electron-rare/kxkm_clown
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d2fed6087a0f7097cef47e0fcc29201e35fad058
kxkm_clown/docs/AUDIT_2026-03-19.md
T
L'électron rare d2fed6087a feat: Add MCP server and smoke test scripts 
- Introduced `mcp-server.js` to expose KXKM personas as MCP tools, supporting chat, persona listing, web search, and status checks.
- Implemented `mcp-server-smoke.js` for testing the MCP server functionality, ensuring compatibility with both new and legacy message formats.
- Created `setup-voice-clone.sh` for managing voice cloning environment setup, including bootstrapping, sample generation, and smoke testing.
- Added `state.json` to track project status and task outputs for various batches.
- Generated summary files for deep cycle and overall project status, capturing performance and security findings.
2026-03-19 16:18:44 +01:00

4.4 KiB
Raw Blame History

Deep Audit 2026-03-19

Analyse exhaustive par 3 agents paralleles (backend, frontend, packages) + veille OSS.

Resultats validation

  • check:v2: OK (TypeScript vert)
  • test:v2: 204 tests, 0 fail, 320ms

Metriques globales

Couche LOC Tests LOC Couverture estimee
apps/api 5 254 1 004 ~45%
apps/web 6 454 374 ~10%
apps/worker 986 230 ~20%
packages 2 853 2 162 ~72%
Total ~15 547 ~3 770 ~40%

Hotspots identifies

Backend (P1)

Fichier LOC Complexite Probleme
ws-conversation-router.ts 358 Tres haute Race condition persona locks, memory leak maps unbounded
ws-ollama.ts 303 Tres haute Semaphore manuel, queue starvation, JSON streaming fragile
context-store.ts 435 Haute RAM unbounded en compaction, deadlock potentiel
worker-runtime.ts 564 Tres haute Subprocess timeout cascade, signal handling absent
app.ts 538 Moyenne 7 repo factories inline, couplage fort

Frontend (P1)

Composant LOC Probleme
Chat.tsx 631 Monolithique, 10+ useState, getNickColor re-render
ChatHistory.tsx 601 Pagination complexe, pas de virtualisation
NodeEditor.tsx 406 Logique metier melee au rendu
VoiceChat.tsx 388 Memory leak recordingTimer, silenceTimer
ComposePage/ImaginePage 203/185 WS pattern duplique, progress bar simulee

Packages (P2)

Package Probleme
@kxkm/core createId race condition en worker threads
@kxkm/node-engine Hyperparams sans validation bounds, docker image hardcoded
@kxkm/persona-domain Extra keys non types, DPO pairs silent []
@kxkm/storage Types unsafe sur row mapping (pas de zod)
@kxkm/ui Zero tests

Vulnerabilites securite

# Severite Fichier Description
SEC-01 CRITICAL app-middleware.ts Cookie session sans Secure flag (HTTPS)
SEC-02 HIGH routes/session.ts Admin token plaintext en env vars
SEC-03 MEDIUM ws-upload-handler.ts MIME type validation contournable (header, pas magic bytes)
SEC-04 MEDIUM /api/session/login Pas de rate limiting (brute force)
SEC-05 LOW ws-ollama.ts Tool execution sans whitelist / sandbox inputs

Refactoring prioritaire

Tier 1 — Immediat

  1. Secure flag cookie (5 min) — app-middleware.ts
  2. Rate limit login (1h) — routes/session.ts
  3. MIME magic bytes validation (30 min) — ws-upload-handler.ts, lib file-type
  4. VoiceChat timer cleanup (30 min) — recordingTimerRef + silenceTimerRef
  5. Chat.tsx getNickColor useCallback (15 min) — reduire re-renders 50%

Tier 2 — Sprint suivant

  1. Decouper Chat.tsx en ChatMessages + ChatInput + ChatSidebar (2-3j)
  2. Remplacer semaphore manuel par p-limit dans ws-ollama.ts (1h)
  3. Input validation schemas (zod) sur endpoints API (4h)
  4. Storage row mapping runtime validation (4h)
  5. Tests Chat.tsx + VoiceChat.tsx (2j)

Tier 3 — Moyen terme

  1. Virtualisation chat messages (react-window)
  2. Worker strategy pattern pour node executors
  3. Error telemetry (Sentry ou equivalent)
  4. A11y pass WCAG 2.1 AA (labels, focus, contrast)
  5. Integration test suite end-to-end

Veille OSS — Nouvelles decouvertes mars 2026

Projet Pertinence Notes
Qwen3-TTS (Alibaba) P2 0.6B-1.7B, clone voix 3s, 10 langues, Apache 2.0
Pocket TTS (Kyutai) P3 100M params, CPU temps reel, voice cloning
NexusRAG P3 Hybrid: vector + LightRAG + Docling + Ollama
AgoraAI P2 Multi-persona voice-to-voice, dual-queue async
webgl-crt-shader P3 GPU-accelere, plus authentique que vault66 CSS
LightRAG v1.4.11rc2 P1 Releases actives, Ollama natif, workspace isolation

Backlog mis a jour

Lot 15 (en cours) — 2/4 done

  • persona-domain-seams
  • node-engine-seams (registry.ts extrait)
  • storage-test-split
  • web-chat-modularization (Chat.tsx → seams)

Backlog Phase 7+

  1. Chatterbox TTS deploiement production (P1)
  2. LightRAG v1.4.11 integration (P1)
  3. Secure flag + rate limit login (P1 securite)
  4. Chat.tsx modularisation (lot 15)
  5. Tests couverture >60% (Chat, VoiceChat, ws-ollama)
  6. vault66 ou webgl-crt-shader (P3)
  7. AgoraAI etude architecture (P3)
  8. Qwen3-TTS evaluation (P2)
Reference in New Issue View Git Blame Copy Permalink