Harden security + add validator, critique, chunking, caching#2

Merged

starc007 merged 29 commits into

mainfrom

feat/harden-and-improve

May 12, 2026

Commits on May 12, 2026

fix(llm): use x-goog-api-key header for Gemini

starc007
and
claude
committed
fix(llm): validate OPENAI_BASE_URL scheme and host

starc007
and
claude
committed
fix(llm): surface body-read failures in API error messages

starc007
and
claude
committed
fix(cli): remove dead --file flag from review command

starc007
and
claude
committed
fix(update): require confirmation before piping install script to sh

starc007
and
claude
committed
fix(prompt): warn when truncating diff drops files

starc007
and
claude
committed
fix(prompt): correct duplicate section comment numbering

starc007
and
claude
committed
fix(linters): canonicalize paths before matching against diff

starc007
and
claude
committed
fix(config): reject unsafe ignore-glob patterns

starc007
and
claude
committed
fix(context): cap per-file size and total files walked

starc007
and
claude
committed
fix(history): walk char boundaries when stripping line refs

starc007
and
claude
committed
fix(git): keep .git assertion when canonicalize fails

starc007
and
claude
committed
chore: drop dead code paths

starc007
and
claude
committed
feat(review): validate findings against the diff before reporting

starc007
and
claude
committed
feat(review): prefer Added lines when re-anchoring findings

starc007
and
claude
committed
feat(prompt): add grounding rules + severity rubric to system prompt

starc007
and
claude
committed
feat(review): self-critique pass to drop low-signal findings

starc007
and
claude
committed
feat(llm): Anthropic prompt caching for stable prefix

starc007
and
claude
committed
feat(review): semantic chunking for diffs over the token budget

starc007
and
claude
committed
feat(output): attach the cited source line to every accepted finding

starc007
and
claude
committed
chore(prompt): drop string-form build_review_prompt_ctx

starc007
and
claude
committed
docs: document validator, critique, chunking, prompt caching

starc007
and
claude
committed
perf(context): build a repo index once, reuse it across chunks

starc007
and
claude
committed
fix(context): disambiguate same-named functions by caller location

starc007
and
claude
committed
perf(context): distill called-function bodies before prompting

starc007
and
claude
committed
perf(prompt): filter type fields to those referenced in the diff

starc007
and
claude
committed
perf(context): tiered token budget for types / called fns / tests

starc007
and
claude
committed
perf(prompt): tighten token estimate to ~3.5 chars/token

starc007
and
claude
committed
fix: spinner Drop guard and O(1) suffix lookup in validator

starc007
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Harden security + add validator, critique, chunking, caching#2

Harden security + add validator, critique, chunking, caching#2
starc007 merged 29 commits into
mainfrom
feat/harden-and-improve

Commits on May 12, 2026

fix(llm): use x-goog-api-key header for Gemini

fix(llm): validate OPENAI_BASE_URL scheme and host

fix(llm): surface body-read failures in API error messages

fix(cli): remove dead --file flag from review command

fix(update): require confirmation before piping install script to sh

fix(prompt): warn when truncating diff drops files

fix(prompt): correct duplicate section comment numbering

fix(linters): canonicalize paths before matching against diff

fix(config): reject unsafe ignore-glob patterns

fix(context): cap per-file size and total files walked

fix(history): walk char boundaries when stripping line refs

fix(git): keep .git assertion when canonicalize fails

chore: drop dead code paths

feat(review): validate findings against the diff before reporting

feat(review): prefer Added lines when re-anchoring findings

feat(prompt): add grounding rules + severity rubric to system prompt

feat(review): self-critique pass to drop low-signal findings

feat(llm): Anthropic prompt caching for stable prefix

feat(review): semantic chunking for diffs over the token budget

feat(output): attach the cited source line to every accepted finding

chore(prompt): drop string-form build_review_prompt_ctx

docs: document validator, critique, chunking, prompt caching

perf(context): build a repo index once, reuse it across chunks

fix(context): disambiguate same-named functions by caller location

perf(context): distill called-function bodies before prompting

perf(prompt): filter type fields to those referenced in the diff

perf(context): tiered token budget for types / called fns / tests

perf(prompt): tighten token estimate to ~3.5 chars/token

fix: spinner Drop guard and O(1) suffix lookup in validator