🔒 Fix: Use strict UTF-8 string conversion for database password

.github/workflows/ci.yml

@@ -272,7 +272,7 @@ jobs:
           cargo nextest run --manifest-path crates/flow/Cargo.toml \
             --all-features \
             --test performance_regression_tests \
-            -- --nocapture
+            --no-capture
       - name: Check for regressions
         if: failure()
         run: |

REUSE.toml.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/CONSTITUTIONAL_COMPLIANCE_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/D1_CACHE_INTEGRATION_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/D1_HTTP_POOLING.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/D1_INTEGRATION_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/D1_PROFILING_BENCHMARKS.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/D1_PROFILING_BENCHMARKS_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/D1_SCHEMA_OPTIMIZATION.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DASHBOARD_CONFIGURATIONS_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DATABASE_OPTIMIZATION_PHASE1.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DATABASE_OPTIMIZATION_ROADMAP.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY16_17_TEST_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY18_DOCUMENTATION_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY19_DEPLOYMENT_OPS_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY20_MONITORING_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY21_CICD_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY22_SECURITY_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY23_PERFORMANCE_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY24_CAPACITY_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY25_DEPLOYMENT_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY26_MONITORING_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY27_PROFILING_COMPLETION.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY28_PHASE5_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAYS_13_14_EDGE_DEPLOYMENT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY_22_PRODUCTION_DEPLOYMENT_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/DAY_22_PRODUCTION_VALIDATION_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/EXTRACTOR_COVERAGE_MAP.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/EXTRACTOR_TESTS_SUMMARY.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/HOT_PATH_OPTIMIZATIONS_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/INCREMENTAL_UPDATE_SYSTEM_DESIGN.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/INFRASTRUCTURE_COVERAGE_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/IO_PROFILING_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/PHASE1_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/PHASE2C_BACKEND_INTEGRATION_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/PHASE2_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/PHASE5_COMPLETE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/PHASE5_QA_VALIDATION_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/PRODUCTION_VALIDATION_TESTS.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/REAL_WORLD_VALIDATION.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/RECOCO_INTEGRATION.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/RECOCO_PATTERN_REFACTOR.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/TASK_51_COMPLETION.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/TASK_58_COMPLETION_SUMMARY.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/profiling/HOT_PATHS_REFERENCE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/profiling/OPTIMIZATION_ROADMAP.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/profiling/PERFORMANCE_PROFILING_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/profiling/PROFILING_SUMMARY.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

claudedocs/profiling/README.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/ast-engine/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/ast-engine/src/tree_sitter/mod.rs

@@ -42,7 +42,8 @@
 //!
 //! ```rust,no_run
 //! # use thread_ast_engine::tree_sitter::{StrDoc, LanguageExt};
-//! # use thread_ast_engine::Language;
+//! # use thread_ast_engine::{Language, Doc};
+//! # #[derive(Clone, Debug)]
 //! # struct Tsx;
 //! # impl Language for Tsx {
 //! #     fn kind_to_id(&self, _: &str) -> u16 { 0 }
@@ -144,6 +145,8 @@ fn parse_lang(
 ///
 /// ```rust,no_run
 /// # use thread_ast_engine::tree_sitter::StrDoc;
+/// # use thread_ast_engine::Doc;
+/// # #[derive(Clone, Debug)]
 /// # struct JavaScript;
 /// # impl thread_ast_engine::Language for JavaScript {
 /// #     fn kind_to_id(&self, _: &str) -> u16 { 0 }

crates/ast-engine/src/tree_sitter/traversal.rs

@@ -26,6 +26,7 @@
 //! # use thread_ast_engine::tree_sitter::traversal::Visitor;
 //! # use thread_ast_engine::Language;
 //! # use thread_ast_engine::tree_sitter::LanguageExt;
+//! # #[derive(Clone, Debug)]
 //! # struct Tsx;
 //! # impl thread_ast_engine::Language for Tsx {
 //! #     fn kind_to_id(&self, _: &str) -> u16 { 0 }
@@ -56,6 +57,7 @@
 //! # use thread_ast_engine::tree_sitter::traversal::Visitor;
 //! # use thread_ast_engine::Language;
 //! # use thread_ast_engine::tree_sitter::LanguageExt;
+//! # #[derive(Clone, Debug)]
 //! # struct Tsx;
 //! # impl thread_ast_engine::Language for Tsx {
 //! #     fn kind_to_id(&self, _: &str) -> u16 { 0 }
@@ -71,7 +73,7 @@
 //! // Non-reentrant: only finds outer matches
 //! let outer_only: Vec<_> = Visitor::new("$FUNC($$$)")
 //!     .reentrant(false)
-//!     .visit(root)
+//!     .visit(root.clone())
 //!     .collect();
 //!
 //! // Reentrant: finds all matches including nested ones
@@ -117,6 +119,7 @@ use std::marker::PhantomData;
 /// # use thread_ast_engine::tree_sitter::traversal::Visitor;
 /// # use thread_ast_engine::Language;
 /// # use thread_ast_engine::tree_sitter::LanguageExt;
+/// # #[derive(Clone, Debug)]
 /// # struct Tsx;
 /// # impl thread_ast_engine::Language for Tsx {
 /// #     fn kind_to_id(&self, _: &str) -> u16 { 0 }

crates/flow/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/flow/claudedocs/LOAD_TEST_REPORT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/flow/claudedocs/PHASE4_COMPLETION_SUMMARY.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/flow/claudedocs/builder_testing_analysis.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/flow/src/incremental/backends/postgres.rs

@@ -101,7 +101,9 @@ impl PostgresIncrementalBackend {
             cfg.user = Some(user.to_string());
         }
         if let Some(password) = pg_config.get_password() {
-            cfg.password = Some(String::from_utf8_lossy(password).to_string());
+            let pwd_str = String::from_utf8(password.to_vec())
+                .map_err(|e| StorageError::Backend(format!("Invalid UTF-8 in password: {e}")))?;
+            cfg.password = Some(pwd_str);
         }
         if let Some(dbname) = pg_config.get_dbname() {
             cfg.dbname = Some(dbname.to_string());

crates/language/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/language/src/html.rs

@@ -34,7 +34,8 @@ use thread_utilities::RapidMap;
 ///
 /// ```rust
 /// use thread_language::Html;
-/// use thread_ast_engine::{Language, LanguageExt};
+/// use thread_ast_engine::Language;
+/// use thread_ast_engine::tree_sitter::LanguageExt;
 ///
 /// let html = Html;
 /// let source = r#"

crates/language/src/lib.rs

@@ -26,7 +26,8 @@
 //!
 //! ```rust
 //! use thread_language::{SupportLang, Rust};
-//! use thread_ast_engine::{Language, LanguageExt};
+//! use thread_ast_engine::Language;
+//! use thread_ast_engine::tree_sitter::LanguageExt;
 //!
 //! // Runtime language selection
 //! let lang = SupportLang::from_path("main.rs").unwrap();
@@ -259,7 +260,7 @@ macro_rules! impl_lang {
 /// assert_eq!(result, "def hello(): pass");
 /// ```
 #[allow(dead_code)]
-fn pre_process_pattern(expando: char, query: &str) -> std::borrow::Cow<'_, str> {
+pub fn pre_process_pattern(expando: char, query: &str) -> std::borrow::Cow<'_, str> {
     // Fast path: check if any processing is needed
     let has_dollar = query.as_bytes().contains(&b'$');
     if !has_dollar {
@@ -672,7 +673,8 @@ impl_lang!(Yaml, language_yaml);
 /// # Usage with AST Analysis
 /// ```rust,ignore
 /// use thread_language::SupportLang;
-/// use thread_ast_engine::{Language, LanguageExt};
+/// use thread_ast_engine::Language;
+/// use thread_ast_engine::tree_sitter::LanguageExt;
 ///
 /// let lang = SupportLang::Rust;
 /// let tree = lang.ast_grep("fn main() {}");
@@ -1721,17 +1723,17 @@ pub fn from_extension(path: &Path) -> Option<SupportLang> {
     }
 
     // Handle extensionless files or files with unknown extensions
-    if let Some(_file_name) = path.file_name().and_then(|n| n.to_str()) {
+    if let Some(file_name) = path.file_name().and_then(|n| n.to_str()) {
         // 1. Check if the full filename matches a known extension (e.g. .bashrc)
         #[cfg(any(feature = "bash", feature = "all-parsers"))]
-        if constants::BASH_EXTS.contains(&_file_name) {
+        if constants::BASH_EXTS.contains(&file_name) {
             return Some(SupportLang::Bash);
         }
 
         // 2. Check known extensionless file names
         #[cfg(any(feature = "bash", feature = "all-parsers", feature = "ruby"))]
         for (name, lang) in constants::LANG_RELATIONSHIPS_WITH_NO_EXTENSION {
-            if *name == _file_name {
+            if *name == file_name {
                 return Some(*lang);
             }
         }

crates/rule-engine/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/services/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/thread/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

crates/utils/CHANGELOG.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

docs-site/public/thread/_headers.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

docs-site/public/thread/robots.txt.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Knitli Inc. <knitli@knit.li>
+
+SPDX-License-Identifier: AGPL-3.0-or-later

xtask/src/main.rs

@@ -7,8 +7,8 @@ use pico_args::Arguments;
 use std::path::Path;
 use std::process::{Command, exit};
 
-const CRATE_PATH: &str = "crates/thread-wasm";
-const PKG_PATH: &str = "crates/thread-wasm/pkg";
+const CRATE_PATH: &str = "crates/wasm";
+const PKG_PATH: &str = "crates/wasm/pkg";
 const DIST_PATH: &str = "dist/thread-wasm.optimized.wasm";
 
 const HELP: &str = r"