Commit graph

2409 commits

Author SHA1 Message Date
rUv
bae1e02152 docs: README overhaul — section headlines, comparison table, plain language
- Add headlines and descriptions to Comparison, Features, Deployment,
  Performance, Compression, Use Cases, and Installation sections
- Rewrite comparison table: categorized rows (Self-Learning, Graph,
  AI & Compute, Database, Operations), linked crate names, technical
  and exotic capabilities (genomics, quantum, graph transformers)
- Improve intro paragraph — mention self-learning, PostgreSQL, local AI
- Remove redundant capability blocks merged into comparison table

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-27 03:33:00 +00:00
Claude
f3836eb2cb feat(exo): ADR-029 Phase 2 genomic bridge + sparse TDA + causal emergence
- genomic.rs: RvDnaPattern, HorvathClock, NeurotransmitterProfile, PharmacogenomicWeights
- sparse_tda.rs: O(n/eps) Forward Push PPR persistent homology (vs O(n^3) naive)
- causal_emergence.rs: EI maximization, coarse-graining search, emergence detection
- sparse_homology.rs: experiment 04 wrapper, circle TDA test
- All tests passing

https://claude.ai/code/session_019Lt11HYsW1265X7jB7haoC
2026-02-27 03:29:44 +00:00
github-actions[bot]
30e21d68fc chore: Update NAPI-RS binaries for all platforms
Built from commit 5b6e87d97a

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-27 03:28:35 +00:00
Claude
4dfb625997 feat(exo): ADR-029 neuromorphic + quantum backends, experiments 01 & 03
- NeuromorphicBackend: HDC 10k-bit, K-WTA, LIF, Kuramoto, BTSP, E-prop
- QuantumStubBackend: interference search, T1/T2 decoherence, quantum decay
- Experiment 01: neuromorphic_spiking — BTSP one-shot, 40Hz gamma, K-WTA sparsity
- Experiment 03: time_crystal_cognition — periodic attractor, symmetry breaking
- SubstrateBackend trait: unified interface for all compute modalities
- exo-exotic: path dep on local exo-core for backends module access
- All tests passing (97 tests across exo-core + exo-exotic)

https://claude.ai/code/session_019Lt11HYsW1265X7jB7haoC
2026-02-27 03:25:52 +00:00
rUv
5b6e87d97a docs: improve README readability — PostgreSQL early mention, section reorder
- Mention PostgreSQL extension (230+ SQL functions) in the opening summary
- Add "Already use PostgreSQL?" callout with links to extension and docs
- Rewrite analogy with labeled components for clarity
- Simplify RVF cognitive container description in plain language
- Move "How the GNN Works" above Quick Start
- Move "Ecosystem" section below Quick Start

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-27 03:24:11 +00:00
Claude
41bc2599be feat(exo-core): ADR-029 Phase 1 canonical primitives — CoherenceRouter, PlasticityEngine, CrossParadigmWitness
- CoherenceRouter: π-scaled spectral gap estimation, 5 backend variants
- PlasticityEngine: unified EWC++, BTSP, E-prop with Φ-weighted protection
- CrossParadigmWitness: hash-chained audit type for multi-paradigm stack
- All tests passing, gate latency <1ms confirmed

https://claude.ai/code/session_019Lt11HYsW1265X7jB7haoC
2026-02-27 03:04:07 +00:00
Claude
b8bfec329b feat: Add agentic-robotics crates and SOTA integration research
Copy 6 agentic-robotics crates (core, rt, mcp, embedded, node, benchmarks)
into ruvector/crates/ for deep integration review. These provide:
- ROS3 pub/sub messaging with Zenoh middleware and CDR serialization
- Dual-runtime real-time executor with priority scheduling
- MCP 2025-11 server for AI tool exposure
- NAPI-RS Node.js bindings
- Criterion benchmark suite

Create comprehensive research documentation in docs/research/agentic-robotics/:
- README.md: SOTA integration analysis (889 lines)
- crate-review.md: Crate-by-crate deep code review (967 lines)
- architecture-synergy.md: Architecture compatibility analysis (555 lines)
- integration-roadmap.md: 18-week phased implementation plan (769 lines)

