Tobias Lütke 0af7e841f5 fix(security): gate project-local collection paths and model URIs (#889) ...

A checked-in .qmd/index.yml could point qmd update at any readable
directory and embed/query/pull at any hf: repo or local GGUF. Reuse the
#887 trust digest for out-of-project paths and non-default models.
Nested picomatch min-bumps for high GHSA-c2c7-rcm5-vvqj.

2026-08-13 19:06:08 +00:00

..

_helpers

fix(embed): exclusive process lock to prevent concurrent embed races

2026-08-13 00:11:16 +00:00

eval-docs

Add 6 synthetic evaluation documents

2025-12-21 13:10:35 -04:00

ast-chunking.test.ts

chore: migrate AST chunking tests to vitest

2026-04-05 17:19:59 -04:00

ast.test.ts

Fix AST grammar packaging for Bun installs

2026-05-09 18:13:58 +00:00

bench-guard.test.ts

fix(bench): fail fast when the fixture collection is missing or empty (#716) (#876)

2026-08-13 02:58:14 -04:00

bench-score.test.ts

feat: support project-local indexes in bench

2026-05-16 18:22:04 +00:00

bin-wrapper.test.ts

fix(bin): spawn process.execPath so native addons match install ABI (#879)

2026-08-13 03:46:59 -04:00

build-script.test.ts

fix(build): spawn tsc without a Windows cmd.exe shell (#681) (#858)

2026-08-12 22:43:54 -04:00

cleanup.test.ts

fix(store): reclaim orphaned content and compact FTS in qmd cleanup (#550) (#875)

2026-08-13 02:41:58 -04:00

cli-exit-lifecycle.test.ts

fix(cli): exit naturally so node-llama-cpp's beforeExit fires

2026-05-28 17:23:31 -07:00

cli-lazy-llm-import.test.ts

fix(cli): keep status from importing llama

2026-05-09 18:12:45 +00:00

cli.test.ts

fix(cli): honor --glob as an alias for collection add --mask (#536) (#880)

2026-08-13 03:59:59 -04:00

collections-config.test.ts

feat: add local init and doctor diagnostics

2026-05-19 14:27:33 -04:00

config-path-model-trust-cli.test.ts

fix(security): gate project-local collection paths and model URIs (#889)

2026-08-13 19:06:08 +00:00

config-path-model-trust.test.ts

fix(security): gate project-local collection paths and model URIs (#889)

2026-08-13 19:06:08 +00:00

Containerfile

Expand install smoke harness

2026-05-19 23:05:49 +00:00

db.test.ts

fix(db): raise busy_timeout default to 120s and expose QMD_SQLITE_BUSY_TIMEOUT

2026-06-12 00:40:26 -05:00

embed-lock.test.ts

fix(embed): exclusive process lock to prevent concurrent embed races

2026-08-13 00:11:16 +00:00

esm-ambiguous-module.test.ts

fix(cli): stamp the build's commit instead of guessing at runtime (#787)

2026-08-12 23:55:10 +00:00

eval-bm25.test.ts

test: move all tests to flat test/ directory

2026-02-15 21:37:47 -04:00

eval-deep-research.jsonl

Merge origin/main into feat/ast-aware-chunking

2026-03-28 20:00:49 -04:00

eval-deep-research.ts

Merge origin/main into feat/ast-aware-chunking

2026-03-28 20:00:49 -04:00

eval-harness.ts

refactor: move CLI and MCP to subdirectories, MCP consumes SDK

2026-03-10 11:39:55 -04:00

eval.test.ts

test: move all tests to flat test/ directory

2026-02-15 21:37:47 -04:00

formatter.test.ts

Add line to JSON search output

2026-04-05 10:08:57 +00:00

full-path-fallback.test.ts

fix(multi-get): emit docid as its own field in --format files (#846)

2026-08-12 20:48:09 -04:00

install-hooks.test.ts

test: cover Windows-safe prepare hooks installer (#778)

2026-08-13 00:04:13 +00:00

intent.test.ts

refactor: move CLI and MCP to subdirectories, MCP consumes SDK

2026-03-10 11:39:55 -04:00

launcher-detection.test.sh

fix(launcher): detect bun global installs via the install-root lockfile

2026-06-12 23:08:44 +02:00

llm.test.ts

chore(deps): bump node-llama-cpp 3.18.1 → 3.20.0 and safe patch/minors (#891)

2026-08-13 14:50:52 -04:00

local-config.test.ts

fix(security): gate project-local collection paths and model URIs (#889)

2026-08-13 19:06:08 +00:00

mcp-origin-guard.test.ts

fix(security): Origin/Host on MCP HTTP + keep index paths inside the collection (#888)

2026-08-13 14:51:05 -04:00

mcp-pid.test.ts

fix(mcp): scope HTTP daemon pidfile per --index (#772) (#850)

2026-08-12 21:24:17 -04:00

mcp-stdio-lifecycle.test.ts

fix(mcp): shut down gracefully when stdin reaches EOF (#751)

2026-08-12 23:58:36 +00:00

mcp.test.ts

feat(mcp): speak protocol 2026-07-28 (stateless HTTP, server/discover) (#883)

2026-08-13 10:14:12 -04:00

multi-collection-filter.test.ts

fix(store): search each collection before merging so -c A -c B is not starved (#775) (#871)

2026-08-13 01:46:24 -04:00

package.test.ts

fix(nix): seed bin/qmd pre-import env in the flake wrapper (#723) (#867)

2026-08-13 00:47:06 -04:00

path-fidelity.test.ts

fix(store): don't let legacy slug migration evict live files (#717) (#869)

2026-08-13 01:18:47 -04:00

release-context.test.ts

fix(release): add missing release-context.sh for /release skill (#796) (#864)

2026-08-13 00:10:34 -04:00

rrf-trace.test.ts

feat(query): add --explain score traces for hybrid search

2026-03-07 14:35:10 -04:00

sdk.test.ts

fix(update): warn and count files skipped due to read errors (#460) (#878)

2026-08-13 03:24:47 -04:00

smoke-install.sh

Expand install smoke harness

2026-05-19 23:05:49 +00:00

store-cjk-fts.test.ts

fix(store): repair leftover FTS name column before CJK rebuild DELETE (#792) (#882)

2026-08-13 10:02:48 -04:00

store-concurrency.test.ts

fix(db): make concurrent store initialization safe

2026-06-24 04:34:16 +00:00

store-insert-context.test.ts

fix(store): look up insertContext collections by name (#853) (#854)

2026-08-12 21:52:23 -04:00

store-paths.test.ts

test: move all tests to flat test/ directory

2026-02-15 21:37:47 -04:00

store.helpers.unit.test.ts

fix(security): Origin/Host on MCP HTTP + keep index paths inside the collection (#888)

2026-08-13 14:51:05 -04:00

store.test.ts

fix(security): Origin/Host on MCP HTTP + keep index paths inside the collection (#888)

2026-08-13 14:51:05 -04:00

structured-search.test.ts

Merge pull request #384 from rymalia/fix/semantic-query-hyphen-validation

2026-05-02 20:16:30 -04:00

update-hook-trust-cli.test.ts

fix(update): don't run a checked-in .qmd config's update commands unattended (#886) (#887)

2026-08-13 14:35:39 -04:00

update-hook-trust.test.ts

fix(update): don't run a checked-in .qmd config's update commands unattended (#886) (#887)

2026-08-13 14:35:39 -04:00

version.test.ts

fix(cli): stamp the build's commit instead of guessing at runtime (#787)

2026-08-12 23:55:10 +00:00