chore: release v0.13.1 to main - #989
Merged
Merged
Conversation
* ci(cla): add CLA check workflow Calls org-level reusable workflow from codecoradev/.github. Every PR will now be checked for CLA signature. Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * ci: re-trigger CLA check (org workflow now merged) Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): add permissions to CLA check caller workflow Reusable workflow needs explicit permissions grant from caller. Without it, GitHub Actions silently fails (0s, no log). Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): inline CLA check workflow (drop reusable dependency) Reusable workflow path with .github repo caused YAML validation failure (0s, no jobs). Switching to self-contained inline workflow that fetches signatures.json from org repo via raw.githubusercontent. Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * ci: re-trigger CLA check (CDN cache cleared) Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): use GitHub API for signatures (raw CDN unreliable) raw.githubusercontent.com returns HTTP 200 with '404: Not Found' body instead of proper HTTP 404, breaking curl -f flag. Switching to gh api which properly resolves content via GitHub REST API. Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): use public REST API for signatures fetch GITHUB_TOKEN is repo-scoped — cannot access codecoradev/.github. Switching to unauthenticated public REST API endpoint (60 req/hr limit is fine for PR-triggered workflow). Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): use actions/checkout for signatures fetch All CDN/API approaches failed for cross-repo access. actions/checkout with sparse-checkout clones .cla/ folder from codecoradev/.github via git protocol — bulletproof. Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): use unauthenticated git clone for signatures GITHUB_TOKEN cannot access codecoradev/.github (repo-scoped). Switching to plain git clone over HTTPS — repo is public, no auth needed. Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * fix(ci): wget+curl fallback for signatures fetch .github repo was private — now public. CDN may still cache 404. Using wget (primary) → curl (fallback) → empty JSON (last resort). Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> * ci: re-trigger CLA check (.github now public + CDN refreshed) Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> --------- Signed-off-by: ajianaz <ajianaz@users.noreply.github.com> Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Remove uteke-comparison.png and uteke-architecture.png from both README.md and README.id.md. These were visual duplicates of content already rendered natively in markdown: - Comparison image → duplicated the 13×9 Tool A-G markdown table - Architecture image → duplicated the Mermaid graph LR diagram Mermaid renders natively on GitHub, is version-controlled, and stays in sync. Static PNGs go stale and add unnecessary page weight. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
- docs/assets/uteke-comparison.png (186KB) — orphaned after comparison table replaced the static image - docs/assets/uteke-architecture.png (491KB) — orphaned after Mermaid diagram replaced the static image - docs/assets/uteke-infographic.html (14KB) — never referenced anywhere Total: 691KB of dead weight removed from the repo. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
#969) CRITICAL (init.rs): Hermes plugin tool.py did not URL-encode and uid=10000(hermes) gid=10000(hermes) groups=10000(hermes) parameters in GET/DELETE query strings, allowing path/query injection via crafted parameter values. Added urllib.parse.quote() calls. MAJOR (chunker.rs): split_long_text() sliced by byte index without checking UTF-8 char boundaries, causing panics on multi-byte text (emoji, CJK). Added floor_char_boundary() polyfill (MSRV-compatible since str::floor_char_boundary needs Rust 1.91+, we support 1.85+). Also improved url_decode() readability in types.rs: changed condition from 'i + 2 < bytes.len()' to explicit 'i + 3 <= bytes.len()' for clarity (semantically equivalent, but more readable intent). Tests: - test_split_long_text_multibyte_utf8: emoji + CJK splitting - test_floor_char_boundary: boundary detection edge cases - test_url_decode_basic/trailing_percent/utf8: encoding edge cases Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…(#P1) (#970) - crud.rs: wrap insert + tag inserts in BEGIN/COMMIT transaction for atomicity - handlers.rs: strip query string before route matching, use literal path match - lib.rs: fix graph_data namespace filter that was a no-op (is_none_or(|_| true)) - vector.rs: geometric capacity growth (2x) instead of fixed +1024 increment Why: each fix addresses a real correctness or performance issue found in audit. Tests: 476 pass, 0 fail. Clippy: 0 warnings. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
- cycle_deprecate_cap (lib.rs) - remember_json (operations.rs) - recall_context (operations.rs) - count_documents (documents.rs) All have zero callers in workspace. Marked #[deprecated] + #[allow(dead_code)] to signal removal intent without breaking downstream API consumers. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Updates ~90+ transitive and direct dependencies to latest patch/minor versions within their existing semver ranges. No Cargo.toml manifest changes needed — all updates are within declared version bounds. Tests: 468 pass, 0 fail. Clippy: 0 warnings. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
* fix: replace execSync with execFileSync in extensions (#973) - uteke-status: use execFileSync("sqlite3", [dbPath, sql]) instead of interpolated shell string - pi-memory-provider: use execFileSync(bin, args) instead of joined string, remove manual double-quoting of arguments - Prevents command injection via shell metacharacters in paths/args * fix: data safety — pinned filter, FTS5 rank col, update transactions (#974 #975 #976 #977) - aging.rs: add AND pinned = 0 to cleanup_aged DELETE to prevent pinned memory data loss (#974) - fts5.rs: fix rank column index from 14 (importance) to 19 (f.rank) in all 4 query branches — search ranking was broken (#975) - store.rs: fix pinned importance formula from 0.2*0.0 to 0.2*if pinned {1.0} else {0.0} (#976) - crud.rs: wrap update() and update_fields() in unchecked_transaction for memory+tags dual-write atomicity (#977) * fix: stability — string slicing panics, vector dim validation, install.ps1 (#978 #979 #980) - Add safe_truncate() helper that respects UTF-8 char boundaries - Replace 3 unsafe &str[..N] slicing locations with safe_truncate() (lib.rs x2, room.rs x1) — prevents panic on multi-byte content - vector.rs build(): validate all items have consistent dimensions before inserting, return Error::validation on mismatch - install.ps1: add exit 1 after checksum mismatch to stop installation of corrupted/tampered archive --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
) - Replace 5 manual format!() JSON constructions with serde_json::json!() in doc.rs (2) and mod.rs (3) — prevents corrupted output when slugs/ids contain quotes or backslashes (#981) - Replace unlock-rename-relock pattern in Windows save() with retry- based rename using exponential backoff — eliminates race window where another process could access the partially-written file (#982) Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…rsist, path corruption, thread cap (#985) - mod.rs: convert remaining manual JSON string to serde_json::json!() - schema.rs: add table name allowlist in column_exists_in (defense-in-depth) - docker-entrypoint.sh: explicit checksum validation with error exit - chunker.rs: guard against zero-length chunks causing infinite loop - operations.rs: persist vector index to disk after soft_forget - documents.rs: replace REPLACE() with substr() prefix swap to avoid multi-occurrence path corruption when moving subtrees - main.rs: cap concurrent request threads via atomic counter backpressure Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…ing, saturating overflow (#986) consolidate.rs: - Hoist index write lock outside dedup loop — acquire once, save once instead of lock+save per pair (N pairs → 1 lock + 1 save) server/main.rs: - Replace spin-yield backpressure with Condvar-based semaphore - Thread park instead of CPU burn under load - Preserve spawn-error slot release semantics vector.rs: - load_or_create: atomic file create via OpenOptions::create_new eliminates TOCTOU race (exists+write → create_new) - key mapping: replace exists()+read() with match on read_to_string (eliminates TOCTOU between check and read) - saturating_add(1) for next_key to prevent u64 overflow panic Test: 476 pass, 0 fail | Clippy: 0 warnings Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
… insertion (#987) * perf: P10 — eliminate N+1 queries across recall, graph BFS, rooms, and edge insertion Store layer (new batch methods): - crud.rs: get_by_ids() — single SELECT ... WHERE id IN (...) using rusqlite params_from_iter - aging.rs: touch_access_batch() — single UPDATE with CASE WHEN for batch access tracking Consumer fixes (6 N+1 hotspots eliminated): - operations.rs recall(): get_by_id per candidate → batch get_by_ids + HashMap lookup - operations.rs 4× touch_access loops → single touch_access_batch call - rooms.rs room_recall(): get_by_id per missing ID → batch get_by_ids - graph.rs BFS depth traversal: 2× get_by_id per level → batch fetch frontier + batch fetch targets Edge insertion optimization: - edges.rs add_memory_edges_batch(): prepare() once outside loop, reuse stmt for all inserts Test: 476 pass, 0 fail. Clippy: 0 warnings. * fix: dedup graph BFS target nodes visited by multiple source nodes in same level Cora review finding: when two source nodes in the same BFS frontier level both reference the same target, the target was added to rel_chains twice. After batch fetch, both entries would insert the target into results and next_frontier, causing duplicate entries and wasted traversal. Fix: check visited set before processing each rel_chain entry. * fix: chunk get_by_ids to stay under SQLite 999 host parameter limit Cora review finding: SQLite has SQLITE_MAX_VARIABLE_NUMBER=999 default. If ids contains >999 entries, the WHERE id IN (?,...) query would fail. Fix: chunk IDs into batches of 900, execute separate query per chunk, merge results. * fix: track best decayed score when multiple BFS sources reference same target Cora review: first-source-wins was non-deterministic and could lose a better score from a later source. Now tracks max score across all sources in the same frontier level before committing to results. --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
🔍 Cora AI Code ReviewReview powered by cora-code · BYOK · MIT |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Release v0.13.1 to main. Patch release: security hardening, data integrity fixes, N+1 query elimination.
Why
Contains all fixes from #968–#988. No breaking changes. See CHANGELOG for full details.
Changes
All commits from develop since v0.13.0 tag (13 commits, 32 files, +1032/-1127 lines).
Testing