CodeRabbit Guide - Complete Reference

​

What’s new since config v2.5.0 (2026-02-05)

• Security tools: Explicit enable for OpenGrep, TruffleHog, Trivy (IaC/containers), and Stylelint (CSS/SCSS), alongside existing ESLint/Biome/Semgrep/OSV/etc.
• Secrets: gitleaks continues to run; CodeRabbit now uses the Betterleaks backend (comment in config).
• Slop detection: slop_detection.label: "ai-slop" for PR triage when suspicious patterns are flagged.
• Chat: allow_non_org_members: false so PR chat stays with org members (healthcare-appropriate default).
• Labels: core:cl, core:pm, and core:it added to labeling_instructions alongside existing core/platform labels.
• Auto-pause: auto_pause_after_reviewed_commits: 12 — reviews pause after twelve reviewed commits; resume with @coderabbitai review (tune to 0 if you need every push reviewed without pause).
• Knowledge base: Additional filePatterns for UI_CONSISTENCY_REVIEW.md and SPEC_COMMAND_CHEATSHEET.md.
• Product surface (reference): CodeRabbit continues to ship Skills/CLI integration, finishing touches (autofix/simplify flows where enabled), issue planner, and multi-repo analysis — see CodeRabbit changelog for the latest.

​

Config v2.8.0 (2026-06-28) — right-sizing + advisory posture

• Advisory posture: request_changes_workflow: false, fail_commit_status: false. CodeRabbit comments but does not block. Process rule: on high-value lanes (edge fns, migrations, regulated cores), read its comments before merging.
• Credit minimization: path_filters now exclude docs/**, specs/**, *.md, generated files, and the bulk of scripts/** (keeping scripts/database/** + scripts/security/** — the CI-gate logic). drafts: false; auto_pause_after_reviewed_commits: 12 → 3; base_branches: .* → [development, main]; issue auto_planning narrowed to opt-in labels (plan-me, ready-for-engine).
• Right-sizing: disabled dead-weight scanners with no surface in this repo (checkov, htmlhint, stylelint, trivy, languagetool); removed the Core Boundary and Code Quality (Deterministic) custom checks because npm run check-architecture and the northsight/require-usequery-freshness ESLint rule already enforce them as REQUIRED CI — leaving the 3 semantic checks (Multi-Tenant & RLS, PHI/PII, Jurisdiction & EKRA). Trimmed CI-redundant path_instruction bullets.
• Promoted a recurring bug class to credit-free CI: new scripts/database/check-view-security-invoker.ts in the migration-guard gate flags any newly-added migration that creates a view without security_invoker = on (the CL-69 #1892 PHI-leak class) — caught even when CodeRabbit is out of credits.
• Guide corrections: removed the non-existent balanced/strict profile values (only chill / assertive exist); fixed the early_access description; corrected review_instructions → path_instructions and paths.ignored_paths → path_filters in Troubleshooting.

​

Config v2.7.2 (2026-06-03)

• Bug fix — config parsing/schema-validation errors resolved: Two issues flagged by CodeRabbit’s schema validation were fixed in .coderabbit.yaml:
  • reviews.suggested_reviewers_instructions was authored as a free-text block scalar (string), but the v2 schema requires an array of { reviewers: [{ handle, type }], instructions } objects. It is now structured correctly, with bare GitHub handles (no leading @) and type: user. Add type: group entries for teams as the team grows (GitHub only).
  • reviews.instructions is not a field in the v2 schema and was being silently ignored. It was removed, and its guidance relocated to tone_instructions (security / multi-tenancy / PHI-PII priority — already present) plus path_instructions for docs/**/*.md (accuracy over markdown nits) and **/*.sh (correctness/idempotency over style; large-normalization transformation-logic focus).
• Stale comment corrected: the pre_merge_checks.custom_checks comment claimed maxItems 5; the current schema allows up to 50 custom checks (we use 5).
• How to verify: validate .coderabbit.yaml against schema.v2.json (the # yaml-language-server: $schema=... directive enables this in editors), or run @coderabbitai configuration on a PR to confirm CodeRabbit accepts the parsed config.

​

Config v2.7.1 (2026-06-02)

• Bug fix — custom ast-grep rules now run: tools.ast-grep.rule_dirs pointed at a non-existent rules/ directory, so the project’s custom rules were silently skipped. Corrected to eslint-rules/ (no-core-to-core-import.yml, no-console-log.yml, no-return-null-loading.yml).
• Presidio is now opt-in: As of 2026-05-08 the Microsoft Presidio analyzer no longer runs by default. The explicit presidio.enabled: true in .coderabbit.yaml is required — removing it silently disables PHI/PII scanning.
• New merge-blocking check — “Jurisdiction & EKRA Risk”: 5th pre_merge_checks.custom_checks entry (mode: error) promotes PF-96 hardcoding and EKRA referral risk from advisory path instructions to a blocking gate.
• Suggested reviewers aligned to CODEOWNERS: suggested_reviewers_instructions now routes high-risk and regulated-core paths to the CODEOWNERS owner (single maintainer today; swap in SME handles as the team grows).
• CLI minimum bumped to v0.5.0+: the coderabbit-review skill documents coderabbit doctor (diagnostics) and coderabbit review findings (replay cached findings without spending a new review).
• Bootstrap installs the CLI: scripts/setup/web-env-setup.sh now installs the CodeRabbit CLI (skip with --skip-coderabbit).

​

Org-level settings (CodeRabbit dashboard — not in .coderabbit.yaml)

• Global Overrides (shipped 2026-04-16): organization-wide enforcement settings that supersede per-repository .coderabbit.yaml. Use to guarantee a baseline (e.g. assertive profile, request-changes workflow, secret scanning) across all Encore-OS repos. Configure under Organization Settings → Global Overrides. Relevant here because knowledge_base.learnings.scope / issues.scope / pull_requests.scope are already global.
• Custom roles & permissions (2026-02-24) and the Custom Roles API (2026-05-31): per-resource access levels for who may override pre-merge checks. Pairs with our pre_merge_checks.override_requested_reviewers_only: true.
• Audit Logs (2026-03-25): tamper-resistant log of administrative actions, exportable via REST API — useful HIPAA evidence.

​

Owner runbook — make reviews actually run (dashboard)

1. Confirm the plan is Pro Plus. Several enabled features (custom pre-merge checks, finishing touches) silently no-op below Pro+. Organization Settings → Billing/Plan.
2. Enable the Usage-Based Add-On with auto-refill. Organization Settings → Usage / Add-On → turn on the add-on → set Auto-refill (refill threshold + top-off amount) and a monthly cap (~$500 to start;$0.25/reviewed file). This is what ends “prepaid credits exhausted” — over-limit reviews then continue instead of silently skipping.
3. Set up a Scheduled Report (HIPAA evidence). Organization Settings → Reports → Scheduled Reports → create a weekly or monthly report (review volume, findings, overrides) delivered to the owner / a shared inbox. Exportable, dated — cheap recurring compliance evidence. Record that it exists here once configured.
4. Decide funding vs. self-host. Work the recommendation + checklist in the cost analysis (confirm seat count; confirm a BAA with CodeRabbit; get an Enterprise/self-host quote). For a behavioral-health ERP the deciding factor is likely the BAA / in-perimeter / audit-log posture, not raw cost.

​

Table of Contents

1. Quick Start
2. Setup
3. Configuration
4. CLI Commands
5. Output Modes
6. Workflow Patterns
7. Reporting
8. Best Practices
9. Troubleshooting

​

Quick Start

​

Current Setup Status ✅

• ✅ CodeRabbit CLI: Installed (see coderabbit --version)
• ✅ Configuration: .coderabbit.yaml v2.7.0+ with custom checks, path instructions, ast-grep rules, and knowledge base
• ✅ Tools: ESLint, Biome, OXC, Gitleaks (Betterleaks), OpenGrep, TruffleHog, Trivy, Stylelint, Semgrep, OSV Scanner, SQLFluff, markdownlint, yamllint, shellcheck, and others (see .coderabbit.yaml)
• ✅ Profile: Assertive (comprehensive reviews)
• ✅ Knowledge Base: Root governance files (constitution.md, AGENTS.md, .cursor/BUGBOT.md, etc.) and auto-detected .cursorrules, AGENTS.md, .cursor/rules

​

Quick Commands

# Using aliases (recommended)
cr                  # Review all changes
cr-uncommitted      # Review only uncommitted changes
cr-plain            # Detailed feedback with suggestions
cr-quick            # Minimal output (token-efficient)

# Direct commands
coderabbit                          # Review all changes
coderabbit --type uncommitted       # Uncommitted only
coderabbit --plain                  # Detailed output
coderabbit --prompt-only            # Minimal output
coderabbit auth status              # Check auth status

​

Common Workflows

cr-uncommitted    # Quick review of changes
# Fix issues, then commit
git add .
git commit -m "Your message"

cr-review         # Comprehensive review
# Address feedback
git commit -m "Apply CodeRabbit suggestions"

cr-lovable              # Full report → reports/active/markdown/coderabbit-<timestamp>/
cr-lovable-uncommitted  # Uncommitted only
cr-lovable-show         # Same with output streamed to terminal
cr-lovable-prompt-only  # Same plus 00-PROMPT-ONLY.md (token-efficient)

cr-report              # Full detailed report (saved to reports/)
cr-report-quick        # Quick prompt-only report
cr-report-uncommitted  # Uncommitted changes report

​

Setup

​

Installation (WSL recommended on Windows)

# From repo root (recommended – uses project script that also configures PATH)
bash scripts/utils/install-coderabbit-wsl.sh
source ~/.bashrc
coderabbit auth login

curl -fsSL https://cli.coderabbit.ai/install.sh | sh
source ~/.bashrc
coderabbit auth login

1. Add this repo’s scripts/bin folder to your Windows user PATH:
   • Environment Variables → User (or System) → Path → Edit → New.
   • Add the full path to scripts\bin, e.g. C:\Users\YourName\encoreos-platform\scripts\bin.
   • OK and restart any open terminals.
2. From PowerShell/CMD, in your repo directory:
   coderabbit --version
   coderabbit --type uncommitted
   

coderabbit --version
coderabbit auth status
./docs/development/verify-coderabbit-setup.sh

​

Git Configuration (CRITICAL)

# In WSL terminal
git config --global core.autocrlf input

​

Performance Optimization

​

Option A: Keep Repository in Windows (Current Setup)

• ✅ Pros: Works with Windows IDEs, easy file access
• ⚠️ Cons: Slower file I/O performance in WSL
• Best for: When you primarily use Windows-based tools

​

Option B: Clone to WSL Filesystem (Recommended for Performance)

• ✅ Pros: Much faster file operations, better WSL performance
• ⚠️ Cons: Need to use VS Code Remote - WSL for editing
• Best for: When you want optimal CodeRabbit performance

# In WSL
cd ~
mkdir -p projects
cd projects
git clone <your-repo-url> encoreos-platform
cd encoreos-platform

​

VS Code Remote - WSL Integration (HIGHLY RECOMMENDED)

• Edit files in Windows VS Code UI
• Terminal runs in WSL (native performance)
• Seamless integration with CodeRabbit CLI
• Best of both worlds

1. Install Extension:
   • Open VS Code
   • Install “Remote - WSL” extension (ms-vscode-remote.remote-wsl)
2. Open Project in WSL:
   # In WSL terminal (use your repo path)
   cd /mnt/c/Users/JeremyBloom/encoreos-platform
   code .
   
   This opens VS Code in WSL mode automatically.
3. Use Integrated Terminal:
   • VS Code terminal will be WSL by default
   • Run coderabbit directly (PATH already configured)

​

Convenience Aliases

​

Quick Setup (Recommended)

bash scripts/setup-coderabbit-aliases.sh
source ~/.bashrc  # or ~/.zshrc

​

Manual Setup

# CodeRabbit aliases
alias cr='coderabbit'
alias cr-review='coderabbit --type all'
alias cr-uncommitted='coderabbit --type uncommitted'
alias cr-plain='coderabbit --plain'
alias cr-quick='coderabbit --prompt-only'

# Report generation aliases (plain text)
alias cr-report='mkdir -p reports && coderabbit --plain > reports/coderabbit-$(date +%Y%m%d-%H%M%S).txt 2>&1 && echo "✅ Report saved to reports/"'
alias cr-report-quick='mkdir -p reports && coderabbit --prompt-only > reports/coderabbit-quick-$(date +%Y%m%d-%H%M%S).txt 2>&1 && echo "✅ Quick report saved"'
alias cr-report-uncommitted='mkdir -p reports && coderabbit --type uncommitted --plain > reports/coderabbit-uncommitted-$(date +%Y%m%d-%H%M%S).txt 2>&1 && echo "✅ Uncommitted report saved"'

# Markdown report generation aliases (by severity)
# Replace /path/to/project with your actual project root path
# Use git root so aliases work from any subdir (setup script uses this pattern)
alias cr-lovable='cd "$(git rev-parse --show-toplevel)" && bash scripts/utils/generate-coderabbit-report.sh'
alias cr-lovable-uncommitted='cd "$(git rev-parse --show-toplevel)" && bash scripts/utils/generate-coderabbit-report.sh --type uncommitted'
alias cr-lovable-show='cd "$(git rev-parse --show-toplevel)" && bash scripts/utils/generate-coderabbit-report.sh --show'

source ~/.bashrc  # or ~/.zshrc

​

Recommended Setup for This Project

​

Option 1: Hybrid Approach (Recommended)

• Keep repository in Windows (current location)
• Use VS Code Remote - WSL for editing
• Run CodeRabbit from WSL terminal (via VS Code integrated terminal)
• Best of both worlds: Windows file access + WSL performance

​

Option 2: Full WSL Migration (Best Performance)

• Clone repository to ~/projects/ in WSL (e.g. encoreos-platform)
• Use VS Code Remote - WSL exclusively
• Maximum performance for CodeRabbit and git operations
• Access files from Windows: \\wsl$\Ubuntu\home\<user>\projects\

​

Setup Verification

./docs/development/verify-coderabbit-setup.sh

# Check installation
coderabbit --version

# Check authentication
coderabbit auth status

# Test review
coderabbit --type uncommitted

​

Configuration

​

Configuration File

• ✅ Multi-tenant healthcare platform security
• ✅ TypeScript/React/Supabase codebase
• ✅ Architecture boundary enforcement
• ✅ Security vulnerability detection

