init__(self, config_dir=None):
         if self._config_file.exists():
             try:
                 with open(self._config_file, "r") as f:
-                    self._file_config = json.load(f)
+                    data = json.load(f)
+                    self._file_config = data if isinstance(data, dict) else {}
             except (json.JSONDecodeError, OSError):
                 self._file_config = {}
 

mempalace/convo_miner.py

@@ -216,7 +216,13 @@ def scan_convos(convo_dir: str) -> list:
                 if filepath.is_symlink():
                     continue
                 try:
-                    if filepath.stat().st_size > MAX_FILE_SIZE:
+                    fsize = filepath.stat().st_size
+                    if fsize > MAX_FILE_SIZE:
+                        print(
+                            f"  ⚠ Skipping large file"
+                            f" ({fsize // (1024 * 1024)}MB > {MAX_FILE_SIZE // (1024 * 1024)}MB"
+                            f" limit): {filepath.name}"
+                        )
                         continue
                 except OSError:
                     continue
@@ -333,27 +339,23 @@ def mine_convos(
             if extract_mode == "general":
                 room_counts[chunk_room] += 1
             drawer_id = f"drawer_{wing}_{chunk_room}_{hashlib.sha256((source_file + str(chunk['chunk_index'])).encode()).hexdigest()[:24]}"
-            try:
-                collection.upsert(
-                    documents=[chunk["content"]],
-                    ids=[drawer_id],
-                    metadatas=[
-                        {
-                            "wing": wing,
-                            "room": chunk_room,
-                            "source_file": source_file,
-                            "chunk_index": chunk["chunk_index"],
-                            "added_by": agent,
-                            "filed_at": datetime.now().isoformat(),
-                            "ingest_mode": "convos",
-                            "extract_mode": extract_mode,
-                        }
-                    ],
-                )
-                drawers_added += 1
-            except Exception as e:
-                if "already exists" not in str(e).lower():
-                    raise
+            collection.upsert(
+                documents=[chunk["content"]],
+                ids=[drawer_id],
+                metadatas=[
+                    {
+                        "wing": wing,
+                        "room": chunk_room,
+                        "source_file": source_file,
+                        "chunk_index": chunk["chunk_index"],
+                        "added_by": agent,
+                        "filed_at": datetime.now().isoformat(),
+                        "ingest_mode": "convos",
+                        "extract_mode": extract_mode,
+                    }
+                ],
+            )
+            drawers_added += 1
 
         total_drawers += drawers_added
         print(f"  ✓ [{i:4}/{len(files)}] {filepath.name[:50]:50} +{drawers_added}")

mempalace/general_extractor.py

@@ -157,7 +157,6 @@
     r"i need",
     r"never told anyone",
     r"nobody knows",
-    r"\*[^*]+\*",
 ]
 
 ALL_MARKERS = {

mempalace/knowledge_graph.py

@@ -39,6 +39,7 @@
 import json
 import os
 import sqlite3
+import threading
 from datetime import date, datetime
 from pathlib import Path
 
@@ -51,6 +52,7 @@ def __init__(self, db_path: str = None):
         self.db_path = db_path or DEFAULT_KG_PATH
         Path(self.db_path).parent.mkdir(parents=True, exist_ok=True)
         self._connection = None
+        self._lock = threading.RLock()
         self._init_db()
 
     def _init_db(self):
@@ -89,11 +91,27 @@ def _init_db(self):
         conn.commit()
 
     def _conn(self):
-        if self._connection is None:
-            self._connection = sqlite3.connect(self.db_path, timeout=10, check_same_thread=False)
-            self._connection.execute("PRAGMA journal_mode=WAL")
-            self._connection.row_factory = sqlite3.Row
-        return self._connection
+        with self._lock:
+            if self._connection is None:
+                self._connection = sqlite3.connect(self.db_path, timeout=10, check_same_thread=False)
+                self._connection.execute("PRAGMA journal_mode=WAL")
+                self._connection.row_factory = sqlite3.Row
+            return self._connection
+
+    def _execute(self, sql, params=()):
+        """Thread-safe execute wrapper."""
+        with self._lock:
+            return self._conn().execute(sql, params)
+
+    def _executemany(self, sql, params_list):
+        """Thread-safe executemany wrapper."""
+        with self._lock:
+            return self._conn().executemany(sql, params_list)
+
+    def _commit(self):
+        """Thread-safe commit wrapper."""
+        with self._lock:
+            self._conn().commit()
 
     def close(self):
         """Close the database connection."""
@@ -346,7 +364,7 @@ def stats(self):
 
     def seed_from_entity_facts(self, entity_facts: dict):
         """
-        Seed the knowledge graph from fact_checker.py ENTITY_FACTS.
+        Seed the knowledge graph from an entity_facts dictionary.
         This bootstraps the graph with known ground truth.
         """
         for key, facts in entity_facts.items():