> For the complete documentation index, see [llms.txt](https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/.spec_system/archive/sessions/phase31-session02-snapshot-exporter-and-fixtures/code-review.md). # Code Review and Repair Report **Session ID**: `phase31-session02-snapshot-exporter-and-fixtures` **Reviewed**: 2026-06-24 **Scope**: All uncommitted changes in the working tree **Result**: RESOLVED ## Review Surface **Files reviewed** (all uncommitted changes): * `.gitignore` - tracked-modified * `.prettierignore` - tracked-modified * `.spec_system/state.json` - tracked-modified * `.spec_system/specs/phase31-session02-snapshot-exporter-and-fixtures/spec.md` - untracked * `.spec_system/specs/phase31-session02-snapshot-exporter-and-fixtures/tasks.md` - untracked * `.spec_system/specs/phase31-session02-snapshot-exporter-and-fixtures/implementation-notes.md` - untracked * `.spec_system/specs/phase31-session02-snapshot-exporter-and-fixtures/code-review.md` - untracked, generated by this command * `package.json` - tracked-modified * `scripts/lib/pages-demo-snapshot.ts` - untracked * `scripts/lib/__tests__/pages-demo-snapshot.test.ts` - untracked * `scripts/demo/export-pages-snapshot.ts` - untracked * `demo-website/README.md` - untracked * `demo-website/snapshot-manifest.json` - untracked * `demo-website/public/demo/live-data.snapshot.json` - untracked * `demo-website/public/demo/snapshot-metadata.json` - untracked * `demo-website/public/demo/graphs/index.json` - untracked * `demo-website/public/demo/graphs/ai-os.json` - untracked * `demo-website/public/demo/trend-finder-assets/README.md` - untracked **Inventory commands**: `git status`, `git diff HEAD`, `git diff --cached`, `git ls-files --others --exclude-standard` ## Findings by Severity ### Critical * No findings. ### High * `demo-website/public/demo/live-data.snapshot.json` - Public fixture exposed validator-backed credential indicators (`keychainCredentials: 0`, `hasKey: false`, `hasToken: false`), conflicting with the session requirement to avoid credential-count disclosures and auth-state details. | Fix: added presence-based credential-disclosure scanning, stripped those fields after validation, regenerated fixtures, and added assertions for scanner rejection and fixture absence. | Status: FIXED ### Medium * `scripts/lib/pages-demo-snapshot.ts` - `writeSnapshotFilesAtomically()` could leave a newly-created target behind if a later rename failed and the target had no backup to restore. | Fix: added duplicate output preflight, tracked committed targets, removed no-backup committed targets during rollback, and added a duplicate-target regression test. | Status: FIXED ### Low * `scripts/lib/pages-demo-snapshot.ts` - The new exporter had formatter/linter failures, including an unused helper and a non-ASCII escaping regex rejected by `no-control-regex`. | Fix: removed the unused helper, replaced regex escaping with code-unit escaping, ran Prettier on session-owned files, and added generated demo JSON paths to `.prettierignore` because the exporter intentionally preserves ASCII-escaped JSON. | Status: FIXED ## Assumptions and Deliberate Non-Fixes * The generated graph registry keeps `graphPath` values in the existing `src/data/graphs/*.json` contract because `parseKnowledgeGraphRegistry()` currently enforces that shape. Later demo-route consumption can map fixture IDs to `/demo/graphs/*.json` without changing this session's parser-backed registry contract. * Repo-wide `bun run lint` and `bun run format:check` still fail on unchanged files outside this uncommitted review surface. They were not modified because `creview` is scoped to defects introduced by uncommitted changes. Targeted session lint and formatting pass. ## Behavior Changes * Public demo fixtures no longer contain credential count or credential presence fields. * Snapshot write transactions now reject duplicate output targets before writing and clean up newly-created targets if rollback is needed. * Generated demo JSON files are ignored by Prettier so ASCII-escaped fixture output remains compatible with the spec-system ASCII rule. ## Verification * Tests: `bun run test` - PASS - 359 files, 4118 tests passed. * Focused tests: `bun run test -- scripts/lib/__tests__/pages-demo-snapshot.test.ts` - PASS - 7 tests passed. * Type checker: `bun run typecheck` - PASS. * Script type checker: `bun run typecheck:scripts` - PASS. * Linter: `bunx eslint scripts/lib/pages-demo-snapshot.ts scripts/lib/__tests__/pages-demo-snapshot.test.ts scripts/demo/export-pages-snapshot.ts` - PASS. * Linter: `bun run lint` - FAIL - unchanged pre-existing failures in `videos/ai-rogue-suno-promo/scripts/build-promo-frames.mjs` plus one unchanged warning in `src/extensions/use-extension-data.ts`. * Formatter: targeted `bunx prettier --check [session-owned source/docs/fixtures]` - PASS. * Formatter: `bun run format:check` - FAIL - unchanged pre-existing formatting drift in phase PRD docs and unrelated docs. * Snapshot exporter: `bun run demo:snapshot` - PASS - wrote 5 expected files; scan `pass`, 17 routes. * Fixture privacy: `verifySnapshotFilePrivacy(process.cwd())` - PASS - `issueCount: 0`. * Fixture credential grep: `rg '"(keychainCredentials|hasKey|hasToken|credCount|hasApiKey|hasOauth|apiKeyReady|chatgptPlanDetected)"' [demo fixtures]` - PASS - no matches. * JSON parseability: `jq empty` over all generated demo JSON files - PASS. * ASCII: `perl -ne 'if (/[^\\x00-\\x7F]/) ...' [session files]` - PASS. * LF endings: `grep -Il $'\\r' [session files]` - PASS - no matches. * Generated Pages output ignore: `git check-ignore -v demo-website/dist demo-website/dist/client/index.html` - PASS. * Final diff re-read: no remaining issues in uncommitted review surface. ## Summary 1. Reviewed 18 uncommitted files: session spec artifacts, exporter library, CLI, tests, fixture docs, generated fixtures, manifest, and tracked config/state changes. 2. Findings: 0 critical, 1 high, 1 medium, 1 low; all fixed. 3. Deliberate non-fixes are limited to unchanged repo-wide lint/format failures outside this review surface. 4. Current session tests, full tests, typechecks, targeted lint/format, privacy scan, ASCII/LF, JSON parseability, and ignored-output checks pass. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/.spec_system/archive/sessions/phase31-session02-snapshot-exporter-and-fixtures/code-review.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.