`yolo-agent/rereview.md`

24 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
server.js:18 — hardcoded Basic Auth defaults — now fail-fast env vars — STATUS concern  
server.js:605 — JSON body destructuring failures — guards added to `/api/task`, `/api/run`, `/api/mode`, `/api/cooldown` — STATUS good  
server.js:1051 — public bind — now binds `127.0.0.1` — STATUS concern  
ledger-app/src/lib/xfetch.ts:18, dashboard/task-ledger.html:584, ledger-dist/assets/index-BwgB1DeC.js:149 — embedded browser auth — now uses browser credentials — STATUS good  
create-missing-collections.js:15, scripts/collection-descriptions.js:17 — hardcoded Slack/Gemini/dashboard auth — env fail-fast added — STATUS concern  
scripts/body-html-cleanup.js:72 — unescaped generated HTML/root paths — escaping and project-relative paths added — STATUS good  
scripts/collection-image-refresh.js:91, orphan-audit.js:188 — `/root` output paths — project-relative paths added — STATUS good  
.env.example:1 — required config docs — placeholder keys only — STATUS concern

## New issues introduced
create-missing-collections.js:3 — new `.env` loading depends on `dotenv`, but `package.json:9` dependencies do not include `dotenv`; the catch hides the import failure, so copying `.env.example` will not satisfy the new fail-fast env checks — severity P1  
scripts/collection-descriptions.js:3 — same missing `dotenv` dependency makes documented `.env` config ineffective for this script’s new required env vars — severity P1  
server.js:1051 — bind changed to loopback, but remote setup still advertises host-IP access at `setup-yolo-remote.sh:196`; a normal remote install will appear live but be unreachable except locally/through a tunnel — severity P2

## Missed call-sites (same problem elsewhere)
setup-yolo-remote.sh:196 — same public-dashboard assumption still present after server was made local-only

## Recommendations
- Add/install `dotenv` or remove the `.env` loader pattern and document that vars must be exported by the process manager.
- Update remote setup output to use `localhost` plus SSH tunnel instructions, or intentionally keep remote bind configurable.