docs: bring README up to date with shipped features - #2
Conversation
The README still described the CLI as "prints a notice only" and predated the implemented engine. Update it to reflect what actually ships: - Drop the stale "notice only" status; the scanner, redactor, source adapters, allowlist, install command, and proxy are all implemented+tested - Document `broom proxy` (live redacting proxy, --install/--daemon/--uninstall) - Document `broom install` (Claude Code skill + Stop hook) and `broom sources` - Document the allowlist file and --allowlist/--no-allowlist flags - Bump the stated Node floor to >=22.13 (node:sqlite unflagged) with rationale - Refresh the flags tables and examples to match `broom --help` Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 22 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the README.md to document several new features of broomsticks, including the local redacting proxy (broom proxy), automated Claude Code sweeps (broom install), the broom sources command, and custom allowlist support. Feedback on these additions highlights three main areas for improvement: addressing the leftover environment variables in shell profiles after running broom proxy --uninstall to prevent connection failures, documenting or optimizing the latency introduced by buffering entire streaming responses in the proxy, and recommending a global installation to avoid performance degradation when the Claude Code integration falls back to using npx.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| broom proxy --install --daemon | ||
|
|
||
| # Remove the daemon later | ||
| broom proxy --uninstall |
There was a problem hiding this comment.
Usability Note: Running broom proxy --uninstall only removes the background daemon; it does not clean up or remove the ANTHROPIC_BASE_URL and OPENAI_BASE_URL environment variables from the shell profile files (e.g., .zshrc, .bashrc).
If these environment variables are left in the shell profiles after the proxy is uninstalled or stopped, all subsequent AI CLI tools (like Claude Code or Aider) will fail to connect to their upstream APIs (resulting in connection refused errors).
Consider:
- Clarifying in the README that users must manually remove these lines from their shell profiles when uninstalling, or
- Implementing an automatic cleanup of shell profiles in the
--uninstallcommand (e.g., anuninstallProxyEnvfunction) to prevent leaving the user's shell in a broken state.
| | `POST /v1/messages` | `api.anthropic.com` | Claude Code, Aider | | ||
| | `POST /v1/chat/completions` | `api.openai.com` | Codex, OpenAI-compatible clients | | ||
|
|
||
| Both streaming (SSE) and non-streaming responses are handled — a streaming response is buffered in full before redaction so a secret straddling two chunks can't slip through, then re-emitted as a valid SSE stream. |
There was a problem hiding this comment.
Performance / UX Note: Buffering the entire streaming response in full before redacting and re-emitting it defeats the primary benefit of streaming (reducing perceived latency). For long model responses, this will cause the AI assistant's UI to appear to hang and then dump the entire response at once, leading to a degraded user experience.
Consider:
- Documenting this latency impact as a known limitation of the proxy in the Limitations section.
- Exploring a sliding-window buffering mechanism in the future, which only buffers a small window (e.g., matching the maximum length of a potential secret) before flushing, thereby preserving the streaming experience while still preventing secrets from straddling chunk boundaries.
| This adds (with your confirmation): | ||
|
|
||
| - `~/.claude/skills/broom-sweep/SKILL.md` — a skill that teaches Claude to preview and apply redactions | ||
| - `~/.claude/hooks/stop-broom.mjs` — a Stop hook that silently scans your transcripts after every turn |
There was a problem hiding this comment.
Performance Note: The installed Stop hook (stop-broom.mjs) falls back to running npx broomsticks scan if the global broom command is not found in the PATH. Running npx on every single turn of Claude Code introduces significant latency (often 1-2+ seconds) due to package resolution overhead, making the chat experience feel sluggish.
Consider adding a note in this section recommending that users install broomsticks globally (npm install -g broomsticks) when using the automatic Claude Code integration to ensure optimal performance.
- Note that `broom proxy --uninstall` leaves base-URL env vars in shell profiles and they must be removed by hand (else tools hit a dead proxy) - Recommend a global install for the Claude Code integration, since the Stop hook's npx fallback adds per-turn latency - Document full-response buffering in the proxy as a streaming-latency limitation Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![battletest[bot]](https://avatars.githubusercontent.com/in/4062504?s=60&v=4){kind=small}
Two proxy fixes surfaced by PR #2 review/battletest: 1. Tool-call argument leak (security). redactAnthropicSSE / redactOpenAISSE only handled text deltas; every other event — including tool-call argument deltas (Anthropic input_json_delta, OpenAI tool_calls[].function.arguments) — passed through unredacted. A model echoing a secret into a tool argument (e.g. write_file content) leaked it to the client. Both redactors now accumulate and redact tool-call argument JSON alongside text, keyed by block / tool_call index, then collapse into the first occurrence. Extended-thinking blocks are deliberately left untouched (rewriting them invalidates their signature and breaks multi-turn thinking+tool loops) and documented as such. 2. Env-var cleanup on uninstall. Added uninstallProxyEnv() — the inverse of installProxyEnv() — and wired it into `broom proxy --uninstall`, so the ANTHROPIC_BASE_URL / OPENAI_BASE_URL block is removed from shell profiles instead of being left behind pointing at a dead proxy. README updated to describe the proxy's actual scope; new tests cover the SSE tool-call round-trip (secret split across chunks), the thinking passthrough, and the env install/uninstall round-trip. Full suite: 38 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
PR #1 was merged before the README could be refreshed. The README still described the CLI as "prints a notice only" and predated the implemented engine. This brings it in line with what actually ships.
Changes
broom proxy(live redacting proxy;--install/--daemon/--uninstall)broom install(Claude Code skill + Stop hook) andbroom sources--allowlist/--no-allowlistflags>=22.13(node:sqlite unflagged) with rationalebroom --helpDocs-only; no code changes.
🤖 Generated with Claude Code