fix: harden hooks, MCP server, and config (security audit)

[brodsky754]

Summary

• hooks_cli: Add _is_safe_transcript_path() to reject .. traversal in transcript reads; add _is_valid_mempal_dir() to validate MEMPAL_DIR contains project markers before subprocess spawn; canonicalize all paths via os.path.realpath()
• mcp_server: Replace str(e) with "Internal error" in 12 except Exception handlers to prevent leaking file paths/internal state to MCP clients (keeps str(e) in ValueError handlers for user-facing validation)
• config: Create config.json atomically with os.open(O_CREAT|O_EXCL, 0o600) to eliminate TOCTOU permission window; write people_map.json with 0o600 permissions (contains PII)

Context

Full security audit of the codebase found 0 Critical, 3 High, 6 Medium, 6 Low findings. This PR addresses all 3 High and 3 trivial Medium fixes. Remaining Medium/Low findings are documented in the audit report (informational only).

Test plan

• All 864 baseline tests pass (0 regressions)
• Updated 4 test fixtures to create .git marker dirs for new _is_valid_mempal_dir() validation
• Verified via background agent that all fixes are correct and complete

🤖 Generated with Claude Code

[bensig]

hey @brodsky754 — this conflicts with develop. also pls rebase onto #863 (precompact fix) first since both touch hooks_cli.py — merging in the wrong order would regress the compaction fix. thanks!

[igorls]

Hi, thanks for the contribution.

This PR has merge conflicts with develop, and the branch has not been updated in over 7 days, which puts it before our most recent release. The conflicts are likely against work that landed in that release.

Could you rebase onto develop so we can take another look?

If this change is no longer relevant, feel free to close the PR.

(This message is part of a periodic backlog pass, sent to all open PRs that match this state.)

[brodsky754]

Rebased onto current develop.

@bensig — #863 landed in develop on Apr 15, so the precompact fix is already in the base; no special ordering needed. I've also dropped the hooks_cli.py changes entirely, since develop now covers them — _validate_transcript_path() does the same ..-rejection + resolve (plus a .jsonl/.json allowlist), and _get_mine_targets() already resolves MEMPAL_DIR before mining. That removes the overlap you flagged.

What's left:

• config.py — config.json / people_map.json are now created atomically with os.open(..., 0o600) (O_EXCL on first create, O_TRUNC on overwrite), so there's no window where they're world-readable between open() and chmod(). Applied to all five write paths.
• mcp_server.py — the internal-error (except Exception) handlers no longer return raw str(e); they return a generic "Internal error" and log the real exception via logger.exception(). Deliberate ValueError validation messages and tool_add_drawer's actionable readback-failure message are unchanged.

ruff check, ruff format --check, and the full test suite (2278 passed) are green locally.

[igorls]

Thanks for this contribution, and apologies for the slow turnaround.

develop has moved a fair way since this was opened and the branch no longer merges cleanly. If you're still interested in landing it, could you rebase onto current develop? Once it merges cleanly and CI is green I'll get it reviewed for the 3.8.0 cycle.

If you'd rather not pick it back up, no problem at all — just say so and I'll close it out, and thanks either way for taking the time to send it.