@forvibe/cli 1.0.6 → 1.0.8

package/dist/index.js

@@ -933,8 +933,8 @@ function getDependencies(rootDir, techStack) {
         join4(rootDir, "build.gradle"),
         join4(rootDir, "build.gradle.kts")
       ];
-      for (const path of gradlePaths) {
-        const content = readFileSafe(path);
+      for (const path2 of gradlePaths) {
+        const content = readFileSafe(path2);
         if (content) {
           const implMatches = content.matchAll(
             /implementation\s*\(?['"]([^'"]+)['"]\)?/g
@@ -1731,8 +1731,8 @@ function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
   const priorityPatterns = getPriorityPatternsForStack(techStack);
   const allFiles = scanDirectory(rootDir, {
     extensions,
-    maxDepth: 6,
-    maxFiles: 200
+    maxDepth: 8,
+    maxFiles: 500
   });
   const sorted = sortByPriority(allFiles, priorityPatterns);
   const parts = [];
@@ -1743,7 +1743,7 @@ function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
     if (!content || content.trim().length < 20) continue;
     if (isTestFile(file)) continue;
     if (isGeneratedFile(file, content)) continue;
-    const truncated = content.substring(0, 8e3);
+    const truncated = content.substring(0, 15e3);
     parts.push(`--- ${file} ---
 ${truncated}`);
     totalChars += truncated.length;
@@ -1869,9 +1869,9 @@ function generateProjectTree(rootDir, maxDepth = 5, maxEntries = 300) {
       }
     }
   }
-  function isDir(path) {
+  function isDir(path2) {
     try {
-      return statSync4(path).isDirectory();
+      return statSync4(path2).isDirectory();
     } catch {
       return false;
     }
@@ -2102,30 +2102,30 @@ function scanAppAssets(rootDir, techStack) {
     collectImagesRecursive(rootDir, dir, "screenshot", assets, MAX_SCREENSHOTS, 3, 0, minSize);
   }
   const splashPaths = getSplashPaths(rootDir, techStack);
-  for (const path of splashPaths) {
+  for (const path2 of splashPaths) {
     if (assets.length >= MAX_TOTAL_ASSETS) break;
     if (assets.some((a) => a.asset_type === "splash_screen")) break;
-    const asset = tryReadImage(rootDir, path, "splash_screen");
+    const asset = tryReadImage(rootDir, path2, "splash_screen");
     if (asset) {
       assets.push(asset);
       break;
     }
   }
   const featurePaths = getFeatureGraphicPaths(rootDir, techStack);
-  for (const path of featurePaths) {
+  for (const path2 of featurePaths) {
     if (assets.length >= MAX_TOTAL_ASSETS) break;
     if (assets.some((a) => a.asset_type === "feature_graphic")) break;
-    const asset = tryReadImage(rootDir, path, "feature_graphic");
+    const asset = tryReadImage(rootDir, path2, "feature_graphic");
     if (asset) {
       assets.push(asset);
       break;
     }
   }
   const promoPaths = getPromotionalPaths(rootDir, techStack);
-  for (const path of promoPaths) {
+  for (const path2 of promoPaths) {
     if (assets.length >= MAX_TOTAL_ASSETS) break;
     if (assets.some((a) => a.asset_type === "promotional_image")) break;
-    const asset = tryReadImage(rootDir, path, "promotional_image");
+    const asset = tryReadImage(rootDir, path2, "promotional_image");
     if (asset) {
       assets.push(asset);
       break;
@@ -2237,17 +2237,56 @@ var ForvibeClient = class {
     }
     return await response.json();
   }
+  /**
+   * Submit codebase review results for combined analysis
+   */
+  async submitCodebaseReview(review) {
+    if (!this.sessionToken) {
+      throw new Error("Not connected. Please validate OTC code first.");
+    }
+    const headers = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this.sessionToken}`
+    };
+    const response = await fetchWithAuth(
+      `${this.baseUrl}/api/review/codebase`,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ codebase_review: review })
+      }
+    );
+    if (!response.ok) {
+      const bodyText = await response.text().catch(() => "");
+      let errorMessage;
+      try {
+        const errorJson = JSON.parse(bodyText);
+        errorMessage = errorJson.error;
+      } catch {
+      }
+      if (response.status === 401) {
+        throw new Error(
+          errorMessage || "Session expired. Please generate a new connection code."
+        );
+      }
+      throw new Error(
+        errorMessage || `Review submission failed (HTTP ${response.status}: ${bodyText.substring(0, 200)})`
+      );
+    }
+    return await response.json();
+  }
 };
 
 // src/ai/providers.ts
 import { GoogleGenerativeAI } from "@google/generative-ai";
-function createGeminiProvider(apiKey) {
+function createGeminiProvider(apiKey, deep) {
+  const modelId = deep ? "gemini-3.1-pro-preview" : "gemini-3-flash-preview";
   return {
-    name: "Gemini",
+    name: `Gemini (${deep ? "3.1 Pro" : "3 Flash"})`,
     async generateJSON(systemPrompt, userPrompt, temperature) {
       const genAI = new GoogleGenerativeAI(apiKey);
       const model = genAI.getGenerativeModel({
-        model: "gemini-2.5-flash",
+        model: modelId,
         generationConfig: {
           temperature,
           responseMimeType: "application/json"
@@ -2336,7 +2375,7 @@ function createClaudeProvider(apiKey) {
     }
   };
 }
-function getAvailableProviders() {
+function getAvailableProviders(deep = false) {
   const providers = [];
   const anthropicKey = process.env.ANTHROPIC_API_KEY;
   if (anthropicKey) {
@@ -2360,9 +2399,9 @@ function getAvailableProviders() {
   if (geminiKey) {
     providers.push({
       id: "gemini",
-      name: "Gemini",
+      name: deep ? "Gemini 3.1 Pro" : "Gemini 3 Flash",
       recommended: false,
-      create: () => createGeminiProvider(geminiKey)
+      create: () => createGeminiProvider(geminiKey, deep)
     });
   }
   return providers;
@@ -2612,6 +2651,53 @@ async function analyzeCommand(options) {
     console.log(chalk.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   }
   console.log();
+  console.log(chalk.bold("  \u{1F4DD} App Review Information"));
+  console.log(chalk.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk.gray("  Apple's review team may need to sign in to your app."));
+  console.log(chalk.gray("  You can also provide this later in the Forvibe dashboard."));
+  console.log();
+  const hasAuthSDKs = (sdkScan.third_party_services.auth?.length ?? 0) > 0;
+  if (hasAuthSDKs) {
+    const signInAnswer = await askQuestion(
+      chalk.cyan("  Does your app require sign-in to use? (y/n): ")
+    );
+    const signInRequired = signInAnswer.toLowerCase().startsWith("y");
+    report.sign_in_required = signInRequired;
+    if (signInRequired) {
+      console.log();
+      console.log(chalk.yellow("  \u26A0 Please create a test account in your app for Apple's review team."));
+      console.log(chalk.gray("  This account should have full access to your app's features."));
+      console.log();
+      const testEmail = await askQuestion(chalk.cyan("  Test account email: "));
+      const testPassword = await askQuestion(chalk.cyan("  Test account password: "));
+      if (testEmail && testPassword) {
+        report.test_account = { email: testEmail, password: testPassword };
+        console.log(chalk.green("  \u2713 Test account saved"));
+      }
+    }
+  } else {
+    report.sign_in_required = false;
+  }
+  console.log();
+  console.log(chalk.gray("  Contact information for Apple's review team (press Enter to skip):"));
+  console.log();
+  const firstName = await askQuestion(chalk.cyan("  First name: "));
+  const lastName = await askQuestion(chalk.cyan("  Last name: "));
+  const contactEmail = await askQuestion(chalk.cyan("  Email: "));
+  const contactPhone = await askQuestion(chalk.cyan("  Phone (e.g. +1 555 123 4567): "));
+  if (firstName && lastName && contactEmail) {
+    report.review_contact = {
+      first_name: firstName,
+      last_name: lastName,
+      email: contactEmail,
+      phone: contactPhone || ""
+    };
+    console.log(chalk.green("  \u2713 Contact info saved"));
+  } else {
+    console.log(chalk.gray("  \u2139 Skipped \u2014 you can add this later in the dashboard."));
+  }
+  console.log(chalk.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log();
   const sendSpinner = ora({
     text: "Sending report to Forvibe...",
     prefixText: "  "
@@ -2634,6 +2720,848 @@ async function analyzeCommand(options) {
   }
 }
 
+// src/commands/review.ts
+import { createInterface as createInterface2 } from "readline";
+import chalk3 from "chalk";
+import ora2 from "ora";
+
+// src/review/feature-detector.ts
+function getFeatureDiscoveryPrompt() {
+  return `You are an expert app analyst. Your job is to understand WHAT an app does from the USER's perspective by reading its source code. You are NOT reviewing code quality.
+
+Respond in English.
+
+Answer this question: "If someone downloads this app and opens it on their iPhone, what will they see and experience?"
+
+Analyze the source code and identify:
+
+1. **App Purpose**: What does this app do? (1-2 sentences)
+2. **User Flows**: What are the main things a user can do? (list each)
+3. **Onboarding**: What happens when you first open the app? Login required? Permissions asked immediately?
+4. **Monetization**: How does the app make money? Subscriptions? IAP? Ads? External payments? Free?
+5. **Data & Privacy**: What user data does the app collect? What device permissions does it need? Is there a privacy policy link?
+6. **Content**: Is there user-generated content (posts, comments, chat)? Third-party content? Web content?
+7. **Account Management**: Can users create accounts? Can they delete their accounts?
+8. **Platform Features**: Does it use WebViews, widgets, extensions, push notifications, background processing?
+9. **Settings & Legal**: What can users configure? Is there a privacy policy accessible in-app? Terms of service?
+10. **External Links**: Does the app link to external payment pages, websites, or other apps?
+
+IMPORTANT: You are seeing a SUBSET of the source code, not the entire codebase. Do not make definitive claims about features being absent \u2014 only report features you can positively identify from the code shown. If something might exist but you don't see it, do not list it as missing.
+
+Respond ONLY with valid JSON in this exact format:
+
+{
+  "appPurpose": "string describing what the app does",
+  "features": [
+    {
+      "feature": "string identifier (e.g., 'subscriptions', 'webview', 'ugc', 'account_creation', 'push_notifications', 'camera_usage', 'location_tracking')",
+      "description": "string describing what the user experiences",
+      "confidence": 0.0-1.0,
+      "keywords": ["relevant", "keywords", "from", "code"],
+      "category": "safety|performance|business|design|legal|common-pitfalls",
+      "relevantFiles": ["file1.swift", "file2.ts"]
+    }
+  ],
+  "riskAreas": ["string describing areas that Apple reviewers commonly flag for apps like this"],
+  "appType": "native|hybrid|webview-heavy|web-wrapper"
+}`;
+}
+async function detectFeatures(provider, platform, appName, bundleId, sourceCode) {
+  const systemPrompt = getFeatureDiscoveryPrompt();
+  const userPrompt = `## App Information
+- Platform: ${platform}
+- App Name: ${appName}
+- Bundle ID: ${bundleId}
+
+## Source Code
+
+${sourceCode}`;
+  try {
+    const response = await provider.generateJSON(systemPrompt, userPrompt, 0.2);
+    return parseFeatureAnalysis(response);
+  } catch {
+    return null;
+  }
+}
+function parseFeatureAnalysis(response) {
+  try {
+    return JSON.parse(response);
+  } catch {
+    const jsonMatch = response.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/);
+    if (jsonMatch) {
+      try {
+        return JSON.parse(jsonMatch[1]);
+      } catch {
+      }
+    }
+    const objectMatch = response.match(/\{[\s\S]*"features"[\s\S]*\}/);
+    if (objectMatch) {
+      try {
+        return JSON.parse(objectMatch[0]);
+      } catch {
+      }
+    }
+    return null;
+  }
+}
+
+// src/review/rag-selector.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { fileURLToPath } from "url";
+import path from "path";
+var DATA_FILES = [
+  "safety.json",
+  "performance.json",
+  "business.json",
+  "design.json",
+  "legal.json",
+  "common-pitfalls.json"
+];
+var cachedStories = null;
+function getDataDir() {
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = path.dirname(__filename);
+  const candidates = [
+    path.join(__dirname, "rag-data"),
+    path.join(__dirname, "review", "rag-data"),
+    path.join(__dirname, "..", "review", "rag-data"),
+    path.join(__dirname, "..", "src", "review", "rag-data")
+  ];
+  for (const dir of candidates) {
+    try {
+      readFileSync5(path.join(dir, "safety.json"));
+      return dir;
+    } catch {
+    }
+  }
+  return candidates[0];
+}
+function loadAllStories() {
+  if (cachedStories) return cachedStories;
+  const dataDir = getDataDir();
+  const stories = [];
+  for (const file of DATA_FILES) {
+    try {
+      const content = readFileSync5(path.join(dataDir, file), "utf-8");
+      const parsed = JSON.parse(content);
+      stories.push(...parsed);
+    } catch {
+    }
+  }
+  cachedStories = stories;
+  return stories;
+}
+function searchStories(signals, maxResults = 20) {
+  const allStories = loadAllStories();
+  if (signals.length === 0) return allStories.slice(0, maxResults);
+  const signalKeywords = new Set(
+    signals.flatMap((s) => s.keywords.map((k) => k.toLowerCase()))
+  );
+  const signalFeatures = new Set(
+    signals.map((s) => s.feature.toLowerCase())
+  );
+  const signalCategories = new Set(signals.map((s) => s.category));
+  const scored = allStories.map((story) => {
+    let score = 0;
+    for (const signal of story.behavioralSignals) {
+      const signalLower = signal.toLowerCase();
+      for (const feature of signalFeatures) {
+        if (signalLower.includes(feature) || feature.includes(signalLower.split(" ")[0])) {
+          score += 3;
+          break;
+        }
+      }
+    }
+    for (const keyword of story.keywords) {
+      if (signalKeywords.has(keyword.toLowerCase())) {
+        score += 2;
+      }
+    }
+    if (signalCategories.has(story.category)) {
+      score += 1;
+    }
+    return { story, score };
+  });
+  return scored.sort((a, b) => b.score - a.score).slice(0, maxResults).map((s) => s.story);
+}
+function formatStoriesForPrompt(stories) {
+  if (stories.length === 0) return "No relevant rejection stories found.";
+  return stories.map((s, i) => {
+    return `### Case ${i + 1}: ${s.guidelineName} (Guideline ${s.guidelineNumber})
+**What happened:** ${s.whatDeveloperDid}
+**Apple said:** "${s.whatAppleSaid}"
+**The fix:** ${s.fix}
+**User-visible signs:** ${s.behavioralSignals.join("; ")}`;
+  }).join("\n\n");
+}
+
+// src/review/reviewer.ts
+function getReviewerSimulationPrompt() {
+  return `You are a senior member of Apple's App Review team. You have personally reviewed thousands of apps and know exactly what causes rejections.
+
+Write all findings in English.
+
+## YOUR MINDSET
+
+You do NOT review code quality. You review the APP \u2014 what a user sees, touches, and experiences. You are testing this app on a real device. You are tapping buttons, reading screens, navigating flows, and checking if the experience meets Apple's standards.
+
+For every issue, think through this exact scenario:
+"I downloaded this app on my iPhone. I opened it. I [did something specific]. I saw [specific result]. This violates Guideline [X.X] because [reason]."
+
+## WHAT YOU CHECK (as if using the app)
+
+1. **First Launch**: What happens when I open the app? Does it crash? Show a blank screen? Force me to log in? Ask for too many permissions at once?
