keisei/KeiSeiKit-1.0
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
KeiSeiKit-1.0/_primitives/_rust
History
Parfii-bot f12eb9f83c fix(v0.21.1): wave-audit consolidated — 5 critic HIGH + 2 security HIGH + 3 polish 
Closes 10 audit findings from 4-agent wave (critic + security +
architect + validator) on v0.21.0.

CRITIC HIGH (5):
  H1 s3_cloud::commit() was listing with delimiter='/' — nested
     writes silently dropped from manifest hash. Added
     list_recursive() (no delimiter), filter manifest-*.json from
     hash input.
  H2 S3Cfg access_key_env + secret_key_env were advertised in TOML
     but never read. Wired via resolve_explicit_creds() with
     aws-credential-types. Partial-set or empty-resolve → error.
  H3 display::sanitize_display missing in detach.rs + mount.rs
     (regression of v0.19.2 L9 ANSI injection fix). Applied at 8
     print sites. 2 new integration tests.
  H4 adapters/jsonmcp.rs RESTORED (was lost in earlier merge).
     107 LOC shared module: load_json_or_empty / upsert_under_key /
     remove_under_key / persist. claude_code 163→105, cursor 165→106,
     zed 178→114. Unified error handling via ConfigParseError.
  H5 ENV_LOCK shared across kei-store tests. New test_env.rs (24 LOC)
     exposed under cfg(any(test, feature='s3')). github.rs +
     s3_cloud/tests.rs + s3_smoke.rs all use shared mutex. Fixes
     parallel-test race on KEI_STORE_S3_ENDPOINT.

SECURITY HIGH (2):
  SEC-H1 scripts/install-actionlint.sh — added sha256 verify
     (shasum/sha256sum) before extract. ACTIONLINT_SHA256_OVERRIDE
     env var for CI injection. Per-platform constants marked
     [UNVERIFIED: SKIP] pending live checksums.txt fetch (agent had
     no WebFetch this session — user follow-up: paste from
     https://github.com/rhysd/actionlint/releases/download/v1.7.12/checksums.txt).
  SEC-H2 S3 SSRF/IMDS guard. validate_endpoint() rejects:
     loopback (127/8, ::1, localhost), link-local (169.254/16,
     fe80::/10), metadata hostnames (google/azure). Override via
     KEI_STORE_S3_ALLOW_INTERNAL=1. HTTP rejected unless
     KEI_STORE_S3_ALLOW_INSECURE=1. Custom endpoint now REQUIRES
     explicit creds (no IMDS chain leak via third-party endpoint).
     4 reject + 3 accept tests pass.

POLISH (3):
  D1 docs/USB-BRAIN-GUIDE.md — ⚠️ WARNING block under Prerequisites:
     exFAT/FAT32 NOT safe for multi-client attach (SQLite WAL needs
     shared-mem mmap). Use ONE client at a time on those FSes.
     New Troubleshooting entry 'SQLite corruption on mount-attach'.
  D2 '~5 MB release binary growth' now labelled [estimate, E5 —
     not yet measured] in CHANGELOG.md + s3_cloud/mod.rs header.
  D3 scripts/validate-workflow-shas.sh exits 2 (not 0) when
     UNVERIFIED_COUNT > 0 and GITHUB_TOKEN absent. Distinguishes
     'network denied' from 'all good'.

REAL VERIFICATION (pasted by agent):
  cargo check -p keisei -p kei-store: Finished (clean)
  cargo test -p keisei --release: 30 passed 0 failed
  cargo test -p kei-store --release: 10 + 9 passed (default features)
  cargo test -p kei-store --features s3 --release:
    31 + 9 + 6 = 46 passed (with s3)
  bash -n scripts/*.sh: OK
  regen-counts.sh --check: no drift

Constructor Pattern: largest new src 200 LOC (s3_cloud/mod.rs, at
limit). jsonmcp.rs 107 LOC. test_env.rs 24 LOC.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 20:03:17 +08:00
..
firewall-diff feat(primitives): 2 Rust verification cubes 2026-04-21 21:00:01 +08:00
kei-artifact Merge feat/v0.16.1-polish — dynamic schema + mode matrix Phase 3.6 2026-04-22 15:13:05 +08:00
kei-auth fix(kei-auth): remove --key CLI flag (F12 HIGH — /proc/cmdline leak) 2026-04-22 13:36:17 +08:00
kei-changelog feat(primitives): kei-docs-scaffold shell + kei-changelog Rust 2026-04-21 21:01:28 +08:00
kei-chat-store chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-conflict-scan feat(primitives): 4 Rust crates for deep-sleep — conflict-scan, refactor-engine, graph-check, store 2026-04-22 08:28:22 +08:00
kei-content-store chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-crossdomain chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-curator chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-graph-check feat(primitives): 4 Rust crates for deep-sleep — conflict-scan, refactor-engine, graph-check, store 2026-04-22 08:28:22 +08:00
kei-ledger feat(primitives): kei-ledger Rust SQLite agent ledger 2026-04-21 20:52:20 +08:00
kei-memory feat(primitives): kei-memory Rust crate — offline session analyzer (Genesis-clean) 2026-04-22 00:50:04 +08:00
kei-migrate feat(primitives): kei-migrate Rust universal migration runner 2026-04-21 20:35:29 +08:00
kei-refactor-engine fix(kei-refactor-engine): retract 'git apply-ready' claim (F1 RELEASE BLOCKER) 2026-04-22 13:36:17 +08:00
kei-router chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-sage chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-search-core chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-social-store chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
kei-store fix(v0.21.1): wave-audit consolidated — 5 critic HIGH + 2 security HIGH + 3 polish 2026-04-22 20:03:17 +08:00
kei-task chore(rust): misc schema/main refactor in 8 crates (assorted CP splits) 2026-04-22 13:36:17 +08:00
keisei fix(v0.21.1): wave-audit consolidated — 5 critic HIGH + 2 security HIGH + 3 polish 2026-04-22 20:03:17 +08:00
mock-render refactor(mock-render): split main.rs 227 LOC into 4 cubes (F5a Constructor Pattern) 2026-04-22 13:36:17 +08:00
ssh-check feat(primitives): 2 Rust verification cubes 2026-04-21 21:00:01 +08:00
tokens-sync feat(primitives): 3 Rust cubes — mock-render, visual-diff, tokens-sync 2026-04-21 21:07:45 +08:00
visual-diff feat(primitives): 3 Rust cubes — mock-render, visual-diff, tokens-sync 2026-04-21 21:07:45 +08:00
.gitignore feat(primitives): 2 Rust verification cubes 2026-04-21 21:00:01 +08:00
Cargo.lock feat(v0.21): kei-store real S3 backend behind opt-in 's3' feature flag 2026-04-22 17:59:11 +08:00
Cargo.toml fix(v0.19): audit hardening — 3 security HIGH + 3 critic HIGH + 2 critic MEDIUM 2026-04-22 16:36:11 +08:00