fix: refine security validation messaging

Agent-Logs-Url: https://github.com/MemPalace/mempalace/sessions/775f2fc4-3051-462e-8586-6d694b55da0d

Co-authored-by: igorls <4753812+igorls@users.noreply.github.com>

mempalace/cli.py

@@ -228,8 +228,7 @@ def cmd_repair(args):
     if os.path.exists(backup_path):
         if not contains_palace_database(backup_path):
             print(
-                "  Cannot proceed: backup path exists but does not contain a valid palace backup "
+                "  Cannot proceed: backup path exists but does not contain chroma.sqlite3. "
-                "(expected chroma.sqlite3). "
                 f"Please remove or rename: {backup_path}"
             )
             return

mempalace/migrate.py

@@ -109,12 +109,14 @@ def contains_palace_database(path: str) -> bool:
     return os.path.isfile(os.path.join(path, "chroma.sqlite3"))
 
 
-def confirm_destructive_action(action: str, palace_path: str, assume_yes: bool = False) -> bool:
+def confirm_destructive_action(
+    operation_name: str, palace_path: str, assume_yes: bool = False
+) -> bool:
     """Require confirmation before destructive palace operations."""
     if assume_yes:
         return True
 
-    print(f"\n  {action} will replace data in: {palace_path}")
+    print(f"\n  {operation_name} will replace data in: {palace_path}")
     print("  A backup will be created first, but the original directory will be deleted.")
     try:
         answer = input("  Continue? [y/N]: ").strip().lower()

mempalace/query_sanitizer.py

@@ -69,11 +69,11 @@ def sanitize_query(raw_query: str) -> dict:
 
     def _strip_wrapping_quotes(candidate: str) -> str:
         candidate = candidate.strip()
-        while candidate[:1] in {"'", '"'} or candidate[-1:] in {"'", '"'}:
+        while candidate[:1] in {"'", '"'} and candidate[-1:] in {"'", '"'}:
             candidate = candidate.strip("\"'")
             if not candidate:
                 return ""
-        return candidate
+        return candidate.strip("\"'")
 
     def _trim_candidate(candidate: str) -> str:
         candidate = _strip_wrapping_quotes(candidate)