Add read-only remove-debug-statement patches for JS/TS by braedonsaunders · Pull Request #110 · braedonsaunders/codeflow

braedonsaunders · 2026-10-19T14:32:06Z

Codeflow stays read-only. This adds the first patch-only refactor suggestion, remove-debug-statement, for JavaScript and TypeScript. A finding can show the proposed unified diff and download it as a .patch. Nothing in this change writes to the user's files: there is no File System Access write call and no write toggle. The user applies the patch themselves with git apply from the repo root.

Appliable

A site is included in the patch only when removing it cannot change program behaviour beyond dropping the debug side effect:

A standalone console.log(...), console.debug(...), or console.info(...) statement, including a multi-line call, when that statement is the only code on its lines and the callee is the global console.
A standalone debugger; statement on the same terms.
The same statements inside a braced function, if, loop (including for await), or arrow body.

Paths in the diff are repo-relative (a/src/app.js), so git apply works from the repo root. Context and deletion lines keep a trailing CR when the source line used CRLF, including files that mix CRLF and LF, so the patch applies to the original bytes. Each statement has its own patch (against the original file). A file patch and one combined patch remove every safe statement in that file or in the whole analysis, with hunk line numbers adjusted together.

Report-only

These stay visible with a short reason and are left out of every patch:

Part of an expression (return console.log(...), an argument, an assignment, a template substitution, a tagged template on the next line, or a TypeScript as / satisfies continuation).
The body of a one-line if, else, loop, do, with, or arrow without braces, including the sole unbraced body of for await (...).
A call through a local console binding (parameter, import, declaration, catch, class name, export default function / class name, a with body, or a TypeScript namespace, module, or enum, including const enum and a qualified name such as Foo.console). Identifier escapes (\uXXXX and \u{...}) are decoded, so \u0063onsole is that same binding. A malformed identifier escape leaves the file report-only. A member call such as logger.console.log(...) stays report-only.
A statement with a trailing comment, so // @ts-ignore, // eslint-disable-next-line, // prettier-ignore, and any other trailing comment is not deleted. A next-line directive on the immediately previous line (@ts-ignore, @ts-expect-error, eslint-disable-next-line, prettier-ignore, biome-ignore, istanbul ignore next, c8 ignore next, and the same family) stays report-only, because deleting the statement would move it onto the following code. A directive comment on a line the patch would delete stays report-only too. A file-level directive that remains on its own line, such as // @ts-nocheck, does not block a later statement.
A console.* call in a sloppy scope that contains a direct eval(...) call, including (eval)(...) and ((eval))(...), because that call can create a function-scoped console. Nested functions in that scope stay report-only. The scope can still be patched when strict mode is established: an exact "use strict" prologue, a class body, an import or export declaration, or a .mjs / .mts file. Indirect eval ((0, eval), eval?.(), window.eval, eval.call) and new Function / Function(...) can replace the global console, so the whole file stays report-only.
Sharing a line with other code.
Following a label.
A JS/TS file that uses a bare CR as a line break. git apply splits the working tree on LF, so those bytes cannot be patched safely.
A debug-statement finding in a non-JS/TS file (unsupported language).

The existing Debug Statements security finding is unchanged: still one issue per file when console.log / console.debug / console.info appears more than three times, with the same severity and description. The JSON report adds a patch string on that finding only when a safe file patch exists. No existing export field is renamed or removed.

Recent analyses stored in IndexedDB keep the finding metadata (path, line, status, reason) but not source snippets or unified diffs. Patches are regenerated only while the live analysis still has file source.

Tests

npm test — 250 passed, 0 failed. The cases check that a simple file's patch applies with git apply, that a CRLF fixture and a mixed CRLF/LF fixture pass git apply --check and keep their original line endings, that risky files stay report-only (including unbraced for await, shadowed console bindings, escaped identifiers, tagged templates on the next line, a TypeScript namespace console, trailing and directive comments, and direct or indirect eval), that cached analyses drop snippets and diffs, and that the existing debug-statement finding and export fields are unchanged.

Security tab showing debug-statement diffs and download buttons

Manual test plan

Open index.html (or the deployed build of this branch) and analyze a local folder that contains a .js or .ts file like this:

function main() {
  console.log('one');
  console.log('two');
  console.info('three');
  console.debug('four');
  if (true) console.log('risky');
  debugger;
  return 1;
}

Open the Security tab. Confirm a "Debug statement patches" section lists the standalone console.* and debugger statements with a red unified-diff preview, and that if (true) console.log('risky') is marked report-only ("inside a one-line if without braces") with no download button.
Download one statement .patch, the file .patch, and "Download all .patch". From the repo root, run git apply --check on the combined patch, then git apply. Confirm only the safe statements are gone and the if line is still there.
Confirm Codeflow itself did not change any file before git apply.
Export the JSON report. A Debug Statements finding for that file should still have severity, title, description, file, path, line, and code, plus an added patch string. Other findings should not gain a patch field.

_{To show artifacts inline, enable in settings.}

Show a unified diff for standalone console.log, console.debug, console.info, and debugger statements, and let the user download a repo-relative .patch for git apply. Expression and braceless cases stay report-only. Codeflow still never writes source files. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

vercel · 2026-10-19T14:32:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codeflow	Ready	Preview	Oct 20, 2026 12:32pm UTC

chatgpt-codex-connector · 2026-10-19T14:32:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T12:38:59.892481Z	`9b89768`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6cb94eb46c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Cached analyses no longer keep source snippets or unified diffs from remove-debug-statement. The sole body of an unbraced for-await stays report-only, and calls through a shadowed or member console do too. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

cursor · 2026-10-19T16:52:42Z

@codex review

chatgpt-codex-connector · 2026-10-19T16:52:45Z

To use Codex here, create a Codex account and connect to github.

braedonsaunders · 2026-10-19T18:14:25Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9192b47ac8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Build unified diffs from the original line bytes so git apply matches CRLF, LF, and mixed files. Treat TypeScript namespace, module, and enum bindings named console as shadowing. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

cursor · 2026-10-19T20:27:17Z

@codex review

chatgpt-codex-connector · 2026-10-19T20:27:20Z

To use Codex here, create a Codex account and connect to github.

braedonsaunders · 2026-10-19T20:28:20Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5204930934

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

A newline before a template, as, or satisfies continues the call, so those sites stay out of the patch. Identifier escapes are decoded before resolving console, and a with body or export-default name that binds console stays report-only. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

cursor · 2026-10-19T22:32:07Z

@codex review

chatgpt-codex-connector · 2026-10-19T22:32:10Z

To use Codex here, create a Codex account and connect to github.

braedonsaunders · 2026-10-19T22:33:05Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f48d305ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

A trailing comment or a next-line directive is left report-only so a downloaded patch does not delete or retarget it. Sloppy scopes that contain a direct eval, and files that call indirect eval or Function, stay report-only unless strict mode is clear. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

cursor · 2026-10-20T00:25:51Z

@codex review

chatgpt-codex-connector · 2026-10-20T00:25:54Z

To use Codex here, create a Codex account and connect to github.

braedonsaunders · 2026-10-20T00:26:36Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54508d985d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

A debug line with its own semicolon can still be the only separator between an unterminated expression and a continuation token. Those sites stay report-only unless the preceding code ends in a semicolon or a statement brace. Writes to console, its methods, global hosts, and aliases make every console call in the file report-only. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

cursor · 2026-10-20T02:35:09Z

@codex review

chatgpt-codex-connector · 2026-10-20T02:35:12Z

To use Codex here, create a Codex account and connect to github.

braedonsaunders · 2026-10-20T02:37:15Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b9ea6b040

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Treat any destructure, alias, or host access that can capture console as report-only for the whole file. Build each site diff from one line split, and quote patch paths with git's C escapes so git apply accepts them. Co-authored-by: Braedon Saunders <braedonsaunders@users.noreply.github.com>

braedonsaunders · 2026-10-20T12:33:38Z

@codex review

chatgpt-codex-connector · 2026-10-20T12:38:58Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 9b89768a69

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread index.html

Comment thread index.html Outdated

Comment thread index.html

vercel Bot deployed to Preview October 19, 2026 16:52

View deployment

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread index.html Outdated

Comment thread index.html

vercel Bot deployed to Preview October 19, 2026 20:26

View deployment

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread index.html

Comment thread index.html Outdated

vercel Bot deployed to Preview October 19, 2026 22:34

View deployment

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread index.html

Comment thread index.html

vercel Bot deployed to Preview October 20, 2026 00:25

View deployment

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread index.html

Comment thread index.html

vercel Bot deployed to Preview October 20, 2026 02:34

View deployment

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread index.html

Comment thread index.html Outdated

Comment thread index.html Outdated

vercel Bot deployed to Preview October 20, 2026 12:32

View deployment

braedonsaunders merged commit b70af01 into main Oct 20, 2026
5 checks passed

braedonsaunders mentioned this pull request Oct 20, 2026

Feature Request: Refactoring Codebases #109

Open

Conversation

braedonsaunders commented Oct 19, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Appliable

Report-only

Tests

Manual test plan

Uh oh!

vercel Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

braedonsaunders commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

braedonsaunders commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

braedonsaunders commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

braedonsaunders commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

braedonsaunders commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

braedonsaunders commented Oct 19, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Oct 19, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading