Parfii-bot d32ca0bc28 fix(v0.19): audit hardening — 3 security HIGH + 3 critic HIGH + 2 critic MEDIUM

Closes consolidated findings from wave-audit (critic + security + architect):

SECURITY HIGH:
  H1 path escape — Brain::load rejects absolute mcp_server paths +
    any containing '..'; canonicalize + starts_with(root) assertion;
    new Error::PathEscape variant.
  H2 brain name validation + clobber refuse — regex ^[a-z][a-z0-9_-]{0,63}$
    enforced at Brain::load; adapters refuse to overwrite existing
    mcpServers[name] with NameConflict (unless same content).
  H3 symlink reject at canonicalize — std::fs::symlink_metadata()
    called before canonicalize; Error::BrainIsSymlink with resolved
    target path; prevents USB → $HOME pivot.

CRITIC HIGH:
  #1 rusqlite dep deleted (zero uses in src/, pulls C toolchain).
  #3 BrainPaths memory/artifacts/manifests now Option<String>
    (only mcp_server required; schema no longer lies about contract).

CRITIC MEDIUM:
  #1 _primitives/_rust/keisei/src/paths.rs (new, 23 LOC) — SSoT for
    $KEISEI_HOME/$HOME resolver; config.rs and claude_code.rs
    delegate instead of duplicating 7-line block.
  #2 canonicalize error preserves io::Error via new Error::BrainLoad
    { path, source } with #[source] attribute.
  #5 fsx::write_atomic_json rewrite via tempfile::NamedTempFile
    + persist — Windows-safe, cross-fs-fallback handling.

New module split (Constructor Pattern): brain.rs (104 → 122) now a
thin orchestrator over brain_validate.rs (108 LOC) which owns
symlink-reject / canonicalize-root / read-manifest / validate-schema
/ validate-name / check-relative-in-root / canonicalize-in-root.

Deps: regex = { workspace = true }, tempfile = "3" (runtime).
Workspace-level regex = "1.10" added.
MANIFEST.toml [primitive.keisei] deps updated.

Tests: 11 pre-existing + 5 adversarial:
  - manifest_with_absolute_mcp_server_rejected — proves /usr/bin/python3
    CANNOT land in settings.json (PathEscape + marker absent asserts)
  - manifest_with_parent_traversal_rejected — ../../etc/passwd rejected
  - manifest_with_invalid_name_rejected — 'claude-ide!' rejected
  - brain_path_is_symlink_rejected — USB → $HOME pivot blocked
  - attach_refuses_to_clobber_existing_mcp_entry — NameConflict on diff

All 16 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-22 16:36:11 +08:00

9.2 KiB

Raw Blame History

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Entries are generated from the git history via _primitives/_rust/kei-changelog (a conventional-commits walker). Regenerate a single version block with, e.g.:

_primitives/_rust/target/release/kei-changelog \
  --from v0.14.2 --to v0.15.0 --version v0.15.0 --update CHANGELOG.md

Unreleased

Work in flight on feat/v0.16-changelog-gen and follow-up branches. Only placeholders — no corresponding commits exist yet. Any line that ships must be replaced with the real commit summary before release.

