Skip to content

feat: automated repository management system #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NITISH-R-G wants to merge 6 commits into
base: main
Choose a base branch
from
Open

feat: automated repository management system #114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fbb71a2
feat: establish automated repository management system
google-labs-jules[bot] Jul 13, 2026
0264c39
fix: update node version to 22 and resolve ai PR reviewer issues
google-labs-jules[bot] Jul 13, 2026
95eeda6
fix: resolve all sonarcloud and action issues for repo automation
google-labs-jules[bot] Jul 13, 2026
3f88698
fix: resolve typecheck error in tests and remaining sonar issues
google-labs-jules[bot] Jul 13, 2026
81cef64
fix: resolve remaining typescript and sonarcloud errors
google-labs-jules[bot] Jul 13, 2026
b37f7e5
fix: resolve PR reviewer file creation issue
google-labs-jules[bot] Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/ai-pr-reviewer.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
name: AI PR Reviewer

on:
pull_request:
types: [opened, synchronize, reopened]
Comment on lines +3 to +5

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add concurrency limits to prevent duplicate review runs.

Without a concurrency block, multiple review runs can execute simultaneously for the same PR (e.g., on rapid pushes). This wastes API quota and may produce duplicate comments.

⚡ Proposed fix 
 on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+concurrency:
+  group: ai-pr-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on:
pull_request:
types: [opened, synchronize, reopened]
on:
pull_request:
types: [opened, synchronize, reopened]
concurrency:
group: ai-pr-review-${{ github.event.pull_request.number }}
cancel-in-progress: true
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ai-pr-reviewer.yml around lines 3 - 5, Add a
workflow-level concurrency block near the trigger configuration in
ai-pr-reviewer.yml, using a pull-request-specific group key so runs for the same
PR share a group, and enable cancellation of in-progress runs to prevent
duplicate reviews during rapid updates.

Source: Linters/SAST tools


permissions:
pull-requests: write
contents: read

jobs:
review:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
Comment on lines +15 to +18

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Workflow security hardening: add persist-credentials: false and pin all actions to SHA hashes. All three workflows share the same security gaps: the actions/checkout step persists GitHub credentials by default, and every action reference uses a floating version tag instead of a pinned commit SHA.

  • .github/workflows/ai-pr-reviewer.yml#L15-L18: Add persist-credentials: false to the checkout with block. Pin actions/checkout@v4, actions/setup-node@v4, and thollander/actions-comment-pull-request@v3 to full commit SHAs.
  • .github/workflows/issue-triage.yml#L15-L16: Add persist-credentials: false to the checkout step. Pin actions/checkout@v4 and actions/setup-node@v4 to full commit SHAs.
  • .github/workflows/continuous-improvement.yml#L16-L17: Add persist-credentials: false to the checkout step. Pin actions/checkout@v4 and actions/setup-node@v4 to full commit SHAs.
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 15-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

📍 Affects 3 files
  • .github/workflows/ai-pr-reviewer.yml#L15-L18 (this comment)
  • .github/workflows/issue-triage.yml#L15-L16
  • .github/workflows/continuous-improvement.yml#L16-L17
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ai-pr-reviewer.yml around lines 15 - 18, Harden all
workflow action references: in .github/workflows/ai-pr-reviewer.yml (15-18), add
persist-credentials: false to the checkout step and pin actions/checkout@v4,
actions/setup-node@v4, and thollander/actions-comment-pull-request@v3 to full
commit SHAs; apply the same checkout credential setting and SHA pinning for
actions/checkout@v4 and actions/setup-node@v4 in
.github/workflows/issue-triage.yml (15-16) and
.github/workflows/continuous-improvement.yml (16-17).

Source: Linters/SAST tools


- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 22
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Run AI PR Review
run: npm run ai:pr-review
env:
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
BASE_REF: ${{ github.base_ref }}

- name: Check if PR review comment exists
id: check_file
run: |
if [ -f pr-review-comment.md ]; then
echo "exists=true" >> $GITHUB_OUTPUT
else
echo "exists=false" >> $GITHUB_OUTPUT
fi

- name: Comment PR
uses: thollander/actions-comment-pull-request@v3

Check failure on line 45 in .github/workflows/ai-pr-reviewer.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=NITISH-R-G_Intelli-Credit-V2&issues=AZ9cmsZdvKN1Zd_3AQz3&open=AZ9cmsZdvKN1Zd_3AQz3&pullRequest=114
if: success() && steps.check_file.outputs.exists == 'true'
with:
file-path: pr-review-comment.md
comment-tag: ai-pr-review
32 changes: 32 additions & 0 deletions .github/workflows/continuous-improvement.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
name: Continuous Improvement Loop

on:
schedule:
- cron: '0 0 * * *' # Run daily at midnight
workflow_dispatch:

permissions:
contents: write
pull-requests: write
Comment on lines +8 to +10

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

contents: write and pull-requests: write permissions are unused by the current script.

The ai-improve.ts script only runs audit, format checks, and tests — it doesn't create commits or PRs. These permissions violate least-privilege. Remove them until the script actually needs them, or scope them to the job level with an explanatory comment.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 9-9: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[error] 10-10: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-improvement.yml around lines 8 - 10, Remove the
unused contents and pull-requests write permissions from the workflow-level
permissions block in continuous-improvement.yml, since ai-improve.ts only
performs audits, formatting checks, and tests. Keep only permissions required by
the current job, avoiding broader write access until commit or pull-request
operations are introduced.

Source: Linters/SAST tools


jobs:
improve:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 22
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Run Continuous Improvement
run: npm run ai:improve
env:
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40 changes: 40 additions & 0 deletions .github/workflows/docs-generation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: Generate Documentation

on:
push:
branches:
- main
workflow_dispatch:

permissions:
contents: write

jobs:
generate:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 22
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Generate Diagrams
run: npm run generate:diagrams

- name: Generate Knowledge Graph
run: npm run generate:knowledge-graph

- name: Commit changes
run: |
git config --local user.email "github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"
git add docs/
git commit -m "docs: auto-generate architecture and knowledge graph" || echo "No changes to commit"
git push origin HEAD || echo "No changes to push"
Comment on lines +34 to +40

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Don't swallow non-"no changes" errors in commit/push step.

|| echo "No changes to commit" and || echo "No changes to push" hide all failures, including branch protection rejections or auth errors. Only suppress the specific "nothing to commit" exit code.

🛡️ Proposed fix 
       - name: Commit changes
         run: |
           git config --local user.email "github-actions[bot]`@users.noreply.github.com`"
           git config --local user.name "github-actions[bot]"
           git add docs/
-          git commit -m "docs: auto-generate architecture and knowledge graph" || echo "No changes to commit"
-          git push origin HEAD || echo "No changes to push"
+          git diff --staged --quiet || git commit -m "docs: auto-generate architecture and knowledge graph"
+          git push origin HEAD
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Commit changes
run: |
git config --local user.email "github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"
git add docs/
git commit -m "docs: auto-generate architecture and knowledge graph" || echo "No changes to commit"
git push origin HEAD || echo "No changes to push"
- name: Commit changes
run: |
git config --local user.email "github-actions[bot]`@users.noreply.github.com`"
git config --local user.name "github-actions[bot]"
git add docs/
git diff --staged --quiet || git commit -m "docs: auto-generate architecture and knowledge graph"
git push origin HEAD
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docs-generation.yml around lines 34 - 40, Update the
“Commit changes” workflow step so only the expected no-changes condition is
suppressed: check the git commit result and allow other commit failures to exit
nonzero, then push only after a successful commit and let push failures
propagate instead of echoing success. Preserve the existing commit message and
git configuration.

31 changes: 31 additions & 0 deletions .github/workflows/issue-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: AI Issue Triage

on:
issues:
types: [opened]

permissions:
issues: write
contents: read

jobs:
triage:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 22
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Run AI Triage
run: npm run ai:triage
env:
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38 changes: 38 additions & 0 deletions .github/workflows/self-healing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Self-Healing Repository

on:
schedule:
- cron: '0 4 * * 1' # Every Monday at 4:00 AM
workflow_dispatch:
Comment on lines +3 to +6

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Missing concurrency limits in both workflows. Neither workflow defines a concurrency block, so overlapping runs can race on shared resources (the auto-fix branch or generated docs). zizmor flags both.

  • .github/workflows/self-healing.yml#L3-L6: Add a concurrency block after the on: section (e.g., group: self-healing, cancel-in-progress: false).
  • .github/workflows/docs-generation.yml#L3-L7: Add a concurrency block after the on: section (e.g., group: docs-generation, cancel-in-progress: true).
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 3-6: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

📍 Affects 2 files
  • .github/workflows/self-healing.yml#L3-L6 (this comment)
  • .github/workflows/docs-generation.yml#L3-L7
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/self-healing.yml around lines 3 - 6, Add concurrency
controls after the on: section in both workflows: use group self-healing with
cancel-in-progress false in .github/workflows/self-healing.yml (lines 3-6), and
group docs-generation with cancel-in-progress true in
.github/workflows/docs-generation.yml (lines 3-7), preventing overlapping runs
for their shared resources.

Source: Linters/SAST tools


permissions:
contents: write
pull-requests: write
Comment on lines +9 to +10

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Overly broad workflow-level permissions across both workflows. Permissions are declared at the workflow level, granting all jobs more access than needed. Move to job-level scope with least privilege. zizmor flags these as excessive.

  • .github/workflows/self-healing.yml#L9-L10: Move contents: write and pull-requests: write from workflow level to the fix job.
  • .github/workflows/docs-generation.yml#L10-L10: Move contents: write from workflow level to the generate job.
🧰 Tools
🪛 zizmor (1.26.1)

[error] 9-9: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[error] 10-10: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

📍 Affects 2 files
  • .github/workflows/self-healing.yml#L9-L10 (this comment)
  • .github/workflows/docs-generation.yml#L10-L10
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/self-healing.yml around lines 9 - 10, Move contents: write
and pull-requests: write from workflow-level permissions into the fix job in
.github/workflows/self-healing.yml. Also move contents: write into the generate
job in .github/workflows/docs-generation.yml, keeping each workflow’s
permissions limited to the job that requires them.

Source: Linters/SAST tools


jobs:
fix:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Missing persist-credentials: false on checkout in both workflows. actions/checkout@v4 persists GITHUB_TOKEN in local git config by default, increasing credential exposure. zizmor flags both as artipacked.

  • .github/workflows/self-healing.yml#L17-L17: Add with: persist-credentials: false to the checkout step.
  • .github/workflows/docs-generation.yml#L17-L17: Add with: persist-credentials: false to the checkout step.
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

📍 Affects 2 files
  • .github/workflows/self-healing.yml#L17-L17 (this comment)
  • .github/workflows/docs-generation.yml#L17-L17
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/self-healing.yml at line 17, Disable persisted credentials
on the actions/checkout@v4 step in both .github/workflows/self-healing.yml lines
17-17 and .github/workflows/docs-generation.yml lines 17-17 by adding the
checkout step’s with configuration with persist-credentials set to false.

Source: Linters/SAST tools

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Unpinned GitHub Actions across both workflows. All action references use mutable tags (@v4, @v6) instead of commit SHAs, exposing the workflows to supply-chain attacks via tag re-pointing. zizmor flags each as an unpinned use.

  • .github/workflows/self-healing.yml#L17-L17: Pin actions/checkout@v4 to a full commit SHA.
  • .github/workflows/self-healing.yml#L20-L20: Pin actions/setup-node@v4 to a full commit SHA.
  • .github/workflows/self-healing.yml#L32-L32: Pin peter-evans/create-pull-request@v6 to a full commit SHA.
  • .github/workflows/docs-generation.yml#L17-L17: Pin actions/checkout@v4 to a full commit SHA.
  • .github/workflows/docs-generation.yml#L20-L20: Pin actions/setup-node@v4 to a full commit SHA.
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

📍 Affects 2 files
  • .github/workflows/self-healing.yml#L17-L17 (this comment)
  • .github/workflows/docs-generation.yml#L17-L17
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/self-healing.yml at line 17, Pin every referenced GitHub
Action to its full commit SHA instead of mutable tags: update actions/checkout
and actions/setup-node in .github/workflows/self-healing.yml (lines 17 and 20),
peter-evans/create-pull-request there (line 32), and actions/checkout and
actions/setup-node in .github/workflows/docs-generation.yml (lines 17 and 20).

Source: Linters/SAST tools


- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 22
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Run fixes
run: npm run fix

- name: Create Pull Request
uses: peter-evans/create-pull-request@v6

Check failure on line 32 in .github/workflows/self-healing.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=NITISH-R-G_Intelli-Credit-V2&issues=AZ9cmsXVvKN1Zd_3AQz2&open=AZ9cmsXVvKN1Zd_3AQz2&pullRequest=114
with:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: 'chore: auto-fix repository issues'
title: 'chore: automated self-healing fixes'
body: 'Automated fixes applied by the repository self-healing workflow.'
branch: 'auto-fix'
29 changes: 29 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# AI Assistant Guidelines

Welcome to the Intelli-Credit Terminal repository. This document outlines guidelines for AI assistants contributing to or managing this repository.

## Automation First

Every repetitive task that can be automated must be automated. You should actively look for opportunities to automate workflows, fix issues, and improve repository health.

## Self-Healing

The repository supports self-healing automation. AI assistants should proactively execute self-healing tasks.
Use the `npm run fix` command to automatically resolve linting, formatting, and other auto-fixable issues.

## Pre-commit Validation

Before proposing any changes (commits, pull requests, etc.), you **must** validate the state of the repository using the following commands:

- `npm run format`: Check and format code.
- `npm run lint`: Run ESLint and ensure there are no linting errors.
- `npm test`: Run the test suite and ensure all tests pass.

Ensure `npm audit` is checked and resolve issues using `npm audit fix` where applicable.

## Security and Conventions

- **Command Execution:** When executing commands in Node.js automation scripts, always use `execFileSync` from the `node:child_process` module instead of `execSync`. Avoid concatenated strings to prevent command injection. Do not use shell pipes (`|`) in `execFileSync`; implement the logic natively in Node.js.
- **Logging:** Do not use `console.log`. Use `console.info`, `console.warn`, or `console.error` instead.
- **Actions Variables:** In GitHub Actions workflows, properly reference environment variables (e.g., `$BASE_REF`) in run scripts rather than injecting them directly using `${{ }}` to prevent command injection vulnerabilities. Use kebab-case inputs for the `thollander/actions-comment-pull-request@v3` action (e.g., `file-path`, `comment-tag`).
- **Git Diffs:** When generating git diffs in GitHub Actions triggered by `pull_request` events, use `git diff origin/$BASE_REF...HEAD` instead of `$HEAD_REF`.
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]

### Changed

- Repository transformed for open-source readiness: MIT License added, README
rewritten, CONTRIBUTING/SECURITY expanded, structured issue templates and PR
template, deterministic CI/release automation.

### Removed

- All AI-dependent and autonomous-commit automation (AI doc agent, self-healing
auto-fix, self-updating README, autonomous repo analysis, dashboard
generator) and their generated artifacts (`metadata.json`,
Expand All @@ -22,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [1.0.0] — 2026-06-23

### Security

- Moved the Google Gemini API key fully server-side into Vercel serverless
functions (`/api/analyze`). The key is never bundled, never logged, and never
returned to the client. The `@google/genai` SDK is absent from the client
Expand All @@ -37,12 +40,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Restricted dev-server CORS from `*` to a localhost + optional origin allowlist.

### Added

- `api/analyze.ts`, `api/_lib/analyze-core.ts`, `api/_lib/mcp-tools.ts`,
`api/_lib/limits.ts` — the serverless analysis layer and shared limits.
- Tests for upload limits and analysis-core resilience (timeout, retry,
guard paths).

### Changed

- `performAnalysis` now POSTs to `/api/analyze` and runs the pure client-side
`calculateRiskAndFraud` on the result; structured server error codes map to
precise UI messages.
Expand All @@ -51,6 +56,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- CI runs `typecheck`, `lint`, `test`, and `build` (was `tsc` + `test` + `build`).

### Removed

- Dead dependencies: `pdf-parse`, `@types/pdf-parse`,
`@types/express-rate-limit`, duplicate `vite` entry.
- Dead files: `test-pdf.ts`, `test-pdf2.ts`, duplicate `src/lib/file-utils.test.ts`.
26 changes: 13 additions & 13 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,19 +147,19 @@ and consistency — please treat feedback as collaborative.
New issues get `needs-triage` automatically. A maintainer will then apply the
appropriate label(s). Canonical set:

| Label | Meaning |
| --- | --- |
| `bug` | Something isn't working as documented |
| `enhancement` | A feature request or improvement |
| `documentation` | Docs gaps or inaccuracies |
| `good first issue` | Small, scoped, beginner-friendly — great first contribution |
| `help wanted` | Welcome community help; design is agreed |
| `needs-triage` | Awaiting maintainer review |
| `needs-design` | Needs discussion before work can start |
| `security` | Security-relevant (use [SECURITY.md](SECURITY.md) to report!) |
| `frontend` / `backend` | Affected area (auto-applied from changed paths) |
| `dependencies` / `github-actions` | Dependency or CI updates |
| `duplicate` / `wontfix` / `question` | Resolution states |
| Label | Meaning |
| ------------------------------------ | ------------------------------------------------------------- |
| `bug` | Something isn't working as documented |
| `enhancement` | A feature request or improvement |
| `documentation` | Docs gaps or inaccuracies |
| `good first issue` | Small, scoped, beginner-friendly — great first contribution |
| `help wanted` | Welcome community help; design is agreed |
| `needs-triage` | Awaiting maintainer review |
| `needs-design` | Needs discussion before work can start |
| `security` | Security-relevant (use [SECURITY.md](SECURITY.md) to report!) |
| `frontend` / `backend` | Affected area (auto-applied from changed paths) |
| `dependencies` / `github-actions` | Dependency or CI updates |
| `duplicate` / `wontfix` / `question` | Resolution states |

The path-based labels (`frontend`, `backend`, `documentation`, `dependencies`,
`github-actions`) are applied automatically by the **Pull Request Labeler**.
Expand Down
4 changes: 3 additions & 1 deletion api/_lib/__tests__/analyze-core.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,9 @@ describe('runAnalysis resilience (per-call timeout + retry)', () => {
});

it('retries a transient (429) error, then succeeds', async () => {
gc.mockImplementationOnce(() => Promise.reject(new Error('429 rate limit'))).mockResolvedValueOnce({
gc.mockImplementationOnce(() =>
Promise.reject(new Error('429 rate limit')),
).mockResolvedValueOnce({
text: JSON.stringify({ ok: true }),
functionCalls: [],
});
Expand Down
3 changes: 1 addition & 2 deletions api/_lib/limits.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,5 +28,4 @@ const ALLOWED_MIME_EXACT = new Set([
]);

export const isAllowedMimeType = (mimeType: string): boolean =>
ALLOWED_MIME_EXACT.has(mimeType) ||
ALLOWED_MIME_PREFIXES.some((p) => mimeType.startsWith(p));
ALLOWED_MIME_EXACT.has(mimeType) || ALLOWED_MIME_PREFIXES.some((p) => mimeType.startsWith(p));
16 changes: 9 additions & 7 deletions api/_lib/mcp-tools.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
*/
export const callMcpTool = async (
toolName: string,
args: any,

Check warning on line 14 in api/_lib/mcp-tools.ts

View workflow job for this annotation

GitHub Actions / build-and-test (20.x) 

Unexpected any. Specify a different type

Check warning on line 14 in api/_lib/mcp-tools.ts

View workflow job for this annotation

GitHub Actions / build-and-test (22.x) 

Unexpected any. Specify a different type
apiMode: boolean,
bureauApiKey: string,
) => {
Expand All @@ -24,8 +24,7 @@
if (toolName === 'search_cases') {
if (!apiKey) {
return {
error:
'eCourts API key not configured. Please set ECOURTS_API_KEY in your environment.',
error: 'eCourts API key not configured. Please set ECOURTS_API_KEY in your environment.',
};
}
return {
Expand Down Expand Up @@ -63,7 +62,7 @@
};
}
return await response.json();
} catch (error) {

Check warning on line 65 in api/_lib/mcp-tools.ts

View workflow job for this annotation

GitHub Actions / build-and-test (20.x) 

'error' is defined but never used

Check warning on line 65 in api/_lib/mcp-tools.ts

View workflow job for this annotation

GitHub Actions / build-and-test (22.x) 

'error' is defined but never used
return {
error: 'Network error: Failed to reach the Bureau API endpoint. Check your connection.',
};
Expand Down Expand Up @@ -100,7 +99,7 @@
};
}
return await response.json();
} catch (error) {

Check warning on line 102 in api/_lib/mcp-tools.ts

View workflow job for this annotation

GitHub Actions / build-and-test (20.x) 

'error' is defined but never used

Check warning on line 102 in api/_lib/mcp-tools.ts

View workflow job for this annotation

GitHub Actions / build-and-test (22.x) 

'error' is defined but never used
return {
error: 'Network error: Failed to reach the LTV Calculation API. Check your connection.',
};
Expand All @@ -124,11 +123,14 @@
if (toolName === 'get_mca_info') {
if (apiMode && bureauApiKey) {
try {
const res = await fetch('https://api.mca.gov.in/resource/4dbe5667-7b6b-41d7-82af-211562424d9a', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ companyName: args.companyName }),
});
const res = await fetch(
'https://api.mca.gov.in/resource/4dbe5667-7b6b-41d7-82af-211562424d9a',
{
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ companyName: args.companyName }),
},
);
if (res.ok) return await res.json();

const getRes = await fetch(
Expand Down
3 changes: 1 addition & 2 deletions api/analyze.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,8 +193,7 @@ export default async function handler(req: Request): Promise<Response> {
console.error(`[/api/analyze:${requestId}]`, e?.stack ?? e);

if (e instanceof AnalysisError) {
const status =
e.code === 'MISSING_API_KEY' || e.code === 'NO_FILES' ? 400 : 500;
const status = e.code === 'MISSING_API_KEY' || e.code === 'NO_FILES' ? 400 : 500;
// `rawLogs` may carry reflected document content / env var names —
// only forward it for client-side-fixable issues; otherwise omit.
const safeRawLogs =
Expand Down
11 changes: 11 additions & 0 deletions docs/architecture/diagram.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Architecture Diagram

```mermaid
graph TD;
Client-->Serverless_API;
Serverless_API-->Gemini;
Serverless_API-->MCP_Tools;
MCP_Tools-->Bureau_Mock;
```

Generated dynamically by continuous docs.
9 changes: 9 additions & 0 deletions docs/knowledge-graph/graph.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Knowledge Graph

This is a generated knowledge graph placeholder mapping relationships between:

- AI Services (Analyze Core -> Gemini API)
- Components (Data Ingestion -> Verification Engine -> Five Cs Analysis)
- Automation (Self-Healing -> PR Review -> Triage)

Detailed nodes and edges will be populated dynamically from source analysis.
1 change: 1 addition & 0 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading