🔒 [security] Replace MD5 with SHA-256 for text hashing

package.json

@@ -88,9 +88,11 @@
     "handlebars": "^4.7.8",
     "ora": "^8.0.1",
     "sqlite-vec": "^0.1.3",
-    "sqlite-vec-windows-x64": "^0.1.7-alpha.2",
     "zod": "^3.22.4"
   },
+  "optionalDependencies": {
+    "sqlite-vec-windows-x64": "^0.1.7-alpha.2"
+  },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.8",
     "@types/blessed": "^0.1.27",

src/agent-system/todolist-manager.ts

@@ -520,7 +520,7 @@ All tasks for "${session.name}" completed at ${session.updatedAt}.
     let name = 'Unknown Session';
     let status: TodoSession['status'] = 'active';
     let createdAt = new Date().toISOString();
-    let updatedAt = new Date().toISOString();
+    const updatedAt = new Date().toISOString();
 
     const tasks: TodoTask[] = [];
 
@@ -543,7 +543,7 @@ All tasks for "${session.name}" completed at ${session.updatedAt}.
       if (createdMatch) createdAt = createdMatch[1];
 
       // Parse tasks
-      const taskMatch = line.match(/^[\[\~x\s\-\]]\s+Task\s+([a-f0-9]+):\s*(.+)$/);
+      const taskMatch = line.match(/^[\x5b~x\s\-\x5d]\s+Task\s+([a-f0-9]+):\s*(.+)$/);
       if (taskMatch) {
         const taskId = taskMatch[1];
         const subject = taskMatch[2];

src/cli/repl/index.ts

@@ -5,6 +5,8 @@
  */
 
 import readline from 'readline';
+import fs from 'fs';
+import path from 'path';
 import { REPLSessionManager, ProjectType } from './core/session.js';
 import { REPLCommandParser } from './core/parser.js';
 import { InitWizard } from './init/wizard.js';
@@ -210,10 +212,10 @@ export class REPLShell {
 
           // Index docs
           for (const doc of docs) {
-            const content = require('fs').readFileSync(doc.path, 'utf-8').slice(0, 50000);
+            const content = fs.readFileSync(doc.path, 'utf-8').slice(0, 50000);
             db.upsertItem({
               type: 'doc',
-              name: require('path').basename(doc.relativePath),
+              name: path.basename(doc.relativePath),
               content,
               filePath: doc.relativePath,
               metadata: { size: doc.size }
@@ -225,13 +227,13 @@ export class REPLShell {
 
           // Index code
           for (const codeFile of code.slice(0, 500)) {
-            const content = require('fs').existsSync(codeFile.path)
-              ? require('fs').readFileSync(codeFile.path, 'utf-8').slice(0, 20000)
+            const content = fs.existsSync(codeFile.path)
+              ? fs.readFileSync(codeFile.path, 'utf-8').slice(0, 20000)
               : '';
             if (content) {
               db.upsertItem({
                 type: 'code',
-                name: require('path').basename(codeFile.relativePath),
+                name: path.basename(codeFile.relativePath),
                 content,
                 filePath: codeFile.relativePath,
                 metadata: { size: codeFile.size }
@@ -244,13 +246,13 @@ export class REPLShell {
 
           // Index tools
           for (const tool of tools) {
-            const content = require('fs').existsSync(tool.path)
-              ? require('fs').readFileSync(tool.path, 'utf-8').slice(0, 50000)
+            const content = fs.existsSync(tool.path)
+              ? fs.readFileSync(tool.path, 'utf-8').slice(0, 50000)
               : '';
             if (content) {
               db.upsertItem({
                 type: 'tool_config',
-                name: `${tool.tool}:${require('path').basename(tool.relativePath)}`,
+                name: `${tool.tool}:${path.basename(tool.relativePath)}`,
                 content,
                 filePath: tool.relativePath,
                 metadata: { tool: tool.tool, size: tool.size }

src/cli/repl/tui/panels/config.ts

@@ -288,7 +288,7 @@ export class ConfigPanel {
           default: String(currentValue || key.defaultValue || '')
         });
 
-      case 'number':
+      case 'number': {
         const inputResult = await input({
           message: key.description,
           default: String(currentValue || key.defaultValue || ''),
@@ -298,6 +298,7 @@ export class ConfigPanel {
           }
         });
         return Number(inputResult);
+      }
 
       default:
         return currentValue;

src/cli/repl/tui/panels/drift.ts

@@ -6,6 +6,7 @@
 
 import fs from 'fs';
 import path from 'path';
+import { execSync } from 'child_process';
 import chalk from 'chalk';
 import { K0NTEXT_THEME } from '../theme.js';
 import { DatabaseClient } from '../../../../db/client.js';
@@ -212,7 +213,7 @@ export class DriftDetectionPanel {
 
     try {
       // Use git diff to check for changes
-      const { execSync } = require('child_process');
+      // execSync is now imported from child_process
 
       // Check for modified files
       const modified = execSync('git diff --name-only', {

src/cli/repl/tui/panels/search.ts

@@ -183,16 +183,18 @@ export class AdvancedSearchPanel {
         case 'name':
           comparison = a.item.name.localeCompare(b.item.name);
           break;
-        case 'date':
+        case 'date': {
           const aDate = a.item.updatedAt ? new Date(a.item.updatedAt).getTime() : 0;
           const bDate = b.item.updatedAt ? new Date(b.item.updatedAt).getTime() : 0;
           comparison = bDate - aDate;
           break;
-        case 'size':
+        }
+        case 'size': {
           const aSize = (a.item.metadata as Record<string, unknown>)?.size || 0;
           const bSize = (b.item.metadata as Record<string, unknown>)?.size || 0;
           comparison = Number(bSize) - Number(aSize);
           break;
+        }
       }
 
       return order === 'desc' ? -comparison : comparison;

src/embeddings/openrouter.ts

@@ -564,7 +564,7 @@ Be specific and actionable in your suggestions.`
    * Hash text for caching
    */
   private hashText(text: string): string {
-    return createHash('md5').update(text).digest('hex');
+    return createHash('sha256').update(text).digest('hex');
   }
 }
 

src/template-sync/engine.ts

@@ -95,7 +95,7 @@ export class TemplateSyncEngine {
       const stats = TemplateMerger.getStatistics(mergeResults);
 
       // Step 4: Handle conflicts
-      let conflictResolutions = new Map<string, 'keep-local' | 'overwrite'>();
+      const conflictResolutions = new Map<string, 'keep-local' | 'overwrite'>();
       let resolvedConflicts: FileComparison[] = [];
 
       if (conflicts.length > 0 && !options.force) {