+
+2. **Account Flow**: If I create an account, can I also delete it? Is the delete option easy to find? Does the app force registration for basic features?
+
+3. **Payment Experience**: If there are subscriptions/purchases:
+   - Are the price, duration, and auto-renewal terms clearly shown BEFORE I tap purchase?
+   - Is there a "Restore Purchases" button I can find?
+   - Am I being sent to a website to pay for digital content? (That's a rejection)
+
+4. **Privacy Experience**:
+   - Does the app explain WHY it needs each permission?
+   - Can I find a privacy policy in the app?
+   - Does it ask for App Tracking permission before tracking me?
+
+5. **Content & Safety**:
+   - If users can post content, can I report/block other users?
+   - Is there inappropriate content without proper age rating?
+
+6. **App Quality**:
+   - Is this just a website in a wrapper? (WebView with no native features = rejection)
+   - Does it feel like a real app or a web page?
+   - Is there placeholder text, "Coming Soon" sections, or test content?
+
+7. **Navigation & UX**:
+   - Can I get back to the main screen?
+   - Does the app follow iOS conventions?
+
+## RESPONSE FORMAT
+
+You MUST respond with valid JSON:
+
+{
+  "findings": [
+    {
+      "ruleId": "string (kebab-case, e.g., 'missing-account-deletion')",
+      "guidelineNumber": "string (e.g., '5.1.1')",
+      "guidelineName": "string",
+      "severity": "high | medium | low | info",
+      "category": "safety | performance | business | design | legal | common-pitfalls",
+      "title": "string (e.g., 'Missing Account Deletion Option')",
+      "description": "string (detailed description of the issue)",
+      "userImpact": "string (what the user actually experiences \u2014 'When I tap Settings, there is no option to delete my account')",
+      "evidence": "string (code/config evidence found)",
+      "file": "string | null (file where evidence was found)",
+      "fixSuggestion": "string (specific actionable fix)",
+      "relatedRejection": "string | null (reference to a similar rejection case if provided)"
+    }
+  ],
+  "overallAssessment": "string (2-3 sentence assessment of the app's review readiness)",
+  "estimatedOutcome": "likely-approved | likely-rejected | needs-attention",
+  "estimatedApprovalChance": 0-100
+}
+
+## IMPORTANT RULES
+
+1. Every finding MUST describe user-visible behavior, not code patterns
+2. The "userImpact" field is MANDATORY \u2014 describe what a person using the app would experience
+3. Be REALISTIC \u2014 don't fabricate issues. If the app looks clean, say so
+4. Reference the rejection stories provided \u2014 they show what Apple ACTUALLY enforces
+5. Severity guide:
+   - high: Apple would very likely reject for this (based on real cases)
+   - medium: Apple might reject, especially if reviewer is strict
+   - low: Improves chances but not a guaranteed rejection
+   - info: Best practice suggestion
+6. Focus on the TOP issues (max 10 findings). Quality over quantity.
+7. CRITICAL: You are seeing a SUBSET of the codebase, not ALL of it. If you cannot find evidence of something (e.g., a "Restore Purchases" button, account deletion flow, privacy policy link), do NOT assume it is missing. Only flag it if you see CONTRADICTING evidence (e.g., subscription code exists but zero restore mechanism in ANY of the visible code). When uncertain, use severity "low" or "info" instead of "high".
+8. Never flag an issue as "high" unless you have DIRECT code evidence that something is definitively wrong or missing. "I didn't see it in the provided code" is NOT sufficient evidence for a high-risk finding \u2014 the feature may exist in files not shown to you.`;
+}
+function parseAIResponse(response) {
+  try {
+    return JSON.parse(response);
+  } catch {
+    const jsonMatch = response.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/);
+    if (jsonMatch) {
+      try {
+        return JSON.parse(jsonMatch[1]);
+      } catch {
+      }
+    }
+    const objectMatch = response.match(/\{[\s\S]*"findings"[\s\S]*\}/);
+    if (objectMatch) {
+      try {
+        return JSON.parse(objectMatch[0]);
+      } catch {
+      }
+    }
+    return null;
+  }
+}
+function validateRiskLevel(s) {
+  if (["high", "medium", "low", "info"].includes(s)) return s;
+  if (s === "rejection") return "high";
+  if (s === "warning") return "medium";
+  if (s === "recommendation") return "low";
+  return "medium";
+}
+function validateCategory(c) {
+  if (["safety", "performance", "business", "design", "legal", "common-pitfalls"].includes(c)) {
+    return c;
+  }
+  return "performance";
+}
+function validateOutcome(o) {
+  if (["likely-approved", "likely-rejected", "needs-attention"].includes(o)) {
+    return o;
+  }
+  return "needs-attention";
+}
+function convertFindings(raw) {
+  return raw.findings.map((f, i) => ({
+    id: f.ruleId || `finding-${i + 1}`,
+    title: f.title,
+    risk_level: validateRiskLevel(f.severity),
