Global mutable state creates implicit coupling and race conditions

[sgardoll]

Summary

6 global let variables for API keys, a global pipelineState object, walkthroughStep, pendingCommitData, and 30+ window.* function exports create a web of implicit coupling where any function can read/write any state at any time.

Risk Assessment

• Risk Level: Medium
• Likelihood: High
• Impact: Medium — debugging difficulty, race conditions between pipeline and refinement

Affected State

Variable	Line	Risk
geminiApiKey, anthropicApiKey, openaiApiKey, openRouterApiKey, flutterflowApiKey, flutterflowProjectId	463-468	Any function can overwrite silently
pipelineState	969	Race conditions between pipeline and refinement
walkthroughStep	506	Minor
pendingCommitData	4297	Shared between async flows
30+ window.* exports	4551-4593	Everything globally callable, including from devtools

Suggested Fix

1. Encapsulate API key state in a module with getter/setter pattern
2. Make pipelineState a class with controlled mutations
3. Use Object.freeze() for read-only config
4. Replace window.* exports with event delegation or ES module imports