fix(security): patch command injection and SONA bugs, publish mincut-wasm

crates/mcp-brain-server/Cargo.toml

@@ -23,8 +23,9 @@ tower-http = { version = "0.6", features = ["cors", "trace", "limit", "set-heade
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
-# HTTP client (for Firestore/GCS REST APIs)
-reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
+# HTTP client (for Firestore/GCS REST APIs + Common Crawl)
+# Using native-tls for compatibility with servers that don't send TLS close_notify
+reqwest = { version = "0.12", features = ["json", "native-tls"], default-features = false }
 
 # Crypto
 sha2 = "0.10"

crates/mcp-brain-server/Dockerfile

@@ -4,10 +4,11 @@ FROM rustlang/rust:nightly-bookworm AS builder
 
 WORKDIR /app
 
-# Install build dependencies
+# Install build dependencies (native-tls requires OpenSSL)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
     libssl-dev \
+    openssl \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy minimal workspace file (only includes required crates)
@@ -73,6 +74,7 @@ FROM debian:bookworm-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
+    libssl3 \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy binary from builder

crates/mcp-brain-server/src/lib.rs

@@ -29,3 +29,4 @@ pub mod web_memory;
 pub mod web_ingest;
 pub mod web_store;
 pub mod pubmed;
+pub mod quantization;