codereview-aia 0.1.3 → 0.1.4

package/src/prompts/cache/PromptCache.ts

@@ -1,50 +0,0 @@
-/**
- * @fileoverview Minimal in-memory prompt cache.
- *
- * The original project ships a much more elaborate cache layer that integrates
- * with the prompt manager. For the trimmed-down fork we only need a basic
- * singleton that allows strategies to avoid recomputing prompt payloads.
- */
-
-/**
- * Simple key-value cache for prompts.
- */
-export class PromptCache {
-  private static instance: PromptCache | null = null;
-  private cache = new Map<string, string>();
-
-  private constructor() {}
-
-  /**
-   * Get the singleton instance.
-   */
-  public static getInstance(): PromptCache {
-    if (!PromptCache.instance) {
-      PromptCache.instance = new PromptCache();
-    }
-    return PromptCache.instance;
-  }
-
-  /**
-   * Retrieve a cached prompt by key.
-   */
-  public get(key: string): string | undefined {
-    return this.cache.get(key);
-  }
-
-  /**
-   * Store a prompt in the cache.
-   */
-  public set(key: string, value: string): void {
-    this.cache.set(key, value);
-  }
-
-  /**
-   * Remove all cached prompts.
-   */
-  public clear(): void {
-    this.cache.clear();
-  }
-}
-
-export default PromptCache;

package/src/prompts/promptText/common/variables/css-frameworks.json

@@ -1,33 +0,0 @@
-{
-  "cssFrameworks": {
-    "tailwind": {
-      "name": "Tailwind CSS",
-      "version": "4.0",
-      "releaseDate": "2024-10-01",
-      "features": [
-        "Design tokens by default",
-        "Smaller runtime",
-        "Improved dark-mode primitives"
-      ],
-      "integrations": {
-        "react": "Official tailwindcss-react plugin",
-        "nextjs": "next/font + tailwind preset",
-        "astro": "Integrated via astro add tailwind"
-      }
-    },
-    "vanilla": {
-      "name": "Vanilla CSS",
-      "version": "latest",
-      "releaseDate": "2024-01-01",
-      "features": [
-        "Native nesting",
-        "Cascade layers",
-        "Custom properties"
-      ],
-      "integrations": {
-        "global": "Works with any renderer"
-      }
-    }
-  }
-}
-

package/src/prompts/promptText/common/variables/framework-versions.json

@@ -1,45 +0,0 @@
-{
-  "frameworks": {
-    "react": {
-      "latest": {
-        "version": "19.x",
-        "releaseDate": "2024-12-01",
-        "supportedUntil": "2026-12-01",
-        "features": [
-          "Concurrent rendering defaults",
-          "Server components with streaming",
-          "Improved memo semantics"
-        ]
-      },
-      "previous": {
-        "version": "18.x",
-        "releaseDate": "2022-03-01",
-        "supportedUntil": "2025-03-01",
-        "features": [
-          "Automatic batching",
-          "Transitions",
-          "Suspense refinements"
-        ]
-      }
-    },
-    "generic": {
-      "latest": {
-        "version": "1.0.0",
-        "releaseDate": "2024-01-01",
-        "supportedUntil": "2026-01-01",
-        "features": [
-          "Baseline guidance only"
-        ]
-      },
-      "previous": {
-        "version": "0.9.0",
-        "releaseDate": "2023-01-01",
-        "supportedUntil": "2024-12-31",
-        "features": [
-          "Legacy guidance"
-        ]
-      }
-    }
-  }
-}
-

