memorius 0.7.0__tar.gz → 0.7.2__tar.gz

{memorius-0.7.0/memorius.egg-info → memorius-0.7.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: memorius
-Version: 0.7.0
-Summary: Self-contained memory vault for any AI agent - vector search, session diaries, and agent-agnostic hooks.
+Version: 0.7.2
+Summary: Self-contained memory vault for any AI agent — vector search, session diaries, and agent-agnostic hooks.
 Author-email: dimonapatrick243 <dimona.patrick@gmail.com>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/Dream-Pixels-Forge/memorius
@@ -17,30 +17,23 @@ Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: chromadb>=0.4.0
-Requires-Dist: httpx>=0.24.0
-Requires-Dist: fastapi>=0.104.0
+Requires-Dist: pyyaml>=6.0.1
+Requires-Dist: chromadb>=0.4.22
+Requires-Dist: httpx>=0.25.0
+Requires-Dist: fastapi>=0.104.1
 Requires-Dist: uvicorn[standard]>=0.24.0
 Requires-Dist: pydantic>=2.0.0
 Requires-Dist: sse-starlette>=1.0.0
-Provides-Extra: local-embeddings
-Requires-Dist: sentence-transformers>=2.2.0; extra == "local-embeddings"
-Provides-Extra: openai
-Requires-Dist: openai>=1.0.0; extra == "openai"
-Provides-Extra: ranker
-Requires-Dist: sentence-transformers>=2.2.0; extra == "ranker"
-Provides-Extra: single-file
-Requires-Dist: sqlite-vec>=0.1.0; extra == "single-file"
-Provides-Extra: all
-Requires-Dist: memorius[local-embeddings,openai,ranker,single-file]; extra == "all"
+Requires-Dist: sentence-transformers>=2.6.0
+Requires-Dist: openai>=1.10.0
+Requires-Dist: sqlite-vec>=0.1.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
 Dynamic: license-file
 
 # Memorius
-<img width="1584" height="672" alt="memorius" src="https://github.com/user-attachments/assets/1a62163d-1ff5-4112-8b8f-1a6b19afab7a" />
+<img alt="memorius" src="assets/banner.png" />
 
 <p align="center">
   <strong>Universal memory vault for any AI agent.</strong>
@@ -52,7 +45,7 @@ Dynamic: license-file
   <a href="https://github.com/Dream-Pixels-Forge/memorius/actions/workflows/publish.yml"><img src="https://github.com/Dream-Pixels-Forge/memorius/actions/workflows/publish.yml/badge.svg" alt="PyPI publish"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
   <a href="https://python.org"><img src="https://img.shields.io/badge/python-3.11%20%7C%203.12-blue" alt="Python 3.11 | 3.12"></a>
-  <a href="https://github.com/Dream-Pixels-Forge/memorius/blob/main/CHANGELOG.md"><img src="https://img.shields.io/badge/changelog-v1.2.4-green" alt="Changelog"></a>
+  <a href="https://github.com/Dream-Pixels-Forge/memorius/blob/main/CHANGELOG.md"><img src="https://img.shields.io/badge/changelog-v0.7.1-green" alt="Changelog"></a>
 </p>
 
 > **Works with Claude Code, Codex CLI, Gemini CLI, OpenClaude, OpenCode, Pi, and any MCP-compatible agent.**
@@ -117,23 +110,33 @@ memorius diary "session-001" --title "Research findings"
 
 <img width="979" height="632" alt="Screenshot from 2026-06-18 15-14-39" src="https://github.com/user-attachments/assets/6cbca59b-1a3c-4b1d-85e8-dd5b256b9061" />
 