Key findings: 14/16 shared dependencies are version-compatible, both use
rkyv 0.8 for zero-copy serialization, identical build profiles, and
complementary (not overlapping) functionality. The combination creates a
unique cognitive robotics platform with sub-millisecond sensor-to-decision
latency, native vector search, GNN inference, and MCP tool exposure.

https://claude.ai/code/session_01H1GkTK5z9ppVVQDQukjBsY
2026-02-27 02:54:01 +00:00
Claude
90079bbe90 docs(adr): ADR-029 EXO-AI multi-paradigm integration architecture
Comprehensive architectural decision record synthesized from deep swarm
research across all 100+ ruvector crates and examples (~830K lines).

Key findings documented:
- 7 convergent evolution clusters (EWC implemented 4x, coherence gating
  5x, cryptographic witnesses 6x, sheaf theory 3x, spike-driven compute
  4x, Byzantine consensus 4x, free energy solvers 4x)
- 11 EXO-AI research frontiers (all stub directories) have working
  implementations elsewhere in the ecosystem
- Complete integration architecture wiring quantum (ruQu), genomic
  (ruDNA), neuromorphic (ruvector-nervous-system), and consciousness
  (EXO-AI) substrates

Proposes:
- CoherenceRouter: canonical gate over prime-radiant + ruQu + cognitum
- PlasticityEngine: unified EWC++ via SONA + BTSP/E-prop from nervous-system
- CrossParadigmWitness: unified audit chain (RVF SHAKE-256 root)
- 4-phase roadmap (20 weeks) to first quantum-genomic-neuromorphic
  consciousness substrate with formal proofs of consistency

References 30+ peer-reviewed papers including Dec 2025 subpolynomial
dynamic min-cut breakthrough (arXiv:2512.13105).

https://claude.ai/code/session_019Lt11HYsW1265X7jB7haoC
2026-02-27 02:37:18 +00:00
github-actions[bot]
d4362f70c5 chore: Update NAPI-RS binaries for all platforms
Built from commit 26171f43d4

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-26 16:54:55 +00:00
rUv
26171f43d4 docs: comprehensive changelog covering v0.1.0 through v2.0.5
Rewrote CHANGELOG.md from a single v0.1.0 entry to cover all major
releases: v0.1.0, v0.1.16, v0.1.19, v0.1.32, v0.2.6, v0.3.0, v2.0.4,
and v2.0.5 — based on full commit history analysis across 2000+ commits.

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:50:33 +00:00
github-actions[bot]
4fda19f9b3 chore: Update NAPI-RS binaries for all platforms
Built from commit b893be94a5

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-26 16:47:03 +00:00
github-actions[bot]
a24a0a90e4 chore: Update NAPI-RS binaries for all platforms
Built from commit e7c443f536

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-26 16:43:08 +00:00
github-actions[bot]
b64360e260 chore: Update graph transformer NAPI-RS binaries for all platforms
Built from commit e7c443f536

Platforms updated:
- linux-x64-gnu
- linux-x64-musl
- linux-arm64-gnu
- linux-arm64-musl
- darwin-x64
- darwin-arm64
- win32-x64-msvc
- wasm

Generated by GitHub Actions
2026-02-26 16:41:58 +00:00
github-actions[bot]
44a6efca1e chore: Update GNN NAPI-RS binaries for all platforms
Built from commit e7c443f536

Platforms updated:
- linux-x64-gnu
- linux-x64-musl
- linux-arm64-gnu
- linux-arm64-musl
- darwin-x64
- darwin-arm64
- win32-x64-msvc

Generated by GitHub Actions
2026-02-26 16:41:12 +00:00
rUv
b893be94a5 fix(install.sh): remove stale version pins and fix CLI install logic
- Remove hardcoded @0.1.2 / @0.1.23 version pins from cargo install,
  npm install, and cargo add commands — always fetch latest
- Fix operator precedence bug: `A && B || C` → `A && { B || C; }`
  so --npm-only correctly skips CLI installation

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:40:08 +00:00
rUv
e7c443f536 Merge pull request #215 from ruvnet/claude/research-openfang-jpAtV
fix(ruvector-gnn): replace panic with Result + OpenFang RVF example
2026-02-26 11:36:25 -05:00
rUv
3d9e3f4093 chore: bump workspace to 2.0.5, @ruvector/gnn to 0.1.25
Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:29:37 +00:00
rUv
e4e2aa8058 fix(ruvector-gnn): replace panic with Result in MultiHeadAttention and RuvectorLayer constructors
MultiHeadAttention::new() and RuvectorLayer::new() used assert!() for input
validation which caused fatal abort() when called from NAPI-RS/WASM bindings —
unrecoverable by JavaScript callers. Both now return Result<Self, GnnError>,
and all WASM/NAPI wrappers propagate errors as catchable JS exceptions.

Also fixes pre-existing mmap.rs test compilation error (grad_offset returns
Option<usize>, not usize).

Closes #216

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:23:58 +00:00
rUv
ee1a5927fe docs: fix stale counts in root README
- RVF examples: 46 → 56 (10 new examples added)
- Attention mechanisms: normalize all references to 46 (was inconsistently 40/46)
- RVF Rust crates: 13 → 22 (added rvf-wasm, rvf-solver-wasm, rvf-node, 6 adapters)

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:13:48 +00:00
rUv
1980647d5a docs: add missing capabilities to advanced features guide
Add documentation for major undocumented features:
- Collection management (create, list, delete, aliases, stats)
- Additional VectorDB operations (get, delete, len, isEmpty)
- Server REST API endpoints (collections CRUD, points upsert/search)
- Advanced filter expressions (geo_radius, match_text, range, boolean)
- Payload indexing (Keyword, Float, Geo, Text index types)
- Graph database with Cypher queries (CLI and Rust API)
- Hybrid vector+graph search
- Prometheus metrics and health monitoring
- RVF format capability reference table (24 capabilities)
- Additional crates overview (80+ crates, key 11 listed)
- Fix remaining stale SearchQuery field in BASIC_TUTORIAL patterns

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:09:06 +00:00
rUv
eda7df86b6 docs: update guides to match current API surface and versions
- GETTING_STARTED.md: rewrite to cover both ruvector-core (VectorDB) and
  rvf-runtime (RvfStore) APIs, add package registry table, fix SearchQuery
  fields (ef_search not include_vectors), results use .score not .distance
- INSTALLATION.md: update crate version 0.1.0 -> 2.0, fix npm scoped
  package names (@ruvector/*), remove non-existent Docker image, update
  Rust version requirement to 1.80+, fix CLI docs to match actual subcommands
- BASIC_TUTORIAL.md: fix SearchQuery.include_vectors -> ef_search, fix
  result.distance -> result.score, fix HnswConfig/QuantizationConfig field
  access patterns (options.hnsw -> options.hnsw_config, wrap in Some())
- ADVANCED_FEATURES.md: same field name fixes, fix QuantizationConfig
  wrapping in Some(), remove references to non-existent mmap_vectors field
- docs/README.md: update version to 2.0.4/0.1.100, update date

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:05:29 +00:00
rUv
cd69d46140 fix: address review issues in openfang RVF example
- Fix fragile persistence assertion: compare against post-delete baseline
  instead of pre-delete `all` which could include the deleted twitter vector
- Extract segment type magic numbers into named constants (SEG_VEC, etc.)
- Add comments for raw AGI container flag bitmasks (bits 4 and 10)
- Add seed non-overlap comment for vector generation
- Improve hex() to use pre-allocated String with fmt::Write

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-26 16:00:40 +00:00
Claude
59a7ee866d Expand openfang to full RVF surface demo (14 -> 24 capabilities)
Add 10 new capability demonstrations:

