Skip to content

Commit 9f3066c

Browse files
H4LFdotDEVclaude
H4LFdotDEV
and
claude
committed
fix(security): Critical security and reliability fixes for enterprise deployment
Security fixes: - config.py: Add path traversal validation to prevent loading malicious configs - sqlite_index.py: Add LIKE pattern escaping to prevent SQL injection - redis_client.py: Replace blocking KEYS with non-blocking SCAN iterator - graphiti_manager.py: Replace threading.Lock with asyncio.Lock to prevent deadlocks Reliability improvements: - redis_client.py: Add connection retry with exponential backoff (3 attempts) - redis_client.py: Add thread-safe initialization with double-checked locking - redis_client.py: Fix cache_embedding to store full EmbeddingCacheModel structure - livegrep_client.py: Add context manager protocol for proper resource cleanup - livegrep_client.py: Add thread-safe client creation and retry logic New components: - graphiti_manager.py: Neo4j/Graphiti knowledge graph manager (warm tier) - livegrep_client.py: Code search client for livegrep integration (cold tier) - test_graphiti_manager.py: Comprehensive tests for knowledge graph - test_livegrep_client.py: Comprehensive tests for code search client Repository cleanup: - .gitignore: Exclude working .md files, keep only essential docs - .gitignore: Exclude .claude/ personal config and Archive/ - Remove accidental python/=0.21 file All 752 tests passing. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent e307fc9 commit 9f3066c

20 files changed

Lines changed: 2826 additions & 277 deletions

‎.env.example‎

Lines changed: 49 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,102 +1,67 @@
11
# Claude Code++ Environment Variables
2-
# Copy this file to .env and populate with your values
3-
4-
# ============================================================================
5-
# REQUIRED: API Keys
6-
# ============================================================================
7-
8-
# Anthropic API key for Claude models
9-
# Get from: https://console.anthropic.com/
10-
ANTHROPIC_API_KEY=sk-ant-your-key-here
11-
12-
# OpenAI API key (optional, for gpt-4o fallback)
13-
# Get from: https://platform.openai.com/api-keys
14-
OPENAI_API_KEY=sk-your-key-here
15-
16-
# LiteLLM master key for model routing proxy authentication
17-
# Generate: `openssl rand -hex 32`
18-
LITELLM_MASTER_KEY=your-secure-key-here
19-
20-
# ============================================================================
21-
# OPTIONAL: Alternative Embeddings Providers
22-
# ============================================================================
23-
24-
# Voyage AI embeddings (higher quality than OpenAI)
25-
# Get from: https://www.voyageai.com/
26-
VOYAGE_API_KEY=
2+
# Copy this file to .env and fill in the values
3+
#
4+
# Required variables are marked with (REQUIRED)
5+
# Optional variables have defaults or are only needed for specific features
276

28-
# ============================================================================
29-
# REQUIRED: Redis Authentication
30-
# ============================================================================
7+
# =============================================================================
8+
# REQUIRED - API Keys
9+
# =============================================================================
3110

32-
# Redis password for cache layer
33-
# Generate: `openssl rand -base64 24`
34-
REDIS_PASSWORD=your-secure-redis-password-here
11+
# Anthropic API Key for Claude models (REQUIRED)
12+
ANTHROPIC_API_KEY=sk-ant-your-anthropic-api-key-here
3513

36-
# ============================================================================
37-
# OPTIONAL: Storage & Persistence
38-
# ============================================================================
14+
# LiteLLM master key for model routing (REQUIRED)
15+
# Generate a secure random key, e.g.: openssl rand -base64 32
16+
LITELLM_MASTER_KEY=your-secure-litellm-master-key
3917

40-
# Path to Obsidian vault for human-readable memory storage
41-
OBSIDIAN_VAULT_PATH=~/Library/Mobile\ Documents/iCloud~md~obsidian/Documents/ObsidianVault
18+
# Redis password for session cache (REQUIRED)
19+
# Generate a secure password, e.g.: openssl rand -base64 32
20+
REDIS_PASSWORD=your-secure-redis-password
4221

43-
# SQLite database path (auto-created if doesn't exist)
44-
SQLITE_PATH=~/.claude-code-pp/memory/sqlite/memories.db
22+
# Neo4j password for knowledge graph (REQUIRED)
23+
# Generate a secure password, e.g.: openssl rand -base64 32
24+
NEO4J_PASSWORD=your-secure-neo4j-password
4525

46-
# FAISS index path
47-
FAISS_INDEX_PATH=~/.claude-code-pp/memory/faiss/vectors.index
26+
# =============================================================================
27+
# OPTIONAL - Additional API Keys
28+
# =============================================================================
4829

