Commit graph

10 commits

Author SHA1 Message Date
Semianchuk Vitalii
6ef173fc51
fix: consolidate icon imports, fix stale refs and package name collision (#2343)
* fix: consolidate icon imports, fix stale refs and package name collision

three components were importing directly from lucide-react instead of
going through the centralized @/lib/lucide-icons module like the rest
of the codebase. added the missing Keyboard and BarChart2 exports to
the icons module and updated the imports.

also:
- removed duplicate mermaid init comment in ProcessFlowModal
- replaced placeholder issue #XXX with a descriptive note in git.ts
- updated stale KuzuDB reference to LadybugDB in ARCHITECTURE.md
- renamed gitnexus-web package.json name from "gitnexus" to "gitnexus-web"
  to avoid collision with the CLI package

* fix: complete package rename in lockfile and cite #2054 in git.ts comment

Address tri-review findings: package-lock.json name fields (top-level and
packages[""]) now match the renamed gitnexus-web package, and the
getCanonicalRemote doc comment cites #2054 instead of dropping the issue
reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(autofix): apply prettier + eslint fixes via /autofix command

---------

Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-02 11:01:12 +01:00
ChamHerry
fc6007e70b
feat(i18n): make web and CLI language-aware (#1748) 2026-05-23 06:14:24 +01:00
Gergő Magyar
acf6fbdd39
feat: configure eslint with unused import removal (#564)
* feat: configure eslint with unused import removal

Add ESLint v9 (flat config) for code quality:
- eslint-plugin-unused-imports for auto-removing dead imports
- @typescript-eslint for TypeScript-aware linting
- eslint-plugin-react-hooks for React hooks rules
- eslint-config-prettier to avoid formatting conflicts
- lint-staged runs eslint --fix before prettier on .ts/.tsx
- CI lint job added to ci-quality.yml

* refactor: remove unused imports via eslint --fix

Auto-fixed by eslint-plugin-unused-imports. No logic changes.

* chore: add eslint fix commit to .git-blame-ignore-revs
2026-03-28 15:28:09 +00:00
Gergő Magyar
bf09eab95b
feat: configure prettier with pre-commit hook (#563)
* feat: configure prettier with pre-commit hook integration

Add prettier, lint-staged, and prettier-plugin-tailwindcss at the repo
root with husky pre-commit hook integration. Moves husky from
gitnexus/ to root package.json for reliable hook installation.

- Root package.json with prepare/format/format:check scripts
- .prettierrc with endOfLine:lf and tailwindStylesheet for TW v4
- .prettierignore excluding fixtures, vendor, generated, *.d.ts, *.md
- .gitattributes enforcing LF line endings for Windows consistency
- Pre-commit hook uses direct node_modules/.bin/ paths (no npx)

* style: apply prettier formatting to entire codebase

One-time bulk format. No logic changes.
Use .git-blame-ignore-revs to skip this commit in git blame.

* chore: add .git-blame-ignore-revs for prettier format commit

* perf: pre-commit hook runs only tests related to staged files

Use vitest --related to scope test execution to tests that import
the changed files, instead of running the full suite on every commit.

* perf: remove vitest from pre-commit hook, keep in CI only

Pre-commit now runs lint-staged + tsc only. Tests run in CI
(ci-tests.yml) where they belong — keeps commits fast.

* ci: add prettier format check to quality workflow

PRs will now fail if code isn't formatted with prettier.
2026-03-28 14:58:04 +00:00
John R. Eakin
f0540b33fb
ci: E2E workflow, web typecheck job, pre-commit hook, test suite (#486) 2026-03-24 06:01:08 +00:00
jreakin
0d9a2ca6b6 fix(web): allow foreignObject in DOMPurify SVG sanitization
Mermaid uses foreignObject for HTML text labels inside flowchart
nodes. The SVG profile strips them by default, causing empty boxes.
ADD_TAGS: ['foreignObject'] preserves text while still sanitizing
against XSS.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:16:33 -05:00
Abhigyan Patwari
9ba2b22ac6
fix(web): resolve Vercel build errors from security hardening PR (#483)
- ProcessFlowModal: revert import from non-existent @/lib/lucide-icons back to lucide-react
- embedding-pipeline: remove extra argument in executeQuery call (signature only accepts 1 arg)

Both issues were introduced in PR #475 (web-security-hardening).

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 19:31:08 +05:30
jreakin
fc6c114570 fix(web): MermaidDiagram XSS, isSafeId allows @, rawMermaid typed
- Add DOMPurify.sanitize() to MermaidDiagram.tsx dangerouslySetInnerHTML
  (was rendering AI-generated SVG unsanitized — the highest-risk surface)
- Add @ to isSafeId regex for scoped npm packages (@angular/core, etc.)
- Add rawMermaid to ProcessData interface, remove (process as any) casts
- Update security tests: @scope/pkg now accepted, @angular/core added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 05:01:57 -05:00
jreakin
9f14edc226 fix(web): security hardening — Cypher injection, XSS, readOnly, prepared statements
- DOMPurify.sanitize() on mermaid SVG in ProcessFlowModal
- validLabel()/validRelType() guards on all Cypher interpolation in tools.ts
- isSafeId() strict regex in ProcessesPanel (no spaces/slashes/metacharacters)
- executeQuery defaults readOnly=true (rejects CREATE/DELETE/DROP/etc.)
- Singleton promise for initLbug (prevents concurrent init races)
- Prepared statements for relation inserts (batched by label pair)
- executeWithReusedStatement for enrichment updates
- try/finally on all PreparedStatement cleanup
- 99 security guard tests (validLabel, validRelType, isSafeId, readOnly regex)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 04:45:09 -05:00
abhigyanpatwari
c90576442e feat: merge gitnexus-mcp into gitnexus package - unified CLI+MCP 2026-02-04 01:12:41 +05:30
Renamed from gitnexus/src/components/ProcessFlowModal.tsx (Browse further)