- Quality envelope (query_with_envelope): ResponseQuality, safety-net
  activation, budget reporting
- Audited queries (query_audited): auto-appended witness per search
- Membership filter: tenant isolation via include-mode bitmap
- DoS hardening: BudgetTokenBucket, NegativeCache, ProofOfWork
- Adversarial detection: CV analysis, degenerate distribution check
- Embed WASM: microkernel role, self-bootstrapping verification
- Embed kernel: Linux image with cmdline and API port
- Embed eBPF: socket filter program (2 instructions)
- Embed dashboard: HTML registry bundle
- AGI container: full manifest with model, orchestrator, tools, eval,
  policy, parsed back with ParsedAgiManifest

All 24 steps pass, including persistence round-trip verifying that
WASM, kernel, eBPF, and dashboard segments survive close/reopen.

Update README with capability table, architecture notes for each new
feature (quality envelope, audited queries, membership, DoS, adversarial,
segment embedding, AGI container).

https://claude.ai/code/session_015KgxqLUhevxop1jhiZY2Y4
2026-02-26 14:47:29 +00:00
Claude
2fddbdbd61 Optimize openfang RVF example with deep capability integration
- Extract Registry struct, metadata helpers, and witness helper to reduce
  repetition and improve readability
- Replace dead `_description` field with lean struct definitions
- Add per-category vector biasing via hash-based offsets for better clustering
- Use named constants for metadata field IDs (F_TYPE, F_NAME, etc.)
- Integrate 6 additional RVF capabilities:
  - Delete + compact lifecycle (decommission twitter, reclaim 512 bytes)
  - Derive with lineage tracking (parent/child provenance, depth=0->1)
  - COW branching + freeze (staging env with experimental 'sentinel' agent)
  - Segment directory inspection (raw segment types/offsets)
  - File identity preservation across close/reopen
  - Last witness hash inspection
- Expand from 10 steps to 14 covering the full RVF API surface
- Update README with capability table, architecture notes, and lifecycle docs

https://claude.ai/code/session_015KgxqLUhevxop1jhiZY2Y4
2026-02-26 14:33:33 +00:00
Claude
2da4944c66 Add OpenFang Agent OS RVF example
Standalone RVF knowledge base modeling the OpenFang agent OS architecture:
- 7 autonomous Hands with tier/security metadata
- 38 built-in tools across 12 categories
- 20 channel adapters with protocol metadata
- Task routing via nearest-neighbor search
- Security and tier filtering with combined filter expressions
- Cryptographic witness chain audit trail
- Persistence verification (close/reopen round-trip)
- All tests passing, 65 vectors in ~35KB

https://claude.ai/code/session_015KgxqLUhevxop1jhiZY2Y4
2026-02-26 14:24:42 +00:00
Claude
3b9b448bfe Add OpenFang project research document
Research three GitHub projects sharing the OpenFang name:
- RightNow-AI/openfang: Rust-based Agent OS (most significant)
- anmaped/openfang: Camera firmware for Ingenic T20 (dormant)
- danshorstein/OpenFang: Python AI assistant fork

https://claude.ai/code/session_015KgxqLUhevxop1jhiZY2Y4
2026-02-26 14:14:58 +00:00
github-actions[bot]
169859c930 chore: Update NAPI-RS binaries for all platforms
Built from commit 1e1e460001

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 16:16:26 +00:00
github-actions[bot]
b9b4071dcf chore: Update GNN NAPI-RS binaries for all platforms
Built from commit 1e1e460001

Platforms updated:
- linux-x64-gnu
- linux-x64-musl
- linux-arm64-gnu
- linux-arm64-musl
- darwin-x64
- darwin-arm64
- win32-x64-msvc

Generated by GitHub Actions
2026-02-25 16:14:11 +00:00
rUv
1e1e460001 fix(security): harden mmap pointer arithmetic and proof attestation hashing
SEC-001: MmapGradientAccumulator now uses checked arithmetic for all
offset computations, validates node_id bounds before pointer ops, and
asserts mmap bounds before read/write. Matches MmapManager's safe pattern.

