fix: security, data safety, and stability fixes (#973-#980)

[ajianaz]

What

Fixes 8 validated bugs from cora re-scan across 3 priority tiers: security (P4), data safety (P5), and stability (P6).

Why

Cora re-scan found 167 findings. After validation, 10 GitHub issues were created (#973-#982). This PR addresses 8 of them — the 2 remaining (#981 CLI JSON, #982 Windows vector race) are lower priority and deferred.

Changes

P4 — Security (#973)

• uteke-status/index.ts: execSync -> execFileSync("sqlite3", [dbPath, sql]) — prevents shell injection via paths
• pi-memory-provider/index.ts: execSync -> execFileSync(bin, args) — prevents shell injection, removed manual double-quoting

P5 — Data Safety

• 🔴 CRITICAL: aging cleanup_aged missing pinned filter → data loss #974 aging.rs: Added AND pinned = 0 to cleanup_aged DELETE — pinned memories were being deleted
• FTA5 search reads rank from wrong column index (importance instead of rank) #975 fts5.rs: Changed row.get(14) -> row.get(19) for f.rank (4 locations) — was reading importance column instead of rank
• Pinned memory importance always 0.0 in recompute_importance formula #976 store.rs: Changed 0.2 * 0.0 -> 0.2 * if m.pinned { 1.0 } else { 0.0 } — pinned bonus was always zero
• update() and update_fields() lack transaction for memory + tags dual-write #977 crud.rs: Wrapped update() and update_fields() in unchecked_transaction() — atomic memory + tags write

P6 — Stability

• UTF-8 panic: String slicing at fixed byte offsets in 8+ locations #978 lib.rs + room.rs: Added safe_truncate() helper, replaced 3 unsafe &str[..N] slicing — prevents UTF-8 panic on multi-byte content
• VectorIndex::build() infers dimensions from first item without validation #979 vector.rs: build() validates all items have consistent dimensions before insert — prevents index corruption
• install.ps1 checksum mismatch does not stop installation #980 install.ps1: Added exit 1 after checksum mismatch — was printing error then continuing

Testing

• cargo fmt --all pass
• cargo clippy --workspace --all-targets — 0 warnings
• cargo test --workspace — 476 passed, 0 failed, 26 ignored
• Pre-commit hooks: fmt + clippy + cora review all passed

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (3)

• crates/uteke-core/src/memory/crud.rs:275 — In the update method, unchecked_transaction() is used to wrap multiple writes. However, if any tx.execute() call fails, the function returns immediately via ? without calling tx.rollback(). While the Transaction drop implementation will attempt to roll back automatically, relying on this for unchecked_transaction is risky and explicit rollback is preferred for robust error handling. The same pattern exists in the update_fields method around line 380.
• crates/uteke-core/src/memory/fts5.rs:119 — The rank column index was changed from 14 to 19 across all FTS5 search queries. This implies the SELECT statement now returns 5 additional columns before the rank column. If the underlying SQL query was not updated to match this new index (e.g., by adding columns or changing the row_to_memory mapping), this will cause a runtime error or read incorrect data as row.get(19) will fetch the wrong column.
• install.ps1:117 — The diff adds exit 1 after the checksum mismatch error message. However, examining the surrounding code, if this is inside a function (e.g., Install-Uteke), exit 1 will terminate the entire PowerShell process. If the intent was to abort just the installation or return an error to the caller, return or throw would be more appropriate. Using exit in a sourced script or function can have unintended side effects.

Correction: Upon closer inspection, the addition of exit 1 is actually the FIX. The original code printed an error message but did NOT exit, meaning it would proceed to install the compromised/corrupted archive. This is a critical bug fix.

Re-evaluation: This is actually a good fix. No issue.

---

Review powered by cora-code · BYOK · MIT