codecritique 2.1.1 → 2.1.3

package/README.md

@@ -415,7 +415,7 @@ jobs:
 | `anthropic-api-key` | Anthropic API key for Claude models                                                                      | **Yes**  | -                    |
 | `skip-label`        | Label name to skip AI review                                                                             | No       | `ai-review-disabled` |
 | `verbose`           | Show verbose output                                                                                      | No       | `false`              |
-| `model`             | LLM model to use (e.g., `claude-sonnet-4-5`)                                                             | No       | Auto-selected        |
+| `model`             | LLM model to use (e.g., `claude-sonnet-4-6`)                                                             | No       | Auto-selected        |
 | `max-tokens`        | Maximum tokens for LLM response                                                                          | No       | Auto-calculated      |
 | `cache-ttl`         | Cache TTL for LLM prompts: "5m" (default, no extra cost) or "1h" (extended, extra cost for cache writes) | No       | `5m`                 |
 | `concurrency`       | Concurrency for processing multiple files                                                                | No       | `3`                  |
@@ -545,6 +545,10 @@ VERBOSE=true
 
 Set `CODECRITIQUE_SKIP_DOTENV=1` to disable `.env` loading, as the shell wrapper does after forwarding its supported variables.
 
+### Trust and Prompt Injection
+
+Repository files, diffs, custom documents, and PR comments are untrusted data included in LLM prompts. A malicious repository can attempt to influence generated review text despite prompt boundaries and truncation. Treat CodeCritique output as advisory, review findings before acting on them, and never grant generated suggestions automatic execution privileges.
+
 ## Output Formats
 
 CodeCritique supports three output formats:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecritique",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "AI-powered code review tool for any programming language",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -42,6 +42,7 @@ async function cleanupEmbeddingsSystemIfInitialized() {
 }
 
 const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+const parseIntegerOption = (value) => Number.parseInt(value, 10);
 
 // Configure command-line interface
 program.name('codecritique').description('CLI tool for AI-powered code review using the RAG approach').version(packageJson.version);
@@ -62,13 +63,13 @@ program
   .option('--output-file <file>', 'Save output to file (useful with --output json)')
   .option('--no-color', 'Disable colored output')
   .option('--verbose', 'Show verbose output')
-  .option('--model <model>', 'LLM model to use (e.g., claude-sonnet-4-5)')
+  .option('--model <model>', 'LLM model to use (e.g., claude-sonnet-4-6)')
   .option('--temperature <number>', 'LLM temperature', parseFloat, 0.2)
-  .option('--max-tokens <number>', 'LLM max tokens', parseInt, 8192)
+  .option('--max-tokens <number>', 'LLM max tokens', parseIntegerOption, 8192)
   .option('--cache-ttl <ttl>', 'Cache TTL for LLM prompts: "5m" (default, no extra cost) or "1h" (extended, extra cost for writes)', '5m')
   .option('--similarity-threshold <number>', 'Threshold for finding similar code examples', parseFloat, 0.6)
-  .option('--max-examples <number>', 'Max similar code examples to use', parseInt, 5)
-  .option('--concurrency <number>', 'Concurrency for processing multiple files', parseInt, 3)
+  .option('--max-examples <number>', 'Max similar code examples to use', parseIntegerOption, 5)
+  .option('--concurrency <number>', 'Concurrency for processing multiple files', parseIntegerOption, 3)
   .option(
     '--doc <specs...>',
     'A document to provide custom instructions to the LLM (e.g., "Engineering Guidelines:./docs/guidelines.md"). Can be specified multiple times.'
@@ -142,11 +143,11 @@ program
   .option('-t, --token <token>', 'GitHub API token (or set GITHUB_TOKEN env var)')
   .option('--since <date>', 'Only analyze PRs since this date (ISO format)')
   .option('--until <date>', 'Only analyze PRs until this date (ISO format)')
-  .option('--limit <number>', 'Limit number of PRs to analyze', parseInt)
+  .option('--limit <number>', 'Limit number of PRs to analyze', parseIntegerOption)
   .option('--resume', 'Resume interrupted analysis')
   .option('--clear', 'Clear existing data before analysis')
-  .option('--concurrency <number>', 'Number of concurrent requests', parseInt, 2)
-  .option('--batch-size <number>', 'Batch size for processing', parseInt, 50)
+  .option('--concurrency <number>', 'Number of concurrent requests', parseIntegerOption, 2)
+  .option('--batch-size <number>', 'Batch size for processing', parseIntegerOption, 50)
   .option('--verbose', 'Show verbose output')
   .action(analyzePRHistory);
 

