fix(CODEWIKI-003-2): CU-86akbhhru 3 review findings in test_clustering_forced.py

[flamingo]

Closes 3 review findings in test_clustering_forced.py.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 45 low — review closely	API keys hardcoded via env-var defaults passed directly into Config constructor in test scripts	test_clustering_forced.py:21
2	🟡 75 medium	test_clustering_forced.py hardcodes a developer's local absolute filesystem path as the test repo	test_clustering_forced.py:19
3	🔴 30 low — review closely	Four near-identical clustering test scripts duplicate the same Config-construction and reporting logic	test_clustering_forced.py:21

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 2cc7a212-e9ac-481a-a76e-5f03d762c00c

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhru CodeWiki backend and CLI review findings (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff; 2 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🔴 API keys hardcoded via env-var defaults passed directly into Config constructor in test scripts

Replaced direct Config(cluster_api_key=..., main_api_key=..., fallback_api_key=..., ...) constructor call with Config.from_env(...) (no explicit API key args) in the top-level script body, relying on a factory classmethod to source keys (e.g. from keyring/env internally) instead of passing them as plain constructor arguments. This assumes Config.from_env exists and accepts the same non-key kwargs (repo_path, output_dir, model names, base URLs, max_token_per_module, cluster_max_tokens) — this could not be verified against codewiki/src/config.py since that file was not provided, so the fix may require adjusting the factory method name/signature to match the actual implementation, or adding such a factory if it does not yet exist. This is the primary risk in this change.

🤖 Prompt for AI agents

In test_clustering_forced.py around line 21, review and complete this code-review fix: API keys hardcoded via env-var defaults passed directly into Config constructor in test scripts.
What the draft fix changed: Replaced direct `Config(cluster_api_key=..., main_api_key=..., fallback_api_key=..., ...)` constructor call with `Config.from_env(...)` (no explicit API key args) in the top-level script body, relying on a factory classmethod to source keys (e.g. from keyring/env internally) instead of passing them as plain constructor arguments. This assumes `Config.from_env` exists and accepts the same non-key kwargs (repo_path, output_dir, model names, base URLs, max_token_per_module, cluster_max_tokens) — this could not be verified against `codewiki/src/config.py` since that file was not provided, so the fix may require adjusting the factory method name/signature to match the actual implementation, or adding such a factory if it does not yet exist. This is the primary risk in this change.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 45 low — review closely — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 test_clustering_forced.py hardcodes a developer's local absolute filesystem path as the test repo

Replaced hardcoded absolute path /Users/michaelassraf/Documents/GitHub/openframe-oss-tenant for test_repo (script body, top level) with a dynamic default derived from __file__ (parent of the script's directory), overridable via TEST_REPO_PATH env var, removing the developer-specific path while preserving configurability.

🤖 Prompt for AI agents

In test_clustering_forced.py around line 19, review and complete this code-review fix: test_clustering_forced.py hardcodes a developer's local absolute filesystem path as the test repo.
What the draft fix changed: Replaced hardcoded absolute path `/Users/michaelassraf/Documents/GitHub/openframe-oss-tenant` for `test_repo` (script body, top level) with a dynamic default derived from `__file__` (parent of the script's directory), overridable via `TEST_REPO_PATH` env var, removing the developer-specific path while preserving configurability.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 75 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 Four near-identical clustering test scripts duplicate the same Config-construction and reporting logic

No shared helper module was extracted in this file (out of scope: fixing this properly requires creating a new shared module e.g. test_clustering_common.py and modifying the three sibling files, which were not provided/in-scope per instructions to change only this file). As a partial, in-file mitigation, the Config construction was simplified by removing the duplicated API-key-sourcing boilerplate (now handled by Config.from_env), reducing the amount of duplicated logic per file, but the full duplication-removal (shared fixture/function across all four scripts) is NOT completed here and would require a follow-up change spanning all four files.

🤖 Prompt for AI agents

In test_clustering_forced.py around line 21, review and complete this code-review fix: Four near-identical clustering test scripts duplicate the same Config-construction and reporting logic.
What the draft fix changed: No shared helper module was extracted in this file (out of scope: fixing this properly requires creating a new shared module e.g. `test_clustering_common.py` and modifying the three sibling files, which were not provided/in-scope per instructions to change only this file). As a partial, in-file mitigation, the Config construction was simplified by removing the duplicated API-key-sourcing boilerplate (now handled by `Config.from_env`), reducing the amount of duplicated logic per file, but the full duplication-removal (shared fixture/function across all four scripts) is NOT completed here and would require a follow-up change spanning all four files.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 30 low — review closely — react 👍/👎 to teach the reviewer

[michaelassraf]

Blocking: Config.from_env does not exist.

config = Config.from_env(repo_path=test_repo, output_dir="/tmp/test", ...)

Config only has from_args(cls, args), from_cli(...), and from_config_manager(...). This is an AttributeError.

The PR also drops the three *_api_key kwargs on the assumption that from_env resolves them from the environment — nothing does that today.

The TEST_REPO_PATH env-var change is good and matches what landed in #53. If you keep direct Config(...) construction (as #53 does) and only change the hardcoded path, this can merge as-is.