@semalt-ai/code 1.8.5 → 1.19.0

package/.claude/settings.local.json

@@ -17,7 +17,12 @@
       "Bash(sed -i \"s/addMessage\\('>>> AI MSG 2'.*$/addMessage\\('>>> AI MSG 2',   ['response body 2a', 'response body 2b']\\);\\\\nfor \\(let k = 3; k <= 8; k++\\) { addMessage\\('>>> USER MSG ' + k, ['line body ' + k]\\); addMessage\\('>>> AI MSG ' + k, ['response body ' + k + 'a', 'response body ' + k + 'b']\\); }/\" scroll-capture.js)",
       "Bash(echo \"exit=$?\")",
       "Bash(echo \"---grep done, exit=$?---\")",
-      "Bash(grep *)"
+      "Bash(grep *)",
+      "Bash(npm test *)",
+      "Read(//srv/www/ai/**)",
+      "Read(//srv/www/ai/cli.semalt.ai/**)",
+      "Bash(npm run *)",
+      "Bash(— normalized\\\\|mcp)"
     ]
   }
 }

package/.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+name: CI
+
+# Green-pipeline gate: lint + tests must pass on every push and PR across the
+# supported OS/Node matrix before changes can land.
+#
+# Supply-chain guardrails (Task 3.2): the project has runtime dependencies
+# (`@modelcontextprotocol/sdk`; plus `@mozilla/readability` + `linkedom` +
+# `turndown` for the web-fetch pipeline, Task W.1). Two checks protect that
+# surface:
+#   * `npm ci` installs strictly from the committed package-lock.json and fails
+#     if package.json and the lockfile disagree — i.e. lockfile integrity.
+#   * `npm audit --omit=dev --audit-level=high` fails the build on a HIGH or
+#     CRITICAL advisory in the runtime dependency tree (dev deps excluded; there
+#     are none today). Audit-findings policy lives in CLAUDE.md
+#     › "Dependency & Supply-Chain Policy".
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+jobs:
+  lint-and-test:
+    name: lint + test (Node ${{ matrix.node }} / ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [18, 20]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      # Lockfile integrity: install strictly from package-lock.json. Fails the
+      # build if package.json and the lockfile have drifted apart.
+      - name: Install dependencies (npm ci)
+        run: npm ci
+
+      # Supply-chain audit: fail on HIGH/CRITICAL advisories in the runtime
+      # (production) dependency tree. See CLAUDE.md for how findings are handled.
+      - name: Security audit (npm audit)
+        run: npm audit --omit=dev --audit-level=high
+
+      # Install ripgrep so the grep rg-vs-Node parity tests (Task 2.1) execute
+      # rather than skip. ripgrep is an optional accelerator for the `grep`
+      # tool, never a runtime dependency — the suite still passes without it.
+      - name: Install ripgrep (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+      - name: Install ripgrep (macOS)
+        if: runner.os == 'macOS'
+        run: brew install ripgrep
+      - name: Install ripgrep (Windows)
+        if: runner.os == 'Windows'
+        run: choco install ripgrep -y
+
+      - name: Lint (node --check across all sources)
+        run: npm run lint
+
+      - name: Test (node --test)
+        run: npm test