dirsql 0.4.10__tar.gz → 0.4.12__tar.gz

{dirsql-0.4.10 → dirsql-0.4.12}/Cargo.lock

@@ -500,7 +500,7 @@ dependencies = [
 
 [[package]]
 name = "dirsql-py-ext"
-version = "0.4.10"
+version = "0.4.12"
 dependencies = [
  "dirsql",
  "pyo3",

{dirsql-0.4.10 → dirsql-0.4.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirsql
-Version: 0.4.10
+Version: 0.4.12
 Requires-Dist: tomli>=2 ; python_full_version < '3.11'
 Summary: Ephemeral SQL index over a local directory
 Keywords: sql,filesystem,directory,sqlite,index

{dirsql-0.4.10 → dirsql-0.4.12}/docs/plugins.md

@@ -38,7 +38,7 @@ export DIRSQL_EMBEDDINGS_BASE_URL="https://api.openai.com"
 export DIRSQL_EMBEDDINGS_MODEL="text-embedding-3-small"
 export DIRSQL_EMBEDDINGS_API_KEY="sk-…"
 
-uvx --with dirsql-plugin-embeddings --with sqlite-vec dirsql server
+uvx --with dirsql-plugin-embeddings dirsql server
 ```
 
 The launcher finds the package through its `dirsql` entry point and injects
@@ -46,7 +46,7 @@ the shipped `dirsql.toml` fragment as an ordinary `-c` flag, composed after
 your own configs. The fragment declares three things:
 
 - the `sqlite-vec` extension (resolved from the installed `sqlite-vec`
-  package — hence the second `--with`), for `vec_distance_cosine()`;
+  package, which the plugin depends on), for `vec_distance_cosine()`;
 - the `documents` table (`path`, `text`, `embedding`), whose
   [`on-file`](./reference/hooks.md#on-file) hook embeds each matched file at
   index time;
@@ -59,7 +59,7 @@ Ask a question as a `{"q": …}` body — via `POST /query` against the server,
 or in one shot from the shell:
 
 ```sh
-uvx --with dirsql-plugin-embeddings --with sqlite-vec \
+uvx --with dirsql-plugin-embeddings \
   dirsql query '{"q": "how do I cook spaghetti?"}'
 # [{"path":"pasta.md","distance":0.113}, …]
 ```

{dirsql-0.4.10 → dirsql-0.4.12}/packages/python/Cargo.toml

@@ -4,7 +4,7 @@ name = "dirsql-py-ext"
 # pypi/maturin handler can rewrite it via `write-version` before
 # `maturin build`. `pyproject.toml` declares `dynamic = ["version"]`
 # and maturin reads this field. Mirrors `packages/rust/Cargo.toml`.
-version = "0.4.10"
+version = "0.4.12"
 # abi3 note: the `abi3-py310` pyo3 feature (below) builds ONE stable-ABI
 # `cp310-abi3` wheel per platform that loads on every CPython >= 3.10
 # (matching `pyproject.toml`'s `requires-python = ">=3.10"`), instead of
@@ -25,6 +25,18 @@ crate-type = ["cdylib", "rlib"]
 dirsql.workspace = true
 pyo3 = { version = "0.28", features = ["extension-module", "generate-import-lib", "abi3-py310"], optional = true }
 
+# Opted in per-crate rather than via `[lints] workspace = true`: the workspace
+# block also carries `clippy::pedantic`, which currently reports 475 warnings
+# across the three crates and would fail `clippy -D warnings` immediately
+# (#763).
+#
+# `deny`, not the workspace's aspirational `forbid`: pyo3's proc macros emit `#[allow(unsafe_code)]`, which `forbid`
+# rejects outright (E0453).
+# `deny` still blocks new hand-written `unsafe` unless a site opts in
+# explicitly, which is the guarantee we want.
+[lints.rust]
+unsafe_code = "deny"
+
 [features]
 default = []
 extension-module = ["pyo3/extension-module"]

dirsql-0.4.12/packages/python/changelog.d/2026-08-03-manylinux-dynamic-binary.md

@@ -0,0 +1,9 @@
+**Fixed** The manylinux wheel's bundled `dirsql` binary is now dynamically
+linked against glibc instead of static-pie musl, so SQLite extension loading
+(`[[dirsql.extension]]`, the embeddings plugin, `sqlite-vec`) works from the
+published PyPI artifact. A static-pie binary cannot `dlopen`, so every
+extension load failed with `Dynamic loading not supported` on Linux via
+`pip`/`uvx`. The linking change lands in the release pipeline
+(putitoutthere's `_matrix.yml` pypi `bundle_cli` lane); a PR-time
+extension-load probe in `release-precheck.yml` guards against regression.
+(#755)

{dirsql-0.4.10/packages/rust → dirsql-0.4.12/packages/python}/docs/plugins.md

@@ -38,7 +38,7 @@ export DIRSQL_EMBEDDINGS_BASE_URL="https://api.openai.com"
 export DIRSQL_EMBEDDINGS_MODEL="text-embedding-3-small"
 export DIRSQL_EMBEDDINGS_API_KEY="sk-…"
 
-uvx --with dirsql-plugin-embeddings --with sqlite-vec dirsql server
+uvx --with dirsql-plugin-embeddings dirsql server
 ```
 
 The launcher finds the package through its `dirsql` entry point and injects
@@ -46,7 +46,7 @@ the shipped `dirsql.toml` fragment as an ordinary `-c` flag, composed after
 your own configs. The fragment declares three things:
 
 - the `sqlite-vec` extension (resolved from the installed `sqlite-vec`
-  package — hence the second `--with`), for `vec_distance_cosine()`;
+  package, which the plugin depends on), for `vec_distance_cosine()`;
 - the `documents` table (`path`, `text`, `embedding`), whose
   [`on-file`](./reference/hooks.md#on-file) hook embeds each matched file at
   index time;
@@ -59,7 +59,7 @@ Ask a question as a `{"q": …}` body — via `POST /query` against the server,
 or in one shot from the shell:
 
 ```sh
-uvx --with dirsql-plugin-embeddings --with sqlite-vec \
+uvx --with dirsql-plugin-embeddings \
   dirsql query '{"q": "how do I cook spaghetti?"}'
 # [{"path":"pasta.md","distance":0.113}, …]
 ```

dirsql-0.4.12/packages/python/e2e-attestations/claude-763-forbid-unsafe.json

@@ -0,0 +1,7 @@
+{
+  "command": "uv run python -m pytest tests/e2e/ -x -q",
+  "ran_at": 1785791343,
+  "exit_code": 0,
+  "commit": "b1b8d2b6b2a200ba4d4aa844221dd7b8e85da92c",
+  "branch": "claude/763-forbid-unsafe"
+}

{dirsql-0.4.10 → dirsql-0.4.12}/packages/rust/Cargo.toml

@@ -74,6 +74,20 @@ toml = "0.8"
 wait-timeout = "0.2"
 walkdir = "2"
 
+# Opted in per-crate rather than via `[lints] workspace = true`: the workspace
+# block also carries `clippy::pedantic`, which currently reports 475 warnings
+# across the three crates and would fail `clippy -D warnings` immediately
+# (#763). This is the lint whose absence actually mattered -- it forbids
+# nothing until a crate opts in.
+[lints.rust]
+# `deny`, not `forbid`: rusqlite's API imposes five unavoidable `unsafe`
+# sites (the `load_extension` guard and four `unsafe impl VTab`/`VTabCursor`).
+# `forbid` cannot be overridden at all, so it would make the crate
+# uncompilable; `deny` blocks new `unsafe` unless a site opts in explicitly
+# with `#[expect(unsafe_code, reason = ...)]`, which is the guarantee we
+# actually want (#763).
+unsafe_code = "deny"
+
 [[bin]]
 name = "dirsql"
 path = "src/bin/dirsql.rs"

{dirsql-0.4.10/packages/python → dirsql-0.4.12/packages/rust}/docs/plugins.md

@@ -38,7 +38,7 @@ export DIRSQL_EMBEDDINGS_BASE_URL="https://api.openai.com"
 export DIRSQL_EMBEDDINGS_MODEL="text-embedding-3-small"
 export DIRSQL_EMBEDDINGS_API_KEY="sk-…"
 
-uvx --with dirsql-plugin-embeddings --with sqlite-vec dirsql server
+uvx --with dirsql-plugin-embeddings dirsql server
 ```
 
 The launcher finds the package through its `dirsql` entry point and injects
@@ -46,7 +46,7 @@ the shipped `dirsql.toml` fragment as an ordinary `-c` flag, composed after
 your own configs. The fragment declares three things:
 
 - the `sqlite-vec` extension (resolved from the installed `sqlite-vec`
-  package — hence the second `--with`), for `vec_distance_cosine()`;
+  package, which the plugin depends on), for `vec_distance_cosine()`;
 - the `documents` table (`path`, `text`, `embedding`), whose
   [`on-file`](./reference/hooks.md#on-file) hook embeds each matched file at
   index time;
@@ -59,7 +59,7 @@ Ask a question as a `{"q": …}` body — via `POST /query` against the server,
 or in one shot from the shell:
 
 ```sh
-uvx --with dirsql-plugin-embeddings --with sqlite-vec \
+uvx --with dirsql-plugin-embeddings \
   dirsql query '{"q": "how do I cook spaghetti?"}'
 # [{"path":"pasta.md","distance":0.113}, …]
 ```

{dirsql-0.4.10 → dirsql-0.4.12}/packages/rust/src/db.rs

@@ -327,6 +327,10 @@ impl Db {
     /// call via [`rusqlite::LoadExtensionGuard`] and disabled again on return,
     /// so the SQL `load_extension()` function is never left exposed to later
     /// queries. A missing or unloadable file surfaces as [`DbError::Sqlite`].
+    #[expect(
+        unsafe_code,
+        reason = "rusqlite's load_extension API is unsafe by design"
+    )]
     pub fn load_extension(&self, path: &Path, entrypoint: Option<&str>) -> Result<()> {
         // SAFETY: loading an extension executes native code from `path`. The
         // path is operator-supplied configuration (a `[[dirsql.extension]]`

{dirsql-0.4.10 → dirsql-0.4.12}/packages/rust/src/parsed_vtab.rs

@@ -198,6 +198,7 @@ struct ParsedTab {
     rows: Vec<JsonRow>,
 }
 
+#[expect(unsafe_code, reason = "rusqlite requires VTab to be an unsafe trait")]
 unsafe impl<'vtab> VTab<'vtab> for ParsedTab {
     type Aux = ();
     type Cursor = ParsedTabCursor;
@@ -271,6 +272,10 @@ struct ParsedTabCursor {
     index: usize,
 }
 
+#[expect(
+    unsafe_code,
+    reason = "rusqlite requires VTabCursor to be an unsafe trait"
+)]
 unsafe impl VTabCursor for ParsedTabCursor {
     fn filter(
         &mut self,

{dirsql-0.4.10 → dirsql-0.4.12}/packages/rust/src/vtab.rs

@@ -197,6 +197,7 @@ struct PathTab {
     spec: Arc<ScanSpec>,
 }
 
+#[expect(unsafe_code, reason = "rusqlite requires VTab to be an unsafe trait")]
 unsafe impl<'vtab> VTab<'vtab> for PathTab {
     type Aux = ();
     type Cursor = PathTabCursor;
@@ -250,6 +251,10 @@ struct PathTabCursor {
     index: usize,
 }
 
+#[expect(
+    unsafe_code,
+    reason = "rusqlite requires VTabCursor to be an unsafe trait"
+)]
 unsafe impl VTabCursor for PathTabCursor {
     fn filter(
         &mut self,