fix: resolve all bugs across 6 source modules

[Rohan5commit]

Summary of fixes

This PR fixes all identified bugs across 6 source modules (25/25 tests passing).

Bug fixes

cli.py — 3 fixes

• --provider none now correctly sets no_llm=True instead of silently converting to "auto" (which still tried all LLM providers — the opposite of what the user intended)
• _extract_archive_root now reports entry names and counts on failure instead of an opaque error
• save_history exceptions are now logged via LOGGER.debug instead of silently swallowed

custom_rules.py — Rewritten (was the most broken)

• Replaced bare except Exception + print() with proper logging.warning()
• Added from __future__ import annotations and Path support
• Validates regex patterns at load time with graceful skip on invalid patterns
• Handles malformed rules (missing required keys) with per-rule error reporting
• Narrowed exception handling to (yaml.YAMLError, OSError)

analyzer.py + security.py — Deduplication

• Removed identical _is_test_file() duplicated in both files
• Both now import is_test_file() from scanner.py (single source of truth)

scanner.py — 1 addition

• Added is_test_file() as the canonical public function

history.py — Modernized

• Added from __future__ import annotations, docstrings
• Modern type hints (Dict→dict, List→list)
• Uses Path.open() with explicit encoding

Verification

• All 25 existing tests pass
• Smoke tests verify all imports, is_test_file(), load_custom_rules(), and get_history() work correctly

[Rohan5commit]

Additional commit: CVE-2026-64642 security fix

Upgraded Next.js from 16.2.9 (vulnerable) to 16.3.3 (patched) to resolve CVE-2026-64642 — a high-severity middleware/proxy bypass in App Router applications using Turbopack and single locale.

Also fixed package.json version specifier from ^15 (mismatched with lockfile) to ^16.2.11 to prevent future version drift.

• npm audit: 0 vulnerabilities
• Build passes on Next.js 16.3.3
• Vercel production deployment updated

[Rohan5commit]

CVE-2026-64641 (DoS via Server Actions) — already covered

Both CVE-2026-64641 (DoS via Server Actions) and CVE-2026-64642 (middleware bypass) are patched in the same Next.js release (16.2.11). Our upgrade to 16.3.3 in commit 9304d5d already covers both.

Verification:

• next@16.3.3 — both CVEs patched ✅
• npm audit — 0 vulnerabilities ✅
• No Server Actions or middleware in web/ — DoS vector not applicable ✅
• Vercel production deployment live with patched version ✅

[Rohan5commit]

CVE-2026-64649 (SSRF in Server Actions on custom servers) — addressed

Version coverage: Already patched by next@16.3.3 (patched in 16.2.11).

App-specific: No custom server and no Server Actions in web/ — the SSRF vector does not apply to this deployment.

New hardening: Added Strict-Transport-Security header (max-age=63072000; includeSubDomains; preload) to next.config.mjs as defense-in-depth.

Check	Result
next@16.3.3	✅ CVE-2026-64649 patched
npm audit	✅ 0 vulnerabilities
Custom server	✅ None (standard Vercel deployment)
Server Actions	✅ None in web/
HSTS header	✅ Added
Vercel production	✅ Live

[Rohan5commit]

CVE-2026-64645 (SSRF in rewrites) — addressed + 2 runtime bugs fixed

Version coverage: Already patched by next@16.3.3 (patched in 16.2.11).

App-specific: The only rewrite is internal (/api/roast -> /api/roast.py) with no attacker-controlled hostname — SSRF vector does not apply.

New fixes in this commit:

1. Missing import base64 — base64url_encode/decode functions used the base64 module but never imported it, causing a NameError crash at runtime when generating or decoding roast IDs.

2. Stale CORS origin — ALLOWED_ORIGINS referenced the old Vercel URL (roast-web-six.vercel.app) instead of the current production URL (roast-my-code-five.vercel.app), which would reject all cross-origin requests from the live site.

Check	Result
next@16.3.3	CVE-2026-64645 patched
npm audit	0 vulnerabilities
Python syntax	Valid
CORS origin	Updated to current production URL
Vercel production	Live

[Rohan5commit]

nanoid CVE-2026-67214 — already patched (stale alert)

nanoid@3.3.18 is installed — the patched version is 3.3.16. This alert is stale.

Dependency	Installed	Patched	Status
nanoid	3.3.18	>=3.3.16	Already patched
postcss	8.5.23	—	Latest
react	18.3.1	—	Latest
next	16.3.3	>=16.2.11	Patched

npm audit: 0 vulnerabilities
Vercel production: redeployed and live

[Rohan5commit]

CVE-2024-56326 (Jinja2 sandbox breakout) — pinned minimum version

Installed version: jinja2@3.1.6 (already patched)
Patched version: 3.1.5
Vulnerability: Sandbox breakout through indirect reference to format method

Fix: Pinned jinja2>=3.1.5 in both pyproject.toml and web/requirements.txt to prevent fresh installs from pulling a vulnerable version.

File	Before	After
pyproject.toml	"jinja2"	"jinja2>=3.1.5"
web/requirements.txt	jinja2	jinja2>=3.1.5

Tests: 25/25 passing
Web build: OK
Vercel: live