$ show openclaw/clawdex
clawdex is a local-first, markdown-first personal contact index CLI written in Go. Contacts are stored as plain markdown files with YAML frontmatter in a private Git repository, making the data diffable, grepable, and portable. The tool provides commands to manage people, notes, avatars, search, and timelines, with import adapters for Apple Contacts (macOS only via a temporary Swift helper), Google Contacts (via the gog CLI), X/Twitter DMs (Birdclaw), Discord DMs (Discrawl), and generic crawlkit-compatible crawlers. It also supports vCard export, Git sync helpers, and a doctor command for repairing damaged frontmatter. The architecture is a single self-contained binary with Kong-based CLI parsing, internal packages for each major domain, and a strong emphasis on security and correctness — the safefile package performs rooted, symlink-aware file I/O with atomic writes, and the markdown package includes robust salvage and repair logic for damaged frontmatter. CI enforces 90%+ test coverage, security scanning (gitleaks, gosec), dead code detection, and reproducible builds via GoReleaser.
The LLM identified 3 files worth highlighting for reuse:
Provides secure, rooted file operations that prevent symlink escapes and TOCTOU attacks. Uses OS-specific openat/NtCreateFile with O_NOFOLLOW for reads, O_CREATE+O_EXCL with os.Root for atomic writes. Implements ValidateAtomicWrite for dry-run previews. Rejecting FIFO/device reads and capping large file reads at 10 MiB. This package is self-contained (no internal imports beyond stdlib and sys/unix) and could be extracted into a standalone security-focused I/O library.
Handles reading, writing, and repairing markdown files with YAML frontmatter. Implements strict YAML parsing with a fallback salvage strategy that extracts known scalar fields (id, name, timestamps) from damaged frontmatter, infers missing IDs and timestamps from filesystem metadata, and appends unrecoverable metadata to the body. Repairs are idempotent and preserve backups. This pattern is reusable for any markdown-based data storage where frontmatter integrity is critical.
Generates RFC 6350 vCards with proper line folding (75-octet limit without splitting UTF-8), structured names, EMAIL/TEL type parameters, escaped categories, and optional PHOTO field embedding from avatar files. Validates MIME type before embedding, rejects line breaks in MIME parameters to prevent injection, and uses safefile for secure avatar reads. Could be extracted as a standalone vCard generation library.