Summary

Version bump from 3.0.14 → 3.1.0. First PyPI cut since v3.0.0 (2026-04-06) — covers 39 merged PRs. Closes the pip/plugin version drift that was causing #290 and #296.

Files touched

• pyproject.toml — version string
• mempalace/version.py — __version__
• README.md — version shield badge

Release notes (for GH release at v3.1.0 tag)

MemPalace v3.1.0

First PyPI cut since v3.0.0 on 2026-04-06 — 39 merged PRs. This release closes the pip/plugin version drift (#290, #296) and lands the first-week community fixes.

🔒 Security

• security: harden inputs, fix shell injection, optimize DB access #387 Input validation at MCP entry points, shell-injection fix in save hook, file size guard + symlink skip, SQLite connection leak fix, WAL audit trail, hardened file perms
• fix: sanitize SESSION_ID in save hook to prevent path traversal #141 Sanitize SESSION_ID in save hook
• fix: sanitize error responses and remove sys.exit from library code #139 Sanitize MCP error responses, remove sys.exit from library code

🐛 Bug fixes (highlights)

• fix: MCP null args hang, repair infinite recursion, OOM on large files #399 MCP null args hang, cmd_repair infinite recursion, 500 MB OOM guard
• Package MemPalace as standard Claude and Codex plugins with easy installation #270 Claude + Codex plugin packaging — one-step install (closes feat: Claude Code plugin for one-step install (hooks + MCP server) #187)
• fix: add limit=10000 safety cap to all unbounded ChromaDB .get() calls #137 10K safety cap on unbounded ChromaDB metadata fetches (closes CLI status silently truncates drawer count at 10,000 with no warning #180)
• fix: replace Unicode separator character for Windows compatibility #129 Windows Unicode crash fix (closes UnicodeEncodeError on Windows: box-drawing chars in searcher.py crash cp1252 console #47)
• fix: --yes flag skips all interactive prompts in init #123 --yes flag bypasses all init prompts (closes mempalace init --yes flag does not fully bypass interactive prompts #179)
• Respect nested .gitignore rules when mining project files #78 Respect nested .gitignore rules during mining (closes Add support for .gitignore files #233)
• fix: silence ChromaDB telemetry warnings and CoreML segfault on Apple Silicon #236 Silence ChromaDB telemetry + Apple Silicon CoreML segfault (closes Posthog > 6.0 causes telemetry event failure #163)
• fix: negotiate MCP protocol version instead of hardcoding #324 Negotiate MCP protocol version instead of hardcoding
• fix: room detection checks keywords against folder paths #145 Room detection checks keywords against folder paths
• fix: enable SQLite WAL mode and add consistent LIMIT to KG timeline #136 SQLite WAL mode + consistent LIMIT in KG timeline
• fix: batch ChromaDB reads to avoid SQLite variable limit #66 Batch ChromaDB reads to avoid SQLite variable limit
• fix: use upsert and deterministic IDs to prevent data stagnation #140 Upsert + deterministic IDs prevent data stagnation
• Plus more — see full commit log

✨ Features

• feat: add OpenAI Codex CLI JSONL normalizer #61 OpenAI Codex CLI JSONL normalizer (first in the feat: add import support for more AI tool session formats (Cursor, Copilot, Codex, Windsurf, Aider, etc.) #59 import format umbrella)
• bench: add scale benchmark suite (106 tests) #223 Scale benchmark suite (106 tests)
• perf: cache ChromaDB PersistentClient instead of re-instantiating per call #135 Cache ChromaDB PersistentClient — big perf win

📊 Benchmarks (the honest version)

• fix: honest AAAK stats — word-based token estimator, lossy labels #147 Honest AAAK stats (word-based token estimator, lossy labels)
• Retired the recall_any@5 headline — see the aa10f8f README correction and the ongoing methodology threads in Multiple issues between README claims and codebase #27, Multiple issues with benchmark methodology and scoring #29, Independent benchmark reproduction on M2 Ultra — raw confirms 96.6%, aaak/rooms regress #39, Benchmarks do not exercise MemPalace — headline 96.6% is a ChromaDB score #214, bench: add BEAM 100K benchmark (end-to-end answer quality) #168

📦 Packaging

• chore: tighten chromadb version range and add py.typed marker #142 Tightened chromadb range (>=0.5.0,<0.7) + py.typed marker
• Increase test coverage from 30% to 85% and fix Windows encoding bugs #281 Test coverage 30% → 85% + Windows encoding fixes
• test: expand coverage from 20 to 92 tests, migrate to uv #131 Migrated tests to uv, 20 → 92 tests
• fix: unify package and MCP version reporting #16 Unified package and MCP version reporting

🙏 Thanks

Massive thanks to everyone who ran audits, caught real bugs, and sent clean PRs in the first week — especially @lhl, @dial481, @gizmax, @rohithzr, @hugooconnor, @anthonyonazure, @fubak, @fuzzymoomoo, @vanachterjacob, @SethRosenthal100, @cktang88, @adv3nt3, @slapglif, @skuznetsov, @rusel95, @M0nkeyFl0wer, @EndeavorYen, @bobmatnyc, @kpulik, @kevgathuku, @mvalentsev, @mvanhorn, @jonashertner.

Closes #290 and #296.

📥 Install

pip install --upgrade mempalace

✨

Test plan

• CI passes on Linux 3.9/3.11/3.13, Windows, macOS
• mempalace --version reports 3.1.0
• python -c "import mempalace; print(mempalace.__version__)" reports 3.1.0
• README version badge shows 3.1.0
• After merge: tag v3.1.0, build wheel + sdist, twine upload dist/*
• Create GH release at the tag using the release notes above