@jcode.labs/mimir 0.2.0 → 0.3.0

package/dist/security.js

@@ -0,0 +1,86 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { loadConfig } from "./config.js";
+import { classifyHost } from "./network.js";
+export async function securityAudit(cwd = process.cwd()) {
+    const config = await loadConfig(cwd);
+    const gitignore = await readGitignore(config.projectRoot);
+    const network = classifyHost(config.ollamaHost);
+    const warnings = [];
+    const kbIgnored = hasGitignoreEntry(gitignore, ".kb/");
+    const mimirIgnored = hasGitignoreEntry(gitignore, ".mimir/");
+    const privateIgnored = hasGitignoreEntry(gitignore, "private/**");
+    if (config.networkPolicy === "allow-any") {
+        warnings.push("networkPolicy is allow-any; document text can be sent to a remote Ollama host.");
+    }
+    if (config.networkPolicy === "local-only" && network.kind !== "loopback") {
+        warnings.push("networkPolicy is local-only but ollamaHost is not loopback.");
+    }
+    if (!config.redaction.enabled) {
+        warnings.push("Redaction is disabled; secrets and identifiers may be embedded in the index.");
+    }
+    if (!kbIgnored) {
+        warnings.push(".kb/ is not ignored by Git.");
+    }
+    if (!mimirIgnored) {
+        warnings.push(".mimir/ is not ignored by Git.");
+    }
+    if (!privateIgnored) {
+        warnings.push("private/** is not ignored by Git.");
+    }
+    return {
+        projectRoot: config.projectRoot,
+        zeroTelemetry: true,
+        network: {
+            policy: config.networkPolicy,
+            ollamaHost: config.ollamaHost,
+            host: network.host,
+            classification: network.kind,
+        },
+        redaction: {
+            enabled: config.redaction.enabled,
+            builtIn: config.redaction.builtIn,
+            customPatterns: config.redaction.patterns.map((pattern) => pattern.name),
+        },
+        accessLog: {
+            enabled: config.accessLog,
+            path: config.accessLogPath,
+            storesRawQueries: false,
+        },
+        storage: {
+            path: config.storageDir,
+            gitIgnored: kbIgnored,
+            encryptedAtRest: "external-required",
+        },
+        mcp: {
+            maxTopK: config.mcpMaxTopK,
+            destructiveToolsExposed: false,
+        },
+        gitignore: {
+            kbIgnored,
+            mimirIgnored,
+            privateIgnored,
+        },
+        recommendations: [
+            "Run Mimir inside an encrypted disk, VM, or container volume for at-rest encryption.",
+            "Use npm provenance, release checksums, and the generated SBOM for release verification.",
+            "Use one repository checkout per trust boundary; Mimir does not implement multi-user RBAC.",
+        ],
+        warnings,
+    };
+}
+async function readGitignore(projectRoot) {
+    const gitignorePath = path.join(projectRoot, ".gitignore");
+    if (!existsSync(gitignorePath)) {
+        return new Set();
+    }
+    return new Set((await readFile(gitignorePath, "utf8"))
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean));
+}
+function hasGitignoreEntry(lines, entry) {
+    return lines.has(entry);
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG3C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACrD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC5D,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAEjE,IAAI,MAAM,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACpD,CAAC;IAED,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,cAAc,EAAE,OAAO,CAAC,IAAI;SAC7B;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;YACjC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;YACjC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzE;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,gBAAgB,EAAE,KAAK;SACxB;QACD,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,UAAU,EAAE,SAAS;YACrB,eAAe,EAAE,mBAAmB;SACrC;QACD,GAAG,EAAE;YACH,OAAO,EAAE,MAAM,CAAC,UAAU;YAC1B,uBAAuB,EAAE,KAAK;SAC/B;QACD,SAAS,EAAE;YACT,SAAS;YACT,YAAY;YACZ,cAAc;SACf;QACD,eAAe,EAAE;YACf,qFAAqF;YACrF,yFAAyF;YACzF,2FAA2F;SAC5F;QACD,QAAQ;KACT,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IAED,OAAO,IAAI,GAAG,CACZ,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;SACpC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkB,EAAE,KAAa;IAC1D,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC"}

package/dist/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAKD,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyBjG"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAKD,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgCjG"}

package/dist/skill.js

@@ -1,6 +1,7 @@
 import { cp, mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { ensureMimirGitignore } from "./gitignore.js";
 const PACKAGE_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const SKILL_NAME = "mimir";
 export function bundledSkillPath() {
@@ -18,15 +19,20 @@ export async function installSkill(options = {}) {
     await cp(bundledSkillPath(), skillPath, { recursive: true, force: true });
     await writeFile(mcpConfigPath, `${JSON.stringify(mcpConfig(cwd), null, 2)}\n`, "utf8");
     await writeFile(readmePath, agentKitReadme(skillPath, mcpConfigPath), "utf8");
+    const wroteGitignore = await ensureMimirGitignore(cwd);
+    const written = [
+        path.relative(cwd, skillPath),
+        path.relative(cwd, mcpConfigPath),
+        path.relative(cwd, readmePath),
+    ];
+    if (wroteGitignore) {
+        written.push(".gitignore");
+    }
     return {
         skillPath,
         mcpConfigPath,
         readmePath,
-        written: [
-            path.relative(cwd, skillPath),
-            path.relative(cwd, mcpConfigPath),
-            path.relative(cwd, readmePath),
-        ],
+        written,
     };
 }
 function mcpConfig(cwd) {

package/dist/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAcxC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC/E,MAAM,UAAU,GAAG,OAAO,CAAA;AAE1B,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA+B,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAEnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzE,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACtF,MAAM,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAA;IAE7E,OAAO;QACL,SAAS;QACT,aAAa;QACb,UAAU;QACV,OAAO,EAAE;YACP,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;SAC/B;KACF,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;QACL,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC;gBACjC,GAAG;aACJ;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,aAAqB;IAC9D,OAAO;;;;;;;;;EASP,SAAS;;;;;;;;;;EAUT,aAAa;;;;;;;;;CASd,CAAA;AACD,CAAC"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAcrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC/E,MAAM,UAAU,GAAG,OAAO,CAAA;AAE1B,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA+B,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAEnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzE,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACtF,MAAM,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAA;IAC7E,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAEtD,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;KAC/B,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO;QACL,SAAS;QACT,aAAa;QACb,UAAU;QACV,OAAO;KACR,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;QACL,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC;gBACjC,GAAG;aACJ;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,aAAqB;IAC9D,OAAO;;;;;;;;;EASP,SAAS;;;;;;;;;;EAUT,aAAa;;;;;;;;;CASd,CAAA;AACD,CAAC"}

