990f5e3711
Extracts authoritative atom discovery + frontmatter parsing into new crate _primitives/_rust/kei-atom-discovery/. kei-sage and kei-runtime now both consume the same implementation, eliminating Frontmatter drift. Resolved findings: - F-3/crit#3: path traversal via md_dir.join() — safe_join helper rejects absolute paths + .. components + post-canonicalise escapes (4 sites) - crit#6/architect P0-a: Frontmatter drift — single AtomMeta struct - SA supply-chain: serde_yaml archived — migrated to serde_yaml_ng 0.10 - crit#2: JSON Schema $ref SSRF — jsonschema 0.17→0.18 with resolve-file feature only, custom LocalFileResolver denies non-file:// schemes - F-4: symlink traversal — walkdir follow_links(false) explicit everywhere - F-5: YAML billion-laughs — 64 KiB pre-parse cap Tests: 9/9 new crate + 23/23 sage + 2/2 runtime + 7/7 kei-task = 41/41 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
57 lines
1.3 KiB
TOML
57 lines
1.3 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"kei-ledger",
|
|
"kei-migrate",
|
|
"kei-changelog",
|
|
"ssh-check",
|
|
"firewall-diff",
|
|
"mock-render",
|
|
"visual-diff",
|
|
"tokens-sync",
|
|
"kei-memory",
|
|
"kei-conflict-scan",
|
|
"kei-refactor-engine",
|
|
"kei-graph-check",
|
|
"kei-store",
|
|
# v0.14 LBM port — 10 new MCP-core primitives
|
|
"kei-router",
|
|
"kei-sage",
|
|
"kei-task",
|
|
"kei-chat-store",
|
|
"kei-crossdomain",
|
|
"kei-search-core",
|
|
"kei-content-store",
|
|
"kei-social-store",
|
|
"kei-curator",
|
|
"kei-auth",
|
|
# v0.15 artifact handoff pipeline
|
|
"kei-artifact",
|
|
# v0.18 exobrain CLI
|
|
"keisei",
|
|
# v1 substrate — local web wizard for scaffolding atoms (Stream A)
|
|
"kei-forge",
|
|
# v1 substrate — atom invocation runtime + schema linter (Stream D)
|
|
"kei-runtime",
|
|
# v1 substrate — shared atom discovery + frontmatter + safe path (Stream E)
|
|
"kei-atom-discovery",
|
|
]
|
|
|
|
[workspace.package]
|
|
edition = "2021"
|
|
rust-version = "1.75"
|
|
|
|
[workspace.dependencies]
|
|
clap = { version = "4", features = ["derive"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yaml = "0.9"
|
|
sha2 = "0.10"
|
|
image = { version = "0.25", default-features = false, features = ["png"] }
|
|
regex = "1.10"
|
|
|
|
[profile.release]
|
|
opt-level = "z"
|
|
lto = true
|
|
strip = true
|
|
codegen-units = 1
|