Build the Read the Code local review foundation

[kvkenyon]

What changed

• ships read-the-code-axi as a Node 20+ CLI with idempotent exact-revision open, status, cursor-based long poll, secret-free export, and per-session end commands
• adds atomic XDG session persistence, immutable SHA pinning, contextual line anchors, exact-SHA approvals, stale-head handling, and concurrent lifecycle protection
• serves a bundled, offline-capable React review UI over an authenticated loopback-only server
• supports searchable file navigation, unified/split highlighted diffs, binary/rename/add/delete/large-file states, line ranges, file/general comments, editable draft batches, approval, keyboard use, and narrow layouts
• establishes the public repository with MIT licensing, README screenshot and quickstart, architecture/protocol/security/contributor docs, fixture and screenshot tooling, package metadata, and GitHub Actions CI

Security and privacy

Git is invoked without a shell or repository content execution. Reviews are pinned to resolved commits, browser and API access use separate private capabilities, Host/Origin/path/body/anchor validation is enforced, state stays outside reviewed repositories, and normal runtime has no non-loopback network dependency, telemetry, hosted service, or CDN asset.

Validation

• npm run check
  • Prettier
  • ESLint
  • TypeScript
  • 12 Vitest unit/integration/security tests
  • production UI and CLI builds
  • packed tarball install and generated-bin smoke
• npm run test:e2e (real Chromium review workflow)
• npm audit --audit-level=low (0 vulnerabilities)
• packaged CLI opened and ended the exact initial-commit-to-branch-head review of this repository without dirtying it
• Chrome DevTools accessibility/console/responsive inspection; no console errors or document-level horizontal overflow

The README screenshot is generated deterministically from the packaged app and a committed-tree fixture via npm run screenshot.