Phase 7: Auto-Fix PR Creation (Killer Feature)¶

Status: Week 2 Day 2 Complete (40% complete) Timeline: 2-3 weeks (Week 1 complete, Week 2 in progress) Priority: HIGH (Strategic differentiator) Estimated Effort: 300-400 hours (solo) Time Spent: ~150 hours (Week 1: 95+ hours, Week 2: 50+ hours so far)

Latest Updates: - ✅ Week 1 Complete: Foundation Components (FixApplier, CommitBuilder, PRCreator, FixPRQueue) - 95+ tests passing - ✅ Week 2 Day 1 Complete: API Endpoint (/api/teams/[teamId]/create-fix-pr) - 15 tests (10 passing) - ✅ Week 2 Day 2 Complete: Webhook Integration (auto-fix CTA comments, PR lifecycle tracking) - 14 tests (all passing) - ⏳ Week 2 Days 3-5: Error handling, quota management, monitoring

Executive Summary¶

The Killer Feature: CodeSlick doesn't just comment on PRs—it automatically creates fix PRs with corrected code.

Why This Wins: - User Delight: Zero manual work (CodeSlick does the tedious fixing) - Competitive Moat: Snyk tries this but is slow/clunky. GitHub doesn't offer it. You can dominate this. - Monetization: Premium feature (€299/month Enterprise plan or €49/month add-on) - Viral Growth: Developers will screenshot and share on Twitter ("look how fast CodeSlick fixed 15 vulnerabilities!")

Current State: You have all the building blocks: - ✅ Pattern-based fixes (instant, 100% reliable) - ✅ AI-powered fixes (smart, context-aware) - ✅ GitHub API integration (PR analysis, comments) - ✅ Fix validation (ensures fixes don't break code)

Gap: No automatic PR creation. User must manually apply fixes.

Problem Statement¶

Current User Flow (Manual)¶

1. Developer opens PR
2. CodeSlick analyzes → Posts comments with vulnerabilities
3. Developer reads comments
4. Developer manually fixes code
5. Developer commits fixes
6. PR gets approved

Pain Points: - Step 3-5 is tedious (copy/paste fixes, test locally, commit) - Developer might ignore comments (too busy) - Fixing 10+ issues = 30-60 minutes manual work

Desired User Flow (Automated)¶

1. Developer opens PR
2. CodeSlick analyzes → Posts comments with vulnerabilities
3. CodeSlick creates separate "Fix PR" with all corrections
4. Developer reviews fix PR → Approves → Merges to original PR
5. Original PR now has fixes → Gets approved

Benefits: - Step 3-4 takes 2 minutes (just review and approve) - Developer can't ignore fixes (they're already done) - Fixing 10+ issues = automatic (30-60 minutes saved)

Product Vision¶

Feature: "Auto-Fix PR"¶

Trigger Options: 1. Manual (MVP): "Create Fix PR" button in PR comment 2. Automatic (Phase 7.5): Auto-create fix PR for all fixable issues 3. Selective (Phase 7.5): User selects which issues to fix, CodeSlick creates PR

PR Structure:

Original PR: feature/add-authentication (by developer)
├── Has vulnerabilities (SQL injection, XSS, hardcoded secrets)
└── CodeSlick creates:
    └── Fix PR: codeslick/fix-add-authentication-abc123
        ├── Base: feature/add-authentication (not main!)
        ├── Commits: One per vulnerability type
        │   ├── "Fix: Remove SQL injection in auth.js"
        │   ├── "Fix: Sanitize XSS in UserInput.tsx"
        │   └── "Fix: Remove hardcoded API key in config.py"
        └── Description: Detailed explanation of each fix

Workflow: 1. Developer merges fix PR → feature/add-authentication 2. Feature branch now has fixes 3. Original PR (feature/add-authentication → main) gets re-analyzed 4. CodeSlick posts: "✅ All fixable issues resolved!"

Existing Infrastructure (What You Have)¶

✅ Fix Generation (`src/lib/utils/`)¶

Component	What It Does	Status
`pattern-fixer.ts`	Pattern-based fixes (syntax, var→const, semicolons)	✅ Complete (23KB, instant)
`security-fixer.ts`	Security-focused fixes (SQL injection, XSS)	✅ Complete (26KB)
`fix-validator.ts`	Validates fixes don't break code	✅ Complete (9KB)

✅ API Endpoints (`src/app/api/`)¶

Endpoint	What It Does	Status
`/api/fix-all`	Batch pattern-based fixing	✅ Complete (<100ms)
`/api/generate-fix`	AI-powered individual fixes	✅ Complete (5-10s per fix)

✅ GitHub Integration (`src/lib/github/`)¶

Component	What It Does	Status
`github-client.ts`	GitHub API wrapper (auth, requests)	✅ Complete
`pr-analyzer.ts`	Fetches PR files, runs analysis	✅ Complete
`comment-formatter.ts`	Formats analysis as PR comments	✅ Complete (16KB)

❌ Missing Components (What You Need to Build)¶

Component	What It Does	Effort
`pr-creator.ts`	Create PR via GitHub API	2 days
`fix-applier.ts`	Apply fixes to file contents	1 day
`commit-builder.ts`	Create commits programmatically	1 day
`fix-pr-ui.tsx`	UI for triggering fix PR creation	2 days
Database schema	Store fix PR metadata	1 day
Job queue	Handle async PR creation	2 days

Total New Code: ~1,500-2,000 LOC Total Tests: 40-50 tests

Technical Architecture¶

Component 1: Fix Applier (`src/lib/github/fix-applier.ts`)¶

Purpose: Apply fixes to file content

/**
 * Apply fixes to a file's content
 */
interface ApplyFixesInput {
  fileContent: string;
  fileName: string;
  language: string;
  vulnerabilities: Vulnerability[];
}

interface ApplyFixesResult {
  fixedContent: string;
  appliedFixes: string[]; // List of what was fixed
  skippedFixes: string[]; // Issues that couldn't be auto-fixed
  validationResult: ValidationResult;
}

async function applyFixes(input: ApplyFixesInput): Promise<ApplyFixesResult> {
  // 1. Categorize vulnerabilities by fix type
  const patternFixable = filterPatternFixable(input.vulnerabilities);
  const aiFixable = filterAIFixable(input.vulnerabilities);
  const manualOnly = filterManualOnly(input.vulnerabilities);

  // 2. Apply pattern-based fixes first (fast, reliable)
  let content = input.fileContent;
  const patternResults = await applyPatternFixes(content, patternFixable);
  content = patternResults.fixedContent;

  // 3. Apply AI fixes (slower, requires API call)
  const aiResults = await applyAIFixes(content, aiFixable);
  content = aiResults.fixedContent;

  // 4. Validate fixes don't break syntax
  const validation = await validateFix(content, input.language);
  if (!validation.valid) {
    // Rollback to original if validation fails
    return {
      fixedContent: input.fileContent,
      appliedFixes: [],
      skippedFixes: [...patternFixable, ...aiFixable].map(v => v.vulnerability),
      validationResult: validation
    };
  }

  // 5. Return results
  return {
    fixedContent: content,
    appliedFixes: [...patternResults.fixed, ...aiResults.fixed],
    skippedFixes: manualOnly.map(v => v.vulnerability),
    validationResult: validation,
  };
}

Key Challenge: Apply multiple fixes to same file without conflicts.

Solution: Apply fixes sequentially, validate after each batch.

