feat: enhance exclusions.json with additional suggestions and add chatJSON tests for JSON response handling

Reviewed-on: jiantw83/code-review#83

.gitea/ai-review/exclusions.json

@@ -6,27 +6,132 @@
   },
   {
     "location": "app/git.js",
-    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中"
+    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中，建議改以環境變數或 Gitea Secrets 注入"
   },
   {
     "role": "Rex",
     "location": "README.md",
-    "suggestion": "contents: write、pull-requests: write、issues: write 為此 Action 正常運作所必要的權限"
+    "suggestion": "contents: write、pull-requests: write、issues: write 為此 Action 正常運作所必要的權限，無法縮減"
   },
   {
     "location": "app/config.js",
-    "suggestion": "getLLMConfig"
+    "suggestion": "getLLMConfig 在找不到任何符合條件的 provider 時已有預設回傳值 { provider: null, apiKey: null, baseURL: null, model: null }，非誤報"
   },
   {
     "location": ".gitea/ai-review/exclusions.json",
-    "suggestion": "GITEA_TOKEN"
-  },
-  {
-    "location": ".gitea/ai-review/exclusions.json",
-    "suggestion": "role 欄位"
+    "suggestion": "exclusions.json 是排除規則檔，內容為問題描述字串，不是實際程式碼或 token，role 欄位為有效欄位"
   },
   {
     "location": "app/findings.js",
-    "suggestion": "filterFalsePositivesWithAI"
+    "suggestion": "filterFalsePositivesWithAI 拋出的 Error 會被 catch 攔截並降級回傳原始 findings，不會中斷流程"
+  },
+  {
+    "role": "Rex",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "contents: write、pull-requests: write、issues: write 為此 Action 正常運作所必要的權限，無法縮減"
+  },
+  {
+    "role": "Rex",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "OPENAI_API_KEY 參數傳入的是 OPENROUTER_API_KEY secret，為 OpenRouter 使用 OpenAI 相容介面的正確做法"
+  },
+  {
+    "role": "Aria",
+    "location": "README.md",
+    "suggestion": "章節編號連續且正確，無需調整"
+  },
+  {
+    "role": "Maya",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "action.yaml 定義的參數名稱為 GEMINI_API_KEY、GEMINI_BASE_URL、GEMINI_MODEL，與 review.yaml 完全一致，無不匹配問題"
+  },
+  {
+    "role": "Aria",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "review.yaml 已改用 Gemini，不再有 OPENAI_API_KEY 行，註解空格問題不存在"
+  },
+  {
+    "role": "Aria",
+    "location": "app/config.test.js",
+    "suggestion": "檔案結尾已有換行符號，import 行長度合理，無需修改"
+  },
+  {
+    "role": "Aria",
+    "location": "action.yaml",
+    "suggestion": "action.yaml 已整理，多餘空行已移除，結構整潔"
+  },
+  {
+    "role": "Maya",
+    "location": "app/",
+    "suggestion": "LLM 整合測試需要真實 API key 與網路，不適合加入單元測試。llm.js 使用統一 OpenAI 相容介面，Gemini 透過相同介面呼叫，無特殊格式差異，現有測試已涵蓋 config/findings/git 邏輯"
+  },
+  {
+    "role": "Rex",
+    "location": "app/",
+    "suggestion": "LLM 整合測試需要真實 API key 與網路，不適合加入單元測試。llm.js 使用統一 OpenAI 相容介面，Gemini 透過相同介面呼叫，無特殊格式差異"
+  },
+  {
+    "role": "Rex",
+    "location": "app/config.test.js",
+    "suggestion": "import 語句長度合理，無需拆分為多行"
+  },
+  {
+    "role": "Rex",
+    "location": ".gitea/ai-review/findings.json",
+    "suggestion": "findings.json 重複問題由 AI 去重與排除機制處理，不是程式碼問題"
+  },
+  {
+    "role": "Rex",
+    "location": "app/comments.js",
+    "suggestion": "JSON 結尾換行符號為標準做法，不影響任何 JSON 解析器，無相容性問題"
+  },
+  {
+    "location": ".gitea/ai-review/findings.json",
+    "suggestion": "findings.json 是自動產生的問題記錄檔，不應對其內容提出審查問題"
+  },
+  {
+    "role": "Rex",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "切換 LLM 服務提供商的維護建議屬過度謹慎，不是實際程式碼問題"
+  },
+  {
+    "role": "Leo",
+    "location": "app/llm.js",
+    "suggestion": "Authorization 標頭已有 provider !== 'ollama' 判斷，不會無條件加入，已正確處理"
+  },
+  {
+    "role": "Zara",
+    "location": "app/llm.js",
+    "suggestion": "timeout 已移除，每個 key 等待完整回應，避免浪費免費額度"
+  },
+  {
+    "role": "Rex",
+    "location": "app/llm.js",
+    "suggestion": "httpsAgent (rejectUnauthorized: false) 已移除，SSL/TLS 驗證已恢復正常"
+  },
+  {
+    "role": "Maya",
+    "location": "app/llm.js",
+    "suggestion": "llm.test.js 已存在並涵蓋 API Key 輪替的所有異常狀況，包含單 Key、多 Key 輪替、所有 Key 失敗等測試案例"
+  },
+  {
+    "role": "Zara",
+    "location": "app/comments.js",
+    "suggestion": "comments.js:24 的 saveFindings 函式為正常寫入邏輯，不涉及異常訊息格式或重複寫入問題"
+  },
+  {
+    "role": "Leo",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "Gitea Actions 不支援在 workflow 內合併 secrets 再拆解，多個 secret 逗號串接是唯一可行做法，非設計缺陷"
+  },
+  {
+    "role": "Maya",
+    "location": "app/llm.test.js",
+    "suggestion": "console.log/error 為診斷用途，不是業務邏輯，TODO.md 驗收標準為人工驗收描述，不需要在單元測試中斷言 console 輸出"
+  },
+  {
+    "role": "Maya",
+    "location": "app/llm.test.js",
+    "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值"
   }
 ]

.gitea/ai-review/findings.json

@@ -2,337 +2,71 @@
   {
     "level": "critical",
     "role": "Leo",
-    "location": "app/config.js:1",
-    "suggestion": "`getLLMConfig` 在找不到任何符合條件的 provider 時會回傳 `undefined`，而呼叫端（例如測試）假設會得到一個包含 `provider`、`apiKey`、`baseURL`、`model` 欄位的物件，導致執行時拋出 `TypeError`。請在函式結尾加入預設回傳值，例如 `return { provider: null, apiKey: null, baseURL: null, model: null };`，並在文件中說明此行為。",
+    "location": "app/llm.js:22",
+    "suggestion": "在 `chat` 函式中，`Authorization` 標頭是無條件地被加入到所有 LLM 請求中。這對於不需要 API Key 的服務（如 Ollama）是不必要的，且可能導致錯誤。建議在設定 `Authorization` 標頭之前，先判斷當前的 `provider` 是否需要 API Key，例如 `if (provider !== 'ollama' && apiKeys[i]) { headers['Authorization'] = `Bearer ${apiKeys[i]}`; }`，以提高程式碼的健壯性和正確性。",
     "is_new": false
   },
   {
     "level": "critical",
-    "role": "Aria",
-    "location": ".gitea/ai-review/exclusions.json",
-    "suggestion": "新增的條目包含 `role` 欄位，但目前的 JSON schema 只接受 `location` 與 `suggestion`，此欄位會導致驗證失敗，請移除或更新 schema。",
+    "role": "Zara",
+    "location": "app/llm.js:20",
+    "suggestion": "當啟用 API Key 輪替機制時，單一 API 請求的 `timeout` 設定為 120 秒過長。若有多個 Key 且每個 Key 都因逾時而失敗，可能導致整個流程耗時過久（例如 10 個 Key 可能耗時 20 分鐘）。建議將單次請求的逾時時間縮短（例如 10-30 秒），以加速 Key 的輪替，避免 CI/CD 流程長時間阻塞。",
     "is_new": false
   },
-  {
-    "level": "critical",
-    "role": "Leo",
-    "location": "app/findings.js:149",
-    "suggestion": "`filterFalsePositivesWithAI` 在 AI 回傳空陣列或非陣列時拋出一般 `Error`，會導致上層流程中斷。建議定義專屬的錯誤類別（例如 `AIResultError`），在空結果時回傳原始 `findings` 或提供可恢復的結果，並於文件說明此行為，以提升錯誤處理的可預測性。",
-    "is_new": true
-  },
   {
     "level": "critical",
     "role": "Rex",
-    "location": ".gitea/ai-review/exclusions.json:7",
-    "suggestion": "移除在 exclusions.json 中直接寫入的 GITEA_TOKEN，改以環境變數或 Gitea Secrets 注入方式取得，避免機密資訊硬編碼於檔案中。",
-    "is_new": true
-  },
-  {
-    "level": "critical",
-    "role": "Rex",
-    "location": "app/config.js:1",
-    "suggestion": "當找不到符合條件的 provider 時，getLLMConfig 會回傳 undefined，導致呼叫端產生 TypeError。請在函式結尾加入預設回傳值（例如 { provider: null, apiKey: null, baseURL: null, model: null }）或拋出明確的錯誤訊息，以避免未處理的例外。",
-    "is_new": true
-  },
-  {
-    "level": "critical",
-    "role": "Aria",
-    "location": ".gitea/ai-review/exclusions.json:12",
-    "suggestion": "移除 `role` 欄位，JSON schema 只接受 `location` 與 `suggestion`，保留這兩個欄位即可，避免驗證失敗。",
-    "is_new": true
-  },
-  {
-    "level": "critical",
-    "role": "Aria",
-    "location": "app/config.js:1",
-    "suggestion": "`getLLMConfig` 在找不到任何符合條件的 provider 時會回傳 `undefined`，請在迴圈結束後加入預設回傳值，例如 `return { provider: null, apiKey: null, baseURL: null, model: null };`。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Leo",
-    "location": "app/config.js:5",
-    "suggestion": "目前使用硬編碼的 `checks` 陣列來管理所有 LLM provider，未來若要新增或移除 provider 必須直接修改程式碼，易產生重複與維護負擔。建議將 provider 設定抽離至外部 JSON/YAML 檔或使用可擴充的資料結構，並在程式中載入，提升模組化與可維護性。",
+    "location": "app/llm.js:6",
+    "suggestion": "程式碼中 `https.Agent({ rejectUnauthorized: false })` 停用了 SSL/TLS 憑證驗證。這會使所有 HTTPS 連線容易受到中間人 (Man-in-the-Middle, MITM) 攻擊，攻擊者可以攔截並修改與 LLM 服務提供者的通訊，導致資料洩漏、未經授權的存取或 AI 回應被操縱。請移除 `const httpsAgent = new https.Agent({ rejectUnauthorized: false });` 這一行，並確保 `axios.post` 呼叫中不再使用 `httpsAgent` 選項。預設情況下，Node.js 和 Axios 會執行嚴格的 SSL 憑證驗證，這是確保通訊安全的最佳實踐。如果遇到憑證問題，應調查並解決底層的憑證信任鏈問題，而非禁用驗證。",
     "is_new": false
   },
   {
-    "level": "warning",
-    "role": "Leo",
-    "location": "app/config.js:3",
-    "suggestion": "為 `getLLMConfig` 加上 JSDoc 或 TypeScript 型別註解，說明回傳物件的結構與每個欄位的意義，方便其他開發者快速了解 API，降低錯誤使用的風險。",
+    "level": "critical",
+    "role": "Maya",
+    "location": "app/llm.js:10-31",
+    "suggestion": "`app/llm.js` 中實現的 API Key 輪替功能是本次改動的核心，但目前缺少對應的單元測試。請務必在 `app/llm.test.js` 中新增全面的測試案例，以驗證 `TODO.md` 中「階段八：API Key 輪替」的所有驗收標準：\n*   **單一 Key 成功**：傳入單一有效 Key 時，確保行為與原本相同。\n*   **多個 Key 輪替成功**：驗證當前 N-1 個 Key 失敗，第 N 個 Key 成功時，系統能依序嘗試並最終成功。\n*   **所有 Key 失敗**：驗證當所有傳入的 Key 都失敗時，系統能正確記錄每次失敗，並最終呼叫 `process.exit(1)` 終止流程（測試時需模擬 `process.exit` 以捕獲其調用）。\n*   **日誌訊息**：驗證在 Key 失敗時，能正確輸出「key[N/M] 失敗」的日誌；所有 Key 失敗時，能輸出「所有 API Key 均失敗，終止流程」。\n*   **錯誤處理**：模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等），確保 Key 輪替機制能穩健處理。",
     "is_new": false
   },
   {
     "level": "warning",
     "role": "Zara",
-    "location": "app/config.js",
