feat: Gemini Assistant and Code Execution Sandbox - #4
Merged
Conversation
… text extraction, and UI/UX polish
Contributor
|
Warning Review limit reached
More reviews will be available in 36 minutes and 36 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (49)
📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe PR bumps the version to 0.2.0 and removes old draft docs. It adds PDF text extraction and Python/SQL sandbox execution commands to the Tauri Rust backend, introduces a frontend code-execution plugin, extends Gemini streaming with grounding metadata and thought-signature support, fixes tool-name normalization and Gemini message roles, and reworks the chat UI with provider logos, collapsible tool-call views, grounding source display, and a copy button. Changesv0.2.0: Code Execution, PDF Reading, Gemini Grounding, and Chat UI
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src-tauri/src/lib.rs`:
- Around line 3855-3951: The execute_sql_blocking function has no timeout
mechanism for SQL statement execution, which can cause indefinite blocking on
long-running queries. Add a timeout/cancellation path by implementing a time
limit (using a deadline or timer) around the loop that iterates through
statements, and either interrupt the connection or break execution if the
timeout is exceeded. Consider using Rusqlite's interrupt functionality or
wrapping the execution in a timeout wrapper to ensure queries cannot run longer
than a specified maximum duration.
- Around line 3855-3951: The execute_sql_blocking function does not validate
against sandbox-escape SQL commands, allowing dangerous operations like ATTACH,
DETACH, and VACUUM INTO to bypass the sandbox boundary. Add validation logic in
the statement processing loop to block these commands before execution. After
trimming the statement and checking for empty content, add a check that
identifies and rejects any statements that start with these dangerous SQL
keywords by converting to uppercase and comparing, then appending an appropriate
error message to stderr and setting success to false before continuing to the
next statement.
- Around line 3724-3734: The code currently has a fallback execution path that
runs Python directly on the host when Docker is not available, which bypasses
the sandbox protection. Remove the non-Docker fallback code that checks
python3_exists and creates Command::new("python3") or Command::new("python")
directly. Instead, ensure that Python code execution only proceeds when Docker
is available and properly sandboxed. If Docker is not available, the function
should return an error or refuse to execute rather than falling back to
unsandboxed host execution.
In `@src/App.tsx`:
- Around line 318-324: The handleCopyMessage function calls
navigator.clipboard.writeText which returns a Promise, but the function does not
handle potential rejections from permission or context issues. Convert
handleCopyMessage to an async function and wrap the
navigator.clipboard.writeText call in a try-catch block to gracefully handle
clipboard write failures. In the catch block, you can optionally set an error
state or display a user-friendly error message to inform the user that the copy
operation failed, then ensure the copied state is still cleared after 2 seconds
as intended.
In `@src/components/GroundingMetadataView.tsx`:
- Around line 58-63: The anchor tag in GroundingMetadataView is binding the
untrusted web.uri directly to the href attribute, which creates a security
vulnerability allowing malicious javascript: or data: URI schemes to execute
when clicked. Before binding web.uri to the href attribute, validate that it
uses an allowlisted scheme such as http or https, and either sanitize the URI or
conditionally set the href only if the validation passes to prevent execution of
harmful URI schemes.
In `@src/components/ToolCallsView.tsx`:
- Around line 48-55: The read_file case in the switch statement declares the
fileBasename variable directly without a block scope, which violates the
noSwitchDeclarations rule and can cause variable scope issues. Wrap the entire
read_file case body (from the Icon assignment through the description
assignment) in curly braces to create a proper block scope for the fileBasename
variable declaration. This ensures the variable is properly scoped to the case
block and prevents any potential scope leakage.
In `@src/plugins/codeExecution.tsx`:
- Around line 212-233: The code detects prefixes by checking the lowercased
trimmed version of the input, but extracts the code using substring operations
on the original query, which may contain leading spaces. This causes the
extracted code to include unwanted whitespace or be offset incorrectly. Replace
all occurrences of query.substring(...) in this block with substring operations
on the trimmed query to ensure the extraction indices match the prefix detection
logic. This applies to all the prefix handling cases including python:, python,
sql:, sql, code:, code, and /code prefixes.
In `@src/utils/toolManager.ts`:
- Line 194: In the toolManager.ts file around line 194 where the role is being
set to "function", change this value to "user" instead. Gemini's generateContent
API does not support the "function" role for function responses and requires the
"user" role to properly handle tool-result turns. Locate the object assignment
containing role: "function" and update it to role: "user" to ensure function
responses are correctly processed by Gemini.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a51bdc90-e2ba-404c-9573-05e8d0ff73aa
⛔ Files ignored due to path filters (12)
package-lock.jsonis excluded by!**/package-lock.jsonsrc-tauri/Cargo.lockis excluded by!**/*.locksrc-tauri/icons/ios/AppIcon-20x20@2x-1.pngis excluded by!**/*.pngsrc-tauri/icons/ios/AppIcon-29x29@2x-1.pngis excluded by!**/*.pngsrc-tauri/icons/ios/AppIcon-40x40@1x.pngis excluded by!**/*.pngsrc-tauri/icons/ios/AppIcon-40x40@2x-1.pngis excluded by!**/*.pngsrc-tauri/icons/ios/AppIcon-40x40@3x.pngis excluded by!**/*.pngsrc/assets/gemini_logo.svgis excluded by!**/*.svgsrc/assets/react.svgis excluded by!**/*.svgwebsite/images/gquick_logo_blue.pngis excluded by!**/*.pngwebsite/images/gquick_logo_red.pngis excluded by!**/*.pngwebsite/images/hero_screenshot.pngis excluded by!**/*.png
📒 Files selected for processing (16)
docs/latest-updates/commit-message.mddocs/latest-updates/release-notes.mdpackage.jsonsrc-tauri/Cargo.tomlsrc-tauri/icons/icon.icnssrc-tauri/src/lib.rssrc-tauri/tauri.conf.jsonsrc/App.tsxsrc/assets/gpt-logo.webpsrc/components/GroundingMetadataView.tsxsrc/components/ToolCallsView.tsxsrc/plugins/codeExecution.tsxsrc/plugins/index.tssrc/plugins/types.tssrc/utils/streaming.tssrc/utils/toolManager.ts
💤 Files with no reviewable changes (2)
- docs/latest-updates/commit-message.md
- docs/latest-updates/release-notes.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request brings several key enhancements and features to GQuick, advancing the version to v0.2.0:
Interactive Code Execution Sandbox (codeExecution plugin):
AI Chat & Model Integration Improvements:
PDF Text Extraction:
UI/UX Polish: