docs: sync TODO/AUDIT with the 2026-07-28 local-AI fixes + Dependabot batch - #274
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 11 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe PR updates local AI provider status and endpoint discovery, replaces selected dynamic imports with static imports, applies checkout credential hardening across workflows, adjusts RTL toggle styling, and records v1.24.1 release changes. ChangesLocal-AI reliability
Workflow and release maintenance
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant AiProviderCard
participant scanLocalOpenAiCompatibleEndpoints
participant Ollama
User->>AiProviderCard: test local provider
AiProviderCard->>scanLocalOpenAiCompatibleEndpoints: scan endpoint
scanLocalOpenAiCompatibleEndpoints->>Ollama: request /api/tags
Ollama-->>scanLocalOpenAiCompatibleEndpoints: success or failure
scanLocalOpenAiCompatibleEndpoints->>Ollama: fallback request /v1/models
scanLocalOpenAiCompatibleEndpoints-->>AiProviderCard: status result
AiProviderCard-->>User: render provider status
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AUDIT.md`:
- Around line 22-23: The documented locale and module counts must be corrected
consistently. Update CLAUDE.md’s locale roster and per-locale module count from
17 to 19 and 20 to 21, then align the corresponding release-history claims in
AUDIT.md lines 22-23 and TODO.md line 60 with the committed CLAUDE.md contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
ed5afbf to
f29a8f7
Compare
|
@CodeAnt-AI review |
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 43-45: Update every actions/checkout step in
.github/workflows/ci.yml at lines 43-45, 101, 182, 270-271, 323-324, 360-361,
405-406, and 462-463 to set persist-credentials to false while preserving the
existing checkout options.
In @.github/workflows/codeql.yml:
- Line 30: Disable persisted checkout credentials by adding persist-credentials:
false to the checkout steps in .github/workflows/codeql.yml lines 30-30,
.github/workflows/docker.yml lines 26-26, .github/workflows/mutation.yml lines
66-66, .github/workflows/storybook-debug.yml lines 34-34,
.github/workflows/tauri-build.yml lines 37-37, and
.github/workflows/voice-nightly.yml lines 28-28; no authenticated Git operations
are required afterward.
In `@components/settings/AiProviderCard.tsx`:
- Around line 206-226: Add role="status" and aria-live="polite" to the status
badge span in the AiProviderCard component, preserving its existing text and
styling logic so screen readers announce changes to the provider status.
- Around line 226-228: Update the error presentation in AiProviderCard,
including the action row that renders testError, so all user-facing Ollama
errors are suppressed when ollamaUntestable is true and only sanitized UI-safe
messaging is shown; route raw transport or exception details to
services/logger.ts instead. Also make the test request completion logic ignore
stale async results so an older request cannot update testStatus or testError
after a newer state has made Ollama untestable.
In `@config/resolveViteBase.ts`:
- Line 6: 添加一行紧邻每处相关改动的 QNBS-v3 原因/影响/创意价值注释：在 config/resolveViteBase.ts
第6行说明提取并导出 Pages 基础路径；在 vite.config.ts 第7-12行说明共享 Tauri 构建标志；在
services/localServerHttp.ts 第10-15行说明日志初始化及新增失败分类；在
tests/unit/aiProviderService.test.ts 第716-760行说明原生优先与回退回归覆盖；在
tests/unit/settings/AiProviderCard.test.tsx 第161-189行说明浏览器与桌面状态覆盖。每条注释使用指定的 “//
QNBS-v3: [Grund / Impact / Kreativer Mehrwert]” 格式。
In `@services/aiProviderService.ts`:
- Around line 706-733: Standardize the QNBS-v3 annotations across all three
changed sites: add one adjacent single-line annotation for the Ollama
native-first logic in scanLocalOpenAiCompatibleEndpoints in
services/aiProviderService.ts (lines 706-733); collapse the existing multiline
annotation near AiProviderCard in components/settings/AiProviderCard.tsx (lines
43-47) into one line; and add an immediate JSX QNBS-v3 annotation beside the
changed badge rendering in components/settings/AiProviderCard.tsx (lines
206-226).
- Around line 706-733: Add the required single-line `// QNBS-v3: ...` annotation
immediately beside the changed `scanLocalOpenAiCompatibleEndpoints` logic,
adjacent to the existing JSDoc and implementation. Keep the annotation concise
and preserve the current Ollama native-first fallback behavior.
In `@services/CLAUDE.md`:
- Line 13: Update the LanguageTool documentation around languageToolService.ts
to remove the claim that network failures degrade silently to an empty result.
Document sanitized technical logging through services/logger.ts and a brief
actionable degraded state for users, while retaining silent handling only for
documented aborts; ensure the underlying async operation uses try/catch or a
Result type.
In `@services/ollamaService.ts`:
- Around line 165-170: Update the plugin_unavailable branch in the
connection-testing method to return a stable, safe localized status message
instead of exposing LocalServerError.message. Preserve the distinct failure
classification and, if existing conventions support it, include only the
normalized endpoint; rely on localServerHttp logging for detailed diagnostics.
In `@tests/unit/aiProviderService.test.ts`:
- Around line 731-747: Update the fallback URL assertion in the test for
scanLocalOpenAiCompatibleEndpoints to require the exact /v1/models path,
replacing the broader /models check while preserving the existing call-order and
success assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ee9a2d51-f419-448a-895a-1be21e49c03d
⛔ Files ignored due to path filters (2)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlsrc-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (73)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/docker.yml.github/workflows/mutation.yml.github/workflows/scorecard.yml.github/workflows/storybook-debug.yml.github/workflows/tauri-build.yml.github/workflows/voice-nightly.ymlAUDIT.mdCHANGELOG.mdCLAUDE.mdTODO.mdcomponents/CLAUDE.mdcomponents/settings/AiProviderCard.tsxconfig/resolveViteBase.tsdocs/adr/0012-local-server-connectivity-tauri-http.mdfeatures/lora/CLAUDE.mdfeatures/plotBoard/CLAUDE.mdlocales/ar/settings.jsonlocales/de/settings.jsonlocales/el/settings.jsonlocales/en/settings.jsonlocales/es/settings.jsonlocales/eu/settings.jsonlocales/fa/settings.jsonlocales/fi/settings.jsonlocales/fr/settings.jsonlocales/he/settings.jsonlocales/hu/settings.jsonlocales/is/settings.jsonlocales/it/settings.jsonlocales/ja/settings.jsonlocales/ko/settings.jsonlocales/pt/settings.jsonlocales/ru/settings.jsonlocales/sv/settings.jsonlocales/zh/settings.jsonpackage.jsonpublic/locales/ar/bundle.jsonpublic/locales/de/bundle.jsonpublic/locales/el/bundle.jsonpublic/locales/en/bundle.jsonpublic/locales/es/bundle.jsonpublic/locales/eu/bundle.jsonpublic/locales/fa/bundle.jsonpublic/locales/fi/bundle.jsonpublic/locales/fr/bundle.jsonpublic/locales/he/bundle.jsonpublic/locales/hu/bundle.jsonpublic/locales/is/bundle.jsonpublic/locales/it/bundle.jsonpublic/locales/ja/bundle.jsonpublic/locales/ko/bundle.jsonpublic/locales/pt/bundle.jsonpublic/locales/ru/bundle.jsonpublic/locales/sv/bundle.jsonpublic/locales/zh/bundle.jsonservices/CLAUDE.mdservices/aiProviderService.tsservices/cloudSync/CLAUDE.mdservices/copilot/CLAUDE.mdservices/localServerHttp.tsservices/ollamaService.tsservices/proForge/CLAUDE.mdservices/voice/CLAUDE.mdsrc-tauri/Cargo.tomltests/CLAUDE.mdtests/unit/aiProviderService.test.tstests/unit/localServerHttpPluginUnavailable.test.tstests/unit/ollamaService.test.tstests/unit/resolveViteBase.test.tstests/unit/settings/AiProviderCard.test.tsxvite.config.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- AUDIT.md
- TODO.md
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 43-45: Update every actions/checkout step in
.github/workflows/ci.yml at lines 43-45, 101, 182, 270-271, 323-324, 360-361,
405-406, and 462-463 to set persist-credentials to false while preserving the
existing checkout options.
In @.github/workflows/codeql.yml:
- Line 30: Disable persisted checkout credentials by adding persist-credentials:
false to the checkout steps in .github/workflows/codeql.yml lines 30-30,
.github/workflows/docker.yml lines 26-26, .github/workflows/mutation.yml lines
66-66, .github/workflows/storybook-debug.yml lines 34-34,
.github/workflows/tauri-build.yml lines 37-37, and
.github/workflows/voice-nightly.yml lines 28-28; no authenticated Git operations
are required afterward.
In `@components/settings/AiProviderCard.tsx`:
- Around line 206-226: Add role="status" and aria-live="polite" to the status
badge span in the AiProviderCard component, preserving its existing text and
styling logic so screen readers announce changes to the provider status.
- Around line 226-228: Update the error presentation in AiProviderCard,
including the action row that renders testError, so all user-facing Ollama
errors are suppressed when ollamaUntestable is true and only sanitized UI-safe
messaging is shown; route raw transport or exception details to
services/logger.ts instead. Also make the test request completion logic ignore
stale async results so an older request cannot update testStatus or testError
after a newer state has made Ollama untestable.
In `@config/resolveViteBase.ts`:
- Line 6: 添加一行紧邻每处相关改动的 QNBS-v3 原因/影响/创意价值注释：在 config/resolveViteBase.ts
第6行说明提取并导出 Pages 基础路径；在 vite.config.ts 第7-12行说明共享 Tauri 构建标志；在
services/localServerHttp.ts 第10-15行说明日志初始化及新增失败分类；在
tests/unit/aiProviderService.test.ts 第716-760行说明原生优先与回退回归覆盖；在
tests/unit/settings/AiProviderCard.test.tsx 第161-189行说明浏览器与桌面状态覆盖。每条注释使用指定的 “//
QNBS-v3: [Grund / Impact / Kreativer Mehrwert]” 格式。
In `@services/aiProviderService.ts`:
- Around line 706-733: Standardize the QNBS-v3 annotations across all three
changed sites: add one adjacent single-line annotation for the Ollama
native-first logic in scanLocalOpenAiCompatibleEndpoints in
services/aiProviderService.ts (lines 706-733); collapse the existing multiline
annotation near AiProviderCard in components/settings/AiProviderCard.tsx (lines
43-47) into one line; and add an immediate JSX QNBS-v3 annotation beside the
changed badge rendering in components/settings/AiProviderCard.tsx (lines
206-226).
- Around line 706-733: Add the required single-line `// QNBS-v3: ...` annotation
immediately beside the changed `scanLocalOpenAiCompatibleEndpoints` logic,
adjacent to the existing JSDoc and implementation. Keep the annotation concise
and preserve the current Ollama native-first fallback behavior.
In `@services/CLAUDE.md`:
- Line 13: Update the LanguageTool documentation around languageToolService.ts
to remove the claim that network failures degrade silently to an empty result.
Document sanitized technical logging through services/logger.ts and a brief
actionable degraded state for users, while retaining silent handling only for
documented aborts; ensure the underlying async operation uses try/catch or a
Result type.
In `@services/ollamaService.ts`:
- Around line 165-170: Update the plugin_unavailable branch in the
connection-testing method to return a stable, safe localized status message
instead of exposing LocalServerError.message. Preserve the distinct failure
classification and, if existing conventions support it, include only the
normalized endpoint; rely on localServerHttp logging for detailed diagnostics.