Component 2: PR Creator (`src/lib/github/pr-creator.ts`)¶

Purpose: Create PR via GitHub API

/**
 * Create a fix PR on GitHub
 */
interface CreateFixPRInput {
  installationId: number;
  owner: string;
  repo: string;
  baseBranch: string; // The PR being fixed (e.g., "feature/auth")
  fixes: FileFixResult[]; // Array of { path, originalContent, fixedContent, appliedFixes }
}

interface CreateFixPRResult {
  prNumber: number;
  prUrl: string;
  branch: string; // Generated branch name (e.g., "codeslick/fix-auth-abc123")
  commitsCreated: number;
}

async function createFixPR(input: CreateFixPRInput): Promise<CreateFixPRResult> {
  const octokit = await getInstallationOctokit(input.installationId);

  // 1. Generate unique branch name
  const branchName = `codeslick/fix-${input.baseBranch.replace(/[^a-z0-9]/gi, '-')}-${nanoid(6)}`;

  // 2. Get base branch SHA
  const { data: baseBranchData } = await octokit.git.getRef({
    owner: input.owner,
    repo: input.repo,
    ref: `heads/${input.baseBranch}`,
  });
  const baseCommitSha = baseBranchData.object.sha;

  // 3. Create new branch
  await octokit.git.createRef({
    owner: input.owner,
    repo: input.repo,
    ref: `refs/heads/${branchName}`,
    sha: baseCommitSha,
  });

  // 4. Create commits (one per file or vulnerability type)
  let currentSha = baseCommitSha;
  for (const fix of input.fixes) {
    // Create blob (file content)
    const { data: blobData } = await octokit.git.createBlob({
      owner: input.owner,
      repo: input.repo,
      content: Buffer.from(fix.fixedContent).toString('base64'),
      encoding: 'base64',
    });

    // Create tree (directory structure)
    const { data: baseTree } = await octokit.git.getTree({
      owner: input.owner,
      repo: input.repo,
      tree_sha: currentSha,
    });

    const { data: newTree } = await octokit.git.createTree({
      owner: input.owner,
      repo: input.repo,
      base_tree: baseTree.sha,
      tree: [{
        path: fix.path,
        mode: '100644',
        type: 'blob',
        sha: blobData.sha,
      }],
    });

    // Create commit
    const commitMessage = generateCommitMessage(fix);
    const { data: commitData } = await octokit.git.createCommit({
      owner: input.owner,
      repo: input.repo,
      message: commitMessage,
      tree: newTree.sha,
      parents: [currentSha],
    });

    currentSha = commitData.sha;

    // Update branch reference
    await octokit.git.updateRef({
      owner: input.owner,
      repo: input.repo,
      ref: `heads/${branchName}`,
      sha: currentSha,
    });
  }

  // 5. Create pull request
  const prBody = generatePRDescription(input.fixes);
  const { data: prData } = await octokit.pulls.create({
    owner: input.owner,
    repo: input.repo,
    title: `🔒 CodeSlick Auto-Fix: ${input.fixes.length} security issues`,
    head: branchName,
    base: input.baseBranch,
    body: prBody,
  });

  return {
    prNumber: prData.number,
    prUrl: prData.html_url,
    branch: branchName,
    commitsCreated: input.fixes.length,
  };
}

function generateCommitMessage(fix: FileFixResult): string {
  return `Fix: ${fix.appliedFixes.join(', ')} in ${fix.path}

Applied fixes:
${fix.appliedFixes.map(f => `- ${f}`).join('\n')}

🤖 Auto-fixed by CodeSlick
`;
}

function generatePRDescription(fixes: FileFixResult[]): string {
  const totalFixes = fixes.reduce((sum, f) => sum + f.appliedFixes.length, 0);

  return `## 🔒 CodeSlick Auto-Fix

CodeSlick automatically fixed **${totalFixes} security vulnerabilities** in this branch.

### Files Modified

${fixes.map(f => `
#### \`${f.path}\`
${f.appliedFixes.map(fix => `- ✅ ${fix}`).join('\n')}
${f.skippedFixes.length > 0 ? `\n**Manual fixes required:**\n${f.skippedFixes.map(s => `- ⚠️ ${s}`).join('\n')}` : ''}
`).join('\n')}

### How to Review

1. Review the changes in each file
2. Run your tests to ensure nothing broke
3. Merge this PR to apply fixes to your feature branch
4. Your original PR will be re-analyzed automatically

### About CodeSlick

CodeSlick automatically detects and fixes security vulnerabilities in your pull requests. [Learn more →](https://codeslick.dev)

---
🤖 Auto-generated by [CodeSlick](https://codeslick.dev) | [Report Issue](https://github.com/VitorLourenco/codeslick2/issues)
`;
}

Component 3: Database Schema¶

New Table: fix_prs

export const fixPrs = pgTable('fix_prs', {
  id: uuid('id').primaryKey().defaultRandom(),
  teamId: uuid('team_id').notNull().references(() => teams.id),

  // Source PR (the one being fixed)
  sourceOwner: varchar('source_owner', { length: 255 }),
  sourceRepo: varchar('source_repo', { length: 255 }),
  sourcePrNumber: integer('source_pr_number'),
  sourceBranch: varchar('source_branch', { length: 255 }),

  // Fix PR (the one CodeSlick creates)
  fixPrNumber: integer('fix_pr_number'),
  fixBranch: varchar('fix_branch', { length: 255 }),
  fixPrUrl: varchar('fix_pr_url', { length: 500 }),

  // Results
  filesFixed: integer('files_fixed'),
  vulnerabilitiesFixed: integer('vulnerabilities_fixed'),
  vulnerabilitiesSkipped: integer('vulnerabilities_skipped'),

  // Status
  status: varchar('status', { length: 20 }), // pending, creating, completed, failed, merged
  createdAt: timestamp('created_at').notNull().defaultNow(),
  completedAt: timestamp('completed_at'),

  // Metadata
  commitCount: integer('commit_count'),
  errorMessage: text('error_message'),
});

Component 4: Job Queue¶

Why Needed: Creating a PR with multiple commits takes 10-30 seconds (GitHub API is slow). Can't block webhook handler.

Solution: Use background job queue.

Options: 1. BullMQ (Redis-based, robust) 2. Inngest (serverless-friendly, easy) 3. Custom (database polling, simple)

Recommended: Inngest (easiest for solo dev)

// src/lib/jobs/create-fix-pr-job.ts
import { inngest } from '@/lib/inngest/client';

export const createFixPrJob = inngest.createFunction(
  { name: 'Create Fix PR' },
  { event: 'codeslick/create-fix-pr' },
  async ({ event, step }) => {
    const { teamId, installationId, owner, repo, prNumber, vulnerabilities } = event.data;

    // Step 1: Fetch PR files
    const files = await step.run('fetch-pr-files', async () => {
      return await fetchPRFiles(installationId, owner, repo, prNumber);
    });

    // Step 2: Apply fixes to each file
    const fixResults = await step.run('apply-fixes', async () => {
      const results = [];
      for (const file of files) {
        const result = await applyFixes({
          fileContent: file.content,
          fileName: file.name,
          language: file.language,
          vulnerabilities: vulnerabilities.filter(v => v.fileName === file.name),
        });
        results.push({ path: file.name, ...result });
      }
      return results.filter(r => r.appliedFixes.length > 0);
    });

    // Step 3: Create PR
    const prResult = await step.run('create-github-pr', async () => {
      return await createFixPR({
        installationId,
        owner,
        repo,
        baseBranch: files[0].branch,
        fixes: fixResults,
      });
    });

    // Step 4: Update database
    await step.run('save-to-database', async () => {
      await db.insert(fixPrs).values({
        teamId,
        sourceOwner: owner,
        sourceRepo: repo,
        sourcePrNumber: prNumber,
        fixPrNumber: prResult.prNumber,
        fixPrUrl: prResult.prUrl,
        fixBranch: prResult.branch,
        filesFixed: fixResults.length,
        vulnerabilitiesFixed: fixResults.reduce((sum, f) => sum + f.appliedFixes.length, 0),
        status: 'completed',
      });
    });

