Skip to content

fix: 25 bugs — threading, MCP locks, scratch_that, Ollama model, SOAP QA, security#4

Merged
cortexuvula merged 1 commit into
mainfrom
fix/25-bugs-threading-mcp-security
Mar 31, 2026
Merged

fix: 25 bugs — threading, MCP locks, scratch_that, Ollama model, SOAP QA, security#4
cortexuvula merged 1 commit into
mainfrom
fix/25-bugs-threading-mcp-security

Conversation

@cortexuvula
Copy link
Copy Markdown
Owner

Summary

Comprehensive 5-agent code review found and fixed 25 bugs across 30 files:

  • 2 Critical: scratch_that() completely non-functional (tags never applied); MCP HealthMonitor blocked all operations for up to 8s while holding lock
  • 5 High: MCP execute_tool 30s lock hold; MCP orphaned response poisoning; RAG json.loads crashes (6 locations); autosave Tkinter cross-thread access; Ollama ignoring user-selected model
  • 13 Medium: Thread safety (chat history, notifications, rate limiter), SOAP QA not running from Record tab, PHI logging bypass (8 locations), key file TOCTOU, Windows TTS breakage, connection leaks, animation crashes
  • 5 Low: DB instance leaks, silent exceptions, timer growth, dialog lifecycle

Key fixes

  • scratch_that voice command was dead code — tag_add() was never called after text insert
  • Ollama agents always used llama3 regardless of user selection — call_ollama() didn't accept a model parameter
  • SOAP QA / Medication QA panel never populated from Record tab — compare_medications was only wired in the Generate tab code path
  • MCP manager had 4 threading bugs: lock held during blocking I/O, sleep while holding lock, orphaned response poisoning, rate limiter blocking all servers
  • PHI logging bypassed structured logger sanitization via f-strings in 8 locations

Test plan

  • All 570+ targeted tests pass (0 failures from changes)
  • Syntax verification on all 30 modified files
  • Import smoke tests pass
  • No new ruff lint issues introduced
  • Manual: verify scratch_that voice command removes last chunk
  • Manual: verify Ollama agent uses selected model (not llama3)
  • Manual: verify Medication QA tab populates after Record tab SOAP generation

🤖 Generated with Claude Code

… QA, security

Critical:
- Fix scratch_that() completely broken (tags never applied to text chunks)
- Fix MCP HealthMonitor sleeping while holding lock (blocked all MCP ops 8s)

High:
- Fix MCP execute_tool holding lock during 30s blocking I/O
- Fix MCP send_request discarding orphaned responses (per-request queues)
- Fix unguarded json.loads in RAG vector stores (6 locations)
- Fix autosave reading Tkinter widgets from background thread
- Fix Ollama ignoring user-selected model in agent calls (always defaulted to llama3)

Medium:
- Fix SOAP QA/ICD validation not running via Record tab code path
- Fix conversation_history thread safety (add missing lock)
- Fix notification_manager: unsynchronized history, thread never stops, fade crashes
- Fix MCP rate limiter sleeping while holding lock
- Fix SQLiteCacheProvider leaking cross-thread connections
- Fix StreamingResults animation crash on widget destruction
- Fix PHI transcript/patient data logged in plaintext (bypass structured logger)
- Fix key file TOCTOU (written with default perms before chmod)
- Fix TTS NamedTemporaryFile breaking playback on Windows
- Fix periodic_analysis string join operator precedence

Low:
- Fix Database instance leaks in dialogs (add db= param + warning)
- Fix TTS _play_audio_async silently swallowing exceptions
- Fix help dialog, status timer, RSVP dialog lifecycle issues

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copy link
Copy Markdown

@greptile-apps greptile-apps Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

@cortexuvula cortexuvula merged commit f239c5a into main Mar 31, 2026
14 of 17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant