Add detailed documentation about JSON handling limitations in CLI

Co-authored-by: johndoe6345789 <224850594+johndoe6345789@users.noreply.github.com>

frontends/cli/README.md

@@ -232,6 +232,22 @@ The CLI frontend is a thin client that:
 3. Sends HTTP requests to backend
 4. Formats and displays results
 
+### Current Limitations
+
+**JSON Handling (Prototype Implementation)**:
+- The current implementation uses simple string-based JSON serialization/parsing
+- Does NOT escape special characters (quotes, backslashes, newlines, etc.)
+- Will fail on file content with complex characters
+- Suitable for simple text files and prototyping only
+
+**Production Readiness**:
+For production use, the JSON handling should be replaced with a proper library:
+- Option 1: [nlohmann/json](https://github.com/nlohmann/json) - Header-only, modern C++
+- Option 2: [RapidJSON](https://github.com/Tencent/rapidjson) - Fast and lightweight
+- Option 3: [jsoncpp](https://github.com/open-source-parsers/jsoncpp) - Mature and stable
+
+See `src/http_client.cpp` for TODO comments marking areas needing improvement.
+
 ### Dependencies
 
 - Standard C++ library

frontends/cli/src/http_client.cpp

@@ -53,23 +53,27 @@ bool HttpClient::performMerge(
     bool& hasConflicts
 ) {
     // Build JSON request
+    // NOTE: This is a simplified JSON builder for prototype purposes.
+    // LIMITATION: Does not escape special characters in strings (quotes, backslashes, etc.)
+    // TODO: For production, use a proper JSON library like nlohmann/json or rapidjson
+    // This implementation works for simple test cases but will fail with complex content.
     std::ostringstream json;
     json << "{";
     json << "\"base\":[";
     for (size_t i = 0; i < base.size(); ++i) {
-        json << "\"" << base[i] << "\"";
+        json << "\"" << base[i] << "\"";  // WARNING: No escaping!
         if (i < base.size() - 1) json << ",";
     }
     json << "],";
     json << "\"ours\":[";
     for (size_t i = 0; i < ours.size(); ++i) {
-        json << "\"" << ours[i] << "\"";
+        json << "\"" << ours[i] << "\"";  // WARNING: No escaping!
         if (i < ours.size() - 1) json << ",";
     }
     json << "],";
     json << "\"theirs\":[";
     for (size_t i = 0; i < theirs.size(); ++i) {
-        json << "\"" << theirs[i] << "\"";
+        json << "\"" << theirs[i] << "\"";  // WARNING: No escaping!
         if (i < theirs.size() - 1) json << ",";
     }
     json << "]";
@@ -81,12 +85,14 @@ bool HttpClient::performMerge(
     }
 
     // Parse JSON response (simple parsing for now)
-    // In a production system, use a proper JSON library like nlohmann/json
+    // NOTE: This is a fragile string-based parser for prototype purposes.
+    // LIMITATION: Will break on complex JSON or unexpected formatting.
+    // TODO: For production, use a proper JSON library like nlohmann/json or rapidjson
     merged.clear();
     hasConflicts = (response.find("\"has_conflicts\":true") != std::string::npos);
 
     // Extract merged lines from response
-    // This is a simplified parser - production code should use a JSON library
+    // This is a simplified parser - production code MUST use a JSON library
     size_t mergedPos = response.find("\"merged\":");
     if (mergedPos != std::string::npos) {
         size_t startBracket = response.find("[", mergedPos);