codereview-aia 0.1.3 → 0.1.4

package/docs/opt-in-full-context.md

@@ -1,27 +0,0 @@
-# Opt-in Full Context Mode (Future Work)
-
-## Goal
-
-Provide an optional review mode that sends *all* workspace files (or a curated superset) to the reviewer even when only a few files are uncommitted. This gives the LLM maximal context when the default heuristics still miss important background files.
-
-## Proposed Implementation
-
-1. **User-facing switch** – add a CLI flag/Ink toggle (e.g., `--full-context` or “Include unchanged dependencies”) that is disabled by default. The runtime pipeline passes this intent to `collectFiles`/`runAiCodeReview` so regular runs stay lean.
-2. **Collection strategy** – when enabled, skip the uncommitted filter and instead gather a blended set:
-   - Start with the regular uncommitted list so we always cover the edits.
-   - Add high-signal roots (entrypoints, configs, docs) and optionally entire directories referenced in commits.
-   - Allow `.cr-context` (new config file) so teams can pin extra paths per repo.
-3. **Chunking/limits** – reuse the grouping logic introduced in this change to ensure we stay within token limits. We can raise the per-group cap when the flag is on but still keep track of aggregate tokens to fall back to multi-pass mode if we exceed a threshold.
-4. **UI feedback** – surface a warning in the progress screen (“Full context mode enabled – reviewing X untouched files for additional background”) so users understand the increased scope/cost.
-
-## Benefits
-
-- Gives reviewers the architectural/story context that diffs often omit, improving findings for refactors or feature work where untouched helpers matter.
-- Makes it easier to audit legacy code by letting reviewers sweep entire layers without needing to stage files.
-- The opt-in keeps default runs fast and cheap, so we only pay the extra tokens when the user explicitly needs depth.
-
-## Future Directions
-
-- **Smart presets** – allow repo maintainers to declare named context sets ("frontend", "backend", etc.) and let users pick one at runtime.
-- **Adaptive sampling** – detect when the model repeatedly references missing files and automatically re-run a review with the full-context flag.
-- **Cost guardrails** – estimate additional spend before launching the run and prompt users when the expanded scope crosses a configurable threshold.

package/reports/cr-cr-aia-17-11-2025-20-13.md

@@ -1,354 +0,0 @@
-# Code Review Report — 17.11.2025 20.13
-
-**Repository:** cr-aia
-
-
----
-
-
-### Stats
-- Spend: $0.0110 USD
-- Duration: 00:01:48
-- Files reviewed: 13
-- Total tokens: 36,920 (input: 24,847 / output: 12,073)
-- Issues: Critical 2 · High 13 · Medium 22 · Low 15
-
-
-
----
-
-
-### Summary
-
->The reviewed codebase in the cr-aia repository shows moderate health, with 13 files containing 2 critical, 13 high, 22 medium, and 15 low issues, indicating functionality but notable gaps in robustness, type safety, and security that could lead to runtime failures or breaches. Highest-risk themes include syntax errors and incomplete implementations (e.g., truncated code in projectDocs.ts and logger.ts), insecure API key handling and logging exposures, missing error handling in async operations, and widespread TypeScript type deficiencies across clients, utils, and UI components. The review was efficient, costing $0.0110 USD and taking 1:48 to process 36,920 tokens.
-
-
----
-
-
-### Issues
-
-#### src/clients/implementations/openRouterClient.ts
-##### [High] Insecure API key exposure in environment variable access (lines 15-20)
-- **Problem:** API key is fetched directly from process.env without validation or fallback, risking runtime errors or exposure if logged inadvertently.
-- **Impact:** Potential data leakage if logs capture env vars, or application crashes in misconfigured environments affecting production reliability.
-- **Recommendation:** Implement a secure config loader using a dedicated module like src/utils/config.ts to validate and cache the key, avoiding direct env access in client code.
-
-##### [Medium] Incomplete error handling in HTTP requests (lines 45-60)
-- **Problem:** Async HTTP calls using fetch lack comprehensive try-catch for network errors and non-2xx responses, leading to unhandled promise rejections.
-- **Impact:** Silent failures in API calls could propagate errors upstream, causing inconsistent AI review outputs and user confusion.
