@codebakers/cli 2.4.0 → 2.6.0

package/dist/mcp/server.js

@@ -1536,6 +1536,7 @@ Just describe what you want to build! I'll automatically:
     async handleUpgrade(args) {
         const { areas = ['all'], severity = 'all', dryRun = false } = args;
         const context = this.gatherProjectContext();
+        const cwd = process.cwd();
         let response = `# ⬆️ Project Upgrade Analysis\n\n`;
         // Stack detection
         response += `## Your Stack (Preserving As-Is)\n\n`;
@@ -1569,6 +1570,325 @@ Just describe what you want to build! I'll automatically:
         const hasNext = context.dependencies.includes('next');
         response += `| Framework | ${hasNext ? 'Next.js' : 'Unknown'} | ✓ Keeping |\n`;
         response += `\n---\n\n`;
+        // Git Analysis Section
+        response += `## Deep Analysis\n\n`;
+        // Check if git repo
+        const isGitRepo = fs.existsSync(path.join(cwd, '.git'));
+        if (isGitRepo) {
+            response += `### Git Hot Spots (Most Changed Files)\n\n`;
+            try {
+                // Get files with most commits
+                const gitLog = (0, child_process_1.execSync)('git log --pretty=format: --name-only --since="6 months ago" 2>/dev/null | sort | uniq -c | sort -rg | head -10', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+                if (gitLog) {
+                    const hotSpots = gitLog.split('\n')
+                        .map(line => line.trim())
+                        .filter(line => line && !line.includes('node_modules'))
+                        .slice(0, 5);
+                    if (hotSpots.length > 0) {
+                        hotSpots.forEach((line, i) => {
+                            const match = line.match(/^\s*(\d+)\s+(.+)$/);
+                            if (match) {
+                                const [, count, file] = match;
+                                response += `${i + 1}. \`${file}\` - ${count} changes\n`;
+                            }
+                        });
+                        response += `\n`;
+                    }
+                }
+                // Count fix commits
+                const fixCount = (0, child_process_1.execSync)('git log --oneline --since="6 months ago" 2>/dev/null | grep -i "fix" | wc -l', { cwd, encoding: 'utf-8', timeout: 5000 }).trim();
+                if (parseInt(fixCount) > 0) {
+                    response += `**Bug Fix Commits:** ${fixCount} (in last 6 months)\n\n`;
+                }
+            }
+            catch {
+                response += `*(Git analysis unavailable)*\n\n`;
+            }
+        }
+        else {
+            response += `*(Not a git repository - skipping git analysis)*\n\n`;
+        }
+        // TODO/FIXME Scan
+        response += `### Developer Notes (TODO/FIXME)\n\n`;
+        try {
+            const todoScan = (0, child_process_1.execSync)('grep -r "TODO\\|FIXME\\|HACK\\|XXX\\|BUG" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" -l 2>/dev/null | head -20', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+            if (todoScan) {
+                const todoFiles = todoScan.split('\n').filter(f => !f.includes('node_modules'));
+                const todoCount = todoFiles.length;
+                if (todoCount > 0) {
+                    response += `Found developer notes in **${todoCount} files**:\n\n`;
+                    // Count by type
+                    try {
+                        const todoTypes = (0, child_process_1.execSync)('grep -roh "TODO\\|FIXME\\|HACK\\|XXX\\|BUG" --include="*.ts" --include="*.tsx" 2>/dev/null | sort | uniq -c | sort -rg', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+                        if (todoTypes) {
+                            todoTypes.split('\n').forEach(line => {
+                                const match = line.trim().match(/^\s*(\d+)\s+(.+)$/);
+                                if (match) {
+                                    const [, count, type] = match;
+                                    const icon = type === 'FIXME' || type === 'BUG' ? '🔴' :
+                                        type === 'HACK' ? '🟡' : '📝';
+                                    response += `- ${icon} ${count} ${type}s\n`;
+                                }
+                            });
+                            response += `\n`;
+                        }
+                    }
+                    catch {
+                        // Ignore count errors
+                    }
+                    response += `*I can implement these TODOs and fix FIXMEs during upgrade.*\n\n`;
+                }
+            }
+            else {
+                response += `✅ No TODO/FIXME comments found - clean codebase!\n\n`;
+            }
+        }
+        catch {
+            response += `*(TODO scan unavailable)*\n\n`;
+        }
+        // Dependency Security Scan (npm audit)
+        response += `### 🔒 Dependency Security Scan\n\n`;
+        try {
+            const auditOutput = (0, child_process_1.execSync)('npm audit --json 2>/dev/null', {
+                cwd,
+                encoding: 'utf-8',
+                timeout: 30000,
+            });
+            const audit = JSON.parse(auditOutput);
+            const vulns = audit.metadata?.vulnerabilities || {};
+            const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+            if (total > 0) {
+                response += `Found **${total} vulnerabilities**:\n\n`;
+                if (vulns.critical > 0)
+                    response += `- 🔴 **${vulns.critical} Critical**\n`;
+                if (vulns.high > 0)
+                    response += `- 🟠 **${vulns.high} High**\n`;
+                if (vulns.moderate > 0)
+                    response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+                if (vulns.low > 0)
+                    response += `- 🟢 **${vulns.low} Low**\n`;
+                response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+            }
+            else {
+                response += `✅ No known vulnerabilities in dependencies!\n\n`;
+            }
+        }
+        catch (error) {
+            // npm audit exits with non-zero if vulnerabilities found
+            const execError = error;
+            if (execError.stdout) {
+                try {
+                    const audit = JSON.parse(execError.stdout);
+                    const vulns = audit.metadata?.vulnerabilities || {};
+                    const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+                    if (total > 0) {
+                        response += `Found **${total} vulnerabilities**:\n\n`;
+                        if (vulns.critical > 0)
+                            response += `- 🔴 **${vulns.critical} Critical**\n`;
+                        if (vulns.high > 0)
+                            response += `- 🟠 **${vulns.high} High**\n`;
+                        if (vulns.moderate > 0)
+                            response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+                        if (vulns.low > 0)
+                            response += `- 🟢 **${vulns.low} Low**\n`;
+                        response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+                    }
+                }
+                catch {
+                    response += `*(Dependency scan unavailable)*\n\n`;
+                }
+            }
+            else {
+                response += `*(Dependency scan unavailable)*\n\n`;
+            }
+        }
+        // TypeScript Strictness Check
+        response += `### 📝 TypeScript Configuration\n\n`;
+        try {
+            const tsconfigPath = path.join(cwd, 'tsconfig.json');
+            if (fs.existsSync(tsconfigPath)) {
+                const tsconfig = JSON.parse(fs.readFileSync(tsconfigPath, 'utf-8'));
+                const compilerOptions = tsconfig.compilerOptions || {};
+                const checks = [
+                    { name: 'strict', value: compilerOptions.strict, recommended: true },
+                    { name: 'noImplicitAny', value: compilerOptions.noImplicitAny, recommended: true },
+                    { name: 'strictNullChecks', value: compilerOptions.strictNullChecks, recommended: true },
+                    { name: 'noUnusedLocals', value: compilerOptions.noUnusedLocals, recommended: true },
+                    { name: 'noUnusedParameters', value: compilerOptions.noUnusedParameters, recommended: true },
+                ];
+                const enabled = checks.filter(c => c.value === true);
+                const missing = checks.filter(c => c.value !== true && c.recommended);
+                if (compilerOptions.strict === true) {
+                    response += `✅ **Strict mode enabled** - Good!\n\n`;
+                }
+                else {
+                    response += `⚠️ **Strict mode not enabled**\n\n`;
+                    if (missing.length > 0) {
+                        response += `Missing recommended options:\n`;
+                        missing.forEach(m => {
+                            response += `- \`${m.name}: true\`\n`;
+                        });
+                        response += `\n`;
+                    }
+                }
+                // Check for any types
+                try {
+                    const anyCount = (0, child_process_1.execSync)('grep -r ": any" --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v node_modules | wc -l', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+                    const count = parseInt(anyCount);
+                    if (count > 10) {
+                        response += `⚠️ Found **${count}** uses of \`: any\` - consider typing these\n\n`;
+                    }
+                    else if (count > 0) {
+                        response += `📝 Found **${count}** uses of \`: any\`\n\n`;
+                    }
+                }
+                catch {
+                    // Ignore
+                }
+            }
+            else {
+                response += `⚠️ No tsconfig.json found - not a TypeScript project?\n\n`;
+            }
+        }
+        catch {
+            response += `*(TypeScript check unavailable)*\n\n`;
+        }
+        // Environment Variable Audit
+        response += `### 🔐 Environment Variable Audit\n\n`;
+        try {
+            const envExamplePath = path.join(cwd, '.env.example');
+            const envLocalPath = path.join(cwd, '.env.local');
+            const envPath = path.join(cwd, '.env');
+            const hasEnvExample = fs.existsSync(envExamplePath);
+            const hasEnvLocal = fs.existsSync(envLocalPath);
+            const hasEnv = fs.existsSync(envPath);
+            if (hasEnvExample) {
+                response += `✅ \`.env.example\` exists - good for documentation\n`;
+            }
+            else {
+                response += `⚠️ No \`.env.example\` - add one for team onboarding\n`;
+            }
+            // Check for hardcoded secrets in code
+            try {
+                const secretPatterns = [
+                    'sk-[a-zA-Z0-9]{20,}', // OpenAI keys
+                    'sk_live_[a-zA-Z0-9]+', // Stripe live keys
+                    'pk_live_[a-zA-Z0-9]+', // Stripe public live keys
+                    'ghp_[a-zA-Z0-9]+', // GitHub tokens
+                    'AKIA[A-Z0-9]{16}', // AWS access keys
+                ];
+                let secretsFound = 0;
+                for (const pattern of secretPatterns) {
+                    try {
+                        const matches = (0, child_process_1.execSync)(`grep -rE "${pattern}" --include="*.ts" --include="*.tsx" --include="*.js" 2>/dev/null | grep -v node_modules | grep -v ".env" | wc -l`, { cwd, encoding: 'utf-8', timeout: 5000 }).trim();
+                        secretsFound += parseInt(matches) || 0;
+                    }
+                    catch {
+                        // Pattern not found
+                    }
+                }
+                if (secretsFound > 0) {
+                    response += `\n🔴 **CRITICAL: Found ${secretsFound} potential hardcoded secrets in code!**\n`;
+                    response += `*These should be moved to environment variables immediately.*\n`;
+                }
+                else {
+                    response += `\n✅ No hardcoded secrets detected in code\n`;
+                }
+            }
+            catch {
+                // Ignore
+            }
+            // Check if .env is gitignored
+            try {
+                const gitignorePath = path.join(cwd, '.gitignore');
+                if (fs.existsSync(gitignorePath)) {
+                    const gitignore = fs.readFileSync(gitignorePath, 'utf-8');
+                    if (!gitignore.includes('.env')) {
+                        response += `\n⚠️ \`.env\` not in .gitignore - secrets could be committed!\n`;
+                    }
+                }
