kore-memory 2.5.0__tar.gz → 3.0.2__tar.gz

kore_memory-3.0.2/.coveragerc

@@ -0,0 +1,19 @@
+[run]
+source = kore_memory
+omit =
+    # Integrations che richiedono dipendenze opzionali (pydantic-ai, openai-agents)
+    kore_memory/integrations/pydantic_ai.py
+    kore_memory/integrations/openai_agents.py
+    # Banner di benvenuto CLI — non coperto da test
+    kore_memory/welcome.py
+    # Entry point scripts — coperti da test funzionali, non unit
+    kore_memory/__main__.py
+    # Vector index sqlite-vec — richiede estensione sqlite-vec, testato in test-semantic CI
+    kore_memory/vector_index.py
+
+[report]
+exclude_lines =
+    pragma: no cover
+    def __repr__
+    if TYPE_CHECKING:
+    raise NotImplementedError

{kore_memory-2.5.0 → kore_memory-3.0.2}/CHANGELOG.md

@@ -11,6 +11,120 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [3.0.2] - 2026-04-28
+
+### Theme: "Hardening & Bug Sweep"
+
+Comprehensive bug-fixing release: 24 fixes across backend, dashboard, security, and infrastructure. No breaking changes.
+
+### Fixed — Backend (Critical)
+
+- **Data corruption in compressor**: `DELETE FROM memory_relations WHERE source_id = target_id` was unscoped — deleted ALL self-relations globally instead of only the newly merged record. Now scoped to `(new_id, new_id)`.
+- **save_memory_batch bypassed entire pipeline**: Batch save was missing privacy filter, title generation, content_hash, structured extraction (facts/concepts/narrative), entity extraction, conflict detection, dedup, session_id, and all v2.1/M2 fields. Refactored with shared `_prepare_memory()` helper — full parity with single save.
+- **Race condition in dedup (TOCTOU)**: Dedup check and INSERT were in separate transactions. Two concurrent identical saves could both pass the check. Now merged into a single transaction.
+- **ZeroDivisionError in RRF fusion**: Setting `KORE_RRF_W_FTS=0` caused crash when that stream had results. Added `or 1.0` fallback.
+- **search_by_tag returned incomplete data**: Missing `title`, `invalidated_at`, `compressed_into`, and all structured fields in SELECT. `_row_to_record` silently returned nulls.
+- **assert in context_assembler**: Token budget invariant used `assert` (disabled with `python -O`). Replaced with `if/raise ValueError`.
+
+### Fixed — Security
+
+- **Auth bypass behind reverse proxy**: `_is_local()` checked only `request.client.host`, which is the proxy's IP (127.0.0.1) when behind nginx/Caddy. Now detects `X-Forwarded-For`/`X-Real-IP` headers and requires API key when proxy is detected.
+- **MCP import no size limit**: Docstring said "max 500" but code passed full list. Added `memories[:500]` truncation.
+- **Search query DoS vector**: `/search` had no `max_length` on query parameter. Added `max_length=1000`.
+- **CSP redundancy**: Removed `'unsafe-inline'` from `script-src` (redundant when nonce is present).
+
+### Fixed — Infrastructure
+
+- **VectorIndex memory leak**: Legacy in-memory cache grew unbounded (one entry per agent, all embeddings in RAM). Added LRU eviction with max 20 agents.
+- **Timer leak in filesystem_watcher**: `stop_all()` stopped observers but didn't cancel pending debounce timers. Timers could fire after shutdown, causing DB operations on closed connections.
+- **init_db() at import time in MCP server**: Any `import kore_memory.mcp_server` triggered full DB initialization. Replaced with lazy `_ensure_db()` using double-check locking.
+
+### Fixed — Dashboard
+
+- **Tab lost on refresh**: No URL state persistence. Added `location.hash` routing — tab survives refresh and browser back/forward.
+- **Memories page empty for agents without relations**: Default view used `/graph/hubs` (requires relations). Changed to `/search?q=*`.
+- **Relations section permanently broken**: `loadRelations(data.results)` where `/analytics` has no `results` field. Now fetches memories via `/search`.
