📋 Daily Codebase Review - 2026-02-08

[claude]

Executive Summary

Today's review found the codebase in good overall health with strong patterns for logging, theming, and testing. Key areas requiring attention include: (1) the useFrameworkReady hook missing its dependency array causing unnecessary re-renders, (2) Math.random() still used for invite code generation despite a tracked security issue, and (3) several uncleaned setTimeout calls that could cause memory leaks.

Health Score: B+

Justification: The codebase demonstrates mature architecture with 85% test coverage requirements, comprehensive privacy controls (Sentry PII stripping), and consistent patterns. Deductions for: technical debt in large components (SettingsContent.tsx at 2,088 lines), skipped tests, and minor security/performance gaps.

---

Top 5 Priority Items

1. 🐛 HIGH: Fix useFrameworkReady missing dependency array (hooks/useFrameworkReady.ts:10-12)

   • Effect runs on every render due to missing [] dependency array
   • Already tracked in 🐛 useFrameworkReady hook missing dependency array causes effect to run on every render #308 but not yet fixed

2. 🔒 MEDIUM: Replace Math.random() with crypto.getRandomValues() (app/(app)/(tabs)/profile/index.tsx:169)

   • Invite code generation uses insecure Math.random()
   • Already tracked in security: Replace Math.random() with crypto.getRandomValues() for invite codes #320 but not yet fixed

3. ⚡ MEDIUM: Fix setTimeout cleanup in meetings screen (app/(app)/(tabs)/program/meetings.tsx:111,119)

   • Two setTimeout calls without cleanup could cause state updates on unmounted components
   • Already partially tracked in perf: Add setTimeout cleanup and memoize date formatting in meetings screen #351 and perf: Fix unsafe setTimeout without cleanup in SettingsContent and meetings screen #363

4. 📝 LOW: Update README test coverage from 80% to 85% (README.md:73,116)

   • Documentation shows 80% coverage but jest.config.js requires 85%
   • Already tracked in docs: Update README test coverage threshold from 80% to 85% #323, docs: Update README test coverage percentage from 80% to 85% #355, docs: Update README test coverage from 80% to 85% #364

5. 🧪 LOW: Fix skipped tests (tests/app/program/meetings.test.tsx:106)

   • MeetingsScreen describe block is skipped (describe.skip)
   • Already tracked in test: Fix skipped MeetingsScreen tests in meetings.test.tsx #354, 🧪 Fix skipped MeetingsScreen tests #360

---

Detailed Findings by Category

1. Code Health & Technical Debt

Issue	Severity	Location	Status
SettingsContent.tsx is 2,088 lines	Medium	components/settings/SettingsContent.tsx	Tracked in #315, #346
TaskCreationSheet.tsx is 842 lines	Low	components/TaskCreationSheet.tsx	Not tracked
useFrameworkReady missing dep array	High	hooks/useFrameworkReady.ts:10-12	Tracked in #308
TODO comment in meetings test	Low	tests/app/program/meetings.test.tsx:105	Minor

SettingsContent.tsx Analysis:
The 2,088-line file includes multiple responsibilities: DevToolsSection, ThemeSection, ProfileSection, and more. Refactoring into focused modules is already tracked but remains open.

2. Security Audit

Issue	Severity	Location	Status
Math.random() for invite codes	Medium	app/(app)/(tabs)/profile/index.tsx:169	Tracked in #320
Hardcoded switch colors in onboarding	Low	app/onboarding.tsx:566-568, 593-595	Tracked in #349

Positive Findings:

• ✅ No hardcoded API keys or secrets in source code
• ✅ Environment variables properly used for sensitive config (supabase/config.toml)
• ✅ Comprehensive PII stripping in Sentry (lib/sentry-privacy.ts)
• ✅ console.log restricted by ESLint (except whitelisted files)
• ✅ Test files appropriately use mock tokens/passwords

3. Test Coverage Gaps

Issue	Severity	Location	Status
MeetingsScreen tests skipped	Medium	tests/app/program/meetings.test.tsx:106	Tracked in #354, #360
program-layout navigation test skipped	Low	tests/app/program-layout.test.tsx:174	Not tracked

Skipped Tests Found:

describe.skip('MeetingsScreen', ...) - meetings.test.tsx:106
it.skip('navigates to literature...') - program-layout.test.tsx:174