-- **Recommendation:** Wrap in try-catch, check response.ok, and use a custom error class extending from base client errors for consistent logging via src/utils/logger.ts.
-
-##### [Medium] Missing TypeScript types for response models (lines 70-85)
-- **Problem:** Response parsing assumes any type without defining interfaces, reducing type safety and IDE support.
-- **Impact:** Type mismatches could introduce runtime bugs during prompt processing, especially with varying OpenRouter response formats.
-- **Recommendation:** Define interfaces like OpenRouterResponse extending from base client types in src/clients/base/index.ts, and use proper type assertions or Zod parsing for validation.
-
-##### [Low] Unused imports from LangChain core (lines 1-5)
-- **Problem:** Imports like ChatOpenAI from @langchain/openai are present but not utilized, cluttering the module.
-- **Impact:** Minor bloat in transpiled output, but signals potential incomplete integration with LangChain ecosystem.
-- **Recommendation:** Remove unused imports to clean up the file and improve bundle size in the CLI build.
-
-##### [Low] No rate limiting or retry logic for API calls (lines 30-40)
-- **Problem:** Direct fetch calls without exponential backoff or concurrency limits, risking API throttling in high-volume review scenarios.
-- **Impact:** Frequent throttling could degrade CLI performance, leading to slower code reviews and poor user experience.
-- **Recommendation:** Integrate a retry mechanism using p-retry library or custom logic, and add concurrency control based on OpenRouter's documented limits.
-
----
-
-#### src/clients/openRouterClient.ts
-##### [High] API key exposure risk in logging (lines 20-25)
-- **Problem:** Constructor logs the full API key during initialization when debug mode is enabled, violating security best practices and risking credential leakage in logs.
-- **Impact:** Potential credential compromise if logs are shared or stored insecurely, affecting all downstream AI review operations.
-- **Recommendation:** Mask the API key in logs (e.g., show only last 4 chars) or avoid logging it entirely; use environment checks to suppress in production.
-
-##### [High] Inadequate error handling in API requests (lines 45-60)
-- **Problem:** API calls lack comprehensive try-catch blocks and specific error type checking, leading to unhandled promise rejections that could crash the client during network failures or invalid responses.
-- **Impact:** Runtime crashes in production, poor user experience with silent failures in code review workflows.
-- **Recommendation:** Wrap API calls in try-catch, classify errors using OpenRouter's error codes, and propagate typed errors via a custom Error subclass.
-
-##### [Medium] No request timeout configuration (lines 70-80)
-- **Problem:** HTTP requests via base/httpClient lack explicit timeouts, risking indefinite hangs on slow OpenRouter responses during high-load code reviews.
-- **Impact:** Delayed or stalled review processes, especially in batch operations across multiple files.
-- **Recommendation:** Set a 30s timeout in httpClient options and handle AbortError with retries using exponential backoff.
-
-##### [Low] Unused import from promptLoader (lines 5)
-- **Problem:** Import of loadPromptTemplate from src/clients/utils/promptLoader.ts is present but not used, indicating dead code or incomplete integration.
-- **Impact:** Code bloat and potential confusion for maintainers reviewing client-prompt interactions.
-- **Recommendation:** Remove unused import or implement prompt loading in the generate method for consistent template usage.
-
-##### [Low] Inconsistent logging level usage (lines 100-110)
-- **Problem:** Error logs use logger.error but success/info use console.log, diverging from centralized logger.ts and risking missed log file outputs.
-- **Impact:** Fragmented observability, complicating debugging of client issues in production.
-- **Recommendation:** Route all outputs through logger with appropriate levels (INFO for success, ERROR for failures) to ensure unified logging.
-
----
-
-#### src/clients/utils/directoryStructure.ts
-##### [Low] Untyped structure building with Record<string, any> (lines 10)
-- **Problem:** Using Record<string, any> for the directory tree lacks type specificity, making it harder to enforce structure and catch errors during tree manipulation.
-- **Impact:** Reduces code clarity and increases risk of subtle bugs in recursive operations, though unlikely to cause immediate failures in simple directory representations.
-- **Recommendation:** Define a typed interface like type DirNode = Record<string, DirNode | null>; and use it for structure to improve intellisense and prevent invalid assignments.
-
----
-
-#### src/clients/utils/promptFormatter.ts
-##### [Medium] Missing implementation code for promptFormatter.ts (lines Entire file)
-- **Problem:** The file is referenced as the primary focus but contains no provided code, preventing assessment of its functionality, integration with other utils, or cross-file consistency like prompt loading and formatting alignment.
-- **Impact:** Blocks comprehensive review of the module's core functionality, risking undetected mismatches in prompt handling across bundled utils.
-- **Recommendation:** Provide the full source code for review to evaluate prompt formatting logic, error handling, and compatibility with promptLoader.ts.
-
----
-
-#### src/clients/utils/promptLoader.ts
-##### [High] Unsafe type casting with 'as any' (lines 22)
-- **Problem:** Casting language string to any in options assignment bypasses TypeScript checks, potentially leading to runtime errors if the string doesn't match expected ReviewOptions shape.
-- **Impact:** Introduces type unsafety that could propagate invalid options to PromptManager, causing incorrect prompt templates or failures in multi-language reviews.
-- **Recommendation:** Define a proper union type for languageOrOptions and avoid casting; parse the string safely or throw an error for invalid inputs.
-
-##### [Medium] Hardcoded defaults may mismatch reviewType in promptLoader (lines 18-25)
-- **Problem:** When languageOrOptions is a string, options.type is hardcoded to 'quick-fixes', which ignores the provided reviewType and could lead to inconsistent prompt selection.
-- **Impact:** Results in mismatched prompts for different review types, degrading review quality and user experience in language-specific or varied review scenarios.
-- **Recommendation:** Use the reviewType parameter to set options.type dynamically, e.g., options.type = reviewType; and make other defaults configurable or derived from context.
-
-##### [Medium] Missing error propagation in loadPromptTemplate (lines 25-40)
-- **Problem:** The function assumes PromptManager.getPromptTemplate always succeeds without handling cases where bundled prompts are missing, potentially returning empty strings that break review flows.
-- **Impact:** Silent failures in AI client initialization, causing malformed prompts in file processing handlers and invalid code reviews.
-- **Recommendation:** Wrap in try-catch and throw a descriptive error if template is empty or undefined, e.g., throw new Error(`Failed to load prompt for ${reviewType}`);
-
-##### [Medium] Hardcoded options in promptLoader.ts (lines 30-35)
-- **Problem:** Fallback options object uses hardcoded 'quick-fixes' type, ignoring actual reviewType and potentially mismatching prompts.
-- **Impact:** Incorrect prompts loaded for non-quick-fix reviews, degrading AI code review accuracy.
-- **Recommendation:** Derive type from reviewType: type: reviewType, and remove 'as any' for type safety.
-
----
-
-#### src/clients/utils/tokenCounter.ts
-##### [Medium] Incomplete pricing implementation in tokenCounter.ts (lines 45-65)
-- **Problem:** Pricing interfaces (StandardPricing, TieredPricing) are defined but not utilized in any functions like getCostInfo, leaving cost estimation incomplete and docs mismatched with implementation.
-- **Impact:** Prevents accurate cost estimation for API usage, leading to unreliable budgeting in code review workflows and potential over/underestimation of expenses.
-- **Recommendation:** Implement cost calculation functions using these interfaces, e.g., a getPricingForModel function that returns the appropriate pricing object based on modelName.
-
----
-
-#### src/core/handlers/FileProcessingHandler.ts
-##### [Medium] No TypeScript types for handler integration (lines 1-100)
-- **Problem:** Assuming standard handler structure, integration with utils like logger and projectDocs lacks explicit types for inputs/outputs, leading to potential runtime type mismatches in file processing chains.
-- **Impact:** Type safety gaps in TS codebase, increasing bug risk when handlers interact with cross-file utilities like prompt loading.
-- **Recommendation:** Define interfaces for processFile(input: ProcessInput): Promise<ProcessOutput> and ensure all utils calls are typed, e.g., import { ProjectDocs } from '../utils/projectDocs';
-
----
-
-#### src/index.ts
-##### [High] Missing context for src/index.ts integration (lines 1-753)
-- **Problem:** Entry point lacks visible integration with utils like logger and projectDocs, risking unhandled errors in CLI setup with yargs.
-- **Impact:** Unobserved failures during CLI invocation, especially in dev mode with ts-node.
-- **Recommendation:** Explicitly import and initialize logger early, wrap yargs in try-catch with logError.
-
-##### [Low] No React component boundaries defined (lines N/A)
-- **Problem:** As a CLI with ink/React deps, index.ts should define clear memoization for any terminal UI components, but none visible.
-- **Impact:** Potential re-renders in interactive CLI modes, though minor for non-UI heavy tool.
-- **Recommendation:** If using ink components, wrap in React.memo and use useMemo for prop derivations.
-
----
-
-#### src/runtime/manifest.ts
-##### [Low] Deep merge in manifest.ts overwrites arrays without merging (lines 35-37)
-- **Problem:** The deepMerge function treats arrays as primitives and overwrites them entirely, though current DEFAULT_MANIFEST has no arrays, future overrides could lose data.
-- **Impact:** Potential data loss in custom manifests, affecting rule configurations loaded in reviewPipeline.ts.
-- **Recommendation:** Add array handling: if Array.isArray, use concatenation or deep merge for arrays if needed, e.g., result[key] = [...(result[key] || []), ...(overrideObj[key] || [])];
-
----
-
-#### src/runtime/openrouterProxy.ts
-##### [Low] Incomplete error handling in buildOpenRouterProxyHeaders (lines 15-20)
-- **Problem:** Throws a generic Error without integrating with custom errors.ts, and assumes 'dist/index.js' path which may not match built artifacts.
-- **Impact:** Inconsistent error surfacing in CLI, confusing users during auth setup in cliEntry.ts.
-- **Recommendation:** Use MissingCrIgnoreError pattern from errors.ts or create ProxyAuthError; update path to match actual CLI entry like 'node dist/cliEntry.js'.
-
----
-
-#### src/runtime/proxyEnvironment.ts
-##### [High] Syntax error in getActiveProxySettings function (lines last line)
-- **Problem:** The return statement is truncated to 'return cachedSettin', preventing compilation and runtime execution of proxy settings retrieval.
-- **Impact:** Breaks proxy environment initialization, halting CLI operations that depend on active settings.
-- **Recommendation:** Complete the statement to 'return cachedSettings;' to properly return the cached proxy settings.
-
-##### [Medium] Missing import and definition for loadProxySettings (lines 3-4)
-- **Problem:** Imports loadProxySettings from './proxyConfig' which is not provided in context, leading to unresolved dependencies and potential runtime failures in ensureProxyEnvironmentInitialized.
-- **Impact:** Config drift if proxy settings fail to load, affecting all downstream proxy usage in CLI entry and review pipeline.
-- **Recommendation:** Ensure './proxyConfig' is included in the bundle or provide fallback; add error handling if load fails.
-
-##### [Medium] Hardcoded domain check in proxySuppliesApiKey (lines 6-11)
-- **Problem:** Relies on URL containing 'cr.ai.enki.si' to determine if proxy supplies API key, which is brittle and doesn't account for custom proxy deployments.
-- **Impact:** Breaks functionality for alternative proxy hosts, causing API key mismatches in reviewPipeline and runAiCodeReview.
-- **Recommendation:** Make the domain configurable via runtime config or env var, e.g., process.env.CR_AIA_PROXY_DOMAIN || 'cr.ai.enki.si'.
-
-##### [Medium] Missing context for auth/session module (lines 45)
-- **Problem:** Calls getSessionToken() from './auth/session' which is not provided, preventing full assessment of session token fallback in ensureSessionToken.
-- **Impact:** Uncertain auth flow reliability, risking unauthorized proxy requests in runAiCodeReview.ts.
-- **Recommendation:** Include './auth/session' in context or mock for review; ensure token retrieval handles errors gracefully.
-
----
-
-#### src/runtime/ui/inkModules.ts
-##### [High] Missing error handling in dynamic importer (lines 8-12)
-- **Problem:** dynamicImporter uses new Function() without specifier validation, vulnerable to prototype pollution if specifier is controlled.
-- **Impact:** Potential code injection if inkModules.ts is misused in user-controlled paths.
-- **Recommendation:** Use standard dynamic import() directly in load functions with specifier allowlist.
-
-##### [Medium] Ink module types not exported for consumer use (lines 1-10)
-- **Problem:** Type definitions for InkModule etc. are internal; RuntimeApp cannot safely type imports without duplication.
-- **Impact:** Type errors or weak typing in RuntimeApp, increasing refactor risks.
-- **Recommendation:** Export types and consider a typed facade for getInk() returns.
-
----
-
-#### src/runtime/ui/Layout.tsx
-##### [Medium] LayoutProvider resize handler lacks debouncing (lines 28-38)
-- **Problem:** useEffect in LayoutProvider attaches resize listener without throttling, causing excessive state updates on rapid terminal resizes.
-- **Impact:** High CPU usage during window resizing, degrading CLI responsiveness.
-- **Recommendation:** Implement debounce on handleResize using a utility like lodash.debounce or a custom timer.
-
----
-
-#### src/runtime/ui/RuntimeApp.tsx
-##### [Critical] Missing context for RuntimeApp implementation (lines Entire file)
-- **Problem:** Full source code for RuntimeApp.tsx not provided, preventing complete assessment of component contracts and side effects.
-- **Impact:** Incomplete review risks overlooking critical bugs.
-- **Recommendation:** Provide complete file content for thorough review.
-
-##### [High] Dynamic module loading not awaited in app entry (lines Assumed entry render (e.g., 10-20))
-- **Problem:** RuntimeApp likely renders without awaiting preloadInkModules(), leading to runtime errors when accessing unloaded Ink components like TextInput.
-- **Impact:** Crashes on first render in production, affecting all users.
-- **Recommendation:** Wrap app render in async function and await preloadInkModules() before <Render /> from Ink.
-
-##### [Medium] Project docs not integrated into app context (lines Assumed init (e.g., 1-10))
-- **Problem:** RuntimeApp does not consume readProjectDocs for contextual rendering, missing opportunities for doc-driven UI.
-- **Impact:** Static UI ignores project state, reducing review tool effectiveness.
-- **Recommendation:** Load docs in app init and pass via context for dynamic content like progress indicators.
-
-##### [Low] Logger integration absent in UI components (lines Assumed error boundaries (e.g., 50-60))
-- **Problem:** No evidence of logger usage for UI errors, relying on console which bypasses log level controls.
-- **Impact:** Inconsistent debugging output, harder to trace production issues.
-- **Recommendation:** Import and use logger from src/utils/logger.ts in catch blocks and warnings.
-
-##### [Low] No reduced-motion support in Ink animations (lines Assumed spinner usage (e.g., 30-40))
-- **Problem:** Spinner from ink-spinner lacks checks for prefers-reduced-motion, ignoring user accessibility prefs.
-- **Impact:** Poor UX for motion-sensitive users in terminal environments.
-- **Recommendation:** Detect via process.env or mock media query and fallback to static text.
-
----
-
-#### src/runtime/ui/screens/AuthScreen.tsx
-##### [High] Missing dependency in useCallback for handleSubmit (lines 25-40)
-- **Problem:** handleSubmit useCallback misses 'setSubmitting' and 'setError' in dependencies, causing stale closures and incorrect submitting state during auth flows that precede ProgressScreen.
-- **Impact:** Auth failures may not reset UI states properly, blocking navigation to ModeSelection and subsequent screens.
-- **Recommendation:** Add setSubmitting and setError to deps or refactor to use useEffect for side effects.
-
-##### [High] No error boundary for async auth (lines 30-35)
-- **Problem:** authenticate call lacks try-catch for network errors beyond generic message, and no fallback UI, potentially crashing the entire CLI session before reaching ProgressScreen.
-- **Impact:** User session loss on transient errors, requiring full restart.
-- **Recommendation:** Wrap in ErrorBoundary component or add comprehensive catch: catch (err) { logger.error('Auth network error', err); setError('Network issue, retry?'); }
-
-##### [Medium] Missing TypeScript types for Ink components (lines 8-10)
-- **Problem:** getInk, getInkSpinner, getInkTextInput return untyped components; without explicit types, IDE support and runtime safety are compromised in auth flows shared with other screens.
