fix(codeflow): [CI/rebase] OpenCode API Key Leaked to Child Processes

[nehraa]

Original task: task_1780281408931_wl61hi99e
PR branch: claude-lane/task_1780281408931_wl61hi99e-20260602145932
CI failure: merge-conflict
Strategy: rebase

Hint: PR has merge conflicts with main. Run: git fetch origin && git rebase origin/main && git push --force-with-lease. The watcher's open_pr_for_task will detect the existing PR.

Failure log (last 3000 chars)

X Pull request #31 is not mergeable: the merge commit cannot be cleanly created.
To have the pull request merged after all the requirements have been met, add the `--auto` flag.

Workflow

1. Read the failure log and the PR's diff (use git log origin/main..claude-lane/task_1780281408931_wl61hi99e-20260602145932)
2. Apply the fix on top of the SAME branch (claude-lane/task_1780281408931_wl61hi99e-20260602145932) — the worktree is already set up by the dispatcher
3. Commit with fix(ci): <one-line summary> (single line)
4. The dispatcher will push your commit to the SAME branch and detect the existing PR
5. The PR's CI re-runs automatically. Watcher picks it up on the next 5-min cycle.
6. Report: files changed, commit SHA, what the fix was

---

Automated by DevPulse dispatcher.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 654c96bf-5437-433c-af17-1d2ad21026fa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Prevent OpenCode API keys from leaking to child processes

🐞 Bug fix ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Writes OpenCode provider keys to owner-only temporary files before spawning.
• Passes key-file paths instead of raw credentials through provider environment variables.
• Rebases the fix with extensive unrelated monorepo history and generated artifacts.

Diagram

graph TD
  Settings["OpenCode Settings"] --> Mapper["Config Mapper"] --> KeyFile[("Protected Key File")]
  Mapper --> SpawnEnv["Spawn Environment"] --> Child["OpenCode Process"]
  Server["Server Manager"] --> SpawnEnv

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rebuild as a minimal security PR

• ➕ Makes the credential-handling change independently reviewable
• ➕ Avoids merging unrelated generated files and historical work
• ➕ Simplifies validation and rollback
• ➖ Requires rebasing or cherry-picking the intended fix onto a clean branch

2. Use a supported file-secret mechanism

• ➕ Keeps credentials out of process environment listings
• ➕ Preserves compatibility when OpenCode supports a dedicated file or credential descriptor
• ➖ Requires explicit OpenCode support for file-path environment variables
• ➖ Requires secure cleanup and lifecycle management

3. Use tightly scoped provider environment variables

• ➕ Matches conventional provider SDK expectations
• ➕ Avoids temporary-file lifecycle and compatibility problems
• ➖ The secret remains visible in the OpenCode process environment
• ➖ Requires ensuring unrelated descendants never inherit the environment

Recommendation: Recreate this as a minimal PR on current main before merging. The current file-path approach is only valid if OpenCode explicitly interprets provider variables as file paths; otherwise it breaks authentication. Additionally, OPENCODE_CONFIG_CONTENT serializes the full configuration, including apiKey, back into the child environment and therefore defeats the intended protection. Remove or sanitize that value, securely delete temporary credentials, add focused spawn-environment tests, remove the committed .env, and rotate every exposed credential.

Files changed (22) +2690 / -10

Enhancement (11) +1736 / -0

types.tsDefines OpenCode configuration and lifecycle types +162/-0

Defines OpenCode configuration and lifecycle types

• Introduces provider metadata, server status, configuration, session, permission, and related OpenCode contracts used by the security-sensitive startup path.

src/lib/opencode/types.ts

client.tsAdds the OpenCode HTTP client +229/-0

Adds the OpenCode HTTP client

• Implements session creation, request handling, health checks, and API interactions with a running OpenCode server.

src/lib/opencode/client.ts

agent.tsAdds OpenCode agent orchestration +289/-0

Adds OpenCode agent orchestration

• Implements agent execution and provider-aware environment handling for OpenCode-backed tasks.

src/lib/opencode/agent.ts

opencode-settings.tsxAdds OpenCode settings interface +666/-0

Adds OpenCode settings interface

• Provides the UI for selecting providers, entering credentials, configuring models, and controlling the OpenCode integration.

src/components/opencode-settings.tsx

route.tsAdds OpenCode startup endpoint +45/-0

Adds OpenCode startup endpoint

• Introduces an API route that accepts configuration and starts the managed OpenCode server.

src/app/api/opencode/start/route.ts

route.tsAdds OpenCode restart endpoint +45/-0

Adds OpenCode restart endpoint

• Introduces an API route for restarting the OpenCode process with updated configuration.

src/app/api/opencode/restart/route.ts

route.tsAdds OpenCode shutdown endpoint +14/-0

Adds OpenCode shutdown endpoint

• Introduces an API route for stopping the managed OpenCode process.

src/app/api/opencode/stop/route.ts

route.tsAdds OpenCode status endpoint +14/-0

Adds OpenCode status endpoint

• Exposes the current managed OpenCode server status to clients.

src/app/api/opencode/status/route.ts

opencode-client.tsAdds reusable OpenCode generation client +139/-0

Adds reusable OpenCode generation client

• Implements session caching and message submission for package consumers using an OpenCode HTTP server.

packages/codeflow-agent/src/ai/opencode-client.ts

opencode-client.jsBuilds the OpenCode generation client +104/-0

Builds the OpenCode generation client

• Adds the compiled JavaScript artifact corresponding to the package-level OpenCode HTTP client.

packages/codeflow-agent/dist/ai/opencode-client.js

opencode-client.d.tsPublishes OpenCode client declarations +29/-0

Publishes OpenCode client declarations

• Adds generated TypeScript declarations for OpenCode client options, providers, and results.

packages/codeflow-agent/dist/ai/opencode-client.d.ts

Bug fix (2) +560 / -0

config.tsMoves provider keys into restricted temporary files +161/-0

Moves provider keys into restricted temporary files

• Changes 'configToEnv' to write API keys under an unpredictable temporary directory with mode 0600 and return the file path as the provider environment value. It also provides OpenCode configuration validation and browser persistence helpers.

src/lib/opencode/config.ts

server.tsAdds OpenCode server process management +399/-0

Adds OpenCode server process management

• Builds the spawn environment using 'configToEnv' and manages server startup, health checks, status notifications, restart, and shutdown. The full configuration is also serialized into 'OPENCODE_CONFIG_CONTENT', which currently includes the raw API key.

src/lib/opencode/server.ts

Tests (2) +158 / -0

config.test.tsTests OpenCode configuration behavior +136/-0

Tests OpenCode configuration behavior

• Covers provider detection, configuration construction, validation, and browser storage. It does not verify key-file permissions, raw-key exclusion, cleanup, or child-process environment sanitization.

src/lib/opencode/config.test.ts

server.test.tsTests default OpenCode server status +22/-0

Tests default OpenCode server status

• Verifies the singleton server reports a valid stopped status before startup. Spawned environment contents and credential isolation are not covered.

src/lib/opencode/server.test.ts

Documentation (1) +74 / -3

README.mdExpands Codeflow setup and feature documentation +74/-3

Expands Codeflow setup and feature documentation

• Documents the broader Codeflow platform, package capabilities, and development workflows introduced by the rebased history.

README.md

Other (6) +162 / -7

.envAdds development credentials to source control +3/-0

Adds development credentials to source control

• Adds Gemini and NVIDIA API credentials plus the development environment setting. These credentials are exposed by the diff and must be removed and rotated before merge.

.env

.gitignoreExpands generated workspace exclusions +17/-0

Expands generated workspace exclusions

• Ignores Codeflow test stores, CodeRAG indexes, agent working directories, Serena metadata, Qwen files, and worktrees. It does not ignore the root '.env' file included in this PR.

.gitignore

codeql.ymlAdds CodeQL security analysis workflow +99/-0

Adds CodeQL security analysis workflow

• Introduces GitHub CodeQL initialization, build, and analysis jobs for repository security scanning.

.github/workflows/codeql.yml

package.jsonExpands application scripts and dependencies +29/-4

Expands application scripts and dependencies

• Adds dependencies and scripts required by the broader IDE, OpenCode, analysis, execution, and package workspace changes.

package.json

pnpm-workspace.yamlDefines the package workspace +2/-0

Defines the package workspace

• Configures the repository package directories for pnpm workspace resolution.

pnpm-workspace.yaml

tsconfig.jsonUpdates root TypeScript configuration +12/-3

Updates root TypeScript configuration

• Adjusts compiler settings and project coverage for the expanded application and package structure.

tsconfig.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (15) 📘 Rule violations (0) 📜 Skill insights (0)

1. Committed credentials expose providers 🐞 Bug ⛨ Security

Description

The new .env file contains literal Gemini and NVIDIA API credentials instead of placeholders or
environment references. Anyone with repository or artifact access can use them until they are
revoked, even after the file is removed from the branch because Git retains its history.

Code

.env[R1-2]

+GEMINI_API_KEY=AIza*********************************tg
+NVIDIA_API_KEY=nvap****************************************************************sF

Evidence

The added root .env file directly contains complete credential values for two providers, while the
ignore rules cover only .env.local and .env*.local; consequently, the sensitive root file
remains tracked.

.env[1-2]
.gitignore[9-17]
.env[1-3]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR commits live-looking Gemini and NVIDIA credentials in `.env`, exposing them through repository history and derived artifacts.

## Fix Focus Areas
- .env[1-2]
- .gitignore[9-17]

## Recommended Fix
Remove `.env` from version control, add the root `.env` file to `.gitignore`, and provide a tracked `.env.example` containing only empty, non-secret placeholders. Immediately revoke and rotate both exposed credentials.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. The child still receives the secret 🐞 Bug ⛨ Security

Description

OpencodeServer.start serializes the complete OpencodeConfig, including apiKey, into
OPENCODE_CONFIG_CONTENT after configToEnv writes the credential to a protected file. Whenever a
keyed provider starts, every OpenCode child and descendant process can read the raw key from its
inherited environment, defeating the file-based protection.

Code

src/lib/opencode/server.ts[R41-45]

+      const env = {
+        ...process.env,
+        ...configToEnv(config),
+        OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
+      };

Evidence

OpencodeConfig includes apiKey, and the launch environment explicitly stringifies the complete
configuration into OPENCODE_CONFIG_CONTENT. The adjacent configuration helper both documents and
implements a protected file-based mechanism specifically intended to ensure API keys are never
placed in environment variables, so these citations directly show that the launch path violates that
security contract.

src/lib/opencode/server.ts[41-45]
src/lib/opencode/types.ts[19-27]
src/lib/opencode/config.ts[57-63]
src/lib/opencode/config.ts[55-79]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The complete OpenCode configuration is serialized into the spawned process environment, exposing the API key despite the separate protected key-file mechanism.

## Fix Focus Areas
- src/lib/opencode/server.ts[41-45]
- src/lib/opencode/config.ts[57-90]
- src/lib/opencode/types.ts[19-27]

## Recommended Fix
Construct `OPENCODE_CONFIG_CONTENT` from a sanitized configuration object with `apiKey` removed, or remove that environment variable entirely if the OpenCode child does not require it. Keep only the protected key-file reference in the child environment, and add a test that inspects the spawn environment and verifies that the raw key appears in no environment value.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Provider authentication always fails 🐞 Bug ≡ Correctness

Description

configToEnv assigns the temporary file pathname to provider variables that are defined as API-key
environment variables. Because the spawned command receives that environment unchanged and no
wrapper reads the file, providers receive a pathname in place of the credential whenever an API key
is configured.

Code

src/lib/opencode/config.ts[R76-79]

+    // Belt-and-suspenders: explicitly chmod in case the umask interfered
+    // with the mode option (writeFileSync's mode is masked by process.umask).
+    chmodSync(keyFile, 0o600);
+    env[providerConfig.apiKeyEnvVar] = keyFile;

Evidence

Provider metadata names variables such as ANTHROPIC_API_KEY and OPENAI_API_KEY, but
configToEnv stores keyFile in those variables and the server passes them directly to spawn.

src/lib/opencode/config.ts[69-79]
src/lib/opencode/types.ts[80-90]
src/lib/opencode/server.ts[61-64]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The OpenCode process receives a temporary file path where its provider integration expects an API-key value, breaking authenticated provider requests.

## Fix Focus Areas
- src/lib/opencode/config.ts[65-90]
- src/lib/opencode/server.ts[61-64]
- src/lib/opencode/types.ts[80-110]

## Recommended Fix
Use a secret-file option that OpenCode explicitly consumes, or launch a controlled wrapper that reads the protected file and supplies the credential only to OpenCode without propagating it to descendants. Add an integration test proving a configured provider receives the actual credential semantics rather than a pathname.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

View high (8)

4. Stopped servers leave secrets on disk 🐞 Bug ⛨ Security

Description

configToEnv creates a new temporary directory and plaintext api_key file for every keyed start
without returning or recording its location for cleanup. Normal stops, restarts, spawn errors, and
startup timeouts consequently leave credentials in the system temporary directory indefinitely.

Code

src/lib/opencode/config.ts[R73-75]

+    const dir = mkdtempSync(join(tmpdir(), "codeflow-opencode-"));
+    const keyFile = join(dir, "api_key");
+    writeFileSync(keyFile, config.apiKey, { mode: 0o600 });

Evidence

The configuration helper creates a unique credential file on every call, while all server shutdown
and failure paths only clear process state and contain no filesystem cleanup.

src/lib/opencode/config.ts[69-79]
src/lib/opencode/server.ts[80-117]
src/lib/opencode/server.ts[296-313]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Temporary files containing provider credentials are never deleted after the OpenCode process stops or fails to start.

## Fix Focus Areas
- src/lib/opencode/config.ts[69-79]
- src/lib/opencode/server.ts[80-117]

## Recommended Fix
Return a cleanup handle with the generated environment, retain it for the process lifetime, and remove both the key file and temporary directory from stop, exit, error, and failed-start paths using idempotent cleanup.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

5. Callers can access host files 🐞 Bug ⛨ Security

Description

The file handlers accept x-codeflow-repo-path as the repository root and pass that
caller-controlled value to validateFilePath, which checks requested paths only for containment
beneath the selected directory rather than a server-owned workspace. An unauthenticated caller can
supply / or another accessible absolute host directory to list directories, read allowed file
types, and create or replace writable files outside the actual project.

Code

src/app/api/files/get/route.ts[R21-24]

+export async function GET(request: Request): Promise<Response> {
+  try {
+    const url = new URL(request.url);
+    const filePathParam = url.searchParams.get("path");

Evidence

The read, write, and list handlers derive repoRoot directly from the request header, while
validateFilePath evaluates containment relative to that supplied root rather than a fixed,
trusted, server-configured workspace; together, these citations show that the caller selects the
filesystem boundary used to authorize file operations.

src/app/api/files/get/route.ts[21-37]
src/app/api/files/list/route.ts[34-46]
src/app/api/files/post/route.ts[55-73]
src/lib/file-security.ts[200-229]
src/app/api/files/get/route.ts[24-44]
src/app/api/files/post/route.ts[57-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A request header controls the filesystem trust root used for path validation, allowing callers to redirect file operations to arbitrary accessible host directories.

## Fix Focus Areas
- src/app/api/files/get/route.ts[21-37]
- src/app/api/files/list/route.ts[34-47]
- src/app/api/files/post/route.ts[55-73]
- src/lib/file-security.ts[200-229]

## Recommended Fix
Remove the client-controlled absolute root header and derive the repository root from trusted server-side session or deployment configuration. If multiple workspaces are supported, accept an opaque authenticated project or workspace identifier, authorize the caller for it, and resolve it against a server-maintained registry or allowlist. Canonicalize the configured root once and reject any root or requested path outside the registered workspace.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

6. Symlinks escape file protections 🐞 Bug ⛨ Security

Description

validateFilePath performs only lexical containment, while the read route never applies the
available realpath check and the write route validates only the parent before opening the unresolved
target path. When an existing in-repository file is a symlink, reads and writes follow it to access
or modify a target outside the repository.

Code

src/app/api/files/get/route.ts[R35-37]

+    let validatedPath: string;
+    try {
+      validatedPath = validateFilePath(filePathParam, repoRoot);

Evidence

The security module defines a separate realpath-based containment helper, showing that
validateFilePath alone is only lexical; however, GET proceeds directly from lexical validation to
reading, while POST invokes the realpath helper only for the parent directory and then writes
through the unchecked final path.

src/lib/file-security.ts[200-229]
src/lib/file-security.ts[243-279]
src/app/api/files/get/route.ts[35-80]
src/app/api/files/post/route.ts[73-107]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Read and write operations can follow an existing repository symlink at the requested file path to access or modify files outside the permitted workspace.

## Fix Focus Areas
- src/app/api/files/get/route.ts[35-80]
- src/app/api/files/post/route.ts[73-107]
- src/lib/file-security.ts[243-279]

## Recommended Fix
Resolve and validate the canonical target against the trusted repository root immediately before every read. For writes, retain the parent-directory realpath check for newly created files; when the target already exists, resolve and validate its real path, reject symlink targets that escape the repository, and use no-follow, exclusive-safe file-opening semantics where available.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

7. Callers can reach internal services 🐞 Bug ⛨ Security

Description

The MCP proxy's address filter explicitly permits localhost destinations and both routes invoke
caller-selected servers without an authentication check. A remote caller can therefore make the
application contact local or otherwise protected MCP services and forward caller-selected
authorization headers from the server's network position.

Code

src/app/api/mcp/invoke/route.ts[R26-31]

+  // Block SSRF by validating hostname
+  const hostname = url.hostname.toLowerCase();
+
+  // Allow localhost and loopback addresses
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") {
+    return url.toString();

Evidence

Both handlers explicitly exempt loopback hosts from address rejection, accept and forward
authorization headers, and call the configured URL without any caller authorization.

src/app/api/mcp/invoke/route.ts[26-31]
src/app/api/mcp/invoke/route.ts[79-115]
src/app/api/mcp/tools/route.ts[23-28]
src/app/api/mcp/tools/route.ts[62-97]
packages/codeflow-mcp/src/index.ts[35-46]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Unauthenticated proxy requests may target localhost and carry arbitrary credentials, exposing services reachable from the application host.

## Fix Focus Areas
- src/app/api/mcp/invoke/route.ts[26-31]
- src/app/api/mcp/invoke/route.ts[79-115]
- src/app/api/mcp/tools/route.ts[23-28]
- src/app/api/mcp/tools/route.ts[62-97]

## Recommended Fix
Require authenticated project authorization and resolve MCP servers from a server-managed allowlist rather than arbitrary URLs. Reject loopback, private, link-local, metadata, and non-public resolved addresses after every DNS resolution and redirect, and do not forward arbitrary credential headers.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

8. Approval IDs escape their directory 🐞 Bug ⛨ Security

Description

getApprovalPath interpolates an arbitrary approvalId into a path without rejecting separators or
traversal segments. The unauthenticated approval route accepts any non-empty identifier, so ../
values can make approveRecord read and overwrite accessible JSON files outside the approvals
directory.

Code

src/lib/blueprint/store-paths.ts[R32-33]

+export const approvalPath = (approvalId: string): string =>
+  path.join(getStoreRoot(), "approvals", `${approvalId}.json`);

Evidence

The route validates only minimum string length, the path helper joins the raw identifier with the
store directory, and approveRecord reads and writes the resulting path.

src/app/api/approvals/approve/route.ts[8-10]
src/lib/blueprint/store-paths.ts[32-33]
src/lib/blueprint/approval-store.ts[49-70]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Caller-controlled approval identifiers can traverse outside the approval store and overwrite unrelated JSON files.

## Fix Focus Areas
- src/lib/blueprint/store-paths.ts[32-33]
- src/app/api/approvals/approve/route.ts[8-10]
- src/lib/blueprint/approval-store.ts[49-70]

## Recommended Fix
Accept only canonical generated identifiers using a strict allowlist such as UUID validation, reject all path separators and traversal segments, and verify the resolved approval path remains under the canonical approvals directory before any read or write.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

9. Visitors can remotely run shell commands 🐞 Bug ⛨ Security

Description

The terminal endpoints create sessions from a caller-controlled working-directory header and forward
arbitrary caller-provided input directly to the spawned shell without authenticating the request,
authorizing project access, or enforcing a trusted workspace boundary. Any client that can reach the
application can create or enumerate sessions, execute commands under the application account in an
accessible directory, retrieve output, and access session lookup or deletion operations without an
ownership check.

Code

src/app/api/terminal/sessions/[sessionId]/route.ts[R44-47]

+    const payload = terminalInputSchema.parse(await request.json());
+    const session = await writeTerminalInput(sessionId, payload.input, {
+      echoInput: payload.echoInput
+    });

Evidence

The cited handlers create and enumerate terminal sessions without an access check, pass the request
header through as the session cwd, and parse arbitrary per-session POST input before forwarding it
to the terminal-session writer. The underlying implementation spawns a shell in that directory,
writes the supplied input to the child process stdin, and retains output for retrieval,
demonstrating that exposed HTTP requests directly control a server-side shell.

src/app/api/terminal/sessions/route.ts[20-31]
src/app/api/terminal/sessions/[sessionId]/route.ts[34-49]
src/lib/server/terminal-sessions.ts[84-147]
src/lib/server/terminal-sessions.ts[190-217]
src/app/api/terminal/sessions/route.ts[14-40]
src/app/api/terminal/sessions/[sessionId]/route.ts[17-59]
src/lib/server/terminal-sessions.ts[190-220]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The terminal HTTP API exposes interactive server-side shell creation, enumeration, lookup, input, output retrieval, and deletion without authentication, project authorization, session ownership enforcement, or workspace confinement.

## Fix Focus Areas
- src/app/api/terminal/sessions/route.ts[14-40]
- src/app/api/terminal/sessions/[sessionId]/route.ts[34-59]
- src/lib/server/terminal-sessions.ts[84-147]

## Recommended Fix
Require authenticated project authorization for every terminal operation, including session creation, enumeration, lookup, input, output retrieval, and deletion. Bind each session to its owner and a server-authorized workspace, restrict working directories to an approved workspace root instead of accepting arbitrary `cwd` values from a request header, and disable the API entirely unless an explicit secure-development mode is enabled.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

10. Exports can write files outside the target 🐞 Bug ⛨ Security

Description

getNodeDocPath interpolates an unrestricted blueprint node ID into a relative documentation path,
and export joins that value to the output directory before writing it. A graph containing an ID with
parent-directory segments therefore makes the documentation write escape the requested export
directory.

Code

src/lib/blueprint/codegen.ts[39]

+export const getNodeDocPath = (node: BlueprintNode): string => `docs/${node.id}.md`;

Evidence

Node IDs are accepted as unrestricted strings, then used in docs/${node.id}.md; the export layer
joins and writes this generated relative path without a post-resolution containment check.

src/lib/blueprint/codegen.ts[39-39]
src/lib/blueprint/export.ts[370-372]
src/lib/blueprint/schema.ts[161-164]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
A blueprint node ID is used directly as a documentation filename, permitting parent-directory traversal during export.
Fix Focus Areas
- src/lib/blueprint/codegen.ts[39-39]
- src/lib/blueprint/export.ts[370-372]
- src/lib/blueprint/schema.ts[161-164]
Recommended Fix
Generate documentation filenames from a safe slug or a strict identifier encoding rather than the raw node ID. Also resolve and validate every export destination against `baseDir` before writing.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

11. Blueprint code can access server credentials 🐞 Bug ⛨ Security

Description

Runtime workspaces write caller-supplied codeDrafts and execute the generated module in a child
Node process whose environment spreads process.env. Submitted blueprint code can consequently read
deployment secrets and provider credentials through process.env during execution.

Code

src/lib/blueprint/runtime-workspace.ts[R205-215]

+      const runResult = await runCommand(process.execPath, [RUNTIME_HARNESS_PATH], {
+        cwd: workspaceDir,
+        timeoutMs: 20_000,
+        stdoutMaxBytes: 64 * 1024,
+        stderrMaxBytes: 128 * 1024,
+        env: {
+          ...process.env,
+          NO_COLOR: "1",
+          CODEFLOW_RUNTIME_PAYLOAD: JSON.stringify(payload),
+          CODEFLOW_RUNTIME_RESULT_PATH: resultPath
+        }

Evidence

The execution route accepts a runtime request, the workspace writes supplied drafts, and
runCommand launches the harness with an environment created by spreading the server environment.

src/app/api/executions/run/route.ts[9-15]
src/lib/blueprint/runtime-workspace.ts[189-215]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
Submitted blueprint code executes in a child process that inherits all environment variables from the CodeFlow server.
Fix Focus Areas
- src/lib/blueprint/runtime-workspace.ts[191-215]
- src/app/api/executions/run/route.ts[9-15]
Recommended Fix
Replace the `process.env` spread with an explicit environment allowlist containing only runtime variables that the harness needs. Ensure secrets, cloud credentials, API keys, and application configuration are never inherited by executable drafts.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

12. Concurrent updates discard session data 🐞 Bug ☼ Reliability

Description

upsertSession performs an unlocked read-modify-write against the shared latest session file and
writes it by truncating the destination directly. Concurrent execution and observability requests
can read the same snapshot and then overwrite each other, losing graph, report, or approval updates
while readers may also observe partial JSON.

Code

src/lib/blueprint/session-store.ts[R62-65]

+  const existing = await loadLatestSession(graph.projectName);
+  const normalizedGraph = persistedSessionSchema.shape.graph.parse(graph);
+  const nextSession = persistedSessionSchema.parse({
+    sessionId: sessionId ?? existing?.sessionId ?? createSessionId(),

Evidence

The implementation loads the current snapshot, derives a replacement, and writes later without
locking; execution and observability endpoints independently update the same project session through
this path.

src/lib/blueprint/session-store.ts[20-23]
src/lib/blueprint/session-store.ts[62-79]
src/app/api/observability/ingest/route.ts[11-31]
src/app/api/executions/run/route.ts[11-20]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Concurrent session upserts race through an unlocked read-modify-write sequence and can discard completed updates or expose partial files.

## Fix Focus Areas
- src/lib/blueprint/session-store.ts[20-23]
- src/lib/blueprint/session-store.ts[62-79]
- src/app/api/observability/ingest/route.ts[11-31]
- src/app/api/executions/run/route.ts[11-20]

## Recommended Fix
Serialize updates per project with a lock or transactional storage operation, reload the latest state while holding that lock, and persist through a temporary file followed by an atomic rename. Add a concurrent-update test proving fields from both requests survive.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

13. Configured OpenCode integrations never start 🐞 Bug ≡ Correctness

Description

The settings component builds a configuration containing MCP servers, skills, and hooks, but passes
only provider, key, model, and base URL to startServer. The start route reconstructs the server
configuration from that reduced payload, so the saved advanced integrations are silently omitted
from the running process.

Code

src/components/opencode-settings.tsx[R145-150]

+      const info = await startServer({
+        provider,
+        apiKey,
+        model: model || undefined,
+        baseUrl: baseUrl || undefined,
+      });

Evidence

The complete configuration is built with the advanced fields, but the immediately following start
request omits them, and the route schema has no fields through which they could reach the server.

src/components/opencode-settings.tsx[127-150]
src/lib/opencode/client.ts[26-35]
src/app/api/opencode/start/route.ts[7-27]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
The OpenCode settings UI collects advanced configuration but omits it from the server-start request.
Fix Focus Areas
- src/components/opencode-settings.tsx[127-150]
- src/lib/opencode/client.ts[26-35]
- src/app/api/opencode/start/route.ts[7-27]
Recommended Fix
Add typed `mcpServers`, `skills`, and `hooks` fields to the client request and route schema, then pass them to `buildOpencodeConfig`. Add an integration test asserting that these configured values reach the started server configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

14. Local model users cannot start OpenCode 🐞 Bug ≡ Correctness

Description

The settings Start button is disabled whenever apiKey is empty, despite the local provider being
configured without an API-key variable. A valid local-provider configuration with its required base
URL therefore cannot be started from the supplied interface.

Code

src/components/opencode-settings.tsx[R369-373]

+        {serverStatus.status === "stopped" || serverStatus.status === "error" ? (
+          <button
+            onClick={handleStartServer}
+            disabled={isLoading || !apiKey}
+            type="button"

Evidence

The button condition requires a key, whereas the provider configuration has no key environment
variable and validation explicitly permits an empty key for local.

src/components/opencode-settings.tsx[369-373]
src/lib/opencode/types.ts[155-161]
src/lib/opencode/config.ts[145-160]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
The OpenCode settings UI requires an API key for every provider, including the keyless local provider.
Fix Focus Areas
- src/components/opencode-settings.tsx[369-373]
- src/lib/opencode/types.ts[155-161]
- src/lib/opencode/config.ts[145-160]
Recommended Fix
Base the Start button enablement on `validateConfig` or explicitly exempt the local provider from the API-key requirement while retaining its base-URL validation.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

View medium (1)

15. Failed tasks abort dependents as cycles 🐞 Bug ☼ Reliability

Description

TaskQueue.getReadyTasks requires every dependency to have completed status, while a failed task
is marked failed. Its dependent remains pending, after which executeWithQueue throws a
circular-dependency error even though the graph is acyclic and the actual failure was already known.

Code

packages/codeflow-agent/src/agent/agent-spawner.ts[R114-117]

+      if (readyTasks.length === 0) {
+        const pending = queue.getPendingCount();
+        if (pending > 0) {
+          throw new Error('Circular dependency detected - no ready tasks but pending tasks exist');

Evidence

Dependency readiness accepts only completed; failed execution sets status to failed; and the
spawner treats a nonempty pending set without ready tasks as a cycle.

packages/codeflow-agent/src/agent/task-queue.ts[21-39]
packages/codeflow-agent/src/agent/task-queue.ts[50-65]
packages/codeflow-agent/src/agent/agent-spawner.ts[111-119]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
Agent task dependents of a failed task remain pending and are reported as a circular dependency.
Fix Focus Areas
- packages/codeflow-agent/src/agent/task-queue.ts[21-39]
- packages/codeflow-agent/src/agent/task-queue.ts[50-65]
- packages/codeflow-agent/src/agent/agent-spawner.ts[111-119]
Recommended Fix
Detect failed dependencies and mark dependent tasks blocked or skipped with the prerequisite failure recorded. Reserve the circular-dependency error for a verified cycle among pending tasks, and return the partial result set for ordinary task failures.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

Review mode: 🧠 Deep: This is an exceptionally dense, cross-cutting change spanning 1,349 files and 1,457 edit sites, including security-sensitive OpenCode process/environment handling, APIs, execution, and generated artifacts, making multiple independent defects especially likely.

Tip of the day

💡 Did you know, you can ask Qodo to dismiss a finding you disagree with, with your reason on record

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Committed credentials expose providers 🐞 Bug ⛨ Security

The new .env file contains literal Gemini and NVIDIA API credentials instead of placeholders or
environment references. Anyone with repository or artifact access can use them until they are
revoked, even after the file is removed from the branch because Git retains its history.

Agent Prompt

## Issue description
The PR commits live-looking Gemini and NVIDIA credentials in `.env`, exposing them through repository history and derived artifacts.

## Fix Focus Areas
- .env[1-2]
- .gitignore[9-17]

## Recommended Fix
Remove `.env` from version control, add the root `.env` file to `.gitignore`, and provide a tracked `.env.example` containing only empty, non-secret placeholders. Immediately revoke and rotate both exposed credentials.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

2. The child still receives the secret 🐞 Bug ⛨ Security

OpencodeServer.start serializes the complete OpencodeConfig, including apiKey, into
OPENCODE_CONFIG_CONTENT after configToEnv writes the credential to a protected file. Whenever a
keyed provider starts, every OpenCode child and descendant process can read the raw key from its
inherited environment, defeating the file-based protection.

Agent Prompt

## Issue description
The complete OpenCode configuration is serialized into the spawned process environment, exposing the API key despite the separate protected key-file mechanism.

## Fix Focus Areas
- src/lib/opencode/server.ts[41-45]
- src/lib/opencode/config.ts[57-90]
- src/lib/opencode/types.ts[19-27]

## Recommended Fix
Construct `OPENCODE_CONFIG_CONTENT` from a sanitized configuration object with `apiKey` removed, or remove that environment variable entirely if the OpenCode child does not require it. Keep only the protected key-file reference in the child environment, and add a test that inspects the spawn environment and verifies that the raw key appears in no environment value.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

3. Provider authentication always fails 🐞 Bug ≡ Correctness

configToEnv assigns the temporary file pathname to provider variables that are defined as API-key
environment variables. Because the spawned command receives that environment unchanged and no
wrapper reads the file, providers receive a pathname in place of the credential whenever an API key
is configured.

Agent Prompt

## Issue description
The OpenCode process receives a temporary file path where its provider integration expects an API-key value, breaking authenticated provider requests.

## Fix Focus Areas
- src/lib/opencode/config.ts[65-90]
- src/lib/opencode/server.ts[61-64]
- src/lib/opencode/types.ts[80-110]

## Recommended Fix
Use a secret-file option that OpenCode explicitly consumes, or launch a controlled wrapper that reads the protected file and supplies the credential only to OpenCode without propagating it to descendants. Add an integration test proving a configured provider receives the actual credential semantics rather than a pathname.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

4. Stopped servers leave secrets on disk 🐞 Bug ⛨ Security

configToEnv creates a new temporary directory and plaintext api_key file for every keyed start
without returning or recording its location for cleanup. Normal stops, restarts, spawn errors, and
startup timeouts consequently leave credentials in the system temporary directory indefinitely.

Agent Prompt

## Issue description
Temporary files containing provider credentials are never deleted after the OpenCode process stops or fails to start.

## Fix Focus Areas
- src/lib/opencode/config.ts[69-79]
- src/lib/opencode/server.ts[80-117]

## Recommended Fix
Return a cleanup handle with the generated environment, retain it for the process lifetime, and remove both the key file and temporary directory from stop, exit, error, and failed-start paths using idempotent cleanup.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

5. Callers can access host files 🐞 Bug ⛨ Security

The file handlers accept x-codeflow-repo-path as the repository root and pass that
caller-controlled value to validateFilePath, which checks requested paths only for containment
beneath the selected directory rather than a server-owned workspace. An unauthenticated caller can
supply / or another accessible absolute host directory to list directories, read allowed file
types, and create or replace writable files outside the actual project.

Agent Prompt

## Issue description
A request header controls the filesystem trust root used for path validation, allowing callers to redirect file operations to arbitrary accessible host directories.

## Fix Focus Areas
- src/app/api/files/get/route.ts[21-37]
- src/app/api/files/list/route.ts[34-47]
- src/app/api/files/post/route.ts[55-73]
- src/lib/file-security.ts[200-229]

## Recommended Fix
Remove the client-controlled absolute root header and derive the repository root from trusted server-side session or deployment configuration. If multiple workspaces are supported, accept an opaque authenticated project or workspace identifier, authorize the caller for it, and resolve it against a server-maintained registry or allowlist. Canonicalize the configured root once and reject any root or requested path outside the registered workspace.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

10. Exports can write files outside the target 🐞 Bug ⛨ Security

getNodeDocPath interpolates an unrestricted blueprint node ID into a relative documentation path,
and export joins that value to the output directory before writing it. A graph containing an ID with
parent-directory segments therefore makes the documentation write escape the requested export
directory.

Agent Prompt

Issue description
A blueprint node ID is used directly as a documentation filename, permitting parent-directory traversal during export.
Fix Focus Areas
- src/lib/blueprint/codegen.ts[39-39]
- src/lib/blueprint/export.ts[370-372]
- src/lib/blueprint/schema.ts[161-164]
Recommended Fix
Generate documentation filenames from a safe slug or a strict identifier encoding rather than the raw node ID. Also resolve and validate every export destination against `baseDir` before writing.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

11. Blueprint code can access server credentials 🐞 Bug ⛨ Security

Runtime workspaces write caller-supplied codeDrafts and execute the generated module in a child
Node process whose environment spreads process.env. Submitted blueprint code can consequently read
deployment secrets and provider credentials through process.env during execution.

Agent Prompt

Issue description
Submitted blueprint code executes in a child process that inherits all environment variables from the CodeFlow server.
Fix Focus Areas
- src/lib/blueprint/runtime-workspace.ts[191-215]
- src/app/api/executions/run/route.ts[9-15]
Recommended Fix
Replace the `process.env` spread with an explicit environment allowlist containing only runtime variables that the harness needs. Ensure secrets, cloud credentials, API keys, and application configuration are never inherited by executable drafts.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

13. Configured opencode integrations never start 🐞 Bug ≡ Correctness

The settings component builds a configuration containing MCP servers, skills, and hooks, but passes
only provider, key, model, and base URL to startServer. The start route reconstructs the server
configuration from that reduced payload, so the saved advanced integrations are silently omitted
from the running process.

