stellavault 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +164 -168
- package/SECURITY.md +23 -0
- package/dist/graph-ui/assets/{camera_utils-D_AxFqU7.js → camera_utils-BK2vNdvf.js} +1 -1
- package/dist/graph-ui/assets/{hands-BumW2WNg.js → hands-yrSjE20U.js} +1 -1
- package/dist/graph-ui/assets/{index-DdorzFNd.js → index-4LS6c1x8.js} +73 -73
- package/dist/graph-ui/index.html +1 -1
- package/dist/stellavault.js +2464 -2237
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,256 +2,252 @@
|
|
|
2
2
|
|
|
3
3
|
> **Drop anything. It compiles itself into knowledge.** Claude remembers everything you know.
|
|
4
4
|
|
|
5
|
-
Self-compiling
|
|
5
|
+
Self-compiling knowledge base with a full-featured editor, 3D neural graph, AI-powered search, and spaced repetition — available as a **desktop app**, **CLI**, **Obsidian plugin**, and **MCP server**. Your vault files are never modified.
|
|
6
6
|
|
|
7
7
|
<p align="center">
|
|
8
8
|
<img src="images/screenshots/graph-main-2.png" alt="3D Knowledge Graph" width="800" />
|
|
9
9
|
<br><em>Your vault as a neural network. Local-first, no cloud required.</em>
|
|
10
10
|
</p>
|
|
11
11
|
|
|
12
|
-
##
|
|
12
|
+
## Install
|
|
13
13
|
|
|
14
|
-
|
|
15
|
-
```
|
|
16
|
-
Any input → auto-classify → raw/ → compile → wiki → connected knowledge
|
|
17
|
-
```
|
|
18
|
-
PDF, DOCX, PPTX, XLSX, YouTube (with transcript), URL, text — everything goes through the same pipeline. You never manually organize.
|
|
14
|
+
### Desktop App (Recommended — one click)
|
|
19
15
|
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
16
|
+
<table>
|
|
17
|
+
<tr>
|
|
18
|
+
<td align="center"><a href="https://github.com/Evanciel/stellavault/releases/download/desktop-v0.1.0/Stellavault-win32-x64-0.1.0.zip"><br/><b>⬇ Download for Windows</b><br/><sub>x64 · 116 MB · ZIP</sub></a></td>
|
|
19
|
+
<td align="center"><a href="https://github.com/Evanciel/stellavault/releases/download/desktop-v0.1.0/Stellavault-linux-x64-0.1.0.zip"><br/><b>⬇ Download for Linux</b><br/><sub>x64 · 107 MB · ZIP</sub></a></td>
|
|
20
|
+
<td align="center"><br/><b>macOS</b><br/><sub>Coming soon</sub></td>
|
|
21
|
+
</tr>
|
|
22
|
+
</table>
|
|
23
|
+
|
|
24
|
+
> Download → Unzip → Run `stellavault.exe` (Windows) or `stellavault` (Linux) → Pick your notes folder → Done.
|
|
25
25
|
|
|
26
|
-
|
|
26
|
+
### CLI (for developers)
|
|
27
27
|
|
|
28
28
|
```bash
|
|
29
|
-
npm install -g stellavault
|
|
30
|
-
stellavault init
|
|
31
|
-
stellavault graph
|
|
29
|
+
npm install -g stellavault # or: npx stellavault
|
|
30
|
+
stellavault init # Interactive setup wizard (3 min)
|
|
31
|
+
stellavault graph # Launch 3D graph in browser
|
|
32
32
|
```
|
|
33
33
|
|
|
34
|
-
>
|
|
35
|
-
|
|
36
|
-
|
|
34
|
+
> Requires Node.js 20+. Run `stellavault doctor` to diagnose issues.
|
|
35
|
+
|
|
36
|
+
### Obsidian Plugin
|
|
37
|
+
|
|
38
|
+
1. Download `main.js` + `manifest.json` + `styles.css` from [stellavault-obsidian releases](https://github.com/Evanciel/stellavault-obsidian/releases/latest)
|
|
39
|
+
2. Place in `.obsidian/plugins/stellavault/`
|
|
40
|
+
3. Enable in Settings → Community plugins
|
|
41
|
+
4. Start API: `npx stellavault graph` in your vault folder
|
|
42
|
+
|
|
43
|
+
---
|
|
44
|
+
|
|
45
|
+
## Editor
|
|
46
|
+
|
|
47
|
+
Full-featured markdown editor — on par with Obsidian.
