stellavault 0.4.4 → 0.5.0

package/README.md

@@ -1,27 +1,27 @@
 # Stellavault
 
-> **Self-compiling knowledge MCP server** — ingest anything, auto-organize into Zettelkasten wiki, and let Claude access your entire knowledge base.
+> **Drop anything. It compiles itself into knowledge.** Claude remembers everything you know.
 
-Drop a PDF, paste a YouTube link, type a thought — Stellavault compiles it into structured knowledge, connects the dots, and gives your AI agent full access through 21 MCP tools.
+Self-compiling Zettelkasten MCP server. Ingest PDFs, YouTube, documents — auto-organized into linked wiki. Claude accesses your entire knowledge base. **Your vault files are never modified.**
 
 <p align="center">
-  <img src="images/screenshots/graph-dark-full.png" alt="3D Knowledge Graph" width="800" />
-  <br><em>Your vault as a neural network. Clusters form constellations.</em>
+  <img src="images/screenshots/graph-main-2.png" alt="3D Knowledge Graph" width="800" />
+  <br><em>Your vault as a neural network. Local-first, no cloud required.</em>
 </p>
 
 ## Two Core Ideas
 
-**1. "Drop it and forget it"** (Karpathy's Self-Compiling Knowledge)
+**1. "Drop it and forget it"** (Inspired by Karpathy's Self-Compiling Knowledge)
 ```
 Any input → auto-classify → raw/ → compile → wiki → connected knowledge
 ```
-PDF, DOCX, YouTube, URL, text — everything goes through the same pipeline. You never manually organize.
+PDF, DOCX, PPTX, XLSX, YouTube (with transcript), URL, text — everything goes through the same pipeline. You never manually organize.
 
-**2. "Claude knows what you know"** (MCP Integration)
+**2. "Claude remembers what you know"** (MCP Integration)
 ```bash
 claude mcp add stellavault -- stellavault serve
 ```
-21 MCP tools give Claude direct access to search, ask, draft, and navigate your entire knowledge base.
+Claude searches, asks, drafts from your vault directly. Local-first — no data leaves your machine.
 
 ## 5-Minute Setup
 
@@ -50,9 +50,12 @@ stellavault ingest <anything>     # PDF, DOCX, URL, YouTube, text
 | Input | How |
 |-------|-----|
 | PDF, DOCX, PPTX, XLSX | `stellavault ingest report.pdf` — auto text extraction |
+| JSON, CSV, XML, YAML | `stellavault ingest data.json` — structured format preserved |
+| HTML, RTF | `stellavault ingest page.html` — clean text extraction |
 | YouTube | `stellavault ingest https://youtu.be/...` — transcript + timestamps |
 | URL | `stellavault ingest https://...` — HTML → clean text |
 | Text | `stellavault ingest "quick thought"` |
+| Folder | `stellavault ingest ./papers/` — batch all files |
 | Web UI | Drag & drop files in browser (mobile too) |
 
 ### Express: Get Knowledge Out
@@ -177,9 +180,33 @@ stellavault autopilot                          # Full cycle: inbox → compile
 - Heatmap overlay (activity score)
 - Timeline slider (creation/modification filter)
 - Decay overlay (fading knowledge)
+- **Multiverse view** — your vault as a universe in a P2P network
 - Dark/Light theme
 - Mobile responsive + PWA installable
 
+## Multiverse — P2P Knowledge Federation
+
+<p align="center">
+  <img src="images/screenshots/multiverse-view.png" alt="Multiverse View" width="800" />
+  <br><em>"Your universe floats alone — for now."</em>
+</p>
+
+Your vault is a universe. Connect with others through P2P federation.
+
+```bash
+stellavault federate join    # Connect to the Stella Network
+stellavault federate status  # See connected peers
+```
+
+**How it works:**
+- **Hyperswarm P2P** — NAT-traversal mesh networking, no central server
+- **Embeddings only** — your original text never leaves your machine
+- **Differential privacy** — mathematical privacy guarantees
+- **Trust & reputation** — good knowledge earns credits
+- **Federated search** — search across connected vaults via MCP
+
+The Multiverse view shows your universe and connected peers as neighboring constellations in 3D. Click to explore their shared knowledge.
+
 ## Tech Stack
 
 | Layer | Tech |
@@ -197,22 +224,31 @@ stellavault autopilot                          # Full cycle: inbox → compile
 