+            }
+            catch {
+                // Ignore
+            }
+            response += `\n`;
+        }
+        catch {
+            response += `*(Environment audit unavailable)*\n\n`;
+        }
+        // Test Coverage Analysis
+        response += `### 🧪 Test Coverage\n\n`;
+        try {
+            const hasPlaywright = context.dependencies.includes('@playwright/test');
+            const hasVitest = context.dependencies.includes('vitest');
+            const hasJest = context.dependencies.includes('jest');
+            if (hasPlaywright || hasVitest || hasJest) {
+                const framework = hasPlaywright ? 'Playwright' : hasVitest ? 'Vitest' : 'Jest';
+                response += `✅ Test framework detected: **${framework}**\n\n`;
+                // Count test files
+                try {
+                    const testFiles = (0, child_process_1.execSync)('find . -name "*.test.ts" -o -name "*.test.tsx" -o -name "*.spec.ts" -o -name "*.spec.tsx" 2>/dev/null | grep -v node_modules | wc -l', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+                    const count = parseInt(testFiles);
+                    if (count > 0) {
+                        response += `Found **${count} test files**\n\n`;
+                    }
+                    else {
+                        response += `⚠️ No test files found - add tests!\n\n`;
+                    }
+                }
+                catch {
+                    // Ignore
+                }
+            }
+            else {
+                response += `⚠️ **No test framework detected**\n\n`;
+                response += `Recommended: Add \`vitest\` or \`@playwright/test\`\n\n`;
+            }
+        }
+        catch {
+            response += `*(Test analysis unavailable)*\n\n`;
+        }
+        // API Endpoint Inventory
+        response += `### 🔌 API Endpoint Inventory\n\n`;
+        if (context.existingApiRoutes.length > 0) {
+            response += `Found **${context.existingApiRoutes.length} API routes**:\n\n`;
+            // Check for auth protection on routes
+            let protectedCount = 0;
+            let unprotectedCount = 0;
+            for (const route of context.existingApiRoutes.slice(0, 10)) {
+                try {
+                    const routePath = path.join(cwd, route);
+                    if (fs.existsSync(routePath)) {
+                        const content = fs.readFileSync(routePath, 'utf-8');
+                        const hasAuth = content.includes('getServerSession') ||
+                            content.includes('auth(') ||
+                            content.includes('requireAuth') ||
+                            content.includes('Authorization') ||
+                            content.includes('authenticate');
+                        if (hasAuth) {
+                            protectedCount++;
+                        }
+                        else {
+                            unprotectedCount++;
+                        }
+                    }
+                }
+                catch {
+                    // Ignore
+                }
+            }
+            if (protectedCount > 0 || unprotectedCount > 0) {
+                response += `- 🔒 **${protectedCount}** routes with auth checks\n`;
+                response += `- 🔓 **${unprotectedCount}** routes without visible auth\n\n`;
+                if (unprotectedCount > protectedCount) {
+                    response += `⚠️ *Many routes lack visible auth - review if intentional*\n\n`;
+                }
+            }
+        }
+        else {
+            response += `No API routes detected yet.\n\n`;
+        }
+        response += `---\n\n`;
         // Scan for upgrade opportunities
         response += `## Upgrade Opportunities\n\n`;
         const upgrades = [];
@@ -1626,18 +1946,26 @@ Just describe what you want to build! I'll automatically:
         if (upgrades.length === 0) {
             response += `✅ No major upgrade opportunities detected!\n\n`;
         }
+        // Review mode options
+        response += `---\n\n`;
+        response += `## Review Modes\n\n`;
+        response += `Pick a focus for the upgrade:\n\n`;
+        response += `- **Security Audit** - Auth, secrets, injections, OWASP top 10\n`;
+        response += `- **Performance Review** - Bundle size, queries, caching\n`;
+        response += `- **Code Quality** - Patterns, DRY, complexity\n`;
+        response += `- **Pre-Launch** - Everything for production\n`;
+        response += `- **Quick Scan** - Top 5 issues only\n`;
+        response += `- **Comprehensive** - All of the above\n\n`;
         // Recommendations
         response += `---\n\n`;
         response += `## Recommended Actions\n\n`;
         if (dryRun) {
             response += `**(Dry Run Mode - No changes will be made)**\n\n`;
         }
-        response += `1. Run \`run_audit\` for detailed code quality check\n`;
-        response += `2. Use \`heal\` to auto-fix common issues\n`;
-        response += `3. Request specific upgrades like:\n`;
-        response += `   - "Add Zod validation to my API routes"\n`;
-        response += `   - "Add error boundaries to components"\n`;
-        response += `   - "Set up Playwright testing"\n\n`;
+        response += `1. Tell me your main concerns (security, performance, etc.)\n`;
+        response += `2. I'll prioritize fixes based on your needs\n`;
+        response += `3. Hot spot files get fixed first (where bugs live)\n`;
+        response += `4. I'll implement your TODOs and fix FIXMEs along the way\n\n`;
         response += `---\n\n`;
         response += `**Key Principle:** Your stack stays the same. Only code quality patterns are upgraded.\n`;
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codebakers/cli",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "CodeBakers CLI - Production patterns for AI-assisted development",
   "main": "dist/index.js",
   "bin": {

package/src/mcp/server.ts

@@ -1729,6 +1729,7 @@ Just describe what you want to build! I'll automatically:
   private async handleUpgrade(args: { areas?: string[]; severity?: string; dryRun?: boolean }) {
     const { areas = ['all'], severity = 'all', dryRun = false } = args;
     const context = this.gatherProjectContext();
+    const cwd = process.cwd();
 
     let response = `# ⬆️ Project Upgrade Analysis\n\n`;
 
@@ -1762,6 +1763,349 @@ Just describe what you want to build! I'll automatically:
 
     response += `\n---\n\n`;
 
+    // Git Analysis Section
+    response += `## Deep Analysis\n\n`;
+
+    // Check if git repo
+    const isGitRepo = fs.existsSync(path.join(cwd, '.git'));
+
+    if (isGitRepo) {
+      response += `### Git Hot Spots (Most Changed Files)\n\n`;
+      try {
+        // Get files with most commits
+        const gitLog = execSync(
+          'git log --pretty=format: --name-only --since="6 months ago" 2>/dev/null | sort | uniq -c | sort -rg | head -10',
+          { cwd, encoding: 'utf-8', timeout: 10000 }
+        ).trim();
+
+        if (gitLog) {
+          const hotSpots = gitLog.split('\n')
+            .map(line => line.trim())
+            .filter(line => line && !line.includes('node_modules'))
+            .slice(0, 5);
+
+          if (hotSpots.length > 0) {
+            hotSpots.forEach((line, i) => {
+              const match = line.match(/^\s*(\d+)\s+(.+)$/);
+              if (match) {
+                const [, count, file] = match;
+                response += `${i + 1}. \`${file}\` - ${count} changes\n`;
+              }
+            });
+            response += `\n`;
+          }
+        }
+
+        // Count fix commits
+        const fixCount = execSync(
+          'git log --oneline --since="6 months ago" 2>/dev/null | grep -i "fix" | wc -l',
+          { cwd, encoding: 'utf-8', timeout: 5000 }
+        ).trim();
+
+        if (parseInt(fixCount) > 0) {
+          response += `**Bug Fix Commits:** ${fixCount} (in last 6 months)\n\n`;
+        }
+      } catch {
+        response += `*(Git analysis unavailable)*\n\n`;
+      }
+    } else {
+      response += `*(Not a git repository - skipping git analysis)*\n\n`;
+    }
+
+    // TODO/FIXME Scan
+    response += `### Developer Notes (TODO/FIXME)\n\n`;
+    try {
+      const todoScan = execSync(
+        'grep -r "TODO\\|FIXME\\|HACK\\|XXX\\|BUG" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" -l 2>/dev/null | head -20',
+        { cwd, encoding: 'utf-8', timeout: 10000 }
+      ).trim();
+
+      if (todoScan) {
+        const todoFiles = todoScan.split('\n').filter(f => !f.includes('node_modules'));
+        const todoCount = todoFiles.length;
+
+        if (todoCount > 0) {
+          response += `Found developer notes in **${todoCount} files**:\n\n`;
+
+          // Count by type
+          try {
+            const todoTypes = execSync(
+              'grep -roh "TODO\\|FIXME\\|HACK\\|XXX\\|BUG" --include="*.ts" --include="*.tsx" 2>/dev/null | sort | uniq -c | sort -rg',
+              { cwd, encoding: 'utf-8', timeout: 10000 }
+            ).trim();
+
+            if (todoTypes) {
+              todoTypes.split('\n').forEach(line => {
+                const match = line.trim().match(/^\s*(\d+)\s+(.+)$/);
+                if (match) {
+                  const [, count, type] = match;
+                  const icon = type === 'FIXME' || type === 'BUG' ? '🔴' :
+                    type === 'HACK' ? '🟡' : '📝';
+                  response += `- ${icon} ${count} ${type}s\n`;
+                }
+              });
+              response += `\n`;
+            }
+          } catch {
+            // Ignore count errors
+          }
+
+          response += `*I can implement these TODOs and fix FIXMEs during upgrade.*\n\n`;
+        }
+      } else {
+        response += `✅ No TODO/FIXME comments found - clean codebase!\n\n`;
+      }
+    } catch {
+      response += `*(TODO scan unavailable)*\n\n`;
+    }
+
+    // Dependency Security Scan (npm audit)
+    response += `### 🔒 Dependency Security Scan\n\n`;
+    try {
+      const auditOutput = execSync('npm audit --json 2>/dev/null', {
+        cwd,
+        encoding: 'utf-8',
+        timeout: 30000,
+      });
+      const audit = JSON.parse(auditOutput);
+      const vulns = audit.metadata?.vulnerabilities || {};
+      const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+
+      if (total > 0) {
+        response += `Found **${total} vulnerabilities**:\n\n`;
+        if (vulns.critical > 0) response += `- 🔴 **${vulns.critical} Critical**\n`;
+        if (vulns.high > 0) response += `- 🟠 **${vulns.high} High**\n`;
+        if (vulns.moderate > 0) response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+        if (vulns.low > 0) response += `- 🟢 **${vulns.low} Low**\n`;
+        response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+      } else {
+        response += `✅ No known vulnerabilities in dependencies!\n\n`;
+      }
+    } catch (error) {
+      // npm audit exits with non-zero if vulnerabilities found
+      const execError = error as { stdout?: string };
+      if (execError.stdout) {
+        try {
+          const audit = JSON.parse(execError.stdout);
+          const vulns = audit.metadata?.vulnerabilities || {};
+          const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+
+          if (total > 0) {
+            response += `Found **${total} vulnerabilities**:\n\n`;
+            if (vulns.critical > 0) response += `- 🔴 **${vulns.critical} Critical**\n`;
+            if (vulns.high > 0) response += `- 🟠 **${vulns.high} High**\n`;
+            if (vulns.moderate > 0) response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+            if (vulns.low > 0) response += `- 🟢 **${vulns.low} Low**\n`;
+            response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+          }
+        } catch {
+          response += `*(Dependency scan unavailable)*\n\n`;
+        }
+      } else {
+        response += `*(Dependency scan unavailable)*\n\n`;
+      }
+    }
+
+    // TypeScript Strictness Check
+    response += `### 📝 TypeScript Configuration\n\n`;
+    try {
+      const tsconfigPath = path.join(cwd, 'tsconfig.json');
+      if (fs.existsSync(tsconfigPath)) {
+        const tsconfig = JSON.parse(fs.readFileSync(tsconfigPath, 'utf-8'));
+        const compilerOptions = tsconfig.compilerOptions || {};
+
+        const checks = [
+          { name: 'strict', value: compilerOptions.strict, recommended: true },
+          { name: 'noImplicitAny', value: compilerOptions.noImplicitAny, recommended: true },
+          { name: 'strictNullChecks', value: compilerOptions.strictNullChecks, recommended: true },
+          { name: 'noUnusedLocals', value: compilerOptions.noUnusedLocals, recommended: true },
+          { name: 'noUnusedParameters', value: compilerOptions.noUnusedParameters, recommended: true },
+        ];
+
+        const enabled = checks.filter(c => c.value === true);
+        const missing = checks.filter(c => c.value !== true && c.recommended);
+
+        if (compilerOptions.strict === true) {
+          response += `✅ **Strict mode enabled** - Good!\n\n`;
+        } else {
+          response += `⚠️ **Strict mode not enabled**\n\n`;
+          if (missing.length > 0) {
+            response += `Missing recommended options:\n`;
+            missing.forEach(m => {
+              response += `- \`${m.name}: true\`\n`;
+            });
+            response += `\n`;
+          }
+        }
+
+        // Check for any types
+        try {
+          const anyCount = execSync(
+            'grep -r ": any" --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v node_modules | wc -l',
+            { cwd, encoding: 'utf-8', timeout: 10000 }
+          ).trim();
+          const count = parseInt(anyCount);
+          if (count > 10) {
+            response += `⚠️ Found **${count}** uses of \`: any\` - consider typing these\n\n`;
+          } else if (count > 0) {
+            response += `📝 Found **${count}** uses of \`: any\`\n\n`;
+          }
+        } catch {
+          // Ignore
+        }
+      } else {
+        response += `⚠️ No tsconfig.json found - not a TypeScript project?\n\n`;
+      }
+    } catch {
+      response += `*(TypeScript check unavailable)*\n\n`;
+    }
+
+    // Environment Variable Audit
+    response += `### 🔐 Environment Variable Audit\n\n`;
+    try {
+      const envExamplePath = path.join(cwd, '.env.example');
+      const envLocalPath = path.join(cwd, '.env.local');
+      const envPath = path.join(cwd, '.env');
+
+      const hasEnvExample = fs.existsSync(envExamplePath);
+      const hasEnvLocal = fs.existsSync(envLocalPath);
+      const hasEnv = fs.existsSync(envPath);
+
+      if (hasEnvExample) {
+        response += `✅ \`.env.example\` exists - good for documentation\n`;
+      } else {
+        response += `⚠️ No \`.env.example\` - add one for team onboarding\n`;
+      }
+
+      // Check for hardcoded secrets in code
+      try {
+        const secretPatterns = [
+          'sk-[a-zA-Z0-9]{20,}',  // OpenAI keys
+          'sk_live_[a-zA-Z0-9]+', // Stripe live keys
+          'pk_live_[a-zA-Z0-9]+', // Stripe public live keys
+          'ghp_[a-zA-Z0-9]+',     // GitHub tokens
+          'AKIA[A-Z0-9]{16}',     // AWS access keys
+        ];
+
+        let secretsFound = 0;
+        for (const pattern of secretPatterns) {
+          try {
+            const matches = execSync(
+              `grep -rE "${pattern}" --include="*.ts" --include="*.tsx" --include="*.js" 2>/dev/null | grep -v node_modules | grep -v ".env" | wc -l`,
+              { cwd, encoding: 'utf-8', timeout: 5000 }
+            ).trim();
+            secretsFound += parseInt(matches) || 0;
+          } catch {
+            // Pattern not found
+          }
+        }
+
+        if (secretsFound > 0) {
+          response += `\n🔴 **CRITICAL: Found ${secretsFound} potential hardcoded secrets in code!**\n`;
+          response += `*These should be moved to environment variables immediately.*\n`;
+        } else {
+          response += `\n✅ No hardcoded secrets detected in code\n`;
+        }
+      } catch {
+        // Ignore
+      }
+
+      // Check if .env is gitignored
+      try {
+        const gitignorePath = path.join(cwd, '.gitignore');
+        if (fs.existsSync(gitignorePath)) {
+          const gitignore = fs.readFileSync(gitignorePath, 'utf-8');
+          if (!gitignore.includes('.env')) {
+            response += `\n⚠️ \`.env\` not in .gitignore - secrets could be committed!\n`;
+          }
+        }
+      } catch {
+        // Ignore
+      }
+
+      response += `\n`;
+    } catch {
+      response += `*(Environment audit unavailable)*\n\n`;
+    }
+
+    // Test Coverage Analysis
+    response += `### 🧪 Test Coverage\n\n`;
+    try {
+      const hasPlaywright = context.dependencies.includes('@playwright/test');
+      const hasVitest = context.dependencies.includes('vitest');
+      const hasJest = context.dependencies.includes('jest');
+
+      if (hasPlaywright || hasVitest || hasJest) {
+        const framework = hasPlaywright ? 'Playwright' : hasVitest ? 'Vitest' : 'Jest';
+        response += `✅ Test framework detected: **${framework}**\n\n`;
+
+        // Count test files
+        try {
+          const testFiles = execSync(
+            'find . -name "*.test.ts" -o -name "*.test.tsx" -o -name "*.spec.ts" -o -name "*.spec.tsx" 2>/dev/null | grep -v node_modules | wc -l',
+            { cwd, encoding: 'utf-8', timeout: 10000 }
+          ).trim();
+          const count = parseInt(testFiles);
+          if (count > 0) {
+            response += `Found **${count} test files**\n\n`;
+          } else {
+            response += `⚠️ No test files found - add tests!\n\n`;
+          }
+        } catch {
+          // Ignore
+        }
+      } else {
+        response += `⚠️ **No test framework detected**\n\n`;
+        response += `Recommended: Add \`vitest\` or \`@playwright/test\`\n\n`;
+      }
+    } catch {
+      response += `*(Test analysis unavailable)*\n\n`;
+    }
+
+    // API Endpoint Inventory
+    response += `### 🔌 API Endpoint Inventory\n\n`;
+    if (context.existingApiRoutes.length > 0) {
+      response += `Found **${context.existingApiRoutes.length} API routes**:\n\n`;
+
+      // Check for auth protection on routes
+      let protectedCount = 0;
+      let unprotectedCount = 0;
+
+      for (const route of context.existingApiRoutes.slice(0, 10)) {
+        try {
+          const routePath = path.join(cwd, route);
+          if (fs.existsSync(routePath)) {
+            const content = fs.readFileSync(routePath, 'utf-8');
+            const hasAuth = content.includes('getServerSession') ||
+                           content.includes('auth(') ||
+                           content.includes('requireAuth') ||
+                           content.includes('Authorization') ||
+                           content.includes('authenticate');
+            if (hasAuth) {
+              protectedCount++;
+            } else {
+              unprotectedCount++;
+            }
+          }
+        } catch {
+          // Ignore
+        }
+      }
+
+      if (protectedCount > 0 || unprotectedCount > 0) {
+        response += `- 🔒 **${protectedCount}** routes with auth checks\n`;
+        response += `- 🔓 **${unprotectedCount}** routes without visible auth\n\n`;
+
+        if (unprotectedCount > protectedCount) {
+          response += `⚠️ *Many routes lack visible auth - review if intentional*\n\n`;
+        }
+      }
+    } else {
+      response += `No API routes detected yet.\n\n`;
+    }
+
+    response += `---\n\n`;
+
     // Scan for upgrade opportunities
     response += `## Upgrade Opportunities\n\n`;
 
@@ -1827,6 +2171,17 @@ Just describe what you want to build! I'll automatically:
       response += `✅ No major upgrade opportunities detected!\n\n`;
     }
 
+    // Review mode options
+    response += `---\n\n`;
+    response += `## Review Modes\n\n`;
+    response += `Pick a focus for the upgrade:\n\n`;
+    response += `- **Security Audit** - Auth, secrets, injections, OWASP top 10\n`;
+    response += `- **Performance Review** - Bundle size, queries, caching\n`;
+    response += `- **Code Quality** - Patterns, DRY, complexity\n`;
+    response += `- **Pre-Launch** - Everything for production\n`;
+    response += `- **Quick Scan** - Top 5 issues only\n`;
+    response += `- **Comprehensive** - All of the above\n\n`;
+
     // Recommendations
     response += `---\n\n`;
     response += `## Recommended Actions\n\n`;
@@ -1835,12 +2190,10 @@ Just describe what you want to build! I'll automatically:
       response += `**(Dry Run Mode - No changes will be made)**\n\n`;
     }
 
-    response += `1. Run \`run_audit\` for detailed code quality check\n`;
-    response += `2. Use \`heal\` to auto-fix common issues\n`;
-    response += `3. Request specific upgrades like:\n`;
-    response += `   - "Add Zod validation to my API routes"\n`;
-    response += `   - "Add error boundaries to components"\n`;
-    response += `   - "Set up Playwright testing"\n\n`;
+    response += `1. Tell me your main concerns (security, performance, etc.)\n`;
+    response += `2. I'll prioritize fixes based on your needs\n`;
+    response += `3. Hot spot files get fixed first (where bugs live)\n`;
+    response += `4. I'll implement your TODOs and fix FIXMEs along the way\n\n`;
 
     response += `---\n\n`;
     response += `**Key Principle:** Your stack stays the same. Only code quality patterns are upgraded.\n`;