codecritique 2.1.0 → 2.1.1

package/README.md

@@ -202,6 +202,8 @@ For easier integration with non-JavaScript projects, you can use the provided sh
    - Validates Node.js 24+ requirement
    - Provides helpful error messages for missing dependencies
 
+   The wrapper forwards only `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_LOG`, `GITHUB_TOKEN`, `GH_TOKEN`, `DEBUG`, `VERBOSE`, `CI`, and `GITHUB_WORKSPACE_PATH` from `.env`; other entries, including process-control variables such as `NODE_OPTIONS` and `PATH`, are ignored. An unreadable `.env` stops the wrapper with an error. Run it only in trusted project directories: `ANTHROPIC_BASE_URL` controls where API requests are sent, while `CI` and `GITHUB_WORKSPACE_PATH` control where embedding data is stored.
+
 ## Quick Start
 
 Follow this three-step workflow for optimal code review results:
@@ -541,6 +543,8 @@ DEBUG=true
 VERBOSE=true
 ```
 
+Set `CODECRITIQUE_SKIP_DOTENV=1` to disable `.env` loading, as the shell wrapper does after forwarding its supported variables.
+
 ## Output Formats
 
 CodeCritique supports three output formats:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecritique",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "AI-powered code review tool for any programming language",
   "type": "module",
   "main": "src/index.js",

package/src/codecritique.test.js

@@ -0,0 +1,169 @@
+import { execFile } from 'node:child_process';
+import { access, chmod, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { describe, expect, it, onTestFinished } from 'vitest';
+
+const execFileAsync = promisify(execFile);
+
+async function runWrapper(envFile, args = [], command = 'codecritique', extraEnv = {}, envIsDirectory = false, nodeMajorVersion = null) {
+  const directory = await mkdtemp(join(tmpdir(), 'codecritique-shell-'));
+  onTestFinished(() => rm(directory, { recursive: true, force: true }));
+  const fakeCommand = join(directory, command);
+  const envInspector = join(directory, 'inspect-entry-env.mjs');
+
+  if (envIsDirectory) {
+    await mkdir(join(directory, '.env'));
+  }
+  else if (envFile !== null) {
+    await writeFile(join(directory, '.env'), envFile);
+  }
+  await writeFile(
+    envInspector,
+    `process.argv = ['node'];
+process.exit = code => { throw new Error(\`exit \${code}\`); };
+try { await import(${JSON.stringify(new URL('./index.js', import.meta.url).href)}); } catch {}
+console.log(\`inspected_node_options=\${process.env.NODE_OPTIONS || ''}\`);
+`
+  );
+  await writeFile(
+    fakeCommand,
+    `#!/bin/bash
+[ "$1" = "--terminate" ] && kill -TERM $$
+[ "$1" = "--inspect-entry" ] && exec node "${envInspector}"
+[ "$1" = "--inspect-entry-with-dotenv" ] && unset CODECRITIQUE_SKIP_DOTENV && exec node "${envInspector}"
+/usr/bin/env
+printf "arg=%s\\n" "$@"
+`
+  );
+  await chmod(fakeCommand, 0o755);
+  if (nodeMajorVersion === null) {
+    await symlink(process.execPath, join(directory, 'node'));
+  }
+  else {
+    await writeFile(
+      join(directory, 'node'),
+      `#!/bin/bash\nif [ "$1" = "-p" ]; then echo ${nodeMajorVersion}; exit; fi\nif [ "$1" = "--version" ]; then echo v${nodeMajorVersion}.0.0; exit; fi\nexec "${process.execPath}" "$@"\n`
+    );
+    await chmod(join(directory, 'node'), 0o755);
+  }
+
+  const result = await execFileAsync('/bin/bash', [join(import.meta.dirname, 'codecritique.sh'), ...args], {
+    cwd: directory,
+    env: { PATH: directory, ...extraEnv },
+  });
+
+  return { ...result, directory };
+}
+
+describe('codecritique.sh', () => {
+  it.each([
+    [20, 'Error: CodeCritique requires Node.js 24 or newer (found v20.0.0).\n'],
+    ['not-a-version', 'Error: Unable to determine the Node.js major version (received: not-a-version).\n'],
+  ])('rejects unsupported Node version output: %s', async (nodeVersion, stderr) => {
+    await expect(runWrapper(null, [], 'codecritique', {}, false, nodeVersion)).rejects.toMatchObject({
+      code: 1,
+      stderr,
+    });
+  });
+
+  it.each([
+    ['unquoted spaces and globs', 'ANTHROPIC_API_KEY=value with spaces *\n', 'value with spaces *'],
+    ['literal JSON quotes', 'ANTHROPIC_API_KEY={"token":"a*b c"}\n', '{"token":"a*b c"}'],
+  ])('loads %s without corruption', async (_label, envFile, expected) => {
+    const { stdout } = await runWrapper(envFile, ['--flag', 'value with spaces']);
+
+    expect(stdout).toContain(`ANTHROPIC_API_KEY=${expected}`);
+    expect(stdout).toContain('arg=--flag');
+    expect(stdout).toContain('arg=value with spaces');
+  });
+
+  it('does not execute .env contents', async () => {
+    const { directory, stdout } = await runWrapper(
