han plugin install notetaker

claude plugin marketplace add thebushidocollective/han
claude plugin install notetaker@han

// AI-DEV-NOTE: This function uses a cache-first strategy because
// the data rarely changes and network calls were causing performance
// issues. See performance profiling in PR #123.

# AI-DEV-NOTE: The validation order matters here - we must check
# authentication before authorization to avoid leaking user existence.

// TODO(ai/performance): This O(n²) loop should be optimized.
// Profiling shows 45% of request time spent here when n > 100.
// Consider: hash map lookup or binary search after sorting.
// Impact: High - affects main user flow
// Effort: Medium - 2-3 hours estimated

// DECISION: Using Arc<RwLock<T>> instead of Mutex<T>
// RATIONALE: Read-heavy workload (95% reads, 5% writes) benefits
// from RwLock's concurrent read access. Benchmarks showed 3x throughput
// improvement with RwLock under typical load patterns.
// ALTERNATIVES_CONSIDERED:
//   - Mutex<T>: Simpler but slower for read-heavy workload
//   - atomic types: Not suitable for complex state
// DATE: 2025-12-04
// AUTHOR: Claude (AI Assistant)

/**
 * @ai-tech-debt
 * @category: Architecture
 * @severity: High
 * @effort: 2-3 days
 * @impact: Maintainability, Performance
 *
 * This service class has grown to 1500+ lines and violates Single
 * Responsibility Principle. Should be split into separate services.
 */

# @doc docs/architecture/authentication.md#oauth-flow
# @api-spec api/openapi.yaml#/components/securitySchemes/oauth2
# @decision-record docs/decisions/003-oauth-provider.md
#
# Implements the authentication flow described in architecture docs.

// AI-DEV-NOTE: Order validation must happen before inventory check
// to prevent race condition where items are reserved but invalid

# AI-DEV-NOTE: Using binary search instead of linear search because
# the dataset can exceed 10k items (profiling showed 300ms avg latency)

// TODO(ai/refactor): Extract duplicate validation into shared validator
// Files to update: api/users.ts, api/teams.ts, api/projects.ts
// Estimated effort: 1-2 hours

// AI-DEV-NOTE: Implements RFC 6749 OAuth 2.0 Authorization Framework
// https://tools.ietf.org/html/rfc6749#section-4.1

// AI-DEV-NOTE: This is important
// Bad - no context about WHY it's important

# AI-DEV-NOTE: This increments the counter by 1
count += 1  # Obvious from code

// TODO: Fix this
// Bad - no context on WHAT needs fixing or HOW

# Find all AI development notes
grep -r "AI-DEV-NOTE" src/

# Find all AI TODOs
grep -r "TODO(ai/" src/

# Find uncertain areas needing review
grep -r "AI-UNCERTAIN" src/

# Extract technical debt annotations
grep -r "@ai-tech-debt" src/

// AI-DEV-NOTE: This weird-looking workaround is necessary because Safari
// doesn't support the standard API (as of v17.2). Filed webkit bug:
// https://bugs.webkit.org/show_bug.cgi?id=123456
// Remove this when Safari support lands (check caniuse.com)

# @ai-tech-debt
# @severity: High
# @effort: 3-4 hours
# @impact: Maintainability
#
# This function has grown too complex. Should be split into:
# 1. Input validation (separate function)
# 2. Business logic (current function)
# 3. Output formatting (separate function)

/**
 * @ai-security
 * @risk-level: High
 * @cwe: CWE-89 (SQL Injection)
 *
 * Although input is validated with regex ^[a-zA-Z0-9_]+$,
 * parameterized queries would be safer. Migration to prepared
 * statements should be prioritized.
 */

// @ai-performance
// @complexity: O(n²)
// @bottleneck: true
// @profiling-data: 45% of request time when n > 100
//
// This nested loop should be optimized to O(n log n) using
// sort + binary search, or O(n) using a hash map approach.