Fix repository regression findings#913
Conversation
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (50)
🔥 Files not summarized due to errors (1)
📝 WalkthroughWalkthroughThis PR adds synchronized Therapy Compass indexes and route-aware loading, improves factsheet persistence and reading-level output, propagates cancellation through search and RAG flows, preserves semantic reranking signals, updates PDF extraction safeguards, classifies authentication failures, and revises CI/offline verification workflows. ChangesTherapy Compass, factsheets, and generated data
Request cancellation and API contracts
Semantic ranking and authentication
PDF extraction and CI prerequisites
Verification and audit workflows
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
#codex please can you resolve the gitguardian security check safely for me and also the failing CI test please. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1014cf8010
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
|
gitguardian Bot 🔎 Detected hardcoded secret in your pull request @codex please resolve this for me. |
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #3531 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1014cf8010
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Summary
Testing
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3bf3f44a28
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3bf3f44 to
f4b26e2
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f4b26e2c83
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (1)
src/components/therapy-compass/bindings.tsx (1)
261-267: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDuplicate "first capable therapy" lookup.
defaultTherapy(brief/sheets branches) andgoBrief/goSheets's fallback both independently runtherapies.find((t) => t.briefInterventionAvailable)/...patientSheetAvailable. Consider extracting small helpers to avoid drift between the two call sites.♻️ Suggested helper extraction
+ const firstBriefTherapy = () => therapies.find((therapy) => therapy.briefInterventionAvailable); + const firstSheetTherapy = () => therapies.find((therapy) => therapy.patientSheetAvailable); const defaultTherapy = screen === "brief" - ? therapies.find((therapy) => therapy.briefInterventionAvailable) + ? firstBriefTherapy() : screen === "sheets" - ? therapies.find((therapy) => therapy.patientSheetAvailable) + ? firstSheetTherapy() : therapies[0];Also applies to: 321-332
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/components/therapy-compass/bindings.tsx` around lines 261 - 267, Extract shared helpers for selecting the first therapy with brief intervention or patient sheet availability, then reuse those helpers in both the screen-based defaultTherapy selection and the goBrief/goSheets fallback paths. Preserve the existing fallback ordering and behavior while eliminating duplicate availability predicates.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@public/therapy-compass-data/therapies-index.json`:
- Around line 261-316: Remove the shorter legacy duplicate records for
Behavioural Activation, EMDR, IPT, MBCT, PST, and PE from the therapy index,
retaining one canonical entry per therapy with its specific therapy modality and
enriched metadata. Ensure modality-based filtering no longer encounters the old
“individual” or “group” copies, and preserve the canonical slugs and records.
In `@src/app/api/documents/`[id]/summarize/route.ts:
- Line 42: Update the summarize route around summarizeDocument to check
request.signal before the first document read and abort if already canceled,
then pass request.signal through both the document and chunk Supabase query
builders so disconnects stop all summary lookups as well as generation.
In `@src/lib/extractors/document.ts`:
- Around line 243-252: Configure the parser created by PDFParse to pass
maxImageSize from limits.maxRenderPixels into pdfjs.getDocument(), ensuring
embedded images are bounded before resolveEmbeddedImage() decodes them. Catch
the resulting over-limit error in the extraction flow and map it to
PDF_EXTRACTION_BUDGET_EXCEEDED, while preserving existing budget assertions; add
a fallback test covering an oversized embedded image.
In `@src/lib/semantic-rerank.ts`:
- Around line 291-306: Update the scoredBand mapping in semantic reranking so
every candidate carries its semanticRerankScore even when
candidate.result.score_explanation is absent. Initialize or preserve
score_explanation before assigning the score, ensuring answerEvidenceScore can
consume the signal for all valid candidates while retaining existing explanation
fields.
In `@src/lib/supabase/client.tsx`:
- Around line 182-188: Update the userResult.error branch to exclude retryable
fetch failures identified by isAuthRetryableFetchError, allowing them to reach
resolveInitialAuthState and preserve sessionResult.data.session through the
offline fallback. Keep the existing definitive-error handling unchanged.
In `@tests/offline-release-profile.test.ts`:
- Line 31: Update the SUPABASE_DB_URL assertion in the offline release profile
test to match the scanner-safe construction using .join(":") or assert the
evaluated runtime value, rather than searching for an expanded URL literal.
Preserve the existing implementation and ensure the test validates the actual
constructed value.
In `@tests/therapy-compass-artifact-navigation.dom.test.tsx`:
- Around line 107-109: Update the unavailable-action assertions in the therapy
compass navigation test to capture nav.pushes before triggering the actions,
then verify the pushes collection is unchanged afterward (and empty when
appropriate), rather than only excluding specific no-artifacts routes. Preserve
the existing action setup and use the nav.pushes symbol to ensure unavailable
actions cause no navigation to any destination.
---
Nitpick comments:
In `@src/components/therapy-compass/bindings.tsx`:
- Around line 261-267: Extract shared helpers for selecting the first therapy
with brief intervention or patient sheet availability, then reuse those helpers
in both the screen-based defaultTherapy selection and the goBrief/goSheets
fallback paths. Preserve the existing fallback ordering and behavior while
eliminating duplicate availability predicates.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: cfa99c4f-9746-42e6-b2ab-03dcfffef648
📒 Files selected for processing (50)
.github/workflows/ci.ymldocs/branch-review-ledger.mdpackage.jsonpublic/therapy-compass-data/therapies-index.jsonscripts/build-therapies-index.mjsscripts/ci-change-scope.mjsscripts/verify-release-offline.mjssrc/app/api/documents/[id]/route.tssrc/app/api/documents/[id]/summarize/route.tssrc/app/api/search/route.tssrc/components/factsheets/factsheet-detail-page.tsxsrc/components/factsheets/factsheets-data.tssrc/components/therapy-compass/bindings.tsxsrc/components/therapy-compass/data/use-therapy-data.tssrc/components/therapy-compass/screens/brief-screen.tsxsrc/components/therapy-compass/screens/pathways-screen.tsxsrc/components/therapy-compass/screens/recommend-screen.tsxsrc/components/therapy-compass/therapy-card.tsxsrc/data/therapies-index.jsonsrc/lib/answer-ranking.tssrc/lib/document-detail.tssrc/lib/document-enrichment.tssrc/lib/extractors/document.tssrc/lib/extractors/pdf-extraction-budget.tssrc/lib/openai.tssrc/lib/rag-versioning.tssrc/lib/rag.tssrc/lib/saved-registry-storage.tssrc/lib/search-scope.tssrc/lib/semantic-rerank.tssrc/lib/supabase/client.tsxsrc/lib/types.tstests/answer-ranking.test.tstests/api-validation-contract.test.tstests/embed-texts-integrity.test.tstests/factsheet-save.dom.test.tsxtests/factsheets-data.test.tstests/offline-release-profile.test.tstests/openai-cache.test.tstests/pdf-extraction-budget.test.tstests/pdf-extractor.test.tstests/private-access-routes.test.tstests/private-client-auth.test.tstests/rag-answer-fallback.test.tstests/rag-document-summary.test.tstests/semantic-rerank.test.tstests/therapy-compass-artifact-navigation.dom.test.tsxtests/therapy-compass-data-recovery.dom.test.tsxtests/therapy-compass-mode-wiring.test.tstests/ui-route-coverage.spec.ts
1 participant
Summary
Verification
Verification not run: provider-backed OpenAI retrieval/answer evaluations were not run because live provider access was outside this remediation workflow.
Risk and rollout
Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes
Summary by CodeRabbit