codecritique 2.1.0 → 2.1.2

package/README.md

@@ -202,6 +202,8 @@ For easier integration with non-JavaScript projects, you can use the provided sh
    - Validates Node.js 24+ requirement
    - Provides helpful error messages for missing dependencies
 
+   The wrapper forwards only `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_LOG`, `GITHUB_TOKEN`, `GH_TOKEN`, `DEBUG`, `VERBOSE`, `CI`, and `GITHUB_WORKSPACE_PATH` from `.env`; other entries, including process-control variables such as `NODE_OPTIONS` and `PATH`, are ignored. An unreadable `.env` stops the wrapper with an error. Run it only in trusted project directories: `ANTHROPIC_BASE_URL` controls where API requests are sent, while `CI` and `GITHUB_WORKSPACE_PATH` control where embedding data is stored.
+
 ## Quick Start
 
 Follow this three-step workflow for optimal code review results:
@@ -413,7 +415,7 @@ jobs:
 | `anthropic-api-key` | Anthropic API key for Claude models                                                                      | **Yes**  | -                    |
 | `skip-label`        | Label name to skip AI review                                                                             | No       | `ai-review-disabled` |
 | `verbose`           | Show verbose output                                                                                      | No       | `false`              |
-| `model`             | LLM model to use (e.g., `claude-sonnet-4-5`)                                                             | No       | Auto-selected        |
+| `model`             | LLM model to use (e.g., `claude-sonnet-4-6`)                                                             | No       | Auto-selected        |
 | `max-tokens`        | Maximum tokens for LLM response                                                                          | No       | Auto-calculated      |
 | `cache-ttl`         | Cache TTL for LLM prompts: "5m" (default, no extra cost) or "1h" (extended, extra cost for cache writes) | No       | `5m`                 |
 | `concurrency`       | Concurrency for processing multiple files                                                                | No       | `3`                  |
@@ -541,6 +543,8 @@ DEBUG=true
 VERBOSE=true
 ```
 
+Set `CODECRITIQUE_SKIP_DOTENV=1` to disable `.env` loading, as the shell wrapper does after forwarding its supported variables.
+
 ## Output Formats
 
 CodeCritique supports three output formats:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecritique",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "AI-powered code review tool for any programming language",
   "type": "module",
   "main": "src/index.js",

package/src/codecritique.test.js

@@ -0,0 +1,169 @@
+import { execFile } from 'node:child_process';
+import { access, chmod, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { describe, expect, it, onTestFinished } from 'vitest';
+
+const execFileAsync = promisify(execFile);
+
+async function runWrapper(envFile, args = [], command = 'codecritique', extraEnv = {}, envIsDirectory = false, nodeMajorVersion = null) {
+  const directory = await mkdtemp(join(tmpdir(), 'codecritique-shell-'));
+  onTestFinished(() => rm(directory, { recursive: true, force: true }));
+  const fakeCommand = join(directory, command);
+  const envInspector = join(directory, 'inspect-entry-env.mjs');
+
+  if (envIsDirectory) {
+    await mkdir(join(directory, '.env'));
+  }
+  else if (envFile !== null) {
+    await writeFile(join(directory, '.env'), envFile);
+  }
+  await writeFile(
+    envInspector,
+    `process.argv = ['node'];
+process.exit = code => { throw new Error(\`exit \${code}\`); };
+try { await import(${JSON.stringify(new URL('./index.js', import.meta.url).href)}); } catch {}
+console.log(\`inspected_node_options=\${process.env.NODE_OPTIONS || ''}\`);
+`
+  );
+  await writeFile(