+      'ANTHROPIC_API_KEY=test\nMALICIOUS=$(touch executed)\nNODE_OPTIONS=--require=./does-not-exist.cjs\n'
+    );
+
+    expect(stdout).toContain('ANTHROPIC_API_KEY=test');
+    expect(stdout).not.toContain('NODE_OPTIONS=');
+    await expect(access(join(directory, 'executed'))).rejects.toThrow();
+  });
+
+  it('prevents the real CLI entry point from reloading filtered .env values', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=test\nNODE_OPTIONS=--require=./does-not-exist.cjs\n', ['--inspect-entry']);
+
+    expect(stdout).toContain('inspected_node_options=\n');
+  });
+
+  it('loads .env at the real CLI entry point when the wrapper sentinel is absent', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=test\nNODE_OPTIONS=loaded-by-dotenv\n', ['--inspect-entry-with-dotenv']);
+
+    expect(stdout).toContain('inspected_node_options=loaded-by-dotenv\n');
+  });
+
+  it('forwards every supported .env setting', async () => {
+    const supportedEnv = {
+      ANTHROPIC_API_KEY: 'test',
+      ANTHROPIC_BASE_URL: 'https://api.example.test',
+      ANTHROPIC_LOG: 'debug',
+      GITHUB_TOKEN: 'github-token',
+      GH_TOKEN: 'gh-token',
+      DEBUG: '1',
+      VERBOSE: 'true',
+      CI: 'true',
+      GITHUB_WORKSPACE_PATH: '/workspace',
+    };
+    const envFile = Object.entries(supportedEnv)
+      .map(([key, value]) => `${key}=${value}`)
+      .join('\n');
+    const { stdout } = await runWrapper(envFile);
+
+    for (const [key, value] of Object.entries(supportedEnv)) {
+      expect(stdout).toContain(`${key}=${value}`);
+    }
+  });
+
+  it('reports null bytes in supported values without an internal stack', async () => {
+    await expect(runWrapper('ANTHROPIC_API_KEY=test\0value\n')).rejects.toMatchObject({
+      stderr: 'Unable to load .env: ANTHROPIC_API_KEY contains a null byte\n',
+    });
+  });
+
+  it('preserves an inherited API key when .env is absent', async () => {
+    const { stdout } = await runWrapper(null, [], 'codecritique', { ANTHROPIC_API_KEY: 'inherited' });
+
+    expect(stdout).toContain('ANTHROPIC_API_KEY=inherited');
+  });
+
+  it('keeps the original .env-over-inherited-value precedence', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=from-file\n', [], 'codecritique', {
+      ANTHROPIC_API_KEY: 'from-parent',
+    });
+
+    expect(stdout).toContain('ANTHROPIC_API_KEY=from-file');
+  });
+
+  it.each([null, 'ANTHROPIC_AUTH_TOKEN=token\n'])('warns when no supported Anthropic credentials are configured', async (envFile) => {
+    const { stderr } = await runWrapper(envFile);
+
+    expect(stderr).toContain('Warning: ANTHROPIC_API_KEY is not set.');
+  });
+
+  it('reports unreadable .env paths without an internal stack', async () => {
+    await expect(runWrapper(null, [], 'codecritique', {}, true)).rejects.toMatchObject({
+      stderr: expect.stringMatching(/^Unable to load \.env: .+\n$/),
+    });
+  });
+
+  it('falls back to npx when codecritique is not installed globally', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=test\n', ['--version'], 'npx');
+
+    expect(stdout).toContain('codecritique not found globally, trying with npx...');
+    expect(stdout).toContain('arg=codecritique');
+    expect(stdout).toContain('arg=--version');
+  });
+
+  it('preserves signal-derived child exit codes', async () => {
+    await expect(runWrapper('ANTHROPIC_API_KEY=test\n', ['--terminate'])).rejects.toMatchObject({ code: 143 });
+  });
+});

package/src/index.js

@@ -15,7 +15,7 @@ import chalk from 'chalk';
 import { Spinner } from 'cli-spinner';
 import { program } from 'commander';
 import { glob } from 'glob';
-import { getDefaultEmbeddingsSystem } from './embeddings/factory.js';
+import { getDefaultEmbeddingsSystem, getDefaultEmbeddingsSystemIfInitialized } from './embeddings/factory.js';
 import { PRHistoryAnalyzer } from './pr-history/analyzer.js';
 import {
   displayAnalysisResults,
@@ -34,8 +34,12 @@ import { diagnosticLog, isDebugEnabled, isVerboseEnabled, verboseLog } from './u
 import { collectPRLevelFindings, getFileLevelIssueCount, hasPRLevelFindings } from './utils/review-results.js';
 import { configureCleanStdoutForDataOutput, isBrokenStdoutPipeError, writeStdout } from './utils/stdout.js';
 
-// Create a default embeddings system instance
-const embeddingsSystem = getDefaultEmbeddingsSystem();
+async function cleanupEmbeddingsSystemIfInitialized() {
+  const embeddingsSystem = getDefaultEmbeddingsSystemIfInitialized();
+  if (embeddingsSystem) {
+    await embeddingsSystem.cleanup();
+  }
+}
 
 const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 
@@ -103,6 +107,7 @@ program
   .command('embeddings:clear-all')
   .description('Clear ALL stored embeddings (affects all projects - use with caution)')
   .action(async () => {
+    const embeddingsSystem = getDefaultEmbeddingsSystem();
     try {
       console.log(chalk.red('WARNING: This will clear embeddings for ALL projects on this machine!'));
       console.log(chalk.cyan('Clearing all embeddings...'));
@@ -227,7 +232,7 @@ process.on('SIGINT', async () => {
 
   try {
     diagnosticLog(chalk.cyan('SIGINT handler: Attempting embeddingsSystem.cleanup()...'));
-    await embeddingsSystem.cleanup();
+    await cleanupEmbeddingsSystemIfInitialized();
     diagnosticLog(chalk.green('embeddingsSystem.cleanup() completed.'));
     clearTimeout(forceExitTimeout); // Cleanup finished, clear the timeout
     diagnosticLog(chalk.cyan('SIGINT handler: Exiting normally (code 0).'));
@@ -251,7 +256,7 @@ process.on('SIGTERM', async () => {
 
   try {
     diagnosticLog(chalk.cyan('SIGTERM handler: Attempting embeddingsSystem.cleanup()...'));
-    await embeddingsSystem.cleanup();
+    await cleanupEmbeddingsSystemIfInitialized();
     diagnosticLog(chalk.green('embeddingsSystem.cleanup() completed.'));
     clearTimeout(forceExitTimeout); // Cleanup finished, clear the timeout
     diagnosticLog(chalk.cyan('SIGTERM handler: Exiting normally (code 0).'));
@@ -468,7 +473,7 @@ async function runCodeReview(options) {
     // Clean up resources
     diagnosticLog(chalk.cyan('Cleaning up resources...'));
     try {
-      await embeddingsSystem.cleanup();
+      await cleanupEmbeddingsSystemIfInitialized();
       await cleanupClassifier();
       diagnosticLog(chalk.green('All resources cleaned up successfully'));
     }
@@ -497,7 +502,7 @@ async function runCodeReview(options) {
 
     // Clean up resources even on error
     try {
-      await embeddingsSystem.cleanup();
+      await cleanupEmbeddingsSystemIfInitialized();
       await cleanupClassifier();
       diagnosticLog(chalk.green('All resources cleaned up successfully'));
     }
@@ -516,6 +521,7 @@ async function runCodeReview(options) {
  * @param {Object} options - Command options
  */
 async function generateEmbeddings(options) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   try {
     console.log(chalk.bold.blue('AI Code Review - Generating embeddings...'));
     const startTime = Date.now();
@@ -717,6 +723,7 @@ async function generateEmbeddings(options) {
  * Clear stored embeddings for the current project
  */
 async function clearEmbeddings(options) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   try {
     // Determine the working directory for project separation
     // If --directory is specified, use that as the project directory
@@ -751,6 +758,7 @@ async function clearEmbeddings(options) {
  * Show statistics about stored embeddings
  */
 async function showEmbeddingStats(options) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   try {
     // Determine the working directory for project separation
     // If --directory is specified, use that as the project directory

package/src/llm.js

@@ -18,7 +18,9 @@ import dotenv from 'dotenv';
 import { verboseLog } from './utils/logging.js';
 
 // Load env variables if present; do not enforce key at import time
-dotenv.config({ quiet: true });
+if (process.env.CODECRITIQUE_SKIP_DOTENV !== '1') {
+  dotenv.config({ quiet: true });
+}
 
 let anthropic = null;
 

package/src/rag-analyzer.js

@@ -37,9 +37,6 @@ const DEFAULT_TRUNCATE_LINES = 300;
 const GUIDELINE_TRUNCATE_LINES = 400;
 const MAX_PR_COMMENTS_FOR_CONTEXT = 15;
 
-// Create embeddings system instance
-const embeddingsSystem = getDefaultEmbeddingsSystem();
-
 // Track if semantic similarity has been initialized
 let semanticSimilarityInitialized = false;
 
@@ -234,6 +231,7 @@ ${ex.content}
  */
 async function getProjectSummary(projectPath, options = {}) {
   const resolvedPath = path.resolve(projectPath);
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
 
   try {
     // Retrieve from database
@@ -1929,6 +1927,7 @@ async function performHolisticPRAnalysis(options) {
  * @returns {Promise<Object>} An object containing the gathered context.
  */
 async function getContextForFile(filePath, content, options = {}) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   const RELEVANT_CHUNK_THRESHOLD = 0.1;
   const W_H1_SIM = 0.2;
   const W_DOC_CONTEXT_MATCH = 0.6;
@@ -2283,6 +2282,7 @@ async function getContextForFile(filePath, content, options = {}) {
 }
 
 async function gatherUnifiedContextForPR(prFiles, options = {}) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   const allProcessedContext = {
     codeExamples: new Map(),
     guidelines: new Map(),