-## What's New in v1.2.4
+## What's New in v0.7.2
 
-### Architecture Improvements
-- **Modular VaultEngine** — extracted `SearchModule` (5-stage search pipeline) and `StoreModule` (CRUD operations). VaultEngine reduced from 692 to 328 lines (53% reduction).
-- **VectorStore ABC** — `ChromaStore` and `SqliteVecStore` now share an abstract base class for swappable backends.
-- **Sealed `_conn()` leakage** — all external callers now use `SQLiteStore` public API (`execute`, `fetchone`, `fetchall`, `transaction`, graph/temporal adapters, import/export methods).
-- **Shared Obsidian module** — `memorius/obsidian.py` consolidates helpers used by REST server and CLI.
+### Security Hardening (Comprehensive Audit)
+- **Path traversal guards** — `export_graph_html` and CLI obsidian export validate paths stay within storage/export directories.
+- **HTML injection prevention** — Graph visualizer title escaped via `html.escape()`.
+- **Command injection prevention** — Windows daemon startup passes host/port/tls via environment variables.
+- **LLM extraction trust model** — System/user message split isolates extraction rules from user-provided content.
+- **Template injection prevention** — Recursion depth limited to 10 in `_substitute_templates`.
+- **UUID validation on MCP handlers** — `memorius_contradictions`, `memorius_get`, `memorius_update`, `memorius_delete` validate memory_id format.
+- **Dependency version pinning** — Minimum versions set for `chromadb>=0.4.22`, `sentence-transformers>=2.6.0`, `httpx>=0.25.0`, `openai>=1.1.0`.
+- **Rate limiter memory growth fix** — Sweep every 200 requests + IP count cap (10,000).
+- **Security documentation** — MCP tool descriptions include security notes about treating memory content as untrusted data.
 
-### Code Quality
-- **Type hints** — complete type annotations on `SQLiteStore` public API.
-- **Exception documentation** — 30 `except Exception` blocks annotated as best-effort with reasons.
-- **Dead code removal** — HNSW switchover path removed from consolidation.
-- **26 new tests** — `SearchModule` (7) and `StoreModule` (19) unit tests.
+### Added
+- **Knowledge Graph Visualizer** — standalone interactive HTML visualization with force-directed canvas layout, shelf/relation filtering, search, node inspector, and zoom/pan. Access via `memorius graph view`, MCP `memorius_graph_export`, or REST `GET /graph/view`.
+- **Dependency consolidation** — `sentence-transformers`, `openai`, `sqlite-vec` now included by default. `pip install memorius` includes all features.
 
-### Fixed
-- **Version mismatch** — `__version__` now uses `importlib.metadata.version()` consistently.
-- **Legacy test references** — `test_features.py` updated to use `SQLiteStore` public API instead of `_conn()`.
+### Code Quality
+- **Extracted lazy-init pattern** — `_get_store_module()` and `_get_search_module()` helpers eliminate repeated init blocks.
+- **Deduplicated JSON parsing** — `safe_parse_json()` in `utils.py` used across `store_module.py` and `search_module.py`.
+- **Missing exception annotations** — 6 unannotated blocks in `doctor.py` and `context_inject.py` now documented.
+- **Sealed message-chain breach** — MCP server calls `engine.list_diaries()` instead of `_engine._meta.list_diaries()`.
+- **Clarified HookEngine naming** — `_get_engine()` → `_get_vault()` to avoid confusion with the HookEngine class.
+- **SQL PRAGMA whitelist** — `_get_columns()` validates table names against `frozenset` allowlist.
+- **UUID validation on batch queries** — `get_memory_meta_batch()` validates IDs before `WHERE IN` interpolation.
+- **Typed module dependencies** — `SearchModule`/`StoreModule` `meta` param typed as `SQLiteStore` (was `Any`).
+- **Scoped connection cleanup** — `VaultEngine.close()` closes only its own DB, not all thread connections.
 
 See [CHANGELOG.md](CHANGELOG.md) for full release history.
 
@@ -237,8 +240,8 @@ Memorius uses a **VectorStore ABC** (abstract base class) for swappable backends
 
 | Backend | Dependency | Description |
 |---|---|---|
-| **ChromaDB** (default) | ChromaDB (bundled) | Persistent HNSW cosine search, auto-migration from legacy collections |
-| **SQLite-vec** | `pip install memorius[single-file]` | Single-file alternative, no ChromaDB dependency |
+| **ChromaDB** (default) | ChromaDB (included) | Persistent HNSW cosine search, auto-migration from legacy collections |
+| **SQLite-vec** | SQLite-vec (included) | Single-file alternative, no ChromaDB dependency |
 
 Set `storage.type: sqlite-vec` in config or `MEMORIUS_STORAGE_TYPE=sqlite-vec` to use the lightweight backend.
 