Agent Prompt

Issue description
The OpenCode settings UI collects advanced configuration but omits it from the server-start request.
Fix Focus Areas
- src/components/opencode-settings.tsx[127-150]
- src/lib/opencode/client.ts[26-35]
- src/app/api/opencode/start/route.ts[7-27]
Recommended Fix
Add typed `mcpServers`, `skills`, and `hooks` fields to the client request and route schema, then pass them to `buildOpencodeConfig`. Add an integration test asserting that these configured values reach the started server configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

14. Local model users cannot start opencode 🐞 Bug ≡ Correctness

The settings Start button is disabled whenever apiKey is empty, despite the local provider being
configured without an API-key variable. A valid local-provider configuration with its required base
URL therefore cannot be started from the supplied interface.

Agent Prompt

Issue description
The OpenCode settings UI requires an API key for every provider, including the keyless local provider.
Fix Focus Areas
- src/components/opencode-settings.tsx[369-373]
- src/lib/opencode/types.ts[155-161]
- src/lib/opencode/config.ts[145-160]
Recommended Fix
Base the Start button enablement on `validateConfig` or explicitly exempt the local provider from the API-key requirement while retaining its base-URL validation.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

15. Failed tasks abort dependents as cycles 🐞 Bug ☼ Reliability

TaskQueue.getReadyTasks requires every dependency to have completed status, while a failed task
is marked failed. Its dependent remains pending, after which executeWithQueue throws a
circular-dependency error even though the graph is acyclic and the actual failure was already known.

Agent Prompt

Issue description
Agent task dependents of a failed task remain pending and are reported as a circular dependency.
Fix Focus Areas
- packages/codeflow-agent/src/agent/task-queue.ts[21-39]
- packages/codeflow-agent/src/agent/task-queue.ts[50-65]
- packages/codeflow-agent/src/agent/agent-spawner.ts[111-119]
Recommended Fix
Detect failed dependencies and mark dependent tasks blocked or skipped with the prerequisite failure recorded. Reserve the circular-dependency error for a verified cycle among pending tasks, and return the partial result set for ordinary task failures.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e5457e44c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove and rotate the committed Gemini and NVIDIA keys

These non-placeholder provider credentials are tracked in the commit, so anyone with repository or fork access can use them; deleting the file in a later commit will not remove copies already fetched. Remove the file from version control and revoke/rotate both exposed credentials.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove and rotate the embedded MiniMax key

This demo hard-codes a provider credential in tracked source, exposing it to every clone, fork, build log, and source archive. Read the key from an untracked environment variable instead and revoke/rotate the exposed value.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Exclude the API key from the OpenCode child environment

When OpenCode is started, JSON.stringify(config) includes apiKey and is placed in the server process environment. Any tool or MCP child process spawned by OpenCode inherits that environment, so this directly reintroduces the API-key leak that the file-backed configToEnv handling is meant to avoid; pass only non-secret configuration through the environment.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Resolve the final file target before writing

For a repository containing an allowed source-file symlink (for example, link.ts pointing outside the repository), the directory check succeeds because only dirPath is resolved, but fs.writeFile(validatedPath, ...) follows the final symlink. Editing that file through this route can therefore overwrite an arbitrary external target; resolve and verify the final target, or reject symlinked files, immediately before writing.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Isolate CodeRAG state by repository

The singleton is closed and replaced whenever any project is indexed. With two projects open in separate tabs, building project B replaces project A's index; a subsequent suggestion for A calls getCodeRag() and can attach B's retrieved source excerpts to the A request, including sending them to the configured model provider. Keep instances keyed by project/repository and select the matching one for each request.

Useful? React with 👍 / 👎.

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR expands the CodeFlow workspace with OpenCode, agent, MCP, versioning, persistence, and UI integrations. It also adds tests and generated package artifacts, but several security and runtime issues remain unresolved.

Changes:

• Adds workspace packages and generated versioning artifacts.
• Adds OpenCode, observability, approval, export, and MCP routes.
• Adds agent orchestration, validation, persistence, and UI scaffolding.

File summaries

File	Description
tsconfig.json	Updated as part of this pull request.
src/types/monaco-workers.d.ts	Updated as part of this pull request.
src/lib/opencode/server.test.ts	Updated as part of this pull request.
src/lib/opencode/index.ts	Updated as part of this pull request.
src/lib/blueprint/test-fixtures/sample-repo/src/lib/auth.ts	Updated as part of this pull request.
src/lib/blueprint/store.test.ts	Updated as part of this pull request.
src/lib/blueprint/run-store.ts	Updated as part of this pull request.
src/lib/blueprint/repo.test.ts	Updated as part of this pull request.
src/lib/blueprint/observability.test.ts	Updated as part of this pull request.
src/lib/blueprint/execute.test.ts	Updated as part of this pull request.
src/components/ide-workbench.tsx	Updated as part of this pull request.
src/app/policy-canvas/page.tsx	Updated as part of this pull request.
src/app/loading.tsx	Updated as part of this pull request.
src/app/layout.tsx	Updated as part of this pull request.
src/app/api/opencode/stop/route.ts	Updated as part of this pull request.
src/app/api/opencode/status/route.ts	Updated as part of this pull request.
src/app/api/observability/latest/route.ts	Updated as part of this pull request.
src/app/api/observability/ingest/route.ts	Updated as part of this pull request.
src/app/api/export/mermaid/route.ts	Updated as part of this pull request.
src/app/api/approvals/approve/route.ts	Updated as part of this pull request.
pnpm-workspace.yaml	Updated as part of this pull request.
packages/codeflow-versioning/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-versioning/tsconfig.json	Updated as part of this pull request.
packages/codeflow-versioning/src/store/index.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/tools.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/tools.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/store/index.js	Updated as part of this pull request.
packages/codeflow-versioning/dist/store/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/store/index.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/session.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/session.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/risk.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/risk.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/reasoning/index.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/reasoning/index.test.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/observability.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/observability.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/invoke.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/invoke.test.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/invoke.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/index.js	Updated as part of this pull request.
packages/codeflow-versioning/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/diff.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/diff.test.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/diff.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/diff.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/coderag/search.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/coderag/search.test.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/coderag/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/coderag/index.d.ts	Updated as part of this pull request.
packages/codeflow-versioning/dist/branch/index.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-versioning/dist/branch/index.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-store/tsconfig.json	Updated as part of this pull request.
packages/codeflow-store/test-fixtures/sample-blueprint.json	Updated as part of this pull request.
packages/codeflow-store/test-fixtures/minimal-blueprint.json	Updated as part of this pull request.
packages/codeflow-store/dist/shared/utils.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/shared/run-command.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/shared/file-tree.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/shared/file-tree.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/session/session.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/session/session.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/session/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/session.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/session.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/run/run.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/run/run.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/run/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/run/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/risk/risk.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/risk/risk.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/risk/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/reasoning/reasoning.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/reasoning/reasoning.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/reasoning/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/reasoning/brutal.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/reasoning/brutal.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/observability/ring-buffer.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/observability/ring-buffer.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/observability/ring-buffer.js	Updated as part of this pull request.
packages/codeflow-store/dist/observability/ring-buffer.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/observability/ring-buffer.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/observability/observability.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/observability/observability.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/observability/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/observability/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/observability/config.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/observability/config.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/observability/config.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/observability/config.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/checkpoint/reasoning.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/checkpoint/reasoning.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/checkpoint/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/checkpoint/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/checkpoint/checkpoint.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/checkpoint/checkpoint.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/branch/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/branch/index.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/branch/brutal.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/branch/brutal.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/branch/branch.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/branch/branch.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/bin/cli.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/bin/cli.d.ts	Updated as part of this pull request.
packages/codeflow-store/dist/approval/approval.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-store/dist/approval/approval.test.d.ts	Updated as part of this pull request.
packages/codeflow-store/.test-store-checkpoint/self-copy-project/file.txt	Updated as part of this pull request.
packages/codeflow-prd/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-prd/tsconfig.json	Updated as part of this pull request.
packages/codeflow-prd/src/invoke.ts	Updated as part of this pull request.
packages/codeflow-prd/src/index.ts	Updated as part of this pull request.
packages/codeflow-prd/dist/prd.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-prd/dist/prd.test.d.ts	Updated as part of this pull request.
packages/codeflow-prd/dist/prd.d.ts.map	Updated as part of this pull request.
packages/codeflow-prd/dist/prd.d.ts	Updated as part of this pull request.
packages/codeflow-prd/dist/invoke.js.map	Updated as part of this pull request.
packages/codeflow-prd/dist/invoke.js	Updated as part of this pull request.
packages/codeflow-prd/dist/invoke.d.ts.map	Updated as part of this pull request.
packages/codeflow-prd/dist/invoke.d.ts	Updated as part of this pull request.
packages/codeflow-prd/dist/index.js.map	Updated as part of this pull request.
packages/codeflow-prd/dist/index.js	Updated as part of this pull request.
packages/codeflow-prd/dist/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-prd/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-prd/dist/build.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-prd/dist/build.test.d.ts	Updated as part of this pull request.
packages/codeflow-prd/dist/build.d.ts.map	Updated as part of this pull request.
packages/codeflow-prd/dist/build.d.ts	Updated as part of this pull request.
packages/codeflow-prd-test-npm/package.json	Updated as part of this pull request.
packages/codeflow-mcp/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-mcp/tsconfig.json	Updated as part of this pull request.
packages/codeflow-mcp/scripts/wrap-cli.mjs	Updated as part of this pull request.
packages/codeflow-mcp/dist/tools/index.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/tools/index.test.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/dist/tools/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/tools/index.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/dist/invoke/index.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/invoke/index.test.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/dist/index.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/index.test.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/dist/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/dist/bin/cli.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/bin/cli.test.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/dist/bin/cli.d.ts.map	Updated as part of this pull request.
packages/codeflow-mcp/dist/bin/cli.d.ts	Updated as part of this pull request.
packages/codeflow-mcp/.npmignore	Updated as part of this pull request.
packages/codeflow-execution/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-execution/tsconfig.json	Updated as part of this pull request.
packages/codeflow-execution/src/index.ts	Updated as part of this pull request.
packages/codeflow-execution/src/execute.ts	Updated as part of this pull request.
packages/codeflow-execution/e2e-demo/package.json	Updated as part of this pull request.
packages/codeflow-execution/dist/vcr.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/utils.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/utils.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/sandbox.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/sandbox.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/runtime-workspace.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/runtime-workspace.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/runtime-tests.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/runner.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/runner.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/plan.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/plan.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/mermaid.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/mermaid.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/internal/typescript-workspace.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/internal/run-command.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/index.js	Updated as part of this pull request.
packages/codeflow-execution/dist/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/execute.js	Updated as part of this pull request.
packages/codeflow-execution/dist/execute.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/execute.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/codegen.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/codegen.d.ts	Updated as part of this pull request.
packages/codeflow-execution/dist/bin/cli.d.ts.map	Updated as part of this pull request.
packages/codeflow-execution/dist/bin/cli.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-evolution/tsconfig.json	Updated as part of this pull request.
packages/codeflow-evolution/tsconfig.build.json	Updated as part of this pull request.
packages/codeflow-evolution/test-fixtures/minimal-blueprint.json	Updated as part of this pull request.
packages/codeflow-evolution/src/ghost/index.ts	Updated as part of this pull request.
packages/codeflow-evolution/src/ghost/ghost-nodes.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/openai.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/openai.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/ollama.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/ollama.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/nvidia.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/nvidia.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/index.js	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/index.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/anthropic.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/providers/anthropic.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/index.js.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/index.js	Updated as part of this pull request.
packages/codeflow-evolution/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/index.js.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/index.js	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/index.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/ghost-nodes.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/ghost-nodes.test.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/ghost-nodes.js.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/ghost-nodes.js	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/ghost-nodes.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/ghost/ghost-nodes.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/genetic.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/genetic.test.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/bin/cli.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/bin/cli.d.ts	Updated as part of this pull request.
packages/codeflow-evolution/dist/api/evolve/route.d.ts.map	Updated as part of this pull request.
packages/codeflow-evolution/dist/api/evolve/route.d.ts	Updated as part of this pull request.
packages/codeflow-dtwin/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-dtwin/tsconfig.json	Updated as part of this pull request.
packages/codeflow-dtwin/src/index.ts	Updated as part of this pull request.
packages/codeflow-dtwin/dist/types.js	Updated as part of this pull request.
packages/codeflow-dtwin/dist/index.js.map	Updated as part of this pull request.
packages/codeflow-dtwin/dist/index.js	Updated as part of this pull request.
packages/codeflow-dtwin/dist/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-dtwin/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-dtwin/dist/digital-twin.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-dtwin/dist/digital-twin.test.d.ts	Updated as part of this pull request.
packages/codeflow-dtwin/dist/bin/cli.d.ts.map	Updated as part of this pull request.