4. Documentation Freshness

Issue	Severity	Location	Status
README shows 80% coverage (should be 85%)	Low	README.md:73,116	Tracked in #323, #355, #364
README project structure outdated	Low	README.md:94-95	Not tracked

README Project Structure Issue:
Line 94-95 shows profile.tsx and steps/ under tabs, but current structure has:

• profile/ (directory, not file)
• program/ with sub-routes (steps moved here)

5. Dependency Health

Unable to run pnpm outdated or pnpm audit due to CI permissions. Manual review of package.json shows:

• Dependencies appear current for Jan 2026
• Expo 54, React Native 0.81, React 19 are recent versions
• No obvious outdated major versions visible

6. Performance Opportunities

Issue	Severity	Location	Status
setTimeout without cleanup	Medium	app/(app)/(tabs)/program/meetings.tsx:111,119	Tracked in #351, #363
setTimeout without cleanup	Low	components/settings/SettingsContent.tsx:607	Tracked in #363
setTimeout without cleanup	Medium	app/onboarding.tsx:137,171,196	Tracked in #363
setTimeout without cleanup	Medium	app/(app)/(tabs)/index.tsx:122	Needs investigation

Meetings Screen Example (meetings.tsx:108-122):

const handleLogMeeting = useCallback((date: string) => {
  dayDetailRef.current?.dismiss();
  setTimeout(() => {
    logMeetingRef.current?.present(date);
  }, 300);  // No cleanup - memory leak risk
}, []);

7. Consistency Check

Issue	Severity	Location	Status
Hardcoded hex colors in onboarding Switch	Low	app/onboarding.tsx:566-568, 593-595	Tracked in #349
Palette usage correctly isolated	N/A	constants/theme.ts	✅ Correct

Positive Findings:

• ✅ Palette colors properly isolated to constants/theme.ts only
• ✅ Components use useTheme() hook for colors
• ✅ Logger usage enforced (console.log banned)
• ✅ Consistent file organization pattern

---

Summary of Existing Issues Referenced

Many findings are already tracked in open issues:

• 🐛 useFrameworkReady hook missing dependency array causes effect to run on every render #308 - useFrameworkReady bug
• refactor: Split SettingsContent.tsx into focused components #315, refactor: Split SettingsContent.tsx (2,088 lines) into focused modules #346 - SettingsContent refactor
• security: Replace Math.random() with crypto.getRandomValues() for invite codes #320 - Math.random security
• docs: Update README test coverage threshold from 80% to 85% #323, docs: Update README test coverage percentage from 80% to 85% #355, docs: Update README test coverage from 80% to 85% #364 - README coverage update
• fix: Replace hardcoded Switch colors with theme colors in onboarding #349 - Hardcoded switch colors
• perf: Add setTimeout cleanup and memoize date formatting in meetings screen #351, perf: Fix unsafe setTimeout without cleanup in SettingsContent and meetings screen #363 - setTimeout cleanup
• test: Fix skipped MeetingsScreen tests in meetings.test.tsx #354, 🧪 Fix skipped MeetingsScreen tests #360 - Skipped MeetingsScreen tests

---

Recommendations

1. Prioritize 🐛 useFrameworkReady hook missing dependency array causes effect to run on every render #308 - The useFrameworkReady bug causes effects to run on every render
2. Close duplicate issues - Multiple issues track the same problems (e.g., docs: Update README test coverage threshold from 80% to 85% #323, docs: Update README test coverage percentage from 80% to 85% #355, docs: Update README test coverage from 80% to 85% #364 all about README coverage)
3. Address security: Replace Math.random() with crypto.getRandomValues() for invite codes #320 - Security issue with Math.random() for invite codes
4. Complete perf: Fix unsafe setTimeout without cleanup in SettingsContent and meetings screen #363 - setTimeout cleanup needed in multiple files

---

🤖 Generated by Daily Codebase Review workflow

[coderabbitai]

🔗 Related PRs

#165 - refactor: rename app from Sobriety Waypoint to Sobers [merged]
#216 - feat: add What's New popup for release announcements [merged]
#217 - Release v1.2.0 [merged]
#221 - test: increase test coverage across multiple components [merged]
#334 - Release: Analytics migration, 12-Step content toggle, and dependency updates [merged]

---

📝 Issue Planner

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!