7076e4b283* perf(daemon): coalesce metadata writes * refactor(metadata): split repository ops * fix(metadata): harden repository invariants * feat: test coverage and continued refactor work in metadata code * fix(graph): handle path-like explore queries - prefer file path symbol lookup for graph explore\n- sanitize alias FTS queries before MATCH * fix(daemon): quiesce shutdown background work - Interrupt pending DB acquires before worker shutdown - Wait for tracked background coroutines and timers to drain * fix(daemon): cancel repair work on shutdown Blocked embed and post-ingest queues could keep salvage and\nstuck-doc repair alive during shutdown. Consume cancellation in\nrepair retry loops and lock the integrated ServiceManager path\nwith regressions so shutdown fails fast instead of drifting. * perf(metadata): reduce sqlite lock contention * perf(metadata): flatten batch content retries * fix(daemon): align shutdown wait budgets A low shutdown timeout override could expire before ServiceManager\nfinished its 5s+30s WorkCoordinator join path. Share the join\nbudget constants, clamp graceful lifecycle waits to that floor,\nand lock the behavior with a daemon regression. * perf(metadata): bound feedback write waits * perf(metadata): prep batch content before tx * fix(daemon): honor no-embeddings tasks Post-ingest queue tasks dropped the per-task noEmbeddings flag,\nso focused extraction tests still emitted embed jobs and Windows\nCI exercised extra async paths. Preserve the flag through the bus,\nskip embed dispatch when requested, and wake the extraction poller\nimmediately after successful queueing. * perf(daemon): batch fallback metadata writes * feat(perf,docs): optimizations for metadata writes, prompt updates and test improvements * perf(metadata): flatten insert retries * fix(metadata): clear CI portability blockers Use the shared portable ScopedEnvVar in metadata search-query helper tests, add mutators for test reuse, and normalize Statement::bindAll integral dispatch so long long arguments bind consistently across platforms. Add focused regression coverage for the bindAll long long path. * perf(metadata): batch writes and steady bench * fix(daemon): skip inactive post-ingest pollers * perf(metadata): tighten tag and path caches * perf(metadata): cache small batch upserts * fix(daemon): harden embedded host teardown * feat(docs): updating docs policies and language * perf(metadata): tune doc update retries * perf(metadata): bound download retries * perf(metadata): bound download metadata waits * bench(metadata): scope post-ingest content path * fix(daemon): export embedded test hooks * fix(daemon): harden test helper linkage * fix(build): add missing standard includes
1.2 KiB
1.2 KiB
Security Policy
If you believe you have found a security vulnerability in YAMS, please report it responsibly.
Thank you for taking the time to do that work.
Reporting
- Please report vulnerabilities privately, not in public tickets.
- Email:
admin@yamsmemory.ai(PGP optional). - Include, if you can: affected version or commit, platform, impact, minimal PoC, repro steps, and relevant logs.
- If you are unsure whether something is security-sensitive, email first and we can help triage.
Response targets
- We aim to acknowledge receipt within 48 hours.
- We aim to triage within 7 days and share next steps.
- For high/critical issues, our target is a fix or mitigation within 90 days; otherwise best effort depending on scope and risk.
Disclosure
- We prefer coordinated disclosure.
- We will credit reporters unless you ask us not to.
- If warranted, we will request a CVE and share the ID in the advisory.
Scope
In scope:
- YAMS daemon
- YAMS CLI
- plugins maintained in this repository
Out of scope:
- third-party dependencies (please report those upstream)
- unsupported forks or heavily modified downstream builds
Supported versions
main- the latest minor release line