990f5e3711
Extracts authoritative atom discovery + frontmatter parsing into new crate _primitives/_rust/kei-atom-discovery/. kei-sage and kei-runtime now both consume the same implementation, eliminating Frontmatter drift. Resolved findings: - F-3/crit#3: path traversal via md_dir.join() — safe_join helper rejects absolute paths + .. components + post-canonicalise escapes (4 sites) - crit#6/architect P0-a: Frontmatter drift — single AtomMeta struct - SA supply-chain: serde_yaml archived — migrated to serde_yaml_ng 0.10 - crit#2: JSON Schema $ref SSRF — jsonschema 0.17→0.18 with resolve-file feature only, custom LocalFileResolver denies non-file:// schemes - F-4: symlink traversal — walkdir follow_links(false) explicit everywhere - F-5: YAML billion-laughs — 64 KiB pre-parse cap Tests: 9/9 new crate + 23/23 sage + 2/2 runtime + 7/7 kei-task = 41/41 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
26 lines
636 B
TOML
26 lines
636 B
TOML
[package]
|
|
name = "kei-sage"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
rust-version = "1.75"
|
|
description = "Obsidian-style knowledge graph (SQLite + FTS5). Port of LBM internal/sage."
|
|
|
|
[[bin]]
|
|
name = "kei-sage"
|
|
path = "src/main.rs"
|
|
|
|
[lib]
|
|
name = "kei_sage"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
rusqlite = { version = "0.31", features = ["bundled"] }
|
|
clap = { version = "4", features = ["derive"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
anyhow = "1"
|
|
chrono = { version = "0.4", default-features = false, features = ["clock"] }
|
|
kei-atom-discovery = { path = "../kei-atom-discovery" }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|