package/src/prompts/promptText/frameworks/react/comprehensive.hbs

@@ -1,19 +0,0 @@
-## Role
-You are a senior React and TypeScript reviewer. Assume the author expects production-ready guidance with zero fluff.
-
-## Focus Areas
-1. **Component contracts** – props/state flow, memoization boundaries, hook dependencies.
-2. **Rendering hygiene** – suspense/streaming boundaries, server/client component split, hydration safety.
-3. **Side effects** – lifecycle correctness, async handling, cleanup discipline.
-4. **Styling & accessibility** – ARIA, keyboard traps, reduced-motion support.
-5. **Data flow** – cache invalidation, query key usage, optimistic updates.
-
-## Output Expectations
-- Respond with a single JSON object that matches the schema already defined in the system instructions (summary, issues[], recommendations[], positiveAspects[]).
-- Every issue must cite the relevant file path and line numbers the formatter supplies.
-- Classify issue type realistically (bug/security/performance/maintainability/etc.). Never invent nonsense categories.
-
-## Deliverable Tone
-- Actionable, surgical, brutally honest. One sentence per bullet unless code requires a short snippet.
-- Never restate these instructions or the original code; go straight to findings.
-

package/src/prompts/promptText/languages/css/comprehensive.hbs

@@ -1,18 +0,0 @@
-## Role
-You review plain CSS (or preprocessors compiling to CSS) with an eye for resilience, performance, and clarity.
-
-## Focus Areas
-1. **Cascade discipline** – selector specificity, layering, variable scoping, inheritance leaks.
-2. **Layout** – responsive breakpoints, container queries, flex/grid misuse, overflow handling.
-3. **Performance** – expensive selectors, animations on non-composited properties, unused rules.
-4. **Accessibility** – contrast ratios, focus indicators, prefers-reduced-motion support.
-5. **Maintainability** – naming conventions, duplication, magic numbers, theme tokens.
-
-## Output Contract
-- Respond with the enforced JSON schema (summary, issues[], recommendations[], positiveAspects[]).
-- Issues must cite stylesheet path + line numbers and, when helpful, a short snippet showing the offending rule.
-- Suggested fixes should mention the exact CSS change (e.g., “replace `left/top` animation with `transform` to keep it on the compositor”).
-
-## Tone
-Succinct, blunt, actionable. Celebrate thoughtful patterns (tokens, logical properties) under `positiveAspects` so the team keeps them.
-

package/src/prompts/promptText/languages/generic/comprehensive.hbs

@@ -1,20 +0,0 @@
-## Role
-You are an experienced full-stack reviewer asked to deliver a comprehensive assessment of the provided code. Your job is to surface the highest-leverage risks, not to narrate the obvious.
-
-## What to Deliver
-1. **Correctness** – logic errors, race conditions, edge cases the author ignored.
-2. **Security & privacy** – injection, auth/z gaps, data leaks, unsafe third-party usage.
-3. **Performance** – hot-path complexity, blocking I/O, unnecessary allocations.
-4. **Maintainability** – readability, duplication, dead code, missing tests, weak observability.
-5. **Testing guidance** – when a failing/absent test would have caught the issue.
-
-## Response Contract
-- Output must be the JSON structure described in the system message (summary, issues[], recommendations[], positiveAspects[]). No prose outside the JSON.
-- Each issue needs: title, priority, type, filePath, lineNumbers, description, codeSnippet (if possible), suggestedFix, impact.
-- Keep snippets minimal but sufficient to justify the claim.
-
-## Behavioral Rules
-- Be direct, no pleasantries.
-- If the file is already solid, explicitly call out the strengths under `positiveAspects`.
-- If you cannot determine something because context is missing, say so and move on—do not guess.
-

package/src/prompts/promptText/languages/html/comprehensive.hbs

@@ -1,18 +0,0 @@
-## Role
-You are reviewing vanilla HTML templates for production reliability, accessibility, and maintainability.
-
-## Review Targets
-1. **Document structure** – semantic tags, heading hierarchy, landmark regions.
-2. **Accessibility** – ARIA usage, label/control pairing, keyboard focus order, reduced-motion fallbacks.
-3. **Security** – escaping of dynamic content, CSP readiness, referrer policy, form autofill hardening.
-4. **Performance** – critical-path resources, preload/prefetch, lazy loading, SSR hydration markers.
-5. **Maintainability** – component composition, duplication, inline styles/scripts, template partials.
-
-## Response Format
-- Emit the agreed JSON payload (summary, issues[], recommendations[], positiveAspects[]). Nothing else.
-- Every issue must cite the template path + line span and include a short snippet when it clarifies the bug.
-- Recommendations should state the exact attribute/tag/structure change, not vague advice.
-
-## Tone
-Clinical and pragmatic. Highlight blockers fast, acknowledge solid craftsmanship when deserved.
-

package/src/prompts/promptText/languages/javascript/comprehensive.hbs

@@ -1,18 +0,0 @@
-## Role
-You are a senior JavaScript reviewer focused on reliability and runtime performance in plain JS environments (DOM, Node, workers).
-
-## What to Police
-1. **Runtime safety** – null/undefined guards, prototype pollution, global namespace leaks.
-2. **Async orchestration** – promise chains vs. async/await, error bubbling, microtask starvation, timers cleanup.
-3. **State & DOM** – mutation patterns, event listener lifecycle, layout thrashing, security (XSS, CSP).
-4. **Modularity** – bundling boundaries, circular deps, ESM/CommonJS interop, dead code elimination.
-5. **Tooling** – lint/format parity, build outputs, sourcemaps, feature detection vs. UA sniffing.
-
-## Reporting Rules
-- Return the JSON structure mandated earlier. Each issue must include file path + line range + concise impact/suggested fix.
-- Keep code snippets tiny (2‑6 lines) and only when they prove the problem.
-- If something is already optimal (e.g., efficient event delegation), praise it under `positiveAspects`.
-
-## Tone
-Direct, technical, no platitudes. Show the cost of ignoring the issue (crash, exploit, perf cliff, debt).
-

package/src/prompts/promptText/languages/python/comprehensive.hbs

@@ -1,18 +0,0 @@
-## Role
-You are a Python platform reviewer. Treat every file as production-critical.
-
-## Inspection Targets
-1. **Correctness** – control flow, edge cases, exception handling, context managers.
-2. **Security** – injection vectors, unsafe deserialization, shell usage, secrets, dependency pinning.
-3. **Performance** – N+1 DB hits, eager loading, blocking operations inside async code, memory churn.
-4. **Maintainability** – adherence to idiomatic patterns, dependency inversion, logging/metrics, docstrings, typing.
-5. **Testing hooks** – unit/functional coverage gaps, fixtures, deterministic randomness.
-
-## Output Rules
-- Emit the mandated JSON object (summary, issues[], recommendations[], positiveAspects[]). No stray prose.
-- Precision matters: reference module + line numbers, include the minimal snippet, suggest a concrete fix.
-- When the code is already strong, record the win under `positiveAspects` so the team knows what to keep.
-
-## Style
-Short, blunt sentences. Call out laziness, accidental complexity, or missing safeguards immediately.
-

package/src/prompts/promptText/languages/typescript/comprehensive.hbs

@@ -1,18 +0,0 @@
-## Role
-You are a senior TypeScript architect. Assume the consuming teams expect bulletproof typings, predictable runtime behavior, and zero regressions.
-
-## Checklist
-1. **Type safety** – sound generics, discriminated unions, exhaustiveness, DTO validation, `any`/`unknown` misuse.
-2. **Runtime parity** – ensure the types describe the actual runtime contract (e.g., optional fields, narrowing, JSON payloads).
-3. **Async flow** – promise chains, error propagation, cancellation, resource cleanup.
-4. **Modularity** – separation of concerns, side-effect-free modules, tree-shakeability.
-5. **Tooling** – eslint/tsconfig alignment, path aliases, build-time assumptions.
-
-## Expectations
-- Output the JSON schema defined in the system instructions. Every issue must cite the path + line range you received.
-- Tie each finding back to the risk (bug/security/perf/etc.) and quantify impact.
-- Suggest fixes that respect TS best practices (narrowing, safe casting, type guards, proper inference).
-
-## Tone
-Relentless but constructive. No filler, no justification about missing context—flag the risk, explain why it matters, prescribe the fix.
-

package/src/runtime/auth/service.ts

@@ -1,58 +0,0 @@
-import { getActiveProxySettings } from '../proxyEnvironment';
-import type { AuthSuccess } from './types';
-
-interface AuthResponsePayload {
-  token: string;
-  user?: {
-    id?: string;
-    username?: string;
-    expires_at?: string | null;
-  };
-  expires_at?: string;
-}
-
-const DEFAULT_PROXY_BASE_URL = 'https://cr.ai.enki.si';
-
-function resolveAuthUrl(): string {
-  const base =
-    getActiveProxySettings()?.baseUrl ||
-    process.env.CR_AIA_PROXY_BASE_URL ||
-    process.env.PROXY_BASE_URL ||
-    DEFAULT_PROXY_BASE_URL;
-
-  return `${base.replace(/\/$/, '')}/auth`;
-}
-
-export async function authenticate(username: string, password: string): Promise<AuthSuccess> {
-  const url = resolveAuthUrl();
-  const response = await fetch(url, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-    },
-    body: JSON.stringify({ username, password }),
-  });
-
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(errorText || 'Authentication failed');
-  }
-
-  const payload = (await response.json()) as AuthResponsePayload;
-  if (!payload.token) {
-    throw new Error('Malformed auth response: missing token');
-  }
-
-  const usernameFromPayload = payload.user?.username;
-  const expiresAt = payload.user?.expires_at ?? payload.expires_at ?? undefined;
-
-  return {
-    token: payload.token,
-    user: {
-      id: payload.user?.id ?? usernameFromPayload ?? 'user',
-      username: usernameFromPayload ?? username,
-      expiresAt: expiresAt ?? undefined,
-    },
-  };
-}
-

package/src/runtime/auth/session.ts

@@ -1,103 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs';
-import { homedir } from 'os';
-import { join } from 'path';
-import type { SessionUser } from './types';
-
-const SESSION_DIR = join(homedir(), '.cr-aia');
-const SESSION_FILE = join(SESSION_DIR, 'session.json');
-
-interface SessionFileContents {
-  token: string;
-}
-
-function ensureSessionDir(): void {
-  if (!existsSync(SESSION_DIR)) {
-    mkdirSync(SESSION_DIR, { recursive: true });
-  }
-}
-
-export function saveSession(token: string): void {
-  ensureSessionDir();
-  const payload: SessionFileContents = { token };
-  writeFileSync(SESSION_FILE, JSON.stringify(payload, null, 2));
-  process.env.CR_AIA_PROXY_SESSION_TOKEN = token;
-}
-
-export function loadSession(): SessionUser | null {
-  if (!existsSync(SESSION_FILE)) {
-    return null;
-  }
-
-  try {
-    const raw = readFileSync(SESSION_FILE, 'utf8');
-    const { token } = JSON.parse(raw) as SessionFileContents;
-    if (!token) {
-      return null;
-    }
-    const decoded = decodeToken(token);
-    if (!decoded) {
-      return null;
-    }
-
-    if (decoded.expiresAt && Date.now() > decoded.expiresAt * 1000) {
-      clearSession();
-      return null;
-    }
-
-    return {
-      id: decoded.sub ?? 'user',
-      username: decoded.username ?? decoded.email ?? 'user',
-      expiresAt: decoded.expiresAt ? new Date(decoded.expiresAt * 1000).toISOString() : undefined,
-    };
-  } catch {
-    return null;
-  }
-}
-
-export function getSessionToken(): string | null {
-  if (!existsSync(SESSION_FILE)) {
-    return null;
-  }
-
-  try {
-    const raw = readFileSync(SESSION_FILE, 'utf8');
-    const { token } = JSON.parse(raw) as SessionFileContents;
-    return token ?? null;
-  } catch {
-    return null;
-  }
-}
-
-export function clearSession(): void {
-  if (existsSync(SESSION_FILE)) {
-    rmSync(SESSION_FILE, { force: true });
-  }
-}
-
-function decodeToken(token: string):
-  | {
-      sub?: string;
-      username?: string;
-      email?: string;
-      exp?: number;
-      expiresAt?: number;
-    }
-  | null {
-  const parts = token.split('.');
-  if (parts.length < 2) {
-    return null;
-  }
-
-  try {
-    const payload = parts[1];
-    const decoded = Buffer.from(payload, 'base64').toString('utf8');
-    const parsed = JSON.parse(decoded) as { sub?: string; username?: string; email?: string; exp?: number };
-    return {
-      ...parsed,
-      expiresAt: parsed.exp,
-    };
-  } catch {
-    return null;
-  }
-}
-

package/src/runtime/auth/types.ts

@@ -1,11 +0,0 @@
-export interface SessionUser {
-  id: string;
-  username: string;
-  expiresAt?: string;
-}
-
-export interface AuthSuccess {
-  token: string;
-  user: SessionUser;
-}
-

package/src/runtime/cliEntry.ts

@@ -1,214 +0,0 @@
-import pc from 'picocolors';
-import pkg from '../../package.json';
-import { RUNTIME_CONFIG } from './runtimeConfig';
-import { executeReview } from './reviewPipeline';
-import { ensureProxyEnvironmentInitialized } from './proxyEnvironment';
-import { preloadInkModules, getInk } from './ui/inkModules';
-import { setLogLevel, LogLevel } from '../utils/logger';
-
-interface DirectOptions {
-  model: string;
-  outDir: string;
-  debug: boolean;
-}
-
-const pkgVersion = pkg.version ?? 'unknown';
-const DEFAULT_PROXY_BASE_URL = 'https://cr.ai.enki.si';
-
-export async function handleRuntimeCliEntry(): Promise<boolean> {
-  const rawArgs = process.argv.slice(2);
-  const { cliArgs, debugFlag } = stripDebugFlag(rawArgs);
-
-  if (cliArgs.length === 0) {
-    await launchUi(debugFlag);
-    return true;
-  }
-
-  if (shouldPrintHelp(cliArgs)) {
-    printHelp();
-    return true;
-  }
-
-  if (shouldRunDirect(cliArgs)) {
-    await runDirectSafely(stripDirectArgs(cliArgs));
-    return true;
-  }
-
-  await launchUi(debugFlag);
-  return true;
-}
-
-function shouldPrintHelp(args: string[]): boolean {
-  if (args.length === 0) return false;
-  const first = args[0];
-  return first === '--help' || first === '-h';
-}
-
-function shouldRunDirect(args: string[]): boolean {
-  if (args.length === 0) return false;
-  return args[0] === 'review';
-}
-
-function stripDirectArgs(args: string[]): string[] {
-  if (args[0] === 'review') {
-    return args.slice(1);
-  }
-  return args;
-}
-
-function stripDebugFlag(args: string[]): { cliArgs: string[]; debugFlag: boolean } {
-  const cleaned: string[] = [];
-  let debugFlag = false;
-
-  for (const arg of args) {
-    if (arg === '--debug') {
-      debugFlag = true;
-      continue;
-    }
-    cleaned.push(arg);
-  }
-
-  return { cliArgs: cleaned, debugFlag };
-}
-
-async function runDirectSafely(argv: string[]): Promise<void> {
-  try {
-    const options = parseArgs(argv);
-    await runDirect(options);
-  } catch (error) {
-    console.error(pc.red('Fatal error:'), error instanceof Error ? error.message : error);
-    process.exit(1);
-  }
-}
-
-async function launchUi(debug: boolean): Promise<void> {
-  setLogLevel(LogLevel.NONE);
-  const restoreConsole = silenceConsole();
-  try {
-    ensureProxyEnvironmentInitialized(process.cwd());
-    await preloadInkModules();
-    const React = await import('react');
-    const { render } = getInk();
-    const { RuntimeApp } = await import('./ui/RuntimeApp');
-    const ink = render(React.createElement(RuntimeApp, { debug }));
-    await ink.waitUntilExit();
-  } finally {
-    restoreConsole();
-  }
-}
-
-function silenceConsole(): () => void {
-  const originalLog = console.log;
-  const originalInfo = console.info;
-  const originalWarn = console.warn;
-  const originalDebug = console.debug;
-  const noop = () => {};
-  console.log = noop;
-  console.info = noop;
-  console.warn = noop;
-  console.debug = noop;
-  return () => {
-    console.log = originalLog;
-    console.info = originalInfo;
-    console.warn = originalWarn;
-    console.debug = originalDebug;
-  };
-}
-
-function parseArgs(argv: string[]): DirectOptions {
-  const opts: DirectOptions = {
-    model: process.env.AI_CODE_REVIEW_MODEL || RUNTIME_CONFIG.DEFAULT_MODEL,
-    outDir: './reports',
-    debug: false,
-  };
-