In `@tests/unit/aiProviderService.test.ts`:
- Around line 731-747: Update the fallback URL assertion in the test for
scanLocalOpenAiCompatibleEndpoints to require the exact /v1/models path,
replacing the broader /models check while preserving the existing call-order and
success assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ee9a2d51-f419-448a-895a-1be21e49c03d
⛔ Files ignored due to path filters (2)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlsrc-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (73)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/docker.yml.github/workflows/mutation.yml.github/workflows/scorecard.yml.github/workflows/storybook-debug.yml.github/workflows/tauri-build.yml.github/workflows/voice-nightly.ymlAUDIT.mdCHANGELOG.mdCLAUDE.mdTODO.mdcomponents/CLAUDE.mdcomponents/settings/AiProviderCard.tsxconfig/resolveViteBase.tsdocs/adr/0012-local-server-connectivity-tauri-http.mdfeatures/lora/CLAUDE.mdfeatures/plotBoard/CLAUDE.mdlocales/ar/settings.jsonlocales/de/settings.jsonlocales/el/settings.jsonlocales/en/settings.jsonlocales/es/settings.jsonlocales/eu/settings.jsonlocales/fa/settings.jsonlocales/fi/settings.jsonlocales/fr/settings.jsonlocales/he/settings.jsonlocales/hu/settings.jsonlocales/is/settings.jsonlocales/it/settings.jsonlocales/ja/settings.jsonlocales/ko/settings.jsonlocales/pt/settings.jsonlocales/ru/settings.jsonlocales/sv/settings.jsonlocales/zh/settings.jsonpackage.jsonpublic/locales/ar/bundle.jsonpublic/locales/de/bundle.jsonpublic/locales/el/bundle.jsonpublic/locales/en/bundle.jsonpublic/locales/es/bundle.jsonpublic/locales/eu/bundle.jsonpublic/locales/fa/bundle.jsonpublic/locales/fi/bundle.jsonpublic/locales/fr/bundle.jsonpublic/locales/he/bundle.jsonpublic/locales/hu/bundle.jsonpublic/locales/is/bundle.jsonpublic/locales/it/bundle.jsonpublic/locales/ja/bundle.jsonpublic/locales/ko/bundle.jsonpublic/locales/pt/bundle.jsonpublic/locales/ru/bundle.jsonpublic/locales/sv/bundle.jsonpublic/locales/zh/bundle.jsonservices/CLAUDE.mdservices/aiProviderService.tsservices/cloudSync/CLAUDE.mdservices/copilot/CLAUDE.mdservices/localServerHttp.tsservices/ollamaService.tsservices/proForge/CLAUDE.mdservices/voice/CLAUDE.mdsrc-tauri/Cargo.tomltests/CLAUDE.mdtests/unit/aiProviderService.test.tstests/unit/localServerHttpPluginUnavailable.test.tstests/unit/ollamaService.test.tstests/unit/resolveViteBase.test.tstests/unit/settings/AiProviderCard.test.tsxvite.config.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- AUDIT.md
- TODO.md
🛑 Comments failed to post (7)
components/settings/AiProviderCard.tsx (2)
206-226: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Expose the status badge as an announced status.
This text changes between ready, connected, disconnected, and browser-unavailable states but is rendered as a plain
span. Addrole="status"andaria-live="polite"so screen readers receive the update.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@components/settings/AiProviderCard.tsx` around lines 206 - 226, Add role="status" and aria-live="polite" to the status badge span in the AiProviderCard component, preserving its existing text and styling logic so screen readers announce changes to the provider status.Source: Coding guidelines
226-228: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Information Disclosure (CWE-209): Generation of Error Message Containing Sensitive Information
Gate every error presentation for browser-unavailable Ollama.
This guard suppresses only the error paragraph here; the action row at Lines 598-602 still renders
testError. A stale async completion can therefore expose raw transport text whileollamaUntestableis true. Apply the same guard to both paths and ignore stale request completions.Based on learnings, raw transport or exception text must not be exposed in user-facing UI; diagnostics belong in
services/logger.ts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@components/settings/AiProviderCard.tsx` around lines 226 - 228, Update the error presentation in AiProviderCard, including the action row that renders testError, so all user-facing Ollama errors are suppressed when ollamaUntestable is true and only sanitized UI-safe messaging is shown; route raw transport or exception details to services/logger.ts instead. Also make the test request completion logic ignore stale async results so an older request cannot update testStatus or testError after a newer state has made Ollama untestable.Source: Learnings
config/resolveViteBase.ts (1)
6-6: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add the required immediate
QNBS-v3rationale comments.
config/resolveViteBase.ts#L6-L6: add a one-line QNBS-v3 comment for extracting and exporting the Pages base constant.vite.config.ts#L7-L12: add a one-line QNBS-v3 comment for deriving the shared Tauri-build flag.services/localServerHttp.ts#L10-L15: add a one-line QNBS-v3 comment for logger initialization and the new failure classification.tests/unit/aiProviderService.test.ts#L716-L760: add a QNBS-v3 comment above the new native-first/fallback regression coverage.tests/unit/settings/AiProviderCard.test.tsx#L161-L189: add a QNBS-v3 comment above the browser-versus-desktop status coverage.As per coding guidelines, “Bei jeder inhaltlich relevanten Änderung in TypeScript- oder JavaScript-Dateien einen einzeiligen Kommentar im Format
// QNBS-v3: [Grund / Impact / Kreativer Mehrwert]unmittelbar bei der Änderung ergänzen.”📍 Affects 5 files
config/resolveViteBase.ts#L6-L6(this comment)vite.config.ts#L7-L12services/localServerHttp.ts#L10-L15tests/unit/aiProviderService.test.ts#L716-L760tests/unit/settings/AiProviderCard.test.tsx#L161-L189🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@config/resolveViteBase.ts` at line 6, 添加一行紧邻每处相关改动的 QNBS-v3 原因/影响/创意价值注释：在 config/resolveViteBase.ts 第6行说明提取并导出 Pages 基础路径；在 vite.config.ts 第7-12行说明共享 Tauri 构建标志；在 services/localServerHttp.ts 第10-15行说明日志初始化及新增失败分类；在 tests/unit/aiProviderService.test.ts 第716-760行说明原生优先与回退回归覆盖；在 tests/unit/settings/AiProviderCard.test.tsx 第161-189行说明浏览器与桌面状态覆盖。每条注释使用指定的 “// QNBS-v3: [Grund / Impact / Kreativer Mehrwert]” 格式。Source: Coding guidelines
services/aiProviderService.ts (1)
706-733: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Standardize the required QNBS-v3 annotations.
The changed TypeScript/TSX sites do not consistently use the mandated adjacent single-line QNBS-v3 comment.
services/aiProviderService.ts#L706-L733: add one single-line annotation beside the Ollama native-first scan change.components/settings/AiProviderCard.tsx#L43-L47: collapse the multiline annotation into one line.components/settings/AiProviderCard.tsx#L206-L226: add an immediate JSX QNBS-v3 annotation for the changed badge rendering.📍 Affects 2 files
services/aiProviderService.ts#L706-L733(this comment)components/settings/AiProviderCard.tsx#L43-L47components/settings/AiProviderCard.tsx#L206-L226🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/aiProviderService.ts` around lines 706 - 733, Standardize the QNBS-v3 annotations across all three changed sites: add one adjacent single-line annotation for the Ollama native-first logic in scanLocalOpenAiCompatibleEndpoints in services/aiProviderService.ts (lines 706-733); collapse the existing multiline annotation near AiProviderCard in components/settings/AiProviderCard.tsx (lines 43-47) into one line; and add an immediate JSX QNBS-v3 annotation beside the changed badge rendering in components/settings/AiProviderCard.tsx (lines 206-226).Source: Coding guidelines
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add the required single-line QNBS-v3 annotation.
This non-trivial TypeScript change uses a JSDoc block but lacks the required
// QNBS-v3: ...comment immediately beside the change.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/aiProviderService.ts` around lines 706 - 733, Add the required single-line `// QNBS-v3: ...` annotation immediately beside the changed `scanLocalOpenAiCompatibleEndpoints` logic, adjacent to the existing JSDoc and implementation. Keep the annotation concise and preserve the current Ollama native-first fallback behavior.Source: Coding guidelines
services/CLAUDE.md (1)
13-13: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not document network failures as silently swallowed.
