`CODEX_REREVIEW.md`

29 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
`server.py:23` — hardcoded Spoonflower credential defaults — removed, but validation now happens at import and blocks unrelated local resize usage — BROKEN

`server.py:18`, `server.py:66`, `server.py:154`, `server.py:197`, `server.py:226` — hardcoded subprocess cwd — all subprocess calls now use `PROJECT_ROOT` — good

`server.py:119`, `server.py:174` — bad/missing JSON caused 500s — malformed/missing bodies now 400; non-object JSON can still 500 at `.get()` — concern

`server.py:291` — advertised public URL — now advertises localhost — good

`server.py:292` — public debug bind — now loopback with debug disabled — good

`SKILL.md:89` — embedded Gemini API key — now reads `process.env.GEMINI_API_KEY` and fails fast — good

`.env.example:1` — missing config docs — placeholders added, but app does not load `.env` — concern

## New issues introduced
`server.py:33` — missing Spoonflower env vars now raise during module import, so `/` and `/api/resize` cannot run without Spoonflower credentials even though local resize does not use them — P1

`server.py:23` — credentials are read only from process env; existing local `.env` will be ignored because no dotenv loader is present — P1

## Missed call-sites (same problem elsewhere)
`server.py:39` — project file serving still uses `send_from_directory('.', 'web-interface.html')`, so launching from outside the repo can still miss checkout-relative files

## Recommendations
- Move Spoonflower credential validation into `/api/spoonflower` and `/api/upload-to-spoonflower`, or load `.env` before the global check if startup must require credentials.
- Validate `get_json()` results are dicts before calling `.get()` on both JSON routes.