@@ -246,8 +249,8 @@ Set `storage.type: sqlite-vec` in config or `MEMORIUS_STORAGE_TYPE=sqlite-vec` t
 
 | Provider | Requirement | Quality |
 |---|---|---|
-| `chroma-default` | ChromaDB (bundled ONNX) | Good (384d) |
-| `sentence-transformers` | `pip install memorius[local-embeddings]` | Better (768d+) |
+| `chroma-default` | ChromaDB (included ONNX) | Good (384d) |
+| `sentence-transformers` | `sentence-transformers` (included) | Better (768d+) |
 | `openai` | `OPENAI_API_KEY` env var | Best (1536d or 3072d) |
 
 Providers are extensible via `EmbeddingFactory.register()` for custom runtime providers.
@@ -267,7 +270,8 @@ Memorius implements the **Ebbinghaus forgetting curve** to rank memories by rele
 - **Auto-linking** on every `store()` call by content proximity (Jaccard word overlap or vector cosine)
 - **BFS expansion** from search results (`--expand-graph` on CLI / `expand_graph=True` on MCP)
 - **Contradiction edges** persisted by `factcheck` (bidirectional `relation='contradicts'`)
-- **Graph statistics** via `memorius stats` or MCP `memorius_graph_stats`
+- **Graph visualization** via `memorius graph view` (interactive browser UI) or `memorius graph export-html`
+- **Graph statistics** via `memorius graph stats` or MCP `memorius_graph_stats`
 
 ## Cross-Encoder Reranker
 
@@ -279,7 +283,7 @@ memorius search "query" --rerank
 
 | Provider | Requirement |
 |---|---|
-| `cross-encoder/ms-marco-MiniLM-L-6-v2` | `pip install memorius[ranker]` |
+| `cross-encoder/ms-marco-MiniLM-L-6-v2` | Included out of the box (`pip install memorius`) |
 
 Adds `__rerank_score__` to memory metadata for transparent ranking.
 
@@ -518,7 +522,7 @@ any MCP-compatible client by pointing it at the MCP server:
 }
 ```
 
-Available MCP tools (22 tools):
+Available MCP tools (21 tools):
 
 | Tool | Description |
 |---|---|
@@ -799,15 +803,17 @@ All inputs are validated for security and correctness:
 - CORS: restrictive by default (Obsidian app + localhost only)
 - Path traversal detection on Obsidian export
 
-## Optional Dependencies
+## Installation
+ 
+```bash
+pip install memorius
+```
+
+All features — including the cross-encoder reranker, sentence-transformers, SQLite-vec single-file backend, OpenAI embeddings support, REST API server, and graph visualizer — are included out of the box.
 
+For development:
 ```bash
-pip install memorius[local-embeddings]  # sentence-transformers
-pip install memorius[openai]            # openai SDK
-pip install memorius[ranker]            # cross-encoder reranker
-pip install memorius[single-file]       # sqlite-vec backend
-pip install memorius[all]               # everything above
-pip install memorius[dev]               # pytest + pytest-asyncio
+pip install memorius[dev]  # pytest + pytest-asyncio
 ```
 
 ## Installed CLI Entry Points

{memorius-0.7.0 → memorius-0.7.2}/README.md

@@ -1,5 +1,5 @@
 # Memorius
-<img width="1584" height="672" alt="memorius" src="https://github.com/user-attachments/assets/1a62163d-1ff5-4112-8b8f-1a6b19afab7a" />
+<img alt="memorius" src="assets/banner.png" />
 
 <p align="center">
   <strong>Universal memory vault for any AI agent.</strong>
@@ -11,7 +11,7 @@
   <a href="https://github.com/Dream-Pixels-Forge/memorius/actions/workflows/publish.yml"><img src="https://github.com/Dream-Pixels-Forge/memorius/actions/workflows/publish.yml/badge.svg" alt="PyPI publish"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
   <a href="https://python.org"><img src="https://img.shields.io/badge/python-3.11%20%7C%203.12-blue" alt="Python 3.11 | 3.12"></a>
-  <a href="https://github.com/Dream-Pixels-Forge/memorius/blob/main/CHANGELOG.md"><img src="https://img.shields.io/badge/changelog-v1.2.4-green" alt="Changelog"></a>
+  <a href="https://github.com/Dream-Pixels-Forge/memorius/blob/main/CHANGELOG.md"><img src="https://img.shields.io/badge/changelog-v0.7.1-green" alt="Changelog"></a>
 </p>
 
 > **Works with Claude Code, Codex CLI, Gemini CLI, OpenClaude, OpenCode, Pi, and any MCP-compatible agent.**
@@ -76,23 +76,33 @@ memorius diary "session-001" --title "Research findings"
 
 <img width="979" height="632" alt="Screenshot from 2026-06-18 15-14-39" src="https://github.com/user-attachments/assets/6cbca59b-1a3c-4b1d-85e8-dd5b256b9061" />
 
-## What's New in v1.2.4
+## What's New in v0.7.2
 
-### Architecture Improvements
-- **Modular VaultEngine** — extracted `SearchModule` (5-stage search pipeline) and `StoreModule` (CRUD operations). VaultEngine reduced from 692 to 328 lines (53% reduction).
-- **VectorStore ABC** — `ChromaStore` and `SqliteVecStore` now share an abstract base class for swappable backends.
-- **Sealed `_conn()` leakage** — all external callers now use `SQLiteStore` public API (`execute`, `fetchone`, `fetchall`, `transaction`, graph/temporal adapters, import/export methods).
-- **Shared Obsidian module** — `memorius/obsidian.py` consolidates helpers used by REST server and CLI.
+### Security Hardening (Comprehensive Audit)
+- **Path traversal guards** — `export_graph_html` and CLI obsidian export validate paths stay within storage/export directories.
+- **HTML injection prevention** — Graph visualizer title escaped via `html.escape()`.
+- **Command injection prevention** — Windows daemon startup passes host/port/tls via environment variables.
+- **LLM extraction trust model** — System/user message split isolates extraction rules from user-provided content.
+- **Template injection prevention** — Recursion depth limited to 10 in `_substitute_templates`.
+- **UUID validation on MCP handlers** — `memorius_contradictions`, `memorius_get`, `memorius_update`, `memorius_delete` validate memory_id format.
+- **Dependency version pinning** — Minimum versions set for `chromadb>=0.4.22`, `sentence-transformers>=2.6.0`, `httpx>=0.25.0`, `openai>=1.1.0`.
+- **Rate limiter memory growth fix** — Sweep every 200 requests + IP count cap (10,000).
+- **Security documentation** — MCP tool descriptions include security notes about treating memory content as untrusted data.
 
-### Code Quality
-- **Type hints** — complete type annotations on `SQLiteStore` public API.
-- **Exception documentation** — 30 `except Exception` blocks annotated as best-effort with reasons.
-- **Dead code removal** — HNSW switchover path removed from consolidation.
-- **26 new tests** — `SearchModule` (7) and `StoreModule` (19) unit tests.
+### Added
+- **Knowledge Graph Visualizer** — standalone interactive HTML visualization with force-directed canvas layout, shelf/relation filtering, search, node inspector, and zoom/pan. Access via `memorius graph view`, MCP `memorius_graph_export`, or REST `GET /graph/view`.
+- **Dependency consolidation** — `sentence-transformers`, `openai`, `sqlite-vec` now included by default. `pip install memorius` includes all features.
 
-### Fixed
-- **Version mismatch** — `__version__` now uses `importlib.metadata.version()` consistently.
-- **Legacy test references** — `test_features.py` updated to use `SQLiteStore` public API instead of `_conn()`.
+### Code Quality
+- **Extracted lazy-init pattern** — `_get_store_module()` and `_get_search_module()` helpers eliminate repeated init blocks.
+- **Deduplicated JSON parsing** — `safe_parse_json()` in `utils.py` used across `store_module.py` and `search_module.py`.
+- **Missing exception annotations** — 6 unannotated blocks in `doctor.py` and `context_inject.py` now documented.
+- **Sealed message-chain breach** — MCP server calls `engine.list_diaries()` instead of `_engine._meta.list_diaries()`.
+- **Clarified HookEngine naming** — `_get_engine()` → `_get_vault()` to avoid confusion with the HookEngine class.
+- **SQL PRAGMA whitelist** — `_get_columns()` validates table names against `frozenset` allowlist.
+- **UUID validation on batch queries** — `get_memory_meta_batch()` validates IDs before `WHERE IN` interpolation.
+- **Typed module dependencies** — `SearchModule`/`StoreModule` `meta` param typed as `SQLiteStore` (was `Any`).
+- **Scoped connection cleanup** — `VaultEngine.close()` closes only its own DB, not all thread connections.
 
 See [CHANGELOG.md](CHANGELOG.md) for full release history.
 
@@ -196,8 +206,8 @@ Memorius uses a **VectorStore ABC** (abstract base class) for swappable backends
 
 | Backend | Dependency | Description |
 |---|---|---|
-| **ChromaDB** (default) | ChromaDB (bundled) | Persistent HNSW cosine search, auto-migration from legacy collections |
-| **SQLite-vec** | `pip install memorius[single-file]` | Single-file alternative, no ChromaDB dependency |
+| **ChromaDB** (default) | ChromaDB (included) | Persistent HNSW cosine search, auto-migration from legacy collections |
+| **SQLite-vec** | SQLite-vec (included) | Single-file alternative, no ChromaDB dependency |
 
 Set `storage.type: sqlite-vec` in config or `MEMORIUS_STORAGE_TYPE=sqlite-vec` to use the lightweight backend.
 
@@ -205,8 +215,8 @@ Set `storage.type: sqlite-vec` in config or `MEMORIUS_STORAGE_TYPE=sqlite-vec` t
 
 | Provider | Requirement | Quality |
 |---|---|---|
-| `chroma-default` | ChromaDB (bundled ONNX) | Good (384d) |
-| `sentence-transformers` | `pip install memorius[local-embeddings]` | Better (768d+) |
+| `chroma-default` | ChromaDB (included ONNX) | Good (384d) |
+| `sentence-transformers` | `sentence-transformers` (included) | Better (768d+) |
 | `openai` | `OPENAI_API_KEY` env var | Best (1536d or 3072d) |
 
 Providers are extensible via `EmbeddingFactory.register()` for custom runtime providers.
@@ -226,7 +236,8 @@ Memorius implements the **Ebbinghaus forgetting curve** to rank memories by rele
 - **Auto-linking** on every `store()` call by content proximity (Jaccard word overlap or vector cosine)
 - **BFS expansion** from search results (`--expand-graph` on CLI / `expand_graph=True` on MCP)
 - **Contradiction edges** persisted by `factcheck` (bidirectional `relation='contradicts'`)
-- **Graph statistics** via `memorius stats` or MCP `memorius_graph_stats`
+- **Graph visualization** via `memorius graph view` (interactive browser UI) or `memorius graph export-html`
+- **Graph statistics** via `memorius graph stats` or MCP `memorius_graph_stats`
 
 ## Cross-Encoder Reranker
 
@@ -238,7 +249,7 @@ memorius search "query" --rerank
 
 | Provider | Requirement |
 |---|---|
-| `cross-encoder/ms-marco-MiniLM-L-6-v2` | `pip install memorius[ranker]` |
+| `cross-encoder/ms-marco-MiniLM-L-6-v2` | Included out of the box (`pip install memorius`) |
 
 Adds `__rerank_score__` to memory metadata for transparent ranking.
 
@@ -477,7 +488,7 @@ any MCP-compatible client by pointing it at the MCP server:
 }
 ```
 
-Available MCP tools (22 tools):
+Available MCP tools (21 tools):
 
 | Tool | Description |
 |---|---|
@@ -758,15 +769,17 @@ All inputs are validated for security and correctness:
 - CORS: restrictive by default (Obsidian app + localhost only)
 - Path traversal detection on Obsidian export
 
-## Optional Dependencies
+## Installation
+ 
+```bash
+pip install memorius
+```
+
+All features — including the cross-encoder reranker, sentence-transformers, SQLite-vec single-file backend, OpenAI embeddings support, REST API server, and graph visualizer — are included out of the box.
 
+For development:
 ```bash
-pip install memorius[local-embeddings]  # sentence-transformers
-pip install memorius[openai]            # openai SDK
-pip install memorius[ranker]            # cross-encoder reranker
-pip install memorius[single-file]       # sqlite-vec backend
-pip install memorius[all]               # everything above
-pip install memorius[dev]               # pytest + pytest-asyncio
+pip install memorius[dev]  # pytest + pytest-asyncio
 ```
 
 ## Installed CLI Entry Points

{memorius-0.7.0 → memorius-0.7.2}/manifest.yaml

@@ -3,7 +3,7 @@
 # Run: memorius-plugin-gen generate
 
 name: memorius
-version: "0.7.0"
+version: "1.2.3"
 description: "Memorius — universal memory vault for any AI agent"
 author: "dimonapatrick243"
 license: MIT

{memorius-0.7.0 → memorius-0.7.2}/memorius/backup.py

@@ -13,17 +13,29 @@ from __future__ import annotations
 
 import json
 import logging
-import os
-import re
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
+from memorius.validation import validate_name as _validate_name
+
 logger = logging.getLogger("memorius.backup")
 
 SCHEMA_VERSION = 1
 
 
+def _validate_hierarchy_names(vaults, shelves, folders, notes):
+    """Validate all hierarchy items before import to prevent path traversal."""
+    for v in vaults:
+        _validate_name(v.get("name", ""), "vault")
+    for s in shelves:
+        _validate_name(s.get("name", ""), "shelf")
+    for f in folders:
+        _validate_name(f.get("name", ""), "folder")
+    for n in notes:
+        _validate_name(n.get("name", ""), "note")
+
+
 # ── JSON export / import ─────────────────────────────────────────────────────
 
 def export_json(engine, dest: str | Path) -> Path:
@@ -99,6 +111,13 @@ def import_json(engine, src: str | Path, *, merge: bool = True) -> dict[str, Any
     }
 