+    fakeCommand,
+    `#!/bin/bash
+[ "$1" = "--terminate" ] && kill -TERM $$
+[ "$1" = "--inspect-entry" ] && exec node "${envInspector}"
+[ "$1" = "--inspect-entry-with-dotenv" ] && unset CODECRITIQUE_SKIP_DOTENV && exec node "${envInspector}"
+/usr/bin/env
+printf "arg=%s\\n" "$@"
+`
+  );
+  await chmod(fakeCommand, 0o755);
+  if (nodeMajorVersion === null) {
+    await symlink(process.execPath, join(directory, 'node'));
+  }
+  else {
+    await writeFile(
+      join(directory, 'node'),
+      `#!/bin/bash\nif [ "$1" = "-p" ]; then echo ${nodeMajorVersion}; exit; fi\nif [ "$1" = "--version" ]; then echo v${nodeMajorVersion}.0.0; exit; fi\nexec "${process.execPath}" "$@"\n`
+    );
+    await chmod(join(directory, 'node'), 0o755);
+  }
+
+  const result = await execFileAsync('/bin/bash', [join(import.meta.dirname, 'codecritique.sh'), ...args], {
+    cwd: directory,
+    env: { PATH: directory, ...extraEnv },
+  });
+
+  return { ...result, directory };
+}
+
+describe('codecritique.sh', () => {
+  it.each([
+    [20, 'Error: CodeCritique requires Node.js 24 or newer (found v20.0.0).\n'],
+    ['not-a-version', 'Error: Unable to determine the Node.js major version (received: not-a-version).\n'],
+  ])('rejects unsupported Node version output: %s', async (nodeVersion, stderr) => {
+    await expect(runWrapper(null, [], 'codecritique', {}, false, nodeVersion)).rejects.toMatchObject({
+      code: 1,
+      stderr,
+    });
+  });
+
+  it.each([
+    ['unquoted spaces and globs', 'ANTHROPIC_API_KEY=value with spaces *\n', 'value with spaces *'],
+    ['literal JSON quotes', 'ANTHROPIC_API_KEY={"token":"a*b c"}\n', '{"token":"a*b c"}'],
+  ])('loads %s without corruption', async (_label, envFile, expected) => {
+    const { stdout } = await runWrapper(envFile, ['--flag', 'value with spaces']);
+
+    expect(stdout).toContain(`ANTHROPIC_API_KEY=${expected}`);
+    expect(stdout).toContain('arg=--flag');
+    expect(stdout).toContain('arg=value with spaces');
+  });
+
+  it('does not execute .env contents', async () => {
+    const { directory, stdout } = await runWrapper(
+      'ANTHROPIC_API_KEY=test\nMALICIOUS=$(touch executed)\nNODE_OPTIONS=--require=./does-not-exist.cjs\n'
+    );
+
+    expect(stdout).toContain('ANTHROPIC_API_KEY=test');
+    expect(stdout).not.toContain('NODE_OPTIONS=');
+    await expect(access(join(directory, 'executed'))).rejects.toThrow();
+  });
+
+  it('prevents the real CLI entry point from reloading filtered .env values', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=test\nNODE_OPTIONS=--require=./does-not-exist.cjs\n', ['--inspect-entry']);
+
+    expect(stdout).toContain('inspected_node_options=\n');
+  });
+
+  it('loads .env at the real CLI entry point when the wrapper sentinel is absent', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=test\nNODE_OPTIONS=loaded-by-dotenv\n', ['--inspect-entry-with-dotenv']);
+
+    expect(stdout).toContain('inspected_node_options=loaded-by-dotenv\n');
+  });
+
+  it('forwards every supported .env setting', async () => {
+    const supportedEnv = {
+      ANTHROPIC_API_KEY: 'test',
+      ANTHROPIC_BASE_URL: 'https://api.example.test',
+      ANTHROPIC_LOG: 'debug',
+      GITHUB_TOKEN: 'github-token',
+      GH_TOKEN: 'gh-token',
+      DEBUG: '1',
+      VERBOSE: 'true',
+      CI: 'true',
+      GITHUB_WORKSPACE_PATH: '/workspace',
+    };
+    const envFile = Object.entries(supportedEnv)
+      .map(([key, value]) => `${key}=${value}`)
+      .join('\n');
+    const { stdout } = await runWrapper(envFile);
+
+    for (const [key, value] of Object.entries(supportedEnv)) {
+      expect(stdout).toContain(`${key}=${value}`);
+    }
+  });
+
+  it('reports null bytes in supported values without an internal stack', async () => {
+    await expect(runWrapper('ANTHROPIC_API_KEY=test\0value\n')).rejects.toMatchObject({
