v2.7.0 release: production stability and multi-runtime hardening

[flyingrobots]

Summary

This PR finalizes the 2.7.0 release, refactoring the core infrastructure for production stability and cross-runtime compatibility (Node.js, Bun, Deno).

Key Changes

• Refactored GitStream: Implemented idempotent destruction and memory-efficient collection.
• Hardened Security: Tightened environment policies and implemented strict command sanitization with global flag blocking.
• Enhanced Orchestration: Corrected backoff logic and implemented total operation timeouts.
• Canonical Persistence: Updated to use for messages and fixed Git date formatting.
• Domain Purity: Standardized entity constructors with Zod validation and removed Node-specific dependencies from the main entry point.
• Full Documentation: Added Design Principles, Security Model, and comprehensive usage examples.

Verification

• 133 tests passed across all runtimes via Docker Compose.
• Address all CodeRabbitAI review feedback.

Summary by CodeRabbit

Release Notes

• New Features

  • Published comprehensive Security Model documentation detailing environment controls, prohibited operations, and resource protection mechanisms
  • Strengthened security validation for command and flag processing

• Documentation

  • Restructured README around security-first design principles
  • Simplified API examples and updated documentation navigation

• Bug Fixes

  • Resolved stream handling edge case preventing double-destruction

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

This PR implements a hardened security model for Git command execution, restructuring flag and environment validation, simplifying message delivery via stdin, enhancing resource cleanup idempotency, and updating documentation to emphasize security-by-default design principles.

Changes

Cohort / File(s)	Summary
Documentation & Security Policy README.md, SECURITY.md	README refactored to highlight Design Principles (security-by-default, streaming-first, domain purity) over implementation details; extensive sections on runners and streaming removed. SECURITY.md renamed from "Security Policy" to "Security Model" with new sections on Prohibited Flags, Whitelisted Commands, Environment Policy, OOM/Resource Protection, and vulnerability reporting.
Core Security Services src/domain/services/CommandSanitizer.js, src/domain/services/EnvironmentPolicy.js	CommandSanitizer restructured: PROHIBITED_FLAGS renamed to PROHIBITED_GLOBAL_FLAGS with new PROHIBITED_COMMAND_FLAGS set; global flags now prohibited anywhere (not just pre-subcommand); cache key strategy optimized using composite key; --version added as special-case allowlist. EnvironmentPolicy: GIT_EXEC_PATH and GIT_TEMPLATE_DIR moved from allowed to blocked list; GIT_CONFIG_PARAMETERS added to blocked keys.
Git Command Infrastructure src/domain/services/GitPersistenceService.js, src/domain/services/GitCommandBuilder.js, src/domain/services/GitBinaryChecker.js	GitPersistenceService changes commit message delivery from builder.message() to stdin input stream. GitCommandBuilder documentation clarified (removed shared pretty-print note). GitBinaryChecker comment updated to note sanitizer special-case handling of --version.
Domain Entities & Value Objects src/domain/entities/GitTree.js, src/domain/value-objects/GitRef.js	GitTree constructor broadened to accept `GitSha
Stream Infrastructure src/infrastructure/GitStream.js	Introduces shared TextEncoder instance and _destroyed flag; optimizes chunk encoding; adds idempotent destroy guard to prevent double destruction.
Test Updates test/domain/services/CommandSanitizer.test.js, test/domain/services/GitCommandBuilder.test.js	CommandSanitizer tests broaden to verify global flags blocked anywhere; --version special case isolated; memoization test simplified. GitCommandBuilder test removes .message() call from commitTree chain and updates expected args accordingly.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• feat: multi-runtime support and hexagonal architecture hardening #1: Makes complementary targeted changes to the same core services and entities (CommandSanitizer, EnvironmentPolicy, GitTree, GitPersistenceService, GitStream, etc.), suggesting coordinated security hardening and validation infrastructure.

Poem

🐰✨ Flags now forbidden far and wide,
Messages flow through stdin's tide,
Security by design, our delight,
Git plumbing wrapped tight—
Hopping toward hardened skies! 🌟

✨ Finishing touches

• 📝 Generate docstrings

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2704980 and 8760169.

📒 Files selected for processing (13)

• README.md
• SECURITY.md
• src/combined_files.txt
• src/domain/entities/GitTree.js
• src/domain/services/CommandSanitizer.js
• src/domain/services/EnvironmentPolicy.js
• src/domain/services/GitBinaryChecker.js
• src/domain/services/GitCommandBuilder.js
• src/domain/services/GitPersistenceService.js
• src/domain/value-objects/GitRef.js
• src/infrastructure/GitStream.js
• test/domain/services/CommandSanitizer.test.js
• test/domain/services/GitCommandBuilder.test.js

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}