Add deterministic JS/TS package hardening and PR-triggered security remediation#390
Merged
nicobistolfi merged 2 commits intomainfrom Apr 3, 2026
Conversation
…emediation Implement a code-driven, deterministic package hardening scan that runs during Vigilante's poll loop for watched JS/TS/Node repositories. When a PR modifies package.json, the scanner checks lockfile presence, runs npm audit, flags non-exact dependency ranges, and verifies CI uses deterministic install paths. Key changes: - New internal/hardening package with deterministic checks and PR comment formatting including the implement-fixes checkbox - Config toggle via package_hardening_enabled in config.json (default: on) - New vigilante:flagged-security-review label in the label taxonomy - Backend interface extensions for PR file listing, PR comments, labels - Checkbox detection and eyes reaction with agentic remediation dispatch - Provider support for package remediation invocations (Claude, Codex, Gemini) - Comprehensive test coverage across hardening, state, and app packages
8 tasks
Replace the PR-listing approach with a post-push worktree-based approach for deterministic JS/TS package hardening. Instead of querying GitHub for all open PRs on every scan cycle, the hardening scan now runs after a session completes and pushes to the branch, using git diff against the base branch to detect package.json changes from the local worktree. Key changes: - Add ExtractPackageJSONPathsFromDiff() to use git diff --name-only for detecting changed package.json files from the worktree - Add runPostPushPackageHardening() triggered after successful session completion in launchIssueSession - Simplify scanPackageHardeningForTargets to only monitor checkbox state on existing hardening entries (monitorHardeningCheckboxes) - Remove ListOpenPullRequests and ListPullRequestFiles calls from the hardening scan path - Add comprehensive tests for diff-based detection, config gating, checkbox monitoring state, and default branch fallback Closes #389
nicobistolfi
deleted the
vigilante/issue-389-add-deterministic-js-ts-package-hardening-and-pr-triggered-security-remediation-for-modified-package-manifests
branch
This was referenced Apr 3, 2026
nicobistolfi
added a commit
that referenced
this pull request
Apr 3, 2026
Add a concise package hardening section to README.md covering user-visible behavior with a caveat that the feature currently applies only to supported JS/TS/Node.js repositories and will expand over time. Add detailed operational documentation to DOCS.md covering trigger conditions, checks performed (lockfile presence, npm audit, non-exact ranges, CI deterministic install, CI audit step), PR comment and label behavior (vigilante:flagged-security-review), checkbox-driven remediation flow, and the package_hardening_enabled config toggle. Closes #392
5 tasks
nicobistolfi
added a commit
that referenced
this pull request
Apr 3, 2026
Add a concise package hardening section to README.md covering user-visible behavior with a caveat that the feature currently applies only to supported JS/TS/Node.js repositories and will expand over time. Add detailed operational documentation to DOCS.md covering trigger conditions, checks performed (lockfile presence, npm audit, non-exact ranges, CI deterministic install, CI audit step), PR comment and label behavior (vigilante:flagged-security-review), checkbox-driven remediation flow, and the package_hardening_enabled config toggle. Closes #392
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nodejstech stack.package.json, Vigilante checks lockfile presence, runsnpm audit, flags non-exact dependency ranges, and verifies CI uses deterministic install paths.implement fixescheckbox; applies thevigilante:flagged-security-reviewlabel when issues are found.implement fixesbox, Vigilante adds aneyesreaction and dispatches an agentic remediation session scoped to the PR branch.package_hardening_enabledconfig toggle (defaults to enabled).Changes
internal/hardening/— New package with deterministic checks (hardening.go), PR comment formatting/parsing with checkbox detection (comment.go), and comprehensive tests.internal/state/state.go—PackageHardeningEnabledconfig field,HardeningPRStatetype, and hardening state persistence..github/labels.json— Newvigilante:flagged-security-reviewlabel in the label taxonomy.internal/backend/— ExtendedPullRequestManagerinterface withListOpenPullRequests,ListPullRequestFiles,CommentOnPullRequest,AddPullRequestCommentReaction,AddPullRequestLabel, andListPullRequestComments.internal/github/github.go— GitHub CLI helpers for the new PR operations.internal/app/app.go—scanPackageHardeningForTargetsintegration inScanOnce, checkbox detection, and remediation dispatch.internal/provider/—PackageRemediationTasktype andBuildPackageRemediationInvocationon all providers.internal/skill/skill.go—BuildPackageRemediationPromptfor agentic remediation sessions.Test plan
extractPackageJSONPathswith various file patterns,isNodeJSTargetwith different tech stacks, config gatinggo fmt,go vet,go test ./...all cleanCloses #389