mirror of
https://github.com/pssah4/vault-operator.git
synced 2026-07-22 17:41:56 +00:00
58b76cb5ed
Adversarially re-verified the Codex audit: no High survived (H-1/H-2/H-3 downgraded to Low-Med / Med). All 12 findings captured as FIX rows and TDD-fixed, then hardened across three adversarial review rounds that each surfaced real residual bypasses in the first-pass fixes. Key changes: - Boundary defang is now reconstruction-safe: shared stripToFixpoint with a content.length bound (a constant cap was attacker-beatable), plus a final chokepoint defang in getSkillDirectorySection covering all three buildSkillDirectory assembly paths and cross-field reassembly. - attached_file/available_skills added to the boundary tag set; skill/MCP descriptions, inventory fields and code-module names sanitized. - H-1: source_interface 'obsilo' coerced to 'unknown' on read AND write handlers (getContext/recall/search + sync_session/save_to_memory). - H-2: session-tool write side effects (memory/index/episode/recipe) gated behind mcpAllowWriteTools; save_conversation forced to manual sync when off. - H-3: release/sync-public/deploy-pages use npm ci --ignore-scripts, pinned rollup@4.62.2, persist-credentials:false, SHA-pinned actions. - M-4 operation-log result token scrubbing; M-5 sandbox execId gate (fail closed on missing execId) + vaultMkdir rate-limit; M-7 shared httpBodyCap (WebFetch + SandboxBridge); M-8 esbuild version pin + no silent re-trust; M-9 adm-zip override >=0.5.18 <0.6.0. - FIX-01-04-03: dynamic ReDoS guard (worker_threads probe measuring runtime, fail-safe) wired into search_files; static blocklist hardened for the remaining sync sites. Suite 4808 passed + 1 expected fail, tsc clean, build 4.79 MB. Backlog rows Done/Built, 5 FIX detail files, FEAT-23-07 (per-connector token) and FIX-01-04-03 follow-up captured. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
109 lines
3.6 KiB
JSON
109 lines
3.6 KiB
JSON
{
|
|
"name": "vault-operator",
|
|
"version": "3.0.3",
|
|
"description": "Agentic AI operating layer for your vault. Discovers and uses installed plugins, maintains persistent unified memory, and adapts to your workflows, skills and tools with full safety controls.",
|
|
"main": "main.js",
|
|
"scripts": {
|
|
"dev": "node esbuild.config.mjs",
|
|
"build": "tsc -noEmit -skipLibCheck && node esbuild.config.mjs production",
|
|
"deploy": "npm run build && ./deploy-local.sh",
|
|
"version": "node version-bump.mjs && git add manifest.json versions.json",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"lint": "eslint src/",
|
|
"format": "prettier --write 'src/**/*.ts'",
|
|
"docs:dev": "vitepress dev docs",
|
|
"docs:build": "vitepress build docs",
|
|
"docs:gen-tools": "node scripts/generate-tools-reference.mjs",
|
|
"docs:preview": "vitepress preview docs",
|
|
"codeql:db": "codeql database create codeql-db --language=javascript --source-root=src/ --overwrite",
|
|
"codeql:analyze": "codeql database analyze codeql-db --format=sarif-latest --output=codeql-results.sarif codeql/javascript-queries:codeql-suites/javascript-security-and-quality.qls",
|
|
"codeql:scan": "npm run codeql:db && npm run codeql:analyze",
|
|
"verify:esbuild-hashes": "bash scripts/update-esbuild-integrity.sh"
|
|
},
|
|
"keywords": [
|
|
"obsidian",
|
|
"plugin",
|
|
"agent",
|
|
"ai",
|
|
"llm",
|
|
"mcp",
|
|
"knowledge-management"
|
|
],
|
|
"author": "Sebastian Hanke",
|
|
"license": "Apache-2.0",
|
|
"devDependencies": {
|
|
"@codemirror/state": "6.5.0",
|
|
"@codemirror/view": "6.38.6",
|
|
"@types/diff": "^7.0.2",
|
|
"@types/node": "^20.11.0",
|
|
"@typescript-eslint/eslint-plugin": "^8.56.1",
|
|
"@typescript-eslint/parser": "^8.56.1",
|
|
"@vitest/coverage-v8": "^4.1.9",
|
|
"dompurify": "^3.4.11",
|
|
"esbuild": "^0.28.1",
|
|
"eslint": "^9.39.3",
|
|
"eslint-plugin-no-unsanitized": "^4.1.5",
|
|
"eslint-plugin-obsidianmd": "^0.1.9",
|
|
"eslint-plugin-security": "^4.0.0",
|
|
"mermaid": "^11.15.0",
|
|
"obsidian": "^1.13.0",
|
|
"prettier": "^3.2.4",
|
|
"tslib": "2.6.2",
|
|
"typescript": "5.3.3",
|
|
"typescript-eslint": "^8.56.1",
|
|
"vite": "^6.4.3",
|
|
"vitepress": "^1.6.4",
|
|
"vitepress-plugin-mermaid": "^2.0.17",
|
|
"vitest": "^4.1.4"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/sdk": "^0.78.0",
|
|
"@aws-sdk/client-bedrock": "^3.1036.0",
|
|
"@aws-sdk/client-bedrock-runtime": "^3.1030.0",
|
|
"@aws-sdk/credential-providers": "^3.1030.0",
|
|
"@huggingface/transformers": "^4.0.0",
|
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
"@smithy/node-http-handler": "^4.0.0",
|
|
"delay": "^5.0.0",
|
|
"diff": "^5.1.0",
|
|
"docx": "^9.6.0",
|
|
"exceljs": "^4.4.0",
|
|
"fast-diff": "^1.3.0",
|
|
"graphology": "^0.26.0",
|
|
"graphology-communities-louvain": "^2.0.2",
|
|
"isomorphic-git": "^1.37.1",
|
|
"jszip": "^3.10.1",
|
|
"openai": "^5.23.2",
|
|
"p-wait-for": "^5.0.0",
|
|
"pdfjs-dist": "^4.4.168",
|
|
"pptxgenjs": "^4.0.1",
|
|
"serialize-error": "^11.0.0",
|
|
"sql.js": "^1.14.1"
|
|
},
|
|
"overrides": {
|
|
"fast-uri": ">=4.0.1",
|
|
"hono": ">=4.12.25",
|
|
"@hono/node-server": ">=1.19.10",
|
|
"express-rate-limit": ">=8.2.2",
|
|
"undici": ">=7.24.0",
|
|
"flatted": ">=3.4.2",
|
|
"path-to-regexp": ">=8.4.0",
|
|
"lodash-es": ">=4.18.0",
|
|
"brace-expansion": ">=2.0.3",
|
|
"vite": "$vite",
|
|
"protobufjs": ">=8.6.0",
|
|
"dompurify": "$dompurify",
|
|
"fast-xml-builder": ">=1.1.7",
|
|
"uuid": "^14.0.0",
|
|
"qs": ">=6.15.2",
|
|
"tmp": ">=0.2.6",
|
|
"js-yaml": ">=4.2.0",
|
|
"zod": ">=4.4.0",
|
|
"esbuild": "$esbuild",
|
|
"image-size": ">=2.0.2",
|
|
"minimatch": ">=10.0.3",
|
|
"glob": ">=10.4.5",
|
|
"adm-zip": ">=0.5.18 <0.6.0"
|
|
}
|
|
}
|