|
|
48
|
+
|
|
49
|
+
| Feature | Status |
|
|
50
|
+
|---------|--------|
|
|
51
|
+
| Bold, Italic, Underline, Strikethrough | ✅ |
|
|
52
|
+
| Headings 1–6 | ✅ |
|
|
53
|
+
| Bullet, Numbered, Task lists (nested checkboxes) | ✅ |
|
|
54
|
+
| Tables (create, resize columns, add/remove rows & cols) | ✅ |
|
|
55
|
+
| Code blocks with syntax highlighting (40+ languages) | ✅ |
|
|
56
|
+
| Images (URL, clipboard paste, drag & drop) | ✅ |
|
|
57
|
+
| KaTeX math rendering (`$E=mc^2$` inline, `$$...$$` display) | ✅ |
|
|
58
|
+
| `/Slash commands` (12 block types, fuzzy search) | ✅ |
|
|
59
|
+
| `[[Wikilink]]` autocomplete | ✅ |
|
|
60
|
+
| Split view (vertical + horizontal, Ctrl+\\) | ✅ |
|
|
61
|
+
| Text alignment (left / center / right) | ✅ |
|
|
62
|
+
| Highlight, Superscript, Subscript | ✅ |
|
|
63
|
+
| Smart typography (curly quotes, em/en dashes) | ✅ |
|
|
64
|
+
| Horizontal rules | ✅ |
|
|
65
|
+
|
|
66
|
+
---
|
|
37
67
|
|
|
38
68
|
## The Pipeline
|
|
39
69
|
|
|
40
70
|
```
|
|
41
71
|
Capture ──→ Organize ──→ Distill ──→ Express
|
|
42
72
|
|
|
43
|
-
|
|
44
|
-
→ auto-extract text # unpdf, mammoth, yt-dlp
|
|
45
|
-
→ raw/ (fleeting) # Zettelkasten inbox
|
|
46
|
-
→ compile → _wiki/ # Auto: concepts + backlinks
|
|
47
|
-
→ stellavault draft "topic" # Blog, report, or outline
|
|
73
|
+
Drop anything → auto-extract → raw/ → compile → _wiki/ → draft
|
|
48
74
|
```
|
|
49
75
|
|
|
50
|
-
|
|
76
|
+
Inspired by Karpathy's self-compiling knowledge architecture.
|
|
77
|
+
|
|
78
|
+
### Ingest 14 Formats
|
|
51
79
|
|
|
52
80
|
| Input | How |
|
|
53
81
|
|-------|-----|
|
|
54
|
-
| PDF, DOCX, PPTX, XLSX | `stellavault ingest report.pdf`
|
|
55
|
-
| JSON, CSV, XML, YAML | `stellavault ingest data.json`
|
|
56
|
-
| HTML, RTF | `stellavault ingest page.html` — clean text extraction |
|
|
82
|
+
| PDF, DOCX, PPTX, XLSX | `stellavault ingest report.pdf` |
|
|
83
|
+
| JSON, CSV, XML, YAML, HTML, RTF | `stellavault ingest data.json` |
|
|
57
84
|
| YouTube | `stellavault ingest https://youtu.be/...` — transcript + timestamps |
|
|
58
|
-
| URL | `stellavault ingest https://...` — HTML →
|
|
85
|
+
| URL | `stellavault ingest https://...` — HTML → markdown |
|
|
59
86
|
| Text | `stellavault ingest "quick thought"` |
|
|
60
87
|
| Folder | `stellavault ingest ./papers/` — batch all files |
|
|
61
|
-
| Web UI | Drag & drop files
|
|
88
|
+
| Desktop / Web UI | Drag & drop files directly |
|
|
62
89
|
|
|
63
90
|
### Express: Get Knowledge Out
|
|
64
91
|
|
|
65
92
|
```bash
|
|
66
|
-
stellavault draft "AI"
|
|
67
|
-
stellavault draft "AI" --
|
|
68
|
-
stellavault draft "AI" --
|
|
69
|
-
stellavault draft --format outline # All-knowledge outline
|
|
93
|
+
stellavault draft "AI" --format blog # Blog post from your vault
|
|
94
|
+
stellavault draft "AI" --format outline # Structured outline
|
|
95
|
+
stellavault draft "AI" --ai # Claude API enhanced ($0.03)
|
|
70
96
|
```
|
|
71
97
|
|
|
72
|
-
Or in
|
|
98
|
+
Or use the **Express tab** in the desktop app — enter a topic, pick a format, and generate a draft grounded in your vault. Save to `_drafts/` and edit inline.
|
|
73
99
|
|
|
74
|
-
|
|
100
|
+
---
|
|
75
101
|
|
|
76
|
-
|
|
77
|
-
Session → session-save → daily-log → flush → wiki
|
|
78
|
-
↑ ↓
|
|
79
|
-
└──── Claude reads wiki via MCP (20 tools) ←─┘
|
|
80
|
-
```
|
|
102
|
+
## Intelligence (What Makes Stellavault Unique)
|
|
81
103
|
|
|
82
|
-
|
|
104
|
+
These features do **not exist** in Obsidian — even with plugins.