    // Step 5: Post comment on original PR
    await step.run('post-pr-comment', async () => {
      await postPRComment(installationId, owner, repo, prNumber, {
        message: `🔒 **Auto-Fix PR Created!**\n\nCodeSlick fixed ${prResult.commitsCreated} files with security vulnerabilities.\n\n[Review and merge fix PR #${prResult.prNumber} →](${prResult.prUrl})`,
      });
    });

    return { success: true, prUrl: prResult.prUrl };
  }
);

Component 5: UI Trigger¶

Page: Team Dashboard (/teams/[teamId])

Component: CreateFixPRButton.tsx

'use client';

import { useState } from 'react';
import { Button } from '@/components/ui/Button';
import { Loader2 } from 'lucide-react';

interface CreateFixPRButtonProps {
  teamId: string;
  prUrl: string; // GitHub PR URL
}

export function CreateFixPRButton({ teamId, prUrl }: CreateFixPRButtonProps) {
  const [loading, setLoading] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const [fixPrUrl, setFixPrUrl] = useState<string | null>(null);

  const handleCreateFixPR = async () => {
    setLoading(true);
    setError(null);

    try {
      const res = await fetch('/api/teams/${teamId}/create-fix-pr', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ prUrl }),
      });

      if (!res.ok) throw new Error('Failed to create fix PR');

      const data = await res.json();
      setFixPrUrl(data.fixPrUrl);
    } catch (err) {
      setError(err.message);
    } finally {
      setLoading(false);
    }
  };

  if (fixPrUrl) {
    return (
      <div className="bg-green-50 border border-green-200 rounded p-4">
        <p className="text-green-900 font-medium mb-2">✅ Fix PR Created!</p>
        <a href={fixPrUrl} target="_blank" className="text-indigo-600 underline">
          View Fix PR →
        </a>
      </div>
    );
  }

  return (
    <div>
      <Button onClick={handleCreateFixPR} disabled={loading}>
        {loading ? (
          <>
            <Loader2 className="animate-spin mr-2" size={16} />
            Creating Fix PR...
          </>
        ) : (
          '🔒 Create Auto-Fix PR'
        )}
      </Button>
      {error && <p className="text-red-600 text-sm mt-2">{error}</p>}
    </div>
  );
}

Implementation Plan (2-3 Weeks)¶

Week 1: Core Functionality¶

Day 1: Fix Applier (6-8 hours) - Create fix-applier.ts - Integrate with pattern-fixer.ts and security-fixer.ts - Handle multiple fixes per file - Validate fixes don't break syntax - Tests: 10+ (edge cases, validation failures)

Day 2: Commit Builder (6-8 hours) - Create commit-builder.ts - Generate commit messages (one per file or vulnerability type) - Handle GitHub Git Data API (blobs, trees, commits) - Tests: 8+ (different commit structures)

Day 3: PR Creator (8-10 hours) - Create pr-creator.ts - Implement branch creation - Implement commit creation loop - Implement PR creation with description - Tests: 12+ (permissions, API failures, edge cases)

Day 4: Integration Testing (6-8 hours) - End-to-end test: PR analysis → Fix application → PR creation - Test with real GitHub repo (test environment) - Fix bugs, handle edge cases - Performance testing (10+ file fixes)

Day 5: Database & Job Queue (8-10 hours) - Create fix_prs table schema - Migration script - Implement Inngest job (or BullMQ if preferred) - Job monitoring/retry logic - Tests: 8+ (job failures, retries, database)

Week 1 Deliverable: Core functionality works end-to-end (manual trigger via script/API call)

Week 2: API & Automation¶

Day 1: API Endpoint (6-8 hours) - Create /api/teams/[teamId]/create-fix-pr endpoint - Authentication (NextAuth session) - Authorization (user must be team member) - Quota check (based on plan) - Trigger Inngest job - Tests: 10+ (auth, permissions, quotas)

Day 2: Webhook Integration (8-10 hours) - Update /api/github/webhook to detect fix opportunities - Post comment on PR: "🔒 CodeSlick can auto-fix X issues. Click here to create fix PR" - Handle PR merge events (update fix_prs table) - Tests: 12+ (different webhook events)

Day 3: Error Handling & Edge Cases (6-8 hours) - Handle GitHub API rate limits (exponential backoff) - Handle fix validation failures (rollback) - Handle PR conflicts (base branch deleted, etc.) - User-friendly error messages - Tests: 10+ (all error scenarios)

Day 4: Quota Management (4-6 hours) - Define quotas per plan: - Free: 0 auto-fix PRs (manual fixes only) - Team (€99): 10 auto-fix PRs/month - Enterprise (€299): Unlimited - Implement quota tracking in database - Enforce quotas in API endpoint - Tests: 6+ (quota enforcement)

Day 5: Monitoring & Logging (4-6 hours) - Add telemetry (PostHog events: fix_pr_created, fix_pr_merged) - Add logging (Vercel logs, Inngest dashboard) - Create admin dashboard view (see all fix PRs) - Error alerting (email on job failures)

Week 2 Deliverable: API endpoint works, webhooks trigger automatically, quotas enforced

Week 3: UI & Polish¶

Day 1-2: Team Dashboard UI (10-12 hours) - Add "Auto-Fix PRs" section to team dashboard - Show recent fix PRs (table: status, files fixed, created date) - "Create Fix PR" button on PR list - Loading states, error states - Responsive design (mobile/tablet)

Day 3: PR Comment UI (6-8 hours) - Update comment-formatter.ts to include auto-fix CTA - Add "Create Fix PR" button in PR comment - Show progress updates ("Creating fix PR...") - Link to fix PR once created

Day 4: Settings & Preferences (6-8 hours) - Team settings: Enable/disable auto-fix PRs - Configure auto-fix behavior: - Manual trigger only (default) - Auto-create for critical/high only - Auto-create for all fixable issues - Save preferences to database

Day 5: Documentation & Launch (6-8 hours) - Write user documentation (/help/auto-fix-prs) - Create video walkthrough (Loom, 2-3 minutes) - Update landing page (add auto-fix PRs to features) - Beta tester email announcement - Social media posts (Twitter, LinkedIn)

Week 3 Deliverable: Feature complete, documented, ready for beta users

Success Metrics¶

User Adoption¶

% of teams that enable auto-fix PRs
Average auto-fix PRs created per team per month
Merge rate (% of fix PRs that get merged)

Value Delivered¶

Average time saved per fix PR (estimate 30-60 min manual work)
Total vulnerabilities fixed via auto-fix PRs
User testimonials/feedback on feature

Business Impact¶

Conversion rate (Free → Team plan) after using auto-fix
Enterprise customers requiring this feature
Social media mentions/shares

Target Metrics (First 3 Months): - 50% of teams enable auto-fix PRs - 80% merge rate (high approval rate = feature works well) - 5+ testimonials mentioning auto-fix as reason for upgrading

Pricing & Monetization¶

Option A: Premium Feature (Recommended)¶

Plan	Auto-Fix PRs/Month	Pricing
Free	0 (disabled)	€0
Team	10	€99/month
Enterprise	Unlimited	€299/month

Rationale: Drives upgrades, justifies €99/month price point.

Option B: Add-On Feature¶

Plan	Base	With Auto-Fix Add-On
Free	€0	€0 (not available)
Team	€99/month	€149/month (+€50)
Enterprise	€299/month	Included

Rationale: Flexibility for teams that want PR analysis but not auto-fix.

Recommended: Option A (simpler pricing, easier to explain)

Risks & Mitigation¶

Risk 1: Fixes Break Code (HIGH)¶

Scenario: Auto-fix introduces bug, user's tests fail, developer loses trust.

Probability: Medium (30-40%)

Mitigation: - Strict validation (syntax check, AST parsing) - Conservative fixes only (skip complex refactorings) - Clear PR description (explain what was changed) - Easy rollback (just close fix PR) - User control (disable auto-fix if they want)

Risk 2: GitHub API Rate Limits (MEDIUM)¶

Scenario: Creating PR requires ~10-20 API calls. Multiple fix PRs = quota exhaustion.

