Skip to content

release: staging → main (symlink fix, audit features, 48 commits)#233

Open
himerus wants to merge 65 commits intomainfrom
staging
Open

release: staging → main (symlink fix, audit features, 48 commits)#233
himerus wants to merge 65 commits intomainfrom
staging

Conversation

@himerus
Copy link
Copy Markdown
Contributor

@himerus himerus commented Mar 27, 2026

Summary

48 commits promoting to main, including:

  • Critical fix: Remove self-referential build and node_modules symlinks from git tracking + harden .gitignore patterns
  • Security: Error path redaction (no more absolute paths in MCP error messages), SBOM generation in publish workflow, npm package files tightened
  • Documentation: Tool count badge fix, README accuracy improvements
  • TypeScript: scaffold.ts variable name fix, formatting cleanup across 24 files
  • Features: VS Code extension enhancements, 8 new analyzer test suites, CLI bounds checking
  • Previous batch: All enterprise-readiness Tier 1+2 features from prior promotion

Test plan

🤖 Generated with Claude Code

himerus and others added 30 commits March 26, 2026 05:49
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace webp-only social card with PNG exported from Playwright.
helixir purple (#8b5cf6) branded at 1200x630.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ontextprotocolsdk

fix: align @modelcontextprotocol/sdk versions across monorepo packages
…dcomponent-and

fix: wire scaffold_component and extend_component into MCP server
Adds the helixir-vscode VS Code extension package at packages/vscode/.
The extension registers helixir as an MCP server definition provider
(vscode.lm, VS Code ≥ 1.99.0) so AI assistants receive full component
library awareness automatically when a workspace is opened.

Files created:
- packages/vscode/package.json — extension manifest with publisher,
  mcpServerDefinitionProviders contribution, Run Health Check command,
  helixir.configPath setting, and vsce/ovsx scripts
- packages/vscode/tsconfig.json — extends root tsconfig, noEmit for
  type-check-only (esbuild handles transpilation)
- packages/vscode/esbuild.config.mjs — dual-bundle config: extension.js
  (CJS, vscode externalized) + mcp-server.js (ESM, bundles helixir)
- packages/vscode/src/extension.ts — activate/deactivate exports, wires
  MCP provider and Run Health Check command
- packages/vscode/src/mcpProvider.ts — registerMcpServerDefinitionProvider
  call; spawns bundled mcp-server.js via stdio with MCP_WC_PROJECT_ROOT
  set to the current workspace folder; degrades gracefully on older VS Code
- packages/vscode/src/mcp-server-entry.ts — imports helixir/mcp and calls
  main(); bundled into the self-contained dist/mcp-server.js
- packages/vscode/.vscodeignore — excludes src, tsconfig, node_modules,
  and build artefacts from the .vsix package
- packages/vscode/README.md — marketplace listing with setup, config
  reference, commands table, and troubleshooting guide

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ckagesvscode-extension

feat: scaffold packages/vscode VS Code extension MVP
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…fault case

Replaces the '/* TODO: set value */' literal in the default branch of
lightPlaceholder() with var(${tokenName}), which produces valid CSS that
degrades gracefully when a token category is unknown.

Adds a test case that exercises the default code path by creating a CEM
with a token name that does not match any known CATEGORY_PATTERNS entry,
causing it to land in the 'other' bucket and hit the default switch case.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add comprehensive test coverage for packages/core/src/tools/styling.ts —
previously the single largest untested file in the codebase (1089 lines,
zero coverage).

- Tests all 29 MCP tool handlers via mocked dependencies
- Verifies happy paths, missing-arg validation errors, and error propagation
- Covers isStylingTool guard and the handleStylingCall dispatcher
- Designed to achieve 80%+ line coverage per vitest thresholds

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…r-returns-todo

fix: replace TODO placeholder with var() fallback in theme handler
…ite-for-styling-tools

test: add test suite for styling tools (29 tools, zero coverage)
- packages/core/src/handlers/cem.ts: throw MCPError with VALIDATION category
  for CSS custom property name validation
- packages/core/src/handlers/dependencies.ts: import MCPError/ErrorCategory,
  throw MCPError with NOT_FOUND category for missing component
- packages/core/src/handlers/extend.ts: import MCPError/ErrorCategory,
  throw MCPError with NOT_FOUND category for missing parent component
- src/mcp/index.ts: import handleToolError, use .message for stderr logging
- src/cli/index.ts: import handleToolError, use .message for stderr logging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…n-error-throws-with

fix: replace plain Error throws with MCPError across all handlers
- Updates tool count badge from 87+ to 73 (accurate count)
- Updates feature headline from "30+ MCP tools" to "73 MCP tools"
- Adds audit_library to Health section (was missing)
- Adds all 29 styling tools in a new Styling section
- Adds TypeGenerate, Theme, Scaffold, and Extend tool sections
- Verified all tool names match src/mcp/index.ts registrations
- Prettier format check passes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…e-tool-count-badge-and

fix: update README tool count badge and tools reference
…ilure

The post-merge verification ran `npm run typecheck` but the root package.json
only had `type-check` (with hyphen). Added a `typecheck` alias that delegates
to `pnpm run type-check` so both script names work.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…erification-failure-for

fix: add typecheck script alias for post-merge verification
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ites-for-scaffold

test: add test suites for scaffold, extend, theme, and bundle tools
Resolve README.md conflict: keep 87+ tool count from feature branch while
incorporating dev's expanded tool description list.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…me-social-card-to

docs: update README social card to PNG and fix tool count to 87+
… typegenerate, typescript, and validate tools

