990f5e3711
Extracts authoritative atom discovery + frontmatter parsing into new crate _primitives/_rust/kei-atom-discovery/. kei-sage and kei-runtime now both consume the same implementation, eliminating Frontmatter drift. Resolved findings: - F-3/crit#3: path traversal via md_dir.join() — safe_join helper rejects absolute paths + .. components + post-canonicalise escapes (4 sites) - crit#6/architect P0-a: Frontmatter drift — single AtomMeta struct - SA supply-chain: serde_yaml archived — migrated to serde_yaml_ng 0.10 - crit#2: JSON Schema $ref SSRF — jsonschema 0.17→0.18 with resolve-file feature only, custom LocalFileResolver denies non-file:// schemes - F-4: symlink traversal — walkdir follow_links(false) explicit everywhere - F-5: YAML billion-laughs — 64 KiB pre-parse cap Tests: 9/9 new crate + 23/23 sage + 2/2 runtime + 7/7 kei-task = 41/41 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
23 lines
501 B
TOML
23 lines
501 B
TOML
[package]
|
|
name = "kei-atom-discovery"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
rust-version = "1.75"
|
|
description = "Shared atom discovery + frontmatter parsing + safe path join"
|
|
|
|
[lib]
|
|
name = "kei_atom_discovery"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_yaml_ng = "0.10"
|
|
walkdir = "2"
|
|
thiserror = "1"
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
[package.metadata.keisei]
|
|
backend = "none"
|
|
description = "Shared atom discovery + frontmatter parsing + safe path join"
|