Refactor bridge.ts into domain-specific route modules (#11) by chitcommit · Pull Request #18 · chittyos/chittycommand

chitcommit · 2026-03-04T04:43:07Z

refactor: split bridge.ts into domain-specific route modules

Break the 880-line monolith into src/routes/bridge/ with 9 domain files (ledger, credentials, finance, plaid, mercury, books, assets, scrape, status) and a barrel index. No behavior changes.

feat(auth): add in-app token management and chittyauth-first mcp auth (feat(auth): add in-app token management for ChittyAuth and MCP #6)
fix: complete 4-lane remediation (fix: complete 4-lane remediation #10)
fix: complete 4-lane remediation — tests, governance, security, CORS

Lane 1 (Testing): Add vitest infrastructure with MCP test cases
covering JSON-RPC protocol, tool success/error paths, and defensive
parsing.

Lane 2 (Governance): Add GitHub Actions CI/CD (ci.yml, deploy-worker,
governance gates), org governance scripts (audit, enforce, remediate),
ISSUE_TEMPLATE, release.yml, and governance-baseline templates.

Lane 3 (Security): Add .gitleaks.toml for secret scanning, security
docs (access broker runbook, secret rotation checklist, scan report),
.gitignore hardening.

Lane 4 (Code + UI): CORS OPTIONS + credentials support, MCP server
expanded from 6 to 28 tools across 8 domains, integrations and
validators updates, UI disputes widget and API client fixes.

fix: address PR review feedback across 10 files

package.json: remove trailing space on kv:seed script line
ci.yml: add npm test step, fix secret allowlist to catch bracket notation (secrets['NAME']) in addition to dot notation
reusable-governance-gates.yml: same bracket notation fix
chittycompliance-dispatch.sh: replace string interpolation with jq -nc for all JSON payloads to prevent injection
org-governance-adversarial-review.sh: add defensive // [] for missingFiles and missingTriggers jq expressions
connect.ts: proper AuthVariables typing instead of @ts-expect-error
integrations.ts: normalize KV cache key with encodeURIComponent
wrangler.toml: default PLAID_ENV to sandbox, production override in [env.production.vars]
org-governance-pr-integration-loop.sh: add author verification against governance automation allowlist before auto-approve
.gitignore: exclude timestamped governance report artifacts

fix(backend): add missing beacon, context, and ledger modules

These three files were present locally but missed during the initial push, causing TypeScript compilation errors in CI.

fix(ci): allow vitest to pass with no test files

Add passWithNoTests to vitest config so CI doesn't fail when the tests directory hasn't been populated yet.

fix(scripts): use grep -F for literal bot author matching

The [bot] suffix in author names was being interpreted as a regex character class. Use -F flag for fixed-string matching.

ci: add CodeQL code scanning workflow

Required by org-level ruleset for branch protection on main.

Set up GitHub Copilot coding agent instructions (Set up GitHub Copilot coding agent instructions #14)
Initial plan
feat: add .github/copilot-instructions.md with repository-specific Copilot guidance

Addressing PR comments (Addressing PR comments #12)
fix: complete 4-lane remediation — tests, governance, security, CORS

Lane 1 (Testing): Add vitest infrastructure with MCP test cases
covering JSON-RPC protocol, tool success/error paths, and defensive
parsing.

Lane 2 (Governance): Add GitHub Actions CI/CD (ci.yml, deploy-worker,
governance gates), org governance scripts (audit, enforce, remediate),
ISSUE_TEMPLATE, release.yml, and governance-baseline templates.

Lane 3 (Security): Add .gitleaks.toml for secret scanning, security
docs (access broker runbook, secret rotation checklist, scan report),
.gitignore hardening.

Lane 4 (Code + UI): CORS OPTIONS + credentials support, MCP server
expanded from 6 to 28 tools across 8 domains, integrations and
validators updates, UI disputes widget and API client fixes.

fix: address PR review feedback across 10 files

package.json: remove trailing space on kv:seed script line
ci.yml: add npm test step, fix secret allowlist to catch bracket notation (secrets['NAME']) in addition to dot notation
reusable-governance-gates.yml: same bracket notation fix
chittycompliance-dispatch.sh: replace string interpolation with jq -nc for all JSON payloads to prevent injection
org-governance-adversarial-review.sh: add defensive // [] for missingFiles and missingTriggers jq expressions
connect.ts: proper AuthVariables typing instead of @ts-expect-error
integrations.ts: normalize KV cache key with encodeURIComponent
wrangler.toml: default PLAID_ENV to sandbox, production override in [env.production.vars]
org-governance-pr-integration-loop.sh: add author verification against governance automation allowlist before auto-approve
.gitignore: exclude timestamped governance report artifacts

Initial plan
fix: address unresolved review comments — error info leakage, type safety, and MCP tests
fix: wire mcpAuthMiddleware in tests, fix empty-body parse error, rename GET test

