Fix 10 project review issues: git data, ESLint, validation, security, CI, docs#5
Merged
Merged
Conversation
… CI, docs - Remove runtime data files (memory.json, projects.json, rules.json, skill-states.json) from git tracking; add .gitignore entries and .gitkeep; seed defaults at startup - Add test gate to release workflow (npm run check && npm run smoke) - Move router.js and compiler.js off ESLint ignore list; fix resulting lint violations - Sanitize 8 error-message returns in router.js (generic messages, log real errors) - Add input validation for 4 endpoints (modes/apply, compile/preview, projects POST/PATCH) - Rate-limit auth token generation (60s cooldown, 429 on repeat) - Cap concurrent ingest jobs at 5 (429 when at capacity) - Add 6 smoke tests to CI integration-tests job - Create .env.example documenting all env vars - Add directory-level intro to bench/README.md - Fix compiler: apply rulesOverride in buildContext, ensure all priority keys present in normalizeRules output (hard/soft/style), support style priority Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…3847 On CI the server may bind a different port (e.g. 3857), causing the hardcoded localhost:3847 origin check to fail. Use the resolved PORT value from config so the test matches the actual allowed origins. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Node.js ServerResponse instances may not reliably allow setHeader overrides across versions. Use simple mock objects that only implement the interface cors/json need (setHeader, writeHead, end). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Jeremy8776
approved these changes
May 20, 2026
Owner
Jeremy8776
left a comment
Jeremy8776
left a comment
There was a problem hiding this comment.
Approved. Validation passed locally (check, smoke, test:api-endpoints, test:compiler, test:rule-files, test:skills, test:config, test:http).
Follow-up note, not blocking this PR: server/lib/rule-files.js still stores rule files under app/data/rules instead of CE_ROOT/data/rules. That predates this PR, but it should be carried forward because it conflicts with the broader direction that runtime data should live outside git/app code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
data/memory.json,projects.json,rules.json,skill-states.jsonnow git-ignored;.gitkeeppreserves the directory;ensureDefaultData()seeds defaults at startupnpm run check && npm run smokebefore buildingPOST /api/modes/apply,POST /api/compile/preview,POST /api/projects,PATCH /api/projects/:slug.env.example: documents all env vars grouped by concernbench/README.md: add directory-level intro and file tablerulesOverride:buildContextnow appliesopts.rulesOverride;normalizeRulesensures all priority keys (hard/soft/style) present in outputTest plan
npm run checkpasses (lint + typecheck + format)npm run smokepassesnpm run test:compilerpassesnpm run test:skillspassesnpm run test:rule-filespassesnpm run test:configpassesnpm run test:httppassesnpm run test:api-endpointspasses (101/101)git ls-files data/shows only.gitkeep🤖 Generated with Claude Code