49-
# ============================================================================
50-
# OPTIONAL: Infrastructure Connections
51-
# ============================================================================
30+
# OpenAI API Key (for embeddings, Graphiti entity extraction, fallback models)
31+
OPENAI_API_KEY=
5232

53-
# Redis connection URL (used if Redis is external/non-docker)
54-
REDIS_URL=redis://localhost:6379
33+
# Voyage API Key (for code-optimized embeddings)
34+
VOYAGE_API_KEY=
5535

56-
# ChromaDB connection URL (used if ChromaDB is external)
57-
CHROMADB_URL=http://localhost:8000
36+
# GitHub Personal Access Token (for repository indexing)
37+
GITHUB_TOKEN=
5838

59-
# LiteLLM proxy URL
60-
LITELLM_URL=http://localhost:4000
39+
# =============================================================================
40+
# OPTIONAL - Service Configuration
41+
# =============================================================================
6142

62-
# ============================================================================
63-
# OPTIONAL: Logging & Debugging
64-
# ============================================================================
43+
# Memory MCP Configuration
44+
MEMORY_MCP_LOG_LEVEL=INFO
45+
MEMORY_MCP_LOG_FILE=/tmp/memory-mcp.log
46+
CLAUDE_CODE_PP_CONFIG=~/.claude-code-pp/config/settings.yaml
6547

66-
# Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL
67-
LOG_LEVEL=INFO
48+
# Neo4j/Graphiti Configuration
49+
NEO4J_URI=bolt://localhost:7687
50+
NEO4J_USER=neo4j
6851

69-
# Enable debug mode (verbose output)
70-
DEBUG=false
52+
# livegrep Configuration
53+
LIVEGREP_ENDPOINT=http://localhost:8910
54+
LIVEGREP_INDEX_PATH=~/.claude-code-pp/livegrep/index.idx
7155

72-
# ============================================================================
73-
# OPTIONAL: Performance Tuning
74-
# ============================================================================
56+
# Local LLM Configuration (Ollama)
57+
OLLAMA_BASE_URL=http://localhost:11434
7558

76-
# FAISS index batch size (higher = faster indexing, more memory)
77-
FAISS_BATCH_SIZE=128
59+
# =============================================================================
60+
# OPTIONAL - Development & Debug
61+
# =============================================================================
7862

79-
# Redis connection pool size
80-
REDIS_POOL_SIZE=10
63+
# Enable debug logging for MCP servers
64+
MCP_DEBUG=false
8165

82-
# ============================================================================
83-
# NOTES
84-
# ============================================================================
85-
#
86-
# 1. Required variables (marked REQUIRED above) MUST be set
87-
# - Docker Compose will fail if these are missing
88-
# - Values with `:?required` syntax are enforced
89-
#
90-
# 2. API Keys should be rotated regularly
91-
# - Never commit .env to version control
92-
# - .env.example contains only placeholders (safe to commit)
93-
#
94-
# 3. For Development:
95-
# - Generate secure passwords: openssl rand -base64 24
96-
# - Use different keys per environment (dev/staging/prod)
97-
#
98-
# 4. For Production:
99-
# - Store secrets in a secret manager (AWS Secrets Manager, HashiCorp Vault, etc.)
100-
# - Never use default passwords
101-
# - Use strong, unique LITELLM_MASTER_KEY
102-
# - Enable Redis requirepass (already configured in docker-compose.yaml)
66+
# Enable verbose logging for all components
67+
VERBOSE=false

‎.gitignore‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,46 @@
11
.DS_Store
22

3+
# Swift
4+
swift-system-controller/.build
5+
swift-system-controller/.swiftpm
6+
7+
# Python
8+
__pycache__/
9+
*.pyc
10+
.venv/
11+
*.egg-info/
12+
python/=0.21
13+
14+
# Docker
15+
docker/.env
16+
17+
# Local config overrides
18+
config/*.local.yaml
19+
20+
# Logs
21+
*.log
22+
23+
# Documentation - exclude all except essential
24+
*.md
25+
!README.md
26+
!LICENSE.md
27+
!CHANGELOG.md
28+
!SECURITY.md
29+
!CONTRIBUTING.md
30+
!CODE_OF_CONDUCT.md
31+
# Keep plugin/subproject READMEs
32+
!plugins/**/README.md
33+
!python/README.md
34+
35+
# Archive and working files
36+
Archive/
37+
Archive.zip
38+
*.checkpoint
39+
*.bak
40+
41+
# Claude Code local config (personal workflow)
42+
.claude/agents/
43+
.claude/commands/
44+
.claude/rules/
45+
.claude/skills/
46+
.claude/hooks.json

0 commit comments

Comments
 (0)