Add package-manager secret ingress guard#2
Merged
Conversation
…ve service (#3) * chore: rename @hasna/configs -> @hasna/instructions Package, SDK package, CLI program name, status contract package name, and docs rebranded to @hasna/instructions. The MCP server identity, the configs-mcp bin alias, the events source, the status service field, and the local data dir are intentionally kept as 'configs' for fleet continuity (fleet rename is a separate controlled step). * feat: self-hosted service surfaces (serve /v1 + auth + SDK) - instructions-serve gains GET /health,/ready,/version and a versioned /v1 cloud API (configs, profiles, snapshots, stats). - A1 pure-remote store: /v1 reads/writes the shared RDS Postgres directly via the vendored storage kit; no local sync/cache in the service. - Per-request @hasna/contracts API-key auth (instructions:read / :write); fail-closed 503 when unconfigured. - OpenAPI 3.1 document served at /openapi.json and used to generate the typed InstructionsV1Client SDK. - Idempotent schema (never clobbers) + migrations dir + one-shot migrate runner. * feat: deploy artifacts (ARM64 Dockerfile, compose, contract, vendored kit) - ARM64/bun multi-stage Dockerfile; default CMD runs instructions-serve, the migrate subcommand is the ECS one-shot migration task. - docker-compose.yml for local cloud-mode stack. - hasna.contract.json service manifest (bins, storage, service metadata; MCP name kept 'configs' aliased). - Vendored @hasna/contracts storage kit 0.4.1 + Amazon RDS global CA bundle.
Bump @hasna/contracts ^0.4.1 -> ^0.4.2 (published latest), re-vendor the storage kit (KIT_VERSION 0.4.2; vendored code functionally identical), and sync hasna.contract.json kitVersion. Release 0.3.1. Verify: kit:check ok (v0.4.2), tsc --noEmit clean, bun test 265 pass / 0 fail.
…ted mode (#5) When HASNA_INSTRUCTIONS_API_URL + HASNA_INSTRUCTIONS_API_KEY are both set, the CLI routes config/profile record reads+writes to https://<host>/v1 with a bearer key (no local SQLite, no DSN on the client). Unset -> local SQLite (untouched). Setting only one var throws (no silent local drift). getDatabase() now throws in cloud mode so any not-yet-wired command fails loudly instead of silently reading the empty local DB. - src/data/config-store.ts: ConfigStore (Local + Cloud HTTP) + resolver - src/cli/index.tsx: list/show/add/delete + profile list/show/create/delete + whoami route via the async store; new 'delete <id>' config command - src/db/database.ts: cloud-mode guard on getDatabase() - src/data/config-store.test.ts: resolver + CRUD mapping coverage (13 tests)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
configs package-manager-scanfor repo/home.npmrc, Bun config, lockfiles, and shell profile scans.npmrcauth redaction to${NPM_TOKEN}env references instead of rendered literal token templatesVerification
bun run typecheckbun testbun run buildbun run src/cli/index.tsx package-manager-scan --home --fail-on-findings .bun run src/cli/index.tsx package-manager-scan --home --fail-on-findings <open-configs> <open-connectors> <open-todos> <open-projects>-> clean, 927 files