Aleksey Shakhmatov
c068dfae0c
fix(review): address review findings (guardrails, prompts, tests, docs)
...
- permission-gate: block refs/tags/v* pushes, rm -r -f separated flags,
git reset --hard, git clean (verified against actual bypasses)
- prompts: /bugfix /feature /review no longer hardcode go-standards —
reference profile-gated <lang>-standards instead
- company-context: drop hardcoded Go stack, note TRACKER_URL priority,
warn on context truncation instead of silently dropping rules
- repo-map/docs-map: graceful degradation when config values are TODO
- /kit-doctor: warn on unfilled config fields (repoMap/trackerUrl/docsUrl)
- audit: retry POSTs to endpoint (3 attempts, backoff), still best-effort
- install.sh: remove TODO course URL from cheat sheet
- tests: expand guardrails (43 node checks), add shell tests for create-mr.sh
(scp/https origin parse, GITLAB_HOST override, protected branch refusal),
cover company-context lib (normalize/fetch/truncation) and mcp-bridge
- commit package-lock.json for reproducible installs
- document npm test Node >= 22.6 requirement (type stripping)
2026-08-06 11:22:53 +03:00
dev
6521d9c431
fix(permission-gate): guard release-* branch and v* tag pushes (deploy convention)
...
Deploy convention at M.Video: a release-* branch push deploys to stage and a
v* tag push deploys to PROD. The old guard only matched release/* (slash) and
never caught tag pushes, so a prod deploy could run unconfirmed.
- permission-gate: match main/master, release-[-/], --tags/--follow-tags, and
whitespace-preceded v<digit> tags; false-positive-safe (space discriminator)
- create-mr.sh: refuse source branch release-* (not just release/*)
- jira-workflow doc updated to release-*
Verified with a behavioral test suite (10 cases incl. v2, false-positive checks).
2026-07-16 13:13:35 +03:00
dev
75e9bf85ba
feat(extensions): protected-paths, permission-gate, company-context
...
- protected-paths: glob-based block of write/edit to secrets/keys/.git/prod configs
- permission-gate: confirm dangerous bash (rm -rf, force push, push to protected branch, prod kubectl, docker prune, sudo)
- company-context: loads config/company.json (+ optional remoteConfigUrl w/ 2.5s timeout), injects corporate context via before_agent_start, registers /kit-config
- config path resolved via import.meta.url, not cwd; text template in company-context.md
2026-07-16 11:00:09 +03:00
Aleksey Shakhmatov
dev