+    category: validateCategory(f.category),
+    source: "codebase",
+    guideline_number: f.guidelineNumber,
+    guideline_name: f.guidelineName,
+    description: f.description,
+    user_impact: f.userImpact ?? f.description,
+    evidence: f.evidence ?? "",
+    recommendation: f.fixSuggestion,
+    file: f.file ?? void 0,
+    related_story_id: f.relatedRejection ?? void 0
+  }));
+}
+function buildSummary(findings, aiResponse) {
+  const high = findings.filter((f) => f.risk_level === "high").length;
+  const medium = findings.filter((f) => f.risk_level === "medium").length;
+  const low = findings.filter((f) => f.risk_level === "low").length;
+  const info = findings.filter((f) => f.risk_level === "info").length;
+  const outcome = validateOutcome(aiResponse.estimatedOutcome);
+  let approvalChance = aiResponse.estimatedApprovalChance ?? 75;
+  if (outcome === "likely-rejected") approvalChance = Math.min(approvalChance, 30);
+  if (outcome === "likely-approved") approvalChance = Math.max(approvalChance, 70);
+  const topRisks = findings.filter((f) => f.risk_level === "high" || f.risk_level === "medium").slice(0, 3).map((f) => f.title);
+  return {
+    total_findings: findings.length,
+    high_risk: high,
+    medium_risk: medium,
+    low_risk: low,
+    info,
+    outcome,
+    estimated_approval_chance: approvalChance,
+    top_risks: topRisks,
+    ai_assessment: aiResponse.overallAssessment
+  };
+}
+async function runCodeReview(provider, platform, appName, bundleId, sourceCode, sourceFilesCount, deep) {
+  const startTime = Date.now();
+  let featureAnalysis = null;
+  let relevantStories;
+  if (deep) {
+    featureAnalysis = await detectFeatures(
+      provider,
+      platform,
+      appName,
+      bundleId,
+      sourceCode
+    );
+    if (featureAnalysis) {
+      relevantStories = searchStories(featureAnalysis.features, 20);
+    } else {
+      relevantStories = loadAllStories().slice(0, 15);
+    }
+  } else {
+    relevantStories = loadAllStories().slice(0, 15);
+  }
+  const storiesText = formatStoriesForPrompt(relevantStories);
+  const featureSection = featureAnalysis ? `## App Analysis (from feature discovery)
+
+**App Purpose:** ${featureAnalysis.appPurpose}
+**App Type:** ${featureAnalysis.appType}
+
+**Detected Features:**
+${featureAnalysis.features.map((f) => `- ${f.feature}: ${f.description} (confidence: ${f.confidence})`).join("\n")}
+
+**Risk Areas:**
+${featureAnalysis.riskAreas.map((r) => `- ${r}`).join("\n")}` : "";
+  const userPrompt = `## App Information
+- Platform: ${platform}
+- App Name: ${appName}
+- Bundle ID: ${bundleId}
+
+${featureSection}
+
+## Real Rejection Cases (from other developers)
+These are REAL cases where Apple rejected similar apps. Use them to calibrate:
+
+${storiesText}
+
+## Source Code
+
+${sourceCode}
+
+Now review this app as an Apple reviewer testing it on a device. What would you flag?`;
+  const systemPrompt = getReviewerSimulationPrompt();
+  const response = await provider.generateJSON(systemPrompt, userPrompt, 0.2);
+  const parsed = parseAIResponse(response);
+  if (!parsed) {
+    return {
+      features_detected: featureAnalysis?.features.map((f) => f.feature) ?? [],
+      source_files_analyzed: sourceFilesCount,
+      platform,
+      bundle_id: bundleId || null,
+      findings: [],
+      summary: {
+        total_findings: 0,
+        high_risk: 0,
+        medium_risk: 0,
+        low_risk: 0,
+        info: 0,
+        outcome: "needs-attention",
+        estimated_approval_chance: 50,
+        top_risks: [],
+        ai_assessment: "AI analysis could not produce structured results."
+      },
+      rag_stories_used: relevantStories.length,
+      scan_duration_ms: Date.now() - startTime
+    };
+  }
+  const findings = convertFindings(parsed);
+  const summary = buildSummary(findings, parsed);
+  return {
+    features_detected: featureAnalysis?.features.map((f) => f.feature) ?? [],
+    source_files_analyzed: sourceFilesCount,
+    platform,
+    bundle_id: bundleId || null,
+    findings,
+    summary,
+    rag_stories_used: relevantStories.length,
+    scan_duration_ms: Date.now() - startTime
+  };
+}
+
+// src/review/formatters.ts
+import chalk2 from "chalk";
+var RISK_ICONS = {
+  high: "\u{1F534}",
+  medium: "\u{1F7E1}",
+  low: "\u{1F535}",
+  info: "\u26AA"
+};
+var RISK_LABELS = {
+  high: "HIGH RISK",
+  medium: "MEDIUM",
+  low: "LOW",
+  info: "INFO"
+};
+var RISK_COLORS = {
+  high: chalk2.red,
+  medium: chalk2.yellow,
+  low: chalk2.blue,
+  info: chalk2.gray
+};
+function outcomeDisplay(outcome) {
+  switch (outcome) {
+    case "likely-approved":
+      return chalk2.green.bold("LIKELY APPROVED");
+    case "likely-rejected":
+      return chalk2.red.bold("LIKELY REJECTED");
+    case "needs-attention":
+      return chalk2.yellow.bold("NEEDS ATTENTION");
+    default:
+      return chalk2.gray(outcome);
+  }
+}
+function approvalBar(chance) {
+  const width = 20;
+  const filled = Math.round(chance / 100 * width);
+  const empty = width - filled;
+  let color;
+  if (chance >= 70) color = chalk2.green;
+  else if (chance >= 40) color = chalk2.yellow;
+  else color = chalk2.red;
+  return color("\u2588".repeat(filled)) + chalk2.gray("\u2591".repeat(empty)) + ` ${chance}%`;
+}
+function formatTerminal(report) {
+  const lines = [];
+  lines.push("");
+  lines.push(chalk2.bold("  \u{1F6E1}\uFE0F  App Store Review Simulation"));
+  lines.push(chalk2.gray("  \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"));
+  lines.push("");
+  lines.push(`  Platform:    ${chalk2.white(report.platform)}`);
+  if (report.bundle_id) {
+    lines.push(`  Bundle ID:   ${chalk2.white(report.bundle_id)}`);
+  }
+  lines.push(`  Files:       ${chalk2.white(String(report.source_files_analyzed))} source files analyzed`);
+  lines.push(`  Stories:     ${chalk2.white(String(report.rag_stories_used))} rejection cases referenced`);
+  lines.push(`  Duration:    ${chalk2.white((report.scan_duration_ms / 1e3).toFixed(1) + "s")}`);
+  lines.push("");
+  lines.push(`  Outcome:     ${outcomeDisplay(report.summary.outcome)}`);
+  lines.push(`  Approval:    ${approvalBar(report.summary.estimated_approval_chance)}`);
+  lines.push("");
+  const counts = [
+    report.summary.high_risk > 0 && chalk2.red(`${report.summary.high_risk} high risk`),
+    report.summary.medium_risk > 0 && chalk2.yellow(`${report.summary.medium_risk} medium`),
+    report.summary.low_risk > 0 && chalk2.blue(`${report.summary.low_risk} low`),
+    report.summary.info > 0 && chalk2.gray(`${report.summary.info} info`)
+  ].filter(Boolean);
+  lines.push(`  Findings:    ${chalk2.bold(String(report.summary.total_findings))} total \u2014 ${counts.join(" \xB7 ")}`);
+  lines.push("");
+  if (report.features_detected.length > 0) {
+    lines.push(`  Features:    ${chalk2.gray(report.features_detected.join(", "))}`);
+    lines.push("");
+  }
+  if (report.summary.ai_assessment) {
+    lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    lines.push(`  ${chalk2.italic(report.summary.ai_assessment)}`);
+    lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    lines.push("");
+  }
+  const findingsByRisk = {
+    high: [],
+    medium: [],
+    low: [],
+    info: []
+  };
+  for (const finding of report.findings) {
+    findingsByRisk[finding.risk_level].push(finding);
+  }
+  for (const level of ["high", "medium", "low", "info"]) {
+    const findings = findingsByRisk[level];
+    if (findings.length === 0) continue;
+    for (const finding of findings) {
+      const icon = RISK_ICONS[level];
+      const label = RISK_LABELS[level];
+      const color = RISK_COLORS[level];
+      lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      lines.push(`  ${icon} ${color(label)}  Guideline ${finding.guideline_number} \u2014 ${finding.guideline_name}`);
+      lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      lines.push("");
+      lines.push(`  ${chalk2.bold(finding.title)}`);
+      lines.push(`  ${finding.description}`);
+      lines.push("");
+      lines.push(`  ${chalk2.cyan("User Impact:")} ${finding.user_impact}`);
+      if (finding.file) {
+        lines.push(`  ${chalk2.cyan("File:")} ${finding.file}`);
+      }
+      lines.push(`  ${chalk2.green("Fix:")} ${finding.recommendation}`);
+      if (finding.related_story_id) {
+        lines.push(`  ${chalk2.gray("Related case:")} ${finding.related_story_id}`);
+      }
+      lines.push("");
+    }
+  }
+  if (report.findings.length === 0) {
+    lines.push(chalk2.green("  \u2713 No significant issues found. Your app looks ready for review!"));
+    lines.push("");
+  }
+  lines.push(chalk2.gray("  \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"));
+  lines.push(chalk2.gray("  Powered by Forvibe CLI \u2014 forvibe.app"));
+  lines.push("");
+  return lines.join("\n");
+}
+function formatJSON(report) {
+  return JSON.stringify(report, null, 2);
+}
+function formatMarkdown(report) {
+  const lines = [];
+  lines.push("# App Store Review Simulation Report");
+  lines.push("");
+  lines.push(`**Platform:** ${report.platform}`);
+  if (report.bundle_id) {
+    lines.push(`**Bundle ID:** ${report.bundle_id}`);
+  }
+  lines.push(`**Files Analyzed:** ${report.source_files_analyzed}`);
+  lines.push(`**Rejection Cases Referenced:** ${report.rag_stories_used}`);
+  lines.push(`**Scan Duration:** ${(report.scan_duration_ms / 1e3).toFixed(1)}s`);
+  lines.push("");
+  lines.push("## Result");
+  lines.push("");
+  lines.push(`**Outcome:** ${report.summary.outcome.replace(/-/g, " ").toUpperCase()}`);
+  lines.push(`**Estimated Approval Chance:** ${report.summary.estimated_approval_chance}%`);
+  lines.push("");
+  lines.push(`| Risk Level | Count |`);
+  lines.push(`|-----------|-------|`);
+  lines.push(`| High | ${report.summary.high_risk} |`);
+  lines.push(`| Medium | ${report.summary.medium_risk} |`);
