pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "REVIEW INCOMPLETE — the PR #14 diff could not be retrieved (network egress and approval prompts are blocked in this environment; the branch is not checked out locally). Findings below are derived from the PR's stated design and the base-branch code it extends, not from the actual changed lines. The blocking concern that stands regardless of implementation is the operator Bearer token stored in localStorage (security/major), since that token authorizes shipping code to production. Three further items (PR-URL href scheme validation, TERMINAL_STATUSES string-matching against the real status enum, and the scope of auth-header injection) are plausible from the description and the base contract but MUST be verified against the actual diff. Verdict is changes_requested on the strength of the localStorage-token finding and the unresolved verification items; re-run with the real diff to confirm severities and obtain accurate line numbers.",
    "verdict": "changes_requested",
    "findings": [
      {
        "file": "components/ApiTokenInput.tsx",
        "lens": "security",
        "line": 0,
        "finding": "The operator Bearer token is persisted in localStorage (stated in the PR), so any XSS on the dashboard can exfiltrate it; since this token can submit feature-to-prod/hotfix runs, theft enables shipping arbitrary code to production — prefer an HttpOnly cookie or in-memory-only storage.",
        "severity": "major"
      },
      {
        "file": "components/PrLink.tsx",
        "lens": "security",
        "line": 0,
        "finding": "A PR URL inferred from run output is rendered into an anchor href; unless extractPrUrl() constrains it to an https://github.com/ host, React will not sanitize a javascript:-scheme value, allowing stored XSS or open redirect from semi-trusted run data (verify).",
        "severity": "major"
      },
      {
        "file": "lib/api.ts",
        "lens": "performance",
        "line": 0,
        "finding": "TERMINAL_STATUSES must match the API's exact status strings ('succeeded','failed','cancelled' per the base RunStatus enum); the PR text says polling 'stops on success' — if it uses 'success' (≠ 'succeeded'), the 2s SWR poll never terminates for completed runs, leaking timers and unbounded requests (verify).",
        "severity": "major"
      },
      {
        "file": "lib/api.ts",
        "lens": "security",
        "line": 0,
        "finding": "Auth-header injection 'on all calls' means the Bearer token is attached to every request including server-component fetches that use the cluster-internal URL; confirm the token is only injected client-side for same-origin/orchestrator targets so it is never sent to an unintended host.",
        "severity": "minor"
      },
      {
        "file": "components/RunStream.tsx",
        "lens": "performance",
        "line": 0,
        "finding": "Each 2s tick issues two requests (snapshot + events) per viewer with no backoff/jitter; acceptable for a few operators but will not degrade gracefully under many concurrent run viewers — consider a single combined endpoint or exponential backoff on errors.",
        "severity": "minor"
      },
      {
        "file": "components/ApiTokenInput.tsx",
        "lens": "privacy",
        "line": 0,
        "finding": "Ensure the token value is masked in the UI and never echoed into console logs or thrown error messages (the base http() puts response bodies into Error messages).",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "fcea6ce4de7b0d78752d5a91f88b261d48dfdbd3",
  "pr_number": 14,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 14,
      "body_chars": 3251,
      "comment_id": 4529287389
    }
  },
  "changed_files": [],
  "dashboard_url": "http://aion.levanto.in/runs/129964db-049b-4b22-96e7-61f40b0690aa",
  "status-failure-review": {
    "posted": {
      "sha": "fcea6ce4de7b0d78752d5a91f88b261d48dfdbd3",
      "state": "failure",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/129964db-049b-4b22-96e7-61f40b0690aa"
    }
  },
  "status-pending-review": {
    "posted": {
      "sha": "fcea6ce4de7b0d78752d5a91f88b261d48dfdbd3",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/129964db-049b-4b22-96e7-61f40b0690aa"
    }
  }
}