oc-pilot 0.0.0-stage → 0.88.1

package/CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing
+
+## Development
+
+```bash
+git clone https://github.com/MyNameIsNikki/oc-pilot.git
+cd oc-pilot
+npm install
+npm run check
+npm test
+```
+
+Requirements: Node.js 22+, Git, and OpenCode 2.x for live model calls. The test suite uses a fake `opencode` executable and does not need credentials.
+
+## Pull requests
+
+- Keep the CLI and MCP behavior in sync. A new command option usually needs an MCP tool argument.
+- Add a regression test for every bug fix. Tests live next to the code in `src/**/*.test.ts`.
+- Do not add runtime dependencies without a security and size justification. The package intentionally ships with none.
+- Do not log prompts, diffs, tokens, or provider responses in production paths. Use the existing `log` helpers.
+- Preserve the bilingual prompt contract. Model-facing English is the default; Russian is selected with `--lang ru`.
+- Run `npm run prompt:export` after changing `src/core/prompt.ts`.
+
+## Security-sensitive changes
+
+Changes to secret detection, redaction, the read-only agent permissions, patch application, MCP HTTP authentication, or path confinement need:
+
+- negative tests (what must be rejected);
+- updates to `SECURITY.md` when the trust model changes;
+- a note in `CHANGELOG.md`.
+
+## Release
+
+Releases are tag-driven and publish through npm trusted publishing (OIDC), so no `NPM_TOKEN` secret exists. Enable it once: on npmjs.com, open the `oc-pilot` package, go to **Settings → Trusted publishing**, and add a GitHub Actions publisher with org `MyNameIsNikki`, repository `oc-pilot`, workflow `release.yml`, and no environment. The names must match `.github/workflows/release.yml` exactly — npm checks them in the OIDC claim.
+
+Then release:
+
+```bash
+npm version patch --no-git-tag-version
+git commit -am "release: vX.Y.Z"
+git tag vX.Y.Z
+git push origin main --tags
+```
+
+The release workflow checks that the tag matches `package.json`, runs the full suite, and publishes with npm provenance. A `workflow_dispatch` run publishes whatever version `package.json` holds, which is useful for verifying the publisher configuration: an "already published" rejection means OIDC worked and only the version number collided.

package/Dockerfile

@@ -0,0 +1,32 @@
+FROM node:22-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json tsconfig.json ./
+COPY src ./src
+RUN npm ci
+RUN npm run build
+
+FROM node:22-bookworm-slim
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+RUN npm install -g opencode-ai
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts
+COPY --from=build /app/dist ./dist
+COPY prompts ./prompts
+COPY docs ./docs
+COPY skills ./skills
+COPY README.md README.ru.md LICENSE server.json ./
+
+ENV NODE_ENV=production \
+    OC_PILOT_MCP_HOST=0.0.0.0 \
+    OC_PILOT_MCP_PORT=8787 \
+    OC_PILOT_MCP_PATH=/mcp
+
+WORKDIR /workspace
+EXPOSE 8787
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:8787/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "/app/dist/mcp.js", "--http", "--host", "0.0.0.0", "--port", "8787", "--path", "/mcp", "--cwd", "/workspace"]

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 oc-pilot contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.