​

Key Settings

reviews:
  profile: "assertive"              # Comprehensive reviews
  request_changes_workflow: true
  high_level_summary: true
  high_level_summary_in_walkthrough: true
  poem: false
  in_progress_fortune: false
  collapse_walkthrough: true        # Cleaner PR view
  auto_review:
    enabled: true
    drafts: true                    # Review draft PRs too
  pre_merge_checks:                 # Quality gates before merge
    docstrings: { mode: "error", threshold: 70 }
    title: { mode: "error" }
    description: { mode: "error" }
    issue_assessment: { mode: "warning" }
    custom_checks: [ ... ]         # Core boundary, multi-tenant, RLS, PHI, code quality
  tools:                            # Static analysis
    eslint: { enabled: true }
    biome: { enabled: true }
    oxc: { enabled: true }
    gitleaks: { enabled: true }
    semgrep: { enabled: true }
    osvScanner: { enabled: true }
    sqlfluff: { enabled: true }
    markdownlint: { enabled: true }
    yamllint: { enabled: true }
    shellcheck: { enabled: true }
    actionlint: { enabled: true }
    # ... and others
  path_instructions: [ ... ]       # File-type specific reviews (SQL, edge functions, cores, etc.)

​

Review Profile

• Enterprise healthcare platform needs thorough reviews
• Catches critical security issues
• Enforces architecture boundaries
• Multi-tenant isolation validation

• chill: lenient — fewer, higher-confidence comments. Too lenient for healthcare/enterprise.
• assertive: ⭐ comprehensive — chosen for this platform.

⚠️ There is NO balanced or strict profile. The CodeRabbit v2 schema accepts only chill and assertive; any other value is rejected/ignored. (Corrected 2026-06-28 — the prior guide listed non-existent balanced/strict values, which would have silently broken the profile.)

​

Configuration Breakdown

​

Language & Access

language: "en-US"
early_access: true   # OPT INTO CodeRabbit beta/early-access features (e.g. custom finishing-touch
                     # recipes). true = MORE bleeding-edge, NOT "stable only" (prior comment was wrong).

• Language: English (US) for consistent terminology
• Early Access: Enabled for stable features only (per config comment)

​

Review Settings

reviews:
  high_level_summary: true    # Summary helps with large PRs
  review_status: true         # Status badges in PR
  collapse_walkthrough: true  # Cleaner PR view (walkthrough in collapsible section)
  auto_review:
    enabled: true             # Auto-review on PR creation
    drafts: true              # Review draft PRs too (catch issues early)

• High-level summary provides PR overview
• Auto-review ensures all PRs get reviewed
• Drafts are reviewed to catch issues early

​

Paths Configuration

• ✅ Source code (src/**)
• ✅ Database migrations (supabase/**)
• ✅ Tests (tests/**)
• ✅ Specifications (specs/**)
• ✅ Documentation (docs/**)
• ✅ Configuration files (*.yaml, *.json, *.ts)

• ❌ Dependencies (node_modules/**)
• ❌ Build artifacts (dist/**, build/**)
• ❌ Lock files (*.lock, bun.lockb)
• ❌ IDE configs (.vscode/**, .idea/**)
• ❌ Generated reports (reports/**)

• Dependencies are external code (not our responsibility)
• Build artifacts are generated (review source instead)
• Lock files are auto-generated
• Reports are CodeRabbit output (circular)

​

Knowledge Base

knowledge_base:
  - constitution.md          # Engineering guardrails (current: see docs/VERSIONS.md)
  - AGENTS.md                # AI agent instructions
  - AI_GUIDE.md              # Contribution guidelines (current: see docs/VERSIONS.md)
  - AGENTS.md      # Quick reference (current: see docs/VERSIONS.md)
  - README.md                 # Project overview
  - docs/architecture/...    # Architecture docs

• CodeRabbit understands our architecture rules
• Enforces core boundaries and import patterns
• Validates against our coding standards
• References integration patterns

​

Review Instructions

• ✅ Enforce core boundaries (no cross-core imports)
• ✅ Validate import paths (@/shared/, @/platform/)
• ✅ Check multi-tenancy (organization_id, RLS)
• ✅ Flag security issues (PHI handling, RLS patterns)
• ✅ Verify performance patterns (React.lazy, QueryClient)
• ✅ Reference key documents

​

Configuration Priority

1. Branch-specific .coderabbit.yaml (if exists in feature branch)
2. Main branch .coderabbit.yaml (fallback)
3. Organization defaults (if configured)
4. CodeRabbit defaults (last resort)

​

Customization

​

Adjust Review Strictness

reviews:
  profile: "chill"

reviews:
  profile: "assertive"   # the only other valid value — there is no "strict"/"balanced"

​

Add More Documentation

knowledge_base:
  code_guidelines:
    filePatterns:
      - "docs/fa/api-reference.md"
      - "specs/rh/RH-01-census-beds.md"
      - "**/MODULE_STANDARDS.md"

​

Customize Paths

paths:
  included_paths:
    - "scripts/**"
    - "tools/**"

paths:
  ignored_paths:
    - "*.test.ts.snap"
    - "coverage/**"

​

Tools Configuration

• Auto-detects eslint.config.js
• Catches linting violations
• Enforces code style

• Detects hardcoded secrets
• Critical for healthcare platform
• Aligns with secrets management policy

​

Path-Specific Instructions

• RLS policies on ALL business tables
• SECURITY DEFINER functions (prevent recursion)
• Multi-tenant isolation (organization_id, site_id)
• No hardcoded secrets
• Proper indexes for performance

• React.lazy() for route components
• Skeleton loaders (not null)
• useCurrentUser hook usage
• Static Supabase imports
• useEffect for side effects
• No direct core-to-core imports
• No PHI/PII logging
• Zod validation for forms

• JWT validation when using service role key
• Organization context extraction
• Organization_id filtering in ALL queries
• URL validation (prevent SSRF)
• CORS headers configured
• Error messages don’t leak PHI/PII
• Input validation on all parameters

• RLS policy coverage
• Multi-tenant test scenarios
• No hardcoded secrets
• Proper cleanup and isolation

​

What CodeRabbit Flags

• ❌ Missing JWT validation in edge functions
• ❌ Missing organization_id in queries
• ❌ SSRF vulnerabilities (no URL validation)
• ❌ Hardcoded secrets or API keys
• ❌ PHI/PII in logs or error messages

• ❌ Direct imports between cores
• ❌ Missing organization_id in business tables
• ❌ RLS policies without SECURITY DEFINER functions
• ❌ Direct route imports (should use React.lazy)

• ❌ return null for loading states
• ❌ Using useState for side effects
• ❌ Dynamic Supabase imports
• ❌ Missing error handling
• ❌ Non-null assertion operators (!)

​

CLI Commands

​

Command Options

​

Review Types

• --type uncommitted: Quick feedback on work-in-progress
• --type committed: Review staged/committed changes
• --type all: Comprehensive review (slower, more thorough)

​

Workflow Integration

​

Pre-Commit Reviews

# Review before committing
coderabbit --type uncommitted

# If satisfied, commit
git add .
git commit -m "Your message"

​

Post-Commit Reviews

# Review committed changes
coderabbit --type committed

# Review against specific branch
coderabbit --base develop --type committed

​

Output Modes

​

--prompt-only (Minimal, Token-Efficient)

• ✅ Minimal prompts for AI assistants
• ✅ Token-efficient (saves API costs)
• ✅ Quick summaries
• ❌ No detailed explanations
• ❌ No code snippets
• ❌ No context/background

• AI coding assistants (Cursor, GitHub Copilot)
• Quick checks during development
• When you need minimal output

Prompt for AI Agent:
File.tsx around line 10: fix the type error by adding proper typing.

​

--plain (Detailed Feedback)

• ✅ Detailed explanations
• ✅ Code snippets and examples
• ✅ Context and background
• ✅ Actionable suggestions
• ✅ More comprehensive
• ❌ Larger output (more tokens)

• Manual code reviews
• Understanding issues deeply
• Learning from feedback
• Comprehensive analysis

File: src/components/Button.tsx
Line: 10-15
Type: potential_issue
Severity: medium

Issue: Missing error handling in async function

The function `handleClick` performs an async operation but doesn't handle
potential errors. This could lead to unhandled promise rejections.

Current code:
```typescript
const handleClick = async () => {
  await submitForm();
  // No error handling
};

const handleClick = async () => {
  try {
    await submitForm();
  } catch (error) {
    console.error('Form submission failed:', error);
    // Handle error appropriately
  }
};

• Unhandled promise rejections can crash the application
• Users won’t see error feedback
• Debugging becomes difficult

### UI Reviews (Most Comprehensive)

**What you see in:** GitHub/GitLab PR reviews

**Output:**
- ✅ Most detailed explanations
- ✅ Interactive code review
- ✅ Inline comments on PR
- ✅ Rich formatting
- ✅ Code diffs with context
- ✅ Team collaboration features
- ✅ Review summaries
- ✅ Categorized findings

**Best for:**
- Team code reviews
- PR collaboration
- Comprehensive analysis
- Documentation and learning

### When to Use Each Mode

**Use `--prompt-only` (`cr-quick`) When:**
- ✅ Working with AI assistants
- ✅ Need quick feedback
- ✅ Want to save tokens/API costs
- ✅ Iterating quickly on code

**Use `--plain` (`cr-plain` or `cr-report`) When:**
- ✅ Manual code review
- ✅ Need detailed explanations
- ✅ Learning from feedback
- ✅ Comprehensive analysis
- ✅ Want to understand issues deeply

**Use UI Reviews When:**
- ✅ Creating pull requests
- ✅ Team collaboration
- ✅ Need interactive review
- ✅ Want inline comments
- ✅ Comprehensive documentation

### Recommended Workflow

**During Development:**
```bash
# Quick check (minimal output)
cr-quick

# If issues found, get details
cr-plain

# Detailed review
cr-plain

# Or generate report
cr-report

• CodeRabbit automatically reviews PRs in UI
• Most comprehensive feedback
• Team collaboration

​

Workflow Patterns

​

CodeRabbit + Lovable Workflow

​

Local Report Generation (cr-lovable)

bash scripts/utils/setup-coderabbit-aliases.sh
source ~/.bashrc   # or ~/.zshrc

• 00-SUMMARY.md — Overview, severity counts, top impacted files, priority actions
• 01-CRITICAL.md — Critical issues (security, architecture, data integrity)
• 02-MAJOR.md — Major issues
• 03-MINOR.md — Minor issues
• 04-TRIVIAL.md — Trivial suggestions
• 05-OUTSIDE-DIFF.md — Findings outside the diff (if any)
• 00-PROMPT-ONLY.md — Present only when run with --prompt-only; token-efficient prompts for AI agents

​

Manual Workflow (Alternative)

1. Make code changes
2. Generate CodeRabbit report (detailed)
3. Feed report to Lovable
4. Lovable reviews and applies fixes
5. Iterate until satisfied

​

Step-by-Step Process

1. Generate Detailed Report

cr-lovable              # All changes, output in reports/active/markdown/coderabbit-<timestamp>/
cr-lovable-uncommitted   # Uncommitted changes only
cr-lovable-prompt-only   # Same plus 00-PROMPT-ONLY.md for token-efficient prompts

cr-report
# or
coderabbit --plain > reports/coderabbit-report-$(date +%Y%m%d-%H%M%S).txt

• Runs CodeRabbit and parses output by severity
• Writes 00-SUMMARY.md, 01-CRITICAL.md through 05-OUTSIDE-DIFF.md in reports/active/markdown/coderabbit-<timestamp>/
• Optionally adds 00-PROMPT-ONLY.md when using --prompt-only
• Includes code snippets, explanations, and AI prompts in each severity file

2. Review the Report

# List report runs (markdown by severity)
ls -lt reports/active/markdown/

# Open latest report dir in VS Code
code reports/active/markdown/coderabbit-<timestamp>/
# Or find latest: code $(ls -td reports/active/markdown/coderabbit-* | head -1)

# View summary
cat reports/active/markdown/coderabbit-<timestamp>/00-SUMMARY.md

3. Feed to Lovable

Option A: Copy Report Content

1. Open the report file
2. Copy the entire content
3. Paste into Lovable chat with prompt:
   Please review this CodeRabbit report and apply the suggested fixes:
   
   [paste report content]
   

Option B: Reference the File

1. Upload the report file to Lovable
2. Use prompt:
   Review the CodeRabbit report in coderabbit-report-YYYYMMDD-HHMMSS.txt
   and apply all suggested fixes to the codebase.
   

4. Lovable Applies Fixes

• ✅ Read the CodeRabbit report
• ✅ Understand the issues
• ✅ Apply suggested fixes
• ✅ Update code accordingly
• ✅ Maintain code quality

5. Iterate

1. Regenerate report to verify fixes:
   cr-report
   
2. Check for remaining issues
3. Repeat if needed

​

Example Lovable Prompts

​

Basic Prompt

Review the CodeRabbit report in reports/coderabbit-report-YYYYMMDD-HHMMSS.txt
and apply all suggested fixes. Focus on:
- Critical security issues
- Architecture violations
- Performance problems
- Code quality improvements

​

Detailed Prompt

I've generated a CodeRabbit review report. Please:

1. Read the report: reports/coderabbit-report-YYYYMMDD-HHMMSS.txt
2. Review all findings
3. Apply fixes for:
   - Architecture violations (core boundaries, import paths)
   - Security issues (RLS, PHI handling)
   - Performance problems (React.lazy, QueryClient)
   - Code quality (type safety, error handling)
4. Maintain existing functionality
5. Follow our coding standards (constitution.md, AGENTS.md)

Report the changes you make.

​

Integration with Development Workflow

# 1. Make changes
# [edit code]

# 2. Generate report
cr-report

# 3. Feed to Lovable
# [paste report to Lovable]

# 4. Lovable applies fixes
# [Lovable works]

# 5. Verify
cr-report

# 6. Commit if clean
git add .
git commit -m "Apply CodeRabbit suggestions"

# 1. Complete feature
# [implement feature]

# 2. Comprehensive review
cr-report

# 3. Feed to Lovable for fixes
# [Lovable reviews and fixes]

# 4. Final verification
cr-report

# 5. Create PR
git push
# CodeRabbit auto-reviews in UI

​

When to Run Reviews

• Before committing significant changes
• After implementing a feature
• Before creating a pull request
• When refactoring code