|
|
83
105
|
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
stellavault
|
|
106
|
+
| Feature | Command / Desktop | Description |
|
|
107
|
+
|---------|-------------------|-------------|
|
|
108
|
+
| **Memory Decay** | `stellavault decay` / Memory tab | FSRS-based — shows which real notes you are forgetting |
|
|
109
|
+
| **Knowledge Gaps** | `stellavault gaps` | Detects weak connections between topic clusters |
|
|
110
|
+
| **Contradictions** | `stellavault contradictions` | Finds conflicting statements across your vault |
|
|
111
|
+
| **Duplicates** | `stellavault duplicates` | Near-identical notes with similarity score |
|
|
112
|
+
| **Health Check** | `stellavault lint` | Aggregated vault health score (0–100) |
|
|
113
|
+
| **Learning Path** | `stellavault learn` | AI-personalized review recommendations |
|
|
114
|
+
| **Daily Brief** | Desktop app home screen | Push-type: top decaying notes + stats on app open |
|
|
115
|
+
| **Auto-Tagging** | Automatic on ingest | Content-based keyword extraction + category rules |
|
|
116
|
+
| **Self-Compiling** | `stellavault compile` | raw/ → _wiki/ with extracted concepts + backlinks |
|
|
90
117
|
|
|
91
|
-
|
|
92
|
-
# See: docs/hooks-setup.md
|
|
93
|
-
```
|
|
118
|
+
---
|
|
94
119
|
|
|
95
|
-
##
|
|
120
|
+
## MCP Integration (21 Tools)
|
|
96
121
|
|
|
97
122
|
```bash
|
|
98
|
-
|
|
99
|
-
stellavault brief # Morning knowledge briefing
|
|
100
|
-
stellavault decay # What's fading from memory?
|
|
101
|
-
stellavault lint # Health score (0-100)
|
|
102
|
-
stellavault learn # AI learning path
|
|
103
|
-
stellavault flush # Daily logs → wiki compilation
|
|
104
|
-
stellavault digest --visual # Weekly Mermaid chart report
|
|
123
|
+
claude mcp add stellavault -- stellavault serve
|
|
105
124
|
```
|
|
106
125
|
|
|
107
|
-
|
|
126
|
+
Claude can search, ask, draft, lint, and analyze your vault directly.
|
|
108
127
|
|
|
109
128
|
| Tool | What it does |
|
|
110
129
|
|------|-------------|
|
|
111
|
-
| `search` | Hybrid
|
|
112
|
-
| `ask` | Q&A
|
|
113
|
-
| `generate-draft` |
|
|
114
|
-
| `get-
|
|
115
|
-
| `get-related` | Semantically similar documents |
|
|
116
|
-
| `list-topics` | Topic cloud |
|
|
117
|
-
| `get-decay-status` | Memory decay report |
|
|
118
|
-
| `get-morning-brief` | Daily knowledge briefing |
|
|
119
|
-
| `get-learning-path` | AI learning recommendations |
|
|
130
|
+
| `search` | Hybrid BM25 + vector + RRF |
|
|
131
|
+
| `ask` | Vault-grounded Q&A |
|
|
132
|
+
| `generate-draft` | AI drafts from your knowledge |
|
|
133
|
+
| `get-decay-status` | Memory decay report (FSRS) |
|
|
120
134
|
| `detect-gaps` | Knowledge gap analysis |
|
|
121
|
-
| `get-evolution` | Semantic drift tracking |
|
|
122
|
-
| `link-code` | Code-knowledge connections |
|
|
123
135
|
| `create-knowledge-node` | AI creates wiki-quality notes |
|
|
124
|
-
| `
|
|
125
|
-
|
|
|
126
|
-
| `create-snapshot` / `load-snapshot` | Context snapshots |
|
|
127
|
-
| `generate-claude-md` | Auto-generate CLAUDE.md |
|
|
128
|
-
| `export` | JSON/CSV export |
|
|
129
|
-
| `federated-search` | P2P federated search |
|
|
136
|
+
| `federated-search` | P2P search across vaults |
|
|
137
|
+
| + 14 more | Documents, topics, decisions, snapshots, export |
|
|
130
138
|
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
```bash
|
|
134
|
-
stellavault session-save # Capture session summary to daily log
|
|
135
|
-
stellavault flush # Daily logs → wiki (Karpathy compile)
|
|