Probability: Low-Medium (20-30%)

Mitigation: - Cache GitHub API responses - Batch operations where possible - Monitor quota usage (alert when low) - Quota-aware scheduling (wait if quota low)

Risk 3: User Confusion (MEDIUM)¶

Scenario: User doesn't understand why CodeSlick created a PR, thinks it's spam.

Probability: Medium (30-40%)

Mitigation: - Clear PR title: "🔒 CodeSlick Auto-Fix: X security issues" - Detailed PR description (explain each fix) - Link to documentation - User control (opt-in, not opt-out)

Risk 4: Competitive Response (LOW)¶

Scenario: Snyk/CodeQL copies this feature after seeing CodeSlick succeed.

Probability: Low (10-20%)

Mitigation: Speed wins. Ship fast, get testimonials, dominate mind share before they react.

Competitive Analysis¶

Snyk Auto-Fix¶

What They Do: - Snyk detects vulnerable dependencies - Offers "Fix this vulnerability" button - Creates PR with updated package.json

Limitations: - Only works for dependencies (not code vulnerabilities) - Slow (takes 30-60s to create PR) - Clunky UI (buried in dashboard)

Your Advantage: - Fix code vulnerabilities (SQL injection, XSS, hardcoded secrets) - Fast (2-5s to create PR) - Seamless UX (button in PR comment)

GitHub Dependabot¶

What They Do: - Auto-updates dependencies - Creates PRs for security updates

Limitations: - Only dependencies (not code) - No custom fix logic - Part of GitHub (not standalone product)

Your Advantage: - Code-level fixes (broader scope) - AI-powered smart fixes - Works with any GitHub repo (not just Enterprise)

DeepSource Auto-Fix¶

What They Do: - Code quality analysis - Auto-fix for linting issues

Limitations: - Focus on code quality (not security) - Requires CI/CD integration - Expensive (€45/user/month)

Your Advantage: - Security-first (OWASP, CVSS scores) - No CI/CD required (GitHub App only) - Cheaper (€99/team vs. €45/user × 5 = €225)

Verdict: You have a real competitive advantage. No one does this well yet.

Requirements Summary¶

Infrastructure¶

✅ Existing: GitHub API client, analyzers, fix generators, validation
❌ New: Job queue (Inngest or BullMQ)
❌ New: Database table (fix_prs)
❌ New: API endpoint (/api/teams/:id/create-fix-pr)

Development¶

2-3 weeks (solo)
1,500-2,000 LOC
40-50 tests
6 new components

Costs¶

Inngest: €0 (free tier: 10K job runs/month)
Vercel: €20/month (existing)
GitHub API: €0 (included in GitHub App)
Total Additional Cost: €0/month 🎉

Dependencies¶

GitHub App permissions (need contents: write, pull_requests: write)
Inngest account (or BullMQ + Redis)
Existing fix utilities (pattern-fixer, security-fixer)

Decision Gate¶

Before Building: Validate with beta users.

Survey Questions (send to 5-10 beta users): 1. "Would you use a feature that automatically creates fix PRs?" 2. "How much time would this save you per week? (estimate in minutes)" 3. "Would this feature influence your decision to upgrade to Team plan?" 4. "What concerns do you have about automated fixes?" 5. "What would make you trust CodeSlick's auto-fixes?"

Decision Criteria: - 70%+ say "yes" to question 1 → Build it - <70% → Re-evaluate or build simplified version

Expected Result: 80-90% will say yes (it's an obvious win).

Next Steps¶

Now: Send survey to beta users (if available)
Week 1: Build core functionality (fix-applier, pr-creator, job queue)
Week 2: Build API + webhook integration
Week 3: Build UI + polish + documentation
Week 4: Soft launch to beta users, collect feedback, iterate

Estimated Launch Date: Early January 2026 (after Phase 5 beta completes)

Last Updated: November 12, 2025 Status: Ready to Build (awaiting beta user validation) Priority: HIGH (Strategic differentiator) Estimated ROI: 10x (feature will drive conversions and viral growth)