Repository navigation
feat: upstream sync 2026-10-28 — tlemmons/junto-memory v1.41.3 - #3
Conversation
Squash of the personal-repo changes since the 2026-07-06 sync (#1). Includes the mcp[cli] <2 pin (SDK v2 breaks FastMCP interposition) and the secret-shaped-string fixes that PR #2 carried. Excluded on purpose: data/ (raw knowledge-base exports; personal content). Removed: src/shared_memory/tools/autopilot.py and its test (removed upstream). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
Branch tree is now exactly tag v1.41.1 (tree 53305fc...) minus data/. Adds 1.40.x/1.41.x over the earlier 1.39.0 sync: project-scope tenant isolation (1.41.0) and auth on /dashboard/api/* (1.41.1), plus /admin. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
tlemmons-lvt
changed the title
![semgrep-code-liveviewtech[bot]](https://avatars.githubusercontent.com/u/16901620?s=60&v=4){kind=small}
|
Semgrep found 3
🟡 Medium severity issue identified in your code: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. |
royhayward
left a comment
royhayward
left a comment
There was a problem hiding this comment.
there are some problematic hardcoded paths. There are also a few things to verify you intended to include.
Massive pull request. this is hard to conclude there are no other problems.
Branch tree is exactly tag v1.41.3 (tree 1c5723e). Removes personal ops material (infra/sage, one-off scripts, backup scripts), requires endpoints via env/args, restricts runner/li.py URLs to http/https, and drops the hard-coded home Mongo password fallback. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
tlemmons-lvt
changed the title
royhayward
left a comment
royhayward
left a comment
There was a problem hiding this comment.
Approve this message
Summary
Squashed sync of tlemmons/junto-memory at tag v1.41.3 (commit 68f288d) since the 2026-07-06 sync (#1). This branch's tree is identical to the tag (
1c5723ed150d8ec6e1d55cd637e3b5bcdd940e92);data/is no longer tracked upstream, so nothing is excluded.Review guide, grouped by theme:
docs/review-guide-1.41.md(159 files vs. the work server's current build; src 58, tests 54, other 47).Changes since the first push of this PR (review feedback + Semgrep)
infra/sage/**, one-off and research scripts, backup scripts,scripts/check_usage.py,docs/workjunto-pilot-setup.md.JUNTO_MCP_LAN_IPis required in compose; test fixtures use documentation IPs.contrib/local-inference/li.pyandcontrib/runner/junto-runner.pyonly pass http/https URLs tourlopen(fixes the Semgrepdynamic-urllib-use-detectedfindings).Why
/dashboard/api/*had no auth (1.41.1).mcp[cli]<2. LVT main has no upper bound; CI anddocker compose buildresolve MCP SDK 2.x and fail. Cause of fix(security): scrub JET-69800 secret false-positives on LiveViewTech main #2'stestfailure./adminweb UI served by the server itself (replaces junto-control). Supersedes fix(security): scrub JET-69800 secret false-positives on LiveViewTech main #2 (closed).Notes
git rev-parse HEAD^{tree}on LVT main must equal1c5723ed…(or differ only by files LVT adds).Underlying server work is by the junto
memoryagent alongside Tom Lemmons.🤖 Generated with Claude Code