chore: integrate OSS-readiness into main

.env.example

@@ -0,0 +1,7 @@
+# Copy to .env and fill in your keys. Never commit the real .env.
+# Client-side dev key — injected by Vite as process.env.API_KEY
+# (see vite.config.ts). Get one at https://aistudio.google.com/apikey
+GEMINI_API_KEY=your_gemini_api_key_here
+
+# Server-side key for the production reference in server/api/analyze.ts
+SERVER_SIDE_API_KEY=your_server_side_gemini_api_key_here

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,35 @@
+name: Bug report
+description: Report a problem so we can fix it
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: How can we reproduce it?
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, runtime version, package versions.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Suggest an idea or improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: What problem would this feature solve?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,24 @@
+# Pull Request
+
+## Summary
+
+<!-- What does this PR change and why? -->
+
+## Type of change
+
+- [ ] feat (new feature)
+- [ ] fix (bug fix)
+- [ ] docs
+- [ ] refactor / chore / ci
+
+## Checklist
+
+- [ ] Targets the `dev` branch (not `main`).
+- [ ] Builds locally.
+- [ ] Tests pass (if applicable).
+- [ ] No secrets / credentials / `.env` values committed.
+- [ ] Linked the related issue (if any).
+
+## Notes for reviewers
+
+<!-- Anything reviewers should pay special attention to. -->

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions fresh.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  # npm — active only when a manifest exists (Dependabot ignores otherwise).
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  # pip / uv — active only when a Python manifest exists.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,57 @@
+# Reusable OSS CI for Node.js projects.
+# Defensive by design: missing lockfile / scripts must NOT turn the build red.
+name: CI
+
+on:
+  push:
+    branches: [main, master, dev]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['20', '22']
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Detect package manager
+        id: pm
+        run: |
+          if [ -f pnpm-lock.yaml ]; then echo "pm=pnpm" >> "$GITHUB_OUTPUT";
+          elif [ -f yarn.lock ]; then echo "pm=yarn" >> "$GITHUB_OUTPUT";
+          else echo "pm=npm" >> "$GITHUB_OUTPUT"; fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: |
+          if [ "${{ steps.pm.outputs.pm }}" = "pnpm" ]; then
+            corepack enable && pnpm install --frozen-lockfile || pnpm install
+          elif [ "${{ steps.pm.outputs.pm }}" = "yarn" ]; then
+            corepack enable && yarn install --frozen-lockfile || yarn install
+          elif [ -f package-lock.json ]; then
+            npm ci || npm install
+          else
+            npm install
+          fi
+
+      - name: Lint (if present)
+        run: npm run lint --if-present
+
+      - name: Type check (if present)
+        run: npm run typecheck --if-present
+
+      - name: Build (if present)
+        run: npm run build --if-present
+
+      - name: Test (if present)
+        run: npm test --if-present

.github/workflows/gitleaks.yml

@@ -0,0 +1,24 @@
+# Secret scanning on every push and PR.
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # GITLEAKS_LICENSE is only required for GitHub organizations.
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.github/workflows/openhands-resolver.yml

@@ -0,0 +1,48 @@
+# OpenHands autonomous issue resolver.
+# Label an issue `fix-me` (or comment `@openhands-agent`) and OpenHands
+# opens a pull request with a proposed fix.
+#
+# SETUP (repo secrets/variables) — until configured the job no-ops, so it
+# never turns CI red:
+#   secrets.LLM_API_KEY   : your model API key (e.g. Anthropic)
+#   secrets.PAT_TOKEN     : a GitHub PAT with repo + workflow scope
+#   vars.LLM_MODEL        : e.g. anthropic/claude-sonnet-4-5
+# Docs: https://docs.openhands.dev/usage/how-to/github-action
+name: OpenHands Resolver
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  resolve:
+    if: |
+      github.event.label.name == 'fix-me' ||
+      contains(github.event.comment.body, '@openhands-agent')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Guard — require LLM_API_KEY before running
+        id: guard
+        run: |
+          if [ -z "${{ secrets.LLM_API_KEY }}" ]; then
+            echo "LLM_API_KEY not set; skipping OpenHands run." >&2
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Run OpenHands resolver
+        if: steps.guard.outputs.ready == 'true'
+        uses: OpenHands/OpenHands@main
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+          llm-api-key: ${{ secrets.LLM_API_KEY }}
+          llm-model: ${{ vars.LLM_MODEL }}

.gitignore

@@ -22,3 +22,8 @@ dist-ssr
 *.njsproj
 *.sln
 *.sw?
+
+# Added by oss-harness: never commit secrets
+.env
+.env.*
+!.env.example

CODE_OF_CONDUCT.md

@@ -0,0 +1,49 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic
+status, nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and unwelcome advances
+- Trolling, insulting or derogatory comments, personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards
+and will take appropriate and fair corrective action in response to any
+behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies
+when an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the maintainers at satomaru.fac.0505@gmail.com. All complaints will be
+reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1.
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing to AudioSpec_Analyzer
+
+Thanks for your interest in contributing! This guide keeps changes safe,
+reviewable, and consistent.
+
+## Getting started
+
+1. Fork the repository and clone your fork.
+2. Install dependencies (see the README for the exact commands).
+3. Create a branch from `dev`:
+   `git switch -c feature/<topic> dev`
+
+## Branching model
+
+We use a three-tier flow: `main` -> `dev` -> `feature/*`.
+
+- `main` is always releasable. Do not commit to it directly.
+- `dev` is the integration branch where features are validated.
+- `feature/<topic>` is where you do the actual work.
+
+Open pull requests against `dev` (not `main`).
+
+## Commit style
+
+Use [Conventional Commits](https://www.conventionalcommits.org/):
+
+- `feat:` a new feature
+- `fix:` a bug fix
+- `docs:`, `test:`, `refactor:`, `chore:`, `perf:`, `ci:`
+
+Keep one logical change per commit, written in the imperative mood
+(`add`, not `added`).
+
+## Before you open a PR
+
+- [ ] Code builds locally.
+- [ ] Tests pass (if the project has tests).
+- [ ] No secrets, credentials, or `.env` values are committed.
+- [ ] The PR description explains the what and the why.
+
+## Reporting bugs and requesting features
+
+Open an issue using the provided templates. Include reproduction steps,
+expected vs. actual behavior, and environment details.
+
+## Code of Conduct
+
+By participating you agree to uphold our
+[Code of Conduct](./CODE_OF_CONDUCT.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 stewroux
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.