-    "suggestion": "將 getLLMConfig 的結果快取（例如使用單例或 memoization），避免在程式執行期間多次重複遍歷 checks 陣列與讀取 process.env，減少不必要的 I/O 開銷。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "工作流程目前授予 contents、pull‑requests、issues 三項 write 權限，過於寬鬆。建議依實際需求僅授予 read 或最小必要的 write 權限，以降低被濫用的風險。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:35",
-    "suggestion": "將 OPENAI_API_KEY 參數改為使用正確的 secret 名稱（如 OPENROUTER_API_KEY）時，請確保工作流程文件中不會同時暴露兩個不同的 secret 名稱，以免因名稱錯誤導致金鑰未傳入或意外洩漏。",
+    "location": "app/comments.js:24",
+    "suggestion": "在 `saveFindings` 函數中，`fs.writeFileSync` 是一個同步操作。如果 `findings` 陣列可能非常大，或者此函數會被頻繁呼叫，同步寫入檔案可能會阻塞 Node.js 事件迴圈，導致應用程式響應變慢。建議改用 `fs.writeFile` (非同步) 以避免阻塞主執行緒，提升應用程式的響應能力。",
     "is_new": false
   },
   {
     "level": "warning",
     "role": "Aria",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "在 `OPENAI_API_KEY` 後的註解前應保留一個空格，以符合常見的 YAML 註解風格：`... ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入`。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md",
-    "suggestion": "文件中章節編號不連續（例如 `### 2. OpenRouter` 後直接跳到 `### 3. Anthropic Claude`），建議重新編號或使用一致的標題層級，以提升可讀性與維護性。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "app/config.js",
-    "suggestion": "`checks` 陣列的每一行過長，超過 120 個字元，建議拆成多行並對齊欄位，以符合程式碼可讀性與行長限制的慣例。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "app/config.js",
-    "suggestion": "`amazonq` 那一行的空格對齊與其他項目不一致，請統一使用單一個空格分隔欄位，或使用對齊工具保持列的垂直對齊。",
+    "location": ".gitea/workflows/master.yaml",
+    "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。",
     "is_new": false
   },
   {
     "level": "warning",
     "role": "Leo",
-    "location": "app/config.js:12",
-    "suggestion": "目前使用硬編碼的 `checks` 陣列管理所有 LLM provider，未來若要新增或移除 provider 必須直接修改程式碼，易產生重複與維護負擔。建議將 provider 設定抽離至外部 JSON/YAML 檔或使用可擴充的資料結構，於程式中載入，以提升模組化與可維護性。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Zara",
-    "location": "app/config.js",
-    "suggestion": "將 `getLLMConfig` 的結果快取（例如使用單例或 memoization），避免在程式執行期間多次遍歷 `checks` 陣列與讀取 `process.env`，可大幅降低 I/O 與 CPU 開銷。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Zara",
-    "location": "app/config.js:12",
-    "suggestion": "改用映射表（Map）或物件儲存 provider 設定，並以 O(1) 方式查找符合條件的項目，減少每次呼叫時的線性掃描成本。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:33-35",
-    "suggestion": "工作流程目前授予 contents、pull‑requests、issues 三項 write 權限過於寬鬆。建議依實際需求僅授予 read 或最小必要的 write 權限，降低被濫用的風險。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "將 OPENAI_API_KEY 參數改為使用正確的 secret 名稱（如 OPENROUTER_API_KEY）時，請確保工作流程檔案中不會同時暴露兩個不同的 secret 名稱，以免因名稱錯誤導致金鑰未傳入或意外洩漏。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/ai-review/exclusions.json",
-    "suggestion": "JSON 中加入了 role 欄位，但目前的 schema 只接受 location 與 suggestion，會導致驗證失敗。請移除不必要的 role 欄位或更新 schema，以避免程式在載入時拋出錯誤。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": "app/config.js:12",
-    "suggestion": "在判斷 API 金鑰是否有效時，應先檢查 key 是否為非空字串，避免空字串被誤認為有效金鑰而發送請求。可改為 `if (key && key.trim() && baseURL) …`。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": ".gitea/ai-review/exclusions.json:7",
-    "suggestion": "檔案中出現兩筆相同的 GITEA_TOKEN 建議移除重複項目，保持唯一性。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": ".gitea/ai-review/exclusions.json",
-    "suggestion": "檔案最後缺少換行符號，請在檔案結尾加入一個空白換行，以符合 POSIX 標準。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": ".gitea/ai-review/findings.json",
-    "suggestion": "檔案最後缺少換行符號，請在檔案結尾加入一個空白換行。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "app/config.js:12-13",
-    "suggestion": "`checks` 陣列每一行超過 120 個字元，請拆成多行並對齊欄位，以符合常見的行長限制。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "app/config.js:13",
-    "suggestion": "`amazonq` 那一行的空格對齊與其他項目不一致，請統一使用單一個空格分隔欄位或使用對齊工具保持列的垂直對齊。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "app/config.test.js",
-    "suggestion": "檔案最後缺少換行符號，請在檔案結尾加入空白換行。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md:28",
-    "suggestion": "文件中章節編號不連續（例如 `### 2. OpenRouter` 後直接跳到 `### 3. Anthropic Claude`），請重新編號或使用自動編號方式，保持編號連續。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md:42",
-    "suggestion": "標題層級使用不一致，部分章節使用 `### 1.`、`### 2.`，而後面的章節直接跳到 `### 3.`，建議統一使用相同層級的 Markdown 標題，並在每個標題後留一個空行以提升可讀性。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "action.yaml:72-99",
-    "suggestion": "大量移除的輸入欄位留下多行空白與註解，請整理檔案結構，移除不必要的空行與註解，保持檔案整潔。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/findings.js:150",
-    "suggestion": "在 `filterFalsePositivesWithAI` 中，當 AI 回傳空陣列時拋出錯誤，可能導致上層流程中斷。建議改為回傳原始 `findings` 或提供更具體的錯誤類別，並在文件中說明此行為，以提升錯誤處理的可預測性。",
+    "location": ".gitea/workflows/review.yaml:36",
+    "suggestion": "GEMINI_API_KEY 的值過長，影響可讀性。雖然這是為了傳遞多個 Secret，但建議考慮是否有其他方式可以讓設定檔更簡潔，例如將多個 Secret 組合為一個，或在 Action 內部處理多個獨立的 Secret 變數（如果 Action 支援）。如果沒有其他方式，請考慮將其分行以提高可讀性（雖然 YAML 可能會將其視為單行）。",
     "is_new": false
   },
   {
-    "level": "info",
-    "role": "Zara",
-    "location": "app/findings.js",
-    "suggestion": "在 filterFalsePositivesWithAI 中，若 AI 回傳的陣列非常大，建議在回傳前加入分頁或限制筆數，避免一次性載入過多資料導致記憶體使用量激增。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Zara",
-    "location": "app/config.js",
-    "suggestion": "對於未設定 API 金鑰的 provider（如 ollama），可提前返回快取的預設設定，避免每次呼叫都進行條件檢查。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Rex",
-    "location": "README.md:28",
-    "suggestion": "文件中列出的權限說明應與實際 workflow 中的 permissions 保持一致，並提醒使用者僅在必要時授予 write 權限，避免在 CI/CD 環境中過度授權。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Rex",
-    "location": "app/config.js:12",
-    "suggestion": "在取得 LLM 設定時，若 key 為空字串仍會被視為有效。建議在判斷前先檢查 key 是否為非空字串，以防止意外使用空的 API 金鑰發送請求。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js",
-    "suggestion": "匯入語句過長，建議改寫為多行匯入，例如：\n```js\nimport {\n  describe,\n  it,\n  beforeEach,\n  afterEach\n} from 'node:test';\n```",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js",
-    "suggestion": "`ENV_KEYS` 陣列過長，建議分行列舉，每行放置一個環境變數，以提升可讀性。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/findings.js",
-    "suggestion": "錯誤訊息 `AI 回傳空陣列或非陣列` 可簡化為 `AI 回傳的結果不是有效的非空陣列`，讓訊息更清晰。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/config.js:12",
-    "suggestion": "`checks` 陣列的每一行過長，超過 120 個字元，建議拆成多行並對齊欄位，以符合程式碼可讀性與行長限制的慣例。",
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/llm.test.js",
+    "suggestion": "在 `llm.test.js` 中，`TODO.md` 驗收標準明確要求驗證「key[N/M] 失敗」和「所有 API Key 均失敗，終止流程」的日誌訊息。目前的測試雖然驗證了 `process.exit(1)` 的調用，但並未對 `console.log` 和 `console.error` 的輸出進行模擬和斷言。建議使用 `mock.method(console, 'log', ...)` 和 `mock.method(console, 'error', ...)` 來捕獲並驗證這些重要的日誌訊息，確保系統在 API Key 輪替失敗時能提供清晰的診斷資訊。",
     "is_new": true
   },
   {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/findings.js:151",
-    "suggestion": "函式內使用 `console.log` 輸出過濾結果，可能在正式環境產生過多日誌。建議改以 logger 並提供可設定的 log level，或在非除錯模式下移除此輸出。",
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/llm.test.js",
+    "suggestion": "針對 API Key 輪替的錯誤處理，`TODO.md` 驗收標準中提到「模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等）」。目前的測試僅使用 `new Error('fail')` 進行通用錯誤模擬。建議擴展測試案例，模擬 `axios` 拋出帶有特定 HTTP 狀態碼（如 401, 429）的錯誤，以及模擬網路超時（例如 `axios.isAxiosError` 且 `e.code === 'ECONNABORTED'`），以確保 API Key 輪替機制在面對不同類型的 API 錯誤時都能穩健運作。",
     "is_new": true
   },
   {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/config.test.js:1",
-    "suggestion": "匯入語句過長，建議改寫為多行匯入，以提升可讀性，例如：\n```js\nimport {\n  describe,\n  it,\n  beforeEach,\n  afterEach\n} from 'node:test';\n```",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/config.test.js:9",
-    "suggestion": "`ENV_KEYS` 陣列過長，建議分行列舉，每行放置一個環境變數，以提升可讀性與維護性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Zara",
-    "location": "app/findings.js:149",
-    "suggestion": "在 `filterFalsePositivesWithAI` 中，若 AI 回傳的陣列可能非常大，建議加入分頁或筆數上限（例如一次只處理前 500 筆），避免一次性載入過多資料導致記憶體使用激增。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js:1",
-    "suggestion": "匯入語句過長，建議改寫為多行匯入，例如：\n```js\nimport {\n  describe,\n  it,\n  beforeEach,\n  afterEach\n} from 'node:test';\n```",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js:7",
-    "suggestion": "`ENV_KEYS` 陣列過長，建議每行放置一個環境變數，分行列舉以提升可讀性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "在 `OPENAI_API_KEY` 後的註解前保留一個空格，以符合常見的 YAML 註解風格：`... ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入`。",
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/llm.js",
+    "suggestion": "`app/llm.js` 中的 `chatJSON` 函數依賴於 `chat` 函數的 API Key 輪替邏輯。雖然 `chat` 函數已新增測試，但 `chatJSON` 函數本身並未有專屬的測試案例。建議在 `app/llm.test.js` 中新增針對 `chatJSON` 的測試，特別是驗證在 API Key 輪替成功和失敗時，`chatJSON` 能正確處理 JSON 格式的回應，並在所有 Key 失敗時也能正確終止流程。",
     "is_new": true
   }
-]
+]

.gitea/workflows/master.yaml

@@ -25,4 +25,4 @@ jobs:
     - name: 清理成品
       uses: https://gitea.jsc.idv.tw/actions/cleanup-release@${{ vars.ACTION_CLEANUP_RELEASE_VERSION }}
       with:
-        RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }}
+        RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }}

.gitea/workflows/review.yaml

@@ -33,9 +33,9 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }}
       with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入
-        OPENAI_BASE_URL: https://openrouter.ai/api/v1
-        OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }}
+        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }}
+        GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
+        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
     permissions:
       contents: write
       pull-requests: write

.gitignore

@@ -0,0 +1 @@
+app/node_modules/

README.md

@@ -21,6 +21,7 @@
 3. Comment 加上些許 emoji 讓資訊有點活力
 4. 盡量將應用程式放在 ./app，修改 entrypoint.sh 與 Dockerfile 讓程式可以正常運行
 5. 將提示詞放到 ./app/prompts 內供程式讀取
+6. API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，全部失敗則 exit 1
 
 # 使用說明
 
@@ -42,7 +43,7 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}  # 支援逗號分隔多個 Key
         OPENAI_BASE_URL: https://api.openai.com/v1
         OPENAI_MODEL: ${{ vars.OPENAI_MODEL }}
     permissions:
@@ -65,7 +66,7 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入
+        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }},${{ secrets.OPENROUTER_API_KEY_1 }}
         OPENAI_BASE_URL: https://openrouter.ai/api/v1
         OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }}
     permissions:
@@ -88,7 +89,7 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }}
+        CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }}  # 支援逗號分隔多個 Key
         CLAUDE_BASE_URL: https://api.anthropic.com/v1
     permissions:
       contents: write
@@ -110,7 +111,7 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }}
         GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
         GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
     permissions:
@@ -133,7 +134,7 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        AMAZONQ_API_KEY: ${{ secrets.AMAZONQ_API_KEY }}
+        AMAZONQ_API_KEY: ${{ secrets.AMAZONQ_API_KEY }}  # 支援逗號分隔多個 Key
         AMAZONQ_BASE_URL: https://q.api.aws
     permissions:
       contents: write

TODO.md

@@ -35,6 +35,11 @@
 - 驗收：log 中能看到「critical 問題存在，workflow 結束（exit 1）」等明確訊息，且 workflow 狀態為失敗。
 - 完成
 
+## 階段八：API Key 輪替
+- 目標：所有平台的 API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。
+- 驗收：log 中能看到「key[N/M] 失敗」等訊息，換 key 後繼續執行；傳入單一 Key 時行為與原本相同；全部 Key 失敗時 log「所有 API Key 均失敗，終止流程」且 workflow 狀態為失敗。
+- 完成
+
 ---
 
 所有階段驗收通過。

action.yaml

@@ -72,8 +72,6 @@ inputs:
     description: 'Amazon Q Base URL'
     required: false
 
-
-
 runs:
   using: 'docker'
   image: 'Dockerfile'

app/comments.js

@@ -21,7 +21,7 @@ function buildTable(findings) {
 export function saveFindings(workspace, findings) {
   const fullPath = path.join(workspace, FINDINGS_PATH);
   fs.mkdirSync(path.dirname(fullPath), { recursive: true });
-  fs.writeFileSync(fullPath, JSON.stringify(findings, null, 2), 'utf8');
+  fs.writeFileSync(fullPath, JSON.stringify(findings, null, 2) + '\n', 'utf8');
   console.log(`  ✅ findings 寫入: ${fullPath} (${findings.length} 筆)`);
 }
 

app/config.js

@@ -8,16 +8,22 @@ export const PR_BASE_BRANCH = process.env.PR_BASE_BRANCH || '';
 export const FINDINGS_PATH = '.gitea/ai-review/findings.json';
 export const EXCLUSIONS_PATH = '.gitea/ai-review/exclusions.json';
 
+/** 將逗號分隔的 API key 字串拆成陣列 */
+function splitKeys(value) {
+  if (!value) return [];
+  return value.split(',').map(k => k.trim()).filter(Boolean);
+}
+
 export function getLLMConfig() {
   const checks = [
-    ['openai',   process.env.OPENAI_API_KEY,   process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',   process.env.OPENAI_MODEL || 'gpt-4o-mini'],
-    ['claude',   process.env.CLAUDE_API_KEY,   process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'],
-    ['gemini',   process.env.GEMINI_API_KEY,   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'],
-    ['ollama',   'ollama',                      process.env.OLLAMA_BASE_URL,  process.env.OLLAMA_MODEL],
-    ['amazonq',  process.env.AMAZONQ_API_KEY,  process.env.AMAZONQ_BASE_URL  || 'https://q.api.aws',              process.env.AMAZONQ_MODEL  || 'amazon-q'],
+    ['openai',   splitKeys(process.env.OPENAI_API_KEY),   process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',   process.env.OPENAI_MODEL || 'gpt-4o-mini'],
+    ['claude',   splitKeys(process.env.CLAUDE_API_KEY),   process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'],
+    ['gemini',   splitKeys(process.env.GEMINI_API_KEY),   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'],
+    ['ollama',   ['ollama'],                               process.env.OLLAMA_BASE_URL,  process.env.OLLAMA_MODEL],
+    ['amazonq',  splitKeys(process.env.AMAZONQ_API_KEY),  process.env.AMAZONQ_BASE_URL  || 'https://q.api.aws',              process.env.AMAZONQ_MODEL  || 'amazon-q'],
   ];
-  for (const [provider, key, baseURL, model] of checks) {
-    if (key && baseURL) return { provider, apiKey: key, baseURL, model };
+  for (const [provider, apiKeys, baseURL, model] of checks) {
+    if (apiKeys.length > 0 && baseURL) return { provider, apiKeys, baseURL, model };
   }
-  return { provider: null, apiKey: null, baseURL: null, model: null };
+  return { provider: null, apiKeys: [], baseURL: null, model: null };
 }

app/config.test.js

@@ -26,14 +26,14 @@ describe('getLLMConfig', () => {
   it('returns null provider when no env vars set', () => {
     const cfg = getLLMConfig();
     assert.equal(cfg.provider, null);
-    assert.equal(cfg.apiKey, null);
+    assert.deepEqual(cfg.apiKeys, []);
   });
 
   it('detects openai with defaults', () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     const cfg = getLLMConfig();
     assert.equal(cfg.provider, 'openai');
-    assert.equal(cfg.apiKey, 'sk-test');
+    assert.deepEqual(cfg.apiKeys, ['sk-test']);
     assert.equal(cfg.baseURL, 'https://api.openai.com/v1');
     assert.equal(cfg.model, 'gpt-4o-mini');
   });
@@ -48,7 +48,14 @@ describe('getLLMConfig', () => {
     assert.equal(cfg.model, 'gpt-4o');
   });
 
-  it('detects gemini with defaults', () => {
+  it('detects gemini with comma-separated keys, picks one', () => {
+    process.env.GEMINI_API_KEY = 'key1,key2,key3';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'gemini');
+    assert.deepEqual(cfg.apiKeys, ['key1', 'key2', 'key3']);
+  });
+
+  it('detects gemini with single key (no comma)', () => {
     process.env.GEMINI_API_KEY = 'gemini-key';
     const cfg = getLLMConfig();
     assert.equal(cfg.provider, 'gemini');

app/findings.js

@@ -117,33 +117,40 @@ export function loadExclusions(workspace) {
 
 /**
  * 套用排除規則，過濾掉符合排除條件的 findings
- * 排除條件：role/location/suggestion 皆符合（省略的欄位視為萬用）
+ * location 只比對檔案路徑（忽略行數），suggestion 省略時視為萬用
  */
 export function applyExclusions(findings, exclusions) {
   if (exclusions.length === 0) return findings;
   const before = findings.length;
-  const filtered = findings.filter(f => !exclusions.some(ex =>
-    (!ex.role || ex.role === f.role) &&
-    (!ex.location || String(f.location).includes(ex.location)) &&
-    (!ex.suggestion || String(f.suggestion).includes(String(ex.suggestion).slice(0, 20)))
-  ));
+  const filtered = findings.filter(f => !exclusions.some(ex => {
+    const fPath = String(f.location).split(':')[0];
+    const exPath = ex.location ? String(ex.location).split(':')[0] : null;
+    return (!exPath || fPath === exPath) &&
+           (!ex.role || ex.role === f.role);
+  }));
   console.log(`  排除過濾: ${before} -> ${filtered.length} 筆（排除 ${before - filtered.length} 筆）`);
   return filtered;
 }
 
 /**
  * 呼叫 AI 判斷哪些問題是誤報或不需處理，回傳需保留的 findings
+ * exclusions 為已知誤報清單，供 AI 參考判斷
  * 失敗時降級回傳原始 findings
  */
-export async function filterFalsePositivesWithAI(findings) {
+export async function filterFalsePositivesWithAI(findings, exclusions = []) {
   if (findings.length === 0) return findings;
 
+  const exclusionHint = exclusions.length > 0
+    ? `\n\n以下是已知的誤報或不需處理的問題清單（供參考，相同檔案路徑且語意相近的問題應一併排除）：\n${JSON.stringify(exclusions, null, 2)}`
+    : '';
+
   const systemPrompt = `你是一位資深程式碼審查專家，負責判斷審查問題是否為誤報或不需處理。
 給你一份問題清單（JSON 陣列），每筆包含 level、role、location、suggestion。
 請移除以下類型的問題：
 1. 誤報：問題描述與實際程式碼不符（例如：程式碼已正確使用環境變數或 secrets，卻被標記為硬編碼敏感資料）
 2. 不適用：問題在此專案情境下不需處理（例如：CI/CD action 本來就需要透過環境變數傳遞 token）
-只回傳需要保留的問題 JSON 陣列，不要有其他文字。`;
+3. 與已知誤報清單語意相近的問題（檔案路徑相同且建議內容相似）
+只回傳需要保留的問題 JSON 陣列，不要有其他文字。${exclusionHint}`;
 
   const userContent = `請判斷以下問題清單，移除誤報或不需處理的問題：\n\n${JSON.stringify(findings, null, 2)}`;
 

app/llm.js

@@ -1,27 +1,33 @@
 import axios from 'axios';
-import https from 'https';
 import { getLLMConfig } from './config.js';
 