package/src/index.test.js

@@ -0,0 +1,35 @@
+import { expect, it, onTestFinished, vi } from 'vitest';
+
+const { originalArgv, originalListeners, reviewFile } = vi.hoisted(() => {
+  const originalArgv = process.argv;
+  const originalListeners = Object.fromEntries(['SIGINT', 'SIGTERM', 'exit'].map((event) => [event, process.listeners(event)]));
+  process.argv = ['node', 'index.js', 'analyze', '--file', 'src/index.js', '--max-examples', '12'];
+  return {
+    originalArgv,
+    originalListeners,
+    reviewFile: vi.fn().mockResolvedValue({ success: true, results: [] }),
+  };
+});
+
+vi.unmock('chalk');
+vi.mock('./rag-review.js', () => ({
+  reviewFile,
+  reviewFiles: vi.fn(),
+  reviewPullRequest: vi.fn(),
+}));
+
+import './index.js';
+
+it('parses integer options independently of Commander defaults', async () => {
+  onTestFinished(() => {
+    process.argv = originalArgv;
+    for (const [event, listeners] of Object.entries(originalListeners)) {
+      process
+        .listeners(event)
+        .filter((listener) => !listeners.includes(listener))
+        .forEach((listener) => process.removeListener(event, listener));
+    }
+  });
+  await vi.waitFor(() => expect(reviewFile).toHaveBeenCalled());
+  expect(reviewFile.mock.calls[0][1].maxExamples).toBe(12);
+});

package/src/llm.js

@@ -41,7 +41,7 @@ function getAnthropicClient() {
 }
 
 // Default model
-const DEFAULT_MODEL = 'claude-sonnet-4-5';
+const DEFAULT_MODEL = 'claude-sonnet-4-6';
 
 // Maximum tokens for response
 const MAX_TOKENS = 4096;

package/src/llm.test.js

@@ -49,7 +49,7 @@ describe('sendPromptToClaude', () => {
 
       expect(mockMessagesCreate).toHaveBeenCalledWith(
         expect.objectContaining({
-          model: 'claude-sonnet-4-5',
+          model: 'claude-sonnet-4-6',
           max_tokens: 4096,
           temperature: 0.7,
         })

package/src/project-analyzer.js

@@ -17,6 +17,7 @@ import { verboseLog } from './utils/logging.js';
 import { escapeSqlString } from './utils/string-utils.js';
 
 const TERM_SEARCH_CONTENT_CANDIDATE_LIMIT = 500;
+const PROJECT_ANALYSIS_MODEL = 'claude-haiku-4-5';
 
 // Consolidated file classification configuration
 const FILE_PATTERNS = {
@@ -586,6 +587,7 @@ Select files following the criteria in the system instructions.`;
       };
 
       const response = await this.llm.sendPromptToClaude(prompt, {
+        model: PROJECT_ANALYSIS_MODEL,
         system: FILE_SELECTION_SYSTEM_PROMPT,
         temperature: 0.1,
         maxTokens: 1000,
@@ -878,6 +880,7 @@ Follow the analysis guidelines from the system instructions to identify custom i
       };
 
       const response = await this.llm.sendPromptToClaude(prompt, {
+        model: PROJECT_ANALYSIS_MODEL,
         system: PROJECT_SUMMARY_SYSTEM_PROMPT,
         temperature: 0.1,
         maxTokens: 4000,
@@ -886,7 +889,7 @@ Follow the analysis guidelines from the system instructions to identify custom i
 
       const summary = response.json;
       if (summary) {
-        // Validate and ensure required fields exist (Sonnet 4.5 compatibility)
+        // Validate and ensure required fields exist across model responses
         const validatedSummary = this.validateProjectSummary(summary);
 
         // Add metadata

package/src/project-analyzer.test.js

@@ -556,7 +556,7 @@ describe('ProjectAnalyzer', () => {
 
       const result = await analyzer.selectFinalKeyFiles(candidates, mockProjectPath);
 
-      expect(llm.sendPromptToClaude).toHaveBeenCalled();
+      expect(llm.sendPromptToClaude).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ model: 'claude-haiku-4-5' }));
       expect(result.length).toBe(1);
       expect(result[0].relativePath).toBe('package.json');
     });
@@ -668,9 +668,11 @@ describe('ProjectAnalyzer', () => {
         content: JSON.stringify(mockSummary),
         json: mockSummary,
       });
+      analyzer.llm = llm;
 
       const result = await analyzer.generateProjectSummary(mockKeyFiles, mockProjectPath);
 
+      expect(llm.sendPromptToClaude).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ model: 'claude-haiku-4-5' }));
       expect(result.projectName).toBe('test-project');
       expect(result.analysisDate).toBeDefined();
       expect(result.projectPath).toBe(mockProjectPath);

package/src/rag-analyzer.js

@@ -764,7 +764,7 @@ function prepareContextForLLM(filePath, content, language, finalCodeExamples, fi
 async function callLLMForAnalysis(context, options = {}) {
   try {
     let prompt;
-    const model = options.model || 'claude-sonnet-4-5';
+    const model = options.model || 'claude-sonnet-4-6';
     const maxTokens = options.maxTokens || 8192; // Default to a safe limit
 
     if (options.isHolisticPRReview) {
@@ -2343,7 +2343,8 @@ async function gatherUnifiedContextForPR(prFiles, options = {}) {
   // Aggregate and deduplicate results
   for (const context of allContexts) {
     (context.finalCodeExamples || []).forEach((example) => {
-      const key = example.path;
+      const normalizedContent = example.content?.trim();
+      const key = normalizedContent ? `content:${normalizedContent}` : example.path ? `path:${example.path}` : null;
       if (
         key &&
         (!allProcessedContext.codeExamples.has(key) || example.similarity > allProcessedContext.codeExamples.get(key).similarity)

package/src/rag-analyzer.test.js

@@ -1136,6 +1136,32 @@ describe('rag-analyzer', () => {
         expect(context.codeExamples[0].similarity).toBeGreaterThanOrEqual(0.7);
       }
     });
+
+    it('should deduplicate identical code content from different paths', async () => {
+      mockEmbeddingsSystem.findSimilarCode
+        .mockResolvedValueOnce([{ path: '/first.js', content: 'shared implementation', similarity: 0.7 }])
+        .mockResolvedValueOnce([{ path: '/second.js', content: ' shared implementation ', similarity: 0.9 }]);
+      const context = await gatherUnifiedContextForPR([
+        { filePath: '/src/file1.js', content: 'code1' },
+        { filePath: '/src/file2.js', content: 'code2' },
+      ]);
+
+      expect(context.codeExamples).toEqual([
+        expect.objectContaining({ path: '/second.js', content: ' shared implementation ', similarity: 0.9 }),
+      ]);
+    });
+
+    it('should keep content keys separate from path fallbacks', async () => {
+      mockEmbeddingsSystem.findSimilarCode
+        .mockResolvedValueOnce([{ path: '/first.js', content: '', similarity: 0.9 }])
+        .mockResolvedValueOnce([{ path: '/second.js', content: ' /first.js ', similarity: 0.8 }]);
+      const context = await gatherUnifiedContextForPR([
+        { filePath: '/src/file1.js', content: 'code1' },
+        { filePath: '/src/file2.js', content: 'code2' },
+      ]);
+
+      expect(context.codeExamples.map((example) => example.path)).toEqual(['/first.js', '/second.js']);
+    });
   });
 
   // ==========================================================================