pi-kit/config/company.json at 38f4ecf81f203696962942e65208cdf4efdeaf80 - pi-kit - Gitea

ai/pi-kit

Files

Aleksey Shakhmatov 7e50043984 feat(security): secret-scanner, commit-guard, llm-redaction, audit-log

- lib/secrets.ts: shared SECRET_PATTERNS + scanSecrets/redact (AWS/GitLab/GitHub/Slack tokens, private keys, JWT, generic credentials)
- lib/audit.ts: local JSONL audit (~/.config/pi-kit/audit.jsonl, 600), optional PI_KIT_AUDIT_URL POST; never logs secret values
- secret-scanner: block write/edit whose content matches a secret (complements protected-paths)
- commit-guard: enforce Conventional Commits on 'git commit -m' + scan message for secrets
- llm-redaction: redact secrets from outbound payload via before_provider_request
- audit-log: session_start + slash-command usage; wires company.json auditEndpoint into env
- config: auditEndpoint (null); package.json: npm test; test/guardrails.test.ts (16 cases, all pass)

Verified: all extensions load via pi (lib/ not loaded as extensions); npm test green.

2026-07-16 13:46:22 +03:00

14 lines

359 B

JSON

Raw Blame History

 {
   "gitHost": "gitlab.tech.mvideo.ru",
   "trackerUrl": "https://jira.mvideo.ru",
   "docsUrl": "https://wiki.mvideo.ru",
   "repoMap": "TODO: где какой код лежит",
   "rules": [
     "не коммитить секреты",
     "не пушить в main",
     "MR обязателен"
   ],
   "remoteConfigUrl": null,
   "auditEndpoint": null
 }