+  lines.push(`| Low | ${report.summary.low_risk} |`);
+  lines.push(`| Info | ${report.summary.info} |`);
+  lines.push(`| **Total** | **${report.summary.total_findings}** |`);
+  lines.push("");
+  if (report.summary.ai_assessment) {
+    lines.push(`> ${report.summary.ai_assessment}`);
+    lines.push("");
+  }
+  if (report.features_detected.length > 0) {
+    lines.push("## Detected Features");
+    lines.push("");
+    for (const feature of report.features_detected) {
+      lines.push(`- ${feature}`);
+    }
+    lines.push("");
+  }
+  lines.push("## Findings");
+  lines.push("");
+  if (report.findings.length === 0) {
+    lines.push("No significant issues found. Your app looks ready for review!");
+    lines.push("");
+    return lines.join("\n");
+  }
+  for (const finding of report.findings) {
+    const riskEmoji = RISK_ICONS[finding.risk_level];
+    lines.push(`### ${riskEmoji} ${finding.title}`);
+    lines.push("");
+    lines.push(`**Guideline:** ${finding.guideline_number} \u2014 ${finding.guideline_name}`);
+    lines.push(`**Risk Level:** ${finding.risk_level}`);
+    lines.push(`**Category:** ${finding.category}`);
+    lines.push("");
+    lines.push(finding.description);
+    lines.push("");
+    lines.push(`**User Impact:** ${finding.user_impact}`);
+    lines.push("");
+    if (finding.file) {
+      lines.push(`**File:** \`${finding.file}\``);
+      lines.push("");
+    }
+    lines.push(`**Recommendation:** ${finding.recommendation}`);
+    lines.push("");
+    lines.push("---");
+    lines.push("");
+  }
+  lines.push("*Powered by Forvibe CLI \u2014 forvibe.app*");
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/commands/review.ts
+function askQuestion2(question) {
+  const rl = createInterface2({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+async function reviewCommand(options) {
+  const rootDir = options.dir || process.cwd();
+  const deep = options.deep ?? false;
+  const format = options.format || "terminal";
+  console.log();
+  console.log(
+    chalk3.bold("  Forvibe CLI") + chalk3.gray(" \u2014 App Store Review Simulation") + (deep ? chalk3.cyan(" [DEEP MODE]") : "")
+  );
+  console.log();
+  const availableProviders = getAvailableProviders(deep);
+  if (availableProviders.length === 0) {
+    console.log(chalk3.red("  \u2717 No AI API key found. Set one of the following:\n"));
+    console.log(
+      chalk3.cyan("    export ANTHROPIC_API_KEY=your-key") + chalk3.gray("   https://console.anthropic.com/settings/keys") + chalk3.green(" (recommended)")
+    );
+    console.log(
+      chalk3.cyan("    export OPENAI_API_KEY=your-key") + chalk3.gray("      https://platform.openai.com/api-keys")
+    );
+    console.log(
+      chalk3.cyan("    export GEMINI_API_KEY=your-key") + chalk3.gray("       https://aistudio.google.com/apikey")
+    );
+    console.log();
+    console.log(
+      chalk3.gray("  Your source code is analyzed locally \u2014 it never leaves your machine.\n")
+    );
+    process.exit(1);
+  }
+  let provider;
+  if (availableProviders.length === 1) {
+    provider = availableProviders[0].create();
+  } else {
+    console.log(chalk3.white("  Multiple AI API keys detected. Choose a provider:\n"));
+    availableProviders.forEach((p, i) => {
+      const label = `${i + 1}. ${p.name}${p.recommended ? chalk3.green(" (recommended)") : ""}`;
+      console.log(`    ${label}`);
+    });
+    console.log();
+    const answer = await askQuestion2(
+      chalk3.cyan(`  Enter choice (1-${availableProviders.length}): `)
+    );
+    const index = parseInt(answer, 10) - 1;
+    if (isNaN(index) || index < 0 || index >= availableProviders.length) {
+      const recommended = availableProviders.find((p) => p.recommended) || availableProviders[0];
+      provider = recommended.create();
+      console.log(chalk3.gray(`  Using ${recommended.name} (default)
+`));
+    } else {
+      provider = availableProviders[index].create();
+    }
+  }
+  console.log(chalk3.gray(`  AI Provider: ${provider.name} \u2713`));
+  console.log();
+  const techSpinner = ora2({
+    text: "Detecting tech stack...",
+    prefixText: "  "
+  }).start();
+  const techStack = detectTechStack(rootDir);
+  if (techStack.stack === "unknown") {
+    techSpinner.fail(
+      chalk3.red(
+        "No supported project found. Supported: Swift, Flutter, React Native, Kotlin, Capacitor, .NET MAUI"
+      )
+    );
+    process.exit(1);
+  }
+  techSpinner.succeed(
+    `Tech stack: ${chalk3.bold(techStack.label)} ${chalk3.gray(`(${techStack.platforms.join(", ")})`)}`
+  );
+  const configSpinner = ora2({
+    text: "Reading project configuration...",
+    prefixText: "  "
+  }).start();
+  const config = parseConfig(rootDir, techStack.stack);
+  const appName = config.app_name || "Unknown App";
+  const bundleId = config.bundle_id || "";
+  configSpinner.succeed(
+    `Config: ${chalk3.white(appName)} ${bundleId ? chalk3.gray(`(${bundleId})`) : ""}`
+  );
+  const sdkSpinner = ora2({