 | Category | Features |
 |----------|----------|
-| **Capture** | ingest (URL/YouTube/PDF/DOCX/PPTX/XLSX/text), fleeting, web drag & drop, mobile PWA |
+| **Capture** | ingest 14 formats (PDF/DOCX/PPTX/XLSX/JSON/CSV/XML/HTML/YAML/RTF/YouTube/URL/text), batch folders, web drag & drop, Quick Capture, mobile PWA |
 | **Organize** | Zettelkasten 3-stage, auto index codes, wikilink auto-connect, configurable folders |
 | **Distill** | compile (raw→wiki), lint (health score), gaps, contradictions, duplicates |
-| **Express** | draft (blog/report/outline), --ai (Claude API), MCP generate-draft (free) |
-| **Memory** | FSRS decay tracking, session-save (daily logs), flush (logs→wiki), compounding loop |
-| **Search** | hybrid (BM25+vector+RRF), multilingual (50+ langs), ask Q&A |
-| **Visualize** | 3D graph, constellation, heatmap, timeline, decay overlay, dark/light |
-| **AI Integration** | 21 MCP tools, Claude Code hooks, Anthropic SDK, generate-draft |
-| **CLI** | 39+ commands, `sv` alias |
+| **Express** | draft (blog/report/outline/instagram/thread/script), blueprint, --ai, MCP generate-draft |
+| **Memory** | FSRS decay, session-save, flush, compounding loop, ADR templates |
+| **Search** | hybrid (BM25+vector+RRF), multilingual 50+, ask Q&A, quotes mode |
+| **Visualize** | 3D graph, heatmap, timeline, right-click context menu, TipTap WYSIWYG editor |
+| **AI Integration** | 21 MCP tools, Claude Code hooks, Anthropic SDK |
+| **Security** | DOMPurify, YAML sanitize, 50MB guard, SSRF protection |
+| **CLI** | 40+ commands, `sv` alias, batch ingest |
+
+## Security
+
+Your vault files are never modified. Stellavault is local-first — no data leaves your machine unless you explicitly use `--ai` (Anthropic API).
+
+See [SECURITY.md](SECURITY.md) for full details.
 
 ## License
 
-MIT
+MIT — full source code available for audit.
 
 ## Links
 
+- [Landing Page](https://evanciel.github.io/stellavault/)
 - [Obsidian Plugin](https://github.com/Evanciel/stellavault-obsidian)
 - [npm](https://www.npmjs.com/package/stellavault)
 - [GitHub Releases](https://github.com/Evanciel/stellavault/releases)
+- [Security Policy](SECURITY.md)

package/SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+## Data Access
+
+Stellavault is **local-first**. Your knowledge stays on your machine.
+
+### What Stellavault reads
+- `.md`, `.txt`, `.pdf`, `.docx`, `.pptx`, `.xlsx` files **inside your configured vault path only**
+- Files are read to build a search index (SQLite-vec database stored in `~/.stellavault/`)
+- **Vault original files are never modified by the indexer** — Stellavault creates its own files in `raw/`, `_wiki/`, `_drafts/` folders
+
+### When network requests occur
+- **YouTube ingest**: fetches video metadata + captions from youtube.com (via yt-dlp)
+- **URL ingest**: fetches the target URL to extract text
+- **`stellavault draft --ai`**: sends vault excerpts to Anthropic API (requires explicit `ANTHROPIC_API_KEY` env var — opt-in only)
+- **MCP serve**: local stdio/HTTP only — no external connections
+- **Embedding model**: downloaded once from Hugging Face on first `stellavault index`, then cached locally
+
+### What never leaves your machine
+- Your vault files
+- Your search index database
+- Your session logs and daily logs
+- Your draft outputs
+- All MCP tool responses
+
+## Vault Safety
+
+- **Read-only default**: The search indexer reads files but does not modify them
+- **New files only**: `ingest`, `session-save`, `compile`, `draft` create new `.md` files — they never overwrite existing vault notes
+- **Edit is explicit**: The web UI edit feature and `PUT /api/document` require deliberate user action
+- **Path traversal protection**: All file operations validate paths stay within vault root
+- **Configurable folders**: `raw/`, `_wiki/`, `_literature/` names can be changed in `.stellavault.json`
+
+## Input Sanitization
+
+- **DOMPurify**: All markdown rendered in the web UI is sanitized against XSS
+- **YAML sanitization**: Frontmatter values are escaped to prevent injection
+- **File size limit**: 50MB max for binary file extraction
+- **URL validation**: Image URLs restricted to `https://` scheme
+- **SSRF protection**: Private/local IP addresses blocked for URL ingest
+
+## Reporting Vulnerabilities
+
+Please report security issues to: https://github.com/Evanciel/stellavault/issues (label: security)
+
+Or email: [create a security@stellavault.dev when domain is registered]
+
+## License
+
+MIT — full source code is available for audit at https://github.com/Evanciel/stellavault