Skip to content

Feat/livekits#109

Merged
Demi-la merged 5 commits into
devfrom
feat/livekits
Jun 1, 2026
Merged

Feat/livekits#109
Demi-la merged 5 commits into
devfrom
feat/livekits

Conversation

@somidotun
Copy link
Copy Markdown
Collaborator

@somidotun somidotun commented Jun 1, 2026

Description

This PR fix the issue of the liveKit implementation and the ui

Changes Proposed

What were you told to do?

i was told to correct the livekit implementation issue .

What did you do?

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Chore (maintenance, configuration, or structural changes)

Check List

  • My code follows the code style of this project.
  • This PR does not contain plagiarized content.
  • The title and description of the PR are clear and explain the approach.
  • I am making a pull request against the dev branch.
  • My commit message style matches our requested structure (Conventional Commits).
  • My code additions will not fail code linting checks or unit tests.
  • I am only making changes to files I was requested to.

Images / Media

  • The live component/feature worked on
image image image image
  • Successful linting check (run pnpm lint or check commit output)
image

Summary by CodeRabbit

Release Notes

  • New Features

    • Livekit integration is now available for interviews
    • Added microphone and camera permission management with retry capability
    • Dashboard navigation bar integrated into interview pages
    • Resume upload timeout set to 60 seconds
  • Bug Fixes

    • Fixed hydration warnings on page load
    • Improved session parameter handling
  • Refactor

    • Theme toggle removed from call interface
    • Updated API endpoints for interview data retrieval

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Jun 1, 2026

Review Change Stack

📝 Walkthrough

Walkthrough

This PR modernizes the call/interview experience by standardizing API endpoint configuration, enabling LiveKit with device permission handling, refactoring layouts and navigation, and strengthening security via the pre-commit hook with obfuscation detection and linting enforcement.

Changes

Call and Interview Experience Modernization

Layer / File(s) Summary
API endpoint and environment standardization
src/app/call/page.tsx, src/app/call/sessions/[id]/edit/page.tsx, src/components/common/call/app/app.tsx, src/components/common/dash/liveInterview/apiCall.ts, src/components/common/dash/createInterview/fileUpload.tsx
Pages and services now derive backend URLs from NEXT_PUBLIC_API_BASE_URL with staging fallbacks; tokenSource flow uses authenticated api client for interview details and LiveKit token requests; API calls standardized to template literals; upload requests add explicit Content-Type and 60-second timeout.
Layout and navigation refactoring
src/app/call/layout.tsx, src/app/call/page.tsx, src/app/call/sessions/[id]/page.tsx, src/app/call/sessions/new/page.tsx
Removed ThemeProvider wrapper and theme toggle UI from call layout; added DashboardNavbar to call pages; replaced SiteHeader with DashboardNavbar in call listing.
Async params and hydration handling
src/app/call/sessions/[id]/page.tsx, src/app/layout.tsx
SessionDetail page now unwraps Promise-based params using React use() hook; root layout suppresses hydration warnings on html and body elements.
LiveKit integration enablement and initialization helper
src/components/common/Onboarding/steps/Step4.tsx, src/lib/livekit/init.ts
Enabled Livekit as selectable integration option; added initLiveKitRoom() helper that constructs, connects, and returns a Room instance with error handling.
Device permission checking and error recovery
src/components/common/call/agents-ui/blocks/agent-session-view-01/components/agent-session-block.tsx, src/components/common/call/app/view-controller.tsx
Added microphone/camera permission state management with Permissions API subscription; device error handlers set denial state and show toast notifications; retry mechanism via getUserMedia; renders overlay banner with retry button; ViewController checks media access on start to detect issues early.
Call UI and form updates
src/components/common/call/agents-ui/agent-track-toggle.tsx, src/components/common/call/session-form.tsx
Refactored icon rendering from getSourceIcon to renderSourceIcon that returns ready JSX; centralized pending animation styling; SessionForm now sends candidate info as nested candidate.name structure and redirects to interview route.