136
|
-
stellavault promote note.md --to lit # Upgrade note stage
|
|
137
|
-
stellavault autopilot # Full cycle: inbox → compile → lint → archive
|
|
138
|
-
```
|
|
139
|
-
|
|
140
|
-
## Zettelkasten (Luhmann + Karpathy)
|
|
141
|
-
|
|
142
|
-
```bash
|
|
143
|
-
stellavault fleeting "raw idea" # → raw/
|
|
144
|
-
stellavault ingest report.pdf # → auto text extract → raw/
|
|
145
|
-
stellavault compile # → raw/ → _wiki/ (concepts + backlinks)
|
|
146
|
-
stellavault promote note.md --to permanent # Upgrade stage
|
|
147
|
-
stellavault autopilot # Full cycle: inbox → compile → lint → archive
|
|
148
|
-
```
|
|
149
|
-
|
|
150
|
-
- **3-stage flow**: fleeting → literature → permanent
|
|
151
|
-
- **Luhmann index codes**: auto-assigned (1A → 1A1)
|
|
152
|
-
- **Frontmatter-first scanning**: 10x token reduction
|
|
153
|
-
- **Configurable folders**: override raw/_wiki/_literature/ in `.stellavault.json`
|
|
154
|
-
|
|
155
|
-
```json
|
|
156
|
-
{
|
|
157
|
-
"vaultPath": "/path/to/vault",
|
|
158
|
-
"folders": {
|
|
159
|
-
"fleeting": "01-Inbox",
|
|
160
|
-
"literature": "02-Reading",
|
|
161
|
-
"permanent": "03-Notes",
|
|
162
|
-
"wiki": "04-Wiki"
|
|
163
|
-
}
|
|
164
|
-
}
|
|
165
|
-
```
|
|
166
|
-
|
|
167
|
-
## Intelligence
|
|
168
|
-
|
|
169
|
-
| Feature | Command |
|
|
170
|
-
|---------|---------|
|
|
171
|
-
| FSRS Decay | `sv decay` — spaced repetition memory tracking |
|
|
172
|
-
| Gap Detection | `sv gaps` — missing connections between topics |
|
|
173
|
-
| Contradictions | `sv contradictions` — conflicting statements |
|
|
174
|
-
| Duplicates | `sv duplicates` — redundant notes |
|
|
175
|
-
| Learning Path | `sv learn` — AI review recommendations |
|
|
176
|
-
| Code Linker | MCP `link-code` — connect code to knowledge |
|
|
139
|
+
---
|
|
177
140
|
|
|
178
141
|
## 3D Visualization
|
|
179
142
|
|
|
180
|
-
- Neural graph with cluster coloring
|
|
143
|
+
- Neural graph with cluster coloring (React Three Fiber)
|
|
181
144
|
- Constellation view (MST star patterns)
|
|
182
|
-
- Heatmap overlay
|
|
183
|
-
-
|
|
184
|
-
- Decay overlay (fading knowledge)
|
|
185
|
-
- **Multiverse view** — your vault as a universe in a P2P network
|
|
145
|
+
- Heatmap overlay + Timeline slider + Decay overlay
|
|
146
|
+
- Multiverse view — your vault as a universe in a P2P network
|
|
186
147
|
- Dark/Light theme
|
|
187
|
-
- Mobile responsive + PWA installable
|
|
188
148
|
|
|
189
|
-
|
|
149
|
+
---
|
|
190
150
|
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
</p>
|
|
151
|
+
## Getting Started Guide
|
|
152
|
+
|
|
153
|
+
### Desktop App
|
|
195
154
|
|
|
196
|
-
|
|
155
|
+
1. **Download** → Unzip → Run
|
|
156
|
+
2. First launch asks you to pick your notes folder
|
|
157
|
+
3. Your notes appear in the sidebar — click to open
|
|
158
|
+
4. Press `Ctrl+P` for quick file switching
|
|
159
|
+
5. Click ✦ in the title bar for AI panel (semantic search, stats, draft)
|
|
160
|
+
6. Click ◉ for 3D graph
|
|
197
161
|
|
|
198
|
-
|
|
162
|
+
### CLI
|
|
199
163
|
|
|
200
|
-
**From the CLI**:
|
|
201
164
|
```bash
|
|
202
|
-
|
|
203
|
-
stellavault
|
|
165
|
+
npm install -g stellavault
|
|
166
|
+
stellavault init # Setup wizard
|
|
167
|
+
stellavault search "machine learning" # Semantic search
|
|
168
|
+
stellavault ingest paper.pdf # Add knowledge
|
|
169
|
+
stellavault graph # 3D graph in browser
|
|
170
|
+
stellavault brief # Morning briefing
|
|
171
|
+
stellavault decay # What are you forgetting?
