ai/pi-kit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
28 Commits 3 Branches 2 Tags
stable
Commit Graph

5 Commits

Author SHA1 Message Date
Aleksey Shakhmatov
38f4ecf81f Merge harness hardening: security guardrails, DX commands, release channels, MCP scaffold 2026-07-16 14:36:29 +03:00
Aleksey Shakhmatov
2995823a0f feat(mcp): scaffold Jira/Confluence/GitLab MCP bridge (disabled by default) 
Pi has no built-in MCP; this adds a bridge extension + declarative registry.
- config/mcp.json: jira/confluence/gitlab servers, all enabled:false; URLs from
  company.json ({config:...}), tokens from env ({env:...}) — nothing hardcoded
- extensions/mcp-bridge.ts: resolves env templates, and for enabled servers
  connects via MCP SDK (dynamic import) and registers their tools; /mcp-status
  command; graceful no-op when disabled or SDK absent
- docs/mcp.md: how to enable, prerequisites (VPN, tokens, uvx/npx, SDK), security
- package.json: @modelcontextprotocol/sdk as optionalDependency; ignore package-lock

Verified offline: extension loads, /mcp-status lists 3 servers (disabled), env
resolver builds gitlab API URL from company.json gitHost + GITLAB_TOKEN. Live
connect needs VPN + a token + authorization to run the server package.
 2026-07-16 14:33:21 +03:00
Aleksey Shakhmatov
7e50043984 feat(security): secret-scanner, commit-guard, llm-redaction, audit-log 
- lib/secrets.ts: shared SECRET_PATTERNS + scanSecrets/redact (AWS/GitLab/GitHub/Slack tokens, private keys, JWT, generic credentials)
- lib/audit.ts: local JSONL audit (~/.config/pi-kit/audit.jsonl, 600), optional PI_KIT_AUDIT_URL POST; never logs secret values
- secret-scanner: block write/edit whose content matches a secret (complements protected-paths)
- commit-guard: enforce Conventional Commits on 'git commit -m' + scan message for secrets
- llm-redaction: redact secrets from outbound payload via before_provider_request
- audit-log: session_start + slash-command usage; wires company.json auditEndpoint into env
- config: auditEndpoint (null); package.json: npm test; test/guardrails.test.ts (16 cases, all pass)

Verified: all extensions load via pi (lib/ not loaded as extensions); npm test green.
 2026-07-16 13:46:22 +03:00
Aleksey Shakhmatov
e6903f8b13 config: set company URLs (gitHost, tracker, docs) 
- gitHost: gitlab.tech.mvideo.ru (где живёт код компании)
- trackerUrl: https://jira.mvideo.ru
- docsUrl: https://wiki.mvideo.ru (Confluence)
- repoMap остаётся TODO

Verified: /kit-config reflects the new values (source: local).
 2026-07-16 13:03:03 +03:00
Aleksey Shakhmatov
76b3d71340 chore: add package manifest, config source-of-truth and tsconfig 
- package.json with pi section (extensions/skills/prompts) and Pi libs as peerDependencies (*)
- config/company.json as the single source of truth (values are TODO, gitHost set)
- tsconfig.json for optional local typecheck
 2026-07-16 10:53:55 +03:00