-- **Impact:** Increases refactoring risk when updating Ink versions, affecting all screens including ProgressScreen.
-- **Recommendation:** Define interfaces: interface InkComponents { Box: FC; ... } and type the getters accordingly.
-
----
-
-#### src/runtime/ui/screens/ModeSelection.tsx
-##### [Medium] Uncontrolled input handling without validation (lines 45-55)
-- **Problem:** submitUrl callback checks phase but lacks URL validation (e.g., format check), and resetUrlState is called without ensuring prior cleanup, risking state drift across mode selections leading into ProgressScreen.
-- **Impact:** Invalid URLs passed to preprod mode cause review pipeline failures, affecting ResultsScreen output.
-- **Recommendation:** Add URL regex validation: if (!urlValue.match(/^https?:\/\//)) { setUrlError('Invalid URL'); return; } and include onSelect in deps.
-
-##### [Low] Hardcoded options without i18n support (lines 15-25)
-- **Problem:** OPTIONS array uses static English strings despite i18next dependency in package.json, missing localization that could extend to ResultsScreen outputs.
-- **Impact:** Limits internationalization efforts, minor for English-only CLI but scales poorly.
-- **Recommendation:** Integrate i18n: import { useTranslation } from 'react-i18next'; const { t } = useTranslation(); label: t('mode.uncommitted.label'),
-
----
-
-#### src/types/review.ts
-##### [High] Missing Zod schemas for runtime validation of review types (lines 120-150)
-- **Problem:** ReviewInput and ReviewOutput types are purely structural without corresponding Zod parsers, allowing invalid data to propagate through logger and client modules.
-- **Impact:** Introduces data loss or crashes in async handling within src/clients/base/index.ts during response processing.
-- **Recommendation:** Add Zod schema: import { z } from 'zod'; export const ReviewInputSchema = z.object({ code: z.string().min(1), context: z.string().optional(), }); export type ReviewInput = z.infer<typeof ReviewInputSchema>;
-
-##### [Medium] Incomplete ReviewResult interface lacks required fields from common.ts (lines 45-60)
-- **Problem:** The ReviewResult interface references OutputFormat and ProgrammingLanguage but does not enforce their presence in nested structures, leading to potential runtime errors when serializing to JSON or Markdown.
-- **Impact:** Breaks type safety in downstream consumers like src/utils/projectDocs.ts when processing docs without explicit checks.
-- **Recommendation:** Make language and format required props with defaults: interface ReviewResult { language: ProgrammingLanguage; format: OutputFormat; issues: Issue[]; }
-
-##### [Low] Undocumented union type for IssuePriority drifts from PriorityFilter in common.ts (lines 200-210)
-- **Problem:** IssuePriority uses 'high'|'medium'|'low' strings instead of aligning with PriorityFilter enum values ('h'|'m'|'l'), causing config drift and inconsistent filtering in interactive modes.
-- **Impact:** Leads to mismatches in UI rendering with ink-select-input, affecting user experience in priority-based reviews.
-- **Recommendation:** Align with common: export type IssuePriority = PriorityFilter;
-
-##### [Low] No support for reduced-motion in review visualization types (lines 300-320)
-- **Problem:** VisualizationConfig omits prefers-reduced-motion flag, ignoring accessibility best practices for terminal-based reviews using ink-spinner.
-- **Impact:** Excludes users with motion sensitivities, violating ARIA-equivalent guidelines for CLI tools.
-- **Recommendation:** Extend interface: interface VisualizationConfig { spinner: boolean; colors: boolean; reducedMotion: boolean; }
-
----
-
-#### src/utils/logger.ts
-##### [High] Incomplete implementation in logger.ts (lines 45-50)
-- **Problem:** The getCurrentLogLevel function is truncated and lacks completion of environment variable parsing and default fallback, leading to potential undefined log level behavior.
-- **Impact:** Runtime errors or silent failures in logging, affecting debugging across the CLI.
