Starstruk Logo MarkStarstruk

v3.1.0

MemPalace/mempalacev3.1.0Apr 9, 2026by milla-jovovich

AI Summary

Security-focused release with extensive bug fixes and improved packaging. Closes pip/plugin version drift and lands community-reported fixes from the first week.

Key Highlights

  • Input validation at MCP entry points, shell-injection fix in save hook
  • MCP null args hang fix, cmd_repair infinite recursion fix, 500MB OOM guard
  • Claude + Codex plugin one-step install
  • 10K safety cap on unbounded ChromaDB metadata fetches
  • Windows Unicode crash fix
  • --yes flag bypasses all init prompts
  • Respect nested .gitignore rules during mining
  • Test coverage 30% to 85%, tests from 20 to 92

New Features

  • Input validation and shell injection prevention
  • File size guard and symlink skip
  • SQLite connection leak fix and WAL audit trail
  • Hardened file permissions
  • Claude + Codex plugin packaging
  • OpenAI Codex CLI JSONL normalizer
  • Scale benchmark suite (106 tests)
  • ChromaDB PersistentClient caching
  • Honest AAAK stats with word-based token estimator
  • Tightened chromadb version range
  • py.typed marker
  • Migrated tests to uv

Full Release Notes

First PyPI cut since v3.0.0 on 2026-04-06 — **39 merged PRs**. This release closes the pip/plugin version drift (#290, #296) and lands the first-week community fixes.

## 🔒 Security
- **#387** Input validation at MCP entry points, shell-injection fix in save hook, file size guard + symlink skip, SQLite connection leak fix, WAL audit trail, hardened file perms
- **#141** Sanitize `SESSION_ID` in save hook
- **#139** Sanitize MCP error responses, remove `sys.exit` from library code

## 🐛 Bug fixes (highlights)
- **#399** MCP null args hang, `cmd_repair` infinite recursion, 500 MB OOM guard
- **#270** **Claude + Codex plugin packaging** — one-step install (closes #187)
- **#137** 10K safety cap on unbounded ChromaDB metadata fetches (closes #180)
- **#129** Windows Unicode crash fix (closes #47)
- **#123** `--yes` flag bypasses all init prompts (closes #179)
- **#78** Respect nested `.gitignore` rules during mining (closes #233)
- **#236** Silence ChromaDB telemetry + Apple Silicon CoreML segfault (closes #163)
- **#324** Negotiate MCP protocol version instead of hardcoding
- **#145** Room detection checks keywords against folder paths
- **#136** SQLite WAL mode + consistent LIMIT in KG timeline
- **#66** Batch ChromaDB reads to avoid SQLite variable limit
- **#140** Upsert + deterministic IDs prevent data stagnation
- Plus more — see full commit log

## ✨ Features
- **#61** OpenAI Codex CLI JSONL normalizer (first in the #59 import format umbrella)
- **#223** Scale benchmark suite (106 tests)
- **#135** Cache ChromaDB `PersistentClient` — big perf win

## 📊 Benchmarks (the honest version)
- **#147** Honest AAAK stats (word-based token estimator, lossy labels)
- Retired the `recall_any@5` headline — see the `aa10f8f` README correction and the ongoing methodology threads in #27, #29, #39, #214, #168

## 📦 Packaging
- **#142** Tightened chromadb range (`>=0.5.0,<0.7`) + `py.typed` marker
- **#281** Test coverage 30% → 85% + Windows encoding fixes
- **#131** Migrated tests to `uv`, 20 → 92 tests
- **#16** Unified package and MCP version reporting

## 🙏 Thanks

Massive thanks to everyone who ran audits, caught real bugs, and sent clean PRs in the first week — especially @lhl, @dial481, @gizmax, @rohithzr, @hugooconnor, @anthonyonazure, @fubak, @fuzzymoomoo, @vanachterjacob, @SethRosenthal100, @cktang88, @adv3nt3, @slapglif, @skuznetsov, @rusel95, @M0nkeyFl0wer, @EndeavorYen, @bobmatnyc, @kpulik, @kevgathuku, @mvalentsev, @mvanhorn, @jonashertner.

Closes #290 and #296.

## 📥 Install

```bash
pip install --upgrade mempalace
```

✨