fix(ci): use two-step yq approach for manifest merging (#1408)

The 'add' function doesn't exist in yq v4, causing parse errors.
Use a two-step approach that was tested locally:
1. Collect all files with '[.files] | flatten'
2. Load merged files into first manifest with 'load()'

Tested locally with yq v4.50.1

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -39,6 +39,7 @@ Follow conventional commits: `<type>: <subject>`
 - [ ] I've tested my changes locally
 - [ ] I've followed the code principles (SOLID, DRY, KISS)
 - [ ] My PR is small and focused (< 400 lines ideally)
+- [ ] **(Python only)** All file operations specify `encoding="utf-8"` for text files
 
 ## Platform Testing Checklist
 

.github/actions/merge-macos-manifests/action.yml

@@ -80,11 +80,12 @@ runs:
           echo "Installed yq version:"
           yq --version
 
-          # Merge the files arrays from both manifests using eval-all
-          # This avoids shell expansion issues with multiline YAML
-          yq eval-all '
-            select(fileIndex == 0) * {"files": ([.[].files] | add)}
-          ' "$intel_manifest" "$arm64_manifest" > "${{ inputs.output-path }}/latest-mac.yml"
+          # Merge the files arrays from both manifests using two-step approach
+          # Step 1: Collect all files from both manifests into a temp file
+          yq eval-all '[.files] | flatten' "$intel_manifest" "$arm64_manifest" > /tmp/merged-files.yml
+
+          # Step 2: Replace files array in first manifest with merged files
+          yq eval '.files = load("/tmp/merged-files.yml")' "$intel_manifest" > "${{ inputs.output-path }}/latest-mac.yml"
 
           echo "Merged manifest contents:"
           cat "${{ inputs.output-path }}/latest-mac.yml"

.github/actions/setup-node-frontend/action.yml

@@ -34,15 +34,93 @@ runs:
       uses: actions/cache@v4
       with:
         path: ${{ steps.npm-cache-dir.outputs.dir }}
-        key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json', 'apps/frontend/package-lock.json') }}
+        key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
         restore-keys: ${{ runner.os }}-npm-
 
     - name: Install dependencies
-      working-directory: apps/frontend
       shell: bash
+      # Run npm ci from root to properly handle workspace dependencies.
+      # With npm workspaces, the lock file is at root and dependencies are hoisted there.
+      # Running npm ci in apps/frontend would fail to populate node_modules correctly.
       run: |
         if [ "${{ inputs.ignore-scripts }}" == "true" ]; then
           npm ci --ignore-scripts
         else
           npm ci
         fi
+
+    - name: Link node_modules for electron-builder
+      shell: bash
+      # electron-builder expects node_modules in apps/frontend for native module rebuilding.
+      # With npm workspaces, packages are hoisted to root. Create a link so electron-builder
+      # can find the modules during packaging and code signing.
+      # Uses symlink on Unix, directory junction on Windows (works without admin privileges).
+      #
+      # IMPORTANT: npm workspaces may create a partial node_modules in apps/frontend for
+      # packages that couldn't be hoisted. We must remove it and create a proper link to root.
+      run: |
+        # Verify npm ci succeeded
+        if [ ! -d "node_modules" ]; then
+          echo "::error::Root node_modules does not exist. npm ci may have failed."
+          exit 1
+        fi
+
+        # Remove any existing node_modules in apps/frontend
+        # This handles: partial directories from npm workspaces, AND broken symlinks
+        if [ -e "apps/frontend/node_modules" ] || [ -L "apps/frontend/node_modules" ]; then
+          # Check if it's a valid symlink pointing to root node_modules
+          if [ -L "apps/frontend/node_modules" ]; then
+            target=$(readlink apps/frontend/node_modules 2>/dev/null || echo "")
+            if [ "$target" = "../../node_modules" ] && [ -d "apps/frontend/node_modules" ]; then
+              echo "Correct symlink already exists: apps/frontend/node_modules -> ../../node_modules"
+            else
+              echo "Removing incorrect/broken symlink (was: $target)..."
+              rm -f "apps/frontend/node_modules"
+            fi
+          else
+            echo "Removing partial node_modules directory created by npm workspaces..."
+            rm -rf "apps/frontend/node_modules"
+          fi
+        fi
+
+        # Create link if it doesn't exist or was removed
+        if [ ! -L "apps/frontend/node_modules" ]; then
+          if [ "$RUNNER_OS" == "Windows" ]; then
+            # Use directory junction on Windows (works without admin privileges)
+            # Use PowerShell's New-Item -ItemType Junction for reliable path handling
+            abs_target=$(cygpath -w "$(pwd)/node_modules")
+            link_path=$(cygpath -w "$(pwd)/apps/frontend/node_modules")
+            powershell -Command "New-Item -ItemType Junction -Path '$link_path' -Target '$abs_target'" > /dev/null
+            if [ $? -eq 0 ]; then
+              echo "Created junction: apps/frontend/node_modules -> $abs_target"
+            else
+              echo "::error::Failed to create directory junction on Windows"
+              exit 1
+            fi
+          else
+            # Use symlink on Unix (macOS/Linux)
+            if ln -s ../../node_modules apps/frontend/node_modules; then
+              echo "Created symlink: apps/frontend/node_modules -> ../../node_modules"
+            else
+              echo "::error::Failed to create symlink"
+              exit 1
+            fi
+          fi
+        fi
+
+        # Final verification - the link must exist and resolve correctly
+        # Note: On Windows, junctions don't show as symlinks (-L), so we check if the directory exists
+        # and can be listed. On Unix, we also verify it's a symlink.
+        if [ "$RUNNER_OS" != "Windows" ] && [ ! -L "apps/frontend/node_modules" ]; then
+          echo "::error::apps/frontend/node_modules symlink was not created"
+          exit 1
+        fi
+        # Verify the link resolves to a valid directory with content
+        if ! ls apps/frontend/node_modules/electron >/dev/null 2>&1; then
+          echo "::error::apps/frontend/node_modules does not resolve correctly (electron not found)"
+          ls -la apps/frontend/ || true
+          ls apps/frontend/node_modules 2>&1 | head -5 || true
+          exit 1
+        fi
+        count=$(ls apps/frontend/node_modules 2>/dev/null | wc -l)
+        echo "Verified: apps/frontend/node_modules resolves correctly ($count entries)"

.github/workflows/quality-security.yml

@@ -1,9 +1,8 @@
 name: Quality Security
 
-# CodeQL is slow (20-30 min per language), so:
-# - Run on push to main only (not PRs or develop)
-# - Run weekly scheduled scan
-# Bandit is fast (5-10 min), so keep it on all PRs
+# CodeQL runs on all PRs, pushes to main, and weekly schedule
+# Note: CodeQL takes 20-30 min per language (40-60 min total)
+# Bandit is fast (5-10 min)
 
 on:
   push:
@@ -35,13 +34,10 @@ permissions:
   actions: read
 
 jobs:
-  # CodeQL only on push to main or scheduled (NOT on PRs - saves 40-60 min per PR)
   codeql:
     name: CodeQL (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    # Only run on push to main or scheduled - skip PRs for speed
-    if: github.event_name == 'push' || github.event_name == 'schedule'
     strategy:
       fail-fast: false
       matrix:

.gitignore

@@ -56,6 +56,7 @@ lerna-debug.log*
 # Auto Claude Generated
 # ===========================
 .auto-claude/
+.planning/
 .auto-build-security.json
 .auto-claude-security.json
 .auto-claude-status
@@ -170,4 +171,5 @@ OPUS_ANALYSIS_AND_IDEAS.md
 # Auto Claude generated files
 .security-key
 /shared_docs
-Agents.md
+logs/security/
+Agents.md

.husky/pre-commit

@@ -290,11 +290,14 @@ if git diff --cached --name-only | grep -q "^apps/frontend/"; then
         exit 1
       fi
 
-      # Check for vulnerabilities (only high severity)
+      # Check for vulnerabilities (only critical severity)
+      # Note: Using critical level because electron-builder has a known high-severity
+      # tar vulnerability (CVE-2026-23745) that cannot be fixed until electron-builder
+      # releases an update with tar@7.x support. This is a build dependency, not runtime.
       echo "Checking for vulnerabilities..."
-      npm audit --audit-level=high
+      npm audit --audit-level=critical
       if [ $? -ne 0 ]; then
-        echo "High severity vulnerabilities found. Run 'npm audit fix' to resolve."
+        echo "Critical severity vulnerabilities found. Run 'npm audit fix' to resolve."
         exit 1
       fi
     )

.pre-commit-config.yaml

@@ -76,6 +76,17 @@ repos:
         files: ^package\.json$
         pass_filenames: false
 
+  # Python encoding check - prevent regression of UTF-8 encoding fixes (PR #782)
+  - repo: local
+    hooks:
+      - id: check-file-encoding
+        name: Check file encoding parameters
+        entry: python scripts/check_encoding.py
+        language: system
+        types: [python]
+        files: ^apps/backend/
+        description: Ensures all file operations specify encoding="utf-8"
+
   # Python linting (apps/backend/)
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.14.10

CHANGELOG.md

@@ -1,3 +1,394 @@
+## 2.7.5 - Security & Platform Improvements
+
+### ✨ New Features
+
+- One-time version 2.7.5 reauthentication warning modal for improved security awareness
+
+- Enhanced authentication failure detection and handling with improved error recovery
+
+- PR review validation pipeline with context enrichment and cross-validation support
+
+- Terminal "Others" section in worktree dropdown for better organization
+
+- Keyboard shortcut to toggle terminal expand/collapse for improved usability
+
+- Searchable branch combobox in worktree creation dialog for easier branch selection
+
+- Update Branch button in PR detail view for streamlined workflow
+
+- Bulk select and create PR functionality for human review column
+
+- Draggable Kanban task reordering for flexible task management
+
+- YOLO mode to invoke Claude with --dangerously-skip-permissions for advanced users
+
+- File and screenshot upload to QA feedback interface for better feedback submission
+
+- Task worktrees section with terminal limit removal for expanded parallel work
+
+- Claude Code version rollback feature for version management
+
+- Linux secret-service support for OAuth token storage (ACS-293)
+
+### 🛠️ Improvements
+
+- Replace setup-token with embedded /login terminal flow for streamlined authentication
+
+- Refactored authentication using platform abstraction for cross-platform reliability
+
+- Removed redundant backend CLI detection (~230 lines) for cleaner codebase
+
+- Replaced Select with Combobox for branch selection UI improvements
+
+- Replace dangerouslySetInnerHTML with Trans component for better security practice
+
+- Wait for CI checks before starting AI PR review for more accurate results
+
+- Improved Claude CLI detection with installation selector
+
+- Terminal rendering, persistence, and link handling improvements
+
+- Enhanced terminal recreation logic with retry mechanism for reliability
+
+- Improved worktree name input UX with better validation
+
+- Made worktree isolation prominent in UI for user awareness
+
+- Reduce ultrathink value from 65536 to 60000 for Opus 4.5 compatibility
+
+- Standardized workflow naming and consolidated linting workflow
+
+- Added gate jobs to CI/CD pipeline for better quality control
+
+- Fast-path detection for merge commits without finding overlap in PR review
+
+- Show progress percentage during planning phase on task cards
+
+- PTY write improvements using PtyManager.writeToPty for safer terminal operations
+
+- Consolidated package-lock.json to root level for simpler dependency management
+
+- Graphiti memory feature fixes on macOS
+
+- Model versions updated to Claude 4.5 with connected insights to frontend settings
+
+### 🐛 Bug Fixes
+
+- Fixed Kanban board status flip-flopping and multi-location task deletion
+
+- Fixed Windows CLI detection and version selection UX issues
+
+- Fixed Windows coding phase not starting after spec/planning
+
+- Fixed Windows UTF-8 encoding errors across entire backend (251 instances)
+
+- Fixed 401 authentication errors by reading tokens from profile configDir
+
+- Fixed Windows packaging by using SDK bundled Claude CLI
+
+- Fixed false stuck detection during planning phase
+
+- Fixed PR list update on post status click
+
+- Fixed screenshot state persistence bug in task modals
+
+- Fixed non-functional '+ Add' button for multiple Claude accounts
+
+- Fixed GitHub Issues/PRs infinite scroll auto-fetch behavior
+
+- Fixed GitHub PR state management and follow-up review trigger bug
+
+- Fixed terminal output freezing on project switch
+
+- Fixed terminal rendering on app close to prevent zombie processes
+
+- Fixed stale terminal metadata filtering with auto-cleanup
+
+- Fixed worktree configuration sync after PTY creation
+
+- Fixed cross-worktree file leakage via environment variables
+
+- Fixed .gitignore auto-commit during project initialization
+
+- Fixed PR review verdict message contradiction and blocked status limbo
+
+- Fixed re-review functionality when previous review failed
+
+- Fixed agent profile resolution before falling back to defaults
+
+- Fixed Windows shell command support in Claude CLI invocation
+
+- Fixed model resolution using resolve_model_id() instead of hardcoded fallbacks
+
+- Fixed ultrathink token budget correction from 64000 to 63999
+
+- Fixed Windows pywin32 DLL loading failure on Python 3.8+
+
+- Fixed circular import between spec.pipeline and core.client
+
+- Fixed pywin32 bundling in Windows binary
+
+- Fixed secretstorage bundling in Linux binary
+
+- Fixed gh CLI detection for PR creation
+
+- Fixed PYTHONPATH isolation to prevent pollution of external projects
+
+- Fixed structured output capture from SDK ResultMessage in PR review
+
+- Fixed CI status refresh before returning cached verdict
+
+- Fixed Python environment readiness before spawning tasks
+
+- Fixed pywintypes import errors during dependency validation
+
+- Fixed Node.js and npm path detection on Windows packaged apps
+
+- Fixed Windows PowerShell command separator usage
+
+- Fixed require is not defined error in terminal handler
+
+- Fixed Sentry DSN initialization error handling
+
+- Fixed requestAnimationFrame fallback for flaky Ubuntu CI tests
+
+- Fixed file drag-and-drop to terminals and task modals with branch status refresh
+
+- Fixed GitHub issues pagination and infinite scroll
+
+- Fixed delete worktree status regression
+
+- Fixed Mac crash on Invoke Claude button
+
+- Fixed worktree symlink for node_modules to enable TypeScript support
+
+- Fixed PTY wait on Windows before recreating terminal
+
+- Fixed terminal aggressive renaming on Claude invocation
+
+- Fixed worktree dropdown scroll area to prevent overflow
+
+- Fixed GitHub PR preloading currently under review
+
+- Fixed actual base branch name display instead of hardcoded main
+
+- Fixed Claude CLI detection with improved installation selector
+
+- Fixed broken pipe errors with Sentry integration
+
+- Fixed app update persistence for Install button visibility
+
+- Fixed Claude exit detection and label reset
+
+- Fixed file merging to include files with content changes
+
+- Fixed worktree config sync on terminal restoration
+
+- Fixed security profile inheritance in worktrees and shell -c validation
+
+- Fixed terminal drag and drop reordering collision detection
+
+- Fixed "already up to date" case handling in worktree operations
+
+- Fixed Windows UTF-8 encoding and path handling issues
+
+- Fixed Terminal label persistence after app restart
+
+- Fixed worktree dropdown enhancement with scrolling support
+
+- Fixed enforcement of 12 terminal limit per project
+
+- Fixed macOS UTF-8 encoding errors (251 instances)
+
+### 📚 Documentation
+
+- Added fork configuration guidance to CONTRIBUTING.md
+
+- Updated README download links to v2.7.4
+
+### 🔧 Other Changes
+
+- Removed node_modules symlink and cleaned up package-lock.json
+
+- Added .planning/ to gitignore
+
+- Migrated ESLint to Biome with optimized workflows
+
+- Fixed tar vulnerability in dependencies
+
+- Added minimatch to externalized dependencies
+
+- Added exception handling for malformed DSN during Sentry initialization
+
+- Corrected roadmap import path in roadmap_runner.py
+
+- Added require polyfill for ESM/Sentry compatibility
+
+- Addressed CodeQL security alerts and code quality issues
+
+- Added shell: true and argument sanitization for Windows packaging
+
+- Packaged runtime dependencies with pydantic_core validation
+
+---
+
+## What's Changed
+
+- test(subprocess): add comprehensive auth failure detection tests by @AndyMik90 in ccaf82db
+- fix(security): replace dangerouslySetInnerHTML with Trans component and persist version warning by @AndyMik90 in 7aec35c3
+- chore: remove node_modules symlink and clean up package-lock.json by @AndyMik90 in 9768af8e
+- fix: address PR review issues and improve code quality by @AndyMik90 in 23a7e5a2
+- fix(auth): read tokens from profile configDir to fix 401 errors (#1385) by @Andy in 55857d6d
+- fix: Kanban board status flip-flopping and multi-location task deletion (#1387) by @Adam Slaker in 7dcb7bbe
+- fix(windows): use SDK bundled Claude CLI for Windows packaged apps (#1382) by @Andy in cd4e2d38
+- feat(auth): enhance authentication failure detection and handling by @AndyMik90 in 7ab10cd5
+- refactor(subprocess): use platform abstraction for auth failure process killing by @AndyMik90 in 17cffecc
+- feat(ui): add one-time version 2.7.5 reauthentication warning modal by @AndyMik90 in f49ef92a
+- refactor: remove redundant backend CLI detection (~230 lines) (#1367) by @Andy in c7bc01d5
+- feat(pr-review): add validation pipeline, context enrichment, and cross-validation (#1354) by @Andy in d8f4de9a
+- fix(terminal): rename Claude terminals only once on initial message (#1366) by @Andy in b2d2d7e9
+- feat(auth): add auth failure detection modal for Claude CLI 401 errors (#1361) by @Andy in 317d5e94
+- docs: add fork configuration guidance to CONTRIBUTING.md (#1364) by @Andy in c57534c3
+- Fix #609: Windows coding phase not starting after spec/planning (#1347) by @TamerineSky in 6da1b170
+- Fix Windows UTF-8 encoding errors across entire backend (251 instances) (#782) by @TamerineSky in 6a6247bb
+- chore: add .planning/ to gitignore by @AndyMik90 in 8df66245
+- feat(auth): replace setup-token with embedded /login terminal flow (#1321) by @Andy in 11f8d572
+- fix: Windows CLI detection and version selection UX improvements (#1341) by @StillKnotKnown in 8a2f3acd
+- fix: add shell: true and argument sanitization for Windows packaging (#1340) by @StillKnotKnown in e482fdf1
+- fix: package runtime deps and validate pydantic_core (#1336) by @StillKnotKnown in 141f44f6
+- fix(test): update mock profile manager and relax audit level by @Test User in 86ba0246
+- 2.7.4 release stable by @Test User in 3e2d6ef4
+- fix(tests): update claude-integration-handler tests for PtyManager.writeToPty by @Test User in 56743ff7
+- chore: consolidate package-lock.json to root level by @Test User in d4044d26
+- build: add minimatch to externalized dependencies by @Test User in 95f7f222
+- refactor(terminal): use PtyManager.writeToPty for safer PTY writes by @Test User in 4637a1a9
+- fix: correct ultrathink token budget from 64000 to 63999 by @Test User in efdb8c71
+- ci: migrate ESLint to Biome, optimize workflows, fix tar vulnerability (#1289) by @Andy in 0b2cf9b0
+- Fix API 401 - Token Decryption Before SDK Initialization (#1283) by @Andy in 4b740928
+- Fix Ultrathink Token Limit Bug (#1284) by @Andy in e989300b
+- fix(security): address CodeQL security alerts and code quality issues (#1286) by @Andy in f700b18d
+- fix(ui): make prose-invert conditional on dark mode for light theme support (#1160) by @youngmrz in 439ed86a
+- fix(terminal): add require polyfill for ESM/Sentry compatibility (#1275) by @VDT-91 in eb739afe
+- fix: add retry logic for planning-to-coding transition (#1276) by @kaigler in b8655904
+- fix(worktree): prevent cross-worktree file leakage via environment variables (#1267) by @Andy in 7cb9e0a3
+- Fix/cleanup 2.7.5 (#1271) by @Andy in f0c3e508
+- Fix False Stuck Detection During Planning Phase (#1236) by @Andy in 44304a61
+- fix(pr-review): allow re-review when previous review failed (#1268) by @Andy in 4cc8f4db
+- fix: enforce 12 terminal limit per project (#1264) by @Andy in d7ed770e
+- Draggable Kanban Task Reordering (#1217) by @Andy in 3606a632
+- fix(terminal): sync worktree config after PTY creation to fix first-attempt failure (#1213) by @Andy in 39236f18
+- fix: auto-commit .gitignore changes during project initialization (#1087) (#1124) by @youngmrz in ba089c5b
+- Fix terminal rendering, persistence, and link handling (#1215) by @Andy in 75a3684c
+- fix(windows): prevent zombie process accumulation on app close (#1259) by @VDT-91 in 90204469
+- update gitignore by @AndyMik90 in c13d9a40
+- Fix PR List Update on Post Status Click (#1207) by @Andy in 3085e392
+- Fix screenshot state persistence bug in task modals (#1235) by @Andy in 3024d547
+- Fix non-functional '+ Add' button for multiple Claude accounts (#1216) by @Andy in e27ff344
+- Fix GitHub Issues/PRs Infinite Scroll Auto-Fetch (#1239) by @Andy in b74b628b
+- Add bulk delete functionality to worktree overview (#1208) by @Andy in 8833feb2
+- Fix GitHub PR State Management - Follow-up Review Trigger Bug (#1238) by @Andy in 76f07720
+- auto-claude: subtask-1-1 - Add useEffect hook to reset expandedTerminalId when projectPath changes (#1240) by @Andy in d1131080
+- Fix Terminal Output Freezing on Project Switch (#1241) by @Andy in 193d2ed9
+- Add Update Branch Button to PR Detail View (#1242) by @Andy in 87c84073
+- Bulk Select All & Create PR for Human Review Column (#1248) by @Andy in 715202b8
+- fix(windows): resolve pywin32 DLL loading failure on Python 3.8+ (#1244) by @VDT-91 in cb786cac
+- fix(gh-cli): use get_gh_executable() and pass GITHUB_CLI_PATH from GUI (ACS-321) (#1232) by @StillKnotKnown in 14fbc2eb
+- auto-claude: subtask-1-1 - Replace Select with Combobox for branch selection (#1250) by @Andy in ed45ece5
+- fix(sentry): add exception handling for malformed DSN during Sentry initialization by @AndyMik90 in 4f86742b
+- dev dependecnies using npm install all by @AndyMik90 in e52a1ba4
+- hotfix/dev-dependency-missing by @AndyMik90 in a0033b1e
+- fix(frontend): resolve require is not defined error in terminal handler (#1243) by @Antti in 9117b59e
+- hotfix/node by @AndyMik90 in bb620044
+- fix(windows): add Node.js and npm paths to COMMON_BIN_PATHS for packaged apps (#1158) by @youngmrz in f0319bc8
+- fix/stale-task-creation by @AndyMik90 in 9612cf8d
+- fix/sentry-local-build by @AndyMik90 in b822797f
+- hotfix/tar-vurnability by @AndyMik90 in 2096b0e2
+- fix(tests): add requestAnimationFrame fallback for flaky Ubuntu CI tests by @AndyMik90 in 9739b338
+- fix(windows): use correct command separator for PowerShell terminals (#1159) by @youngmrz in cb8e46ca
+- fix(ui): show progress percentage during planning phase on task cards (#1162) by @youngmrz in 515aada1
+- fix(tests): isolate git operations in test fixtures from parent repository (#1205) by @Andy in 596b1e0c
+- feat(terminal): add "Others" section to worktree dropdown (#1209) by @Andy in 219cc068
+- fix(linux): ensure secretstorage is bundled in Linux binary (ACS-310) (#1211) by @StillKnotKnown in 48bd4a9c
+- fix(terminal): persist worktree label after app restart (#1210) by @Andy in ba7358af
+- fix: Graphiti memory feature on macOS (#1174) by @Alexander Penzin in c2e53d58
+- fix(windows): ensure pywin32 is bundled in Windows binary (ACS-306) (#1197) by @StillKnotKnown in 76af0aaa
+- fix(spec): resolve circular import between spec.pipeline and core.client (ACS-302) (#1192) by @StillKnotKnown in 648cf3fc
+- Fix Mac Crash on Invoke Claude Button (#1185) by @Andy in ae40f819
+- fix(worktree): symlink node_modules to worktrees for TypeScript support (#1148) by @Andy in d7c7ce8e
+- fix(terminal): wait for PTY exit on Windows before recreating terminal (#1184) by @Andy in d5d56975
+- fix(runners): use resolve_model_id() for model resolution instead of hardcoded fallbacks (ACS-294) (#1170) by @StillKnotKnown in 5199fdbf
+- fix(frontend): support Windows shell commands in Claude CLI invocation (ACS-261) (#1152) by @StillKnotKnown in 3a1966bd
+- feat(terminal): add keyboard shortcut to toggle expand/collapse (#1180) by @Andy in 1edfe333
+- fix(kanban): remove error column and add backend JSON repair (#1143) by @Andy in 51f67c5d
+- fix(ci): add gate jobs and consolidate linting workflow (#1182) by @Andy in 4b43f074
+- fix(ci): standardize workflow naming and remove redundant workflows (#1178) by @Andy in 4a3391b2
+- fix(terminal): enable scrolling in worktree dropdown when many items exist (#1175) by @Andy in 5525f36d
+- fix: windows (#1056) by @Alex in d6234f52
+- fix(backend): reduce ultrathink value from 65536 to 60000 for Opus 4.5 compatibility (#1173) by @StillKnotKnown in 30638c2f
+- feat(backend): add Linux secret-service support for OAuth token storage (ACS-293) (#1168) by @StillKnotKnown in a6934a8e
+- fix(terminal): prevent aggressive renaming on Claude invocation (#1147) by @Andy in 10bceac9
+- fix(pr-review): resolve verdict message contradiction and blocked status limbo (#1151) by @Andy in 8b269fea
+- feat(pr-review): add fast-path detection for merge commits without finding overlap (#1145) by @Andy in 32811142
+- fix(frontend): resolve agent profile before falling back to defaults (ACS-255) (#1068) by @StillKnotKnown in 33014682
+- fix(terminal): add scroll area to worktree dropdown to prevent overflow (#1146) by @Andy in 200bb3bc
+- fix(frontend): add windowsVerbatimArguments for Windows .cmd validation (ACS-252) (#1075) by @StillKnotKnown in 658f26cb
+- fix(backend): improve gh CLI detection for PR creation (ACS-247) (#1071) by @StillKnotKnown in 2eef82bf
+- fix(terminal): filter stale worktree metadata and auto-cleanup (#1038) by @Andy in 16bc37ce
+- Fix Delete Worktree Status Regression (#1076) by @Andy in 97f98ed7
+- 117-sidebar-update-banner (#1078) by @Andy in 4fd25b01
+- fix(ci): add beta manifest renaming and validation (#1002) (#1080) by @Andy in c6c6525b
+- fix: update all model versions to Claude 4.5 and connect insights to frontend settings (#1082) by @Andy in 58f4f30b
+- fix: file drag-and-drop to terminals and task modals + branch status refresh (#1092) by @Andy in b5c0e631
+- fix(github-issues): add pagination and infinite scroll for issues tab (#1042) by @Andy in f1674923
+- fix(ci): enable automatic release workflow triggering (#1043) by @Andy in 2ff9ccab
+- fix(backend): isolate PYTHONPATH to prevent pollution of external projects (ACS-251) (#1065) by @StillKnotKnown in 18d9b6cf
+- add time sensitive AI review logic (#1137) by @Andy in 5fb7574b
+- fix(pr-review): use list instead of tuple for line_range to fix SDK structured output (#1140) by @Andy in 45060ca3
+- feat(github-review): wait for CI checks before starting AI PR review (#1131) by @Andy in a55e4f68
+- fix(frontend): pass CLAUDE_CLI_PATH to Python backend subprocess (ACS-230) (#1081) by @StillKnotKnown in 5e91c3a7
+- fix(runners): correct roadmap import path in roadmap_runner.py (ACS-264) (#1091) by @StillKnotKnown in 767dd5c3
+- fix(pr-review): properly capture structured output from SDK ResultMessage (#1133) by @Andy in f28d2298
+- fix(github-review): refresh CI status before returning cached verdict (#1083) by @Andy in c3bdd4f8
+- fix(agent): ensure Python env is ready before spawning tasks (ACS-254) (#1061) by @StillKnotKnown in 7dc54f23
+- fix(windows): prevent pywintypes import errors before dependency validation (ACS-253) (#1057) by @StillKnotKnown in 71a9fc84
+- fix(docs): update README download links to v2.7.4 by @Test User in 67b39e52
+- fix readme for 2.7.4 by @Test User in a0800646
+- changelog 2.7.4 by @AndyMik90 in 1b5aecdd
+- 2.7.4 release by @AndyMik90 in 72797ac0
+- fix(frontend): validate Windows claude.cmd reliably in GUI (#1023) by @Umaru in 1ae3359b
+- fix(auth): await profile manager initialization before auth check (#1010) by @StillKnotKnown in c8374bc1
+- Add file/screenshot upload to QA feedback interface (#1018) by @Andy in 88277f84
+- feat(terminal): add task worktrees section and remove terminal limit (#1033) by @Andy in 17118b07
+- fix(terminal): enhance terminal recreation logic with retry mechanism (#1013) by @Andy in df1b8a3f
+- fix(terminal): improve worktree name input UX (#1012) by @Andy in 54e9f228
+- Make worktree isolation prominent in UI (#1020) by @Andy in 4dbb7ee4
+- feat(terminal): add YOLO mode to invoke Claude with --dangerously-skip-permissions (#1016) by @Andy in d48e5f68
+- Fix Duplicate Kanban Task Creation on Rapid Button Clicks (#1021) by @Andy in 2d1d3ef1
+- feat(sentry): embed Sentry DSN at build time for packaged apps (#1025) by @Andy in aed28c5f
+- fix(github): resolve circular import issues in context_gatherer and services (#1026) by @Andy in 0307a4a9
+- hotfix/sentry-backend-build by @AndyMik90 in e7b38d49
+- chore: bump version to 2.7.4 by @AndyMik90 in 432e985b
+- fix(github-prs): prevent preloading of PRs currently under review (#1006) by @Andy in 1babcc86
+- fix(ui): display actual base branch name instead of hardcoded main (#969) by @Andy in 5d07d5f1
+- ci(release): move VirusTotal scan to separate post-release workflow (#980) by @Andy in 553d1e8d
+- fix: improve Claude CLI detection and add installation selector (#1004) by @Andy in e07a0dbd
+- fix(backend): add Sentry integration and fix broken pipe errors (#991) by @Andy in aa9fbe9d
+- fix(app-update): persist downloaded update state for Install button visibility (#992) by @Andy in 6f059bb5
+- fix(terminal): detect Claude exit and reset label when user closes Claude (#990) by @Andy in 14982e66
+- fix(merge): include files with content changes even when semantic analysis is empty (#986) by @Andy in 4736b6b6
+- fix(frontend): sync worktree config to renderer on terminal restoration (#982) by @Andy in 68fe0860
+- feat(frontend): add searchable branch combobox to worktree creation dialog (#979) by @Andy in 2a2dc3b8
+- fix(security): inherit security profiles in worktrees and validate shell -c commands (#971) by @Andy in 750ea8d1
+- feat(frontend): add Claude Code version rollback feature (#983) by @Andy in 8d21978f
+- fix(ACS-181): enable auto-switch on 401 auth errors & OAuth-only profiles (#900) by @Michael Ludlow in e7427321
+- fix(terminal): add collision detection for terminal drag and drop reordering (#985) by @Andy in 1701160b
+- fix(worktree): handle "already up to date" case correctly (ACS-226) (#961) by @StillKnotKnown in 74ed4320
+- ci: add Azure auth test workflow by @AndyMik90 in d12eb523
+
+## Thanks to all contributors
+
+@AndyMik90, @Andy, @Adam Slaker, @TamerineSky, @StillKnotKnown, @Test User, @youngmrz, @VDT-91, @kaigler, @Alexander Penzin, @Antti, @Alex, @Michael Ludlow, @Umaru
+
 ## 2.7.4 - Terminal & Workflow Enhancements
 
 ### ✨ New Features

CLAUDE.md

@@ -56,9 +56,10 @@ cd apps/backend && uv venv && uv pip install -r requirements.txt
 # Frontend (from apps/frontend/)
 cd apps/frontend && npm install
 
-# Set up OAuth token
-claude setup-token
-# Add to apps/backend/.env: CLAUDE_CODE_OAUTH_TOKEN=your-token
+# Authenticate (token auto-saved to Keychain)
+claude
+# Then type: /login
+# Press Enter to open browser and complete OAuth
 ```
 
 ### Creating and Running Specs

CONTRIBUTING.md

@@ -16,6 +16,7 @@ Thank you for your interest in contributing to Auto Claude! This document provid
 - [Testing](#testing)
 - [Continuous Integration](#continuous-integration)
 - [Git Workflow](#git-workflow)
+  - [Working with Forks](#working-with-forks)
   - [Branch Overview](#branch-overview)
   - [Main Branches](#main-branches)
   - [Supporting Branches](#supporting-branches)
@@ -357,6 +358,64 @@ export default function(props) {
 - End files with a newline
 - Keep line length under 100 characters when practical
 
+### File Encoding (Python)
+
+**Always specify `encoding="utf-8"` for text file operations** to ensure Windows compatibility.
+
+Windows Python defaults to `cp1252` encoding instead of UTF-8, causing errors with:
+- Emoji (🚀, ✅, ❌)
+- International characters (ñ, é, 中文, العربية)
+- Special symbols (™, ©, ®)
+
+**DO:**
+
+```python
+# Reading files
+with open(path, encoding="utf-8") as f:
+    content = f.read()
+
+# Writing files
+with open(path, "w", encoding="utf-8") as f:
+    f.write(content)
+
+# Path methods
+from pathlib import Path
+content = Path(file).read_text(encoding="utf-8")
+Path(file).write_text(content, encoding="utf-8")
+
+# JSON files - reading
+import json
+with open(path, encoding="utf-8") as f:
+    data = json.load(f)
+
+# JSON files - writing
+with open(path, "w", encoding="utf-8") as f:
+    json.dump(data, f, ensure_ascii=False, indent=2)
+```
+
+**DON'T:**
+
+```python
+# Wrong - platform-dependent encoding
+with open(path) as f:
+    content = f.read()
+
+# Wrong - Path methods without encoding
+content = Path(file).read_text()
+
+# Wrong - encoding on json.dump (not open!)
+json.dump(data, f, encoding="utf-8")  # ERROR
+```
+
+**Binary files - NO encoding:**
+
+```python
+with open(path, "rb") as f:  # Correct
+    data = f.read()
+```
+
+Our pre-commit hooks automatically check for missing encoding parameters. See [PR #782](https://github.com/AndyMik90/Auto-Claude/pull/782) for the comprehensive encoding fix and [guides/windows-development.md](guides/windows-development.md) for Windows-specific development guidance.
+
 ## Testing
 
 ### Python Tests
@@ -459,6 +518,72 @@ npm run typecheck
 
 We use a **Git Flow** branching strategy to manage releases and parallel development.
 
+### Working with Forks
+
+When contributing to Auto Claude, you'll typically fork the repository first. Proper fork configuration is essential to avoid sync issues.
+
+#### Initial Fork Setup
+
+```bash
+# 1. Fork on GitHub (click the Fork button on the repo page)
+
+# 2. Clone YOUR fork (not the original repo)
+git clone https://github.com/YOUR-USERNAME/Auto-Claude.git
+cd Auto-Claude
+
+# 3. Verify your remotes point to YOUR fork
+git remote -v
+# Should show:
+# origin  https://github.com/YOUR-USERNAME/Auto-Claude.git (fetch)
+# origin  https://github.com/YOUR-USERNAME/Auto-Claude.git (push)
+
+# 4. Add upstream remote to sync with the original repo
+git remote add upstream https://github.com/AndyMik90/Auto-Claude.git
+```
+
+#### Keeping Your Fork Updated
+
+```bash
+# Fetch latest changes from upstream
+git fetch upstream
+
+# Sync your develop branch with upstream
+git checkout develop
+git merge upstream/develop
+git push origin develop
+```
+
+#### Converting a Fork to Standalone
+
+> ⚠️ **Common Issue:** After making a fork standalone (e.g., disconnecting from the original repo on GitHub), your local git configuration may still reference the original forked repository, causing push/pull issues.
+
+If you convert your fork to a standalone repository:
+
+```bash
+# 1. Update origin to point to your standalone repo
+git remote set-url origin https://github.com/YOUR-USERNAME/Your-Standalone-Repo.git
+
+# 2. Remove the upstream remote (no longer applicable)
+git remote remove upstream
+
+# 3. Verify your configuration
+git remote -v
+# Should only show your standalone repo as origin
+
+# 4. Update your default branch tracking if needed
+git branch --set-upstream-to=origin/main main
+git branch --set-upstream-to=origin/develop develop
+```
+
+#### Troubleshooting Fork Issues
+
+| Problem | Cause | Solution |
+|---------|-------|----------|
+| `Permission denied` on push | Origin points to upstream repo | `git remote set-url origin <your-fork-url>` |
+| `Repository not found` | Fork was deleted or made standalone | Update remote URL to current repo location |
+| Can't push to develop | Local branch tracks wrong remote | `git branch --set-upstream-to=origin/develop` |
+| Commits show wrong author | Git config not set | `git config user.email "you@example.com"` |
+
 ### Branch Overview
 
 ```

README.md

@@ -16,17 +16,17 @@
 ### Stable Release
 
 <!-- STABLE_VERSION_BADGE -->
-[![Stable](https://img.shields.io/badge/stable-2.7.5-blue?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.5)
+[![Stable](https://img.shields.io/badge/stable-2.7.4-blue?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.4)
 <!-- STABLE_VERSION_BADGE_END -->
 
 <!-- STABLE_DOWNLOADS -->
 | Platform | Download |
 |----------|----------|
-| **Windows** | [Auto-Claude-2.7.5-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-win32-x64.exe) |
-| **macOS (Apple Silicon)** | [Auto-Claude-2.7.5-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-darwin-arm64.dmg) |
-| **macOS (Intel)** | [Auto-Claude-2.7.5-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-darwin-x64.dmg) |
-| **Linux** | [Auto-Claude-2.7.5-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-x86_64.AppImage) |
-| **Linux (Debian)** | [Auto-Claude-2.7.5-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-amd64.deb) |
+| **Windows** | [Auto-Claude-2.7.4-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.4/Auto-Claude-2.7.4-win32-x64.exe) |
+| **macOS (Apple Silicon)** | [Auto-Claude-2.7.4-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.4/Auto-Claude-2.7.4-darwin-arm64.dmg) |
+| **macOS (Intel)** | [Auto-Claude-2.7.4-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.4/Auto-Claude-2.7.4-darwin-x64.dmg) |
+| **Linux** | [Auto-Claude-2.7.4-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.4/Auto-Claude-2.7.4-linux-x86_64.AppImage) |
+| **Linux (Debian)** | [Auto-Claude-2.7.4-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.4/Auto-Claude-2.7.4-linux-amd64.deb) |
 | **Linux (Flatpak)** | [Auto-Claude-2.7.4-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.4/Auto-Claude-2.7.4-linux-x86_64.flatpak) |
 <!-- STABLE_DOWNLOADS_END -->
 

apps/backend/README.md

@@ -17,12 +17,14 @@ python -m pip install -r requirements.txt
 cp .env.example .env
 ```
 
-Set your Claude API token in `.env`:
-```
-CLAUDE_CODE_OAUTH_TOKEN=your-token-here
+Authenticate with Claude Code (token auto-saved to Keychain):
+```bash
+claude
+# Type: /login
+# Press Enter to open browser
 ```
 
-Get your token by running: `claude setup-token`
+Token is auto-detected from macOS Keychain / Windows Credential Manager.
 
 ### 3. Run
 

apps/backend/agents/coder.py

@@ -226,7 +226,7 @@ async def run_autonomous_agent(
             print("  PAUSED BY HUMAN")
             print("=" * 70)
 
-            pause_content = pause_file.read_text().strip()
+            pause_content = pause_file.read_text(encoding="utf-8").strip()
             if pause_content:
                 print(f"\nMessage: {pause_content}")
 

apps/backend/agents/tools_pkg/tools/memory.py

@@ -171,7 +171,7 @@ def create_memory_tools(spec_dir: Path, project_dir: Path) -> list:
             # PRIMARY: Save to file-based storage (always works)
             # Load existing map or create new
             if codebase_map_file.exists():
-                with open(codebase_map_file) as f:
+                with open(codebase_map_file, encoding="utf-8") as f:
                     codebase_map = json.load(f)
             else:
                 codebase_map = {
@@ -187,7 +187,7 @@ def create_memory_tools(spec_dir: Path, project_dir: Path) -> list:
             }
             codebase_map["last_updated"] = datetime.now(timezone.utc).isoformat()
 
-            with open(codebase_map_file, "w") as f:
+            with open(codebase_map_file, "w", encoding="utf-8") as f:
                 json.dump(codebase_map, f, indent=2)
 
             # SECONDARY: Also save to Graphiti/LadybugDB (for Memory UI)
@@ -246,7 +246,7 @@ def create_memory_tools(spec_dir: Path, project_dir: Path) -> list:
                 entry += f"\n\n_Context: {context}_"
             entry += "\n"
 
-            with open(gotchas_file, "a") as f:
+            with open(gotchas_file, "a", encoding="utf-8") as f:
                 if not gotchas_file.exists() or gotchas_file.stat().st_size == 0:
                     f.write(
                         "# Gotchas & Pitfalls\n\nThings to watch out for in this codebase.\n"
@@ -303,7 +303,7 @@ def create_memory_tools(spec_dir: Path, project_dir: Path) -> list:
         codebase_map_file = memory_dir / "codebase_map.json"
         if codebase_map_file.exists():
             try:
-                with open(codebase_map_file) as f:
+                with open(codebase_map_file, encoding="utf-8") as f:
                     codebase_map = json.load(f)
 
                 discoveries = codebase_map.get("discovered_files", {})
@@ -319,7 +319,7 @@ def create_memory_tools(spec_dir: Path, project_dir: Path) -> list:
         gotchas_file = memory_dir / "gotchas.md"
         if gotchas_file.exists():
             try:
-                content = gotchas_file.read_text()
+                content = gotchas_file.read_text(encoding="utf-8")
                 if content.strip():
                     result_parts.append("\n## Gotchas")
                     # Take last 1000 chars to avoid too much context
@@ -333,7 +333,7 @@ def create_memory_tools(spec_dir: Path, project_dir: Path) -> list:
         patterns_file = memory_dir / "patterns.md"
         if patterns_file.exists():
             try:
-                content = patterns_file.read_text()
+                content = patterns_file.read_text(encoding="utf-8")
                 if content.strip():
                     result_parts.append("\n## Patterns")
                     result_parts.append(

apps/backend/agents/tools_pkg/tools/progress.py

@@ -57,7 +57,7 @@ def create_progress_tools(spec_dir: Path, project_dir: Path) -> list:
             }
 
         try:
-            with open(plan_file) as f:
+            with open(plan_file, encoding="utf-8") as f:
                 plan = json.load(f)
 
             stats = {

apps/backend/agents/tools_pkg/tools/qa.py

@@ -140,7 +140,7 @@ def create_qa_tools(spec_dir: Path, project_dir: Path) -> list:
             except json.JSONDecodeError:
                 tests_passed = {}
 
-            with open(plan_file) as f:
+            with open(plan_file, encoding="utf-8") as f:
                 plan = json.load(f)
 
             qa_session = _apply_qa_update(plan, status, issues, tests_passed)
@@ -162,7 +162,7 @@ def create_qa_tools(spec_dir: Path, project_dir: Path) -> list:
             if auto_fix_plan(spec_dir):
                 # Retry after fix
                 try:
-                    with open(plan_file) as f:
+                    with open(plan_file, encoding="utf-8") as f:
                         plan = json.load(f)
 
                     qa_session = _apply_qa_update(plan, status, issues, tests_passed)

apps/backend/agents/tools_pkg/tools/subtask.py

@@ -113,7 +113,7 @@ def create_subtask_tools(spec_dir: Path, project_dir: Path) -> list:
             }
 
         try:
-            with open(plan_file) as f:
+            with open(plan_file, encoding="utf-8") as f:
                 plan = json.load(f)
 
             subtask_found = _update_subtask_in_plan(plan, subtask_id, status, notes)
@@ -145,7 +145,7 @@ def create_subtask_tools(spec_dir: Path, project_dir: Path) -> list:
             if auto_fix_plan(spec_dir):
                 # Retry after fix
                 try:
-                    with open(plan_file) as f:
+                    with open(plan_file, encoding="utf-8") as f:
                         plan = json.load(f)
 
                     subtask_found = _update_subtask_in_plan(

apps/backend/agents/utils.py

@@ -48,9 +48,9 @@ def load_implementation_plan(spec_dir: Path) -> dict | None:
     if not plan_file.exists():
         return None
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             return json.load(f)
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return None
 
 

apps/backend/analysis/analyzers/__init__.py

@@ -46,7 +46,7 @@ def analyze_project(project_dir: Path, output_file: Path | None = None) -> dict:
 
     if output_file:
         output_file.parent.mkdir(parents=True, exist_ok=True)
-        with open(output_file, "w") as f:
+        with open(output_file, "w", encoding="utf-8") as f:
             json.dump(results, f, indent=2)
         print(f"Project index saved to: {output_file}")
 
@@ -87,7 +87,7 @@ def analyze_service(
 
     if output_file:
         output_file.parent.mkdir(parents=True, exist_ok=True)
-        with open(output_file, "w") as f:
+        with open(output_file, "w", encoding="utf-8") as f:
             json.dump(results, f, indent=2)
         print(f"Service analysis saved to: {output_file}")
 

apps/backend/analysis/analyzers/base.py

@@ -99,7 +99,7 @@ class BaseAnalyzer:
     def _read_file(self, path: str) -> str:
         """Read a file relative to the analyzer's path."""
         try:
-            return (self.path / path).read_text()
+            return (self.path / path).read_text(encoding="utf-8")
         except (OSError, UnicodeDecodeError):
             return ""
 

apps/backend/analysis/analyzers/context/auth_detector.py

@@ -126,7 +126,7 @@ class AuthDetector(BaseAnalyzer):
 
         for py_file in all_py_files:
             try:
-                content = py_file.read_text()
+                content = py_file.read_text(encoding="utf-8")
                 # Find custom decorators
                 if (
                     "@require" in content

apps/backend/analysis/analyzers/context/jobs_detector.py

@@ -52,7 +52,7 @@ class JobsDetector(BaseAnalyzer):
         tasks = []
         for task_file in celery_files:
             try:
-                content = task_file.read_text()
+                content = task_file.read_text(encoding="utf-8")
                 # Find @celery.task or @shared_task decorators
                 task_pattern = r"@(?:celery\.task|shared_task|app\.task)\s*(?:\([^)]*\))?\s*def\s+(\w+)"
                 task_matches = re.findall(task_pattern, content)

apps/backend/analysis/analyzers/context/monitoring_detector.py

@@ -77,7 +77,7 @@ class MonitoringDetector(BaseAnalyzer):
                 continue
 
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
                 # Look for actual Prometheus imports or usage patterns
                 prometheus_patterns = [
                     "from prometheus_client import",

apps/backend/analysis/analyzers/database_detector.py

@@ -52,7 +52,7 @@ class DatabaseDetector(BaseAnalyzer):
 
         for file_path in py_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -119,7 +119,7 @@ class DatabaseDetector(BaseAnalyzer):
 
         for file_path in model_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -168,7 +168,7 @@ class DatabaseDetector(BaseAnalyzer):
             return models
 
         try:
-            content = schema_file.read_text()
+            content = schema_file.read_text(encoding="utf-8")
         except (OSError, UnicodeDecodeError):
             return models
 
@@ -216,7 +216,7 @@ class DatabaseDetector(BaseAnalyzer):
 
         for file_path in ts_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -265,7 +265,7 @@ class DatabaseDetector(BaseAnalyzer):
 
         for file_path in schema_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -295,7 +295,7 @@ class DatabaseDetector(BaseAnalyzer):
 
         for file_path in model_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 

apps/backend/analysis/analyzers/project_analyzer_module.py

@@ -287,6 +287,6 @@ class ProjectAnalyzer:
 
     def _read_file(self, path: str) -> str:
         try:
-            return (self.project_dir / path).read_text()
+            return (self.project_dir / path).read_text(encoding="utf-8")
         except (OSError, UnicodeDecodeError):
             return ""

apps/backend/analysis/analyzers/route_detector.py

@@ -66,7 +66,7 @@ class RouteDetector(BaseAnalyzer):
 
         for file_path in files_to_check:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -130,7 +130,7 @@ class RouteDetector(BaseAnalyzer):
 
         for file_path in files_to_check:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -179,7 +179,7 @@ class RouteDetector(BaseAnalyzer):
 
         for file_path in url_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -218,7 +218,7 @@ class RouteDetector(BaseAnalyzer):
         files_to_check = js_files + ts_files
         for file_path in files_to_check:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -283,7 +283,7 @@ class RouteDetector(BaseAnalyzer):
                 route_path = re.sub(r"\[([^\]]+)\]", r":\1", route_path)
 
                 try:
-                    content = route_file.read_text()
+                    content = route_file.read_text(encoding="utf-8")
                     # Detect exported methods: export async function GET(request)
                     methods = re.findall(
                         r"export\s+(?:async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH)",
@@ -348,7 +348,7 @@ class RouteDetector(BaseAnalyzer):
 
         for file_path in go_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 
@@ -384,7 +384,7 @@ class RouteDetector(BaseAnalyzer):
 
         for file_path in rust_files:
             try:
-                content = file_path.read_text()
+                content = file_path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
                 continue
 

apps/backend/analysis/ci_discovery.py

@@ -163,7 +163,7 @@ class CIDiscovery:
             )
 
             try:
-                content = wf_file.read_text()
+                content = wf_file.read_text(encoding="utf-8")
                 workflow_data = self._parse_yaml(content)
 
                 if not workflow_data:
@@ -242,7 +242,7 @@ class CIDiscovery:
         )
 
         try:
-            content = config_file.read_text()
+            content = config_file.read_text(encoding="utf-8")
             data = self._parse_yaml(content)
 
             if not data:
@@ -312,7 +312,7 @@ class CIDiscovery:
         )
 
         try:
-            content = config_file.read_text()
+            content = config_file.read_text(encoding="utf-8")
             data = self._parse_yaml(content)
 
             if not data:
@@ -370,7 +370,7 @@ class CIDiscovery:
         )
 
         try:
-            content = jenkinsfile.read_text()
+            content = jenkinsfile.read_text(encoding="utf-8")
 
             # Extract sh commands using regex
             sh_pattern = re.compile(r'sh\s+[\'"]([^\'"]+)[\'"]')

apps/backend/analysis/insight_extractor.py

@@ -237,7 +237,7 @@ def _get_subtask_description(spec_dir: Path, subtask_id: str) -> str:
         return f"Subtask: {subtask_id}"
 
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
 
         # Search through phases for the subtask
@@ -280,7 +280,7 @@ def _build_extraction_prompt(inputs: dict) -> str:
     prompt_file = Path(__file__).parent / "prompts" / "insight_extractor.md"
 
     if prompt_file.exists():
-        base_prompt = prompt_file.read_text()
+        base_prompt = prompt_file.read_text(encoding="utf-8")
     else:
         # Fallback if prompt file missing
         base_prompt = """Extract structured insights from this coding session.

apps/backend/analysis/test_discovery.py

@@ -302,7 +302,7 @@ class TestDiscovery:
         try:
             with open(package_json, encoding="utf-8") as f:
                 pkg = json.load(f)
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return
 
         deps = pkg.get("dependencies", {})
@@ -398,7 +398,7 @@ class TestDiscovery:
         # Check pyproject.toml
         pyproject = project_dir / "pyproject.toml"
         if pyproject.exists():
-            content = pyproject.read_text()
+            content = pyproject.read_text(encoding="utf-8")
 
             # Check for pytest
             if "pytest" in content:
@@ -418,7 +418,7 @@ class TestDiscovery:
         # Check requirements.txt
         requirements = project_dir / "requirements.txt"
         if requirements.exists():
-            content = requirements.read_text().lower()
+            content = requirements.read_text(encoding="utf-8").lower()
             if "pytest" in content and not any(
                 f.name == "pytest" for f in result.frameworks
             ):
@@ -496,7 +496,7 @@ class TestDiscovery:
         if not gemfile.exists():
             return
 
-        content = gemfile.read_text().lower()
+        content = gemfile.read_text(encoding="utf-8").lower()
 
         if "rspec" in content or (project_dir / ".rspec").exists():
             result.frameworks.append(

apps/backend/cli/batch_commands.py

@@ -31,7 +31,7 @@ def handle_batch_create_command(batch_file: str, project_dir: str) -> bool:
         return False
 
     try:
-        with open(batch_path) as f:
+        with open(batch_path, encoding="utf-8") as f:
             batch_data = json.load(f)
     except json.JSONDecodeError as e:
         print_status(f"Invalid JSON in batch file: {e}", "error")
@@ -81,7 +81,7 @@ def handle_batch_create_command(batch_file: str, project_dir: str) -> bool:
         }
 
         req_file = spec_dir / "requirements.json"
-        with open(req_file, "w") as f:
+        with open(req_file, "w", encoding="utf-8") as f:
             json.dump(requirements, f, indent=2, default=str)
 
         created_specs.append(
@@ -145,7 +145,7 @@ def handle_batch_status_command(project_dir: str) -> bool:
 
         if req_file.exists():
             try:
-                with open(req_file) as f:
+                with open(req_file, encoding="utf-8") as f:
                     req = json.load(f)
                     title = req.get("task_description", title)
             except json.JSONDecodeError:

apps/backend/cli/build_commands.py

@@ -421,7 +421,7 @@ def _handle_build_interrupt(
         if human_input:
             # Save to HUMAN_INPUT.md
             input_file = spec_dir / "HUMAN_INPUT.md"
-            input_file.write_text(human_input)
+            input_file.write_text(human_input, encoding="utf-8")
 
             content = [
                 success(f"{icon(Icons.SUCCESS)} INSTRUCTIONS SAVED"),

apps/backend/cli/followup_commands.py

@@ -121,7 +121,7 @@ def collect_followup_task(spec_dir: Path, max_retries: int = 3) -> str | None:
                 # Expand ~ and resolve path
                 file_path = Path(file_path_str).expanduser().resolve()
                 if file_path.exists():
-                    followup_task = file_path.read_text().strip()
+                    followup_task = file_path.read_text(encoding="utf-8").strip()
                     if followup_task:
                         print_status(
                             f"Loaded {len(followup_task)} characters from file",
@@ -195,7 +195,7 @@ def collect_followup_task(spec_dir: Path, max_retries: int = 3) -> str | None:
 
         # Save to FOLLOWUP_REQUEST.md
         request_file = spec_dir / "FOLLOWUP_REQUEST.md"
-        request_file.write_text(followup_task)
+        request_file.write_text(followup_task, encoding="utf-8")
 
         # Show confirmation
         content = [
@@ -285,7 +285,7 @@ def handle_followup_command(
     # Check for prior follow-ups (for sequential follow-up context)
     prior_followup_count = 0
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan_data = json.load(f)
         phases = plan_data.get("phases", [])
         # Count phases that look like follow-up phases (name contains "Follow" or high phase number)

apps/backend/cli/input_handlers.py

@@ -149,7 +149,7 @@ def read_from_file() -> str | None:
         # Expand ~ and resolve path
         file_path = Path(file_path_input).expanduser().resolve()
         if file_path.exists():
-            content = file_path.read_text().strip()
+            content = file_path.read_text(encoding="utf-8").strip()
             if content:
                 print_status(
                     f"Loaded {len(content)} characters from file",

apps/backend/cli/main.py

@@ -74,12 +74,12 @@ Examples:
   python auto-claude/run.py --spec 001 --qa-status      # Check QA validation status
 
 Prerequisites:
-  1. Create a spec first: claude /spec
-  2. Run 'claude setup-token' and set CLAUDE_CODE_OAUTH_TOKEN
+  1. Authenticate: Run 'claude' and type '/login'
+  2. Create a spec first: claude /spec
 
 Environment Variables:
-  CLAUDE_CODE_OAUTH_TOKEN  Your Claude Code OAuth token (required)
-                           Get it by running: claude setup-token
+  CLAUDE_CODE_OAUTH_TOKEN  Your Claude Code OAuth token (auto-detected from Keychain)
+                           Or authenticate via: claude → /login
   AUTO_BUILD_MODEL         Override default model (optional)
         """,
     )

apps/backend/cli/workspace_commands.py

@@ -182,7 +182,7 @@ def _detect_worktree_base_branch(
     config_path = worktree_path / ".auto-claude" / "worktree-config.json"
     if config_path.exists():
         try:
-            config = json.loads(config_path.read_text())
+            config = json.loads(config_path.read_text(encoding="utf-8"))
             if config.get("base_branch"):
                 debug(
                     MODULE,

apps/backend/context/builder.py

@@ -37,8 +37,12 @@ class ContextBuilder:
         """Load project index from file or create new one (.auto-claude is the installed instance)."""
         index_file = self.project_dir / ".auto-claude" / "project_index.json"
         if index_file.exists():
-            with open(index_file) as f:
-                return json.load(f)
+            try:
+                with open(index_file, encoding="utf-8") as f:
+                    return json.load(f)
+            except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+                # Corrupted or legacy-encoded file, regenerate
+                pass
 
         # Try to create one
         from analyzer import analyze_project
@@ -230,7 +234,9 @@ class ContextBuilder:
         if context_file.exists():
             return {
                 "source": "SERVICE_CONTEXT.md",
-                "content": context_file.read_text()[:2000],  # First 2000 chars
+                "content": context_file.read_text(encoding="utf-8")[
+                    :2000
+                ],  # First 2000 chars
             }
 
         # Generate basic context from service info

apps/backend/context/main.py

@@ -72,7 +72,7 @@ def build_task_context(
 
     if output_file:
         output_file.parent.mkdir(parents=True, exist_ok=True)
-        with open(output_file, "w") as f:
+        with open(output_file, "w", encoding="utf-8") as f:
             json.dump(result, f, indent=2)
         print(f"Task context saved to: {output_file}")
 

apps/backend/context/pattern_discovery.py

@@ -38,7 +38,7 @@ class PatternDiscoverer:
         for match in reference_files[:max_files]:
             try:
                 file_path = self.project_dir / match.path
-                content = file_path.read_text(errors="ignore")
+                content = file_path.read_text(encoding="utf-8", errors="ignore")
 
                 # Look for common patterns
                 for keyword in keywords:

apps/backend/context/search.py

@@ -41,7 +41,7 @@ class CodeSearcher:
 
         for file_path in self._iter_code_files(service_path):
             try:
-                content = file_path.read_text(errors="ignore")
+                content = file_path.read_text(encoding="utf-8", errors="ignore")
                 content_lower = content.lower()
 
                 # Score this file

apps/backend/context/serialization.py

@@ -41,7 +41,7 @@ def save_context(context: TaskContext, output_file: Path) -> None:
         output_file: Path to output JSON file
     """
     output_file.parent.mkdir(parents=True, exist_ok=True)
-    with open(output_file, "w") as f:
+    with open(output_file, "w", encoding="utf-8") as f:
         json.dump(serialize_context(context), f, indent=2)
 
 
@@ -55,5 +55,5 @@ def load_context(input_file: Path) -> dict:
     Returns:
         Context dictionary
     """
-    with open(input_file) as f:
+    with open(input_file, encoding="utf-8") as f:
         return json.load(f)

apps/backend/core/auth.py

@@ -9,12 +9,11 @@ for custom API endpoints.
 import json
 import logging
 import os
+import shutil
 import subprocess
 from typing import TYPE_CHECKING
 
 from core.platform import (
-    find_executable,
-    get_claude_detection_paths,
     is_linux,
     is_macos,
     is_windows,
@@ -59,6 +58,10 @@ SDK_ENV_VARS = [
     "API_TIMEOUT_MS",
     # Windows-specific: Git Bash path for Claude Code CLI
     "CLAUDE_CODE_GIT_BASH_PATH",
+    # Claude CLI path override (allows frontend to pass detected CLI path to SDK)
+    "CLAUDE_CLI_PATH",
+    # Profile's custom config directory (for multi-profile token storage)
+    "CLAUDE_CONFIG_DIR",
 ]
 
 
@@ -239,7 +242,7 @@ def _decrypt_token_macos(encrypted_data: str) -> str:
         ValueError: If decryption fails or Claude CLI not available
     """
     # Verify Claude CLI is installed (required for future decryption implementation)
-    if not find_executable("claude", get_claude_detection_paths()):
+    if not shutil.which("claude"):
         raise ValueError(
             "Claude Code CLI not found. Please install it from https://code.claude.com"
         )
@@ -313,6 +316,36 @@ def _decrypt_token_windows(encrypted_data: str) -> str:
     )
 
 
+def _try_decrypt_token(token: str | None) -> str | None:
+    """
+    Attempt to decrypt an encrypted token, returning original if decryption fails.
+
+    This helper centralizes the decrypt-or-return-as-is logic used when resolving
+    tokens from various sources (env vars, config dir, keychain).
+
+    Args:
+        token: Token string (may be encrypted with "enc:" prefix, plaintext, or None)
+
+    Returns:
+        - Decrypted token if successfully decrypted
+        - Original token if decryption fails (allows client validation to report error)
+        - Original token if not encrypted
+        - None if token is None
+    """
+    if not token:
+        return None
+
+    if is_encrypted_token(token):
+        try:
+            return decrypt_token(token)
+        except ValueError:
+            # Decryption failed - return encrypted token so client validation
+            # (validate_token_not_encrypted) can provide specific error message.
+            return token
+
+    return token
+
+
 def get_token_from_keychain() -> str | None:
     """
     Get authentication token from system credential store.
@@ -477,14 +510,65 @@ def _get_token_from_linux_secret_service() -> str | None:
         return None
 
 
-def get_auth_token() -> str | None:
+def _get_token_from_config_dir(config_dir: str) -> str | None:
     """
-    Get authentication token from environment variables or system credential store.
+    Read token from a custom config directory's credentials file.
+
+    Claude Code stores credentials in .credentials.json within the config directory.
+    This function reads from a profile's custom configDir instead of the default location.
+
+    Args:
+        config_dir: Path to the config directory (e.g., ~/.auto-claude/profiles/work)
+
+    Returns:
+        Token string if found, None otherwise
+    """
+    # Expand ~ if present
+    expanded_dir = os.path.expanduser(config_dir)
+
+    # Claude stores credentials in these files within the config dir
+    cred_files = [
+        os.path.join(expanded_dir, ".credentials.json"),
+        os.path.join(expanded_dir, "credentials.json"),
+    ]
+
+    for cred_path in cred_files:
+        if os.path.exists(cred_path):
+            try:
+                with open(cred_path, encoding="utf-8") as f:
+                    data = json.load(f)
+
+                # Try both credential structures
+                oauth_data = data.get("claudeAiOauth") or data.get("oauthAccount") or {}
+                token = oauth_data.get("accessToken")
+
+                # Accept both plaintext tokens (sk-ant-oat01-) and encrypted tokens (enc:)
+                if token and (
+                    token.startswith("sk-ant-oat01-") or token.startswith("enc:")
+                ):
+                    logger.debug(f"Found token in {cred_path}")
+                    return token
+            except (json.JSONDecodeError, KeyError, Exception) as e:
+                logger.debug(f"Failed to read {cred_path}: {e}")
+                continue
+
+    return None
+
+
+def get_auth_token(config_dir: str | None = None) -> str | None:
+    """
+    Get authentication token from environment variables or credential store.
+
+    Args:
+        config_dir: Optional custom config directory (profile's configDir).
+                   If provided, reads credentials from this directory.
+                   If None, checks CLAUDE_CONFIG_DIR env var, then uses default locations.
 
     Checks multiple sources in priority order:
     1. CLAUDE_CODE_OAUTH_TOKEN (env var)
     2. ANTHROPIC_AUTH_TOKEN (CCR/proxy env var for enterprise setups)
-    3. System credential store (macOS Keychain, Windows Credential Manager, Linux Secret Service)
+    3. Custom config directory (config_dir param or CLAUDE_CONFIG_DIR env var)
+    4. System credential store (macOS Keychain, Windows Credential Manager, Linux Secret Service)
 
     NOTE: ANTHROPIC_API_KEY is intentionally NOT supported to prevent
     silent billing to user's API credits when OAuth is misconfigured.
@@ -495,40 +579,46 @@ def get_auth_token() -> str | None:
     Returns:
         Token string if found, None otherwise
     """
-    # First check environment variables
+    # First check environment variables (highest priority)
     for var in AUTH_TOKEN_ENV_VARS:
         token = os.environ.get(var)
         if token:
-            # Decrypt if token is encrypted
-            if is_encrypted_token(token):
-                try:
-                    token = decrypt_token(token)
-                except ValueError:
-                    # Decryption failed - return encrypted token so client validation
-                    # can provide specific error message about encrypted format
-                    return token
-            return token
+            return _try_decrypt_token(token)
 
-    # Fallback to system credential store
-    token = get_token_from_keychain()
-    if token and is_encrypted_token(token):
-        try:
-            token = decrypt_token(token)
-        except ValueError:
-            # Decryption failed - return encrypted token so client validation
-            # (validate_token_not_encrypted) can provide specific error message.
-            # This is consistent with env var handling above.
-            return token
-    return token
+    # Check CLAUDE_CONFIG_DIR environment variable (profile's custom config directory)
+    env_config_dir = os.environ.get("CLAUDE_CONFIG_DIR")
+    effective_config_dir = config_dir or env_config_dir
+
+    # If a custom config directory is specified, read from there
+    if effective_config_dir:
+        token = _get_token_from_config_dir(effective_config_dir)
+        if token:
+            return _try_decrypt_token(token)
+
+    # Fallback to system credential store (default locations)
+    return _try_decrypt_token(get_token_from_keychain())
 
 
-def get_auth_token_source() -> str | None:
-    """Get the name of the source that provided the auth token."""
+def get_auth_token_source(config_dir: str | None = None) -> str | None:
+    """
+    Get the name of the source that provided the auth token.
+
+    Args:
+        config_dir: Optional custom config directory (profile's configDir).
+                   If provided, checks this directory for credentials.
+                   If None, checks CLAUDE_CONFIG_DIR env var.
+    """
     # Check environment variables first
     for var in AUTH_TOKEN_ENV_VARS:
         if os.environ.get(var):
             return var
 
+    # Check if token came from custom config directory (profile's configDir)
+    env_config_dir = os.environ.get("CLAUDE_CONFIG_DIR")
+    effective_config_dir = config_dir or env_config_dir
+    if effective_config_dir and _get_token_from_config_dir(effective_config_dir):
+        return "CLAUDE_CONFIG_DIR"
+
     # Check if token came from system credential store
     if get_token_from_keychain():
         if is_macos():
@@ -541,14 +631,19 @@ def get_auth_token_source() -> str | None:
     return None
 
 
-def require_auth_token() -> str:
+def require_auth_token(config_dir: str | None = None) -> str:
     """
     Get authentication token or raise ValueError.
 
+    Args:
+        config_dir: Optional custom config directory (profile's configDir).
+                   If provided, reads credentials from this directory.
+                   If None, checks CLAUDE_CONFIG_DIR env var, then uses default locations.
+
     Raises:
         ValueError: If no auth token is found in any supported source
     """
-    token = get_auth_token()
+    token = get_auth_token(config_dir)
     if not token:
         error_msg = (
             "No OAuth token found.\n\n"
@@ -559,25 +654,30 @@ def require_auth_token() -> str:
         if is_macos():
             error_msg += (
                 "To authenticate:\n"
-                "  1. Run: claude setup-token\n"
-                "  2. The token will be saved to macOS Keychain automatically\n\n"
-                "Or set CLAUDE_CODE_OAUTH_TOKEN in your .env file."
+                "  1. Run: claude\n"
+                "  2. Type: /login\n"
+                "  3. Press Enter to open browser\n"
+                "  4. Complete OAuth login in browser\n\n"
+                "The token will be saved to macOS Keychain automatically."
             )
         elif is_windows():
             error_msg += (
                 "To authenticate:\n"
-                "  1. Run: claude setup-token\n"
-                "  2. The token should be saved to Windows Credential Manager\n\n"
-                "If auto-detection fails, set CLAUDE_CODE_OAUTH_TOKEN in your .env file.\n"
-                "Check: %LOCALAPPDATA%\\Claude\\credentials.json"
+                "  1. Run: claude\n"
+                "  2. Type: /login\n"
+                "  3. Press Enter to open browser\n"
+                "  4. Complete OAuth login in browser\n\n"
+                "The token will be saved to Windows Credential Manager."
             )
         else:
             # Linux
             error_msg += (
                 "To authenticate:\n"
-                "  1. Run: claude setup-token\n"
-                "  2. The token will be saved to the system secret service (gnome-keyring/kwallet)\n\n"
-                "If secret-service is not available, set CLAUDE_CODE_OAUTH_TOKEN in your .env file."
+                "  1. Run: claude\n"
+                "  2. Type: /login\n"
+                "  3. Press Enter to open browser\n"
+                "  4. Complete OAuth login in browser\n\n"
+                "Or set CLAUDE_CODE_OAUTH_TOKEN in your .env file."
             )
         raise ValueError(error_msg)
     return token
@@ -713,3 +813,181 @@ def ensure_claude_code_oauth_token() -> None:
     token = get_auth_token()
     if token:
         os.environ["CLAUDE_CODE_OAUTH_TOKEN"] = token
+
+
+def trigger_login() -> bool:
+    """
+    Trigger Claude Code OAuth login flow.
+
+    Opens the Claude Code CLI and sends /login command to initiate
+    browser-based OAuth authentication. The token is automatically
+    saved to the system credential store (macOS Keychain, Windows
+    Credential Manager).
+
+    Returns:
+        True if login was successful, False otherwise
+    """
+    if is_macos():
+        return _trigger_login_macos()
+    elif is_windows():
+        return _trigger_login_windows()
+    else:
+        # Linux: fall back to manual instructions
+        print("\nTo authenticate, run 'claude' and type '/login'")
+        return False
+
+
+def _trigger_login_macos() -> bool:
+    """Trigger login on macOS using expect."""
+    import shutil
+    import tempfile
+
+    # Check if expect is available
+    if not shutil.which("expect"):
+        print("\nTo authenticate, run 'claude' and type '/login'")
+        return False
+
+    # Create expect script
+    expect_script = """#!/usr/bin/expect -f
+set timeout 120
+spawn claude
+expect {
+    -re ".*" {
+        send "/login\\r"
+        expect {
+            "Press Enter" {
+                send "\\r"
+            }
+            -re ".*login.*" {
+                send "\\r"
+            }
+            timeout {
+                send "\\r"
+            }
+        }
+    }
+}
+# Keep running until user completes login or exits
+interact
+"""
+
+    # Use TemporaryDirectory context manager for automatic cleanup
+    # This prevents information leakage about authentication activity
+    # Directory created with mode 0o700 (owner read/write/execute only)
+    try:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            # Ensure directory has owner-only permissions
+            os.chmod(temp_dir, 0o700)
+
+            # Write expect script to temp file in our private directory
+            script_path = os.path.join(temp_dir, "login.exp")
+            with open(script_path, "w", encoding="utf-8") as f:
+                f.write(expect_script)
+
+            # Set script permissions to owner-only (0o700)
+            os.chmod(script_path, 0o700)
+
+            print("\n" + "=" * 60)
+            print("CLAUDE CODE LOGIN")
+            print("=" * 60)
+            print("\nOpening Claude Code for authentication...")
+            print("A browser window will open for OAuth login.")
+            print("After completing login in the browser, press Ctrl+C to exit.\n")
+
+            # Run expect script
+            subprocess.run(
+                ["expect", script_path],
+                timeout=300,  # 5 minute timeout
+            )
+
+            # Verify token was saved
+            token = get_token_from_keychain()
+            if token:
+                print("\n✓ Login successful! Token saved to macOS Keychain.")
+                return True
+            else:
+                print(
+                    "\n✗ Login may not have completed. Try running 'claude' and type '/login'"
+                )
+                return False
+
+    except subprocess.TimeoutExpired:
+        print("\nLogin timed out. Try running 'claude' manually and type '/login'")
+        return False
+    except KeyboardInterrupt:
+        # User pressed Ctrl+C - check if login completed
+        token = get_token_from_keychain()
+        if token:
+            print("\n✓ Login successful! Token saved to macOS Keychain.")
+            return True
+        return False
+    except Exception as e:
+        print(f"\nLogin failed: {e}")
+        print("Try running 'claude' manually and type '/login'")
+        return False
+
+
+def _trigger_login_windows() -> bool:
+    """Trigger login on Windows."""
+    # Windows doesn't have expect by default, so we use a simpler approach
+    # that just launches claude and tells the user what to type
+    print("\n" + "=" * 60)
+    print("CLAUDE CODE LOGIN")
+    print("=" * 60)
+    print("\nLaunching Claude Code...")
+    print("Please type '/login' and press Enter.")
+    print("A browser window will open for OAuth login.\n")
+
+    try:
+        # Launch claude interactively
+        subprocess.run(["claude"], timeout=300)
+
+        # Verify token was saved
+        token = _get_token_from_windows_credential_files()
+        if token:
+            print("\n✓ Login successful!")
+            return True
+        else:
+            print("\n✗ Login may not have completed.")
+            return False
+
+    except Exception as e:
+        print(f"\nLogin failed: {e}")
+        return False
+
+
+def ensure_authenticated() -> str:
+    """
+    Ensure the user is authenticated, prompting for login if needed.
+
+    Checks for existing token and triggers login flow if not found.
+
+    Returns:
+        The authentication token
+
+    Raises:
+        ValueError: If authentication fails after login attempt
+    """
+    # First check if already authenticated
+    token = get_auth_token()
+    if token:
+        return token
+
+    # No token found - trigger login
+    print("\nNo OAuth token found. Starting login flow...")
+
+    if trigger_login():
+        # Re-check for token after login
+        token = get_auth_token()
+        if token:
+            return token
+
+    # Login failed or was cancelled
+    raise ValueError(
+        "Authentication required.\n\n"
+        "To authenticate:\n"
+        "  1. Run: claude\n"
+        "  2. Type: /login\n"
+        "  3. Press Enter to open browser\n"
+        "  4. Complete OAuth login in browser"
+    )

apps/backend/core/client.py

@@ -16,17 +16,12 @@ import copy
 import json
 import logging
 import os
-import shutil
-import subprocess
 import threading
 import time
 from pathlib import Path
 from typing import Any
 
 from core.platform import (
-    get_claude_detection_paths_structured,
-    get_comspec_path,
-    is_macos,
     is_windows,
     validate_cli_path,
 )
@@ -130,220 +125,6 @@ def invalidate_project_cache(project_dir: Path | None = None) -> None:
                 logger.debug(f"Invalidated project index cache for {project_dir}")
 
 
-# =============================================================================
-# Claude CLI Path Detection
-# =============================================================================
-# Cross-platform detection of Claude Code CLI binary.
-# This mirrors the frontend's cli-tool-manager.ts logic to ensure consistency.
-
-_CLAUDE_CLI_CACHE: dict[str, str | None] = {}
-_CLI_CACHE_LOCK = threading.Lock()
-
-
-def _get_claude_detection_paths() -> dict[str, list[str] | str]:
-    """
-    Get all candidate paths for Claude CLI detection.
-
-    This is a thin wrapper around the platform module's implementation.
-    See core/platform/__init__.py:get_claude_detection_paths_structured()
-    for the canonical implementation.
-
-    Returns:
-        Dict with 'homebrew', 'platform', and 'nvm_versions_dir' keys
-    """
-    return get_claude_detection_paths_structured()
-
-
-def _validate_claude_cli(cli_path: str) -> tuple[bool, str | None]:
-    """
-    Validate that a Claude CLI path is executable and returns a version.
-
-    Includes security validation to prevent command injection attacks.
-
-    Args:
-        cli_path: Path to the Claude CLI executable
-
-    Returns:
-        Tuple of (is_valid, version_string or None)
-
-    Note:
-        Cross-references with frontend's validateClaudeCliAsync() in
-        apps/frontend/src/main/ipc-handlers/claude-code-handlers.ts
-        Both should be kept in sync for consistent behavior.
-    """
-    import re
-
-    # Security validation: reject paths with shell metacharacters or directory traversal
-    if not validate_cli_path(cli_path):
-        logger.warning(f"Rejecting insecure Claude CLI path: {cli_path}")
-        return False, None
-
-    try:
-        # Augment PATH with the CLI directory for proper resolution
-        env = os.environ.copy()
-        cli_dir = os.path.dirname(cli_path)
-        if cli_dir:
-            env["PATH"] = cli_dir + os.pathsep + env.get("PATH", "")
-
-        # For Windows .cmd/.bat files, use cmd.exe with proper quoting
-        # /d = disable AutoRun registry commands
-        # /s = strip first and last quotes, preserving inner quotes
-        # /c = run command then terminate
-        if is_windows() and cli_path.lower().endswith((".cmd", ".bat")):
-            # Get cmd.exe path from platform module
-            cmd_exe = get_comspec_path()
-            # Use double-quoted command line for paths with spaces
-            cmd_line = f'""{cli_path}" --version"'
-            result = subprocess.run(
-                [cmd_exe, "/d", "/s", "/c", cmd_line],
-                capture_output=True,
-                text=True,
-                timeout=5,
-                env=env,
-                creationflags=subprocess.CREATE_NO_WINDOW,
-            )
-        else:
-            result = subprocess.run(
-                [cli_path, "--version"],
-                capture_output=True,
-                text=True,
-                timeout=5,
-                env=env,
-                creationflags=subprocess.CREATE_NO_WINDOW if is_windows() else 0,
-            )
-
-        if result.returncode == 0:
-            # Extract version from output (e.g., "claude-code version 1.0.0")
-            output = result.stdout.strip()
-            match = re.search(r"(\d+\.\d+\.\d+)", output)
-            version = match.group(1) if match else output.split("\n")[0]
-            return True, version
-
-        return False, None
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError) as e:
-        logger.debug(f"Claude CLI validation failed for {cli_path}: {e}")
-        return False, None
-
-
-def find_claude_cli() -> str | None:
-    """
-    Find the Claude Code CLI binary path.
-
-    Uses cross-platform detection with the following priority:
-    1. CLAUDE_CLI_PATH environment variable (user override)
-    2. shutil.which() - system PATH lookup
-    3. Homebrew paths (macOS)
-    4. NVM paths (Unix - checks Node.js version manager)
-    5. Platform-specific standard locations
-
-    Returns:
-        Path to Claude CLI if found and valid, None otherwise
-    """
-    # Check cache first
-    cache_key = "claude_cli"
-    with _CLI_CACHE_LOCK:
-        if cache_key in _CLAUDE_CLI_CACHE:
-            cached = _CLAUDE_CLI_CACHE[cache_key]
-            logger.debug(f"Using cached Claude CLI path: {cached}")
-            return cached
-
-    paths = _get_claude_detection_paths()
-
-    # 1. Check environment variable override
-    env_path = os.environ.get("CLAUDE_CLI_PATH")
-    if env_path:
-        if Path(env_path).exists():
-            valid, version = _validate_claude_cli(env_path)
-            if valid:
-                logger.info(f"Using CLAUDE_CLI_PATH: {env_path} (v{version})")
-                with _CLI_CACHE_LOCK:
-                    _CLAUDE_CLI_CACHE[cache_key] = env_path
-                return env_path
-        logger.warning(f"CLAUDE_CLI_PATH is set but invalid: {env_path}")
-
-    # 2. Try shutil.which() - most reliable cross-platform PATH lookup
-    which_path = shutil.which("claude")
-    if which_path:
-        valid, version = _validate_claude_cli(which_path)
-        if valid:
-            logger.info(f"Found Claude CLI in PATH: {which_path} (v{version})")
-            with _CLI_CACHE_LOCK:
-                _CLAUDE_CLI_CACHE[cache_key] = which_path
-            return which_path
-
-    # 3. Homebrew paths (macOS)
-    if is_macos():
-        for hb_path in paths["homebrew"]:
-            if Path(hb_path).exists():
-                valid, version = _validate_claude_cli(hb_path)
-                if valid:
-                    logger.info(f"Found Claude CLI (Homebrew): {hb_path} (v{version})")
-                    with _CLI_CACHE_LOCK:
-                        _CLAUDE_CLI_CACHE[cache_key] = hb_path
-                    return hb_path
-
-    # 4. NVM paths (Unix only) - check Node.js version manager installations
-    if not is_windows():
-        nvm_dir = Path(paths["nvm_versions_dir"])
-        if nvm_dir.exists():
-            try:
-                # Get all version directories and sort by version (newest first)
-                version_dirs = []
-                for entry in nvm_dir.iterdir():
-                    if entry.is_dir() and entry.name.startswith("v"):
-                        # Parse version: v20.0.0 -> (20, 0, 0)
-                        try:
-                            parts = entry.name[1:].split(".")
-                            if len(parts) == 3:
-                                version_dirs.append(
-                                    (tuple(int(p) for p in parts), entry.name)
-                                )
-                        except ValueError:
-                            continue
-
-                # Sort by version descending (newest first)
-                version_dirs.sort(reverse=True)
-
-                for _, version_name in version_dirs:
-                    nvm_claude = nvm_dir / version_name / "bin" / "claude"
-                    if nvm_claude.exists():
-                        valid, version = _validate_claude_cli(str(nvm_claude))
-                        if valid:
-                            logger.info(
-                                f"Found Claude CLI (NVM): {nvm_claude} (v{version})"
-                            )
-                            with _CLI_CACHE_LOCK:
-                                _CLAUDE_CLI_CACHE[cache_key] = str(nvm_claude)
-                            return str(nvm_claude)
-            except OSError as e:
-                logger.debug(f"Error scanning NVM directory: {e}")
-
-    # 5. Platform-specific standard locations
-    for plat_path in paths["platform"]:
-        if Path(plat_path).exists():
-            valid, version = _validate_claude_cli(plat_path)
-            if valid:
-                logger.info(f"Found Claude CLI: {plat_path} (v{version})")
-                with _CLI_CACHE_LOCK:
-                    _CLAUDE_CLI_CACHE[cache_key] = plat_path
-                return plat_path
-
-    # Not found
-    logger.warning(
-        "Claude CLI not found. Install with: npm install -g @anthropic-ai/claude-code"
-    )
-    with _CLI_CACHE_LOCK:
-        _CLAUDE_CLI_CACHE[cache_key] = None
-    return None
-
-
-def clear_claude_cli_cache() -> None:
-    """Clear the Claude CLI path cache, forcing re-detection on next call."""
-    with _CLI_CACHE_LOCK:
-        _CLAUDE_CLI_CACHE.clear()
-    logger.debug("Claude CLI cache cleared")
-
-
 from agents.tools_pkg import (
     CONTEXT7_TOOLS,
     ELECTRON_TOOLS,
@@ -709,6 +490,7 @@ def create_client(
        (see security.py for ALLOWED_COMMANDS)
     4. Tool filtering - Each agent type only sees relevant tools (prevents misuse)
     """
+    # Get OAuth token - Claude CLI handles token lifecycle internally
     oauth_token = require_auth_token()
 
     # Validate token is not encrypted before passing to SDK
@@ -875,7 +657,7 @@ def create_client(
 
     # Write settings to a file in the project directory
     settings_file = project_dir / ".claude_settings.json"
-    with open(settings_file, "w") as f:
+    with open(settings_file, "w", encoding="utf-8") as f:
         json.dump(security_settings, f, indent=2)
 
     print(f"Security settings: {settings_file}")
@@ -1013,14 +795,6 @@ def create_client(
         print("   - CLAUDE.md: disabled by project settings")
     print()
 
-    # Find Claude CLI path for SDK
-    # This ensures the SDK can find the Claude Code binary even if it's not in PATH
-    cli_path = find_claude_cli()
-    if cli_path:
-        print(f"   - Claude CLI: {cli_path}")
-    else:
-        print("   - Claude CLI: using SDK default detection")
-
     # Build options dict, conditionally including output_format
     options_kwargs: dict[str, Any] = {
         "model": model,
@@ -1045,9 +819,12 @@ def create_client(
         "enable_file_checkpointing": True,
     }
 
-    # Add CLI path if found (helps SDK find Claude Code in non-standard locations)
-    if cli_path:
-        options_kwargs["cli_path"] = cli_path
+    # Optional: Allow CLI path override via environment variable
+    # The SDK bundles its own CLI, but users can override if needed
+    env_cli_path = os.environ.get("CLAUDE_CLI_PATH")
+    if env_cli_path and validate_cli_path(env_cli_path):
+        options_kwargs["cli_path"] = env_cli_path
+        logger.info(f"Using CLAUDE_CLI_PATH override: {env_cli_path}")
 
     # Add structured output format if specified
     # See: https://platform.claude.com/docs/en/agent-sdk/structured-outputs

apps/backend/core/debug.py

@@ -110,7 +110,7 @@ def _write_log(message: str, to_file: bool = True) -> None:
                 import re
 
                 clean_message = re.sub(r"\033\[[0-9;]*m", "", message)
-                with open(log_file, "a") as f:
+                with open(log_file, "a", encoding="utf-8") as f:
                     f.write(clean_message + "\n")
             except Exception:
                 pass  # Silently fail file logging

apps/backend/core/progress.py

@@ -43,7 +43,7 @@ def count_subtasks(spec_dir: Path) -> tuple[int, int]:
         return 0, 0
 
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
 
         total = 0
@@ -56,7 +56,7 @@ def count_subtasks(spec_dir: Path) -> tuple[int, int]:
                     completed += 1
 
         return completed, total
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return 0, 0
 
 
@@ -81,7 +81,7 @@ def count_subtasks_detailed(spec_dir: Path) -> dict:
         return result
 
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
 
         for phase in plan.get("phases", []):
@@ -94,7 +94,7 @@ def count_subtasks_detailed(spec_dir: Path) -> dict:
                     result["pending"] += 1
 
         return result
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return result
 
 
@@ -182,7 +182,7 @@ def print_progress_summary(spec_dir: Path, show_next: bool = True) -> None:
 
         # Phase summary
         try:
-            with open(spec_dir / "implementation_plan.json") as f:
+            with open(spec_dir / "implementation_plan.json", encoding="utf-8") as f:
                 plan = json.load(f)
 
             print("\nPhases:")
@@ -230,8 +230,8 @@ def print_progress_summary(spec_dir: Path, show_next: bool = True) -> None:
                         f"  {icon(Icons.ARROW_RIGHT)} Next: {highlight(next_id)} - {next_desc}"
                     )
 
-        except (OSError, json.JSONDecodeError):
-            pass
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+            pass  # Ignore corrupted/unreadable progress files
     else:
         print()
         print_status("No implementation subtasks yet - planner needs to run", "pending")
@@ -302,7 +302,7 @@ def get_plan_summary(spec_dir: Path) -> dict:
         }
 
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
 
         summary = {
@@ -355,7 +355,7 @@ def get_plan_summary(spec_dir: Path) -> dict:
 
         return summary
 
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return {
             "workflow_type": None,
             "total_phases": 0,
@@ -376,7 +376,7 @@ def get_current_phase(spec_dir: Path) -> dict | None:
         return None
 
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
 
         for phase in plan.get("phases", []):
@@ -396,7 +396,7 @@ def get_current_phase(spec_dir: Path) -> dict | None:
 
         return None
 
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return None
 
 
@@ -470,7 +470,7 @@ def get_next_subtask(spec_dir: Path) -> dict | None:
 
         return None
 
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return None
 
 

apps/backend/core/sentry.py

@@ -53,7 +53,7 @@ def _get_version() -> str:
         if package_json.exists():
             import json
 
-            with open(package_json) as f:
+            with open(package_json, encoding="utf-8") as f:
                 data = json.load(f)
                 return data.get("version", "0.0.0")
     except Exception as e:

apps/backend/core/simple_client.py

@@ -21,6 +21,7 @@ Example usage:
     client = create_simple_client(agent_type="insights", cwd=project_dir)
 """
 
+import logging
 from pathlib import Path
 
 from agents.tools_pkg import get_agent_config, get_default_thinking_level
@@ -30,9 +31,11 @@ from core.auth import (
     require_auth_token,
     validate_token_not_encrypted,
 )
-from core.client import find_claude_cli
+from core.platform import validate_cli_path
 from phase_config import get_thinking_budget
 
+logger = logging.getLogger(__name__)
+
 
 def create_simple_client(
     agent_type: str = "merge_resolver",
@@ -95,10 +98,8 @@ def create_simple_client(
         thinking_level = get_default_thinking_level(agent_type)
         max_thinking_tokens = get_thinking_budget(thinking_level)
 
-    # Find Claude CLI path (handles non-standard installations)
-    cli_path = find_claude_cli()
-
     # Build options dict
+    # Note: SDK bundles its own CLI, so no cli_path detection needed
     options_kwargs = {
         "model": model,
         "system_prompt": system_prompt,
@@ -112,8 +113,10 @@ def create_simple_client(
     if max_thinking_tokens is not None:
         options_kwargs["max_thinking_tokens"] = max_thinking_tokens
 
-    # Add CLI path if found
-    if cli_path:
-        options_kwargs["cli_path"] = cli_path
+    # Optional: Allow CLI path override via environment variable
+    env_cli_path = os.environ.get("CLAUDE_CLI_PATH")
+    if env_cli_path and validate_cli_path(env_cli_path):
+        options_kwargs["cli_path"] = env_cli_path
+        logger.info(f"Using CLAUDE_CLI_PATH override: {env_cli_path}")
 
     return ClaudeSDKClient(options=ClaudeAgentOptions(**options_kwargs))

apps/backend/core/workspace/models.py

@@ -93,7 +93,7 @@ class MergeLock:
                 os.close(fd)
 
                 # Write our PID to the lock file
-                self.lock_file.write_text(str(os.getpid()))
+                self.lock_file.write_text(str(os.getpid()), encoding="utf-8")
                 self.acquired = True
                 return self
 
@@ -101,7 +101,7 @@ class MergeLock:
                 # Lock file exists - check if process is still running
                 if self.lock_file.exists():
                     try:
-                        pid = int(self.lock_file.read_text().strip())
+                        pid = int(self.lock_file.read_text(encoding="utf-8").strip())
                         # Import locally to avoid circular dependency
                         import os as _os
 
@@ -183,7 +183,7 @@ class SpecNumberLock:
                 os.close(fd)
 
                 # Write our PID to the lock file
-                self.lock_file.write_text(str(os.getpid()))
+                self.lock_file.write_text(str(os.getpid()), encoding="utf-8")
                 self.acquired = True
                 return self
 
@@ -191,7 +191,7 @@ class SpecNumberLock:
                 # Lock file exists - check if process is still running
                 if self.lock_file.exists():
                     try:
-                        pid = int(self.lock_file.read_text().strip())
+                        pid = int(self.lock_file.read_text(encoding="utf-8").strip())
                         import os as _os
 
                         try:

apps/backend/core/workspace/setup.py

@@ -412,10 +412,10 @@ def setup_workspace(
         if PROFILE_FILENAME in security_files_copied:
             profile_path = worktree_info.path / PROFILE_FILENAME
             try:
-                with open(profile_path) as f:
+                with open(profile_path, encoding="utf-8") as f:
                     profile_data = json.load(f)
                 profile_data["inherited_from"] = str(project_dir.resolve())
-                with open(profile_path, "w") as f:
+                with open(profile_path, "w", encoding="utf-8") as f:
                     json.dump(profile_data, f, indent=2)
                 debug(
                     MODULE, f"Marked security profile as inherited from {project_dir}"
@@ -474,7 +474,7 @@ def ensure_timeline_hook_installed(project_dir: Path) -> None:
 
         # Handle worktrees (where .git is a file, not directory)
         if git_dir.is_file():
-            content = git_dir.read_text().strip()
+            content = git_dir.read_text(encoding="utf-8").strip()
             if content.startswith("gitdir:"):
                 git_dir = Path(content.split(":", 1)[1].strip())
             else:
@@ -484,7 +484,7 @@ def ensure_timeline_hook_installed(project_dir: Path) -> None:
 
         # Check if hook already installed
         if hook_path.exists():
-            if "FileTimelineTracker" in hook_path.read_text():
+            if "FileTimelineTracker" in hook_path.read_text(encoding="utf-8"):
                 debug(MODULE, "FileTimelineTracker hook already installed")
                 return
 
@@ -522,7 +522,7 @@ def initialize_timeline_tracking(
         if source_spec_dir:
             plan_path = source_spec_dir / "implementation_plan.json"
             if plan_path.exists():
-                with open(plan_path) as f:
+                with open(plan_path, encoding="utf-8") as f:
                     plan = json.load(f)
                 task_title = plan.get("title", spec_name)
                 task_intent = plan.get("description", "")
@@ -533,6 +533,7 @@ def initialize_timeline_tracking(
                         files_to_modify.extend(subtask.get("files", []))
 
         # Get the current branch point commit
+        # Note: run_git() already handles capture_output and encoding internally
         result = run_git(
             ["rev-parse", "HEAD"],
             cwd=project_dir,

apps/backend/ideation/analyzer.py

@@ -51,7 +51,7 @@ class ProjectAnalyzer:
         project_index_path = self.project_dir / ".auto-claude" / "project_index.json"
         if project_index_path.exists():
             try:
-                with open(project_index_path) as f:
+                with open(project_index_path, encoding="utf-8") as f:
                     index = json.load(f)
                     # Extract tech stack from services
                     for service_name, service_info in index.get("services", {}).items():
@@ -70,7 +70,7 @@ class ProjectAnalyzer:
             )
             if roadmap_path.exists():
                 try:
-                    with open(roadmap_path) as f:
+                    with open(roadmap_path, encoding="utf-8") as f:
                         roadmap = json.load(f)
                         # Extract planned features
                         for feature in roadmap.get("features", []):
@@ -87,7 +87,7 @@ class ProjectAnalyzer:
             )
             if discovery_path.exists() and not context["target_audience"]:
                 try:
-                    with open(discovery_path) as f:
+                    with open(discovery_path, encoding="utf-8") as f:
                         discovery = json.load(f)
                         audience = discovery.get("target_audience", {})
                         context["target_audience"] = audience.get("primary_persona")
@@ -109,7 +109,7 @@ class ProjectAnalyzer:
                         spec_file = spec_dir / "spec.md"
                         if spec_file.exists():
                             # Extract title from spec
-                            content = spec_file.read_text()
+                            content = spec_file.read_text(encoding="utf-8")
                             lines = content.split("\n")
                             for line in lines:
                                 if line.startswith("# "):

apps/backend/ideation/formatter.py

@@ -39,7 +39,7 @@ class IdeationFormatter:
         existing_session = None
         if append and ideation_file.exists():
             try:
-                with open(ideation_file) as f:
+                with open(ideation_file, encoding="utf-8") as f:
                     existing_session = json.load(f)
                     existing_ideas = existing_session.get("ideas", [])
                     print_status(
@@ -56,7 +56,7 @@ class IdeationFormatter:
             type_file = self.output_dir / f"{ideation_type}_ideas.json"
             if type_file.exists():
                 try:
-                    with open(type_file) as f:
+                    with open(type_file, encoding="utf-8") as f:
                         data = json.load(f)
                         ideas = data.get(ideation_type, [])
                         new_ideas.extend(ideas)
@@ -123,7 +123,7 @@ class IdeationFormatter:
                 ideation_session["summary"]["by_status"].get(idea_status, 0) + 1
             )
 
-        with open(ideation_file, "w") as f:
+        with open(ideation_file, "w", encoding="utf-8") as f:
             json.dump(ideation_session, f, indent=2)
 
         action = "Updated" if append else "Created"
@@ -139,7 +139,7 @@ class IdeationFormatter:
         context_data = {}
         if context_file.exists():
             try:
-                with open(context_file) as f:
+                with open(context_file, encoding="utf-8") as f:
                     context_data = json.load(f)
             except json.JSONDecodeError:
                 pass

apps/backend/ideation/generator.py

@@ -80,7 +80,7 @@ class IdeationGenerator:
             return False, f"Prompt not found: {prompt_path}"
 
         # Load prompt
-        prompt = prompt_path.read_text()
+        prompt = prompt_path.read_text(encoding="utf-8")
 
         # Add context
         prompt += f"\n\n---\n\n**Output Directory**: {self.output_dir}\n"

apps/backend/ideation/phase_executor.py

@@ -85,7 +85,7 @@ class PhaseExecutor:
 
         if not is_graphiti_enabled():
             print_status("Graphiti not enabled, skipping graph hints", "info")
-            with open(hints_file, "w") as f:
+            with open(hints_file, "w", encoding="utf-8") as f:
                 json.dump(
                     {
                         "enabled": False,
@@ -131,7 +131,7 @@ class PhaseExecutor:
                 total_hints += len(result)
 
         # Save hints
-        with open(hints_file, "w") as f:
+        with open(hints_file, "w", encoding="utf-8") as f:
             json.dump(
                 {
                     "enabled": True,
@@ -178,11 +178,11 @@ class PhaseExecutor:
         graph_hints = {}
         if hints_file.exists():
             try:
-                with open(hints_file) as f:
+                with open(hints_file, encoding="utf-8") as f:
                     hints_data = json.load(f)
                     graph_hints = hints_data.get("hints_by_type", {})
-            except (OSError, json.JSONDecodeError):
-                pass
+            except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+                pass  # Use empty hints if file is corrupted/unreadable
 
         # Write context file
         context_data = {
@@ -200,7 +200,7 @@ class PhaseExecutor:
             "created_at": datetime.now().isoformat(),
         }
 
-        with open(context_file, "w") as f:
+        with open(context_file, "w", encoding="utf-8") as f:
             json.dump(context_data, f, indent=2)
 
         print_status("Created ideation_context.json", "success")
@@ -252,7 +252,7 @@ class PhaseExecutor:
         if output_file.exists() and not self.refresh:
             # Load and validate existing ideas - only skip if we have valid ideas
             try:
-                with open(output_file) as f:
+                with open(output_file, encoding="utf-8") as f:
                     data = json.load(f)
                     count = len(data.get(ideation_type, []))
 

apps/backend/ideation/prioritizer.py

@@ -48,7 +48,7 @@ class IdeaPrioritizer:
             }
 
         try:
-            content = output_file.read_text()
+            content = output_file.read_text(encoding="utf-8")
             data = json.loads(content)
             debug_verbose(
                 "ideation_prioritizer",
@@ -102,7 +102,7 @@ class IdeaPrioritizer:
             return {
                 "success": False,
                 "error": f"Invalid JSON: {e}",
-                "current_content": output_file.read_text()
+                "current_content": output_file.read_text(encoding="utf-8")
                 if output_file.exists()
                 else "",
                 "count": 0,

apps/backend/ideation/runner.py

@@ -232,7 +232,7 @@ class IdeationOrchestrator:
         """Print summary of ideation generation results."""
         ideation_file = self.output_dir / "ideation.json"
         if ideation_file.exists():
-            with open(ideation_file) as f:
+            with open(ideation_file, encoding="utf-8") as f:
                 ideation = json.load(f)
 
             ideas = ideation.get("ideas", [])

apps/backend/init.py

@@ -57,7 +57,7 @@ def ensure_gitignore_entry(project_dir: Path, entry: str = ".auto-claude/") -> b
 
     # Check if .gitignore exists and if entry is already present
     if gitignore_path.exists():
-        content = gitignore_path.read_text()
+        content = gitignore_path.read_text(encoding="utf-8")
         lines = content.splitlines()
 
         if _entry_exists_in_gitignore(lines, entry):
@@ -72,14 +72,14 @@ def ensure_gitignore_entry(project_dir: Path, entry: str = ".auto-claude/") -> b
         content += "\n# Auto Claude data directory\n"
         content += entry + "\n"
 
-        gitignore_path.write_text(content)
+        gitignore_path.write_text(content, encoding="utf-8")
         return True
     else:
         # Create new .gitignore with the entry
         content = "# Auto Claude data directory\n"
         content += entry + "\n"
 
-        gitignore_path.write_text(content)
+        gitignore_path.write_text(content, encoding="utf-8")
         return True
 
 
@@ -177,7 +177,7 @@ def ensure_all_gitignore_entries(
 
     # Read existing content or start fresh
     if gitignore_path.exists():
-        content = gitignore_path.read_text()
+        content = gitignore_path.read_text(encoding="utf-8")
         lines = content.splitlines()
     else:
         content = ""
@@ -203,7 +203,7 @@ def ensure_all_gitignore_entries(
         content += entry + "\n"
         added_entries.append(entry)
 
-    gitignore_path.write_text(content)
+    gitignore_path.write_text(content, encoding="utf-8")
 
     # Auto-commit if requested and entries were added
     if auto_commit and added_entries:

apps/backend/integrations/graphiti/config.py

@@ -507,7 +507,7 @@ class GraphitiState:
     def save(self, spec_dir: Path) -> None:
         """Save state to the spec directory."""
         marker_file = spec_dir / GRAPHITI_STATE_MARKER
-        with open(marker_file, "w") as f:
+        with open(marker_file, "w", encoding="utf-8") as f:
             json.dump(self.to_dict(), f, indent=2)
 
     @classmethod
@@ -518,9 +518,9 @@ class GraphitiState:
             return None
 
         try:
-            with open(marker_file) as f:
+            with open(marker_file, encoding="utf-8") as f:
                 return cls.from_dict(json.load(f))
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return None
 
     def record_error(self, error_msg: str) -> None:

apps/backend/integrations/linear/config.py

@@ -126,7 +126,7 @@ class LinearProjectState:
     def save(self, spec_dir: Path) -> None:
         """Save state to the spec directory."""
         marker_file = spec_dir / LINEAR_PROJECT_MARKER
-        with open(marker_file, "w") as f:
+        with open(marker_file, "w", encoding="utf-8") as f:
             json.dump(self.to_dict(), f, indent=2)
 
     @classmethod
@@ -137,9 +137,9 @@ class LinearProjectState:
             return None
 
         try:
-            with open(marker_file) as f:
+            with open(marker_file, encoding="utf-8") as f:
                 return cls.from_dict(json.load(f))
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return None
 
 

apps/backend/integrations/linear/integration.py

@@ -158,9 +158,9 @@ class LinearManager:
             return None
 
         try:
-            with open(plan_file) as f:
+            with open(plan_file, encoding="utf-8") as f:
                 return json.load(f)
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return None
 
     def get_subtasks_for_sync(self) -> list[dict]:

apps/backend/integrations/linear/updater.py

@@ -81,7 +81,7 @@ class LinearTaskState:
     def save(self, spec_dir: Path) -> None:
         """Save state to the spec directory."""
         state_file = spec_dir / LINEAR_TASK_FILE
-        with open(state_file, "w") as f:
+        with open(state_file, "w", encoding="utf-8") as f:
             json.dump(self.to_dict(), f, indent=2)
 
     @classmethod
@@ -92,9 +92,9 @@ class LinearTaskState:
             return None
 
         try:
-            with open(state_file) as f:
+            with open(state_file, encoding="utf-8") as f:
                 return cls.from_dict(json.load(f))
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return None
 
 

apps/backend/memory/codebase_map.py

@@ -38,9 +38,9 @@ def update_codebase_map(spec_dir: Path, discoveries: dict[str, str]) -> None:
     # Load existing map or create new
     if map_file.exists():
         try:
-            with open(map_file) as f:
+            with open(map_file, encoding="utf-8") as f:
                 codebase_map = json.load(f)
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             codebase_map = {}
     else:
         codebase_map = {}
@@ -58,7 +58,7 @@ def update_codebase_map(spec_dir: Path, discoveries: dict[str, str]) -> None:
     )
 
     # Write back
-    with open(map_file, "w") as f:
+    with open(map_file, "w", encoding="utf-8") as f:
         json.dump(codebase_map, f, indent=2, sort_keys=True)
 
     # Also save to Graphiti if enabled
@@ -90,12 +90,12 @@ def load_codebase_map(spec_dir: Path) -> dict[str, str]:
         return {}
 
     try:
-        with open(map_file) as f:
+        with open(map_file, encoding="utf-8") as f:
             codebase_map = json.load(f)
 
         # Remove metadata before returning
         codebase_map.pop("_metadata", None)
         return codebase_map
 
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return {}

apps/backend/memory/patterns.py

@@ -36,7 +36,7 @@ def append_gotcha(spec_dir: Path, gotcha: str) -> None:
     # Load existing gotchas
     existing_gotchas = set()
     if gotchas_file.exists():
-        content = gotchas_file.read_text()
+        content = gotchas_file.read_text(encoding="utf-8")
         # Extract bullet points
         for line in content.split("\n"):
             line = line.strip()
@@ -47,7 +47,7 @@ def append_gotcha(spec_dir: Path, gotcha: str) -> None:
     gotcha_stripped = gotcha.strip()
     if gotcha_stripped and gotcha_stripped not in existing_gotchas:
         # Append to file
-        with open(gotchas_file, "a") as f:
+        with open(gotchas_file, "a", encoding="utf-8") as f:
             if gotchas_file.stat().st_size == 0:
                 # First entry - add header
                 f.write("# Gotchas and Pitfalls\n\n")
@@ -80,7 +80,7 @@ def load_gotchas(spec_dir: Path) -> list[str]:
     if not gotchas_file.exists():
         return []
 
-    content = gotchas_file.read_text()
+    content = gotchas_file.read_text(encoding="utf-8")
     gotchas = []
 
     for line in content.split("\n"):
@@ -112,7 +112,7 @@ def append_pattern(spec_dir: Path, pattern: str) -> None:
     # Load existing patterns
     existing_patterns = set()
     if patterns_file.exists():
-        content = patterns_file.read_text()
+        content = patterns_file.read_text(encoding="utf-8")
         # Extract bullet points
         for line in content.split("\n"):
             line = line.strip()
@@ -123,7 +123,7 @@ def append_pattern(spec_dir: Path, pattern: str) -> None:
     pattern_stripped = pattern.strip()
     if pattern_stripped and pattern_stripped not in existing_patterns:
         # Append to file
-        with open(patterns_file, "a") as f:
+        with open(patterns_file, "a", encoding="utf-8") as f:
             if patterns_file.stat().st_size == 0:
                 # First entry - add header
                 f.write("# Code Patterns\n\n")
@@ -156,7 +156,7 @@ def load_patterns(spec_dir: Path) -> list[str]:
     if not patterns_file.exists():
         return []
 
-    content = patterns_file.read_text()
+    content = patterns_file.read_text(encoding="utf-8")
     patterns = []
 
     for line in content.split("\n"):

apps/backend/memory/sessions.py

@@ -76,7 +76,7 @@ def save_session_insights(
     }
 
     # Write to file (always use file-based storage)
-    with open(session_file, "w") as f:
+    with open(session_file, "w", encoding="utf-8") as f:
         json.dump(session_data, f, indent=2)
 
     # Also save to Graphiti if enabled (non-blocking, errors logged but not raised)
@@ -110,9 +110,9 @@ def load_all_insights(spec_dir: Path) -> list[dict[str, Any]]:
     insights = []
     for session_file in session_files:
         try:
-            with open(session_file) as f:
+            with open(session_file, encoding="utf-8") as f:
                 insights.append(json.load(f))
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             # Skip corrupted files
             continue
 

apps/backend/merge/file_evolution/storage.py

@@ -61,7 +61,7 @@ class EvolutionStorage:
             return {}
 
         try:
-            with open(self.evolution_file) as f:
+            with open(self.evolution_file, encoding="utf-8") as f:
                 data = json.load(f)
 
             evolutions = {}
@@ -88,7 +88,7 @@ class EvolutionStorage:
                 for file_path, evolution in evolutions.items()
             }
 
-            with open(self.evolution_file, "w") as f:
+            with open(self.evolution_file, "w", encoding="utf-8") as f:
                 json.dump(data, f, indent=2)
 
             logger.debug(f"Saved evolution data for {len(evolutions)} files")

apps/backend/merge/file_merger.py

@@ -83,10 +83,16 @@ def apply_single_task_changes(
             # Addition - need to determine where to add
             if change.change_type == ChangeType.ADD_IMPORT:
                 # Add import at top
+                # Content is already normalized to LF, so only check for \n
+                has_trailing_newline = content.endswith("\n")
                 lines = content.splitlines()
                 import_end = find_import_end(lines, file_path)
-                lines.insert(import_end, change.content_after)
+                # Strip trailing newline from content_after to prevent double newlines
+                # (content_after may include newline from diff generation)
+                lines.insert(import_end, change.content_after.rstrip("\n\r"))
                 content = line_ending.join(lines)
+                if has_trailing_newline:
+                    content += line_ending
             elif change.change_type == ChangeType.ADD_FUNCTION:
                 # Add function at end (before exports)
                 content += f"{line_ending}{line_ending}{change.content_after}"
@@ -149,13 +155,21 @@ def combine_non_conflicting_changes(
 
     # Add imports
     if imports:
+        # Content is already normalized to LF, so only check for \n
+        has_trailing_newline = content.endswith("\n")
         lines = content.splitlines()
         import_end = find_import_end(lines, file_path)
         for imp in imports:
-            if imp.content_after and imp.content_after not in content:
-                lines.insert(import_end, imp.content_after)
+            # Strip trailing newline from content_after to prevent double newlines
+            import_content = (
+                imp.content_after.rstrip("\n\r") if imp.content_after else ""
+            )
+            if import_content and import_content not in content:
+                lines.insert(import_end, import_content)
                 import_end += 1
         content = line_ending.join(lines)
+        if has_trailing_newline:
+            content += line_ending
 
     # Apply modifications
     for mod in modifications:

apps/backend/merge/install_hook.py

@@ -75,7 +75,7 @@ def install_hook(project_path: Path) -> bool:
     # Handle worktrees (where .git is a file, not directory)
     if git_dir.is_file():
         # Read the gitdir from the file
-        content = git_dir.read_text().strip()
+        content = git_dir.read_text(encoding="utf-8").strip()
         if content.startswith("gitdir:"):
             git_dir = Path(content.split(":", 1)[1].strip())
         else:
@@ -93,7 +93,7 @@ def install_hook(project_path: Path) -> bool:
 
     # Check if hook already exists
     if hook_path.exists():
-        existing = hook_path.read_text()
+        existing = hook_path.read_text(encoding="utf-8")
         if "FileTimelineTracker" in existing:
             print(f"Hook already installed at {hook_path}")
             return True
@@ -104,13 +104,13 @@ def install_hook(project_path: Path) -> bool:
         print(f"Backed up existing hook to {backup_path}")
 
         # Append our hook to existing
-        with open(hook_path, "a") as f:
+        with open(hook_path, "a", encoding="utf-8") as f:
             f.write("\n\n# FileTimelineTracker integration\n")
             f.write(HOOK_SCRIPT.split("#!/bin/bash", 1)[1])  # Skip shebang
         print(f"Appended FileTimelineTracker hook to {hook_path}")
     else:
         # Write new hook
-        hook_path.write_text(HOOK_SCRIPT)
+        hook_path.write_text(HOOK_SCRIPT, encoding="utf-8")
         print(f"Created new hook at {hook_path}")
 
     # Make executable
@@ -127,7 +127,7 @@ def uninstall_hook(project_path: Path) -> bool:
     git_dir = project_path / ".git"
 
     if git_dir.is_file():
-        content = git_dir.read_text().strip()
+        content = git_dir.read_text(encoding="utf-8").strip()
         if content.startswith("gitdir:"):
             git_dir = Path(content.split(":", 1)[1].strip())
 
@@ -137,7 +137,7 @@ def uninstall_hook(project_path: Path) -> bool:
         print("No hook to uninstall")
         return True
 
-    content = hook_path.read_text()
+    content = hook_path.read_text(encoding="utf-8")
     if "FileTimelineTracker" not in content:
         print("Hook does not contain FileTimelineTracker integration")
         return True

apps/backend/merge/models.py

@@ -108,5 +108,5 @@ class MergeReport:
 
     def save(self, path: Path) -> None:
         """Save report to JSON file."""
-        with open(path, "w") as f:
+        with open(path, "w", encoding="utf-8") as f:
             json.dump(self.to_dict(), f, indent=2)

apps/backend/merge/timeline_persistence.py

@@ -71,13 +71,13 @@ class TimelinePersistence:
             return timelines
 
         try:
-            with open(index_path) as f:
+            with open(index_path, encoding="utf-8") as f:
                 index = json.load(f)
 
             for file_path in index.get("files", []):
                 timeline_file = self._get_timeline_file_path(file_path)
                 if timeline_file.exists():
-                    with open(timeline_file) as f:
+                    with open(timeline_file, encoding="utf-8") as f:
                         data = json.load(f)
                     timelines[file_path] = FileTimeline.from_dict(data)
 
@@ -101,7 +101,7 @@ class TimelinePersistence:
             timeline_file = self._get_timeline_file_path(file_path)
             timeline_file.parent.mkdir(parents=True, exist_ok=True)
 
-            with open(timeline_file, "w") as f:
+            with open(timeline_file, "w", encoding="utf-8") as f:
                 json.dump(timeline.to_dict(), f, indent=2)
 
         except Exception as e:
@@ -119,7 +119,7 @@ class TimelinePersistence:
             "files": file_paths,
             "last_updated": datetime.now().isoformat(),
         }
-        with open(index_path, "w") as f:
+        with open(index_path, "w", encoding="utf-8") as f:
             json.dump(index, f, indent=2)
 
     def _get_timeline_file_path(self, file_path: str) -> Path:

apps/backend/phase_config.py

@@ -164,7 +164,7 @@ def load_task_metadata(spec_dir: Path) -> TaskMetadataConfig | None:
         return None
 
     try:
-        with open(metadata_path) as f:
+        with open(metadata_path, encoding="utf-8") as f:
             return json.load(f)
     except (json.JSONDecodeError, OSError):
         return None

apps/backend/planner_lib/context.py

@@ -41,21 +41,29 @@ class ContextLoader:
         """Load all context files from spec directory."""
         # Read spec.md
         spec_file = self.spec_dir / "spec.md"
-        spec_content = spec_file.read_text() if spec_file.exists() else ""
+        spec_content = (
+            spec_file.read_text(encoding="utf-8") if spec_file.exists() else ""
+        )
 
         # Read project_index.json
         index_file = self.spec_dir / "project_index.json"
         project_index = {}
         if index_file.exists():
-            with open(index_file) as f:
-                project_index = json.load(f)
+            try:
+                with open(index_file, encoding="utf-8") as f:
+                    project_index = json.load(f)
+            except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+                pass  # Use empty dict on error
 
         # Read context.json
         context_file = self.spec_dir / "context.json"
         task_context = {}
         if context_file.exists():
-            with open(context_file) as f:
-                task_context = json.load(f)
+            try:
+                with open(context_file, encoding="utf-8") as f:
+                    task_context = json.load(f)
+            except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+                pass  # Use empty dict on error
 
         # Determine services involved
         services = task_context.get("scoped_services", [])
@@ -89,7 +97,7 @@ class ContextLoader:
         requirements_file = self.spec_dir / "requirements.json"
         if requirements_file.exists():
             try:
-                with open(requirements_file) as f:
+                with open(requirements_file, encoding="utf-8") as f:
                     requirements = json.load(f)
                 declared_type = _normalize_workflow_type(
                     requirements.get("workflow_type", "")
@@ -103,7 +111,7 @@ class ContextLoader:
         assessment_file = self.spec_dir / "complexity_assessment.json"
         if assessment_file.exists():
             try:
-                with open(assessment_file) as f:
+                with open(assessment_file, encoding="utf-8") as f:
                     assessment = json.load(f)
                 declared_type = _normalize_workflow_type(
                     assessment.get("workflow_type", "")

apps/backend/prediction/main.py

@@ -52,7 +52,7 @@ def main():
             print(f"Error: No implementation_plan.json found in {spec_dir}")
             sys.exit(1)
 
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
 
         # Find first pending subtask

apps/backend/prediction/memory_loader.py

@@ -33,7 +33,7 @@ class MemoryLoader:
             return []
 
         gotchas = []
-        content = self.gotchas_file.read_text()
+        content = self.gotchas_file.read_text(encoding="utf-8")
 
         # Parse markdown list items
         for line in content.split("\n"):
@@ -56,7 +56,7 @@ class MemoryLoader:
             return []
 
         patterns = []
-        content = self.patterns_file.read_text()
+        content = self.patterns_file.read_text(encoding="utf-8")
 
         # Parse markdown sections
         current_pattern = None
@@ -89,8 +89,8 @@ class MemoryLoader:
             return []
 
         try:
-            with open(self.history_file) as f:
+            with open(self.history_file, encoding="utf-8") as f:
                 history = json.load(f)
                 return history.get("attempts", [])
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return []

apps/backend/project/analyzer.py

@@ -69,7 +69,7 @@ class ProjectAnalyzer:
             return None
 
         try:
-            with open(profile_path) as f:
+            with open(profile_path, encoding="utf-8") as f:
                 data = json.load(f)
             return SecurityProfile.from_dict(data)
         except (OSError, json.JSONDecodeError, KeyError):
@@ -80,7 +80,7 @@ class ProjectAnalyzer:
         profile_path = self.get_profile_path()
         profile_path.parent.mkdir(parents=True, exist_ok=True)
 
-        with open(profile_path, "w") as f:
+        with open(profile_path, "w", encoding="utf-8") as f:
             json.dump(profile.to_dict(), f, indent=2)
 
     def compute_project_hash(self) -> str:

apps/backend/project/config_parser.py

@@ -38,7 +38,7 @@ class ConfigParser:
     def read_json(self, filename: str) -> dict | None:
         """Read a JSON file from project root."""
         try:
-            with open(self.project_dir / filename) as f:
+            with open(self.project_dir / filename, encoding="utf-8") as f:
                 return json.load(f)
         except (FileNotFoundError, json.JSONDecodeError):
             return None
@@ -59,7 +59,7 @@ class ConfigParser:
     def read_text(self, filename: str) -> str | None:
         """Read a text file from project root."""
         try:
-            with open(self.project_dir / filename) as f:
+            with open(self.project_dir / filename, encoding="utf-8") as f:
                 return f.read()
         except (OSError, FileNotFoundError):
             return None

apps/backend/project/stack_detector.py

@@ -248,7 +248,7 @@ class StackDetector:
                 "**/*.yaml"
             ) + self.parser.glob_files("**/*.yml"):
                 try:
-                    with open(yaml_file) as f:
+                    with open(yaml_file, encoding="utf-8") as f:
                         content = f.read()
                         if "apiVersion:" in content and "kind:" in content:
                             self.stack.infrastructure.append("kubernetes")

apps/backend/prompts/coder.md

@@ -942,13 +942,13 @@ if insights["discoveries"]["patterns_found"]:
     # Load existing patterns
     existing_patterns = set()
     if patterns_file.exists():
-        content = patterns_file.read_text()
+        content = patterns_file.read_text(encoding="utf-8")
         for line in content.split("\n"):
             if line.strip().startswith("- "):
                 existing_patterns.add(line.strip()[2:])
 
     # Add new patterns
-    with open(patterns_file, "a") as f:
+    with open(patterns_file, "a", encoding="utf-8") as f:
         if patterns_file.stat().st_size == 0:
             f.write("# Code Patterns\n\n")
             f.write("Established patterns to follow in this codebase:\n\n")
@@ -965,13 +965,13 @@ if insights["discoveries"]["gotchas_encountered"]:
     # Load existing gotchas
     existing_gotchas = set()
     if gotchas_file.exists():
-        content = gotchas_file.read_text()
+        content = gotchas_file.read_text(encoding="utf-8")
         for line in content.split("\n"):
             if line.strip().startswith("- "):
                 existing_gotchas.add(line.strip()[2:])
 
     # Add new gotchas
-    with open(gotchas_file, "a") as f:
+    with open(gotchas_file, "a", encoding="utf-8") as f:
         if gotchas_file.stat().st_size == 0:
             f.write("# Gotchas and Pitfalls\n\n")
             f.write("Things to watch out for in this codebase:\n\n")

apps/backend/prompts/github/partials/full_context_analysis.md

@@ -0,0 +1,39 @@
+# Full Context Analysis (Shared Partial)
+
+This section is shared across multiple PR review agent prompts.
+When updating this content, sync to all files listed below:
+
+- pr_security_agent.md
+- pr_quality_agent.md
+- pr_logic_agent.md
+- pr_codebase_fit_agent.md
+- pr_followup_newcode_agent.md
+- pr_followup_resolution_agent.md (partial version)
+
+---
+
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**

apps/backend/prompts/github/pr_codebase_fit_agent.md

@@ -92,6 +92,33 @@ Before flagging a "should use existing utility" issue:
 2. Check if existing utility has the right signature/behavior
 3. Consider if the new implementation is intentionally different
 
+<!-- SYNC: This section is shared. See partials/full_context_analysis.md for canonical version -->
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**
+
 ## Code Patterns to Flag
 
 ### Reinventing Existing Utilities

apps/backend/prompts/github/pr_followup_newcode_agent.md

@@ -124,6 +124,33 @@ For findings claiming something is **missing** (no fallback, no validation, no e
 
 **Only report if you can confidently say**: "I verified the complete scope and the safeguard does not exist."
 
+<!-- SYNC: This section is shared. See partials/full_context_analysis.md for canonical version -->
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**
+
 ## Evidence Requirements
 
 Every finding MUST include an `evidence` field with:

apps/backend/prompts/github/pr_followup_resolution_agent.md

@@ -69,6 +69,32 @@ For each verification, provide actual code evidence:
 - Verify the pattern still exists (for unresolved)
 - Check surrounding context for alternative fixes you might miss
 
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**
+
 ## Resolution Criteria
 
 ### RESOLVED

apps/backend/prompts/github/pr_logic_agent.md

@@ -113,6 +113,33 @@ For each finding, provide:
 2. What the current code produces
 3. What it should produce
 
+<!-- SYNC: This section is shared. See partials/full_context_analysis.md for canonical version -->
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**
+
 ## Code Patterns to Flag
 
 ### Off-By-One Errors

apps/backend/prompts/github/pr_parallel_orchestrator.md

@@ -58,6 +58,10 @@ You have access to these specialized review agents via the Task tool:
 **Description**: AI comment validator for triaging comments from CodeRabbit, Gemini Code Assist, Cursor, Greptile, and other AI reviewers.
 **When to use**: PRs that have existing AI review comments that need validation.
 
+### finding-validator
+**Description**: Finding validation specialist that re-investigates findings to confirm they are real issues, not false positives.
+**When to use**: After ALL specialist agents have reported their findings. Invoke for EVERY finding to validate it exists in the actual code.
+
 ## Your Workflow
 
 ### Phase 1: Analysis
@@ -96,21 +100,114 @@ For a PR adding a new authentication endpoint:
 After receiving agent results, synthesize findings:
 
 1. **Aggregate**: Collect all findings from all agents
-2. **Cross-validate**:
-   - If multiple agents report the same issue → boost confidence
-   - If agents conflict → use your judgment to resolve
+2. **Cross-validate** (see "Multi-Agent Agreement" section):
+   - Group findings by (file, line, category)
+   - If 2+ agents report same issue → merge into one, boost confidence by +0.15
+   - Set `cross_validated: true` and populate `source_agents` list
+   - Track agreed finding IDs in `agent_agreement.agreed_findings`
 3. **Deduplicate**: Remove overlapping findings (same file + line + issue type)
-4. **Filter**: Only include findings with confidence ≥80%
+4. **Route by Confidence** (see "Confidence Tiers" section):
+   - HIGH (>=0.8): Include as-is
+   - MEDIUM (0.5-0.8): Include with "[Potential]" prefix
+   - LOW (<0.5): Log and exclude
 5. **Generate Verdict**: Based on severity of remaining findings
 
+### Phase 3.5: Finding Validation (CRITICAL - Prevent False Positives)
+
+**MANDATORY STEP** - After synthesis, validate ALL findings before generating verdict:
+
+1. **Invoke finding-validator** for EACH finding from specialist agents
+2. For each finding, the validator returns one of:
+   - `confirmed_valid` - Issue IS real, keep in findings list
+   - `dismissed_false_positive` - Original finding was WRONG, remove from findings
+   - `needs_human_review` - Cannot determine, keep but flag for human
+
+3. **Filter findings based on validation:**
+   - Keep only `confirmed_valid` findings
+   - Remove `dismissed_false_positive` findings entirely
+   - Keep `needs_human_review` but add note in description
+
+4. **Re-calculate verdict** based on VALIDATED findings only
+   - A finding dismissed as false positive does NOT count toward verdict
+   - Only confirmed issues determine severity
+
+**Why this matters:** Specialist agents sometimes flag issues that don't exist in the actual code. The validator reads the code with fresh eyes to catch these false positives before they're reported.
+
+**Example workflow:**
+```
+Specialist finds 3 issues → finding-validator validates each →
+Result: 2 confirmed, 1 dismissed → Verdict based on 2 issues
+```
+
+## Confidence Tiers
+
+After validation, findings are routed based on confidence scores:
+
+| Tier | Score Range | Treatment |
+|------|-------------|-----------|
+| HIGH | >= 0.8 | Included as reported, affects verdict |
+| MEDIUM | 0.5 - 0.8 | Included with "[Potential]" prefix, affects verdict |
+| LOW | < 0.5 | Logged for monitoring, excluded from output |
+
+**Guidelines for assigning confidence:**
+- 0.9+ : Direct evidence in code, multiple indicators, clear violation
+- 0.8-0.9 : Strong evidence, clear pattern, high certainty
+- 0.6-0.8 : Likely issue but some uncertainty, may need context
+- 0.4-0.6 : Possible issue, limited evidence, context-dependent
+- < 0.4 : Speculation, no direct evidence, likely false positive
+
+**Example:**
+- SQL injection with `userId` in query string: 0.95 (direct evidence)
+- Missing null check where input could be null: 0.75 (likely but depends on callers)
+- "This might cause issues" without specifics: 0.3 (speculation, will be dropped)
+
+## Multi-Agent Agreement
+
+When multiple specialist agents flag the same issue (same file + line + category), this is strong signal:
+
+### Confidence Boost
+- If 2+ agents agree: confidence boosted by +0.15 (max 0.95)
+- cross_validated field set to true
+- source_agents lists all agents that flagged the issue
+
+### Why This Matters
+- Independent verification increases certainty
+- False positives rarely get flagged by multiple specialized agents
+- Multi-agent agreement often indicates real issues
+
+### Example
+```
+security-reviewer finds: XSS vulnerability at line 45 (confidence: 0.75)
+quality-reviewer finds: Unsafe string interpolation at line 45 (confidence: 0.70)
+
+Result: Single finding with confidence 0.90 (0.75 + 0.15 boost)
+        source_agents: ["security-reviewer", "quality-reviewer"]
+        cross_validated: true
+```
+
+### Agent Agreement Tracking
+The `agent_agreement` field in structured output tracks:
+- `agreed_findings`: Finding IDs where 2+ agents agreed
+- `conflicting_findings`: Finding IDs where agents disagreed (reserved for future)
+- `resolution_notes`: How conflicts were resolved (reserved for future)
+
+**Note:** Agent agreement data is logged for monitoring. The cross-validation results
+are reflected in each finding's source_agents, cross_validated, and confidence fields.
+
 ## Output Format
 
-After synthesis, output your final review in this JSON format:
+After synthesis and validation, output your final review in this JSON format:
 
 ```json
 {
   "analysis_summary": "Brief description of what you analyzed and why you chose those agents",
-  "agents_invoked": ["security-reviewer", "quality-reviewer"],
+  "agents_invoked": ["security-reviewer", "quality-reviewer", "finding-validator"],
+  "validation_summary": {
+    "total_findings": 5,
+    "confirmed_valid": 3,
+    "dismissed_false_positive": 2,
+    "needs_human_review": 0
+  },
   "findings": [
     {
       "id": "finding-1",
@@ -125,7 +222,9 @@ After synthesis, output your final review in this JSON format:
       "suggested_fix": "Use parameterized queries",
       "fixable": true,
       "source_agents": ["security-reviewer"],
-      "cross_validated": false
+      "cross_validated": false,
+      "validation_status": "confirmed_valid",
+      "validation_evidence": "Actual code: `const query = 'SELECT * FROM users WHERE id = ' + userId`"
     }
   ],
   "agent_agreement": {
@@ -138,6 +237,13 @@ After synthesis, output your final review in this JSON format:
 }
 ```
 
+**Note on validation fields:**
+- `validation_summary` at top level tracks validation statistics
+- Each finding includes `validation_status` ("confirmed_valid", "dismissed_false_positive", or "needs_human_review")
+- Each finding includes `validation_evidence` with actual code snippet from validation
+- Only include findings with `validation_status: "confirmed_valid"` or `"needs_human_review"` in the final output
+- Dismissed findings should be removed from the findings array entirely
+
 ## Verdict Types (Strict Quality Gates)
 
 We use strict quality gates because AI can fix issues quickly. Only LOW severity findings are optional.

apps/backend/prompts/github/pr_quality_agent.md

@@ -114,6 +114,33 @@ When your finding claims something is **missing** (no error handling, no fallbac
 - Respect framework idioms (React hooks, etc.)
 - Distinguish between "wrong" and "not my style"
 
+<!-- SYNC: This section is shared. See partials/full_context_analysis.md for canonical version -->
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**
+
 ## Code Patterns to Flag
 
 ### JavaScript/TypeScript

apps/backend/prompts/github/pr_security_agent.md

@@ -108,6 +108,33 @@ When your finding claims protection is **missing** (no validation, no sanitizati
 - Check if mitigation exists elsewhere (e.g., WAF, input validation)
 - Review framework security features (does React escape by default?)
 
+<!-- SYNC: This section is shared. See partials/full_context_analysis.md for canonical version -->
+## CRITICAL: Full Context Analysis
+
+Before reporting ANY finding, you MUST:
+
+1. **USE the Read tool** to examine the actual code at the finding location
+   - Never report based on diff alone
+   - Get +-20 lines of context around the flagged line
+   - Verify the line number actually exists in the file
+
+2. **Verify the issue exists** - Not assume it does
+   - Is the problematic pattern actually present at this line?
+   - Is there validation/sanitization nearby you missed?
+   - Does the framework provide automatic protection?
+
+3. **Provide code evidence** - Copy-paste the actual code
+   - Your `evidence` field must contain real code from the file
+   - Not descriptions like "the code does X" but actual `const query = ...`
+   - If you can't provide real code, you haven't verified the issue
+
+4. **Check for mitigations** - Use Grep to search for:
+   - Validation functions that might sanitize this input
+   - Framework-level protections
+   - Comments explaining why code appears unsafe
+
+**Your evidence must prove the issue exists - not just that you suspect it.**
+
 ## Code Patterns to Flag
 
 ### JavaScript/TypeScript

apps/backend/prompts_pkg/prompt_generator.py

@@ -336,7 +336,7 @@ def load_subtask_context(
         full_path = project_dir / pattern_path
         if full_path.exists():
             try:
-                lines = full_path.read_text().split("\n")
+                lines = full_path.read_text(encoding="utf-8").split("\n")
                 if len(lines) > max_file_lines:
                     content = "\n".join(lines[:max_file_lines])
                     content += (
@@ -353,7 +353,7 @@ def load_subtask_context(
         full_path = project_dir / file_path
         if full_path.exists():
             try:
-                lines = full_path.read_text().split("\n")
+                lines = full_path.read_text(encoding="utf-8").split("\n")
                 if len(lines) > max_file_lines:
                     content = "\n".join(lines[:max_file_lines])
                     content += (

apps/backend/prompts_pkg/prompts.py

@@ -173,7 +173,7 @@ def get_planner_prompt(spec_dir: Path) -> str:
             "Make sure the auto-claude/prompts/planner.md file exists."
         )
 
-    prompt = prompt_file.read_text()
+    prompt = prompt_file.read_text(encoding="utf-8")
 
     # Inject spec directory information at the beginning
     spec_context = f"""## SPEC LOCATION
@@ -216,7 +216,7 @@ def get_coding_prompt(spec_dir: Path) -> str:
             "Make sure the auto-claude/prompts/coder.md file exists."
         )
 
-    prompt = prompt_file.read_text()
+    prompt = prompt_file.read_text(encoding="utf-8")
 
     spec_context = f"""## SPEC LOCATION
 
@@ -240,7 +240,7 @@ The project root is the parent of auto-claude/. All code goes in the project roo
     # Check for human input file
     human_input_file = spec_dir / "HUMAN_INPUT.md"
     if human_input_file.exists():
-        human_input = human_input_file.read_text().strip()
+        human_input = human_input_file.read_text(encoding="utf-8").strip()
         if human_input:
             spec_context += f"""## HUMAN INPUT (READ THIS FIRST!)
 
@@ -275,7 +275,7 @@ def _get_recovery_context(spec_dir: Path) -> str:
         return ""
 
     try:
-        with open(attempt_history_file) as f:
+        with open(attempt_history_file, encoding="utf-8") as f:
             history = json.load(f)
 
         # Check for stuck subtasks
@@ -321,7 +321,7 @@ Subtasks with previous attempts:
 
         return ""
 
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return ""
 
 
@@ -344,7 +344,7 @@ def get_followup_planner_prompt(spec_dir: Path) -> str:
             "Make sure the auto-claude/prompts/followup_planner.md file exists."
         )
 
-    prompt = prompt_file.read_text()
+    prompt = prompt_file.read_text(encoding="utf-8")
 
     # Inject spec directory information at the beginning
     spec_context = f"""## SPEC LOCATION (FOLLOW-UP MODE)
@@ -405,7 +405,7 @@ def is_first_run(spec_dir: Path) -> bool:
         # Check if any phase has subtasks
         total_subtasks = sum(len(phase.get("subtasks", [])) for phase in phases)
         return total_subtasks == 0
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         # If we can't read the file, treat as first run
         return True
 
@@ -426,7 +426,7 @@ def _load_prompt_file(filename: str) -> str:
     prompt_file = PROMPTS_DIR / filename
     if not prompt_file.exists():
         raise FileNotFoundError(f"Prompt file not found: {prompt_file}")
-    return prompt_file.read_text()
+    return prompt_file.read_text(encoding="utf-8")
 
 
 def get_qa_reviewer_prompt(spec_dir: Path, project_dir: Path) -> str:

apps/backend/qa/criteria.py

@@ -21,9 +21,9 @@ def load_implementation_plan(spec_dir: Path) -> dict | None:
     if not plan_file.exists():
         return None
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             return json.load(f)
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return None
 
 
@@ -31,7 +31,7 @@ def save_implementation_plan(spec_dir: Path, plan: dict) -> bool:
     """Save the implementation plan JSON."""
     plan_file = spec_dir / "implementation_plan.json"
     try:
-        with open(plan_file, "w") as f:
+        with open(plan_file, "w", encoding="utf-8") as f:
             json.dump(plan, f, indent=2)
         return True
     except OSError:

apps/backend/qa/fixer.py

@@ -38,7 +38,7 @@ def load_qa_fixer_prompt() -> str:
     prompt_file = QA_PROMPTS_DIR / "qa_fixer.md"
     if not prompt_file.exists():
         raise FileNotFoundError(f"QA fixer prompt not found: {prompt_file}")
-    return prompt_file.read_text()
+    return prompt_file.read_text(encoding="utf-8")
 
 
 # =============================================================================

apps/backend/qa/report.py

@@ -324,7 +324,7 @@ These issues have appeared {RECURRING_ISSUE_THRESHOLD}+ times without being reso
 - `implementation_plan.json` - Full iteration history
 """
 
-    escalation_file.write_text(content)
+    escalation_file.write_text(content, encoding="utf-8")
     print(f"\n📝 Escalation file created: {escalation_file}")
 
 
@@ -345,7 +345,7 @@ def create_manual_test_plan(spec_dir: Path, spec_name: str) -> Path:
     spec_file = spec_dir / "spec.md"
     spec_content = ""
     if spec_file.exists():
-        spec_content = spec_file.read_text()
+        spec_content = spec_file.read_text(encoding="utf-8")
 
     # Extract acceptance criteria from spec if present
     acceptance_criteria = []
@@ -439,7 +439,7 @@ _Add any observations or issues found during testing_
 
 """
 
-    manual_plan_file.write_text(content)
+    manual_plan_file.write_text(content, encoding="utf-8")
     return manual_plan_file
 
 
@@ -460,9 +460,9 @@ def check_test_discovery(spec_dir: Path) -> dict[str, Any] | None:
         return None
 
     try:
-        with open(discovery_file) as f:
+        with open(discovery_file, encoding="utf-8") as f:
             return json.load(f)
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         return None
 
 

apps/backend/review/formatters.py

@@ -159,7 +159,7 @@ def display_plan_summary(spec_dir: Path) -> None:
         return
 
     try:
-        with open(plan_file) as f:
+        with open(plan_file, encoding="utf-8") as f:
             plan = json.load(f)
     except (OSError, json.JSONDecodeError) as e:
         print_status(f"Could not read implementation_plan.json: {e}", "error")

apps/backend/review/state.py

@@ -85,7 +85,7 @@ class ReviewState:
     def save(self, spec_dir: Path) -> None:
         """Save state to the spec directory."""
         state_file = Path(spec_dir) / REVIEW_STATE_FILE
-        with open(state_file, "w") as f:
+        with open(state_file, "w", encoding="utf-8") as f:
             json.dump(self.to_dict(), f, indent=2)
 
     @classmethod
@@ -100,9 +100,9 @@ class ReviewState:
             return cls()
 
         try:
-            with open(state_file) as f:
+            with open(state_file, encoding="utf-8") as f:
                 return cls.from_dict(json.load(f))
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             return cls()
 
     def is_approved(self) -> bool:

apps/backend/runners/ai_analyzer/cache_manager.py

@@ -48,7 +48,7 @@ class CacheManager:
             return None
 
         print(f"✓ Using cached AI insights ({hours_old:.1f} hours old)")
-        return json.loads(self.cache_file.read_text())
+        return json.loads(self.cache_file.read_text(encoding="utf-8"))
 
     def save_result(self, result: dict[str, Any]) -> None:
         """
@@ -57,5 +57,5 @@ class CacheManager:
         Args:
             result: Analysis result to cache
         """
-        self.cache_file.write_text(json.dumps(result, indent=2))
+        self.cache_file.write_text(json.dumps(result, indent=2), encoding="utf-8")
         print(f"\n✓ AI insights cached to: {self.cache_file}")

apps/backend/runners/ai_analyzer/claude_client.py

@@ -87,7 +87,7 @@ class ClaudeAnalysisClient:
         }
 
         settings_file = self.project_dir / ".claude_ai_analyzer_settings.json"
-        with open(settings_file, "w") as f:
+        with open(settings_file, "w", encoding="utf-8") as f:
             json.dump(settings, f, indent=2)
 
         return settings_file

apps/backend/runners/ai_analyzer_runner.py

@@ -56,7 +56,7 @@ def main() -> int:
         print(f"Run: python analyzer.py --project-dir {args.project_dir} --index")
         return 1
 
-    project_index = json.loads(index_path.read_text())
+    project_index = json.loads(index_path.read_text(encoding="utf-8"))
 
     # Import here to avoid import errors if dependencies are missing
     try:

apps/backend/runners/github/audit.py

@@ -369,7 +369,7 @@ class AuditLogger:
 
         try:
             log_file = self._get_log_file_path()
-            with open(log_file, "a") as f:
+            with open(log_file, "a", encoding="utf-8") as f:
                 f.write(entry.to_json() + "\n")
         except Exception as e:
             logger.error(f"Failed to write audit log: {e}")
@@ -585,7 +585,7 @@ class AuditLogger:
 
         for log_file in sorted(self.log_dir.glob("audit_*.jsonl"), reverse=True):
             try:
-                with open(log_file) as f:
+                with open(log_file, encoding="utf-8") as f:
                     for line in f:
                         if not line.strip():
                             continue

apps/backend/runners/github/batch_issues.py

@@ -368,7 +368,7 @@ class IssueBatch:
         if not batch_file.exists():
             return None
 
-        with open(batch_file) as f:
+        with open(batch_file, encoding="utf-8") as f:
             data = json.load(f)
         return cls.from_dict(data)
 
@@ -448,7 +448,7 @@ class IssueBatcher:
         """Load batch index from disk."""
         index_file = self.github_dir / "batches" / "index.json"
         if index_file.exists():
-            with open(index_file) as f:
+            with open(index_file, encoding="utf-8") as f:
                 data = json.load(f)
             self._batch_index = {
                 int(k): v for k, v in data.get("issue_to_batch", {}).items()
@@ -460,7 +460,7 @@ class IssueBatcher:
         batches_dir.mkdir(parents=True, exist_ok=True)
 
         index_file = batches_dir / "index.json"
-        with open(index_file, "w") as f:
+        with open(index_file, "w", encoding="utf-8") as f:
             json.dump(
                 {
                     "issue_to_batch": self._batch_index,
@@ -1107,7 +1107,7 @@ class IssueBatcher:
         batches = []
         for batch_file in batches_dir.glob("batch_*.json"):
             try:
-                with open(batch_file) as f:
+                with open(batch_file, encoding="utf-8") as f:
                     data = json.load(f)
                 batches.append(IssueBatch.from_dict(data))
             except Exception as e:

apps/backend/runners/github/batch_validator.py

@@ -230,7 +230,7 @@ class BatchValidator:
             }
 
             settings_file = self.project_dir / ".batch_validator_settings.json"
-            with open(settings_file, "w") as f:
+            with open(settings_file, "w", encoding="utf-8") as f:
                 json.dump(settings, f)
 
             try:

apps/backend/runners/github/bot_detection.py

@@ -85,7 +85,7 @@ class BotDetectionState:
         if not state_file.exists():
             return cls()
 
-        with open(state_file) as f:
+        with open(state_file, encoding="utf-8") as f:
             return cls.from_dict(json.load(f))
 
 

apps/backend/runners/github/cleanup.py

@@ -248,9 +248,9 @@ class DataCleaner:
     ) -> bool:
         """Process a single file for cleanup."""
         try:
-            with open(file_path) as f:
+            with open(file_path, encoding="utf-8") as f:
                 data = json.load(f)
-        except (OSError, json.JSONDecodeError):
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
             # Corrupted file, mark for deletion
             if not dry_run:
                 file_size = file_path.stat().st_size
@@ -327,7 +327,7 @@ class DataCleaner:
         data["_archived_at"] = datetime.now(timezone.utc).isoformat()
         data["_original_path"] = str(file_path)
 
-        with open(archive_path, "w") as f:
+        with open(archive_path, "w", encoding="utf-8") as f:
             json.dump(data, f, indent=2)
 
         # Remove original
@@ -350,7 +350,7 @@ class DataCleaner:
                 continue
 
             try:
-                with open(index_path) as f:
+                with open(index_path, encoding="utf-8") as f:
                     index_data = json.load(f)
 
                 if not isinstance(index_data, dict):
@@ -375,12 +375,12 @@ class DataCleaner:
                     for key in to_remove:
                         del items[key]
 
-                    with open(index_path, "w") as f:
+                    with open(index_path, "w", encoding="utf-8") as f:
                         json.dump(index_data, f, indent=2)
 
                 result.pruned_index_entries += pruned
 
-            except (OSError, json.JSONDecodeError, KeyError):
+            except (OSError, json.JSONDecodeError, UnicodeDecodeError, KeyError):
                 result.errors.append(f"Error pruning index: {index_path}")
 
     async def _clean_audit_logs(

apps/backend/runners/github/context_gatherer.py

@@ -16,8 +16,10 @@ Responsibilities:
 
 from __future__ import annotations
 
+import ast
 import asyncio
 import json
+import os
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -782,7 +784,7 @@ class PRContextGatherer:
         # Check for package.json (Node.js)
         if (self.project_dir / "package.json").exists():
             try:
-                with open(self.project_dir / "package.json") as f:
+                with open(self.project_dir / "package.json", encoding="utf-8") as f:
                     pkg_data = json.load(f)
                     if "workspaces" in pkg_data:
                         structure_info.append(
@@ -828,6 +830,7 @@ class PRContextGatherer:
         - Imported modules and dependencies
         - Configuration files in the same directory
         - Related type definition files
+        - Reverse dependencies (files that import changed files)
         """
         related = set()
 
@@ -848,12 +851,15 @@ class PRContextGatherer:
             if path.suffix in [".ts", ".tsx"]:
                 related.update(self._find_type_definitions(path))
 
+            # Find reverse dependencies (files that import this file)
+            related.update(self._find_dependents(changed_file.path))
+
         # Remove files that are already in changed_files
         changed_paths = {cf.path for cf in changed_files}
         related = {r for r in related if r not in changed_paths}
 
-        # Limit to 20 most relevant files
-        return sorted(related)[:20]
+        # Use smart prioritization with increased limit (50 instead of 20)
+        return self._prioritize_related_files(related, limit=50)
 
     def _find_test_files(self, source_path: Path) -> set[str]:
         """Find test files related to a source file."""
@@ -882,28 +888,113 @@ class PRContextGatherer:
         Find imported files from source code.
 
         Supports:
-        - JavaScript/TypeScript: import statements
-        - Python: import statements
+        - JavaScript/TypeScript: ES6 imports, path aliases, CommonJS, re-exports
+        - Python: import statements via AST
         """
         imports = set()
 
         if source_path.suffix in [".ts", ".tsx", ".js", ".jsx"]:
-            # Match: import ... from './file' or from '../file'
-            # Only relative imports (starting with . or ..)
-            pattern = r"from\s+['\"](\.[^'\"]+)['\"]"
-            for match in re.finditer(pattern, content):
+            # Load tsconfig paths once for this file (for alias resolution)
+            ts_paths = self._load_tsconfig_paths()
+
+            # Pattern 1: ES6 relative imports (existing)
+            # Matches: from './file', from '../file'
+            relative_pattern = r"from\s+['\"](\.[^'\"]+)['\"]"
+            for match in re.finditer(relative_pattern, content):
                 import_path = match.group(1)
                 resolved = self._resolve_import_path(import_path, source_path)
                 if resolved:
                     imports.add(resolved)
 
+            # Pattern 2: Path alias imports (NEW)
+            # Matches: from '@/utils', from '~/config', from '@shared/types'
+            alias_pattern = r"from\s+['\"](@[^'\"]+|~[^'\"]+)['\"]"
+            if ts_paths:
+                for match in re.finditer(alias_pattern, content):
+                    import_path = match.group(1)
+                    resolved = self._resolve_alias_import(import_path, ts_paths)
+                    if resolved:
+                        imports.add(resolved)
+
+            # Pattern 3: CommonJS require (NEW)
+            # Matches: require('./utils'), require('@/config')
+            require_pattern = r"require\s*\(\s*['\"]([^'\"]+)['\"]\s*\)"
+            for match in re.finditer(require_pattern, content):
+                import_path = match.group(1)
+                resolved = self._resolve_any_import(import_path, source_path, ts_paths)
+                if resolved:
+                    imports.add(resolved)
+
+            # Pattern 4: Re-exports (NEW)
+            # Matches: export * from './module', export { x } from './module'
+            reexport_pattern = r"export\s+(?:\*|\{[^}]*\})\s+from\s+['\"]([^'\"]+)['\"]"
+            for match in re.finditer(reexport_pattern, content):
+                import_path = match.group(1)
+                resolved = self._resolve_any_import(import_path, source_path, ts_paths)
+                if resolved:
+                    imports.add(resolved)
+
         elif source_path.suffix == ".py":
-            # Python relative imports are complex, skip for now
-            # Could add support for "from . import" later
-            pass
+            # Python imports via AST
+            imports.update(self._find_python_imports(content, source_path))
 
         return imports
 
+    def _resolve_alias_import(
+        self, import_path: str, ts_paths: dict[str, list[str]]
+    ) -> str | None:
+        """
+        Resolve a path alias import to an actual file path.
+
+        Path aliases (e.g., @/utils, ~/config) are project-root relative,
+        not relative to the importing file.
+
+        Args:
+            import_path: Path alias import like '@/utils' or '~/config'
+            ts_paths: tsconfig paths mapping
+
+        Returns:
+            Resolved path relative to project root, or None if not found
+        """
+        resolved_alias = self._resolve_path_alias(import_path, ts_paths)
+        if not resolved_alias:
+            return None
+
+        # Path aliases are project-root relative, so resolve from root
+        # by using an empty base path (Path(".").parent = Path("."))
+        return self._resolve_import_path("./" + resolved_alias, Path("."))
+
+    def _resolve_any_import(
+        self, import_path: str, source_path: Path, ts_paths: dict[str, list[str]] | None
+    ) -> str | None:
+        """
+        Resolve any import path (relative, alias, or node_modules).
+
+        Handles all import types:
+        - Relative: './utils', '../config'
+        - Path aliases: '@/utils', '~/config'
+        - Node modules: 'lodash' (returns None - not project files)
+
+        Args:
+            import_path: The import path from the source code
+            source_path: Path of the file doing the importing
+            ts_paths: tsconfig paths mapping, or None
+
+        Returns:
+            Resolved path relative to project root, or None if not found/external
+        """
+        if import_path.startswith("."):
+            # Relative import
+            return self._resolve_import_path(import_path, source_path)
+        elif import_path.startswith("@") or import_path.startswith("~"):
+            # Path alias import
+            if ts_paths:
+                return self._resolve_alias_import(import_path, ts_paths)
+            return None
+        else:
+            # Node modules package - skip
+            return None
+
     def _resolve_import_path(self, import_path: str, source_path: Path) -> str | None:
         """
         Resolve a relative import path to an absolute file path.
@@ -976,6 +1067,391 @@ class PRContextGatherer:
 
         return set()
 
+    def _find_dependents(self, file_path: str, max_results: int = 15) -> set[str]:
+        """
+        Find files that import the given file (reverse dependencies).
+
+        Uses pure Python to search for import statements referencing this file.
+        Cross-platform compatible (Windows, macOS, Linux).
+        Limited to prevent performance issues on large codebases.
+
+        Args:
+            file_path: Path of the file to find dependents for
+            max_results: Maximum number of dependents to return
+
+        Returns:
+            Set of file paths that import this file.
+        """
+        dependents: set[str] = set()
+        path_obj = Path(file_path)
+        stem = path_obj.stem  # e.g., 'helpers' from 'utils/helpers.ts'
+
+        # Skip if stem is too generic (would match too many files)
+        if stem in ["index", "main", "app", "utils", "helpers", "types", "constants"]:
+            return dependents
+
+        # Build regex patterns and file extensions based on file type
+        pattern = None
+        file_extensions = []
+
+        if path_obj.suffix in [".ts", ".tsx", ".js", ".jsx"]:
+            # Match various import styles for JS/TS
+            # from './helpers', from '../utils/helpers', from '@/utils/helpers'
+            # Escape stem for regex safety
+            escaped_stem = re.escape(stem)
+            pattern = re.compile(rf"['\"].*{escaped_stem}['\"]")
+            file_extensions = [".ts", ".tsx", ".js", ".jsx"]
+        elif path_obj.suffix == ".py":
+            # Match Python imports: from .helpers import, import helpers
+            escaped_stem = re.escape(stem)
+            pattern = re.compile(rf"(from.*{escaped_stem}|import.*{escaped_stem})")
+            file_extensions = [".py"]
+        else:
+            return dependents
+
+        # Directories to exclude
+        exclude_dirs = {
+            "node_modules",
+            ".git",
+            "dist",
+            "build",
+            "__pycache__",
+            ".venv",
+            "venv",
+        }
+
+        # Walk the project directory
+        project_path = Path(self.project_dir)
+        files_checked = 0
+        max_files_to_check = 2000  # Prevent infinite scanning on large codebases
+
+        try:
+            for root, dirs, files in os.walk(project_path):
+                # Modify dirs in-place to exclude certain directories
+                dirs[:] = [d for d in dirs if d not in exclude_dirs]
+
+                for filename in files:
+                    # Check if we've hit the file limit
+                    if files_checked >= max_files_to_check:
+                        safe_print(
+                            f"[Context] File limit reached finding dependents for {file_path}"
+                        )
+                        return dependents
+
+                    # Check if file has the right extension
+                    if not any(filename.endswith(ext) for ext in file_extensions):
+                        continue
+
+                    file_full_path = Path(root) / filename
+                    files_checked += 1
+
+                    # Get relative path from project root
+                    try:
+                        relative_path = file_full_path.relative_to(project_path)
+                        relative_path_str = str(relative_path).replace("\\", "/")
+
+                        # Don't include the file itself
+                        if relative_path_str == file_path:
+                            continue
+
+                        # Search for the pattern in the file
+                        try:
+                            with open(
+                                file_full_path, encoding="utf-8", errors="ignore"
+                            ) as f:
+                                content = f.read()
+                                if pattern.search(content):
+                                    dependents.add(relative_path_str)
+                                    if len(dependents) >= max_results:
+                                        return dependents
+                        except (OSError, UnicodeDecodeError):
+                            # Skip files that can't be read
+                            continue
+
+                    except ValueError:
+                        # File is not relative to project_path, skip it
+                        continue
+
+        except Exception as e:
+            safe_print(f"[Context] Error finding dependents: {e}")
+
+        return dependents
+
+    def _prioritize_related_files(self, files: set[str], limit: int = 50) -> list[str]:
+        """
+        Prioritize related files by relevance.
+
+        Priority order:
+        1. Test files (most important for review context)
+        2. Type definition files (.d.ts)
+        3. Configuration files
+        4. Direct imports/dependents
+        5. Other files
+
+        Args:
+            files: Set of file paths to prioritize
+            limit: Maximum number of files to return
+
+        Returns:
+            List of files sorted by priority, limited to `limit`.
+        """
+        test_files = []
+        type_files = []
+        config_files = []
+        other_files = []
+
+        for f in files:
+            path = Path(f)
+            name_lower = path.name.lower()
+
+            # Test files
+            if (
+                ".test." in name_lower
+                or ".spec." in name_lower
+                or name_lower.startswith("test_")
+                or name_lower.endswith("_test.py")
+                or "__tests__" in f
+            ):
+                test_files.append(f)
+            # Type definition files
+            elif name_lower.endswith(".d.ts") or "types" in name_lower:
+                type_files.append(f)
+            # Config files
+            elif name_lower in [
+                n.lower() for n in CONFIG_FILE_NAMES
+            ] or name_lower.endswith((".config.js", ".config.ts", "rc", "rc.json")):
+                config_files.append(f)
+            else:
+                other_files.append(f)
+
+        # Sort within each category alphabetically for consistency, then combine
+        prioritized = (
+            sorted(test_files)
+            + sorted(type_files)
+            + sorted(config_files)
+            + sorted(other_files)
+        )
+
+        return prioritized[:limit]
+
+    def _load_json_safe(self, filename: str) -> dict | None:
+        """
+        Load JSON file from project_dir, handling tsconfig-style comments.
+
+        tsconfig.json allows // and /* */ comments, which standard JSON
+        parsers reject. This method first tries standard parsing (most
+        tsconfigs don't have comments), then falls back to comment stripping.
+
+        Note: Comment stripping only handles comments outside strings to
+        avoid mangling path patterns like "@/*" which contain "/*".
+
+        Args:
+            filename: JSON filename relative to project_dir
+
+        Returns:
+            Parsed JSON as dict, or None on error
+        """
+        try:
+            file_path = self.project_dir / filename
+            if not file_path.exists():
+                return None
+
+            content = file_path.read_text(encoding="utf-8")
+
+            # Try standard JSON parse first (most tsconfigs don't have comments)
+            try:
+                return json.loads(content)
+            except json.JSONDecodeError:
+                pass
+
+            # Fall back to comment stripping (outside strings only)
+            # First, remove block comments /* ... */
+            # Simple approach: remove everything between /* and */
+            # This handles multi-line block comments
+            while "/*" in content:
+                start = content.find("/*")
+                end = content.find("*/", start)
+                if end == -1:
+                    # Unclosed block comment - remove to end
+                    content = content[:start]
+                    break
+                content = content[:start] + content[end + 2 :]
+
+            # Then handle single-line comments
+            # This regex-based approach handles // comments
+            # outside of strings by checking for quotes
+            lines = content.split("\n")
+            cleaned_lines = []
+            for line in lines:
+                # Strip single-line comments, but not inside strings
+                # Simple heuristic: if '//' appears and there's an even
+                # number of quotes before it, strip from there
+                comment_pos = line.find("//")
+                if comment_pos != -1:
+                    # Count quotes before the //
+                    before_comment = line[:comment_pos]
+                    if before_comment.count('"') % 2 == 0:
+                        line = before_comment
+                cleaned_lines.append(line)
+            content = "\n".join(cleaned_lines)
+
+            return json.loads(content)
+        except (json.JSONDecodeError, OSError) as e:
+            safe_print(f"[Context] Could not load {filename}: {e}", style="dim")
+            return None
+
+    def _load_tsconfig_paths(self) -> dict[str, list[str]] | None:
+        """
+        Load path mappings from tsconfig.json.
+
+        Handles the 'extends' field to merge paths from base configs.
+
+        Returns:
+            Dict mapping path aliases to target paths, e.g.:
+            {"@/*": ["src/*"], "@shared/*": ["src/shared/*"]}
+            Returns None if no paths configured.
+        """
+        config = self._load_json_safe("tsconfig.json")
+        if not config:
+            return None
+
+        paths: dict[str, list[str]] = {}
+
+        # Handle extends field - load base config first
+        if "extends" in config:
+            extends_path = config["extends"]
+            # Handle relative paths like "./tsconfig.base.json"
+            if extends_path.startswith("./"):
+                extends_path = extends_path[2:]
+            base_config = self._load_json_safe(extends_path)
+            if base_config:
+                base_paths = base_config.get("compilerOptions", {}).get("paths", {})
+                paths.update(base_paths)
+
+        # Override with current config's paths
+        current_paths = config.get("compilerOptions", {}).get("paths", {})
+        paths.update(current_paths)
+
+        return paths if paths else None
+
+    def _resolve_path_alias(
+        self, import_path: str, paths: dict[str, list[str]]
+    ) -> str | None:
+        """
+        Resolve a path alias import to an actual file path.
+
+        Args:
+            import_path: Import path like '@/utils/helpers' or '~/config'
+            paths: tsconfig paths mapping from _load_tsconfig_paths()
+
+        Returns:
+            Resolved path like 'src/utils/helpers', or None if no match
+        """
+        for alias_pattern, target_paths in paths.items():
+            # Skip empty target_paths (malformed tsconfig entry)
+            if not target_paths:
+                continue
+            # Convert '@/*' to regex pattern '^@/(.*)$'
+            regex_pattern = "^" + alias_pattern.replace("*", "(.*)") + "$"
+            match = re.match(regex_pattern, import_path)
+            if match:
+                suffix = match.group(1) if match.lastindex else ""
+                # Use first target path, replace * with suffix
+                target = target_paths[0].replace("*", suffix)
+                return target
+        return None
+
+    def _resolve_python_import(
+        self, module_name: str, level: int, source_path: Path
+    ) -> str | None:
+        """
+        Resolve a Python import to an actual file path.
+
+        Args:
+            module_name: Module name like 'utils' or 'utils.helpers'
+            level: Import level (0=absolute, 1=from ., 2=from .., etc.)
+            source_path: Path of file doing the importing
+
+        Returns:
+            Resolved path relative to project root, or None if not found.
+        """
+        if level > 0:
+            # Relative import: from . or from ..
+            base_dir = source_path.parent
+            # level=1 means same package (.), level=2 means parent (..), etc.
+            for _ in range(level - 1):
+                base_dir = base_dir.parent
+
+            if module_name:
+                # from .module import x -> look for module.py or module/__init__.py
+                parts = module_name.split(".")
+                candidate = base_dir / Path(*parts)
+            else:
+                # from . import x -> can't resolve without knowing what x is
+                return None
+        else:
+            # Absolute import - check if it's project-internal
+            parts = module_name.split(".")
+            candidate = Path(*parts)
+
+        # Try as module file (e.g., utils.py)
+        file_path = self.project_dir / candidate.with_suffix(".py")
+        if file_path.exists() and file_path.is_file():
+            try:
+                return str(file_path.relative_to(self.project_dir))
+            except ValueError:
+                return None
+
+        # Try as package directory (e.g., utils/__init__.py)
+        init_path = self.project_dir / candidate / "__init__.py"
+        if init_path.exists() and init_path.is_file():
+            try:
+                return str(init_path.relative_to(self.project_dir))
+            except ValueError:
+                return None
+
+        return None
+
+    def _find_python_imports(self, content: str, source_path: Path) -> set[str]:
+        """
+        Find imported files from Python source code using AST.
+
+        Uses ast.parse to extract Import and ImportFrom nodes, then resolves
+        them to actual file paths within the project.
+
+        Args:
+            content: Python source code
+            source_path: Path of the file being analyzed
+
+        Returns:
+            Set of resolved file paths relative to project root.
+        """
+        imports: set[str] = set()
+
+        try:
+            tree = ast.parse(content)
+        except SyntaxError:
+            # Invalid Python syntax - skip gracefully
+            return imports
+
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Import):
+                # import module, import module.submodule
+                for alias in node.names:
+                    resolved = self._resolve_python_import(alias.name, 0, source_path)
+                    if resolved:
+                        imports.add(resolved)
+
+            elif isinstance(node, ast.ImportFrom):
+                # from module import x, from . import x, from ..module import x
+                module = node.module or ""
+                level = node.level  # 0=absolute, 1=from ., 2=from .., etc.
+                resolved = self._resolve_python_import(module, level, source_path)
+                if resolved:
+                    imports.add(resolved)
+
+        return imports
+
     @staticmethod
     def find_related_files_for_root(
         changed_files: list[ChangedFile],
@@ -1035,8 +1511,8 @@ class PRContextGatherer:
         changed_paths = {cf.path for cf in changed_files}
         related = {r for r in related if r not in changed_paths}
 
-        # Limit to 20 most relevant files
-        return sorted(related)[:20]
+        # Limit to 50 most relevant files (increased from 20)
+        return sorted(related)[:50]
 
 
 class FollowupContextGatherer:
@@ -1285,7 +1761,7 @@ class FollowupContextGatherer:
             diff_since_review=diff_since_review,
             contributor_comments_since_review=contributor_comments
             + contributor_reviews,
-            ai_bot_comments_since_review=ai_comments,
+            ai_bot_comments_since_review=ai_comments + ai_reviews,
             pr_reviews_since_review=pr_reviews,
             has_merge_conflicts=has_merge_conflicts,
             merge_state_status=merge_state_status,

apps/backend/runners/github/duplicates.py

@@ -347,7 +347,7 @@ class DuplicateDetector:
         if not cache_file.exists():
             return {}
 
-        with open(cache_file) as f:
+        with open(cache_file, encoding="utf-8") as f:
             data = json.load(f)
 
         cache = {}
@@ -365,7 +365,7 @@ class DuplicateDetector:
             "embeddings": [e.to_dict() for e in cache.values()],
             "last_updated": datetime.now(timezone.utc).isoformat(),
         }
-        with open(cache_file, "w") as f:
+        with open(cache_file, "w", encoding="utf-8") as f:
             json.dump(data, f)
 
     async def get_embedding(