|
|
204
172
|
```
|
|
205
173
|
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
174
|
+
### Keyboard Shortcuts (Desktop)
|
|
175
|
+
|
|
176
|
+
| Shortcut | Action |
|
|
177
|
+
|----------|--------|
|
|
178
|
+
| `Ctrl+P` | Quick Switcher (fuzzy file search) |
|
|
179
|
+
| `Ctrl+Shift+P` | Command Palette (all actions) |
|
|
180
|
+
| `Ctrl+S` | Save current note |
|
|
181
|
+
| `Ctrl+\` | Toggle split view |
|
|
182
|
+
| `Ctrl+B` | Bold |
|
|
183
|
+
| `Ctrl+I` | Italic |
|
|
184
|
+
| `Ctrl+U` | Underline |
|
|
185
|
+
| `Ctrl+E` | Inline code |
|
|
186
|
+
| `/` | Slash commands (at start of line) |
|
|
187
|
+
| `[[` | Wikilink autocomplete |
|
|
188
|
+
|
|
189
|
+
### Quick Reference
|
|
190
|
+
|
|
191
|
+
| Action | Desktop | CLI |
|
|
192
|
+
|--------|---------|-----|
|
|
193
|
+
| Search notes | Ctrl+P or AI panel | `stellavault search "query"` |
|
|
194
|
+
| Add a note | + Note button or drag & drop | `stellavault ingest "text"` |
|
|
195
|
+
| See 3D graph | ◉ button | `stellavault graph` |
|
|
196
|
+
| Memory decay | AI panel → Memory | `stellavault decay` |
|
|
197
|
+
| Generate draft | AI panel → Draft | `stellavault draft "topic"` |
|
|
198
|
+
| Health check | AI panel → Stats | `stellavault lint` |
|
|
199
|
+
|
|
200
|
+
---
|
|
214
201
|
|
|
215
202
|
## Tech Stack
|
|
216
203
|
|
|
217
204
|
| Layer | Tech |
|
|
218
205
|
|-------|------|
|
|
206
|
+
| Desktop | Electron + React + TipTap (15 extensions) + Zustand |
|
|
219
207
|
| Runtime | Node.js 20+ (ESM, TypeScript) |
|
|
220
|
-
| Vector Store | SQLite-vec (local,
|
|
221
|
-
| Embedding |
|
|
208
|
+
| Vector Store | SQLite-vec (local, zero config) |
|
|
209
|
+
| Embedding | MiniLM-L12-v2 (local, 50+ languages, batch processing) |
|
|
222
210
|
| Search | BM25 + Cosine + RRF Fusion |
|
|
223
|
-
|
|
|
224
|
-
|
|
|
211
|
+
| Math | KaTeX (inline + display) |
|
|
212
|
+
| Code | lowlight / highlight.js (40+ languages) |
|
|
225
213
|
| 3D | React Three Fiber + Three.js |
|
|
226
|
-
| AI | MCP (
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|----------|----------|
|
|
232
|
-
| **Capture** | ingest 14 formats (PDF/DOCX/PPTX/XLSX/JSON/CSV/XML/HTML/YAML/RTF/YouTube/URL/text), batch folders, web drag & drop, Quick Capture, mobile PWA |
|
|
233
|
-
| **Organize** | Zettelkasten 3-stage, auto index codes, wikilink auto-connect, configurable folders |
|
|
234
|
-
| **Distill** | compile (raw→wiki), lint (health score), gaps, contradictions, duplicates |
|
|
235
|
-
| **Express** | draft (blog/report/outline/instagram/thread/script), blueprint, --ai, MCP generate-draft |
|
|
236
|
-
| **Memory** | FSRS decay, session-save, flush, compounding loop, ADR templates |
|
|
237
|
-
| **Search** | hybrid (BM25+vector+RRF), multilingual 50+, ask Q&A, quotes mode |
|
|
238
|
-
| **Visualize** | 3D graph, heatmap, timeline, right-click context menu, TipTap WYSIWYG editor |
|
|
239
|
-
| **AI Integration** | 21 MCP tools, Claude Code hooks, Anthropic SDK |
|
|
240
|
-
| **Security** | DOMPurify, YAML sanitize, 50MB guard, SSRF protection |
|
|
241
|
-
| **CLI** | 40+ commands, `sv` alias, batch ingest |
|
|
214
|
+
| AI | MCP (21 tools) + Anthropic SDK |
|
|
215
|
+
| P2P | Hyperswarm (optional, differential privacy) |
|
|
216
|
+
| CI | GitHub Actions (Node 20 + 22) |
|
|
217
|
+
|
|
218
|
+
---
|
|
242
219
|
|
|
243
220
|
## Security
|
|
244
221
|
|
|
245
|
-
|
|
222
|
+
- **Local-first** — no data leaves your machine unless you use `--ai`
|
|
223
|
+
- **Vault files never modified** — indexes into SQLite, originals untouched
|
|
224
|
+
- **Electron sandbox enabled** — renderer runs with reduced OS privileges
|
|
225
|
+
- **IPC path validation** — all file operations stay inside vault root
|
|
226
|
+
- **API auth token** — per-session random token for mutating endpoints
|
|
227
|
+
- **SSRF protection** — private IPs blocked on URL ingest
|
|
228
|
+
- **E2E encryption** — AES-256-GCM for cloud sync
|
|
246
229
|
|
|
247
230
|
See [SECURITY.md](SECURITY.md) for full details.
|
|
248
231
|
|
|
232
|
+
## Troubleshooting
|
|
233
|
+
|
|
234
|
+
```bash
|
|
235
|
+
stellavault doctor # Check config, vault, DB, model, Node version
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
Common issues:
|
|
239
|
+
- **"Command not found"** → `npm i -g stellavault@latest`
|
|
240
|
+
- **"API server not found"** → `npx stellavault graph`
|
|
241
|
+
- **Empty graph** → `stellavault index`
|
|
242
|
+
- **Slow first run** → AI model downloads ~30MB once
|
|
243
|
+
|
|
249
244
|
## License
|
|
250
245
|
|
|
251
246
|
MIT — full source code available for audit.
|
|
252
247
|
|
|
253
248
|
## Links
|
|
254
249
|
|
|
250
|
+
- **[⬇ Download Desktop App](https://github.com/Evanciel/stellavault/releases/tag/desktop-v0.1.0)**
|
|
255
251
|
- [Landing Page](https://evanciel.github.io/stellavault/)
|
|
256
252
|
- [Obsidian Plugin](https://github.com/Evanciel/stellavault-obsidian)
|
|
257
253
|
- [npm](https://www.npmjs.com/package/stellavault)
|
package/SECURITY.md
CHANGED
|
@@ -39,6 +39,29 @@ Stellavault is **local-first**. Your knowledge stays on your machine.
|
|
|
39
39
|
- **URL validation**: Image URLs restricted to `https://` scheme
|
|
40
40
|
- **SSRF protection**: Private/local IP addresses blocked for URL ingest
|
|
41
41
|
|
|
42
|
+
## Desktop App Security (Electron)
|
|
43
|
+
|
|
44
|
+
- **Context Isolation**: enabled — renderer cannot access Node.js APIs
|
|
45
|
+
- **Sandbox**: enabled — renderer runs with reduced OS privileges
|
|
46
|
+
- **Node Integration**: disabled — no `require()` in renderer
|
|
47
|
+
- **IPC Allowlist**: explicit channel whitelist in preload (17 channels)
|
|
48
|
+
- **Path Validation**: all vault filesystem IPC handlers validate paths stay inside vault root
|
|
49
|
+
- **Auth Token**: API server generates per-session random token for all mutating endpoints
|
|
50
|
+
- **CSP**: strict Content Security Policy (no unsafe-eval in production)
|
|
51
|
+
|
|
52
|
+
## Federation Security
|
|
53
|
+
|
|
54
|
+
- **Embeddings only**: original text never transmitted over the network
|
|
55
|
+
- **Buffer limits**: 1MB per connection, 64KB per message
|
|
56
|
+
- **Message validation**: schema checking on all incoming messages
|
|
57
|
+
- **Leave authentication**: leave messages only accepted from the owning connection
|
|
58
|
+
- **Differential privacy**: noise added to shared embeddings
|
|
59
|
+
|
|
60
|
+
## Known Accepted Risks
|
|
61
|
+
|
|
62
|
+
- **LOW-03**: `data:` URIs allowed in desktop CSP for inline images in markdown editor
|
|
63
|
+
- **LOW-05**: Cloud sync uses Bearer token instead of AWS Signature v4 (R2-specific)
|
|
64
|
+
|
|
42
65
|
## Reporting Vulnerabilities
|
|
43
66
|
|
|
44
67
|
Please report security issues to: https://github.com/Evanciel/stellavault/issues (label: security)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import{c as q,g as K}from"./index-
|
|
1
|
+
import{c as q,g as K}from"./index-4LS6c1x8.js";function L(d,m){for(var w=0;w<m.length;w++){const f=m[w];if(typeof f!="string"&&!Array.isArray(f)){for(const a in f)if(a!=="default"&&!(a in d)){const j=Object.getOwnPropertyDescriptor(f,a);j&&Object.defineProperty(d,a,j.get?j:{enumerable:!0,get:()=>f[a]})}}}return Object.freeze(Object.defineProperty(d,Symbol.toStringTag,{value:"Module"}))}var F={},T;function Q(){return T||(T=1,(function(){function d(t){var e=0;return function(){return e<t.length?{done:!1,value:t[e++]}:{done:!0}}}var m=typeof Object.defineProperties=="function"?Object.defineProperty:function(t,e,o){return t==Array.prototype||t==Object.prototype||(t[e]=o.value),t};function w(t){t=[typeof globalThis=="object"&&globalThis,t,typeof window=="object"&&window,typeof self=="object"&&self,typeof q=="object"&&q];for(var e=0;e<t.length;++e){var o=t[e];if(o&&o.Math==Math)return o}throw Error("Cannot find global object")}var f=w(this);function a(t,e){if(e)t:{var o=f;t=t.split(".");for(var i=0;i<t.length-1;i++){var s=t[i];if(!(s in o))break t;o=o[s]}t=t[t.length-1],i=o[t],e=e(i),e!=i&&e!=null&&m(o,t,{configurable:!0,writable:!0,value:e})}}a("Symbol",function(t){function e(l){if(this instanceof e)throw new TypeError("Symbol is not a constructor");return new o(i+(l||"")+"_"+s++,l)}function o(l,n){this.g=l,m(this,"description",{configurable:!0,writable:!0,value:n})}if(t)return t;o.prototype.toString=function(){return this.g};var i="jscomp_symbol_"+(1e9*Math.random()>>>0)+"_",s=0;return e}),a("Symbol.iterator",function(t){if(t)return t;t=Symbol("Symbol.iterator");for(var e="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),o=0;o<e.length;o++){var i=f[e[o]];typeof i=="function"&&typeof i.prototype[t]!="function"&&m(i.prototype,t,{configurable:!0,writable:!0,value:function(){return j(d(this))}})}return t});function j(t){return t={next:t},t[Symbol.iterator]=function(){return this},t}function A(t){var e=typeof Symbol<"u"&&Symbol.iterator&&t[Symbol.iterator];return e?e.call(t):{next:d(t)}}function E(){this.i=!1,this.g=null,this.o=void 0,this.j=1,this.m=0,this.h=null}function S(t){if(t.i)throw new TypeError("Generator is already running");t.i=!0}E.prototype.l=function(t){this.o=t};function _(t,e){t.h={F:e,G:!0},t.j=t.m}E.prototype.return=function(t){this.h={return:t},this.j=this.m};function U(t){this.g=new E,this.h=t}function H(t,e){S(t.g);var o=t.g.g;return o?C(t,"return"in o?o.return:function(i){return{value:i,done:!0}},e,t.g.return):(t.g.return(e),b(t))}function C(t,e,o,i){try{var s=e.call(t.g.g,o);if(!(s instanceof Object))throw new TypeError("Iterator result "+s+" is not an object");if(!s.done)return t.g.i=!1,s;var l=s.value}catch(n){return t.g.g=null,_(t.g,n),b(t)}return t.g.g=null,i.call(t.g,l),b(t)}function b(t){for(;t.g.j;)try{var e=t.h(t.g);if(e)return t.g.i=!1,{value:e.value,done:!1}}catch(o){t.g.o=void 0,_(t.g,o)}if(t.g.i=!1,t.g.h){if(e=t.g.h,t.g.h=null,e.G)throw e.F;return{value:e.return,done:!0}}return{value:void 0,done:!0}}function I(t){this.next=function(e){return S(t.g),t.g.g?e=C(t,t.g.g.next,e,t.g.l):(t.g.l(e),e=b(t)),e},this.throw=function(e){return S(t.g),t.g.g?e=C(t,t.g.g.throw,e,t.g.l):(_(t.g,e),e=b(t)),e},this.return=function(e){return H(t,e)},this[Symbol.iterator]=function(){return this}}function G(t){function e(i){return t.next(i)}function o(i){return t.throw(i)}return new Promise(function(i,s){function l(n){n.done?i(n.value):Promise.resolve(n.value).then(e,o).then(l,s)}l(t.next())})}a("Promise",function(t){function e(n){this.h=0,this.i=void 0,this.g=[],this.o=!1;var r=this.j();try{n(r.resolve,r.reject)}catch(u){r.reject(u)}}function o(){this.g=null}function i(n){return n instanceof e?n:new e(function(r){r(n)})}if(t)return t;o.prototype.h=function(n){if(this.g==null){this.g=[];var r=this;this.i(function(){r.l()})}this.g.push(n)};var s=f.setTimeout;o.prototype.i=function(n){s(n,0)},o.prototype.l=function(){for(;this.g&&this.g.length;){var n=this.g;this.g=[];for(var r=0;r<n.length;++r){var u=n[r];n[r]=null;try{u()}catch(c){this.j(c)}}}this.g=null},o.prototype.j=function(n){this.i(function(){throw n})},e.prototype.j=function(){function n(c){return function(h){u||(u=!0,c.call(r,h))}}var r=this,u=!1;return{resolve:n(this.A),reject:n(this.l)}},e.prototype.A=function(n){if(n===this)this.l(new TypeError("A Promise cannot resolve to itself"));else if(n instanceof e)this.C(n);else{t:switch(typeof n){case"object":var r=n!=null;break t;case"function":r=!0;break t;default:r=!1}r?this.v(n):this.m(n)}},e.prototype.v=function(n){var r=void 0;try{r=n.then}catch(u){this.l(u);return}typeof r=="function"?this.D(r,n):this.m(n)},e.prototype.l=function(n){this.u(2,n)},e.prototype.m=function(n){this.u(1,n)},e.prototype.u=function(n,r){if(this.h!=0)throw Error("Cannot settle("+n+", "+r+"): Promise already settled in state"+this.h);this.h=n,this.i=r,this.h===2&&this.B(),this.H()},e.prototype.B=function(){var n=this;s(function(){if(n.I()){var r=f.console;typeof r<"u"&&r.error(n.i)}},1)},e.prototype.I=function(){if(this.o)return!1;var n=f.CustomEvent,r=f.Event,u=f.dispatchEvent;return typeof u>"u"?!0:(typeof n=="function"?n=new n("unhandledrejection",{cancelable:!0}):typeof r=="function"?n=new r("unhandledrejection",{cancelable:!0}):(n=f.document.createEvent("CustomEvent"),n.initCustomEvent("unhandledrejection",!1,!0,n)),n.promise=this,n.reason=this.i,u(n))},e.prototype.H=function(){if(this.g!=null){for(var n=0;n<this.g.length;++n)l.h(this.g[n]);this.g=null}};var l=new o;return e.prototype.C=function(n){var r=this.j();n.s(r.resolve,r.reject)},e.prototype.D=function(n,r){var u=this.j();try{n.call(r,u.resolve,u.reject)}catch(c){u.reject(c)}},e.prototype.then=function(n,r){function u(v,y){return typeof v=="function"?function(k){try{c(v(k))}catch(D){h(D)}}:y}var c,h,M=new e(function(v,y){c=v,h=y});return this.s(u(n,c),u(r,h)),M},e.prototype.catch=function(n){return this.then(void 0,n)},e.prototype.s=function(n,r){function u(){switch(c.h){case 1:n(c.i);break;case 2:r(c.i);break;default:throw Error("Unexpected state: "+c.h)}}var c=this;this.g==null?l.h(u):this.g.push(u),this.o=!0},e.resolve=i,e.reject=function(n){return new e(function(r,u){u(n)})},e.race=function(n){return new e(function(r,u){for(var c=A(n),h=c.next();!h.done;h=c.next())i(h.value).s(r,u)})},e.all=function(n){var r=A(n),u=r.next();return u.done?i([]):new e(function(c,h){function M(k){return function(D){v[k]=D,y--,y==0&&c(v)}}var v=[],y=0;do v.push(void 0),y++,i(u.value).s(M(v.length-1),h),u=r.next();while(!u.done)})},e});var N=typeof Object.assign=="function"?Object.assign:function(t,e){for(var o=1;o<arguments.length;o++){var i=arguments[o];if(i)for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(t[s]=i[s])}return t};a("Object.assign",function(t){return t||N});var z=this||self,R={facingMode:"user",width:640,height:480};function O(t,e){this.video=t,this.i=0,this.h=Object.assign(Object.assign({},R),e)}O.prototype.stop=function(){var t=this,e,o,i,s;return G(new I(new U(function(l){if(t.g){for(e=t.g.getTracks(),o=A(e),i=o.next();!i.done;i=o.next())s=i.value,s.stop();t.g=void 0}l.j=0})))},O.prototype.start=function(){var t=this,e;return G(new I(new U(function(o){return navigator.mediaDevices&&navigator.mediaDevices.getUserMedia||alert("No navigator.mediaDevices.getUserMedia exists."),e=t.h,o.return(navigator.mediaDevices.getUserMedia({video:{facingMode:e.facingMode,width:e.width,height:e.height}}).then(function(i){$(t,i)}).catch(function(i){var s="Failed to acquire camera feed: "+i;throw console.error(s),alert(s),i}))})))};function P(t){window.requestAnimationFrame(function(){J(t)})}function $(t,e){t.g=e,t.video.srcObject=e,t.video.onloadedmetadata=function(){t.video.play(),P(t)}}function J(t){var e=null;t.video.paused||t.video.currentTime===t.i||(t.i=t.video.currentTime,e=t.h.onFrame()),e?e.then(function(){P(t)}):P(t)}var x=["Camera"],g=z;x[0]in g||typeof g.execScript>"u"||g.execScript("var "+x[0]);for(var p;x.length&&(p=x.shift());)x.length||O===void 0?g[p]&&g[p]!==Object.prototype[p]?g=g[p]:g=g[p]={}:g[p]=O}).call(F)),F}var B=Q();const V=K(B),X=L({__proto__:null,default:V},[B]);export{X as c};
|