package/dist/types.d.ts

@@ -4,14 +4,39 @@ export interface Config {
     rawDir: string;
     storageDir: string;
     sourcesFile: string;
+    accessLogPath: string;
     tableName: string;
     ollamaHost: string;
+    networkPolicy: NetworkPolicy;
     embedModel: string;
     llmModel: string;
+    redaction: RedactionConfig;
+    accessLog: boolean;
+    mcpMaxTopK: number;
     topK: number;
     chunkSize: number;
     chunkOverlap: number;
 }
+export type NetworkPolicy = "local-only" | "allow-private" | "allow-any";
+export interface RedactionConfig {
+    enabled: boolean;
+    builtIn: boolean;
+    patterns: RedactionPattern[];
+}
+export interface RedactionPattern {
+    name: string;
+    pattern: string;
+    flags?: string | undefined;
+    replacement?: string | undefined;
+}
+export interface RedactionCount {
+    name: string;
+    count: number;
+}
+export interface HostClassification {
+    kind: "loopback" | "private" | "remote" | "invalid";
+    host: string;
+}
 export interface SourceFile {
     absolutePath: string;
     relativePath: string;
@@ -46,6 +71,7 @@ export interface IngestResult {
     indexedFiles: number;
     chunks: number;
     skippedFiles: number;
+    redactions: number;
     errors: Array<{
         path: string;
         message: string;
@@ -76,4 +102,45 @@ export interface AuditReport {
     staleInIndex: string[];
     totalChunks: number;
 }
+export interface DestroyIndexResult {
+    storageDir: string;
+    removed: boolean;
+    note: string;
+}
+export interface SecurityAuditReport {
+    projectRoot: string;
+    zeroTelemetry: true;
+    network: {
+        policy: NetworkPolicy;
+        ollamaHost: string;
+        host: string;
+        classification: HostClassification["kind"];
+    };
+    redaction: {
+        enabled: boolean;
+        builtIn: boolean;
+        customPatterns: string[];
+    };
+    accessLog: {
+        enabled: boolean;
+        path: string;
+        storesRawQueries: false;
+    };
+    storage: {
+        path: string;
+        gitIgnored: boolean;
+        encryptedAtRest: "external-required";
+    };
+    mcp: {
+        maxTopK: number;
+        destructiveToolsExposed: false;
+    };
+    gitignore: {
+        kbIgnored: boolean;
+        mimirIgnored: boolean;
+        privateIgnored: boolean;
+    };
+    recommendations: string[];
+    warnings: string[];
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,QAAQ,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,QAAQ,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,aAAa,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,eAAe,CAAA;IAC1B,SAAS,EAAE,OAAO,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,WAAW,CAAA;AAExE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAA;IACnD,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,QAAQ,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,QAAQ,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,IAAI,CAAA;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAC3C,CAAA;IACD,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,cAAc,EAAE,MAAM,EAAE,CAAA;KACzB,CAAA;IACD,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,gBAAgB,EAAE,KAAK,CAAA;KACxB,CAAA;IACD,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,OAAO,CAAA;QACnB,eAAe,EAAE,mBAAmB,CAAA;KACrC,CAAA;IACD,GAAG,EAAE;QACH,OAAO,EAAE,MAAM,CAAA;QACf,uBAAuB,EAAE,KAAK,CAAA;KAC/B,CAAA;IACD,SAAS,EAAE;QACT,SAAS,EAAE,OAAO,CAAA;QAClB,YAAY,EAAE,OAAO,CAAA;QACrB,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.2.0";
+export declare const VERSION = "0.3.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.2.0";
+export const VERSION = "0.3.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jcode.labs/mimir",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Mimir: open-source local-first memory and retrieval for private project knowledge.",
   "type": "module",
   "license": "MIT",
@@ -42,7 +42,10 @@
   "files": [
     "dist",
     "skills",
-    "README.md"
+    "README.md",
+    "SECURITY-HARDENING.md",
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "publishConfig": {
     "access": "public"
@@ -55,9 +58,10 @@
     "lint": "biome ci .",
     "lint:fix": "biome check --write .",
     "package:check": "publint",
+    "release:artifacts": "node scripts/release-artifacts.mjs",
     "smoke": "node scripts/smoke.mjs",
     "test": "vitest run",
-    "validate": "pnpm lint && pnpm check && pnpm test && pnpm build && pnpm smoke && pnpm package:check"
+    "validate": "pnpm lint && pnpm check && pnpm test && pnpm build && pnpm smoke && pnpm package:check && pnpm release:artifacts"
   },
   "dependencies": {
     "@lancedb/lancedb": "^0.30.0",

package/skills/mimir/SKILL.md

@@ -20,12 +20,15 @@ private/          # raw documents to ingest
 .kb/config.json   # local Mimir config
 .kb/sources.txt   # optional extra source paths
 .kb/storage/      # generated local index
+.kb/access.log    # metadata-only access log
 ```
 
 ## Data Safety
 
 - Do not commit raw documents, secrets, tax IDs, scans, bank documents, tokens, or generated vector stores.
-- Keep `private/**` and `.kb/storage/**` ignored by Git.
+- Keep `private/**`, `.kb/`, and `.mimir/` ignored by Git.
+- Treat `kb search`, `kb ask`, and MCP results as sensitive because they can contain private
+  source passages even when redaction is enabled.
 - Prefer summaries and citations over dumping long private passages into the chat.
 - If the user asks for a high-stakes answer, identify which facts came from Mimir and which still require professional or official verification.
 
@@ -35,6 +38,7 @@ From the repository root:
 
 ```bash
 pnpm exec kb status
+pnpm exec kb security-audit
 ```
 
 If Mimir is not installed:
@@ -58,10 +62,12 @@ After documents are added or changed:
 ```bash
 pnpm exec kb ingest
 pnpm exec kb audit
+pnpm exec kb security-audit
 pnpm exec kb status
 ```
 
-The audit must show no missing or stale supported files before relying on the index.
+The audit must show no missing or stale supported files before relying on the index. The security
+audit should not show warnings before relying on Mimir for sensitive work.
 
 ## Query Workflow
 
@@ -101,9 +107,13 @@ Available MCP tools:
 - `mimir_search`: retrieve source passages.
 - `mimir_ask`: synthesize an answer with local citations.
 - `mimir_audit`: compare source files with the current index.
+- `mimir_security_audit`: inspect local privacy, network, redaction, MCP, and gitignore posture.
 
 Prefer MCP tools over shell commands when the agent runtime provides them. Use shell commands when MCP is unavailable.
 
+MCP is read-focused and intentionally does not expose index deletion. Use `pnpm exec kb
+destroy-index --yes` from the shell when the user explicitly wants to remove the generated index.
+
 ## Installing This Skill Into A Repository
 
 Run: