# CodeFlow Residual Findings

This document enumerates CodeFlow findings that remain after the
2026-04-16 cleanup pass and explains why each is intentionally not
addressed. It is a living document — update it when CodeFlow is re-run
or when a residual item becomes actionable.

## Accepted — scanner false positives after .codeflowignore

The `.codeflowignore` excludes the following file-type/area combinations
from secret, XSS, SQL-injection, and function-constructor scans:

- **Documentation** (`docs/**`, `README.md`, `AGENTS.md`, `CLAUDE.md`,
  `.claude/**/*.md`) — illustrative placeholders in MDX/Markdown are
  compile-time constants, not runtime code. Sanitized in PR 1 to
  angle-bracket sentinels so human reviewers aren't confused either.
- **CI/CD YAML** (`.github/**/*.yml`, `.depot/**/*.yml`) — GitHub
  Actions' `${{ secrets.X }}` and `${{ vars.Y }}` syntax is a reference
  to encrypted secrets, not a hardcoded credential. Scanner confuses it
  with SQL template interpolation.
- **Lockfiles** (`bun.lock`, etc.) — dependency-tracker content; not
  authored code.
- **Generated output** (`apps/**/dist/**`, `packages/**/dist/**`) — not
  in the repo's authored-code surface.
- **Submodule** (`eliza/**`, `plugins/**`) — tracked upstream; not our
  code to fix.
- **Test runners and build scripts** (`apps/app/test/design-review/**`,
  `apps/app/test/electrobun-packaged/**`, `apps/app/test/setup.ts`,
  `.github/trust-scoring.js`) — intentionally use `console.*`,
  `new Function()`, and shell spawns for controlled test/build logic.

## Accepted — code-level intentional patterns

### `apps/homepage/src/components/docs/Diagram.tsx` — `innerHTML` with sanitized SVG
Mermaid renders user-authored (MDX compile-time) Markdown into SVG; the
SVG is sanitized by DOMPurify (added in PR 3) and Mermaid is configured
with `securityLevel: "strict"`. Replacing `innerHTML` with
`dangerouslySetInnerHTML` does not reduce risk — it is the same primitive.
A React-native renderer for Mermaid SVG (e.g. via `react-svg` fetch
pattern) is possible future work.

### `apps/app/test/setup.ts` — `patchedEmit`
Installed as a side-effect into jsdom's window; not imported elsewhere.
CodeFlow's unused-function heuristic cannot see side-effect installs.
Annotated inline (PR 2).

### `escapeRegExp` duplication across 5 files
Each copy is a one-line utility (`str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")`).
Consolidation saves minimal code while introducing an import coupling
across otherwise-independent modules. Accepted duplication.

### `handleStorage` duplication across 4 files
Despite the shared name, each is a distinct `storage` event listener
with different business logic. Renaming them to be file-local-obvious
(e.g. `handleAgentStorageEvent`, `handleCloudLoginStorageEvent`) is a
future ergonomic polish.

## Deferred — bigger refactors tracked separately

### `eliza/packages/app-core/src/App.tsx` (886 lines, 49 imports)
Lives in the `eliza` submodule; requires an upstream elizaOS PR.
Decomposition into smaller feature slices is tracked as a separate
upstream contribution.

### `.github/trust-scoring.js` (858 lines, 19 console statements)
Self-contained CommonJS CLI with legitimate console output (designed to
run in CI where stdout is the only log surface). Splitting it into
scorer/reporter/io modules is a separate refactor.

## Dismissed — scanner category errors

### 5 reported "circular dependencies"
Spot-checked; all 5 are phantom:
- `setup.ts ↔ setup.ts` — self-reference (scanner bug).
- `setup.ts ↔ cloud-api.ts` — `cloud-api.ts` does not exist in the
  expected path.
- `App.tsx ↔ ConnectionModal.tsx` — ConnectionModal imports unrelated
  utilities; no import of App.
- `App.tsx ↔ useCloudLogin.ts` — same; no bidirectional import exists.
- `DocsLayout.tsx ↔ DocsSidebar.tsx` — one-directional import;
  DocsLayout imports DocsSidebar but not the reverse.

### 112 "Architecture Violations" (test → utils)
Tests legitimately import from test utilities. Scanner's layer map is
incorrect for a Bun monorepo. If CodeFlow supports a layer-config file,
map `test/**` as a peer to `utils/**`; otherwise accept.

### 139 "High Complexity Files"
Top offenders are `changelog.mdx` (928 lines), `bun.lock` (624), and CI
YAML (`agent-review.yml` at 256). None are authored code. After
`.codeflowignore` lands, this number drops to reflect real-code-only
complexity.