+    text: "Scanning dependencies...",
+    prefixText: "  "
+  }).start();
+  const sdkScan = scanSDKs(rootDir, techStack.stack);
+  sdkSpinner.succeed(
+    `Dependencies: ${chalk3.bold(String(sdkScan.detected_sdks.length))} known SDKs detected`
+  );
+  const sourceSpinner = ora2({
+    text: "Reading source code...",
+    prefixText: "  "
+  }).start();
+  const maxChars = deep ? 4e5 : 15e4;
+  const sourceCode = readSourceCode(rootDir, techStack.stack, maxChars);
+  const projectTree = generateProjectTree(rootDir);
+  const sourceLines = sourceCode.split("\n").length;
+  sourceSpinner.succeed(
+    `Source code: ${chalk3.bold(String(sourceLines))} lines analyzed`
+  );
+  console.log();
+  const reviewSpinner = ora2({
+    text: deep ? `Running deep review with ${provider.name} (Pass 1: feature detection, Pass 2: Apple reviewer simulation)...` : `Running review with ${provider.name} (simulating Apple's review process)...`,
+    prefixText: "  "
+  }).start();
+  let report;
+  try {
+    const enrichedSource = buildEnrichedContext(
+      sourceCode,
+      projectTree,
+      sdkScan,
+      config
+    );
+    report = await runCodeReview(
+      provider,
+      techStack.label,
+      appName,
+      bundleId,
+      enrichedSource,
+      sourceLines,
+      deep
+    );
+    reviewSpinner.succeed(
+      chalk3.green(
+        `Review complete! ${report.summary.total_findings} findings (${report.summary.high_risk} high risk)`
+      )
+    );
+  } catch (error) {
+    reviewSpinner.fail(
+      chalk3.red(
+        `Review failed: ${error instanceof Error ? error.message : "Unknown error"}`
+      )
+    );
+    process.exit(1);
+  }
+  switch (format) {
+    case "json":
+      console.log(formatJSON(report));
+      break;
+    case "markdown":
+      console.log(formatMarkdown(report));
+      break;
+    case "terminal":
+    default:
+      console.log(formatTerminal(report));
+      break;
+  }
+  if (options.send) {
+    console.log(
+      chalk3.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")
+    );
+    console.log();
+    const otcCode = await askQuestion2(
+      chalk3.cyan("  \u{1F517} Enter your Forvibe connection code: ")
+    );
+    if (!otcCode || otcCode.length < 6) {
+      console.log(
+        chalk3.red(
+          "\n  \u2717 Invalid code. Please enter the 6-character code from forvibe.app\n"
+        )
+      );
+      process.exit(1);
+    }
+    const connectSpinner = ora2({
+      text: "Connecting to Forvibe...",
+      prefixText: "  "
+    }).start();
+    const client = new ForvibeClient(options.apiUrl);
+    try {
+      await client.validateOTC(otcCode);
+      connectSpinner.succeed(chalk3.green("Connected to Forvibe!"));
+    } catch (error) {
+      connectSpinner.fail(
+        chalk3.red(error instanceof Error ? error.message : "Connection failed")
+      );
+      process.exit(1);
+    }
+    const sendSpinner = ora2({
+      text: "Sending review results to Forvibe...",
+      prefixText: "  "
+    }).start();
+    try {
+      const result = await client.submitCodebaseReview(report);
+      sendSpinner.succeed(chalk3.green("Review results sent!"));
+      console.log();
+      console.log(
+        chalk3.bold("  \u{1F310} View combined review at: ") + chalk3.cyan.underline(result.web_url)
+      );
+      console.log();
+    } catch (error) {
+      sendSpinner.fail(
+        chalk3.red(
+          `Failed to send: ${error instanceof Error ? error.message : "Unknown error"}`
+        )
+      );
+    }
+  }
+}
+function buildEnrichedContext(sourceCode, projectTree, sdkScan, config) {
+  const sections = [];
+  sections.push(`## Project Structure
+\`\`\`
+${projectTree}
+\`\`\``);
+  if (sdkScan.detected_sdks.length > 0) {
+    const sdkList = sdkScan.detected_sdks.map((sdk) => `- ${sdk.name} (${sdk.category})${sdk.collects.length > 0 ? ` \u2014 collects: ${sdk.collects.join(", ")}` : ""}`).join("\n");
+    sections.push(`## Detected SDKs
+${sdkList}`);
+  }
+  sections.push(`## Source Code
+
+${sourceCode}`);
+  return sections.join("\n\n");
+}
+
 // src/index.ts
 var program = new Command();
 program.name("forvibe").description("Forvibe CLI \u2014 AI-powered App Store automation").version("0.1.0");
@@ -2644,4 +3572,11 @@ program.command("analyze", { isDefault: true }).description(
   "Forvibe API URL (for development)",
   void 0
 ).action(analyzeCommand);
+program.command("review").description(
+  "Simulate Apple's App Store review process on your project"
+).option("-d, --dir <path>", "Project directory to review", process.cwd()).option("--deep", "Enable deep 2-pass review (feature detection + reviewer simulation)").option("--format <type>", "Output format: terminal, json, markdown", "terminal").option("--send", "Send results to Forvibe for combined review with metadata analysis").option(
+  "--api-url <url>",
+  "Forvibe API URL (for development)",
+  void 0
+).action(reviewCommand);
 program.parse();