July 17, 2026

A Full-Codebase Sweep, Not One Behavior Changed

A day spent hardening the codebase — complexity, unsafe regexes, silent errors, broken accessibility — with a hard rule that none of it was allowed to change what Chalie actually does.

1.1.0-beta shipped yesterday. Today was the bill for shipping fast: a full pass through the codebase fixing everything flagged and ignored while features were the priority. No new surface, no new endpoints. One rule for the whole day — touch it, prove it’s identical, move on.

That rule is harder than it sounds. Cutting cognitive complexity means pulling chunks of a function out into named helpers, and it’s trivially easy to shift behavior while you do it — swallow a continue, drop a guard, reorder a check. So every extraction got the same treatment: verbatim block moves, diff-audited path by path, full test suite run after every batch. One helper in the LLM client code turned out to have a guard that looked load-bearing and wasn’t — both exception paths in the code it guarded already raised, so the condition could never actually be false. Worth finding, not worth trusting on a hunch.

The regex fixes were the sharpest part of the day. A handful of patterns in the bash and search-enrichment code were vulnerable to catastrophic backtracking — regex that runs in milliseconds on normal input and hangs for seconds on input built to exploit it. One scanner went from 2.95 seconds to 0.0007 seconds on a 100,000-character worst case. Another dropped a quarter-second stall on hostile HTML to nothing. Nobody was hitting these in practice, but “nobody’s hit it yet” isn’t a sentence worth still saying after someone finds it on purpose. Every rewrite got corpus- and fuzz-tested against the original before it landed.

The quieter fix that probably matters most day to day: 113 exception handlers were logging errors with logger.error, which drops the stack trace on the floor. Swapped every one to logger.exception — one-token change, and the next time something breaks in production the log says where. That’s a bug that costs an hour of guessing every time it doesn’t happen; now it doesn’t have to. Alongside it: duplicated string literals collapsed into constants across two dozen files, an a11y pass that turned a fake role="button" div into a real button, and a TypeScript modernization batch that replaced ternary soup with the idioms the language actually has for it. Also landed a small piece of continuity from yesterday’s ledger cleanup — the spend-bucket vocabulary got a real name and a written contract instead of an implicit one.

One decision got reversed the same afternoon it was made, worth being honest about rather than quietly folding into the next commit. Backend has no update endpoint anymore, so the interface’s app-update overlay had been dead code for a while — pulled it out entirely, WebSocket event and all. Then it became clear that went one step too far: removing the command left no way to update Chalie short of re-running the installer by hand. So it came back as a one-shot CLI command — stop the daemon, re-pull the installer, start again — no auto-update pretending to manage itself, just a manual command that does the obvious three steps for you.

Closed the day rebuilding the frontend bundles against everything that moved, and fixing two tests that had drifted from the real DOM — one still asserting against a CSS class renamed out from under it weeks ago, another that only passed running after a specific other test.

None of this is visible in the product tomorrow. That’s the point of a day like this — the release is out, the debt that piled up getting there is paid down, and whatever ships next isn’t dragging a backlog behind it.

  • Decomposed cognitive-complexity hotspots across dozens of backend and frontend files into extraction-only helpers, diff-audited to prove zero behavior change

  • Rewrote regexes vulnerable to catastrophic backtracking; one worst-case scan dropped from 2.95s to 0.0007s, corpus- and fuzz-verified against the originals

  • Converted 113 exception handlers from logger.error to logger.exception so tracebacks actually surface in production logs

  • Removed dead app-update plumbing from the interface, then restored the CLI’s one-shot update command after realizing the removal had gone too far

  • Ran an accessibility and TypeScript-modernization pass across the interface, rebuilt the frontend bundles, and fixed two tests that had drifted from the live DOM