[
  {
    "level": "critical",
    "role": "Maya",
    "location": "app/index.js:1, 52, 58",
    "problem": "核心邏輯完全缺乏自動化測試。自動解衝突流程直接 commit 但缺乏對人工解衝突後正確性、以及對 build/test 結果的驗證，且 `createPull` 錯誤處理可能因 JSON 解析問題導致行為異常。",
    "suggestion": "建立完整的單元與整合測試架構。在建立解衝突分支並合併後，執行專案的建置指令或測試指令，並增強對 API 回傳錯誤的解析與處理。"
  },
  {
    "level": "critical",
    "role": "Maya",
    "location": "app/lib/git.js:106",
    "problem": "detectConflict 執行 git 合併失敗後的 abort 嘗試若失敗，會導致工作區殘留錯誤狀態，且未經測試。",
    "suggestion": "增加測試案例模擬 git 合併失敗與 abort 失敗的場景，確保狀態正確復原。"
  },
  {
    "level": "critical",
    "role": "Assassin",
    "location": "app/lib/opencode.js:180",
    "problem": "AI 模型產生的 PR 描述未經 sanitization，易遭 Prompt Injection 導致 Stored XSS 攻擊。",
    "suggestion": "在 `extractResult` 中對 `obj.description` 使用成熟的 HTML Sanitizer 過濾惡意標籤。"
  },
  {
    "level": "warning",
    "role": "Maya",
    "location": "app/index.js:114, 126",
    "problem": "diff 截斷邏輯與 fallbackSummary 處理邊界情況缺乏測試。",
    "suggestion": "補上針對 truncateDiff 及 commitMessages 為空/null 時的測試案例。",
    "is_new": false
  },
  {
    "level": "warning",
    "role": "Leo",
    "location": "app/lib/opencode.js:154",
    "problem": "summarize 函式使用了 5 分鐘固定 timeout，大型 diff 可能導致分析失敗。",
    "suggestion": "將 timeout 設定為可配置參數或根據 diff 大小動態計算。"
  },
  {
    "level": "warning",
    "role": "Mage",
    "location": "app/lib/opencode.js:127",
    "problem": "`summarize` 方法中使用 `spawnSync` 執行指令，未處理退出訊號可能導致清理競態。",
    "suggestion": "明確處理 `spawnSync` 的退出訊號，並確保清理操作是原子性的。"
  },
  {
    "level": "warning",
    "role": "Maya",
    "location": "app/lib/git.js:145",
    "problem": "合併衝突後未檢查是否存在殘留衝突標記。",
    "suggestion": "在 `git add` 之後，使用 grep 掃描檔案中是否仍有未處理的衝突標記。"
  },
  {
    "level": "info",
    "role": "Maya",
    "location": "app/index.js:150",
    "problem": "缺乏測試案例驗證 fallbackSummary 的結果是否符合預期格式。",
    "suggestion": "補上單元測試，驗證 fallbackSummary 在不同輸入下的產出格式。",
    "is_new": false
  },
  {
    "level": "info",
    "role": "Maya",
    "location": "app/lib/opencode.js:176",
    "problem": "缺乏單元測試驗證 `extractResult` 對非標準 JSON 的解析能力。",
    "suggestion": "補上單元測試，驗證 extractResult 能否正確解析壞 JSON。",
    "is_new": false
  },
  {
    "level": "info",
    "role": "Assassin",
    "location": "app/lib/opencode.js:77",
    "problem": "傳遞整個 `process.env` 導致敏感環境變數暴露。",
    "suggestion": "明確篩選並只傳遞必要環境變數。"
  },
  {
    "level": "info",
    "role": "Bard",
    "location": "Dockerfile:16",
    "problem": "在 RUN 指令中使用 cd 切換目錄，導致環境隱晦。",
    "suggestion": "使用 `WORKDIR /app`。"
  },
  {
    "level": "info",
    "role": "Leo",
    "location": "app/lib/git.js:122",
    "problem": "臨時分支名稱可能衝突或殘留。",
    "suggestion": "產生臨時分支名稱時加入 process ID 或隨機字串，並在 finally 區塊清理。"
  },
  {
    "level": "info",
    "role": "Maya",
    "location": "app/index.js:77",
    "problem": "解衝突的 PR 產出缺乏人工檢查機制。",
    "suggestion": "加入「檢查清單（Checklist）」要求人工確認。"
  },
  {
    "level": "info",
    "role": "Rogue",
    "location": "app/lib/opencode.js:40",
    "problem": "頻繁寫入讀取 `opencode.json` 設定檔造成無謂的 I/O。",
    "suggestion": "若支援，透過參數或環境變數傳入配置。"
  }
]