packages/codeflow-dtwin/dist/bin/cli.d.ts	Updated as part of this pull request.
packages/codeflow-dtwin/dist/api/simulate/route.d.ts	Updated as part of this pull request.
packages/codeflow-dtwin/dist/api/route.d.ts.map	Updated as part of this pull request.
packages/codeflow-dtwin/dist/api/route.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-canvas/tsconfig.json	Updated as part of this pull request.
packages/codeflow-canvas/tsconfig.build.json	Updated as part of this pull request.
packages/codeflow-canvas/src/store/index.ts	Updated as part of this pull request.
packages/codeflow-canvas/src/components/index.ts	Updated as part of this pull request.
packages/codeflow-canvas/src/components/ide-workbench.tsx	Updated as part of this pull request.
packages/codeflow-canvas/scripts/wrap-cli.mjs	Updated as part of this pull request.
packages/codeflow-canvas/dist/store/index.js.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/store/index.js	Updated as part of this pull request.
packages/codeflow-canvas/dist/store/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/store/index.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/types.js.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/types.js	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/traces.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/traces.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/index.js.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/index.js	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/index.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/edit.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/lib/browser/storage.js	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ts-language-service.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/policy-workbench.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/policy-workbench.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/opencode-settings.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/opencode-settings.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/monaco-setup.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/monaco-setup.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/index.js	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/index.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ide-workbench.js.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ide-workbench.js	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ide-workbench.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ide-workbench.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ide-layout.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/ide-layout.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/file-tree.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/file-tree.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/file-tabs.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/file-tabs.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/code-diff-editor.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/blueprint-workbench.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/components/blueprint-workbench.d.ts	Updated as part of this pull request.
packages/codeflow-canvas/dist/bin/cli.d.ts.map	Updated as part of this pull request.
packages/codeflow-canvas/dist/bin/cli.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-analysis/tsconfig.json	Updated as part of this pull request.
packages/codeflow-analysis/test-fixtures/sample-repo/tsconfig.json	Updated as part of this pull request.
packages/codeflow-analysis/test-fixtures/sample-repo/src/services/task-service.ts	Updated as part of this pull request.
packages/codeflow-analysis/test-fixtures/sample-repo/src/services/base-service.ts	Updated as part of this pull request.
packages/codeflow-analysis/test-fixtures/sample-repo/src/lib/auth.ts	Updated as part of this pull request.
packages/codeflow-analysis/test-fixtures/sample-repo/src/app/page.tsx	Updated as part of this pull request.
packages/codeflow-analysis/test-fixtures/sample-repo/src/app/api/tasks/route.ts	Updated as part of this pull request.
packages/codeflow-analysis/src/index.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/smells.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/smells.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/smells.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/refactor.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/refactor.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/metrics.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/metrics.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/metrics.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/invoke.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/invoke.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/index.js	Updated as part of this pull request.
packages/codeflow-analysis/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/smells.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/refactor-heal.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/refactor-heal.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/refactor-detect.js	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/refactor-detect.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/refactor-detect.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/metrics.js	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/metrics.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/cycles.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/handlers/conflicts.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/cycles.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/cycles.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/conflicts.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/conflicts.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/conflicts.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/conflicts.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/bin/cli.js	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/refactor/heal/route.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/refactor/heal/route.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/refactor/detect/route.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/refactor/detect/route.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/conflicts/route.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/conflicts/route.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/analysis/smells/route.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/analysis/smells/route.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/analysis/metrics/route.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/analysis/metrics/route.test.d.ts	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/analysis/cycles/route.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-analysis/dist/app/api/analysis/cycles/route.test.d.ts	Updated as part of this pull request.
packages/codeflow-agent/vitest.config.ts	Updated as part of this pull request.
packages/codeflow-agent/tsconfig.json	Updated as part of this pull request.
packages/codeflow-agent/src/plugins/loader.ts	Updated as part of this pull request.
packages/codeflow-agent/src/index.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/types/blueprint.js	Updated as part of this pull request.
packages/codeflow-agent/dist/types/blueprint.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/skills/registry.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/skills/loader.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/skills/loader.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/plugins/registry.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/plugins/loader.js	Updated as part of this pull request.
packages/codeflow-agent/dist/plugins/loader.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/plugins/loader.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/mcp/connector.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/index.js	Updated as part of this pull request.
packages/codeflow-agent/dist/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/index.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/cli/index.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/cli/index.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/test-generator.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/test-generator.test.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/scaffold-utils.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/scaffold-generator.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/scaffold-generator.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/refactor-suggester.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/refactor-suggester.test.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/multi-language-codegen.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/multi-language-codegen.test.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/index.js	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/doc-generator.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/doc-generator.test.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/doc-generator.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/ai/code-generator.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/types.js	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/task-queue.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/result-aggregator.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/result-aggregator.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/tester-prompt.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/tester-prompt.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/reviewer-prompt.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/reviewer-prompt.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/planner-prompt.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/planner-prompt.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/prompts/coder-prompt.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/blueprint.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/blueprint.d.ts	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/agent.test.d.ts.map	Updated as part of this pull request.
packages/codeflow-agent/dist/agent/agent.test.d.ts	Updated as part of this pull request.
next.config.ts	Updated as part of this pull request.
eslint.config.mjs	Updated as part of this pull request.
codeflow-core/vitest.config.ts	Updated as part of this pull request.
codeflow-core/tsconfig.json	Updated as part of this pull request.
codeflow-core/test-fixtures/sample-ts/base-service.ts	Updated as part of this pull request.
codeflow-core/test-fixtures/sample-js/service.js	Updated as part of this pull request.
codeflow-core/test-fixtures/sample-c/main.c	Updated as part of this pull request.
codeflow-core/src/store-paths.ts	Updated as part of this pull request.
codeflow-core/src/index.ts	Updated as part of this pull request.
codeflow-core/src/analyzer/index.ts	Updated as part of this pull request.
codeflow-core/dist/store-paths.js	Updated as part of this pull request.
codeflow-core/dist/store-paths.d.ts	Updated as part of this pull request.
codeflow-core/dist/storage/store-paths.d.ts	Updated as part of this pull request.
codeflow-core/dist/internal/prd.d.ts	Updated as part of this pull request.
codeflow-core/dist/internal/plan.d.ts	Updated as part of this pull request.
codeflow-core/dist/internal/codegen.d.ts	Updated as part of this pull request.
codeflow-core/dist/index.js	Updated as part of this pull request.
codeflow-core/dist/index.d.ts	Updated as part of this pull request.
codeflow-core/dist/export/index.d.ts	Updated as part of this pull request.
codeflow-core/dist/conflicts/index.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/tree-sitter-queries.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/tree-sitter-loader.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/test-hook-check.js	Updated as part of this pull request.
codeflow-core/dist/analyzer/test-hook-check.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/repo.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/repo-multi.test.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/index.js	Updated as part of this pull request.
codeflow-core/dist/analyzer/index.d.ts	Updated as part of this pull request.
codeflow-core/dist/analyzer/build.d.ts	Updated as part of this pull request.
claude-code/verification/current-failures.json	Updated as part of this pull request.
claude-code/verification/attempt-count.txt	Updated as part of this pull request.
claude-code/reasoning/verification-summary.md	Updated as part of this pull request.
claude-code/reasoning/verification-status.txt	Updated as part of this pull request.
claude-code/reasoning/verification-1775122124.md	Updated as part of this pull request.
claude-code/reasoning/verification-1775106145.md	Updated as part of this pull request.
claude-code/reasoning/verification-1775106088.md	Updated as part of this pull request.
claude-code/reasoning/verification-1775106063.md	Updated as part of this pull request.
claude-code/reasoning/verification-1775106029.md	Updated as part of this pull request.
claude-code/reasoning/verification-1775105963.md	Updated as part of this pull request.
claude-code/reasoning/verification-1775099076.md	Updated as part of this pull request.
claude-code/reasoning/task-results-1775122417.json	Updated as part of this pull request.
claude-code/reasoning/task-results-1775106463.json	Updated as part of this pull request.
claude-code/reasoning/task-results-1775106448.json	Updated as part of this pull request.
claude-code/reasoning/task-results-1775106433.json	Updated as part of this pull request.
claude-code/reasoning/task-results-1775106389.json	Updated as part of this pull request.
claude-code/reasoning/task-results-1775106169.json	Updated as part of this pull request.
claude-code/reasoning/task-results-1775099215.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775121879.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775106141.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775106086.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775106062.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775106025.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775105962.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775100635.json	Updated as part of this pull request.
claude-code/reasoning/task-context-1775099033.json	Updated as part of this pull request.
claude-code/reasoning/subagent-results-summary.md	Updated as part of this pull request.
claude-code/reasoning/subagent-assignments.json	Updated as part of this pull request.
claude-code/reasoning/subagent-aggregation-summary.md	Updated as part of this pull request.
claude-code/reasoning/quality-gates-.json	Updated as part of this pull request.
claude-code/reasoning/prompt-compliance.txt	Updated as part of this pull request.
claude-code/reasoning/modular-tasks.json	Updated as part of this pull request.
claude-code/reasoning/doc-result.txt	Updated as part of this pull request.
.serena/.gitignore	Updated as part of this pull request.
.qwen/settings.json	Updated as part of this pull request.
.gitignore	Updated as part of this pull request.
.env	Updated as part of this pull request.

Review details

• Files reviewed: 94/1349 changed files
• Comments generated: 40
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.