• Documentation-only changes
• Simple formatting fixes
• Generated files

​

Reporting

​

Quick Methods

​

Method 1: Simple Output Redirection

# Review all changes and save to file
coderabbit --plain > coderabbit-report.txt

# Review uncommitted changes and save
coderabbit --type uncommitted --plain > coderabbit-report.txt

# Review with timestamp in filename
coderabbit --plain > "coderabbit-report-$(date +%Y%m%d-%H%M%S).txt"

​

Method 2: Save Both Output and Errors

coderabbit --plain > coderabbit-report.txt 2>&1

​

Method 3: View and Save Simultaneously

coderabbit --plain | tee coderabbit-report.txt

​

Parse AI prompts from an existing PR

• Node parser: GITHUB_TOKEN with repo (or public_repo for public repos). For local runs, add GITHUB_TOKEN=ghp_... to .env.local (gitignored); the npm script loads it automatically.
• Bash script: GitHub CLI (gh) authenticated (gh auth login).

# CodeRabbit-only, with consolidated prompt (Node)
npm run parse-pr-coderabbit -- 346
# Output: reports/active/pr-346-parsed/ (includes 06-AI-PROMPT-CONSOLIDATED.md)

# All reviewers, with consolidated prompt (Bash)
bash scripts/utils/generate-pr-review-report.sh 346
# Output: reports/active/markdown/PR-346-coderabbit-<timestamp>/ (includes 05-AI-PROMPT-CONSOLIDATED.md)

# With GITHUB_TOKEN in .env.local (Node)
npm run parse-pr-coderabbit -- 282
npm run parse-pr-coderabbit -- 282 reports/active/pr-282

# Or pass token inline (Node)
GITHUB_TOKEN=ghp_xxxx npm run parse-pr-coderabbit -- 282

​

Report Types

​

Quick Report (--prompt-only)

• ✅ Minimal output (token-efficient)
• ✅ Quick to generate
• ✅ Designed for AI assistants
• ❌ No detailed explanations
• ❌ No code snippets
• ❌ Limited context

• Quick checks during development
• AI assistant integration
• When you need minimal output

​

Detailed Report (--plain)

• ✅ Detailed explanations
• ✅ Code snippets included
• ✅ Context provided
• ✅ Actionable suggestions
• ✅ Issue categorization
• ❌ Larger file size
• ❌ Takes longer to generate

• Manual code reviews
• Feeding to Lovable
• Understanding issues deeply
• Comprehensive analysis

​

Report Comparison

​

For Lovable Workflow

​

✅ Use Detailed Report

• Lovable needs context to understand issues
• Code snippets help Lovable see the problem
• Detailed explanations guide fixes
• Better results with more information

cr-report          # Generate detailed report

​

❌ Don’t Use Quick Report

• Too minimal for Lovable
• Lacks context
• No code snippets
• Harder for Lovable to understand

​

Report Organization

​

Recommended Directory Structure

reports/
├── coderabbit-report-20250110-143022.txt
├── coderabbit-report-20250110-150145.txt
└── README.md

​

Using Aliases for Reports

• Create reports/ directory if needed
• Generate timestamped filenames
• Save both output and errors
• Provide confirmation message

# Plain text reports
cr-report              # Generate plain text report in reports/ directory
cr-report-uncommitted  # Plain text report for uncommitted only
cr-report-quick        # Quick prompt-only report

# Markdown reports (organized by severity)
cr-lovable             # Generate markdown report by severity (all changes)
cr-lovable-uncommitted # Markdown report for uncommitted changes
cr-lovable-show        # Generate markdown report and show output

• 00-SUMMARY.md - Overview with counts and top impacted files
• 01-CRITICAL.md - Critical issues (security, data integrity)
• 02-MAJOR.md - Major issues (architecture, multi-tenancy)
• 03-MINOR.md - Minor issues (code quality, best practices)
• 04-TRIVIAL.md - Trivial issues (refactoring suggestions)
• 05-OUTSIDE-DIFF.md - Issues outside the diff (if any)

​

Best Practices

​

1. Use Timestamps

coderabbit --plain > "report-$(date +%Y%m%d-%H%M%S).txt"

​

2. Organize Reports

mkdir -p reports
coderabbit --plain > reports/coderabbit-report.txt

​

3. Include Context

{
    echo "CodeRabbit Review Report"
    echo "Generated: $(date)"
    echo "Repository: $(basename $(git rev-parse --show-toplevel))"
    echo "Branch: $(git branch --show-current)"
    echo "Commit: $(git rev-parse --short HEAD)"
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    echo ""
    coderabbit --plain
} > reports/coderabbit-report.txt

​

4. Review Type Selection

• --type uncommitted: For work-in-progress reviews
• --type committed: For reviewing staged changes
• --type all: For comprehensive reviews

​

5. Output Format

• --plain: Always use for reports (removes interactive formatting)
• --prompt-only: For minimal output (AI assistant integration)

​

Example Workflows

# Morning: Review yesterday's work
coderabbit --type committed --plain > reports/daily-$(date +%Y%m%d).txt

# Before commit: Quick review
coderabbit --type uncommitted --plain > reports/pre-commit-$(date +%Y%m%d-%H%M%S).txt

# Comprehensive review before PR
coderabbit --type all --plain > reports/feature-review-$(date +%Y%m%d).txt

​

Best Practices

​

1. Review Before Committing

# Quick check before commit
cr-uncommitted
# Fix issues, then commit

​

2. Use Appropriate Output Mode

• Development: cr-plain (detailed feedback)
• AI Assistants: cr-quick (token-efficient)
• CI/CD: cr-report (save to file)

​

3. Address Security Issues First

1. Security vulnerabilities (SSRF, JWT validation, etc.)
2. Multi-tenant isolation violations
3. Architecture boundary violations
4. Code quality issues

​

4. Review Reports Regularly

• Full reports for comprehensive analysis
• Quick reports for AI assistant context
• Uncommitted reports for pre-commit checks

​

5. Keep Configuration Updated

• Update .coderabbit.yaml
• Add new docs to knowledge base
• Update review instructions

​

6. Integrate with Workflow

• Run reviews before committing
• Use reports for documentation
• Share findings with team

​

7. Learnings and Quarterly Review

• Quarterly: In the CodeRabbit app, go to Learnings and review/remove outdated or conflicting learnings. Filter by date or topic; delete learnings that reference deprecated patterns or old file layouts.
• Scope: Use global if all org repos share the same standards; use local if you have repos with different tech stacks to avoid cross-contamination.
• Reinforcement: If learnings seem ignored, add a path instruction that says: “Before responding, review all Learnings to ensure none are ignored.”

​

Troubleshooting

​

Issue: CodeRabbit Not Found

# Check if installed
which coderabbit

# If not found, reinstall
curl -fsSL https://cli.coderabbit.ai/install.sh | sh
source ~/.bashrc

​

Issue: Authentication Required

coderabbit auth login
# Follow prompts to authenticate with GitHub

​

Issue: Authentication Failed (libsecret not available)

​

Issue: Slow Performance (Windows Filesystem)

1. Use VS Code Remote - WSL:
   • Install “Remote - WSL” extension
   • Open project in WSL mode: code . (from WSL terminal)
2. Move Repository to WSL Filesystem (Optional):
   cd ~
   mkdir -p projects
   cd projects
   git clone <repo-url> encoreos-platform
   

​

Issue: Line Ending Conflicts

git config --global core.autocrlf input

​

Issue: Reports Directory Not Found

mkdir -p reports
# Reports will be saved here automatically

​

Issue: Report File is Empty

1. Check if CodeRabbit found any changes:
   git status
   
2. Try with explicit type:
   coderabbit --type all --plain > report.txt
   
3. Check for errors:
   coderabbit --plain > report.txt 2>&1
   cat report.txt
   

​

Issue: Report Too Large

1. Review specific files only (if CodeRabbit supports it)
2. Use --prompt-only for summary
3. Filter output:
   coderabbit --plain | grep -E "(CRITICAL|HIGH|MEDIUM)" > report-critical.txt
   

​

Issue: CodeRabbit Not Using Configuration

1. Verify file is in repository root
2. Check YAML syntax (use validator)
3. Ensure file is committed to branch
4. Check CodeRabbit app is installed

​

Issue: Knowledge Base Not Working

1. Verify file paths are correct (relative to repo root)
2. Ensure files exist and are committed
3. Check file sizes (very large files may be skipped)
4. Use absolute paths if needed

​

Issue: Too Many/Few Reviews

1. Adjust reviews.profile: "assertive" → "chill" (those are the only two valid values)
2. Modify reviews.path_instructions (NOT review_instructions — that key does not exist) to be more/less specific
3. Update reviews.path_filters (NOT paths.ignored_paths) to exclude more files

​

Recent Improvements (2025-12-10)

​

Added Tools

• ✅ ESLint integration
• ✅ Gitleaks secret detection

​

Enhanced Path Instructions

• ✅ Edge function security patterns
• ✅ PHI/PII logging detection
• ✅ Config file review instructions
• ✅ Enhanced React/TypeScript patterns

​

Expanded Security Patterns

• ✅ SSRF prevention
• ✅ JWT validation requirements
• ✅ Error message security
• ✅ Input validation checks

​

Additional Resources

• CodeRabbit Docs: https://docs.coderabbit.ai
• Configuration Schema: https://coderabbit.ai/integrations/schema.v2.json
• Project Constitution: constitution.md
• AI Guide: AI_GUIDE.md
• Quick Reference: CODE_REVIEW_PROCESS.md - Daily commands section

​

Quick Reference Card

# Daily Commands
cr-uncommitted      # Quick pre-commit review
cr-review           # Full review
cr-quick            # AI-friendly output

# Reports
cr-report           # Save full report
cr-report-quick     # Save quick report

# Status
coderabbit auth status    # Check auth
coderabbit --version      # Check version