     # ── hierarchy ──
+    # Validate all imported names to prevent path traversal
+    _validate_hierarchy_names(
+        payload.get("vaults", []),
+        payload.get("shelves", []),
+        payload.get("folders", []),
+        payload.get("notes", []),
+    )
     engine._meta.import_hierarchy(
         payload.get("vaults", []),
         payload.get("shelves", []),
@@ -112,6 +131,11 @@ def import_json(engine, src: str | Path, *, merge: bool = True) -> dict[str, Any
 
     # ── memories ──
     for m in payload.get("memories", []):
+        # Validate memory hierarchy fields to prevent path traversal
+        _validate_name(m["vault"], "vault")
+        _validate_name(m["shelf"], "shelf")
+        _validate_name(m["folder"], "folder")
+        _validate_name(m["note"], "note")
         engine._meta.ensure_note(m["vault"], m["shelf"], m["folder"], m["note"])
         imported = engine._meta.import_memory_meta(m, merge=merge)
         if imported:
@@ -174,6 +198,11 @@ def export_markdown(engine, dest: str | Path) -> Path:
         edges = edges_by_source.get(mid, [])
 
         md_path = dest / m["vault"] / m["shelf"] / m["folder"] / m["note"] / f"{mid}.md"
+        # Path traversal guard: resolved path must stay inside dest
+        md_path_resolved = md_path.resolve()
+        if not str(md_path_resolved).startswith(str(dest.resolve())):
+            logger.warning("Skipping memory %s: path traversal detected", mid)
+            continue
         md_path.parent.mkdir(parents=True, exist_ok=True)
 
         # Build YAML frontmatter

{memorius-0.7.0 → memorius-0.7.2}/memorius/cli/main.py

@@ -20,6 +20,8 @@ Usage:
   memorius obsidian list     List notes in an Obsidian vault
   memorius obsidian import   Import Obsidian notes as memories
   memorius obsidian export   Export memories as Obsidian notes
+  memorius graph view        Open interactive knowledge graph in browser
+  memorius graph export-html Export standalone interactive HTML graph
   memorius web <query>     Search the internet (web fallback)
 """
 
@@ -119,10 +121,12 @@ def main():
 
     serve_rest_p = subparsers.add_parser("serve-rest", help="Start REST API server")
     serve_rest_p.add_argument("--port", type=int, default=None, help="Port")
-    serve_rest_p.add_argument("--host", default=None, help="Host")
+    serve_rest_p.add_argument("--host", default=None, help="Host (default: 127.0.0.1)")
     serve_rest_p.add_argument("--daemon", action="store_true", help="Run as background daemon")
     serve_rest_p.add_argument("--stop", action="store_true", help="Stop running daemon")
     serve_rest_p.add_argument("--pid-file", default=None, help="PID file path")
+    serve_rest_p.add_argument("--tls-cert", default=None, help="Path to TLS certificate file (PEM)")
+    serve_rest_p.add_argument("--tls-key", default=None, help="Path to TLS private key file (PEM)")
 
     config_p = subparsers.add_parser("config", help="Show configuration")
     config_p.add_argument("--show", action="store_true", default=True, help="Show config")
@@ -201,6 +205,35 @@ def main():
     list_p.add_argument("--limit", type=int, default=10, help="Max results per page (default: 10)")
     list_p.add_argument("--cursor", help="Cursor for next page (timestamp)")
 
+    # ── Graph subcommands ──
+    graph_p = subparsers.add_parser("graph", help="Visualize and inspect the knowledge graph")
+    graph_sub = graph_p.add_subparsers(dest="subcommand")
+
+    g_view_p = graph_sub.add_parser("view", help="Open interactive knowledge graph visualizer in browser")
+    g_view_p.add_argument("--vault", default=None, help="Filter by vault")
+    g_view_p.add_argument("--shelf", default=None, help="Filter by shelf")
+    g_view_p.add_argument("--relation", default=None, help="Filter by relation type (related, references, contradicts, co_occurs)")
+    g_view_p.add_argument("--min-weight", type=float, default=0.0, help="Minimum edge weight (default: 0.0)")
+    g_view_p.add_argument("--limit", type=int, default=500, help="Max nodes to display (default: 500)")
+    g_view_p.add_argument("--no-open", action="store_true", help="Don't open browser automatically")
+
+    g_export_p = graph_sub.add_parser("export-html", help="Export standalone interactive HTML visualization")
+    g_export_p.add_argument("--output", "-o", default="graph.html", help="Output file path (default: graph.html)")
+    g_export_p.add_argument("--vault", default=None, help="Filter by vault")
+    g_export_p.add_argument("--shelf", default=None, help="Filter by shelf")
+    g_export_p.add_argument("--relation", default=None, help="Filter by relation type")
+    g_export_p.add_argument("--min-weight", type=float, default=0.0, help="Minimum edge weight")
+    g_export_p.add_argument("--limit", type=int, default=500, help="Max nodes to export")
+
+    graph_sub.add_parser("stats", help="Display knowledge graph statistics")
+
+    g_json_p = graph_sub.add_parser("json", help="Output graph topology as JSON")
+    g_json_p.add_argument("--vault", default=None, help="Filter by vault")
+    g_json_p.add_argument("--shelf", default=None, help="Filter by shelf")
+    g_json_p.add_argument("--relation", default=None, help="Filter by relation type")
+    g_json_p.add_argument("--min-weight", type=float, default=0.0, help="Minimum edge weight")
+    g_json_p.add_argument("--limit", type=int, default=500, help="Max nodes")
+
     # ── Obsidian subcommands ──
     obsidian_p = subparsers.add_parser("obsidian", help="Interact with Obsidian vaults")
     obsidian_sub = obsidian_p.add_subparsers(dest="subcommand")
@@ -268,6 +301,7 @@ def main():
         "import": cmd_import,
         "doctor": cmd_doctor,
         "list": cmd_list,
+        "graph": cmd_graph,
     }
     handler = commands.get(args.command)
     if handler:
@@ -525,10 +559,18 @@ def cmd_serve_rest(engine, args, config):
         return
 
     if getattr(args, "daemon", False):
-        _start_daemon(engine, host, port, pid_file)
+        _start_daemon(
+            engine, host, port, pid_file,
+            tls_cert=getattr(args, "tls_cert", None),
+            tls_key=getattr(args, "tls_key", None),
+        )
     else:
         from memorius.rest_server import run_rest_server
-        run_rest_server(engine, host=host, port=port)
+        run_rest_server(
+            engine, host=host, port=port,
+            tls_cert=getattr(args, "tls_cert", None),
+            tls_key=getattr(args, "tls_key", None),
+        )
 
 
 def _stop_daemon(pid_file: Path):
@@ -582,27 +624,44 @@ def _stop_daemon(pid_file: Path):
     print("Daemon stopped")
 
 
-def _start_daemon(engine, host: str, port: int, pid_file: Path):
+def _start_daemon(engine, host: str, port: int, pid_file: Path,
+                   tls_cert: str | None = None, tls_key: str | None = None):
     """Start REST server as a background daemon."""
     import os
     import sys
     import subprocess
-    import time
 
     if os.name == "nt":
         # Windows: launch detached subprocess
-        cmd = [
-            sys.executable, "-c",
-            (
-                f"import os, sys; sys.stdin = open(os.devnull); "
-                f"Path('{pid_file}').write_text(str(os.getpid())); "
-                f"from memorius.rest_server import run_rest_server; "
-                f"from memorius.vault import VaultEngine; "
-                f"from memorius.config import load_config; "
-                f"e = VaultEngine(load_config()); "
-                f"run_rest_server(e, host='{host}', port={port})"
-            ),
-        ]
+        # Pass configuration via environment variables to avoid shell injection
+        # through string interpolation in python -c commands.
+        daemon_script = (
+            "import os, sys; sys.stdin = open(os.devnull); "
+            "from pathlib import Path; "
+            "Path(os.environ['MEMORIUS_PID_FILE']).write_text(str(os.getpid())); "
+            "from memorius.rest_server import run_rest_server; "
+            "from memorius.vault import VaultEngine; "
+            "from memorius.config import load_config; "
+            "e = VaultEngine(load_config()); "
+            "run_rest_server(e, host=os.environ['MEMORIUS_HOST'], "
+            "port=int(os.environ['MEMORIUS_PORT']))"
+        )
+        env = os.environ.copy()
+        env["MEMORIUS_HOST"] = host
+        env["MEMORIUS_PORT"] = str(port)
+        env["MEMORIUS_PID_FILE"] = str(pid_file)
+        if tls_cert and tls_key:
+            env["MEMORIUS_TLS_CERT"] = tls_cert
+            env["MEMORIUS_TLS_KEY"] = tls_key
+            daemon_script = daemon_script.replace(
+                "run_rest_server(e, host=os.environ['MEMORIUS_HOST'], "
+                "port=int(os.environ['MEMORIUS_PORT']))",
+                "run_rest_server(e, host=os.environ['MEMORIUS_HOST'], "
+                "port=int(os.environ['MEMORIUS_PORT']), "
+                "tls_cert=os.environ.get('MEMORIUS_TLS_CERT'), "
+                "tls_key=os.environ.get('MEMORIUS_TLS_KEY'))",
+            )
+        cmd = [sys.executable, "-c", daemon_script]
         proc = subprocess.Popen(
             cmd,
             creationflags=subprocess.CREATE_NO_WINDOW | subprocess.DETACHED_PROCESS,
@@ -848,6 +907,58 @@ def cmd_stats(engine, args, config):
             print(f"      {rel}: {count}")
 
 
+def cmd_graph(engine, args, config):
+    """Inspect or visualize knowledge graph."""
+    sub = getattr(args, "subcommand", None)
+    if sub == "stats" or sub is None:
+        graph_stats = engine.get_graph_stats()
+        print("  Knowledge Graph Statistics:")
+        print(f"    Nodes:        {graph_stats.get('unique_nodes', 0)}")
+        print(f"    Edges:        {graph_stats.get('total_edges', 0)}")
+        relations = graph_stats.get('relations', {})
+        if relations:
+            print("    Relations:")
+            for rel, count in relations.items():
+                print(f"      {rel}: {count}")
+    elif sub == "export-html":
+        out_file = args.output
+        engine.export_graph_html(
+            dest=out_file,
+            vault=args.vault,
+            shelf=args.shelf,
+            relation=args.relation,
+            min_weight=args.min_weight,
+            limit=args.limit,
+        )
+        print(f"Knowledge graph visualization saved to: {Path(out_file).resolve()}")
+    elif sub == "view":
+        import tempfile
+        import webbrowser
+        temp_dir = Path(tempfile.gettempdir())
+        html_file = temp_dir / "memorius_graph.html"
+        engine.export_graph_html(
+            dest=str(html_file),
+            vault=args.vault,
+            shelf=args.shelf,
+            relation=args.relation,
+            min_weight=args.min_weight,
+            limit=args.limit,
+        )
+        print(f"Generated visualization: {html_file}")
+        if not getattr(args, "no_open", False):
+            print("Opening in default browser...")
+            webbrowser.open(f"file://{html_file.resolve()}")
+    elif sub == "json":
+        data = engine.get_graph_data(
+            vault=args.vault,
+            shelf=args.shelf,
+            relation=args.relation,
+            min_weight=args.min_weight,
+            limit=args.limit,
+        )
+        print(json.dumps(data, indent=2))
+
+
 def cmd_get(engine, args, config):
     """Get a single memory by ID."""
     from memorius.validation import validate_memory_id as _vid

{memorius-0.7.0 → memorius-0.7.2}/memorius/cli/obsidian.py

@@ -11,9 +11,7 @@ Usage:
 
 from __future__ import annotations
 
-import json
 import logging
-import os
 import re
 from pathlib import Path
 from typing import Any
@@ -21,10 +19,7 @@ from typing import Any
 from memorius.vault import VaultEngine
 from memorius.obsidian import (
     resolve_vault_path as _resolve_vault_path,
-    scan_vault as _scan_vault,
-    parse_note as _parse_note,
     parse_frontmatter as _parse_frontmatter,
-    FRONTMATTER_RE,
 )
 
 logger = logging.getLogger("memorius.obsidian")
@@ -158,7 +153,7 @@ def import_notes(
         metadata["obsidian_path"] = str(relative)
         metadata["obsidian_title"] = title
 
-        memory = engine.store(
+        engine.store(
             content=store_content,
             vault=target_vault,
             shelf=target_shelf,
@@ -227,7 +222,14 @@ def export_memories(
                         continue
 
                     # Build output path mirroring hierarchy
-                    note_subdir = export_dir / sh["name"] / f["name"]
+                    note_subdir = (export_dir / sh["name"] / f["name"]).resolve()
+                    # Path traversal guard: must stay inside export_dir
+                    if not str(note_subdir).startswith(str(export_dir.resolve())):
+                        logger.warning(
+                            "Skipping %s/%s/%s: path traversal detected",
+                            sh["name"], f["name"], n["name"],
+                        )
+                        continue
                     note_subdir.mkdir(parents=True, exist_ok=True)
                     note_file = note_subdir / f"{n['name']}.md"