Line 13 says LanguageTool returns an empty result silently on network failure, conflicting with the repository rule requiring async failures to be handled and not silently swallowed. Log only sanitized technical details through
services/logger.tsand expose a brief actionable degraded state; reserve silent handling for documented aborts.As per coding guidelines, async operations must use
try/catchor a Result type, and silent swallowing is prohibited except for documented aborts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/CLAUDE.md` at line 13, Update the LanguageTool documentation around languageToolService.ts to remove the claim that network failures degrade silently to an empty result. Document sanitized technical logging through services/logger.ts and a brief actionable degraded state for users, while retaining silent handling only for documented aborts; ensure the underlying async operation uses try/catch or a Result type.Source: Coding guidelines
services/ollamaService.ts (1)
165-170: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not forward the plugin error message to the UI.
LocalServerErroris public and can carry arbitrary text; return a stable, safe status message (optionally with the normalized endpoint) instead oferror.message. Detailed diagnostics are already logged bylocalServerHttp.Based on learnings, connection testing must return only safe localization context rather than raw transport or exception messages.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/ollamaService.ts` around lines 165 - 170, Update the plugin_unavailable branch in the connection-testing method to return a stable, safe localized status message instead of exposing LocalServerError.message. Preserve the distinct failure classification and, if existing conventions support it, include only the normalized endpoint; rely on localServerHttp logging for detailed diagnostics.Sources: Coding guidelines, Learnings
tests/unit/aiProviderService.test.ts (1)
731-747: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the exact OpenAI-compatible fallback path.
The test name promises
/v1/models, buttoContain('/models')also accepts an incorrect/modelsendpoint. Assert/v1/modelsso this regression test enforces the documented compatibility contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/unit/aiProviderService.test.ts` around lines 731 - 747, Update the fallback URL assertion in the test for scanLocalOpenAiCompatibleEndpoints to require the exact /v1/models path, replacing the broader /models check while preserving the existing call-order and success assertions.
9c4a3c5 to
c00bce6
Compare
f29a8f7 to
6af5b9b
Compare
… batch Light-touch update reflecting today's session: the two remaining #266 fixes (desktop discovery build-config bug, browser status badge reconciliation), the 13-of-18 Dependabot merge outcome with the 5 documented real blockers left open, and the Issue #60 status comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
6af5b9b to
1f55a08
Compare
…(CWE-522) None of the affected jobs push or commit after cloning, so persisting the GITHUB_TOKEN via actions/checkout was unnecessary attack surface flagged by zizmor/CodeRabbit. Sets persist-credentials: false on all 14 checkout steps in ci.yml, codeql.yml, docker.yml, mutation.yml, storybook-debug.yml, tauri-build.yml, and voice-nightly.yml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…imports ToggleSwitch used a malformed [dir:ltr]/[dir:rtl] arbitrary variant that compiled to the invalid CSS pseudo-class :is(dir:ltr), producing a lightningcss warning on every production build. Replaced with Tailwind's built-in ltr:/rtl: direction variants, which correctly target the dir attribute App.tsx already sets on <html>. Also converts 3 dynamic import() calls (transientUiStore, ecoModeService, spotlightTour) to static imports: Rolldown flagged all three as unable to move their module into a separate chunk since each is also statically imported elsewhere in the eager bundle, making the dynamic import dead weight with no code-splitting benefit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
CodeRabbit's re-review hit a GitHub API error posting inline comments and fell back to review-body text for 10 findings; the 2 that did post (persist-credentials) were already fixed. This addresses the 5 remaining real findings among the 7 that never became formal review threads: - AiProviderCard: status badge lacked role="status"/aria-live="polite" for a value that changes between ready/connected/disconnected/browser- unavailable states. - AiProviderCard (CWE-209): a stale in-flight connection-test result could overwrite testError after switching to Ollama-in-browser, since handleTest had no guard against a superseded request completing late. Added a monotonic request-id ref checked before every state update, invalidated whenever the provider/desktop context changes. Also gated the manual-test action row's error span with the same !ollamaUntestable check the paragraph above it already used, so a stale error can't render there either. - ollamaService.ts (CWE-209): the plugin_unavailable branch returned LocalServerError.message directly -- a public class whose message isn't guaranteed safe for every kind -- instead of building its own fixed string like the timeout/unreachable branches already do. - aiProviderService.test.ts: tightened a scan-fallback assertion from a loose '/models' substring to the exact '/v1/models' path. The remaining 2 findings (missing QNBS-v3 rationale comments on several already-commented files; services/CLAUDE.md's LanguageTool wording) were verified already covered by existing file-level comments or already fixed in an earlier commit -- not re-applied to avoid redundant/stale docs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Addressing CodeRabbit's 10-finding re-review — GitHub's API failed to post inline comments for most of them ( Already fixed (2, posted inline successfully): missing Fixed just now (5, from the review-body text that failed to post inline) — commit 1323629:
Verified already resolved (1): Not applied (2, judged already adequately covered): missing standalone Also fixed 2 unrelated real All targeted tests + full lint + typecheck pass locally; fresh CI running on these commits now. |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/tauri-build.yml (1)
147-147: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPrefer the runner’s
gh releaseover a redundant third-party action.
ghis already used in the following step; usinggh release createhere too would remove an unnecessary action and keep release creation/upload in one authenticated path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tauri-build.yml at line 147, Replace the softprops/action-gh-release step with the runner’s existing gh-based release flow, using gh release create to create the release and upload its assets through the same authenticated path. Preserve the current release metadata and asset behavior while removing the third-party action.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app/listenerMiddleware.ts`:
- Around line 570-571: Before each affected change, add a JSX comment marker in
the required bracketed QNBS-v3 format, using SettingsShared.tsx syntax:
app/listenerMiddleware.ts lines 570-571 for direct transient-store access, 6 for
the static eco-mode import, 22 for the static transient-store import, and
597-598 by replacing the existing nonconforming rationale;
services/commands/commandDefinitions.tsx lines 8 and 636 for the static
spotlight-tour import and synchronous command call; and
components/settings/SettingsShared.tsx line 66 immediately above the changed
span.
---
Nitpick comments:
In @.github/workflows/tauri-build.yml:
- Line 147: Replace the softprops/action-gh-release step with the runner’s
existing gh-based release flow, using gh release create to create the release
and upload its assets through the same authenticated path. Preserve the current
release metadata and asset behavior while removing the third-party action.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5b011b12-d3f5-4460-a53c-5214ea58cd30
📒 Files selected for processing (17)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/docker.yml.github/workflows/mutation.yml.github/workflows/storybook-debug.yml.github/workflows/tauri-build.yml.github/workflows/voice-nightly.ymlAUDIT.mdCHANGELOG.mdTODO.mdapp/listenerMiddleware.tscomponents/settings/AiProviderCard.tsxcomponents/settings/SettingsShared.tsxservices/commands/commandDefinitions.tsxservices/ollamaService.tstests/unit/aiProviderService.test.tstests/unit/ollamaService.test.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- services/ollamaService.ts
- tests/unit/ollamaService.test.ts
- components/settings/AiProviderCard.tsx
- AUDIT.md
- tests/unit/aiProviderService.test.ts
…fixes CodeRabbit's re-review correctly flagged the previous commit's changes (ac48b4d) as missing the repo's required single-line rationale comment on non-trivial changes. Adds one at each real change site explaining why the dynamic import was ineffective and safe to convert to static. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
One nitpick from the latest re-review, deliberately not applied now: |
Adds targeted coverage for the 3 lines Codecov flagged as uncovered: - commandDefinitions.test.ts: invokes help-tour's run() and asserts startSpotlightTour is called, covering the static-import call site. - listenerMiddleware.test.ts: exercises the binder-node pin reconciliation listener end-to-end (clears a stale pin when its node is removed, leaves it untouched when the node still exists) -- previously untested even before this session's dynamic-to-static import change. - AiProviderCard.test.tsx: a dedicated regression test for the CWE-209 stale-request guard -- queues connection-test resolvers, switches to Ollama-in-browser mid-flight, and asserts a late-resolving stale result never surfaces once the newer context supersedes it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Summary
Light-touch doc sync (per this repo's own convention: CHANGELOG/TODO/AUDIT updated in the same session's PRs, not a wholesale rewrite) reflecting today's work:
No code changes —
TODO.mdandAUDIT.mdonly.Test plan
pnpm run lint— clean🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Security