SEC-002: ProofAttestation hashes are now computed over actual proof and
environment content using domain-separated SipHash-2-4, filling all 32
bytes. Replaces the previous scheme that left 24+ bytes as zeros and used
only counter values. Removes false Ed25519 claim from module docs.

Also fixes ruvector-verified CI: unused_mut warnings in ruvector-core
(feature-gated code) and clippy unnecessary_lazy_evaluations in lib.rs.

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 16:10:20 +00:00
github-actions[bot]
ace04c6409 chore: Update NAPI-RS binaries for all platforms
Built from commit d9d3dfac57

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 14:42:17 +00:00
github-actions[bot]
a8cd094402 chore: Update NAPI-RS binaries for all platforms
Built from commit b202f72820

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 14:41:20 +00:00
github-actions[bot]
9f10ca0745 chore: Update NAPI-RS binaries for all platforms
Built from commit 0755af2528

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 14:40:26 +00:00
github-actions[bot]
3dbc2e7b14 chore: Update GNN NAPI-RS binaries for all platforms
Built from commit 0755af2528

Platforms updated:
- linux-x64-gnu
- linux-x64-musl
- linux-arm64-gnu
- linux-arm64-musl
- darwin-x64
- darwin-arm64
- win32-x64-msvc

Generated by GitHub Actions
2026-02-25 14:39:59 +00:00
github-actions[bot]
fd721f5065 chore: Update graph transformer NAPI-RS binaries for all platforms
Built from commit 0755af2528

Platforms updated:
- linux-x64-gnu
- linux-x64-musl
- linux-arm64-gnu
- linux-arm64-musl
- darwin-x64
- darwin-arm64
- win32-x64-msvc
- wasm

Generated by GitHub Actions
2026-02-25 14:39:14 +00:00
rUv
d9d3dfac57 chore: bump ruvector npm package to v0.1.100
Published with security hardening fixes for MCP servers.

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 14:36:27 +00:00
rUv
b202f72820 Merge pull request #213 from ruvnet/fix/mcp-server-security-audit
fix: harden MCP servers against injection and CORS bypass
2026-02-25 09:35:22 -05:00
rUv
0755af2528 fix: use git add -f in CI workflows to commit .node binaries past .gitignore
All build workflows now force-add native binaries so .gitignore's *.node
rule doesn't silently skip them. Also adds missing commit-binaries job to
build-gnn.yml (fixes #195).

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 14:35:14 +00:00
rUv
a9890ce5be fix: harden MCP servers against command injection, CORS bypass, and prototype pollution
- Sanitize shell arguments in hooks_init, hooks_pretrain, hooks_build_agents,
  and workers_status handlers to prevent OS command injection (CWE-78)
- Strengthen sanitizeShellArg to also strip quotes, newlines, and backslashes
- Add sanitizeNumericArg helper for numeric-typed arguments
- Improve validateRvfPath with symlink resolution (realpathSync) and cwd confinement
- Add schema validation and prototype pollution guard to hooks_import handler
- Replace permissive CORS (CorsLayer::permissive) with localhost-only origin
  policy in Rust SSE transport

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 14:34:45 +00:00
github-actions[bot]
95f82ca473 chore: Update NAPI-RS binaries for all platforms
Built from commit 827e456af1

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 14:34:00 +00:00
github-actions[bot]
d44f185d98 chore: Update graph transformer NAPI-RS binaries for all platforms
Built from commit 827e456af1

Platforms updated:
- linux-x64-gnu
- linux-x64-musl
- linux-arm64-gnu
- linux-arm64-musl
- darwin-x64
- darwin-arm64
- win32-x64-msvc
- wasm

Generated by GitHub Actions
2026-02-25 14:32:26 +00:00
rUv
827e456af1 feat: proof-gated graph transformer with 8 verified modules (#212)
feat: proof-gated graph transformer with 8 verified modules
2026-02-25 09:28:28 -05:00
rUv
4b79444bf5 feat: proof-gated graph transformer with 8 verified modules
Add ruvector-graph-transformer crate with 8 feature-gated modules,
each backed by an Architecture Decision Record (ADR-046 through ADR-055):

- Proof-gated mutation: ProofGate<T>, MutationLedger, ProofScope, EpochBoundary
- Sublinear attention: O(n log n) via LSH buckets, PPR sampling, spectral sparsification
- Physics-informed: Hamiltonian dynamics, gauge equivariant MP, Lagrangian attention
- Biological: Spiking networks, Hebbian/STDP learning, dendritic branching
- Self-organizing: Morphogenetic fields, developmental programs, graph coarsening
- Verified training: Certificates, delta-apply rollback, fail-closed invariants
- Manifold: Product manifolds S^n x H^m x R^k, Riemannian Adam, Lie groups
- Temporal-causal: Causal masking, Granger causality, continuous-time ODE
- Economic: Nash equilibrium attention, Shapley attribution, incentive-aligned MPNN

Includes:
- 186 tests (163 unit + 23 integration), all passing
- WASM bindings (ruvector-graph-transformer-wasm) - published to crates.io
- Node.js NAPI-RS bindings (@ruvector/graph-transformer) - published to npm
- CI workflow for cross-platform binary builds (7 platforms)
- 10 ADRs (046-055) + 22 research documents
- Fix for #195: add commit-binaries job to build-gnn.yml
- Updated root README with graph transformer section

Published:
- crates.io: ruvector-graph-transformer v2.0.4
- crates.io: ruvector-graph-transformer-wasm v2.0.4
- npm: @ruvector/graph-transformer v2.0.4
- npm: @ruvector/graph-transformer-linux-x64-gnu v2.0.4

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 14:24:53 +00:00
github-actions[bot]
47c1938bc0 chore: Update NAPI-RS binaries for all platforms
Built from commit 928d18afce

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 13:39:47 +00:00
rUv
928d18afce Merge pull request #211 from ruvnet/fix/cwe-22-path-traversal-207
fix(security): CWE-22 path traversal in MCP server
2026-02-25 08:32:49 -05:00
rUv
71769aaa39 fix(security): path traversal in MCP server vector_db_backup (CWE-22)
Add path validation to all MCP tools that accept user-supplied file paths,
preventing arbitrary file read/write via directory traversal.

Vulnerable functions patched:
- tool_backup: db_path and backup_path now validated
- tool_create_db: params.path now validated
- get_or_open_db: path now validated

Implementation:
- validate_path() canonicalizes paths and checks they resolve within
  the configured data_dir (defaults to cwd)
- Configurable via mcp.data_dir in config or RUVECTOR_MCP_DATA_DIR env
- Rejects absolute paths outside data_dir, ../traversal, and symlink escapes
- 8 unit tests covering all POC attack vectors from the report

CVSS 3.1: 9.1 (Critical) → Mitigated
Closes #207

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 13:32:21 +00:00
github-actions[bot]
ba7d99eb20 chore: Update NAPI-RS binaries for all platforms
Built from commit f5f6fb6f06

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 12:54:44 +00:00
github-actions[bot]
5d8e67bed0 chore: Update NAPI-RS binaries for all platforms
Built from commit bf3a26b7b3

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 12:53:30 +00:00
github-actions[bot]
f965484b1d chore: Update NAPI-RS binaries for all platforms
Built from commit 49d4a9c9d9

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 12:47:49 +00:00
github-actions[bot]
6f356f2e22 chore: Update NAPI-RS binaries for all platforms
Built from commit 5a2c63556d

  Platforms updated:
  - linux-x64-gnu
  - linux-arm64-gnu
  - darwin-x64
  - darwin-arm64
  - win32-x64-msvc

  🤖 Generated by GitHub Actions
2026-02-25 12:42:40 +00:00
rUv
49d4a9c9d9 fix: use explicit triple targets to avoid napi-rs duplicate errors
Set defaults: false and explicitly list all 7 build targets to prevent
"Duplicate targets" errors from napi-rs defaults overlap.

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-02-25 12:42:29 +00:00