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (!arg.startsWith('--')) continue;
-    const value = argv[i + 1];
-
-    switch (arg) {
-      case '--model':
-        if (!value) throw new Error('Missing value for --model');
-        opts.model = value;
-        i += 1;
-        break;
-      case '--out':
-        if (!value) throw new Error('Missing value for --out');
-        opts.outDir = value;
-        i += 1;
-        break;
-      case '--debug':
-        opts.debug = true;
-        break;
-      case '--help':
-      case '-h':
-        printHelp();
-        process.exit(0);
-        break;
-      default:
-        throw new Error(`Unknown option: ${arg}`);
-    }
-  }
-
-  return opts;
-}
-
-async function runDirect(options: DirectOptions): Promise<void> {
-  console.log(pc.blue('Collecting files...'));
-  const result = await executeReview({
-    model: options.model,
-    outDir: options.outDir,
-    debug: options.debug,
-    onStage: (stage, info) => {
-      switch (stage) {
-        case 'collecting':
-          if (info?.filesFound !== undefined) {
-            const uncommitted = info.uncommittedFiles ?? info.filesFound;
-            const context = info.contextFiles ?? 0;
-            const breakdown = context ? ` (${uncommitted} uncommitted + ${context} context)` : '';
-            console.log(pc.green(`✓ Found ${info.filesFound} files${breakdown}`));
-          }
-          break;
-        case 'reviewing': {
-          const context = info?.contextFiles ?? 0;
-          const base = info?.uncommittedFiles ?? info?.filesFound;
-          const suffix =
-            base || context
-              ? ` (scope: ${base ?? '?'} uncommitted${context ? ` + ${context} context` : ''})`
-              : '';
-          const defaultLine = `Running AI review${suffix ? suffix : ''}...`;
-          const detailLine =
-            typeof info?.fileIndex === 'number' &&
-            typeof info.totalFiles === 'number' &&
-            info.totalFiles > 0 &&
-            info.currentFile
-              ? `Running AI review ▸ ${info.fileIndex}/${info.totalFiles} ${info.currentFile}${suffix}`
-              : defaultLine;
-          console.log(pc.blue(detailLine));
-          break;
-        }
-        case 'merging':
-          console.log(pc.blue('Merging reports...'));
-          break;
-        default:
-          break;
-      }
-    },
-  });
-
-  console.log(pc.green(`✓ Review complete (${result.duration}s)`));
-  console.log(pc.cyan(`  Critical: ${result.totals?.critical || 0}`));
-  console.log(pc.yellow(`  High: ${result.totals?.high || 0}`));
-  console.log(pc.gray(`  Medium: ${result.totals?.medium || 0}`));
-  console.log(pc.gray(`  Low: ${result.totals?.low || 0}`));
-  if (result.reportPath) {
-    console.log(pc.green(`  Report: ${result.reportPath}`));
-  }
-}
-
-function printHelp(): void {
-  console.log(
-    `cr-aia v${pkgVersion}\n\nUsage: cr-aia review [options]\n\nOptions:\n  --model <model-id>           AI model (default: ${RUNTIME_CONFIG.DEFAULT_MODEL})\n  --out <dir>                  Output directory (default: ./reports)\n  --debug                      Enable debug logging to logs/ directory\n  --help                       Show this help message\n\nProxy:\n  Requests to OpenRouter are routed through the proxy at PROXY_BASE_URL\n  (default: ${DEFAULT_PROXY_BASE_URL}). Configure via env or .cr-aia.yml.\n  Optional: PROXY_HTTP_REFERER, PROXY_X_TITLE, PROXY_BASIC_AUTH_USER/PASSWORD.\n\nNotes:\n  This CLI runs a non-interactive review of your staged/uncommitted changes.\n  Ensure the proxy endpoint is reachable before running a review.`,
-  );
-}