mirror of
https://github.com/ruvnet/RuVector.git
synced 2026-08-24 16:13:54 +00:00
Addresses the PR #869 security audit (1 MEDIUM, 2 LOW/informational): MEDIUM — stripComments was not string-aware: a // inside a quoted string was treated as a line comment, so URL-form references ("https://hf.co/repo/model.safetensors", "file://models/x.gguf", "http://internal/finetune") evaded the model-file-reference and generic-finetune rules. Replaced the regex strip with a per-language character scan that tracks quote state (js-like: ' " ` incl. template literals with counted ${} nesting and backslash escapes; rust: " only — ' deliberately ignored so lifetimes cannot desynchronize the scan, plus nested block comments; python: # + ' " and triple quotes; shell: # only at word start, ' without escapes, " with). Comments are stripped only outside strings; residual stripper edges (js regex literals with //, rust char-literal " / raw strings) are documented and are all in the false-positive direction — they can never hide a token. Self-test gains the auditor's three URL fixtures (must flag), a comment-containing-URL case and a .sh comment case (must NOT flag), and the single-slash "ruvllm/training" import regression case (still flags). LOW hardening — SCAN_EXT now includes .py and .sh; dist removed from SKIP_DIRS (committed build output is what executes). Real-tree scan stays clean: 25 files across the 3 surfaces, 0 hits — no committed dist/ or vendored code exists under the surfaces today, so no scoping carve-out was needed. Self-test covers .py/.sh violations and a violation under dist/. fixtures/ and node_modules/ remain skipped by convention, stated in the header. Accepted residuals documented in the script header and shaperLoop.ts module docs: the capability gate fires on a self-declared capabilityDelta until WP11 wires independent extraction (evaluation is not promotion — human + vetoes still gate); the model-hash binding is record-only until WP12's day-0/day-30 re-hash. Self-test: 23/23 assertions pass. Harness suite: 26/26 pass. Refs #841, PR #869 audit. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X |
||
|---|---|---|
| .. | ||
| benchmark | ||
| build | ||
| ci | ||
| deploy | ||
| lib | ||
| patches/hnsw_rs | ||
| publish | ||
| research-gate | ||
| sona-drift | ||
| test | ||
| training | ||
| validate | ||
| adr-index.mjs | ||
| analyze-evolution.js | ||
| analyze-ham10000.js | ||
| build-solver.sh | ||
| build-sonic-ct-wasm.sh | ||
| check_brain_status.sh | ||
| claude-code-decompile.sh | ||
| claude-code-rvf-corpus.sh | ||
| create-brainpedia.py | ||
| deploy-crawl-phase1.sh | ||
| deploy-dragnes.sh | ||
| deploy-gemini-agents.sh | ||
| deploy-wet-job.sh | ||
| deploy_brain_services.sh | ||
| deploy_trainer.sh | ||
| discover_and_train.sh | ||
| extract-ruqu-rvdna-submodules.sh | ||
| frozen-weights-check.mjs | ||
| gemini-agents.js | ||
| generate-rvf-manifest.py | ||
| historical-crawl-import.sh | ||
| publish-rvf.sh | ||
| README.md | ||
| rebuild-all-versions.mjs | ||
| run_mincut_bench.sh | ||
| rvagent-flywheel-evaluator.mjs | ||
| rvforge-parity-check.sh | ||
| rvforge-parity-fixture.cjs | ||
| seed-brain-all.py | ||
| seed-brain.rs | ||
| seed-specialized.py | ||
| setup-gcs-examples.sh | ||
| sift1m_hnswlib_bench.mjs | ||
| sql-audit-v3.sql | ||
| swarm_train_15.sh | ||
| sync-lockfile.sh | ||
| train-lora.py | ||
| train_brain.sh | ||
| training_orchestrator.sh | ||
| upvote_memories.py | ||
| vote-boost.py | ||
| wet-filter-inject.js | ||
| wet-full-import.sh | ||
| wet-job.yaml | ||
| wet-orchestrate.sh | ||
| wet-processor.sh | ||
| workspace-check.mjs | ||
RuVector Automation Scripts
This directory contains automation scripts organized by purpose.
📁 Directory Structure
scripts/
├── README.md # This file
├── benchmark/ # Performance benchmarking
├── build/ # Build utilities
├── ci/ # CI/CD automation
├── deploy/ # Deployment scripts
├── patches/ # Patch files
├── publish/ # Package publishing
├── test/ # Testing scripts
└── validate/ # Validation & verification
🚀 Deployment
Scripts for deploying to production.
| Script | Description |
|---|---|
deploy/deploy.sh |
Comprehensive deployment (crates.io + npm) |
deploy/test-deploy.sh |
Test deployment without publishing |
deploy/DEPLOYMENT.md |
Full deployment documentation |
deploy/DEPLOYMENT-QUICKSTART.md |
Quick deployment guide |
Usage:
# Full deployment
./scripts/deploy/deploy.sh
# Dry run
./scripts/deploy/deploy.sh --dry-run
# Test deployment
./scripts/deploy/test-deploy.sh
📦 Publishing
Scripts for publishing packages to registries.
| Script | Description |
|---|---|
publish/publish-all.sh |
Publish all packages |
publish/publish-crates.sh |
Publish Rust crates to crates.io |
publish/publish-cli.sh |
Publish CLI package |
publish/publish-router-wasm.sh |
Publish router WASM package |
publish/check-and-publish-router-wasm.sh |
Check and publish router WASM |
Usage:
# Set credentials first
export CRATES_API_KEY="your-crates-io-token"
export NPM_TOKEN="your-npm-token"
# Publish all
./scripts/publish/publish-all.sh
# Publish crates only
./scripts/publish/publish-crates.sh
📊 Benchmarking
Performance benchmarking scripts.
| Script | Description |
|---|---|
benchmark/run_benchmarks.sh |
Run core benchmarks |
benchmark/run_llm_benchmarks.sh |
Run LLM inference benchmarks |
Usage:
# Run core benchmarks
./scripts/benchmark/run_benchmarks.sh
# Run LLM benchmarks
./scripts/benchmark/run_llm_benchmarks.sh
🧪 Testing
Testing and validation scripts.
| Script | Description |
|---|---|
test/test-wasm.mjs |
Test WASM bindings |
test/test-graph-cli.sh |
Test graph CLI commands |
test/test-all-graph-commands.sh |
Test all graph commands |
test/test-docker-package.sh |
Test Docker packaging |
Usage:
# Test WASM
node ./scripts/test/test-wasm.mjs
# Test graph CLI
./scripts/test/test-graph-cli.sh
✅ Validation
Package and build verification scripts.
| Script | Description |
|---|---|
validate/validate-packages.sh |
Validate package configs |
validate/validate-packages-simple.sh |
Simple package validation |
validate/verify-paper-impl.sh |
Verify paper implementation |
validate/verify_hnsw_build.sh |
Verify HNSW build |
Usage:
# Validate packages
./scripts/validate/validate-packages.sh
# Verify HNSW
./scripts/validate/verify_hnsw_build.sh
🔄 CI/CD
Continuous integration scripts.
| Script | Description |
|---|---|
ci/ci-sync-lockfile.sh |
Auto-fix lock files in CI |
ci/sync-lockfile.sh |
Sync package-lock.json |
ci/install-hooks.sh |
Install git hooks |
Usage:
# Install git hooks (recommended)
./scripts/ci/install-hooks.sh
# Sync lockfile
./scripts/ci/sync-lockfile.sh
🛠️ Build
Build utility scripts located in build/.
🩹 Patches
Patch files for dependencies located in patches/.
🚀 Quick Start
For Development
-
Install git hooks (recommended):
./scripts/ci/install-hooks.sh -
Run tests:
./scripts/test/test-wasm.mjs
For Deployment
-
Set credentials:
export CRATES_API_KEY="your-crates-io-token" export NPM_TOKEN="your-npm-token" -
Dry run first:
./scripts/deploy/deploy.sh --dry-run -
Deploy:
./scripts/deploy/deploy.sh
🔐 Security
Never commit credentials! Always use environment variables or .env file.
See deploy/DEPLOYMENT.md for security best practices.