Pre-commit Hook Security and Linting

Layer / File(s) Summary
Bash-based pre-commit with obfuscation detection
.husky/pre-commit
Upgraded to /bin/bash; runs lint-staged first; detects repo type (Python/Node) and applies targeted auto-fixes (line truncation, module shim removal, postcss config rewrite); blocks commits on obfuscation patterns (String.fromCharCode, eval, Function, global access) and Python injection patterns (exec, compile, __import__, subprocess); restages fixes and exits with failure on blocks.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • hngprojects/meetmind-ui#91: Related changes to LiveKit call integration, tokenSource logic, and agent-track-toggle icon rendering patterns.

Suggested reviewers

  • Demi-la
  • AgboolaAgbeniga
🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 13.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check ❓ Inconclusive The title 'Feat/livekits' is vague and uses a branch-naming convention rather than a descriptive summary of the changes made in the PR. Replace the title with a clear, descriptive summary of the main change, such as 'Fix LiveKit implementation and add media permission handling' or 'Improve LiveKit integration with permission management and UI updates'.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/livekits

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (9)
.husky/pre-commit (7)

80-98: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Size-based postcss config replacement can destroy legitimate files.

The check at lines 81-98 overwrites any postcss configuration file larger than 500 bytes with a minimal default config. While 500 bytes may exceed malicious payloads, legitimate postcss configurations with multiple plugins, options, or comments can easily exceed this threshold. This auto-fix can silently destroy valid developer configuration without verification.

🛡️ Safer alternative: block and warn instead of auto-replacing
   if [ "$IS_NODE" -eq 1 ] && echo "$file" | grep -q "postcss"; then
     SIZE=$(wc -c < "$file")
     if [ "$SIZE" -gt 500 ]; then
-      echo "⚠️  [file-size] $file is $SIZE bytes — likely injected, auto-fixing..."
-      # Restore to the known-good minimal config
-      cat > "$file" << 'EOF'
-const config = {
-  plugins: {
-    "`@tailwindcss/postcss`": {},
-  },
-};
-
-export default config;
-EOF
-      git add "$file"
-      FIXED=1
+      echo "❌ [file-size] $file is $SIZE bytes (threshold: 500)"
+      echo "   Review manually to confirm if this is legitimate or malicious."
+      FAILED=1
     fi
   fi

Alternatively, raise the threshold or add content-based validation before replacing.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit around lines 80 - 98, The current pre-commit check
unconditionally overwrites any postcss.* file larger than 500 bytes (using the
heredoc that writes the minimal config and setting FIXED=1), which can destroy
legitimate configs; change the behavior in the postcss size check (the block
that computes SIZE and compares to 500) to be non-destructive: instead of
auto-replacing via the cat > "$file" heredoc and git add, emit a clear
warning/error, prevent the commit (exit non-zero) or prompt the user for
confirmation, and/or raise the SIZE threshold and add content-based validation
(e.g., check for known malicious markers) before attempting any automatic fix;
keep variables/flags like IS_NODE, SIZE, file, and FIXED but remove the
unconditional rewrite to preserve user files.

13-13: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix operator precedence in repo type detection.

The condition uses || and && without grouping, causing incorrect evaluation due to operator precedence. The expression evaluates as [ -f "pyproject.toml" ] || [ -f "setup.py" ] || ([ -f "requirements.txt" ] && IS_PYTHON=1), so if only pyproject.toml or setup.py exists, IS_PYTHON will remain 0.

