Argentum

The project maintains all released versions on GitHub Releases page. Each release includes installer (.exe, .msi) and release notes describing changes. Users can download any previous version if needed. https://github.com/AG064/argentum/releases

The project uses GitHub Issues for tracking individual issues. https://github.com/AG064/argentum/issues

The project has not received external vulnerability reports in the last 12 months. The documented issue (RUSTSEC-2024-0429) is an upstream dependency vulnerability in glib, not a report from a user. No third-party reporters require credit. https://github.com/AG064/argentum/blob/main/SECURITY.md

SECURITY.md "Reporting Security Issues" section includes:

• GitHub Security Advisories для private reporting
• Maintainer contact: AG064 (GitHub)
• Expected response: acknowledgment within 24-48 hours, fix timeline based on severity
• Clear method for reporting vulnerabilities
• Coordinated disclosure process documented [osps_vm_01_01]
  https://github.com/AG064/argentum/blob/main/SECURITY.md

The project documents its coding standards in CONTRIBUTING.md, referencing Prettier for formatting, Google TypeScript Style Guide as the named reference, and typescript-eslint for linting. Contributions must pass npm run lint and npm run format. https://github.com/AG064/argentum/blob/main/CONTRIBUTING.md

The project enforces coding style via typescript-eslint in CI and via husky + lint-staged as a pre-commit hook. When contributors commit, lint-staged runs prettier --write and eslint --fix on staged files automatically. CI also runs npm run lint on every push. https://github.com/AG064/argentum/blob/main/package.json

Argentum is a Tauri desktop application. The build system uses Cargo for Rust and npm for TypeScript. Cargo automatically passes environment variables (CC, CFLAGS, CXXFLAGS, LDFLAGS) to the Rust compiler. The npm build wraps Cargo. No special configuration is needed for environment variables to be honored. https://github.com/AG064/argentum/blob/main/src/desktop/Cargo.toml

Argentum is a Tauri desktop application. Cargo (Rust) build system honors environment variables. Release builds use strip = true by default, but debug profiles preserve symbols. This is a SHOULD-level criterion for projects producing binaries where users may need debugging. https://github.com/AG064/argentum/blob/main/src/desktop/Cargo.toml

Cargo (Rust) builds the entire workspace at once with correct dependency resolution, not recursively. npm also handles TypeScript/JS dependencies correctly. Neither uses recursive make. https://github.com/AG064/argentum/blob/main/src/desktop/Cargo.toml

The project uses lockfiles (Cargo.lock, package-lock.json) to pin dependency versions. Source code + lockfiles + same toolchain = reproducible builds. Tauri also embeds some build metadata (git commit hash, build timestamp) which may vary, but core artifacts are reproducible from source.

The project provides Windows installer (.exe, .msi) and tarball archives for each release, following standard conventions. npm install works for the TypeScript package. Docker image is also available. https://github.com/AG064/argentum/releases

Linux and macOS are source-supported targets (no pre-built installers yet). The README states "Linux desktop packages are planned for release automation." Once installers are provided, DESTDIR would apply.

CONTRIBUTING.md now includes accurate build instructions:

• npm install for dependencies
• npm run build for production build
• npm run dev for watch mode
• npm run docker:build for Docker image
• npm run rebuild for clean rebuild
• Desktop app optional section with prepare:llama-server, desktop:dev, desktop:build
• All required libraries, SDKs, and dependencies documented [osps_do_07_01]

The project lists external dependencies in a computer-processable way:

• npm (package.json + package-lock.json) for Node.js/TypeScript dependencies
• Cargo (Cargo.toml + Cargo.lock) for Rust/Tauri desktop dependencies
• Dockerfile: RUN npm install pulls from package.json lockfile
• Standard lockfile tracking ensures reproducible builds https://github.com/AG064/argentum/blob/main/package.json

.github/workflows/dependency-scan.yml created:

• Runs on: push to development/main AND pull requests
• Runs npm audit --audit-level=high
• Runs Trivy scan on entire codebase (fs mode)
• Uploads results to GitHub Security tab (SARIF)
• Blocks merge if Critical/High vulnerabilities found (exit 1)
• Exceptions can be declared via .trivyignore or osv-scanner.toml

Policy documented in SECURITY_DEPENDENCY_NOTES.md SCA Remediation Policy section:

• Critical: 24h remediation
• High: 7 days
• Exceptions: documented in .trivyignore or per-CVE suppression

Branch protection ensures this check must pass before merge. [osps_vm_05_03]

package.json: direct npm dependencies
package-lock.json: locked dependency tree (npm ci compatible)
Cargo.toml: Rust dependencies for desktop subproject [osps_qa_02_01]

Удалил deprecated type aliases из mcp/types.ts. Lint прошел. Push на AGX.

Justification: The project avoids deprecated interfaces — the few @deprecated markers were internal compatibility aliases that have been removed. No deprecated external APIs are in use.

• ci.yml: runs npm run typecheck && npm run lint && npm run test:ci on every push/PR
• npm run test:ci uses Jest with coverage (text-summary, lcov)
• Contributors can run locally: npm test, npm run test:unit, npm run test:integration
• Test results visible in GitHub Actions UI for all contributors
• Consistent environment: GitHub Actions ubuntu-latest [osps_qa_06_01]

he project enforces Conventional Commits via commitlint + husky hook. CONTRIBUTING.md documents the regression test policy for bugs. PR template includes commit type prefixes and requires test evidence. https://github.com/AG064/argentum/blob/main/CONTRIBUTING.md

The project has Jest coverage configured (npm run test:coverage). jest.config.js now requires 80% statement/branch/function/line coverage. ROADMAP.md documents the goal to reach 80% coverage. https://github.com/AG064/argentum/blob/main/jest.config.js

CONTRIBUTING.md "Test Policy for Major Changes" section exists:

• Defines what constitutes a major change (new features, API changes, bug fixes, security changes)
• Specifies what tests to add: unit tests for new functionality, regression tests for bug fixes
• States PR policy: new features require tests, regression tests required for bug fixes
• Acknowledges current thin coverage but commits to testing for major changes [osps_qa_06_03]

CONTRIBUTING.md "Test Policy for Major Changes" section exists:

• Defines what constitutes a major change (new features, API changes, bug fixes, security changes)
• Specifies what tests to add: unit tests for new functionality, regression tests for bug fixes
• States PR policy: new features require tests, regression tests required for bug fixes
• Acknowledges current thin coverage but commits to testing for major changes [osps_qa_06_03]

The project maximizes warning strictness: ESLint runs with TypeScript support and CI fails on errors. The project has moved from 16 lint errors to 0, and reduced warnings to zero as well. https://github.com/AG064/argentum

The project implements secure design principles. The policy engine uses default-deny (access decisions deny by default unless explicitly allowed). Allowlists enforce complete mediation — every access is checked. Installation is secure by default. Sandbox execution for untrusted code. https://github.com/AG064/argentum/blob/main/src/security/policy-engine/index.ts

Project uses SHA-256 and AES-256-GCM. No SHA-1, no CBC mode in SSH context. https://github.com/AG064/argentum

The project stores credentials in data/secrets.enc.json (separate from config). The master key comes from ARGENTUM_MASTER_KEY environment variable. Users can update/replace credentials without recompilation. https://github.com/AG064/argentum/blob/main/src/security/encrypted-secrets.ts

The project uses HTTPS/TLS for all external API calls (LLM providers: OpenAI, MiniMax, etc.). Local HTTP is only for localhost webchat interface. No insecure protocols (FTP, HTTP external, telnet, SSLv3) in use.

Node.js (v18+) supports TLS 1.2 and 1.3 by default. All HTTPS connections to LLM providers (OpenAI, MiniMax, etc.) use TLS 1.2+. No SSLv3 or TLS 1.0/1.1 in use.

Node.js https module performs TLS certificate verification by default. All API calls to LLM providers (OpenAI, MiniMax, etc.) use the default https agent which verifies certificates. No custom TLS configuration that disables verification.

Node.js performs TLS certificate verification by default before sending any data. The project does not send private information over TLS without verification. No custom code disables certificate verification.

cosign verify-blob command includes:
--certificate-identity-regexp "https://github.com/AG064/argentum"
--certificate-oidc-issuer https://token.actions.githubusercontent.com

This verifies:

• The binary was signed by GitHub Actions workflow in AG064/argentum repository
• The OIDC issuer is token.actions.githubusercontent.com (GitHub's Sigstore issuer)
• The certificate identity matches our repository URL

Documentation is in docs/releases/ (separate from .github/workflows/). [osps_do_03_02]

The project uses signed tags (git tag -v) for releases. v0.0.7 tag is cryptographically signed by the maintainer. https://github.com/AG064/argentum/releases/tag/v0.0.7

The project uses allowlist-based input validation throughout. The allowlists feature (src/features/allowlists/index.ts) enforces default-deny mode. URL validation checks against allowlist patterns. Policy engine validates all inputs before processing. https://github.com/AG064/argentum/blob/main/src/features/allowlists/index.ts

The project implements security hardening headers: Content-Security-Policy (CSP) with nonce, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, HSTS, Referrer-Policy, Permissions-Policy. Rust/Tauri provides additional memory safety via the Rust language. https://github.com/AG064/argentum/blob/main/src/core/security.ts

The project provides security documentation that serves as the assurance case: SECURITY.md documents the threat model, security requirements, and known issues. docs/architecture.md describes trust boundaries and system design. The threat model identifies key trust boundaries (user input, LLM providers, messaging channels). https://github.com/AG064/argentum/blob/main/SECURITY.md

Semgrep with --config=auto fetches the full Semgrep Registry including security-focused rules for TypeScript and JavaScript that detect common vulnerability patterns (SQL injection, XSS, insecure random, hardcoded credentials, etc.). https://github.com/AG064/argentum/blob/main/.github/workflows/semgrep.yml

Project's Rust code (src/desktop/) has no unsafe blocks in project code. unsafe-libyaml in Cargo.lock is a transitive dependency of serde_yaml, not project code. No ASAN/sanitizer configured because there is no unsafe code to check.