kxkm_clown/docs/AUDIT_2026-03-17.md

Deep Audit Report — 2026-03-17

"Le reel n'est jamais propre, mais il est toujours testable." -- electron rare

Scope

Audit complet du monorepo kxkm_clown + repo mascarade/core. 5 agents paralleles (api, web, packages, mascarade, v1+worker) + TUI deep-audit.js.

Metriques globales

Metrique	Valeur
Erreurs TypeScript	0
Tests	119 pass, 0 fail
Security findings P0	0 (apres corrections)
Fichiers >500 LOC	8
Packages outdated	2

Corrections appliquees (chirurgicales)

apps/api (P0)

Fix	Sev	Detail
Semaphore double-release PDF	P0	try/finally restructure, un seul releaseFileProcessor()
Path traversal voice-sample	P0	path.basename() + boundary check 3 endpoints
Analytics sans auth	P1	requirePermission("ops:read")
5x sync I/O handlers async	P2	fsp.writeFile/readFile/unlink

apps/web (P0)

Fix	Sev	Detail
Pas d'Error Boundary	P0	ErrorBoundary.tsx cree + integre dans App.tsx
Chat non accessible	P1	role="log" aria-live="polite"

packages (P0)

Fix	Sev	Detail
core createId() non-crypto	P0	Math.random → crypto.randomBytes(8) hex
auth timing leak verifyPassword	P0	Buffer padding avant timingSafeEqual
persona-domain applyPatches unsafe	P0	Allowlist fields + typeof type guard

Findings non-corriges (backlog)

apps/api — P1

• ws-chat.ts: 1449 LOC (refactoring planifie → 4 modules)
• app.ts: 1292 LOC (extraction routes planifiee)
• Persona memory race condition (concurrent updatePersonaMemory)
• Session expiration not enforced (no periodic cleanup)
• RAG O(n) linear search (candidat HNSW/Annoy)
• Context store unlimited concurrent compactions

apps/web — P1

• No React.memo on large components (Chat, ChatHistory, VoiceChat)
• No virtualization for message list (max 500 DOM nodes)
• Hash routing fragile (no route guards, no 404)
• Tab completion O(n) filtering on each keystroke
• WebSocket send silently fails if disconnected
• File upload no size validation before base64 encoding

packages — P1

• storage: 0 tests (P0 — couverture critique manquante)
• node-engine sandbox.ts: 0 tests
• node-engine training.ts: 0 tests
• chat-domain channel normalization returns empty string
• persona-domain extractJsonBlock greedy regex

mascarade (repo companion)

• server.py (52 KB), cluster.py (41 KB): fichiers volumineux
• MCP client FreeCAD sandboxing fragile (blocklist vs AST)
• P2P: deux implementations (asyncio vs libp2p) — maintenance burden
• 190+ settings dans config.py sans validation conflits

Fichiers complexite elevee

Fichier	LOC	Status
apps/api/src/ws-chat.ts	1449	refactoring planifie
apps/api/src/app.ts	1292	refactoring planifie
packages/persona-domain/src/index.ts	782	acceptable
packages/node-engine/src/index.ts	717	acceptable
apps/web/src/components/ChatHistory.tsx	602	a surveiller
apps/web/src/components/Chat.tsx	567	a surveiller
packages/storage/src/index.ts	551	acceptable
apps/worker/src/index.ts	548	acceptable

Findings V1 + Worker (agent 5/5)

V1 Code Quality: GOOD

• 27 modules V1 bien separes (chat-routing, commands, http-api, websocket, storage, etc.)
• smoke.js: 1199 lignes de tests d'integration comprehensive
• Ops TUI (health-check, queue-viewer, persona-manager, log-rotate): EXCELLENT quality

Issues V1

Issue	Sev	Detail
Memory leak channelHistory	P1	Map grows unbounded, no LRU eviction
Unhandled Promise in websocket.js	P1	Async handlers not awaited in some paths
Docker runs as root	P1	Missing USER node in Dockerfile
safeCompare() duplique	P2	commands.js + http-api.js (extract to util)
Dead code workspace-package.js	P2	Supprime (9 lignes, exports nothing)
ANSI helpers dupliques	P2	4+ scripts ops (consolider dans @kxkm/tui)
No graceful shutdown server.js	P2	Missing SIGTERM/SIGINT handlers

Mascarade (repo companion)

• Orchestrateur LLM sophistique: 15 providers, P2P, MCP, fine-tuning
• server.py (52 KB), cluster.py (41 KB): fichiers volumineux
• Integration KXKM: coexistence Docker, partage Ollama, MCP potentiel

Recommandations prioritaires

Immediat (lot 17 suite)

1. Refactoring ws-chat.ts → ws-multimodal.ts, ws-persona-router.ts, ws-commands.ts
2. Refactoring app.ts → routes/personas.ts, routes/node-engine.ts, routes/chat.ts
3. Tests storage — couverture minimale repos Postgres
4. Tests sandbox.ts + training.ts — couverture node-engine

Moyen terme (lot 18)

5. SearXNG dans docker-compose
6. Discord Pharmacius bot
7. React.memo + lazy load composants lourds
8. RAG: evaluer BGE-M3 embeddings

Long terme (lot 19+)

9. Virtualization messages chat (react-window)
10. HNSW index pour RAG search
11. MCP integration personas ↔ outils
12. XTTS-v2 voice cloning