mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
Profa
dc10361133
Performance fixes: - HNSW Array.splice → BinaryHeap for O(log n) insertion (25x speedup) - vectorSearch N+1 → batch SQL query with IN clause - loadPatterns N+1 → batched concurrent Promise.all (50/batch) - Math.min(...spread) → iterative loop to prevent stack overflow at >10K vertices - Move @faker-js/faker to devDependencies (-5.2MB production) Security fixes: - SQL table name allowlist for defense-in-depth (SQLite can't parameterize identifiers) - Object.assign() → safeAssignPooled() to prevent prototype pollution (3 locations) - OAuth timingSafeCompare pads strings instead of early-return on length mismatch - OAuth no longer stores raw tokens (hash-only storage) - OAuth revokedTokens Set→Map with timestamps for 24hr expiry cleanup - Remove hardcoded GCP credentials from sync/interfaces.ts defaults - Add .env.example GCP section with placeholder comments Testing: - Add 167 tests for 5 MCP security boundary validators (command, path-traversal, input-sanitizer, crypto, regex-safety) - Include QE swarm analysis reports for v3.6.3 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>