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ites-for-remaining-9

test: add test suites for 9 remaining tool files
- Replace 10 nearly-identical if-blocks with ENV_MAP_STRING and
  ENV_MAP_NULLABLE lookup tables iterated in a loop
- Remove deprecated mcpwc.config.json fallback and its warning message
- readConfigFile() now only reads helixir.mcp.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…figts-env-var-loading

fix: refactor config.ts env var loading to table-driven pattern
…indsurf-mcpjson-helper

feat: add Cursor/Windsurf mcp.json helper command to VS Code extension
himerus and others added 16 commits March 26, 2026 19:37
Add scaffold_component and extend_component to the expected coreTools
list. These tools were wired into the MCP server in PR #207 but the
test assertion was never updated, causing CI failures on all subsequent PRs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-count-badge-in-readme

fix: correct tool count badge in README (73 → actual count)
Generates sbom.json during each publish run using @cyclonedx/cyclonedx-npm,
uploads it as a GitHub Actions artifact for enterprise compliance audits.
Adds sbom.json to .gitignore and documents availability in README.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ration-to-publish

ci: add SBOM generation to publish workflow
…ute-file-paths-from-mcp

sec: redact absolute file paths from MCP error messages
packages/core/src was included in the files array but all exports already
point to compiled build/ paths, making source inclusion redundant. Removing
it reduces unpacked package size by ~94% (806 kB → 54 kB). src/skills is
retained as it ships the update-helixir Claude Code skill to end users.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-tighten-packagejson

chore: review and tighten package.json files field for npm publish
…config)

The handleScaffoldCall function parameter is named _config but the catch
block referenced config without underscore prefix, causing TS2552.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove build and node_modules symlinks from git tracking (committed
  by scaffold_component agent in 4c91c99, root cause of all ELOOP errors)
- Change .gitignore from build/ and node_modules/ (directory-only) to
  build and node_modules (matches both files and directories)
- Fix prettier formatting across 24 agent-committed files
- Fix unused imports in mixin-resolver.test.ts, source-accessibility.test.ts
- Fix scaffold.ts error handler variable name (_config not config)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
release: dev → staging (symlink fix + audit features)
Add optional scoring.weights config section to helixir.mcp.json
that lets enterprise teams apply per-dimension weight multipliers
to health scores. Accessibility-first teams can weight that
dimension 3× while rapid-prototyping teams can downweight it 0.5×.

- Add ScoringWeights and ScoringConfig interfaces to McpWcConfig
- Parse and validate scoring.weights in loadConfig() (positive
  numbers only; warn and discard invalid values)
- Export DIMENSION_WEIGHT_KEYS mapping from dimensions.ts
- Apply multipliers via getEffectiveWeight() in
  scoreComponentMultiDimensional()
- Default multiplier is 1.0 (fully backward-compatible)
- Document all 14 dimension keys in README with examples

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…e-health-scoring

feat: configurable health scoring weights via mcpwc.config.json
Add review requirements for tool handlers that accept user input,
fetch external URLs, or access the filesystem (cdn.ts, library.ts),
shared security utilities (error-handling.ts, git.ts), and the
configuration module (config.ts).

Uses @himerus consistent with existing CODEOWNERS entries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…wners-to-cover-security

sec: expand CODEOWNERS to cover security-sensitive tool handlers
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 27, 2026

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (4)
  • AUDIT
  • audit
  • Deep Audit
  • deep-audit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b26d87b0-31b9-4a4a-bddf-087e54f140c7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch staging

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

himerus and others added 13 commits March 26, 2026 21:16
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Restore legacy mcpwc.config.json fallback in config loader (7 config tests)
- Fix attribute reflection union count in api-surface analyzer
- Fix regex pattern redaction ordering in error-handling sanitizer
- Add .strict() to CreateThemeArgsSchema for proper Zod validation
- Fix validate test HTML string length calculation
- Remove unused rest parameter in error-handling callback

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The lockfile had stale specifiers (^1.26.0) for @modelcontextprotocol/sdk
while package.json required ^1.27.1, causing CI frozen-lockfile failures.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add scripts/act-ci.sh with --full, --matrix, and --help flags
  (--matrix sets ACT_MATRIX_TESTS=true + ACT_FULL_TESTS=true for Node 20/22/24 parity)
- Add scripts/preflight.sh with Gate 8 (full test suite with vitest hang watchdog)
- Add .automaker/context/agent-push-protocol.md documenting push sequence and
  the new --matrix flag with guidance on when to run it

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…0-22-24

Add CI build matrix with Node 20, 22, and 24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant