kore-memory 3.0.1__tar.gz → 3.0.2__tar.gz

{kore_memory-3.0.1 → kore_memory-3.0.2}/CHANGELOG.md

@@ -11,6 +11,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [3.0.2] - 2026-04-28
+
+### Theme: "Hardening & Bug Sweep"
+
+Comprehensive bug-fixing release: 24 fixes across backend, dashboard, security, and infrastructure. No breaking changes.
+
+### Fixed — Backend (Critical)
+
+- **Data corruption in compressor**: `DELETE FROM memory_relations WHERE source_id = target_id` was unscoped — deleted ALL self-relations globally instead of only the newly merged record. Now scoped to `(new_id, new_id)`.
+- **save_memory_batch bypassed entire pipeline**: Batch save was missing privacy filter, title generation, content_hash, structured extraction (facts/concepts/narrative), entity extraction, conflict detection, dedup, session_id, and all v2.1/M2 fields. Refactored with shared `_prepare_memory()` helper — full parity with single save.
+- **Race condition in dedup (TOCTOU)**: Dedup check and INSERT were in separate transactions. Two concurrent identical saves could both pass the check. Now merged into a single transaction.
+- **ZeroDivisionError in RRF fusion**: Setting `KORE_RRF_W_FTS=0` caused crash when that stream had results. Added `or 1.0` fallback.
+- **search_by_tag returned incomplete data**: Missing `title`, `invalidated_at`, `compressed_into`, and all structured fields in SELECT. `_row_to_record` silently returned nulls.
+- **assert in context_assembler**: Token budget invariant used `assert` (disabled with `python -O`). Replaced with `if/raise ValueError`.
+
+### Fixed — Security
+
+- **Auth bypass behind reverse proxy**: `_is_local()` checked only `request.client.host`, which is the proxy's IP (127.0.0.1) when behind nginx/Caddy. Now detects `X-Forwarded-For`/`X-Real-IP` headers and requires API key when proxy is detected.
+- **MCP import no size limit**: Docstring said "max 500" but code passed full list. Added `memories[:500]` truncation.
+- **Search query DoS vector**: `/search` had no `max_length` on query parameter. Added `max_length=1000`.
+- **CSP redundancy**: Removed `'unsafe-inline'` from `script-src` (redundant when nonce is present).
+
+### Fixed — Infrastructure
+
+- **VectorIndex memory leak**: Legacy in-memory cache grew unbounded (one entry per agent, all embeddings in RAM). Added LRU eviction with max 20 agents.
+- **Timer leak in filesystem_watcher**: `stop_all()` stopped observers but didn't cancel pending debounce timers. Timers could fire after shutdown, causing DB operations on closed connections.
+- **init_db() at import time in MCP server**: Any `import kore_memory.mcp_server` triggered full DB initialization. Replaced with lazy `_ensure_db()` using double-check locking.
+
+### Fixed — Dashboard
+
+- **Tab lost on refresh**: No URL state persistence. Added `location.hash` routing — tab survives refresh and browser back/forward.
+- **Memories page empty for agents without relations**: Default view used `/graph/hubs` (requires relations). Changed to `/search?q=*`.
+- **Relations section permanently broken**: `loadRelations(data.results)` where `/analytics` has no `results` field. Now fetches memories via `/search`.
+- **Graph detail panel permanently broken after X close**: Inline `style.display='none'` overrode CSS class. Fixed to use `classList.remove('open')`.
+- **Graph animation CPU leak**: `requestAnimationFrame` loop ran at 60fps on hidden canvas after navigating away. Now cancelled on page change.
+- **HiDPI mouse coordinates wrong**: `screenToGraph()` used `canvas.width` (physical pixels) instead of `canvas.offsetWidth` (CSS pixels). Hover/drag/click hit wrong nodes on Retina displays.
+- **Edit from graph detail race condition**: `setTimeout(300ms)` guess for API load. Now opens modal directly with node data.
+- **NaN decay display**: `decay_score * 100` crashed on null. Defaults to 1.0.
+- **No pagination indicator**: Added "Showing X of Y" when `has_more` is true.
+- **Edit modal ignored tags**: Tags field was visible but values discarded on save. Now sends tags via API.
+- **Session memories appended duplicates**: Clicking "View" multiple times appended cards. Now replaces existing detail.
+- **Inline event handlers violated CSP**: `onmouseover`/`onmouseout` replaced with CSS `:hover`.
+
+### Added
+
+- Test: batch/single save parity test verifying structured fields (title, content_hash, memory_type) are populated identically.
+
+---
+
 ## [3.0.0] - 2026-04-15
 