+- **Graph detail panel permanently broken after X close**: Inline `style.display='none'` overrode CSS class. Fixed to use `classList.remove('open')`.
+- **Graph animation CPU leak**: `requestAnimationFrame` loop ran at 60fps on hidden canvas after navigating away. Now cancelled on page change.
+- **HiDPI mouse coordinates wrong**: `screenToGraph()` used `canvas.width` (physical pixels) instead of `canvas.offsetWidth` (CSS pixels). Hover/drag/click hit wrong nodes on Retina displays.
+- **Edit from graph detail race condition**: `setTimeout(300ms)` guess for API load. Now opens modal directly with node data.
+- **NaN decay display**: `decay_score * 100` crashed on null. Defaults to 1.0.
+- **No pagination indicator**: Added "Showing X of Y" when `has_more` is true.
+- **Edit modal ignored tags**: Tags field was visible but values discarded on save. Now sends tags via API.
+- **Session memories appended duplicates**: Clicking "View" multiple times appended cards. Now replaces existing detail.
+- **Inline event handlers violated CSP**: `onmouseover`/`onmouseout` replaced with CSS `:hover`.
+
+### Added
+
+- Test: batch/single save parity test verifying structured fields (title, content_hash, memory_type) are populated identically.
+
+---
+
+## [3.0.0] - 2026-04-15
+
+### Theme: "Cognitive Runtime + Coding Vertical GA"
+
+Chiude Wave 3 con il lancio ufficiale del Coding Memory Mode e consolida Graph, Context Engine e Filesystem Watcher in un runtime cognitivo completo.
+
+### Breaking Changes
+
+- Nessuna breaking change nelle API REST o MCP rispetto a v2.x
+- `pip install kore-memory` porta tutti i miglioramenti automaticamente
+
+### Migration Guide (v2.2 → v3.0)
+
+#### Da v2.2 (Context Engine)
+- Nessuna azione richiesta per API REST e MCP esistenti
+- Nuovo: `ranking_profile: "coding"` in `/context/assemble` e `memory_get_context()`
+- Nuovo: categorie coding (`architectural_decision`, `root_cause`, `runbook`, `regression_note`)
+
+#### Da v2.3 (Wave 3 Graph)
+- Nessuna azione richiesta
+- Nuovo: filesystem watcher (`pip install 'kore-memory[watcher]'`)
+- Nuovo: tool MCP `memory_log_root_cause`
+
+#### DB pre-esistenti (v1.x)
+- Il sistema applica automaticamente le migrazioni incrementali al primo avvio
+- Backup consigliato: `cp data/memory.db data/memory.db.bak`
+
+### Added
+
+#### Coding Memory Mode GA (#030)
+- **`memory_log_root_cause`**: nuovo tool MCP per registrare root cause analysis con `symptom`, `affected_component`, `fix_applied`
+- **`docs/coding-memory-mode.md`**: guida completa setup, workflow, tool table, benchmark, troubleshooting
+- **`presets/claude-code-coding.md`**: snippet CLAUDE.md pronto all'uso per attivare il coding mode
+- **`presets/claude-code/README.md`**: aggiornato con tutti i 4 tool coding
+- Il Coding Memory Mode è ora GA e supporta repository-scoped namespace (`agent/repo`)
+- Tutti i tool coding in un'unica installazione: `pip install kore-memory`
+
+#### Quality & Coverage
+- **`.coveragerc`**: esclude `vector_index.py`, `integrations/pydantic_ai.py`, `integrations/openai_agents.py`, `welcome.py` dai report locali (testati in CI separata o non applicabili)
+- **`tests/test_coverage_gaps.py`**: 17 test mirati per branch non coperti (`/agents`, wildcard `q=*`, `update_memory` branches, session double-check locking)
+- Coverage raggiunge **80%** sulla soglia CI (era 76% prima di questo ciclo)
+
+### Closes
+
+- #95 (#030 Coding Memory Mode GA)
+- #96 (#031 Release v3.0.0)
+
+### Wave 3 — Completata
+
+| Issue | Feature | Versione |
+|-------|---------|---------|
+| #024 | Filesystem Overlay | v2.3.0 |
+| #025 | File Watcher (watchdog) | v2.5.0 |
+| #026 | Typed Relations | v2.3.0 |
+| #027 | Subgraph Extraction | v2.3.0 |
+| #028 | Hub Detection | v2.3.0 |
+| #029 | Benchmark CI | v2.3.0 |
+| #030 | Coding Memory Mode GA | v3.0.0 |
+
+### Tests
+- **648 test totali** (da 572 in v2.2 → +76 in Wave 3)
+- Coverage: **80%** (soglia CI: 80%)
+
+---
+
 ## [2.5.0] - 2026-04-14
 
 ### Theme: "Filesystem Watcher — Live Overlay Sync"