Skip to content

Commit 67968fb

Browse files
skulidropekskulidropek
committed
Merge remote-tracking branch 'origin/main' into issue-278-d92a50df7e27
2 parents a872a79 + ac92dc8 commit 67968fb

115 files changed

Lines changed: 2825 additions & 507 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.coderabbit.yaml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
2+
language: "ru-RU"
3+
early_access: false
4+
5+
reviews:
6+
profile: "assertive"
7+
request_changes_workflow: false
8+
high_level_summary: true
9+
high_level_summary_in_walkthrough: true
10+
review_status: true
11+
review_details: true
12+
commit_status: true
13+
fail_commit_status: true
14+
collapse_walkthrough: true
15+
changed_files_summary: true
16+
sequence_diagrams: true
17+
estimate_code_review_effort: true
18+
assess_linked_issues: true
19+
related_issues: true
20+
related_prs: true
21+
suggested_labels: true
22+
poem: false
23+
in_progress_fortune: false
24+
abort_on_close: true
25+
26+
auto_review:
27+
enabled: true
28+
auto_incremental_review: true
29+
auto_pause_after_reviewed_commits: 0
30+
drafts: true
31+
base_branches:
32+
- ".*"
33+
labels:
34+
- "!do-not-review"
35+
- "!skip-coderabbit"
36+
ignore_title_keywords:
37+
- "[skip review]"
38+
- "[skip coderabbit]"
39+
- "do not review"
40+
41+
path_instructions:
42+
- path: "**/*"
43+
instructions: |
44+
Ты строгий ревьюер SPEC DRIVEN DEVELOPMENT.
45+
46+
Перед выводами изучи README.md, другие *.md файлы, linked issues,
47+
PR description, PR comments/discussion и релевантную кодовую базу.
48+
49+
Сверь изменения с исходным ТЗ/спекой и обсуждением. Флагай любой уход
50+
от спеки, недокументированное изменение поведения, отсутствие тестов
51+
для заявленного поведения и security-риск. Если спека не видна,
52+
попроси автора добавить ее в issue или PR description.
53+
54+
Проверь решение с точки зрения формальной верификации: какие инварианты,
55+
предусловия и постусловия можно доказать математически, а где доказуемость
56+
слабая. Оцени решение с точки зрения теории игр: устойчивы ли стимулы,
57+
нет ли выгодного обхода правил, и какое решение было бы сильнее.
58+
59+
pre_merge_checks:
60+
issue_assessment:
61+
mode: "warning"
62+
custom_checks:
63+
- name: "Requirements alignment"
64+
mode: "error"
65+
instructions: |
66+
Fail if the diff contradicts the visible spec/TZ, linked issue, PR
67+
discussion, README/docs, or changes behavior without documenting it.
68+
Fail if promised behavior has no relevant tests. Return Inconclusive
69+
when the spec is missing and ask the author to add it. Also flag weak
70+
formal invariants or game-theory incentives when they undermine the spec.
71+
- name: "Security regression"
72+
mode: "warning"
73+
instructions: |
74+
Fail if changed files introduce a high-confidence security regression, including:
75+
- command injection or unsafe shell/process execution with user-controlled input;
76+
- path traversal or writes outside intended project/container state directories;
77+
- credential, token, private-key, or PII exposure in source, generated config, logs, or CI output;
78+
- unsafe Docker/GitHub Actions configuration such as privileged containers, broad host mounts, unbounded Docker socket access, unsafe `pull_request_target`, or unnecessary write permissions;
79+
- dependency or package-manager changes that materially increase supply-chain risk without justification.
80+
81+
Pass when no high-confidence regression is found. Return Inconclusive when the diff is too large or lacks enough context to determine risk.
82+
83+
tools:
84+
github-checks:
85+
enabled: true
86+
timeout_ms: 900000
87+
gitleaks:
88+
enabled: true
89+
trufflehog:
90+
enabled: true
91+
semgrep:
92+
enabled: true
93+
opengrep:
94+
enabled: true
95+
osvScanner:
96+
enabled: true
97+
checkov:
98+
enabled: true
99+
trivy:
100+
enabled: true
101+
presidio:
102+
enabled: true
103+
actionlint:
104+
enabled: true
105+
hadolint:
106+
enabled: true
107+
shellcheck:
108+
enabled: true
109+
eslint:
110+
enabled: true
111+
oxc:
112+
enabled: true
113+
yamllint:
114+
enabled: true
115+
dotenvLint:
116+
enabled: true
117+
118+
knowledge_base:
119+
opt_out: false
120+
web_search:
121+
enabled: true
122+
code_guidelines:
123+
enabled: true
124+
filePatterns:
125+
- "AGENTS.md"
126+
- "CLAUDE.md"
127+
- "GEMINI.md"
128+
- "README.md"
129+
- "docs/**/*.md"
130+
issues:
131+
scope: "local"
132+
pull_requests:
133+
scope: "local"
134+
learnings:
135+
scope: "local"
136+
137+
chat:
138+
art: false
139+
auto_reply: true
140+
allow_non_org_members: true