Added

primitives: keisei CLI MVP — attach <brain-path> + status subcommands for mounting a portable exobrain directory into Claude Code. First step of the v0.18 exobrain architecture (multi-client adapter surface prepared; only claude-code adapter ships in MVP).
primitives (v0.19 — multi-client exobrain):
- keisei mount <brain-path> — attach a brain to EVERY detected AI client in one shot (Claude Code + Cursor + Continue + Zed).
- keisei detach — remove the brain from every client recorded in the marker, preserving user's other MCP/context-server entries.
- keisei list-adapters — tabular dump of every registered adapter and whether it's detected on this host.
- 3 new ClientAdapter implementations: cursor (.cursor/mcp.json project-local or ~/.cursor/mcp.json global), continue (~/.continue/config.{yaml,json} — YAML preferred, JSON fallback), zed (~/Library/Application Support/Zed/settings.json on macOS or ~/.config/zed/settings.json on Linux, under context_servers).
- keisei-attached.toml schema v2 — carries a list of [[attachments]] (client_type + config_path) instead of a single client_type. v1 markers read transparently (auto-migrated in memory).
- New error variants: AdapterFailed { client, reason } and ConfigParseError { path, reason }.
Placeholder: CHANGELOG.md generation wired through kei-changelog (this file).
Placeholder: .github/workflows/release.yml — tag-driven multi-platform release.
Placeholder: pre-built-binary install path in install.sh (KEI_SKIP_RUST_BUILD=1).
added: kei-mcp-server single-binary compile for 5 platforms (linux/darwin/windows × x64/arm64 where available) via bun build --compile — v0.18 Phase 1 of the exobrain distribution architecture. Ships as bare binaries + .sha256 sums on every GitHub release; install.sh detects a dropped binary at _primitives/_rust/target/release/kei-mcp-server-<os>-<arch> and skips bun/npm build. Opt-out via KEI_SKIP_MCP_BUILD=1. See _ts_packages/packages/mcp-server/BUILD.md.

Changed

Placeholder: plugin / block format refresh targeted for v0.16.0.

Fixed

Placeholder: hook-bypass edge case follow-up to v0.15.1.
primitives/keisei (v0.19 audit hardening): close 3 Security HIGH + 3 Critic HIGH + 2 Critic MEDIUM findings. Path-escape guard on mcp_server + memory/artifacts/manifests (absolute / .. / canonical-mismatch → PathEscape); brain-name regex ^[a-z][a-z0-9_-]{0,63}$ (InvalidName); symlink-rooted brain inputs rejected (BrainIsSymlink — closes USB → $HOME pivot); MCP-entry collision check across all 4 adapters (NameConflict instead of silent clobber); dropped unused rusqlite dep (no C toolchain tail); BrainPaths.{memory,artifacts,manifests} relaxed to Option<String>; $KEISEI_HOME/$HOME resolver deduped into paths.rs SSoT; fsx::write_atomic rewritten on tempfile::NamedTempFile for Windows + cross-fs correctness; 5 adversarial integration tests added (16 total pass).

0.15.0 — 2026-04-22

Added

primitives: kei-artifact typed handoff pipeline (BMAD-style doc passthrough) (3f303b7)
blocks: 5 cognitive mode blocks + 2 manifest wirings (fdfc690)

0.14.2 — 2026-04-22

Added

hooks: runtime controls via KEI_DISABLED_HOOKS + KEI_HOOK_PROFILE (v0.14.2) (1a448e8)

Removed

genesis-scan from public kit (internal tool, Bundle-only) (268226b)

0.14.1 — 2026-04-22

Added

ci: GitHub Actions workflows + .claude/worktrees gitignore (407e8b7)

Changed

readme + install: reconcile all count drift (F4 RELEASE BLOCKER) (0199fd4)
rust: misc schema/main refactor in 8 crates (assorted CP splits) (61448b9)
mock-render: split main.rs 227 LOC into 4 cubes (F5a Constructor Pattern) (ad5977d)

Fixed

kei-auth: remove --key CLI flag (F12 HIGH — /proc/cmdline leak) (b449587)
kei-refactor-engine: retract 'git apply-ready' claim (F1 RELEASE BLOCKER) (f50ef43)
kei-store: path-traversal guard (F2 RELEASE BLOCKER) + S3 stub gate (F7) + GitHub RULE 0.1 guard (F8) (ad9c53f)

0.14.0 — 2026-04-22

Added

primitives: 10 Rust crates extracted from LBM (Genesis-scrubbed) (a5e6649)
ts-packages: 6 TS packages — MCP server + 5 external-API adapters (7b647d5)

Changed

rust-core: Constructor-Pattern splits in kei-router + kei-auth (afed921)

0.13.0 — 2026-04-22

Added

integration: deep-sleep wired into MANIFEST + sleep-setup Phase 3b + README (bcd80f6)
primitives: 4 Rust crates for deep-sleep — conflict-scan, refactor-engine, graph-check, store (0f75493)
skills: /onboard auto-project-analyze with 3-mode apply (full-auto / step-by-step / full-manual) (1396139)

Changed

readme: "Why Rust, not Python" paragraph in author note (92c918a)
readme: clarify "my sample, not claim of originality" in author note (47d2448)
readme: add "double sorry" disclaimer in author note (3d5d768)
readme: move "From the author" to opening, expand with transformer-error context (fd67315)
readme: add "From the author" note (b103c3d)

0.12.0 — 2026-04-22

Added

integration: Phase A incubation wired into trigger + install + README (d72de64)
skills: /sleep-on-it 6-phase wizard + kei-sleep-queue CRUD + incubation prompt (30df6cb)

0.11.0 — 2026-04-22

Added

integration: --with-sleep-sync flag + README Cloud REM sync section (1dd05c6)
skills: /sleep-setup 5-phase wizard (click + 1 free-text URL) (b658f81)
hooks: session-end-dump calls kei-sleep-sync after ingest (1ab39d5)
primitives: kei-sleep-setup wizard + kei-sleep-sync helper + trigger template (4fdaab6)

0.10.0 — 2026-04-22

Added

integration: register genesis-scan in MANIFEST core+full + README + install.sh sizing (93ba0a0)
hooks: git-pre-commit-genesis — template for repo symlink into .git/hooks/pre-commit (670af3f)
primitives: genesis-scan Rust — patent-IP leak detector (CI / pre-commit) (5db8548)
integration: wire kei-memory into MANIFEST + settings-snippet + README for v0.10 (0b5da5a)
skills: /self-audit 5-phase triage pipeline (334a867)
hooks: 3 self-audit triggers — stop / milestone / error-spike (a5c3896)
primitives: kei-memory Rust crate — offline session analyzer (Genesis-clean) (448fc07)

0.9.1 — 2026-04-21

Added

install: interactive menu (whiptail / dialog / plain) + confirm screen + --yes / --no-execute (4809269)

0.9.0 — 2026-04-21

Added

install: modular profiles + --add / --remove / --list incremental install (b1b8de0)
primitives: MANIFEST.toml — SSoT for 21 primitives + 6 profiles (764a999)

Changed

readme: install profiles table + migration note for v0.9.0 (47931a3)

BREAKING: default install profile is now minimal (was full). Re-run with --profile=full to preserve prior behaviour.

0.8.0 — 2026-04-21

Added

install: copy _primitives/ + build Rust workspace; register agent-fork-logger + site-wysiwyd hooks (b0d9389)
hooks: site-wysiwyd-check PostToolUse(Edit | Write) drift advisory (c2041b4)
skills: /site-create pipeline (phases 0–4 — phases 5–6 deferred) (839ae57)

Changed

compose-solution: prior-art grep paths + phase-5 cross-refs for 10 pipelines + 21 primitives (f664cbc)
readme: v0.8.0 — 73 blocks / 34 skills / 21 primitives / 6 hooks / 11 bridges + pipelines section (ed7d566)

9.2 KiB Raw Blame History Unescape Escape

Changelog

Unreleased

Added

Changed

Fixed

0.15.0 — 2026-04-22

Added

0.14.2 — 2026-04-22

Added

Removed

0.14.1 — 2026-04-22

Added

Changed

Fixed

0.14.0 — 2026-04-22

Added

Changed

0.13.0 — 2026-04-22

Added

Changed

0.12.0 — 2026-04-22

Added

0.11.0 — 2026-04-22

Added

0.10.0 — 2026-04-22

Added

0.9.1 — 2026-04-21

Added

0.9.0 — 2026-04-21

Added

Changed

0.8.0 — 2026-04-21

Added

Changed

9.2 KiB

Raw Blame History