`Letsbegin/rereview.md`

28 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
`.env.example:1` — missing env documentation — placeholder keys added — STATUS good  
`lib/auth.ts:8` — hardcoded auth/session fallbacks — required env lookup added — STATUS good  
`lib/gemini-image.ts:7` et al. — hardcoded Gemini fallback — fail-fast env checks added — STATUS good  
`scripts/ralph-llm-runner.js:45` — hardcoded Gemini fallback — key now required before backend selection — STATUS broken  
`app/api/quickmode/route.ts:4` — hardcoded Postgres URL — required `DATABASE_URL` added — STATUS good  
`app/api/projects/scan/route.ts:6` — hardcoded admin fallback — required `ADMIN_PASSWORD` added — STATUS good  
`components/PRDGeneratorStep.tsx:339` — admin key exposed in browser — header removed; same-origin referer path still authorizes — STATUS good  
`CLAUDE.md:6` — documented real secrets — env-based examples now shown — STATUS good  
`app/api/prd/generate/route.ts:73`, `app/api/url-info/route.ts:31`, `app/api/quickmode/route.ts:32` — invalid JSON returned 500 — local 400 guards added — STATUS good  
`sync_brands_page.js:16` et al. — script secrets in source — env variables plus fail-fast checks added — STATUS good

## New issues introduced
`scripts/ralph-llm-runner.js:47` — requires `GEMINI_API_KEY_RALPH`/`GEMINI_API_KEY` even when `RALPH_LLM` defaults to `ollama` at `scripts/ralph-llm-runner.js:110`; this breaks documented/default Ollama runs without Gemini credentials — severity P1

## Missed call-sites (same problem elsewhere)
`app/api/prd/clarify/route.ts:75` — malformed JSON still falls into outer catch and returns 500  
`app/api/ralph/convert/route.ts:141` — malformed JSON still falls into outer catch and returns 500  
`app/api/claude/suggest/route.ts:130` — malformed JSON still falls into outer catch and returns 500  
`app/api/processes/analyze/route.ts:33` — malformed JSON still falls into outer catch and returns 500  
`app/api/processes/fix/route.ts:36` — malformed JSON still falls into outer catch and returns 500

## Recommendations
- Move the Ralph Gemini key check inside the Gemini backend path, after `LLM_BACKEND` is computed.
- Apply the same invalid-JSON guard pattern to remaining POST routes that call `request.json()`.