Plan review: add compatibility fallback design + test vectors#3847

Open

nguyenhoangduc0707-lang wants to merge 14 commits into

github:mainfrom

nguyenhoangduc0707-lang:compat/plan-review-fallback

Commits on Jun 18, 2026

Add plan review menu compatibility design and test vectors

Admin
and
Copilot
committed
Add TypeScript prototype parser for plan-review menus and unit tests (JSON-first then bullets heuristic)

Admin
and
Copilot
committed
Enhance parser: add YAML parsing and stronger id extraction; add YAML + id-extraction tests\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Admin
committed
Add integration example and instructions for wiring parser into plan-mode flow\n\nProvides TypeScript and Go examples and testing notes.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.…
Admin
committed
Add generic patch to integrate parsePlanReviewOptions into plan-approval flow (placeholder path)\n\nIncludes unified-diff style patch and notes for maintainers.\n\nCo-authored-by: Copilot <22355621…
Admin
committed
Add GitHub Actions CI for plan-review parser prototype tests on PRs\n\nRuns npm ci and npm test to validate prototype behavior.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Admin
committed
Add feature-flag and sanitization for plan-review fallback; enable fallback in tests via options\n\n- Feature flag: COPILOT_PLAN_FALLBACK=1 or options.enableFallback=true; disabled by default\n- Sa…
Admin
committed
Add OAuth2 implementation plan and detailed security checklist to plan.md\n\nIncludes tasks, detailed steps, acceptance criteria, estimated time, and a comprehensive security checklist for tokens/s…
Admin
committed
Add .env.example with recommended env vars (OAuth, session, Redis, feature flags)\n\nDo NOT commit real secrets; use GitHub Secrets or a vault.
Admin
committed
Harden parser: limit candidate size, cap menu items, use JSON_SCHEMA for YAML parsing to avoid unsafe tags
Admin
committed
Security: override serialize-javascript to 7.0.6 to mitigate known vulnerabilities; update lockfile
Admin
committed
Add security automation: Dependabot, truffleHog secret-scan, and CodeQL workflows
Admin
committed
Security: add husky + secretlint pre-commit hook and parser fuzz/security tests
Admin
committed
Add comprehensive SECURITY_AUDIT_REPORT.md (audit summary, findings, remediations, roadmap)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Admin
committed