fix(adhoc-sweep-fixes): 6 review findings across 6 files

[flamingo]

Closes 6 review findings across 6 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 95 high	RedisCacheService.getInsertTime NPEs when expiration key is absent	backend/src/main/java/cx/flamingo/analysis/cache/impl/RedisCacheService.java:45
2	🟡 80 medium	initializeRateLimits is a no-op after first call due to alreadyInitialized guard, so rate limits never refresh after startup	backend/src/main/java/cx/flamingo/analysis/rate/GithubTokenRateManager.java:97
3	🟢 90 high	Frontend logs the resolved backend API URL to the console in production builds	frontend/src/services/api.ts:6
4	🟡 70 medium	fixedDelay=1000ms scheduled cache-refresh cycle likely reruns immediately, causing continuous re-fetch churn	backend/src/main/java/cx/flamingo/analysis/service/PreCacheService.java:28
5	🟡 85 medium	QuerySerializer.serializeArguments has dead-code ternary that always evaluates identically	backend/src/main/java/cx/flamingo/analysis/graphql/QuerySerializer.java:51
6	🟢 90 high	console.log left in production App.tsx fetch path	frontend/src/App.tsx:28

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 89424001-8db6-4ce6-8840-ab853de69d56

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

6 finding(s) fixed in this draft — 6 explained inline on the diff.

[flamingo]

🦩 🔴 RedisCacheService.getInsertTime NPEs when expiration key is absent

In getInsertTime (RedisCacheService.java), added a null check on json immediately after fetching it via valueOps.get(redisKey + EXPIRATION_SUFFIX), returning 0L when null, before calling json.toString(). This matches the suggested fix exactly and prevents the NullPointerException when the expiration key is absent.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/cache/impl/RedisCacheService.java around line 45, review and complete this code-review fix: RedisCacheService.getInsertTime NPEs when expiration key is absent.
What the draft fix changed: In `getInsertTime` (RedisCacheService.java), added a null check on `json` immediately after fetching it via `valueOps.get(redisKey + EXPIRATION_SUFFIX)`, returning `0L` when null, before calling `json.toString()`. This matches the suggested fix exactly and prevents the NullPointerException when the expiration key is absent.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 initializeRateLimits is a no-op after first call due to alreadyInitialized guard, so rate limits never refresh after startup

Removed the alreadyInitialized early-return guard at the top of initializeRateLimits() so the method always performs the GitHub rate-limit fetch and updates each token's headers on every call. The alreadyInitialized field is retained (still set to true at the end of the method, preserving its value/semantics for any external readers via the Lombok @Getter) but no longer blocks re-execution, so the "wait then re-check" retry loop in getBestAvailableClient will now actually refresh rate-limit data from GitHub instead of silently no-op'ing. Risk: this method now performs a real HTTP call per token on every invocation instead of only once, which is the correct/intended behavior per the finding but increases GitHub API call volume during retries — no additional throttling/backoff was added beyond what already existed in getBestAvailableClient.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/rate/GithubTokenRateManager.java around line 97, review and complete this code-review fix: initializeRateLimits is a no-op after first call due to alreadyInitialized guard, so rate limits never refresh after startup.
What the draft fix changed: Removed the `alreadyInitialized` early-return guard at the top of `initializeRateLimits()` so the method always performs the GitHub rate-limit fetch and updates each token's headers on every call. The `alreadyInitialized` field is retained (still set to `true` at the end of the method, preserving its value/semantics for any external readers via the Lombok `@Getter`) but no longer blocks re-execution, so the "wait then re-check" retry loop in `getBestAvailableClient` will now actually refresh rate-limit data from GitHub instead of silently no-op'ing. Risk: this method now performs a real HTTP call per token on every invocation instead of only once, which is the correct/intended behavior per the finding but increases GitHub API call volume during retries — no additional throttling/backoff was added beyond what already existed in `getBestAvailableClient`.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 80 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 Frontend logs the resolved backend API URL to the console in production builds

In the module-level initialization code of frontend/src/services/api.ts, wrapped the console.log('API Service: Using backend URL:', BACKEND_API_URL) call in an if (process.env.NODE_ENV !== 'production') guard, exactly as suggested, so the resolved backend URL is not logged in production bundles.

🤖 Prompt for AI agents

In frontend/src/services/api.ts around line 6, review and complete this code-review fix: Frontend logs the resolved backend API URL to the console in production builds.
What the draft fix changed: In the module-level initialization code of `frontend/src/services/api.ts`, wrapped the `console.log('API Service: Using backend URL:', BACKEND_API_URL)` call in an `if (process.env.NODE_ENV !== 'production')` guard, exactly as suggested, so the resolved backend URL is not logged in production bundles.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 fixedDelay=1000ms scheduled cache-refresh cycle likely reruns immediately, causing continuous re-fetch churn

In runFullCacheCycle's @Scheduled annotation, changed fixedDelay from 1000l (1 second) to 3600000l (1 hour), so the full cache refresh cycle no longer restarts almost immediately after completion but instead runs hourly, while initialDelay remains unchanged so it still runs on startup. The exact interval value (1 hour) is a reasonable default per the finding's suggestion but was not explicitly specified elsewhere in the codebase, so a reviewer should confirm the desired refresh period.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/service/PreCacheService.java around line 28, review and complete this code-review fix: fixedDelay=1000ms scheduled cache-refresh cycle likely reruns immediately, causing continuous re-fetch churn.
What the draft fix changed: In `runFullCacheCycle`'s `@Scheduled` annotation, changed `fixedDelay` from `1000l` (1 second) to `3600000l` (1 hour), so the full cache refresh cycle no longer restarts almost immediately after completion but instead runs hourly, while `initialDelay` remains unchanged so it still runs on startup. The exact interval value (1 hour) is a reasonable default per the finding's suggestion but was not explicitly specified elsewhere in the codebase, so a reviewer should confirm the desired refresh period.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 QuerySerializer.serializeArguments has dead-code ternary that always evaluates identically

In serializeArguments, the ternary's true-branch (String values) now wraps the value in escaped double quotes ("\"" + entry.getValue().toString() + "\"") instead of duplicating the non-string branch, so string GraphQL argument values are emitted as quoted literals (e.g. name: "hello") while non-string values remain unquoted (e.g. numbers, booleans). This is the minimal fix restoring the intended behavior described by the comment; it does not add escaping of internal quotes/special characters within the string value, which a more complete fix might require.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/graphql/QuerySerializer.java around line 51, review and complete this code-review fix: QuerySerializer.serializeArguments has dead-code ternary that always evaluates identically.
What the draft fix changed: In serializeArguments, the ternary's true-branch (String values) now wraps the value in escaped double quotes (`"\"" + entry.getValue().toString() + "\""`) instead of duplicating the non-string branch, so string GraphQL argument values are emitted as quoted literals (e.g. `name: "hello"`) while non-string values remain unquoted (e.g. numbers, booleans). This is the minimal fix restoring the intended behavior described by the comment; it does not add escaping of internal quotes/special characters within the string value, which a more complete fix might require.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔵 console.log left in production App.tsx fetch path

Removed the console.log('App: URL state changed:', urlState) call along with its wrapping useEffect in MainApp, and removed the now-unused console.log('Fetching contributors with params:', ...) call inside the queryFn of the useQuery call in MainApp. Also removed the now-unused useEffect import from React since it was only used for the removed effect. This eliminates the debug scaffolding logging on every render/query-key change without altering any other behavior.

🤖 Prompt for AI agents

In frontend/src/App.tsx around line 28, review and complete this code-review fix: console.log left in production App.tsx fetch path.
What the draft fix changed: Removed the `console.log('App: URL state changed:', urlState)` call along with its wrapping `useEffect` in `MainApp`, and removed the now-unused `console.log('Fetching contributors with params:', ...)` call inside the `queryFn` of the `useQuery` call in `MainApp`. Also removed the now-unused `useEffect` import from React since it was only used for the removed effect. This eliminates the debug scaffolding logging on every render/query-key change without altering any other behavior.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer