Fix merge conflicts, lint/test breakages, and harden heady-manager.js

[Copilot]

Repository had pervasive merge conflicts (.gitignore, .gitattributes, src/hc_autobuild.js, 8 .windsurf/workflows/ files), a broken ESLint config referencing uninstalled TypeScript parser, a failing test importing a nonexistent module, and no input validation on subprocess-spawning API endpoints.

Merge conflict resolution

• .gitignore — 3-way conflict → unified file
• .gitattributes — merged LFS/binary/line-ending rules
• src/hc_autobuild.js — 17 nested conflict markers from repeated local merges
• .windsurf/workflows/*.md — 8 files

ESLint pipeline fix

• .eslintrc.json — replaced broken @typescript-eslint/parser config with eslint:recommended (codebase is JS, not TS)
• Added .eslintignore for frontend/backend/packages/workers
• package.json lint scripts now use .eslintignore instead of --ignore-path .gitignore
• Fixed all 8 errors (parse errors, no-undef, no-empty) and 26 no-unused-vars warnings across 13 files

Security hardening — heady-manager.js

• Input validation on all conductor endpoints (type, 10k length cap, control character rejection) returning 400
• 30s subprocess timeout + 5MB stdout/stderr cap on runPythonConductor
• proc.on("error") handler for spawn failures
• Error logging in readJsonFileSafe

function validateConductorInput(value, fieldName) {
  if (typeof value !== "string") throw new Error(`${fieldName} must be a string`);
  if (value.length > MAX_INPUT_LENGTH) throw new Error(`${fieldName} exceeds maximum length`);
  if (/[\x00-\x08\x0e-\x1f]/.test(value)) throw new Error(`${fieldName} contains invalid control characters`);
  return value;
}

Bug fixes

• src/hc_ai_nodes.js — target was referenced but never defined; now derived from payload.target
• scripts/auto-merge.js — shebang on line 15 (after brand header) caused parse error; removed
• scripts/gitignore_audit.js — walk() missing return results after catch

Tests & CI

• Fixed pre_projection.test.js — removed dead require('../../src/hc_pipeline')
• Added 10 tests for heady-manager: health, config, endpoint validation, input rejection
• Added .github/workflows/ci.yml — lint + test on push/PR to main (Node 22)

Original prompt

On it — proceeding with all tasks for:

• https://github.com/HeadySystems/Heady-Main
• HeadyMe/heady-production

I’ll continue full-scope execution across both: fix all issues, productionize deployment, and apply enterprise-grade hardening and optimization.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
heady	Error		Apr 3, 2026 8:23am