chore(web): UVAI Phase 1 SEO, a11y, and missing assets - #202
Conversation
github-actions
Bot
added
documentation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (52)
Disabled knowledge base sources:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR introduces SEO and accessibility infrastructure for the web app: static PWA and crawl assets, production-domain metadata and JSON-LD in the root layout, a sitemap route, landing accessibility and focus-style improvements, broad marketing page refactors, backend hardening, and many new/updated tests and CI workflow tweaks. ChangesUVAI Phase 1: SEO, a11y, static assets
Estimated code review effort 🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances the UVAI web application's SEO, accessibility, and static asset management. Key implementations include a sitemap generator, JSON-LD structured data, a PWA manifest, and a skip-to-main-content link. Accessibility improvements feature ARIA labels, focus-visible styles, and reduced-motion support. Reviewers identified a violation of the security policy concerning the use of dangerouslySetInnerHTML and recommended centralizing hardcoded values, such as the base URL and brand colors, to improve maintainability.
| <body className="min-h-screen bg-void font-sans antialiased"> | ||
| <script | ||
| type="application/ld+json" | ||
| dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }} |
There was a problem hiding this comment.
The use of dangerouslySetInnerHTML violates the repository security policy. While this is a standard pattern for injecting JSON-LD in Next.js, the policy explicitly forbids it. Consider if this can be implemented using a safer alternative or if a policy exception is required for static structured data.
References
- The Repository Style Guide explicitly states 'no dangerouslySetInnerHTML' under the Security section (line 120). (link)
| creator: 'UVAI', | ||
| publisher: 'UVAI', | ||
| metadataBase: new URL('https://v0-uvai.vercel.app'), | ||
| metadataBase: new URL('https://uvai.io'), |
There was a problem hiding this comment.
The base URL https://uvai.io is hardcoded in multiple locations (e.g., here and in apps/web/src/app/sitemap.ts). To prevent configuration drift and improve maintainability, consider centralizing this value in a shared constant or an environment variable.
| <div className="flex justify-between items-center px-8 py-5 max-w-[1440px] mx-auto"> | ||
| {/* Logo */} | ||
| <Link href="/" className="flex items-center gap-2.5 group"> | ||
| <Link href="/" className="flex items-center gap-2.5 group focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[#6af2de] rounded-lg" aria-label="UVAI home"> |
There was a problem hiding this comment.
The brand color #6af2de is hardcoded in multiple Tailwind classes across the project (e.g., lines 39, 58, 72, 81). For better maintainability and consistency, consider defining this color in your tailwind.config.js and using a named class (e.g., focus-visible:outline-brand).
🔴 E2E Test Results: FAILURE DETECTED
Test Output |
There was a problem hiding this comment.
Pull request overview
Phase 1 web-only fixes to address uvai.io SEO/a11y drift and restore missing static assets referenced by the Next.js app, without touching backend/workflows/deploy config.
Changes:
- Added missing public assets (icons, OG image, manifest, robots) and updated metadata to use canonical
https://uvai.io. - Added a Next.js metadata sitemap route (
/sitemap.xml). - Improved accessibility (skip link, aria labels, focus-visible rings, reduced-motion handling).
Reviewed changes
Copilot reviewed 8 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
CHANGELOG.md |
Documents the Phase 1 SEO/a11y/static-asset corrections and known follow-ups. |
apps/web/src/app/layout.tsx |
Updates canonical metadata + adds JSON-LD and a global skip link; marks decorative backgrounds as aria-hidden. |
apps/web/src/app/page.tsx |
Adds an in-page anchor target for the skip link (needs adjustment for global consistency). |
apps/web/src/app/sitemap.ts |
Adds a sitemap metadata route so Next emits /sitemap.xml. |
apps/web/src/components/landing/LandingNav.tsx |
Improves nav a11y via labels and focus-visible outlines. |
apps/web/src/components/landing/HeroSection.tsx |
Adds focus-visible outlines and honors prefers-reduced-motion for the marquee animation. |
apps/web/public/robots.txt |
Adds crawler directives and points to the sitemap. |
apps/web/public/manifest.json |
Adds PWA manifest referenced by metadata. |
apps/web/public/icon.svg |
Adds the SVG icon referenced by metadata/manifest. |
apps/web/public/favicon.ico |
Adds the favicon referenced by metadata. |
apps/web/public/apple-touch-icon.png |
Adds the Apple touch icon referenced by metadata/manifest. |
apps/web/public/og-image.png |
Adds the OG/Twitter image referenced by metadata. |
| <div className="fixed inset-0 noise pointer-events-none" aria-hidden="true" /> | ||
|
|
||
| {/* Main content */} | ||
| <div className="relative z-10"> |
| <div className="min-h-screen bg-void text-ink overflow-x-hidden"> | ||
| <LandingNav /> | ||
| <main> | ||
| <main id="main"> |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/src/app/layout.tsx`:
- Around line 120-123: The script currently uses dangerouslySetInnerHTML with
the jsonLd object; remove dangerouslySetInnerHTML and instead render the
serialized JSON-LD as the script's children by calling JSON.stringify(jsonLd)
and escaping any "<" as "\u003c" (e.g., JSON.stringify(jsonLd).replace(/</g,
'\\u003c')); update the JSX in apps/web/src/app/layout.tsx (the <script
type="application/ld+json"> element that references jsonLd) to use the escaped
string as its child content rather than an unsafe injection.
In `@CHANGELOG.md`:
- Line 14: The markdown headings are missing required blank lines after them
(MD022). Add a single blank line immediately after the "#### Added" heading
shown in the diff and likewise insert a blank line after the other two headings
flagged (lines 29 and 43) so each heading is followed by one empty line; this
will satisfy the MD022 lint rule.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9c0a78d9-12db-4297-8d4d-82234807310d
⛔ Files ignored due to path filters (4)
apps/web/public/apple-touch-icon.pngis excluded by!**/*.pngapps/web/public/favicon.icois excluded by!**/*.icoapps/web/public/icon.svgis excluded by!**/*.svgapps/web/public/og-image.pngis excluded by!**/*.png
📒 Files selected for processing (8)
CHANGELOG.mdapps/web/public/manifest.jsonapps/web/public/robots.txtapps/web/src/app/layout.tsxapps/web/src/app/page.tsxapps/web/src/app/sitemap.tsapps/web/src/components/landing/HeroSection.tsxapps/web/src/components/landing/LandingNav.tsx
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: copilot-pull-request-reviewer
- GitHub Check: Generate and Upload Coverage
- GitHub Check: trivy
- GitHub Check: Analyze (javascript)
- GitHub Check: E2E Pipeline Tests
- GitHub Check: Analyze (python)
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{py,js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{py,js,jsx,ts,tsx}: Use Python 3.9+ and Node 18+ for development
Never hardcode API keys, database URLs, or secrets in code
Make minimal, surgical changes and avoid deleting working code unless fixing security issues
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
**/*.{py,js,ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Maintain >80% code coverage for new features
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
**/*.{py,ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{py,ts,tsx}: Keep frontend and backend data models synchronized using matching Pydantic (backend) and TypeScript (frontend) interfaces
Use type-safe interfaces for backend-frontend data exchange
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
apps/web/**/*.{ts,tsx}: Use strict mode TypeScript with strict mode enabled in apps/web/tsconfig.json
Use Tailwind CSS for styling in the frontend
Never use dangerouslySetInnerHTML in React components
apps/web/**/*.{ts,tsx}: Use TypeScript strict mode in tsconfig.json for frontend code
Use ESLint with Next.js rules via shared config from packages/eslint-config/
Use path alias@/* to reference src/* directory in frontend code
Never use dangerouslySetInnerHTML in React/TypeScript code
Use NextAuth.js for authentication in the frontend
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
apps/web/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use ESLint with Next.js rules from shared config in packages/eslint-config/
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
apps/web/src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use path alias
@/* mapping to src/* in TypeScript/JavaScript frontend code
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
apps/web/**/*.{ts,tsx,css}
📄 CodeRabbit inference engine (GEMINI.md)
Use Tailwind CSS for styling in the frontend
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
apps/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (GEMINI.md)
Use Turbo for building, developing, linting, and testing JavaScript workspaces (apps/, packages/, mcp-servers/*)
Files:
apps/web/src/app/sitemap.tsapps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
**/*.ts
⚙️ CodeRabbit configuration file
This is a TypeScript/Next.js project. Focus on type safety, null checks, async/await error handling, and SSE stream lifecycle management. Flag any fetch() calls without AbortSignal.timeout. Check for proper error boundaries. Flag any TODO, placeholder, or stub implementations that are not production-ready. Enforce TypeScript strict mode compliance — flag implicit any, missing return types, and unsafe type assertions.
