Skip to content

feat: add custom config support and security auditor pipeline#4

Merged
pontino merged 7 commits intomainfrom
feat/custom-config-and-security-auditor
Nov 24, 2025
Merged

feat: add custom config support and security auditor pipeline#4
pontino merged 7 commits intomainfrom
feat/custom-config-and-security-auditor

Conversation

@pontino
Copy link
Copy Markdown
Collaborator

@pontino pontino commented Nov 24, 2025

Overview

Enhanced QualOps with flexible custom configuration system and security auditor pipeline.

Key Features

Custom Configuration Support

  • Added --config CLI option to load custom config files
  • Configs are completely independent (no inheritance)
  • Example: qualops --config examples/security-auditor/security-auditor.qualopsrc.json

Security Auditor Pipeline

  • 5 specialized security passes (Token/Storage, XSS, Auth, API, Crypto)
  • Custom prompts with CWE/OWASP mapping
  • High confidence threshold (9+) for low false-positive rate

Configuration Cleanup

  • Removed deprecated fields: reactReview, multiPassReview, filter section
  • Removed Nx-specific code (already clean in standalone version)
  • Cleaned up config types and environment variables

Structure Reorganization

  • Created examples/angular-nx-monorepo/ for framework-specific configs
  • Created examples/security-auditor/ with security pipeline
  • Added qualops-llm.txt (1,342-line LLM agent guide) to root

Usage

# Security audit
qualops --config examples/security-auditor/security-auditor.qualopsrc.json --files src/

# Angular/Nx project
qualops --config examples/angular-nx-monorepo/signalstore-migration.qualopsrc.json

- Remove hardcoded file extension filtering (.ts, .py) from file-parser.ts
- Remove hardcoded .ts filtering from batch-processor.ts
- Rename tsFiles to filesToReview for language-agnostic naming
- Fix glob CommonJS import compatibility
- Add explicit JSON escaping instructions to file-reviewer.ts
- Add custom config support via -c, --config flag
- Create Python quality configuration and prompts

This makes QualOps work with any language specified by the user,
trusting the files option without hardcoded assumptions.
…tibility

- Install tsx as dev dependency
- Update dev script to use tsx instead of node --experimental-strip-types
- Remove --experimental-strip-types from cli.ts shebang
- Fix glob import for CommonJS/ESM compatibility
- Enables language-agnostic file processing without module resolution issues
Resolved conflicts:
- package.json: Keep tsx dev script and LC_ALL=en_US test script
The projects folder is for local testing and should not be tracked in git.
- Fix import order in all-command.ts (config before session-context)
- Remove unused error variable in file-reviewer.ts catch block
- Remove TS-specific filtering tests (.d.ts, .tsx)
- Update tests to expect all file types without filtering
- Remove tests for non-existent features (reactReview, multiPassReview, filter)
- Fix mock expectations for glob patterns

These changes align tests with our language-agnostic approach where
file filtering is controlled by skipPatterns config rather than
hardcoded TS-specific logic.
@pontino pontino requested a review from gsanseverino November 24, 2025 16:17
@pontino pontino merged commit a804173 into main Nov 24, 2025
1 check passed
@pontino pontino deleted the feat/custom-config-and-security-auditor branch November 24, 2025 16:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant