codecritique 2.1.2 → 2.1.3

package/README.md

@@ -545,6 +545,10 @@ VERBOSE=true
 
 Set `CODECRITIQUE_SKIP_DOTENV=1` to disable `.env` loading, as the shell wrapper does after forwarding its supported variables.
 
+### Trust and Prompt Injection
+
+Repository files, diffs, custom documents, and PR comments are untrusted data included in LLM prompts. A malicious repository can attempt to influence generated review text despite prompt boundaries and truncation. Treat CodeCritique output as advisory, review findings before acting on them, and never grant generated suggestions automatic execution privileges.
+
 ## Output Formats
 
 CodeCritique supports three output formats:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecritique",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "AI-powered code review tool for any programming language",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -42,6 +42,7 @@ async function cleanupEmbeddingsSystemIfInitialized() {
 }
 
 const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+const parseIntegerOption = (value) => Number.parseInt(value, 10);
 
 // Configure command-line interface
 program.name('codecritique').description('CLI tool for AI-powered code review using the RAG approach').version(packageJson.version);
@@ -64,11 +65,11 @@ program
   .option('--verbose', 'Show verbose output')
   .option('--model <model>', 'LLM model to use (e.g., claude-sonnet-4-6)')
   .option('--temperature <number>', 'LLM temperature', parseFloat, 0.2)
-  .option('--max-tokens <number>', 'LLM max tokens', parseInt, 8192)
+  .option('--max-tokens <number>', 'LLM max tokens', parseIntegerOption, 8192)
   .option('--cache-ttl <ttl>', 'Cache TTL for LLM prompts: "5m" (default, no extra cost) or "1h" (extended, extra cost for writes)', '5m')
   .option('--similarity-threshold <number>', 'Threshold for finding similar code examples', parseFloat, 0.6)
-  .option('--max-examples <number>', 'Max similar code examples to use', parseInt, 5)
-  .option('--concurrency <number>', 'Concurrency for processing multiple files', parseInt, 3)
+  .option('--max-examples <number>', 'Max similar code examples to use', parseIntegerOption, 5)
+  .option('--concurrency <number>', 'Concurrency for processing multiple files', parseIntegerOption, 3)
   .option(
     '--doc <specs...>',
     'A document to provide custom instructions to the LLM (e.g., "Engineering Guidelines:./docs/guidelines.md"). Can be specified multiple times.'
@@ -142,11 +143,11 @@ program
   .option('-t, --token <token>', 'GitHub API token (or set GITHUB_TOKEN env var)')
   .option('--since <date>', 'Only analyze PRs since this date (ISO format)')
   .option('--until <date>', 'Only analyze PRs until this date (ISO format)')
-  .option('--limit <number>', 'Limit number of PRs to analyze', parseInt)
+  .option('--limit <number>', 'Limit number of PRs to analyze', parseIntegerOption)
   .option('--resume', 'Resume interrupted analysis')
   .option('--clear', 'Clear existing data before analysis')
-  .option('--concurrency <number>', 'Number of concurrent requests', parseInt, 2)
-  .option('--batch-size <number>', 'Batch size for processing', parseInt, 50)
+  .option('--concurrency <number>', 'Number of concurrent requests', parseIntegerOption, 2)
+  .option('--batch-size <number>', 'Batch size for processing', parseIntegerOption, 50)
   .option('--verbose', 'Show verbose output')
   .action(analyzePRHistory);
 

package/src/index.test.js

@@ -0,0 +1,35 @@
+import { expect, it, onTestFinished, vi } from 'vitest';
+
+const { originalArgv, originalListeners, reviewFile } = vi.hoisted(() => {
+  const originalArgv = process.argv;
+  const originalListeners = Object.fromEntries(['SIGINT', 'SIGTERM', 'exit'].map((event) => [event, process.listeners(event)]));
+  process.argv = ['node', 'index.js', 'analyze', '--file', 'src/index.js', '--max-examples', '12'];
+  return {
+    originalArgv,
+    originalListeners,
+    reviewFile: vi.fn().mockResolvedValue({ success: true, results: [] }),
+  };
+});
+
+vi.unmock('chalk');
+vi.mock('./rag-review.js', () => ({
+  reviewFile,
+  reviewFiles: vi.fn(),
+  reviewPullRequest: vi.fn(),
+}));
+
+import './index.js';
+
+it('parses integer options independently of Commander defaults', async () => {
+  onTestFinished(() => {
+    process.argv = originalArgv;
+    for (const [event, listeners] of Object.entries(originalListeners)) {
+      process
+        .listeners(event)
+        .filter((listener) => !listeners.includes(listener))
+        .forEach((listener) => process.removeListener(event, listener));
+    }
+  });
+  await vi.waitFor(() => expect(reviewFile).toHaveBeenCalled());
+  expect(reviewFile.mock.calls[0][1].maxExamples).toBe(12);
+});

package/src/rag-analyzer.js

@@ -2343,7 +2343,8 @@ async function gatherUnifiedContextForPR(prFiles, options = {}) {
   // Aggregate and deduplicate results
   for (const context of allContexts) {
     (context.finalCodeExamples || []).forEach((example) => {
-      const key = example.path;
+      const normalizedContent = example.content?.trim();
+      const key = normalizedContent ? `content:${normalizedContent}` : example.path ? `path:${example.path}` : null;
       if (
         key &&
         (!allProcessedContext.codeExamples.has(key) || example.similarity > allProcessedContext.codeExamples.get(key).similarity)

package/src/rag-analyzer.test.js

@@ -1136,6 +1136,32 @@ describe('rag-analyzer', () => {
         expect(context.codeExamples[0].similarity).toBeGreaterThanOrEqual(0.7);
       }
     });
+
+    it('should deduplicate identical code content from different paths', async () => {
+      mockEmbeddingsSystem.findSimilarCode
+        .mockResolvedValueOnce([{ path: '/first.js', content: 'shared implementation', similarity: 0.7 }])
+        .mockResolvedValueOnce([{ path: '/second.js', content: ' shared implementation ', similarity: 0.9 }]);
+      const context = await gatherUnifiedContextForPR([
+        { filePath: '/src/file1.js', content: 'code1' },
+        { filePath: '/src/file2.js', content: 'code2' },
+      ]);
+
+      expect(context.codeExamples).toEqual([
+        expect.objectContaining({ path: '/second.js', content: ' shared implementation ', similarity: 0.9 }),
+      ]);
+    });
+
+    it('should keep content keys separate from path fallbacks', async () => {
+      mockEmbeddingsSystem.findSimilarCode
+        .mockResolvedValueOnce([{ path: '/first.js', content: '', similarity: 0.9 }])
+        .mockResolvedValueOnce([{ path: '/second.js', content: ' /first.js ', similarity: 0.8 }]);
+      const context = await gatherUnifiedContextForPR([
+        { filePath: '/src/file1.js', content: 'code1' },
+        { filePath: '/src/file2.js', content: 'code2' },
+      ]);
+
+      expect(context.codeExamples.map((example) => example.path)).toEqual(['/first.js', '/second.js']);
+    });
   });
 
   // ==========================================================================