Files:
apps/web/src/app/sitemap.ts
**/*.tsx
⚙️ CodeRabbit configuration file
React components in Next.js 16. Check for proper use of 'use client' directives, hook dependency arrays, memory leaks in useEffect, and accessibility issues. Flag any TODO or placeholder UI components that are not production-ready.
Files:
apps/web/src/app/page.tsxapps/web/src/components/landing/LandingNav.tsxapps/web/src/components/landing/HeroSection.tsxapps/web/src/app/layout.tsx
🪛 ast-grep (0.42.2)
apps/web/src/app/layout.tsx
[warning] 121-121: Usage of dangerouslySetInnerHTML detected. This bypasses React's built-in XSS protection. Always sanitize HTML content using libraries like DOMPurify before injecting it into the DOM to prevent XSS attacks.
Context: dangerouslySetInnerHTML
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml
- https://cwe.mitre.org/data/definitions/79.html
(react-unsafe-html-injection)
🪛 markdownlint-cli2 (0.22.1)
CHANGELOG.md
[warning] 14-14: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 29-29: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 43-43: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🪛 OpenGrep (1.21.0)
apps/web/src/app/layout.tsx
[WARNING] 120-123: dangerouslySetInnerHTML with dynamic content can lead to XSS. Sanitize the input with a library like DOMPurify before rendering.
(coderabbit.xss.react-dangerously-set-innerhtml)
🔇 Additional comments (13)
apps/web/src/components/landing/HeroSection.tsx (3)
116-116: LGTM!
134-134: LGTM!
320-324: LGTM!apps/web/src/components/landing/LandingNav.tsx (5)
26-26: LGTM!
39-39: LGTM!
58-58: LGTM!
71-72: LGTM!
81-81: LGTM!apps/web/public/manifest.json (1)
1-23: LGTM!apps/web/public/robots.txt (1)
1-5: LGTM!apps/web/src/app/layout.tsx (1)
21-24: LGTM!Also applies to: 28-29, 79-110, 125-133
apps/web/src/app/page.tsx (1)
14-14: LGTM!apps/web/src/app/sitemap.ts (1)
1-14: LGTM!
… skip-link in layout, central SITE_URL Addresses code review feedback on PR #202. 1. layout.tsx: replace dangerouslySetInnerHTML JSON-LD with React <script>{jsonLdString}</script> children. jsonLdString escapes `<` -> `<` to prevent any nested `</script>` breakout. Build verified: rendered HTML contains exactly one valid JSON-LD block. Complies with repo policy that forbids dangerouslySetInnerHTML. 2. CHANGELOG.md: markdownlint MD022 — blank lines after `#### Added`, `### Changed`, and `### Notes / known follow-ups (not in this change)`. 3. Skip-to-main-content target moved from `apps/web/src/app/page.tsx`'s <main> to the root layout's content wrapper. The link now works on every route (dashboard, pricing, features, playground, prototype, not-found), not just the homepage. Duplicate `id="main"` removed from page.tsx — rendered HTML on `/` now contains exactly one `id="main"`. 4. Add apps/web/src/lib/site.ts exporting SITE_URL = 'https://uvai.io'. layout.tsx (metadataBase, alternates.canonical, og.url, JSON-LD URLs) and sitemap.ts both consume it. Pricing/playground references kept as-is — those are mailto: addresses and api.uvai.io examples in code samples, not the same axis as the site origin. Failing CI check (E2E Pipeline Tests) is unrelated to this PR: - E2E runs vitest against BASE_URL=https://uvai.io (the live deployment) - Live root returns 200 but is stale (title still "UVAI — Video to Software") - This PR touches zero files under tests/e2e/, src/youtube_extension/, or apps/web/src/app/api/ - Resolution requires a redeploy of the current main, which is outside this PR's scope per the original instructions Local verification: - npx eslint on touched files: clean (exit 0) - npm run build (apps/web): ✓ Compiled, TypeScript clean, 21 pages - Rendered HTML inspection: JSON-LD block present and well-formed; id="main" present on /, /pricing, /features, /dashboard, /playground; exactly one id="main" on each prerendered page (no duplicates) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
🔴 E2E Test Results: FAILURE DETECTED
Test Output |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
CHANGELOG.md (1)
35-36:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winConflicting
id="main"history in the same release entry.Line 35-Line 36 says
page.tsxnow ownsid="main", but Line 63-Line 67 says it was moved to layout and removed frompage.tsx. Keep only the final-state statement (or explicitly mark the first as superseded) to avoid misleading release notes.Also applies to: 63-67
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CHANGELOG.md` around lines 35 - 36, The CHANGELOG contains conflicting statements about id="main": one entry claims apps/web/src/app/page.tsx now has id="main" while a later entry says id="main" was moved to layout and removed from page.tsx; update the changelog so only the final state remains (or mark the earlier note as superseded). Edit the entries referencing apps/web/src/app/page.tsx and the layout change so they are consistent—either remove the earlier line that adds id="main" to page.tsx or add a clarifying “superseded by” note and keep the later entry that the id was moved to layout.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 59-62: Update the CHANGELOG entry to reflect the actual escape
sequence used for JSON-LD; replace the incorrect phrase “escaping `<` as `<`”
with the real escaped form used in the code (e.g., `\u003c`) and mention that
this prevents `</script>` breakout when rendering the JSON-LD string in
apps/web/src/app/layout.tsx (where the code switched from
dangerouslySetInnerHTML to <script>{jsonLdString}</script>).
---
Outside diff comments:
In `@CHANGELOG.md`:
- Around line 35-36: The CHANGELOG contains conflicting statements about
id="main": one entry claims apps/web/src/app/page.tsx now has id="main" while a
later entry says id="main" was moved to layout and removed from page.tsx; update
the changelog so only the final state remains (or mark the earlier note as
superseded). Edit the entries referencing apps/web/src/app/page.tsx and the
layout change so they are consistent—either remove the earlier line that adds
id="main" to page.tsx or add a clarifying “superseded by” note and keep the
later entry that the id was moved to layout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 51e69273-69c5-498f-8b8d-5ed2fcefa035
📒 Files selected for processing (4)
CHANGELOG.mdapps/web/src/app/layout.tsxapps/web/src/app/sitemap.tsapps/web/src/lib/site.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: E2E Pipeline Tests
- GitHub Check: trivy
- GitHub Check: Analyze (javascript)
- GitHub Check: Analyze (python)
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{py,js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{py,js,jsx,ts,tsx}: Use Python 3.9+ and Node 18+ for development
Never hardcode API keys, database URLs, or secrets in code
Make minimal, surgical changes and avoid deleting working code unless fixing security issues
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
**/*.{py,js,ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Maintain >80% code coverage for new features
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
**/*.{py,ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{py,ts,tsx}: Keep frontend and backend data models synchronized using matching Pydantic (backend) and TypeScript (frontend) interfaces
Use type-safe interfaces for backend-frontend data exchange
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
apps/web/**/*.{ts,tsx}: Use strict mode TypeScript with strict mode enabled in apps/web/tsconfig.json
Use Tailwind CSS for styling in the frontend
Never use dangerouslySetInnerHTML in React components
apps/web/**/*.{ts,tsx}: Use TypeScript strict mode in tsconfig.json for frontend code
Use ESLint with Next.js rules via shared config from packages/eslint-config/
Use path alias@/* to reference src/* directory in frontend code
Never use dangerouslySetInnerHTML in React/TypeScript code
Use NextAuth.js for authentication in the frontend
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
apps/web/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use ESLint with Next.js rules from shared config in packages/eslint-config/
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
apps/web/src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use path alias
@/* mapping to src/* in TypeScript/JavaScript frontend code
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
apps/web/**/*.{ts,tsx,css}
📄 CodeRabbit inference engine (GEMINI.md)
Use Tailwind CSS for styling in the frontend
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
apps/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (GEMINI.md)
Use Turbo for building, developing, linting, and testing JavaScript workspaces (apps/, packages/, mcp-servers/*)
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.tsapps/web/src/app/layout.tsx
**/*.ts
⚙️ CodeRabbit configuration file
This is a TypeScript/Next.js project. Focus on type safety, null checks, async/await error handling, and SSE stream lifecycle management. Flag any fetch() calls without AbortSignal.timeout. Check for proper error boundaries. Flag any TODO, placeholder, or stub implementations that are not production-ready. Enforce TypeScript strict mode compliance — flag implicit any, missing return types, and unsafe type assertions.
Files:
apps/web/src/lib/site.tsapps/web/src/app/sitemap.ts
**/*.tsx
⚙️ CodeRabbit configuration file
React components in Next.js 16. Check for proper use of 'use client' directives, hook dependency arrays, memory leaks in useEffect, and accessibility issues. Flag any TODO or placeholder UI components that are not production-ready.
Files:
apps/web/src/app/layout.tsx
🔇 Additional comments (3)
apps/web/src/lib/site.ts (1)
1-1: LGTM!apps/web/src/app/layout.tsx (1)
4-4: LGTM!Also applies to: 22-24, 29-29, 85-89, 93-95, 98-99, 108-108, 113-117, 126-126, 138-140
apps/web/src/app/sitemap.ts (1)
2-2: LGTM!Also applies to: 8-8
![v0[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…Nav (#205) Zero emoji, real product mockups per feature section, SVG icons everywhere, LandingNav with proper cross-page routing and active states. Co-authored-by: v0[bot] <v0[bot]@users.noreply.github.com>
… E2E resilience (#206) - 155 new unit tests (middleware, API models, error handling) - Fix Vercel ERESOLVE build failure via .npmrc legacy-peer-deps - Fix dashboard ?video= URL param auto-select (issue #159) - Fix next.config.js duplicate redirects/headers - Fix CI test dependency installation for Python 3.12 - Make SSE stream always emit terminal pipeline_status event - Make E2E tests resilient to live server degraded mode - Replace banned dQw4w9WgXcQ video ID with auJzb1D-fag throughout
🎯 What: Removed the hardcoded fallback value for the GROK_API_KEY in TriModelConsensusTool.⚠️ Risk: Hardcoded API keys in source code can be exploited if the codebase is exposed or leaked, leading to unauthorized API access, quota exhaustion, and potential financial loss. 🛡️ Solution: Removed the hardcoded string so the tool relies strictly on the environment variable, aligning with secure configuration management practices. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
…type pages (#204) Resolves 404s on /privacy, /terms, /api/docs, /app, /login and ensures /prototype carries a noindex robots tag. Scope is intentionally narrow and does not overlap PR #202 (assets, robots, sitemap, JSON-LD, a11y). - /privacy, /terms: server-rendered legal placeholder pages with proper metadata, canonical URLs, and footer links. Plain-language, startup- friendly; will be replaced before enterprise contracts. - /api/docs: human-readable reference matching the documentation pointer returned by /api JSON. Lists actual /api/* routes that exist in code. - /app, /login: server redirects to /dashboard, marked noindex. UVAI has no auth gate today, so this matches actual product behavior. - /prototype: adds a route layout with robots.index=false because the underlying page is an internal prototype spec, not a public surface. - LandingFooter: surfaces Privacy and Terms links now that the pages exist. Build: next build succeeds, 25 routes generated. Type-check and ESLint clean. Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…de (#182) Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
…ction (#207) Resolves conflicts manually — the conflicting hunks were all in tests/e2e/pipeline.test.ts and .github/workflows/e2e-tests.yml which were already fixed better in #206. The security-relevant changes are applied cleanly: - code_generator.py (#193): replace hardcoded SECRET_KEY with os.getenv/secrets.token_urlsafe - code_generator.py (#195): restrict CORS allow_origins from ["*"] to localhost origins - real_api_endpoints.py (#196): read ALLOWED_ORIGINS from env; default to localhost origins - database_cleanup_service.py (#197): validate table name with regex before SQL use; quote safe_table_name with double quotes for PRAGMA and DELETE statements - deployment_manager.py (#200): add path traversal guard (resolve + is_dir check); add --ignore-scripts to npm install; use resolved_path for all cwd args - tests/unit/test_database_cleanup_security.py: new unit tests for SQL injection prevention Closes #193 #195 #196 #197 #200 https://claude.ai/code/session_01AgA9F82EwazbdB5R2f9nsd Co-authored-by: Claude <noreply@anthropic.com>
* chore: move legacy agent files into .github Agent-Logs-Url: https://github.com/groupthinking/EventRelay/sessions/8e79c6e5-9755-40a2-b8b0-73b9ff75249e Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com> * docs: fix relocated agent references Agent-Logs-Url: https://github.com/groupthinking/EventRelay/sessions/8e79c6e5-9755-40a2-b8b0-73b9ff75249e Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com> * docs: remove vague agent rule reference Agent-Logs-Url: https://github.com/groupthinking/EventRelay/sessions/8e79c6e5-9755-40a2-b8b0-73b9ff75249e Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