‎.github/pull_request_template.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Source TZ / Issues
2+
3+
- Fixes #
4+
- Related discussion:
5+
6+
## Summary
7+
8+
-
9+
10+
## Requirements Alignment
11+
12+
- Implemented:
13+
- Out of scope:
14+
- Security-sensitive changes:
15+
16+
## Verification
17+
18+
-

‎.greptile/config.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"strictness": 1,
3+
"commentTypes": ["logic", "syntax", "style", "info"],
4+
"triggerOnUpdates": true,
5+
"triggerOnDrafts": true,
6+
"ignorePatterns": "node_modules/**\ndist/**\ncoverage/**\nthird_party/**",
7+
"statusCheck": true,
8+
"statusCommentsEnabled": true,
9+
"updateExistingSummaryComment": true,
10+
"summarySection": {
11+
"included": true,
12+
"collapsible": true,
13+
"defaultOpen": false
14+
},
15+
"instructions": "This is a public MIT open-source TypeScript/Bun monorepo. Review every PR as SPEC DRIVEN DEVELOPMENT: compare the diff with README.md, repository Markdown docs, linked issues, PR description, PR comments and the relevant codebase. Flag spec drift, undocumented behavior changes, missing tests for promised behavior, high-confidence security risks, weak formal invariants, and game-theory incentive problems.",
16+
"rules": [
17+
{
18+
"id": "spec-source-required",
19+
"rule": "Every behavioral change must be traceable to a visible source of truth: linked issue, PR description, PR discussion, README/docs, or changed-code reference. If the spec is missing, ask the author to add it before approval.",
20+
"severity": "high"
21+
},
22+
{
23+
"id": "spec-alignment",
24+
"rule": "Flag any change that contradicts the visible issue/TZ/spec, PR discussion, README/docs, or changes behavior without documentation.",
25+
"severity": "high"
26+
},
27+
{
28+
"id": "security-review",
29+
"rule": "Look for injection, path traversal, secret leaks, unsafe Docker/GitHub Actions settings, supply-chain risk, and cross-container isolation regressions.",
30+
"severity": "high"
31+
},
32+
{
33+
"id": "formal-verification",
34+
"rule": "Assess which invariants, preconditions, and postconditions are mathematically defensible. Flag weak or unstated invariants when they affect correctness.",
35+
"severity": "medium"
36+
},
37+
{
38+
"id": "game-theory",
39+
"rule": "Assess whether the implementation creates incentives to bypass intended rules or safety controls. Suggest a stronger mechanism when incentives are misaligned.",
40+
"severity": "medium"
41+
}
42+
]
43+
}

‎.greptile/files.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"files": [
3+
{
4+
"path": "README.md",
5+
"description": "Main project behavior, CLI usage, runtime contracts, and architecture notes."
6+
},
7+
{
8+
"path": "AGENTS.md",
9+
"description": "Repository engineering rules, formal verification expectations, and review constraints."
10+
},
11+
{
12+
"path": "LICENSE",
13+
"description": "Project license text, legal terms, and copyright."
14+
}
15+
]
16+
}

‎.greptile/rules.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# SPEC-DRIVEN DEVELOPMENT Review Rules
2+
3+
Review every PR against its source of truth, not only against the diff.
4+
5+
Use README.md, repository Markdown docs, linked issues, PR description, PR comments/discussion, and the relevant codebase as review context.
6+
7+
Flag:
8+
- Spec drift or contradiction with the issue/TZ/spec.
9+
- Undocumented behavior changes.
10+
- Missing tests for promised behavior.
11+
- Security regressions.
12+
- Weak formal invariants, preconditions, or postconditions.
13+
- Game-theory incentive problems where users can profitably bypass intended rules.
14+
15+
If the spec is not visible, ask the author to copy the final requirements into the issue or PR description.

‎.pr_agent.toml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
[github_app]
2+
pr_commands = [
3+
"/agentic_describe",
4+
"/agentic_review"
5+
]
6+
handle_push_trigger = true
7+
push_commands = [
8+
"/agentic_review"
9+
]
10+
11+
[review_agent]
12+
comments_location_policy = "both"
13+
inline_comments_severity_threshold = 2
14+
issues_user_guidelines = """
15+
Review as SPEC DRIVEN DEVELOPMENT.
16+
Read README.md, repository Markdown docs, linked issues, PR description, PR comments/discussion, and relevant code.
17+
Flag spec drift, undocumented behavior changes, missing tests for promised behavior, and security risks.
18+
"""
19+
compliance_user_guidelines = """
20+
Check whether the code matches the visible issue/TZ/spec and discussion.
21+
Check formal-verification quality: invariants, preconditions, postconditions, and what can be proved mathematically.
22+
Check game-theory quality: whether incentives let users bypass intended rules, and suggest stronger mechanisms.
23+
If the spec is missing, ask the author to add it to the issue or PR description.
24+
"""

‎.sourcery.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
ignore:
2+
- .git
3+
- node_modules
4+
- dist
5+
- coverage
6+
- third_party
7+
8+
github:
9+
labels: []
10+
ignore_labels:
11+
- sourcery-ignore
12+
- do-not-review
13+
- skip-review

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 ProverCoderAI Contributors
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
`docker-git` создаёт отдельную Docker-среду для каждого репозитория, issue или PR.
44
По умолчанию проекты лежат в `~/.docker-git`.
55

6+
License: MIT. See [LICENSE](LICENSE).
7+
68
## Установка
79

810
```bash
@@ -113,3 +115,30 @@ When the CLI cannot acquire Docker access it now prints a message that
113115
names the specific failure mode, restates the host-Docker contract, and
114116
lists remediation steps for that exact mode. Implementation lives in
115117
`packages/app/src/docker-git/controller-docker-diagnostics.ts`.
118+
119+
## Resource limits
120+
121+
`docker-git` caps host resource consumption at two layers so a runaway
122+
project (or the controller itself) cannot consume the entire system.
123+
124+
- **Per-project containers** ship with a default limit of `30%` CPU and
125+
`30%` RAM (resolved against the host on `apply`). Override via
126+
`--cpu` / `--ram` (or per-project `docker-git.json`).
127+
- **Controller container** (`docker-git-api`) is capped in
128+
`docker-compose.yml` and `docker-compose.api.yml`. When started through
129+
`docker-git` or `./ctl`, the default CPU/RAM cap is resolved to `90%` of
130+
host resources. Override with global CLI flags:
131+
132+
```bash
133+
docker-git --controller-cpu 75% --controller-ram 8g --controller-pids 8192 ps
134+
./ctl up --cpu 75% --ram 8g --pids 8192
135+
```
136+
137+
The same values can be provided through env vars before `docker-git` or
138+
`./ctl up`:
139+
140+
| Variable | Default | Purpose |
141+
| ------------------------------ | ------- | ------------------------------------ |
142+
| `DOCKER_GIT_CONTROLLER_CPUS` | `90%` | CPU percent or cores for the controller |
143+
| `DOCKER_GIT_CONTROLLER_MEMORY` | `90%` | RAM percent or size; swap is matched |
144+
| `DOCKER_GIT_CONTROLLER_PIDS` | `4096` | Maximum PIDs inside the controller |

0 commit comments

Comments
 (0)