+      stderr: 'Unable to load .env: ANTHROPIC_API_KEY contains a null byte\n',
+    });
+  });
+
+  it('preserves an inherited API key when .env is absent', async () => {
+    const { stdout } = await runWrapper(null, [], 'codecritique', { ANTHROPIC_API_KEY: 'inherited' });
+
+    expect(stdout).toContain('ANTHROPIC_API_KEY=inherited');
+  });
+
+  it('keeps the original .env-over-inherited-value precedence', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=from-file\n', [], 'codecritique', {
+      ANTHROPIC_API_KEY: 'from-parent',
+    });
+
+    expect(stdout).toContain('ANTHROPIC_API_KEY=from-file');
+  });
+
+  it.each([null, 'ANTHROPIC_AUTH_TOKEN=token\n'])('warns when no supported Anthropic credentials are configured', async (envFile) => {
+    const { stderr } = await runWrapper(envFile);
+
+    expect(stderr).toContain('Warning: ANTHROPIC_API_KEY is not set.');
+  });
+
+  it('reports unreadable .env paths without an internal stack', async () => {
+    await expect(runWrapper(null, [], 'codecritique', {}, true)).rejects.toMatchObject({
+      stderr: expect.stringMatching(/^Unable to load \.env: .+\n$/),
+    });
+  });
+
+  it('falls back to npx when codecritique is not installed globally', async () => {
+    const { stdout } = await runWrapper('ANTHROPIC_API_KEY=test\n', ['--version'], 'npx');
+
+    expect(stdout).toContain('codecritique not found globally, trying with npx...');
+    expect(stdout).toContain('arg=codecritique');
+    expect(stdout).toContain('arg=--version');
+  });
+
+  it('preserves signal-derived child exit codes', async () => {
+    await expect(runWrapper('ANTHROPIC_API_KEY=test\n', ['--terminate'])).rejects.toMatchObject({ code: 143 });
+  });
+});

package/src/index.js

@@ -15,7 +15,7 @@ import chalk from 'chalk';
 import { Spinner } from 'cli-spinner';
 import { program } from 'commander';
 import { glob } from 'glob';
-import { getDefaultEmbeddingsSystem } from './embeddings/factory.js';
+import { getDefaultEmbeddingsSystem, getDefaultEmbeddingsSystemIfInitialized } from './embeddings/factory.js';
 import { PRHistoryAnalyzer } from './pr-history/analyzer.js';
 import {
   displayAnalysisResults,
@@ -34,8 +34,12 @@ import { diagnosticLog, isDebugEnabled, isVerboseEnabled, verboseLog } from './u
 import { collectPRLevelFindings, getFileLevelIssueCount, hasPRLevelFindings } from './utils/review-results.js';
 import { configureCleanStdoutForDataOutput, isBrokenStdoutPipeError, writeStdout } from './utils/stdout.js';
 
-// Create a default embeddings system instance
-const embeddingsSystem = getDefaultEmbeddingsSystem();
+async function cleanupEmbeddingsSystemIfInitialized() {
+  const embeddingsSystem = getDefaultEmbeddingsSystemIfInitialized();
+  if (embeddingsSystem) {
+    await embeddingsSystem.cleanup();
+  }
+}
 
 const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 
@@ -58,7 +62,7 @@ program
   .option('--output-file <file>', 'Save output to file (useful with --output json)')
   .option('--no-color', 'Disable colored output')
   .option('--verbose', 'Show verbose output')
-  .option('--model <model>', 'LLM model to use (e.g., claude-sonnet-4-5)')
+  .option('--model <model>', 'LLM model to use (e.g., claude-sonnet-4-6)')
   .option('--temperature <number>', 'LLM temperature', parseFloat, 0.2)
   .option('--max-tokens <number>', 'LLM max tokens', parseInt, 8192)
   .option('--cache-ttl <ttl>', 'Cache TTL for LLM prompts: "5m" (default, no extra cost) or "1h" (extended, extra cost for writes)', '5m')
@@ -103,6 +107,7 @@ program
   .command('embeddings:clear-all')
   .description('Clear ALL stored embeddings (affects all projects - use with caution)')
   .action(async () => {
+    const embeddingsSystem = getDefaultEmbeddingsSystem();
     try {
       console.log(chalk.red('WARNING: This will clear embeddings for ALL projects on this machine!'));
       console.log(chalk.cyan('Clearing all embeddings...'));
@@ -227,7 +232,7 @@ process.on('SIGINT', async () => {
 
   try {
     diagnosticLog(chalk.cyan('SIGINT handler: Attempting embeddingsSystem.cleanup()...'));
-    await embeddingsSystem.cleanup();
+    await cleanupEmbeddingsSystemIfInitialized();
     diagnosticLog(chalk.green('embeddingsSystem.cleanup() completed.'));
     clearTimeout(forceExitTimeout); // Cleanup finished, clear the timeout
     diagnosticLog(chalk.cyan('SIGINT handler: Exiting normally (code 0).'));
@@ -251,7 +256,7 @@ process.on('SIGTERM', async () => {
 
   try {
     diagnosticLog(chalk.cyan('SIGTERM handler: Attempting embeddingsSystem.cleanup()...'));
-    await embeddingsSystem.cleanup();
+    await cleanupEmbeddingsSystemIfInitialized();
     diagnosticLog(chalk.green('embeddingsSystem.cleanup() completed.'));
     clearTimeout(forceExitTimeout); // Cleanup finished, clear the timeout
     diagnosticLog(chalk.cyan('SIGTERM handler: Exiting normally (code 0).'));
@@ -468,7 +473,7 @@ async function runCodeReview(options) {
     // Clean up resources
     diagnosticLog(chalk.cyan('Cleaning up resources...'));
     try {
-      await embeddingsSystem.cleanup();
+      await cleanupEmbeddingsSystemIfInitialized();
       await cleanupClassifier();
       diagnosticLog(chalk.green('All resources cleaned up successfully'));
     }
@@ -497,7 +502,7 @@ async function runCodeReview(options) {
 
     // Clean up resources even on error
     try {
-      await embeddingsSystem.cleanup();
+      await cleanupEmbeddingsSystemIfInitialized();
       await cleanupClassifier();
       diagnosticLog(chalk.green('All resources cleaned up successfully'));
     }
@@ -516,6 +521,7 @@ async function runCodeReview(options) {
  * @param {Object} options - Command options
  */
 async function generateEmbeddings(options) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   try {
     console.log(chalk.bold.blue('AI Code Review - Generating embeddings...'));
     const startTime = Date.now();
@@ -717,6 +723,7 @@ async function generateEmbeddings(options) {
  * Clear stored embeddings for the current project
  */
 async function clearEmbeddings(options) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   try {
     // Determine the working directory for project separation
     // If --directory is specified, use that as the project directory
@@ -751,6 +758,7 @@ async function clearEmbeddings(options) {
  * Show statistics about stored embeddings
  */
 async function showEmbeddingStats(options) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   try {
     // Determine the working directory for project separation
     // If --directory is specified, use that as the project directory

package/src/llm.js

@@ -18,7 +18,9 @@ import dotenv from 'dotenv';
 import { verboseLog } from './utils/logging.js';
 
 // Load env variables if present; do not enforce key at import time
-dotenv.config({ quiet: true });
+if (process.env.CODECRITIQUE_SKIP_DOTENV !== '1') {
+  dotenv.config({ quiet: true });
+}
 
 let anthropic = null;
 
@@ -39,7 +41,7 @@ function getAnthropicClient() {
 }
 
 // Default model
-const DEFAULT_MODEL = 'claude-sonnet-4-5';
+const DEFAULT_MODEL = 'claude-sonnet-4-6';
 
 // Maximum tokens for response
 const MAX_TOKENS = 4096;

package/src/llm.test.js

@@ -49,7 +49,7 @@ describe('sendPromptToClaude', () => {
 
       expect(mockMessagesCreate).toHaveBeenCalledWith(
         expect.objectContaining({
-          model: 'claude-sonnet-4-5',
+          model: 'claude-sonnet-4-6',
           max_tokens: 4096,
           temperature: 0.7,
         })

package/src/project-analyzer.js

@@ -17,6 +17,7 @@ import { verboseLog } from './utils/logging.js';
 import { escapeSqlString } from './utils/string-utils.js';
 
 const TERM_SEARCH_CONTENT_CANDIDATE_LIMIT = 500;
+const PROJECT_ANALYSIS_MODEL = 'claude-haiku-4-5';
 
 // Consolidated file classification configuration
 const FILE_PATTERNS = {
@@ -586,6 +587,7 @@ Select files following the criteria in the system instructions.`;
       };
 
       const response = await this.llm.sendPromptToClaude(prompt, {
+        model: PROJECT_ANALYSIS_MODEL,
         system: FILE_SELECTION_SYSTEM_PROMPT,
         temperature: 0.1,
         maxTokens: 1000,
@@ -878,6 +880,7 @@ Follow the analysis guidelines from the system instructions to identify custom i
       };
 
       const response = await this.llm.sendPromptToClaude(prompt, {
+        model: PROJECT_ANALYSIS_MODEL,
         system: PROJECT_SUMMARY_SYSTEM_PROMPT,
         temperature: 0.1,
         maxTokens: 4000,
@@ -886,7 +889,7 @@ Follow the analysis guidelines from the system instructions to identify custom i
 
       const summary = response.json;
       if (summary) {
-        // Validate and ensure required fields exist (Sonnet 4.5 compatibility)
+        // Validate and ensure required fields exist across model responses
         const validatedSummary = this.validateProjectSummary(summary);
 
         // Add metadata

package/src/project-analyzer.test.js

@@ -556,7 +556,7 @@ describe('ProjectAnalyzer', () => {
 
       const result = await analyzer.selectFinalKeyFiles(candidates, mockProjectPath);
 
-      expect(llm.sendPromptToClaude).toHaveBeenCalled();
+      expect(llm.sendPromptToClaude).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ model: 'claude-haiku-4-5' }));
       expect(result.length).toBe(1);
       expect(result[0].relativePath).toBe('package.json');
     });
@@ -668,9 +668,11 @@ describe('ProjectAnalyzer', () => {
         content: JSON.stringify(mockSummary),
         json: mockSummary,
       });
+      analyzer.llm = llm;
 
       const result = await analyzer.generateProjectSummary(mockKeyFiles, mockProjectPath);
 
+      expect(llm.sendPromptToClaude).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ model: 'claude-haiku-4-5' }));
       expect(result.projectName).toBe('test-project');
       expect(result.analysisDate).toBeDefined();
       expect(result.projectPath).toBe(mockProjectPath);

package/src/rag-analyzer.js

@@ -37,9 +37,6 @@ const DEFAULT_TRUNCATE_LINES = 300;
 const GUIDELINE_TRUNCATE_LINES = 400;
 const MAX_PR_COMMENTS_FOR_CONTEXT = 15;
 
-// Create embeddings system instance
-const embeddingsSystem = getDefaultEmbeddingsSystem();
-
 // Track if semantic similarity has been initialized
 let semanticSimilarityInitialized = false;
 
@@ -234,6 +231,7 @@ ${ex.content}
  */
 async function getProjectSummary(projectPath, options = {}) {
   const resolvedPath = path.resolve(projectPath);
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
 
   try {
     // Retrieve from database
@@ -766,7 +764,7 @@ function prepareContextForLLM(filePath, content, language, finalCodeExamples, fi
 async function callLLMForAnalysis(context, options = {}) {
   try {
     let prompt;
-    const model = options.model || 'claude-sonnet-4-5';
+    const model = options.model || 'claude-sonnet-4-6';
     const maxTokens = options.maxTokens || 8192; // Default to a safe limit
 
     if (options.isHolisticPRReview) {
@@ -1929,6 +1927,7 @@ async function performHolisticPRAnalysis(options) {
  * @returns {Promise<Object>} An object containing the gathered context.
  */
 async function getContextForFile(filePath, content, options = {}) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   const RELEVANT_CHUNK_THRESHOLD = 0.1;
   const W_H1_SIM = 0.2;
   const W_DOC_CONTEXT_MATCH = 0.6;
@@ -2283,6 +2282,7 @@ async function getContextForFile(filePath, content, options = {}) {
 }
 
 async function gatherUnifiedContextForPR(prFiles, options = {}) {
+  const embeddingsSystem = getDefaultEmbeddingsSystem();
   const allProcessedContext = {
     codeExamples: new Map(),
     guidelines: new Map(),