 ### Theme: "Cognitive Runtime + Coding Vertical GA"

{kore_memory-3.0.1 → kore_memory-3.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kore-memory
-Version: 3.0.1
+Version: 3.0.2
 Summary: The memory layer that thinks like a human: remembers what matters, forgets what doesn't, and never calls home.
 Project-URL: Homepage, https://github.com/auriti-labs/kore-memory
 Project-URL: Documentation, https://auritidesign.it/docs

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/auth.py

@@ -64,7 +64,13 @@ def _is_local(request: Request) -> bool:
     # "testclient" only in explicit test environments
     if os.getenv("KORE_TEST_MODE", "0") == "1":
         trusted.add("testclient")
-    return client_host in trusted
+    if client_host not in trusted:
+        return False
+    # Detect reverse proxy: if X-Forwarded-For is present, the real client
+    # is NOT local — require auth even if socket peer is localhost
+    if request.headers.get("X-Forwarded-For") or request.headers.get("X-Real-IP"):
+        return False
+    return True
 
 
 def _local_only_mode() -> bool:

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/compressor.py

@@ -362,9 +362,10 @@ def _merge_cluster(cluster: list[dict], agent_id: str = "default") -> int | None
                 WHERE target_id IN ({placeholders})""",
             [new_id, *ids],
         )
-        # Remove any self-relations created by the relink
+        # Remove any self-relations created by the relink (scoped to new_id only)
         conn.execute(
-            "DELETE FROM memory_relations WHERE source_id = target_id",
+            "DELETE FROM memory_relations WHERE source_id = ? AND target_id = ?",
+            (new_id, new_id),
         )
 
         # Mark originals as compressed

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/config.py

@@ -85,4 +85,4 @@ CONFLICT_MAX_CANDIDATES = int(os.getenv("KORE_CONFLICT_MAX_CANDIDATES", "10"))
 
 # ── Version ───────────────────────────────────────────────────────────────────
 
-VERSION = "3.0.1"
+VERSION = "3.0.2"

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/context_assembler.py

@@ -100,9 +100,10 @@ def assemble_context(
         tokens_used += tokens_est
 
     # Verifica invariante TOKEN-BUDGET BOUNDED
-    assert tokens_used <= req.budget_tokens, (
-        f"INVARIANTE VIOLATO: budget_tokens_used ({tokens_used}) > budget_tokens ({req.budget_tokens})"
-    )
+    if tokens_used > req.budget_tokens:
+        raise ValueError(
+            f"INVARIANTE VIOLATO: budget_tokens_used ({tokens_used}) > budget_tokens ({req.budget_tokens})"
+        )
 
     # Carica conflitti tra le memorie selezionate (invariante #3)
     selected_ids = [m.id for m in selected]

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/filesystem_watcher.py

@@ -62,6 +62,7 @@ class _WatcherEntry:
         self.include_extra_md = include_extra_md
         self.max_depth = max_depth
         self.observer: Any = None
+        self.handler: Any = None
         self.started_at: str = datetime.now(UTC).isoformat()
         self.events_processed: int = 0
 
@@ -103,12 +104,18 @@ class _WatcherRegistry:
             ]
 
     def stop_all(self) -> int:
-        """Ferma tutti i watcher — chiamato al shutdown del server."""
+        """Ferma tutti i watcher e cancella i timer pendenti — chiamato al shutdown del server."""
         with self._lock:
             entries = list(self._watchers.values())
             self._watchers.clear()
         count = 0
         for entry in entries:
+            # Cancel pending debounce timers to prevent post-shutdown DB operations
+            if entry.handler:
+                with entry.handler._timers_lock:
+                    for timer in entry.handler._timers.values():
+                        timer.cancel()
+                    entry.handler._timers.clear()
             if entry.observer:
                 try:
                     entry.observer.stop()
@@ -277,6 +284,7 @@ def start_watcher(
     observer.start()
 
     entry.observer = observer
+    entry.handler = handler
     _registry.add(entry)
 
     logger.info("Watcher avviato: base_path=%s agent=%s", resolved, agent_id)

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/main.py

@@ -189,7 +189,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
             "default-src 'self'; "
             "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
             "font-src 'self' https://fonts.gstatic.com; "
-            f"script-src 'nonce-{nonce}' 'unsafe-inline'; "
+            f"script-src 'nonce-{nonce}'; "
             "connect-src 'self'; "
             "img-src 'self' data:; "
             "frame-ancestors 'none'"
@@ -315,7 +315,7 @@ def save_batch(
 @app.get("/search", response_model=MemorySearchResponse)
 def search(
     request: Request,
-    q: str = Query(..., min_length=1, description="Search query (any language)"),
+    q: str = Query(..., min_length=1, max_length=1000, description="Search query (any language)"),
     limit: int = Query(5, ge=1, le=20),
     cursor: str | None = Query(None, description="Opaque pagination cursor"),
     category: str | None = Query(None),
@@ -1119,7 +1119,7 @@ def shared_memories(
 @app.get("/stream/search")
 async def stream_search(
     request: Request,
-    q: str = Query(..., min_length=1, description="Search query"),
+    q: str = Query(..., min_length=1, max_length=1000, description="Search query"),
     limit: int = Query(10, ge=1, le=50),
     _: str = _Auth,
     agent_id: str = _Agent,

{kore_memory-3.0.1 → kore_memory-3.0.2}/kore_memory/mcp_server.py

@@ -46,8 +46,20 @@ logger = logging.getLogger(__name__)
 _SERVER_START_TIME = _time.monotonic()
 _SESSION_TIMESTAMP = datetime.now().strftime("%Y%m%d-%H%M%S")
 
-# Initialize DB before any operation
-init_db()
+# DB initialized lazily on first operation (not at import time)
+_db_initialized = False
+_db_init_lock = threading.Lock()
+
+
+def _ensure_db() -> None:
+    global _db_initialized
+    if _db_initialized:
+        return
+    with _db_init_lock:
+        if not _db_initialized:
+            init_db()
+            _db_initialized = True
+
 
 mcp = FastMCP(
     "Kore Memory",
@@ -65,6 +77,7 @@ _session_lock = threading.Lock()
 
 def _get_or_create_session(agent_id: str) -> str:
     """Restituisce la session_id corrente per l'agent, creandola se necessario."""
+    _ensure_db()
     if agent_id in _agent_sessions:
         return _agent_sessions[agent_id]
     with _session_lock:
@@ -401,7 +414,7 @@ def memory_import(
     Import memories from a list of dicts. Each item must have at least 'content'.
     Optional fields: category, importance. Maximum 500 memories.
     """
-    count = import_memories(memories, agent_id=_sanitize_agent_id(agent_id))
+    count = import_memories(memories[:500], agent_id=_sanitize_agent_id(agent_id))
     return {"imported": count, "message": f"{count} memories imported"}
 
 
@@ -833,6 +846,8 @@ def _add_health_route() -> None:
 def main():
     import argparse
 
+    _ensure_db()
+
     parser = argparse.ArgumentParser(description="Kore MCP Server")
     parser.add_argument(
         "--transport",