chore: audit guardrails and observability (#290)

.github/workflows/ci.yml

@@ -33,5 +33,8 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Run linter
+        run: npm run lint
+
       - name: Run tests
         run: npm test

eslint.config.js

@@ -0,0 +1,21 @@
+import js from '@eslint/js';
+import globals from 'globals';
+
+export default [
+  js.configs.recommended,
+  {
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'module',
+      globals: {
+        ...globals.node,
+      },
+    },
+    rules: {
+      'no-unused-vars': ['warn', { argsIgnorePattern: '^_' }],
+    },
+  },
+  {
+    ignores: ['node_modules/', 'coverage/'],
+  },
+];

package.json

@@ -21,6 +21,7 @@
   "scripts": {
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage --exclude test/contracts.integration.test.js --exclude test/content.test.js --exclude test/version.test.js",
     "lint": "eslint src/ bin/",
     "format": "prettier --write 'src/**/*.js' 'bin/**/*.js'"
   },

src/cli/commands.js

@@ -3,12 +3,12 @@
  * Command implementations for the git-mind CLI.
  */
 
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { writeFile, chmod, access, constants, readFile } from 'node:fs/promises';
 import { join, extname } from 'node:path';
 import { initGraph, loadGraph } from '../graph.js';
 import { createEdge, queryEdges, removeEdge, EDGE_TYPES } from '../edges.js';
 import { getNodes, hasNode, getNode, getNodesByPrefix, setNodeProperty, unsetNodeProperty } from '../nodes.js';
 import { computeStatus } from '../status.js';
 import { importFile } from '../import.js';
 import { importFromMarkdown } from '../frontmatter.js';
@@ -23,10 +23,10 @@
 import { generateSuggestions } from '../suggest.js';
 import { getPendingSuggestions, acceptSuggestion, rejectSuggestion, skipSuggestion, batchDecision } from '../review.js';
 import { computeDiff } from '../diff.js';
 import { createContext, DEFAULT_CONTEXT } from '../context-envelope.js';
 import { loadExtension, registerExtension, removeExtension, listExtensions, validateExtension } from '../extension.js';
 import { writeContent, readContent, getContentMeta, hasContent, deleteContent } from '../content.js';
 import { success, error, info, warning, formatEdge, formatView, formatNode, formatNodeList, formatStatus, formatExportResult, formatImportResult, formatDoctorResult, formatSuggestions, formatReviewItem, formatDecisionSummary, formatAtStatus, formatDiff, formatExtensionList, formatContentMeta } from './format.js';
 
 /**
  * Write structured JSON to stdout with schemaVersion and command fields.
@@ -116,7 +116,7 @@
  */
 export async function init(cwd) {
   try {
     const graph = await initGraph(cwd);
     console.log(success('Initialized git-mind graph'));
   } catch (err) {
     console.error(error(`Failed to initialize: ${err.message}`));
@@ -297,7 +297,7 @@
  */
 export async function processCommitCmd(cwd, sha) {
   try {
-    const message = execSync(`git log -1 --format=%B ${sha}`, { cwd, encoding: 'utf-8' });
+    const message = execFileSync('git', ['log', '-1', '--format=%B', sha], { cwd, encoding: 'utf-8' });
     const graph = await loadGraph(cwd);
     const directives = await processCommit(graph, { sha, message });
 

src/lens.js

@@ -36,7 +36,6 @@ export function defineLens(name, filterFn, opts = {}) {
     throw new Error(`defineLens("${name}"): filterFn must be a function`);
   }
   if (builtInDefs.size > 0 && builtInDefs.has(name)) {
-    // eslint-disable-next-line no-console
     console.warn(`defineLens: overwriting built-in lens "${name}". Call resetLenses() to restore.`);
   }
   registry.set(name, {

src/remote.js

@@ -5,7 +5,7 @@
  */
 
 /** @type {RegExp} Regex for cross-repo node IDs. */
-export const CROSS_REPO_ID_REGEX = /^repo:([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+):([a-z][a-z0-9-]*):([A-Za-z0-9._\/@-]+)$/;
+export const CROSS_REPO_ID_REGEX = /^repo:([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+):([a-z][a-z0-9-]*):([A-Za-z0-9._/@-]+)$/;
 
 /**
  * @typedef {object} CrossRepoId

src/validators.js

@@ -9,7 +9,7 @@ import { CROSS_REPO_ID_REGEX } from './remote.js';
 // ── Constants ────────────────────────────────────────────────────────
 
 /** @type {RegExp} Canonical regex for node IDs (prefix:identifier) */
-export const NODE_ID_REGEX = /^[a-z][a-z0-9-]*:[A-Za-z0-9._\/@-]+$/;
+export const NODE_ID_REGEX = /^[a-z][a-z0-9-]*:[A-Za-z0-9._/@-]+$/;
 
 /** @type {number} Maximum total length of a node ID */
 export const NODE_ID_MAX_LENGTH = 256;

vitest.config.js

@@ -7,5 +7,10 @@ export default defineConfig({
         execArgv: ['--disable-warning=DEP0169'],
       },
     },
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'lcov'],
+      reportsDirectory: './coverage',
+    },
   },
 });