Live uvai.io referenced /favicon.ico, /icon.svg, /apple-touch-icon.png but apps/web/public/ did not exist in the repo, producing 404s. Layout metadata also pointed metadataBase and og.url at the legacy v0-uvai.vercel.app host rather than the canonical uvai.io domain. Changes: - Add apps/web/public with favicon.ico (multi-res), icon.svg, apple-touch-icon.png, og-image.png (1200x630), manifest.json, robots.txt. - Add apps/web/src/app/sitemap.ts (Next.js Metadata Route sitemap). - layout.tsx: metadataBase + og.url -> https://uvai.io, add alternates.canonical, inject Organization/WebSite/SoftwareApplication JSON-LD, add skip-to-main link. - page.tsx: <main id=\"main\"> as skip-link target. - LandingNav.tsx: aria-label=\"Primary\" on nav, aria-labels on brand + GitHub external link, visible focus rings on all interactive elements. - HeroSection.tsx: focus rings on CTAs, honor prefers-reduced-motion for marquee. - Add CHANGELOG.md with timestamped entry. Local verification: - npx eslint on touched files: clean - npm run build (apps/web): success, /sitemap.xml route generated, TypeScript clean No production / deploy / DNS / secret changes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
… skip-link in layout, central SITE_URL Addresses code review feedback on PR #202. 1. layout.tsx: replace dangerouslySetInnerHTML JSON-LD with React <script>{jsonLdString}</script> children. jsonLdString escapes `<` -> `<` to prevent any nested `</script>` breakout. Build verified: rendered HTML contains exactly one valid JSON-LD block. Complies with repo policy that forbids dangerouslySetInnerHTML. 2. CHANGELOG.md: markdownlint MD022 — blank lines after `#### Added`, `### Changed`, and `### Notes / known follow-ups (not in this change)`. 3. Skip-to-main-content target moved from `apps/web/src/app/page.tsx`'s <main> to the root layout's content wrapper. The link now works on every route (dashboard, pricing, features, playground, prototype, not-found), not just the homepage. Duplicate `id="main"` removed from page.tsx — rendered HTML on `/` now contains exactly one `id="main"`. 4. Add apps/web/src/lib/site.ts exporting SITE_URL = 'https://uvai.io'. layout.tsx (metadataBase, alternates.canonical, og.url, JSON-LD URLs) and sitemap.ts both consume it. Pricing/playground references kept as-is — those are mailto: addresses and api.uvai.io examples in code samples, not the same axis as the site origin. Failing CI check (E2E Pipeline Tests) is unrelated to this PR: - E2E runs vitest against BASE_URL=https://uvai.io (the live deployment) - Live root returns 200 but is stale (title still "UVAI — Video to Software") - This PR touches zero files under tests/e2e/, src/youtube_extension/, or apps/web/src/app/api/ - Resolution requires a redeploy of the current main, which is outside this PR's scope per the original instructions Local verification: - npx eslint on touched files: clean (exit 0) - npm run build (apps/web): ✓ Compiled, TypeScript clean, 21 pages - Rendered HTML inspection: JSON-LD block present and well-formed; id="main" present on /, /pricing, /features, /dashboard, /playground; exactly one id="main" on each prerendered page (no duplicates) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
🔍 PR Validation |
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Summary
Phase 1 fixes for verified uvai.io drift and missing static/SEO assets. This is intentionally scoped to low-risk web changes only: no production deploy, DNS, Vercel config, secrets, backend code, or workflow changes.
What changed
apps/web/public/assets for favicon, SVG icon, Apple touch icon, Open Graph image, PWA manifest, and robots.txt.apps/web/src/app/sitemap.tsso Next emits/sitemap.xml.v0-uvai.vercel.apptohttps://uvai.io.aria-hiddenhandling.CHANGELOG.mdentry for 2026-05-22.Verified local checks
npx eslint src/app/layout.tsx src/app/page.tsx src/app/sitemap.ts src/components/landing/{LandingNav,HeroSection}.tsxpassed.npm run buildinapps/webpassed, TypeScript clean, 21 pages generated,/sitemap.xmlroute emitted.Not included
@opentelemetry/apipeer dependency conflict.next lint --dirremains a follow-up because Next 16 removed the flag.Follow-ups
redirects()andheaders()definitions inapps/web/next.config.js.npm installpeer-dep conflict so full Turbo test runs are reliable./privacy,/terms, and clarify/prototypenoindex/auth strategy.Commit: 42156cd