🐛 Proposed fix
-[ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] && IS_PYTHON=1
+{ [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ]; } && IS_PYTHON=1

Or use explicit if-statement:

-[ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] && IS_PYTHON=1
+if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ]; then
+  IS_PYTHON=1
+fi
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit at line 13, The boolean test for detecting Python repo
leaves IS_PYTHON unset due to operator precedence; change the condition so
IS_PYTHON is assigned when any of the three file tests succeeds by grouping the
ORs or using an explicit if: update the line that uses [ -f "pyproject.toml" ]
|| [ -f "setup.py" ] || [ -f "requirements.txt" ] && IS_PYTHON=1 to a grouped
test (e.g., [ \( -f "pyproject.toml" -o -f "setup.py" -o -f "requirements.txt"
\) ] && IS_PYTHON=1) or replace it with an if-statement that sets IS_PYTHON=1
when any of the three file checks succeed; reference the IS_PYTHON variable and
the three file existence tests to locate the change.

37-42: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

grep -v will fail with set -e when pattern is not found.

The grep -v command at line 40 returns exit code 1 when no lines are filtered (i.e., the pattern doesn't exist in the file). Combined with set -e at line 2, this causes the script to exit unexpectedly when attempting to fix a file that doesn't contain the pattern.

🛡️ Proposed fix to handle grep exit codes
 fix_create_require() {
   file="$1"
-  grep -v "createRequire\|from 'module'" "$file" > "${file}.cleaned"
+  grep -v "createRequire\|from 'module'" "$file" > "${file}.cleaned" || true
   mv "${file}.cleaned" "$file"
 }

Or more robust:

 fix_create_require() {
   file="$1"
-  grep -v "createRequire\|from 'module'" "$file" > "${file}.cleaned"
-  mv "${file}.cleaned" "$file"
+  if grep -v "createRequire\|from 'module'" "$file" > "${file}.cleaned"; then
+    mv "${file}.cleaned" "$file"
+  else
+    # No matches found, file is already clean
+    rm -f "${file}.cleaned"
+  fi
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit around lines 37 - 42, The helper function
fix_create_require currently uses grep -v which exits with code 1 when no match
is found and, combined with set -e, can abort the pre-commit hook; update
fix_create_require to avoid failing on no-match (e.g., first test with grep -q
'createRequire\|from '\''module'\'' || true or use grep -v ... || true, or
switch to a non-failing tool like sed) so that it only rewrites the file when
matches exist and does not cause the script to exit; locate the function named
fix_create_require to implement the guard and ensure mv only runs after a
successful create of the cleaned file.

100-109: 🧹 Nitpick | 🔵 Trivial | 💤 Low value

Python injection patterns may produce false positives for legitimate code.

The patterns at lines 102-103 block compile, subprocess, __import__, and exec in Python configuration files. While these can be used maliciously, they also have legitimate uses:

  • compile() is commonly used for regex compilation
  • subprocess is a standard module for running external commands
  • __import__() is Python's dynamic import mechanism
  • exec() is occasionally used for dynamic code evaluation

Consider refining the detection to reduce false positives—for example, checking for suspicious contexts (obfuscated strings, base64, unusual chaining) rather than blocking the keywords outright, or documenting an escape mechanism for approved uses.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit around lines 100 - 109, The current pre-commit check in
the IS_PYTHON branch flags any occurrence of "exec\s*\(", "compile\s*\(",
"__import__", and "subprocess" which creates false positives; update the logic
in that block so the forbidden-pattern check (the for loop that sets FAILED=1)
only triggers on suspicious contexts (e.g., use regexes that detect obfuscated
strings, base64-like payloads, eval/exec of dynamic strings, or chained/indirect
calls) or implement an explicit allowlist mechanism (e.g., a file-level marker
or comment token to skip the check) and update the grep patterns accordingly so
legitimate uses of compile(), subprocess, __import__ and exec() are not blocked
while still catching likely injection attempts; keep references to IS_PYTHON,
the for pattern loop, file and FAILED so reviewers can locate and verify the
change.

44-110: 🧹 Nitpick | 🔵 Trivial | ⚖️ Poor tradeoff

Consider security and performance implications of auto-fixing workflow.

