Commit graph

5 commits

Author SHA1 Message Date
Parfii-bot
d09dc5b142 chore(v0.19.1): replace placeholder bun.lock with real lockfile + fix workspace path
bun is a monorepo tool — lockfile lives at workspace root
(_ts_packages/bun.lock), not per-subpackage. Placeholder at
_ts_packages/packages/mcp-server/bun.lock was the wrong path.

Changes:
  - Generated real _ts_packages/bun.lock (626 lines) via 'bun install'
    (bun 1.3.13, auto-migrated from package-lock.json)
  - .github/workflows/release.yml working-directory:
    _ts_packages/packages/mcp-server → _ts_packages (workspace root)
  - BUILD.md Lockfile section rewritten to document workspace-root
    location + coexistence with package-lock.json (L2 audit finding
    partially resolved — full consolidation deferred to v0.20)

release.yml build-mcp-binary job now has real lockfile to consume —
H4 'tag build fails on missing lockfile' gate still active but now
there's something actually committed to satisfy it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 17:16:57 +08:00
Parfii-bot
ca046e61c1 fix(v0.19.1): supply-chain hardening remainder — ci.yml SHA-pin + dependabot + bun.lock placeholder
Follow-up to c27b626 (release.yml pinning). Finishes H4 + H5.

ci.yml:
  - 11 third-party actions SHA-pinned with # vN.m.k comments
  - actions/checkout@34e114876b... (v4.3.1)
  - actions/setup-node@49933ea5288... (v4.4.0)
  - dtolnay/rust-toolchain@3c5f7ea28... (rust 1.94.1)
  - Swatinem/rust-cache@c19371144... (v2.9.1)

.github/dependabot.yml (NEW):
  - 3 ecosystems weekly: github-actions, npm, cargo
  - PR cap 5, labels [dependencies, <ecosystem>]
  - Auto-opens update PRs for SHA bumps — human reviews, not silent churn

_ts_packages/packages/mcp-server/bun.lock (NEW — placeholder):
  - 13-line comment explaining H4 gate
  - Instructs: 'cd _ts_packages/packages/mcp-server && bun install' before release
  - release.yml (since v0.19.1) uses --frozen-lockfile with NO fallback —
    missing real lockfile fails the build deliberately

BUILD.md:
  - New 'Lockfile' section (19 LOC) documenting the pre-release workflow

CHANGELOG.md:
  - [Unreleased] → Security: 3 bullets covering this + prior supply-chain commit

All SHAs E1 (verified via api.github.com or reused from release.yml).

NEXT STEP BEFORE TAGGING v0.19.1:
  Populate real bun.lock locally, commit, then tag. Workflow will fail
  on missing/stale lockfile — that's the point of H4 defense.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 17:12:15 +08:00
Parfii-bot
e67ade47c8 feat(v0.18): kei-mcp-server single-binary compile — 5-platform via bun
Phase 1 of exobrain architecture. Ships TS MCP server as a static
binary so users on machines without Node can run KeiSeiKit (USB /
flashdrive / air-gapped scenarios).

.github/workflows/release.yml (+62 LOC) — new build-mcp-binary job:
  - 5-target matrix: darwin arm64/x64, linux arm64/x64, windows x64
  - bun build --compile, linux arm64 continue-on-error (ARM runners
    less reliable)
  - Artifact kei-mcp-server-<os>-<arch>[.exe] + sha256
  - release job now needs [build-release, build-mcp-binary]

install/lib-rust.sh (+50 LOC) — have_prebuilt_mcp_server() +
  report_mcp_server_binary_status(); KEI_SKIP_MCP_BUILD=1 env
  flag skips bun/npm install when a prebuilt binary is present.
  File 165 LOC (<200 limit).

_ts_packages/packages/mcp-server/package.json — scripts.build:native
  + 5 per-target aliases (macos-arm, macos-x64, linux-x64,
  linux-arm, win-x64) for local dev.

_ts_packages/packages/mcp-server/BUILD.md (NEW, 52 LOC) — local
  compile guide per platform + Gatekeeper/code-sign notes +
  cites bun docs [VERIFIED: https://bun.sh/docs/bundler/executables].

README.md pre-built-binaries section gains 'MCP server binary'
subsection (download, chmod +x, xattr -d com.apple.quarantine for
macOS, UAC note for Windows).

CHANGELOG.md [Unreleased] bullet added.

Output size: ~90 MB per binary (bundled bun runtime). Acceptable
trade for zero-dep USB distribution.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 15:52:36 +08:00
Parfii-bot
24c584ee50 fix: remove genesis-scan from public kit (internal tool, Bundle-only)
Per user decision: publishing the sensitive IP pattern blocklist via public
scanner is leak of the blocklist itself (attack surface). genesis-scan
remains in PROJECT-E (private); user-global
~/.claude/hooks/genesis-leak-guard.sh (runtime hook) separate.

Deleted:
- _primitives/_rust/genesis-scan/ (whole crate, 5 files)
- hooks/git-pre-commit-genesis.sh (scanner companion)

Modified:
- workspace Cargo.toml -1 member (24→23)
- MANIFEST.toml — removed [primitive.genesis-scan] + core/full profile refs
- .github/workflows/ci.yml — removed genesis-scan job
- README.md — 7 count/description edits (24→23 rust, 10→9 hooks, 37→36 full)
- install.sh — 5 edits (--help + menus)
- mcp-server tool-registry.ts + test — scanner removed from MCP surface
- kei-sleep-queue.sh — removed scan_prompt() pre-submit hook
- 2 sleep-on-it skill phases — removed genesis-scan references

Tests: 160 Rust (was 167, -7 genesis-scan tests as expected), 24 assembler unchanged.
2026-04-22 14:11:22 +08:00
Parfii-bot
c21943e40b feat(ts-packages): 6 TS packages — MCP server + 5 external-API adapters
Total 1465 LOC + 616 test LOC, 78/78 tests pass.
- @keisei/mcp-server (25 tests) — Rust-CLI bridge via execa, stdio+HTTP, HMAC auth, kei() meta-tool
- @keisei/telegram-adapter (16 tests) — grammy Bot, 7 tools
- @keisei/recall-adapter (8 tests) — Zoom via Recall.ai, 5 tools
- @keisei/grok-adapter (6 tests) — xAI OpenAI-compatible, 2 tools
- @keisei/gmail-adapter (11 tests) — googleapis OAuth2, 6 tools (new — LBM gap)
- @keisei/youtube-adapter (12 tests) — YouTube Data API v3, 5 tools (new — LBM gap)

RULE 0.2 exception #4 (TS for MCP/API layer documented in _ts_packages/README.md).
RULE 0.8 — env vars only (TELEGRAM_BOT_TOKEN, XAI_API_KEY, GMAIL_*, YOUTUBE_API_KEY).
Strict TypeScript: strict + exactOptionalPropertyTypes + noUncheckedIndexedAccess.
Genesis-scan clean (0 hits).
2026-04-22 12:45:19 +08:00