@ts-expect-error

* refactor: split bridge.ts into domain-specific route modules Break the 880-line monolith into src/routes/bridge/ with 9 domain files (ledger, credentials, finance, plaid, mercury, books, assets, scrape, status) and a barrel index. No behavior changes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(auth): add in-app token management and chittyauth-first mcp auth (#6) * fix: complete 4-lane remediation (#10) * fix: complete 4-lane remediation — tests, governance, security, CORS Lane 1 (Testing): Add vitest infrastructure with MCP test cases covering JSON-RPC protocol, tool success/error paths, and defensive parsing. Lane 2 (Governance): Add GitHub Actions CI/CD (ci.yml, deploy-worker, governance gates), org governance scripts (audit, enforce, remediate), ISSUE_TEMPLATE, release.yml, and governance-baseline templates. Lane 3 (Security): Add .gitleaks.toml for secret scanning, security docs (access broker runbook, secret rotation checklist, scan report), .gitignore hardening. Lane 4 (Code + UI): CORS OPTIONS + credentials support, MCP server expanded from 6 to 28 tools across 8 domains, integrations and validators updates, UI disputes widget and API client fixes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address PR review feedback across 10 files - package.json: remove trailing space on kv:seed script line - ci.yml: add npm test step, fix secret allowlist to catch bracket notation (secrets['NAME']) in addition to dot notation - reusable-governance-gates.yml: same bracket notation fix - chittycompliance-dispatch.sh: replace string interpolation with jq -nc for all JSON payloads to prevent injection - org-governance-adversarial-review.sh: add defensive // [] for missingFiles and missingTriggers jq expressions - connect.ts: proper AuthVariables typing instead of @ts-expect-error - integrations.ts: normalize KV cache key with encodeURIComponent - wrangler.toml: default PLAID_ENV to sandbox, production override in [env.production.vars] - org-governance-pr-integration-loop.sh: add author verification against governance automation allowlist before auto-approve - .gitignore: exclude timestamped governance report artifacts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(backend): add missing beacon, context, and ledger modules These three files were present locally but missed during the initial push, causing TypeScript compilation errors in CI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): allow vitest to pass with no test files Add passWithNoTests to vitest config so CI doesn't fail when the tests directory hasn't been populated yet. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(scripts): use grep -F for literal bot author matching The [bot] suffix in author names was being interpreted as a regex character class. Use -F flag for fixed-string matching. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add CodeQL code scanning workflow Required by org-level ruleset for branch protection on main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * Set up GitHub Copilot coding agent instructions (#14) * Initial plan * feat: add .github/copilot-instructions.md with repository-specific Copilot guidance Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com> * Addressing PR comments (#12) * fix: complete 4-lane remediation — tests, governance, security, CORS Lane 1 (Testing): Add vitest infrastructure with MCP test cases covering JSON-RPC protocol, tool success/error paths, and defensive parsing. Lane 2 (Governance): Add GitHub Actions CI/CD (ci.yml, deploy-worker, governance gates), org governance scripts (audit, enforce, remediate), ISSUE_TEMPLATE, release.yml, and governance-baseline templates. Lane 3 (Security): Add .gitleaks.toml for secret scanning, security docs (access broker runbook, secret rotation checklist, scan report), .gitignore hardening. Lane 4 (Code + UI): CORS OPTIONS + credentials support, MCP server expanded from 6 to 28 tools across 8 domains, integrations and validators updates, UI disputes widget and API client fixes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address PR review feedback across 10 files - package.json: remove trailing space on kv:seed script line - ci.yml: add npm test step, fix secret allowlist to catch bracket notation (secrets['NAME']) in addition to dot notation - reusable-governance-gates.yml: same bracket notation fix - chittycompliance-dispatch.sh: replace string interpolation with jq -nc for all JSON payloads to prevent injection - org-governance-adversarial-review.sh: add defensive // [] for missingFiles and missingTriggers jq expressions - connect.ts: proper AuthVariables typing instead of @ts-expect-error - integrations.ts: normalize KV cache key with encodeURIComponent - wrangler.toml: default PLAID_ENV to sandbox, production override in [env.production.vars] - org-governance-pr-integration-loop.sh: add author verification against governance automation allowlist before auto-approve - .gitignore: exclude timestamped governance report artifacts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Initial plan * fix: address unresolved review comments — error info leakage, type safety, and MCP tests Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com> * fix: wire mcpAuthMiddleware in tests, fix empty-body parse error, rename GET test Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com> --------- Co-authored-by: @chitcommit <208086304+chitcommit@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

chatgpt-codex-connector · 2026-03-04T04:43:13Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

github-actions · 2026-03-04T04:43:16Z

@coderabbitai review
@copilot review
@codex review
@claude review
Adversarial review request: evaluate security, policy bypass paths, regression risk, and merge-gating bypass attempts.

coderabbitai · 2026-03-04T04:43:27Z

Caution

Review failed

The head commit changed during the review from 668d1fc to 18ad546.

✨ Finishing Touches

📝 Generate docstrings (stacked PR)
📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feat/ui-design-enhancement

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-03-04T04:44:09Z

@coderabbitai review
@copilot review
@codex review
@claude review
Adversarial review request: evaluate security, policy bypass paths, regression risk, and merge-gating bypass attempts.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings March 4, 2026 04:43

Copilot started reviewing on behalf of chitcommit March 4, 2026 04:43 View session

chitcommit enabled auto-merge (squash) March 4, 2026 04:43

Merge branch 'main' into feat/ui-design-enhancement

18ad546

chitcommit merged commit 408e854 into main Mar 4, 2026
10 checks passed

chitcommit deleted the feat/ui-design-enhancement branch March 4, 2026 04:44

Copilot AI reviewed Mar 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refactor bridge.ts into domain-specific route modules (#11)#18

Refactor bridge.ts into domain-specific route modules (#11)#18
chitcommit merged 2 commits intomainfrom
feat/ui-design-enhancement

chitcommit commented Mar 4, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 4, 2026

Uh oh!

github-actions bot commented Mar 4, 2026

Uh oh!

coderabbitai bot commented Mar 4, 2026 •

edited

Loading

Review failed

Uh oh!

github-actions bot commented Mar 4, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

chitcommit commented Mar 4, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 4, 2026

Uh oh!

github-actions bot commented Mar 4, 2026

Uh oh!

coderabbitai bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Uh oh!

github-actions bot commented Mar 4, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai bot commented Mar 4, 2026 •

edited

Loading