argenis de la rosa
|
f8befafe4d
|
feat: add Composio tool provider + encrypted secret store + wizard integration
- src/tools/composio.rs: ComposioTool implementing Tool trait
- list/execute/connect actions via Composio API (1000+ OAuth apps)
- 60s timeout, proper error handling, JSON schema for LLM
- 12 tests covering schema, validation, serde, error paths
- src/security/secrets.rs: SecretStore for encrypted credential storage
- XOR cipher with random 32-byte key stored in ~/.zeroclaw/.secret_key
- enc: prefix for encrypted values, plaintext passthrough (backward compat)
- Key file created with 0600 permissions (Unix)
- 16 tests: roundtrip, unicode, long secrets, corrupt hex, permissions
- src/config/schema.rs: ComposioConfig + SecretsConfig structs
- Composio: enabled (default: false), api_key, entity_id
- Secrets: encrypt (default: true)
- Both with serde(default) for backward compatibility
- 8 new config tests
- src/onboard/wizard.rs: new Step 5 'Tool Mode & Security'
- Sovereign (local only) vs Composio (managed OAuth) selection
- Encrypted secret storage toggle (default: on)
- 7-step wizard (was 6)
- src/tools/mod.rs: all_tools() now accepts optional composio_key
- src/agent/loop_.rs: wires Composio key from config into tool registry
- README.md: Composio integration + encrypted secrets documentation
1017 tests, 0 clippy warnings, cargo fmt clean.
|
2026-02-14 02:41:29 -05:00 |
|
argenis de la rosa
|
976c5bbf3c
|
hardening: fix 7 production weaknesses found in codebase scan
Scan findings and fixes:
1. Gateway buffer overflow (8KB → 64KB)
- Fixed: Increased request buffer from 8,192 to 65,536 bytes
- Large POST bodies (long prompts) were silently truncated
2. Gateway slow-loris attack (no read timeout → 30s)
- Fixed: tokio::time::timeout(30s) on stream.read()
- Malicious clients could hold connections indefinitely
3. Webhook secret timing attack (== → constant_time_eq)
- Fixed: Now uses constant_time_eq() for secret comparison
- Prevents timing side-channel on webhook authentication
4. Pairing brute force (no limit → 5 attempts + 5min lockout)
- Fixed: PairingGuard tracks failed attempts with lockout
- Returns 429 Too Many Requests with retry_after seconds
5. Shell tool hang (no timeout → 60s kill)
- Fixed: tokio::time::timeout(60s) on Command::output()
- Commands that hang are killed and return error
6. Shell tool OOM (unbounded output → 1MB cap)
- Fixed: stdout/stderr truncated at 1MB with warning
- Prevents memory exhaustion from verbose commands
7. Provider HTTP timeout (none → 120s request + 10s connect)
- Fixed: All 5 providers (OpenRouter, Anthropic, OpenAI,
Ollama, Compatible) now have reqwest timeouts
- Ollama gets 300s (local models are slower)
949 tests passing, 0 clippy warnings, cargo fmt clean
|
2026-02-14 01:47:08 -05:00 |
|
argenis de la rosa
|
0e7f501fd6
|
feat: full-stack search engine — FTS5, vector search, hybrid merge, embedding cache, chunker
The Full Stack (All Custom):
- Vector DB: embeddings stored as BLOB, cosine similarity in pure Rust
- Keyword Search: FTS5 virtual tables with BM25 scoring + auto-sync triggers
- Hybrid Merge: weighted fusion of vector + keyword results (configurable weights)
- Embeddings: provider abstraction (OpenAI, custom URL, noop fallback)
- Chunking: line-based markdown chunker with heading preservation
- Caching: embedding_cache table with LRU eviction
- Safe Reindex: rebuild FTS5 + re-embed missing vectors
New modules:
- src/memory/embeddings.rs — EmbeddingProvider trait + OpenAI + Noop + factory
- src/memory/vector.rs — cosine similarity, vec↔bytes, ScoredResult, hybrid_merge
- src/memory/chunker.rs — markdown-aware document splitting
Upgraded:
- src/memory/sqlite.rs — FTS5 schema, embedding column, hybrid recall, cache, reindex
- src/config/schema.rs — MemoryConfig expanded with embedding/search settings
- All callers updated to pass api_key for embedding provider
739 tests passing, 0 clippy warnings (Rust 1.93.1), cargo-deny clean
|
2026-02-14 00:00:23 -05:00 |
|
argenis de la rosa
|
bc31e4389b
|
style: cargo fmt — fix all formatting for CI
Ran cargo fmt across entire codebase to pass CI's cargo fmt --check.
No logic changes, only whitespace/formatting.
|
2026-02-13 16:03:50 -05:00 |
|
argenis de la rosa
|
05cb353f7f
|
feat: initial release — ZeroClaw v0.1.0
- 22 AI providers (OpenRouter, Anthropic, OpenAI, Mistral, etc.)
- 7 channels (CLI, Telegram, Discord, Slack, iMessage, Matrix, Webhook)
- 5-step onboarding wizard with Project Context personalization
- OpenClaw-aligned system prompt (SOUL.md, IDENTITY.md, USER.md, AGENTS.md, etc.)
- SQLite memory backend with auto-save
- Skills system with on-demand loading
- Security: autonomy levels, command allowlists, cost limits
- 532 tests passing, 0 clippy warnings
|
2026-02-13 12:19:14 -05:00 |
|