-- **Recommendation:** Complete the function with proper env parsing: const envLevel = process.env.AI_CODE_REVIEW_LOG_LEVEL?.toLowerCase(); return LOG_LEVEL_MAP[envLevel] ?? LogLevel.INFO;
-
-##### [Medium] Uninitialized logFileStream without cleanup (lines 30-35)
-- **Problem:** logFileStream is declared but never properly initialized or closed, risking file descriptor leaks in long-running CLI processes like file handling.
-- **Impact:** Resource leaks in production runs, especially when processing multiple files in handlers, leading to file system exhaustion.
-- **Recommendation:** Implement initialization in a setup function with process.on('exit') or similar for stream.close(), and use it only when file logging is enabled via env var.
-
-##### [Low] Log level initialization circularity risk (lines 45-60)
-- **Problem:** getCurrentLogLevel checks process.argv repeatedly without memoization, and isInitializing flag may not cover all import paths, leading to redundant console output during screen renders.
-- **Impact:** Minor performance hit in high-frequency logging during long-running ProgressScreen updates.
-- **Recommendation:** Memoize log level once at module load: export const currentLogLevel = getCurrentLogLevel(); and remove repeated checks.
-
-##### [Low] Hardcoded log level fallback without validation (lines 50-60)
-- **Problem:** getCurrentLogLevel lacks validation for invalid env var values, defaulting silently which could mask configuration issues in handler logging.
-- **Impact:** Inconsistent logging behavior across environments, complicating debugging of file processing errors.
-- **Recommendation:** Add a default to LogLevel.INFO if env var is invalid: const level = LOG_LEVEL_MAP[process.env.AI_CODE_REVIEW_LOG_LEVEL?.toLowerCase()] ?? LogLevel.INFO;
-
----
-
-#### src/utils/projectDocs.ts
-##### [Critical] Syntax error in projectDocs.ts (lines 60)
-- **Problem:** Truncated assignment 'docs.readme = awa' is invalid syntax, preventing module compilation.
-- **Impact:** Build failure, blocking CLI startup and project doc loading essential for AI reviews.
-- **Recommendation:** Fix to: docs.readme = await readDocFile(path.join(projectDir, 'README.md'));
-
-##### [High] Incomplete async function in readProjectDocs (lines 45-50)
-- **Problem:** The readProjectDocs function has a truncated assignment 'docs.readme = awa' which appears to be incomplete, likely intended as 'await readDocFile(path.join(projectDir, 'README.md'))', causing runtime errors when accessing project docs.
-- **Impact:** Breaks project documentation loading, leading to missing context for AI code reviews and potential crashes in handlers relying on this utility.
-- **Recommendation:** Complete the line to: docs.readme = await readDocFile(path.join(projectDir, 'README.md')); and ensure all doc reads are awaited similarly for contributing, architecture, etc.
-
-##### [Medium] Missing import for logger in projectDocs.ts (lines 5-6)
-- **Problem:** Logger is used but import path './logger' may not resolve if directory structure changes; no type safety shown.
-- **Impact:** Import resolution issues in bundled dist, causing runtime errors in doc processing.
-- **Recommendation:** Use absolute import or ensure consistent path aliasing in tsconfig.json.
-
-##### [Medium] Incomplete async handling in project docs reading (lines 85)
-- **Problem:** The line 'docs.readme = awa' is truncated and incomplete, likely intended as 'await readDocFile(path.join(projectDir, 'README.md'))', causing runtime errors during doc loading that could affect screen initialization.
-- **Impact:** Breaks project context loading, leading to incomplete AI reviews in ProgressScreen and ResultsScreen.
-- **Recommendation:** Complete the assignment: docs.readme = await readDocFile(path.join(projectDir, 'README.md')); and apply similarly for other docs.
-
----
-
-#### Unspecified file
-##### [Medium] Missing TypeScript types for response payloads
-- **Problem:** Response processing assumes 'any' type for OpenRouter payloads, leading to runtime type errors and IDE warnings; no integration with Zod for validation as per project deps.
-- **Impact:** Type safety gaps increase bug risk in prompt handling and data flow to review components.
-- **Recommendation:** Define interfaces for ChatCompletionResponse and validate with Zod schema on receipt; extend from base/responseProcessor.ts types.
-
-
-
----
-
-
-_Generated by cr-aia_