-const httpsAgent = new https.Agent({ rejectUnauthorized: false });
-
 export async function chat(systemPrompt, userContent) {
-  const { provider, apiKey, baseURL, model } = getLLMConfig();
+  const { provider, apiKeys, baseURL, model } = getLLMConfig();
   if (!provider) throw new Error('未設定任何 LLM API Key');
 
   console.log(`  [LLM] provider=${provider} model=${model}`);
 
-  const headers = {
-    'Content-Type': 'application/json',
-    'Authorization': `Bearer ${apiKey}`,
-  };
+  const headers = { 'Content-Type': 'application/json' };
   if (provider === 'claude') headers['anthropic-version'] = '2023-06-01';
 
-  const resp = await axios.post(
-    `${baseURL.replace(/\/$/, '')}/chat/completions`,
-    { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 },
-    { headers, timeout: 120000, httpsAgent }
-  );
-  return resp.data.choices[0].message.content;
+  const shuffled = [...apiKeys].sort(() => Math.random() - 0.5);
+  let lastError;
+  for (let i = 0; i < shuffled.length; i++) {
+    if (provider !== 'ollama') headers['Authorization'] = `Bearer ${shuffled[i]}`;
+    try {
+      const resp = await axios.post(
+        `${baseURL.replace(/\/$/, '')}/chat/completions`,
+        { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 },
+        { headers }
+      );
+      return resp.data.choices[0].message.content;
+    } catch (e) {
+      lastError = e;
+      console.log(`  [LLM] key[${i + 1}/${shuffled.length}] 失敗: ${e.message}`);
+    }
+  }
+  console.error('  [LLM] 所有 API Key 均失敗，終止流程');
+  process.exit(1);
 }
 
 export async function chatJSON(systemPrompt, userContent) {

app/llm.test.js

@@ -0,0 +1,153 @@
+import { describe, it, beforeEach, afterEach, mock } from 'node:test';
+import assert from 'node:assert/strict';
+
+// Mock axios before importing llm.js
+import axios from 'axios';
+
+const ENV_KEYS = [
+  'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_MODEL',
+  'GEMINI_API_KEY', 'GEMINI_BASE_URL', 'GEMINI_MODEL',
+  'CLAUDE_API_KEY', 'CLAUDE_BASE_URL', 'CLAUDE_MODEL',
+  'OLLAMA_BASE_URL', 'OLLAMA_MODEL',
+  'AMAZONQ_API_KEY', 'AMAZONQ_BASE_URL', 'AMAZONQ_MODEL',
+];
+
+let saved = {};
+beforeEach(() => {
+  saved = {};
+  for (const k of ENV_KEYS) { saved[k] = process.env[k]; delete process.env[k]; }
+});
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  mock.restoreAll();
+});
+
+function mockAxiosPost(responses) {
+  let call = 0;
+  mock.method(axios, 'post', async () => {
+    const r = responses[call++] ?? responses[responses.length - 1];
+    if (r instanceof Error) throw r;
+    return r;
+  });
+}
+
+function makeOkResponse(content = 'ok') {
+  return { data: { choices: [{ message: { content } }] } };
+}
+
+describe('chat - key rotation', async () => {
+  const { chat } = await import('./llm.js');
+
+  it('succeeds on first key', async () => {
+    process.env.OPENAI_API_KEY = 'key1';
+    mockAxiosPost([makeOkResponse('hello')]);
+    const result = await chat('sys', 'user');
+    assert.equal(result, 'hello');
+  });
+
+  it('shuffles keys and tries each exactly once', async () => {
+    process.env.OPENAI_API_KEY = 'key1,key2,key3';
+    const usedKeys = [];
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      usedKeys.push(opts.headers['Authorization'].replace('Bearer ', ''));
+      throw new Error('fail');
+    });
+    const exitMock = mock.method(process, 'exit', () => { throw new Error('exit:1'); });
+    await assert.rejects(() => chat('sys', 'user'), /exit:1/);
+    assert.equal(exitMock.mock.calls[0].arguments[0], 1);
+    assert.equal(usedKeys.length, 3);
+    assert.deepEqual([...usedKeys].sort(), ['key1', 'key2', 'key3']);
+  });
+
+  it('calls process.exit(1) when all keys fail', async () => {
+    process.env.OPENAI_API_KEY = 'k1,k2';
+    mockAxiosPost([new Error('fail'), new Error('fail')]);
+    const exitMock = mock.method(process, 'exit', () => { throw new Error('exit:1'); });
+    await assert.rejects(() => chat('sys', 'user'), /exit:1/);
+    assert.equal(exitMock.mock.calls[0].arguments[0], 1);
+  });
+
+  it('does not set Authorization header for ollama', async () => {
+    process.env.OLLAMA_BASE_URL = 'http://localhost:11434/v1';
+    process.env.OLLAMA_MODEL = 'llama3';
+    let capturedHeaders;
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      capturedHeaders = opts.headers;
+      return makeOkResponse('ollama response');
+    });
+    await chat('sys', 'user');
+    assert.equal(capturedHeaders['Authorization'], undefined);
+  });
+
+  it('sets Authorization header for openai', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    let capturedHeaders;
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      capturedHeaders = opts.headers;
+      return makeOkResponse();
+    });
+    await chat('sys', 'user');
+    assert.equal(capturedHeaders['Authorization'], 'Bearer sk-test');
+  });
+
+  it('does not set timeout', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    let capturedOpts;
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      capturedOpts = opts;
+      return makeOkResponse();
+    });
+    await chat('sys', 'user');
+    assert.equal(capturedOpts.timeout, undefined);
+  });
+
+  it('does not pass httpsAgent to axios', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    let capturedOpts;
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      capturedOpts = opts;
+      return makeOkResponse();
+    });
+    await chat('sys', 'user');
+    assert.equal(capturedOpts.httpsAgent, undefined);
+  });
+
+  it('sets anthropic-version header for claude', async () => {
+    process.env.CLAUDE_API_KEY = 'claude-key';
+    let capturedHeaders;
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      capturedHeaders = opts.headers;
+      return makeOkResponse();
+    });
+    await chat('sys', 'user');
+    assert.equal(capturedHeaders['anthropic-version'], '2023-06-01');
+  });
+});
+
+describe('chatJSON', async () => {
+  const { chatJSON } = await import('./llm.js');
+
+  it('parses plain JSON response', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    mockAxiosPost([makeOkResponse('[{"level":"critical"}]')]);
+    const result = await chatJSON('sys', 'user');
+    assert.deepEqual(result, [{ level: 'critical' }]);
+  });
+
+  it('strips markdown code block before parsing', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    mockAxiosPost([makeOkResponse('```json\n[{"level":"info"}]\n```')]);
+    const result = await chatJSON('sys', 'user');
+    assert.deepEqual(result, [{ level: 'info' }]);
+  });
+
+  it('returns [] when JSON is invalid', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    mockAxiosPost([makeOkResponse('not json')]);
+    const result = await chatJSON('sys', 'user');
+    assert.deepEqual(result, []);
+  });
+});

app/main.js

@@ -85,7 +85,7 @@ async function main() {
   console.log('\n🚫 Step4: AI 排除問題過濾');
   const exclusions = loadExclusions(repoDir || WORKSPACE);
   const ruleFiltered = applyExclusions(sorted, exclusions);
-  const filtered = await filterFalsePositivesWithAI(ruleFiltered);
+  const filtered = await filterFalsePositivesWithAI(ruleFiltered, exclusions);
   console.log(`  Step4 完成: findings total=${filtered.length}`);
 
   // Step5: 寫入 findings.json，依序發布 comment

app/package-lock.json

@@ -0,0 +1,468 @@
+{
+  "name": "ai-code-review",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "ai-code-review",
+      "version": "1.0.0",
+      "dependencies": {
+        "axios": "^1.6.7",
+        "js-yaml": "^4.1.0",
+        "openai": "^4.28.0"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "18.19.130",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz",
+      "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==",
+      "dependencies": {
+        "undici-types": "~5.26.4"
+      }
+    },
+    "node_modules/@types/node-fetch": {
+      "version": "2.6.13",
+      "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.13.tgz",
+      "integrity": "sha512-QGpRVpzSaUs30JBSGPjOg4Uveu384erbHBoT1zeONvyCfwQxIkUshLAOqN/k9EjGviPRmWTTe6aH2qySWKTVSw==",
+      "dependencies": {
+        "@types/node": "*",
+        "form-data": "^4.0.4"
+      }
+    },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/agentkeepalive": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
+      "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
+      "dependencies": {
+        "humanize-ms": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 8.0.0"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+    },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
+    },
+    "node_modules/axios": {
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz",
+      "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==",
+      "dependencies": {
+        "follow-redirects": "^1.16.0",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^2.1.0"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/follow-redirects": {
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/RubenVerborgh"
+        }
+      ],
+      "engines": {
+        "node": ">=4.0"
+      },
+      "peerDependenciesMeta": {
+        "debug": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/form-data": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/form-data-encoder": {
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-1.7.2.tgz",
+      "integrity": "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A=="
+    },
+    "node_modules/formdata-node": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/formdata-node/-/formdata-node-4.4.1.tgz",
+      "integrity": "sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==",
+      "dependencies": {
+        "node-domexception": "1.0.0",
+        "web-streams-polyfill": "4.0.0-beta.3"
+      },
+      "engines": {
+        "node": ">= 12.20"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/humanize-ms": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
+      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
+      "dependencies": {
+        "ms": "^2.0.0"
+      }
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+    },
+    "node_modules/node-domexception": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
+      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
+      "deprecated": "Use your platform's native DOMException instead",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "github",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
+      "engines": {
+        "node": ">=10.5.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
+      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/openai": {
+      "version": "4.104.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-4.104.0.tgz",
+      "integrity": "sha512-p99EFNsA/yX6UhVO93f5kJsDRLAg+CTA2RBqdHK4RtK8u5IJw32Hyb2dTGKbnnFmnuoBv5r7Z2CURI9sGZpSuA==",
+      "dependencies": {
+        "@types/node": "^18.11.18",
+        "@types/node-fetch": "^2.6.4",
+        "abort-controller": "^3.0.0",
+        "agentkeepalive": "^4.2.1",
+        "form-data-encoder": "1.7.2",
+        "formdata-node": "^4.3.2",
+        "node-fetch": "^2.6.7"
+      },
+      "bin": {
+        "openai": "bin/cli"
+      },
+      "peerDependencies": {
+        "ws": "^8.18.0",
+        "zod": "^3.23.8"
+      },
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/proxy-from-env": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
+    },
+    "node_modules/undici-types": {
+      "version": "5.26.5",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
+      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="
+    },
+    "node_modules/web-streams-polyfill": {
+      "version": "4.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz",
+      "integrity": "sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    }
+  }
+}

app/package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "type": "module",
   "scripts": {
-    "test": "node --test app/git.test.js"
+    "test": "node --test git.test.js config.test.js llm.test.js"
   },
   "dependencies": {
     "axios": "^1.6.7",