The current approach auto-fixes files and immediately re-stages them without validation (lines 54-56, 63-65, 95-96). This workflow has several architectural concerns:

Security:

  • Auto-fixes run without validating the result is syntactically valid
  • Corrupted files are staged and could be committed
  • Developer may not review what was changed before the commit proceeds

Performance:

  • Each file is processed individually with multiple grep/awk invocations
  • For large commits, this can be slow
  • Consider batching pattern detection across all files

Observability:

  • No logging of what was actually changed
  • Difficult to audit auto-fix behavior

Consider adding syntax validation after auto-fixes, implementing a dry-run mode, or requiring explicit confirmation before staging modified files.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit around lines 44 - 110, The pre-commit hook auto-applies
fixes and immediately git-adds files (calls to fix_long_lines and
fix_create_require followed by git add and setting FIXED), which can stage
invalid or unreviewed edits and is inefficient; update the flow to 1) run fixes
but do not auto-stage—collect modified files in a list instead of calling git
add immediately, 2) validate each modified file syntactically using the
appropriate validator (JS/TS linter or Node/TypeScript compiler when
IS_NODE/IS_PYTHON flags apply) and run a formatter/linter check for
fix_long_lines and fix_create_require outputs, 3) if validation passes, log the
diff/changes for observability and then stage those files (only then run git add
and set FIXED), otherwise mark FAILED and surface actionable errors so the
developer can review; also consider batching grep/awk checks across $STAGED to
reduce per-file overhead.

28-35: ⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

Truncating long lines at 200 characters can corrupt valid code.

The comment at line 32 claims "real config lines are never this long," but modern codebases frequently have legitimate lines exceeding 200 characters—such as long import statements, type unions, generated code, embedded URLs, or base64-encoded data. Blindly truncating at character 200 can:

  • Break import statements mid-identifier
  • Corrupt type definitions and generics
  • Damage embedded data or configuration values
  • Introduce syntax errors that may not be caught immediately

This auto-fix should either be removed or replaced with a blocking check that requires manual review.

⚠️ Safer alternative: block instead of auto-fix
-  # ── Check 1: Long lines (the hiding technique) ──────────────────────────────
   if awk 'length > 200 { found=1; exit } END { exit !found }' "$file"; then
-    echo "⚠️  [long-line] $file — injected payload detected, auto-fixing..."
-    fix_long_lines "$file"
-    git add "$file"
-    FIXED=1
+    echo "❌ [long-line] $file — contains lines over 200 chars"
+    echo "   Review manually to determine if this is legitimate or malicious."
+    FAILED=1
   fi

Then remove the fix_long_lines helper function entirely (lines 28-35).

Also applies to: 51-57

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit around lines 28 - 35, The fix_long_lines helper currently
truncates lines which can corrupt valid code; remove the fix_long_lines function
and any calls to it (references to fix_long_lines in the hook) and replace it
with a non-destructive blocker: implement a check that scans staged files for
lines exceeding the threshold and fails the commit with a clear error message
asking for manual review (e.g., use awk/grep to detect length and exit non-zero
with instructions). Ensure the hook reports file and line numbers for offending
lines and do the same for the other similar helper occurrences so no automatic
truncation occurs.

25-25: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Filenames with spaces will break the scan loop.

The staged files list at line 25 combined with the unquoted expansion in for file in $STAGED at line 45 will fail for filenames containing spaces or special characters. Each space-separated word becomes a separate iteration, causing the script to skip or misprocess such files.

🔒 Proposed fix using null-delimited parsing
-STAGED=$(git diff --cached --name-only)
+# Use null-delimited output for safe parsing
+while IFS= read -r -d '' file; do
+  # ... existing checks ...
+done < <(git diff --cached --name-only -z)

Or simpler approach:

-STAGED=$(git diff --cached --name-only)
+git diff --cached --name-only | while IFS= read -r file; do
+  # ... move the loop body here ...
+done

Note: You'll need to restructure the loop at lines 45-110 accordingly.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit at line 25, The STAGED variable and the unquoted loop "for
file in $STAGED" will break on filenames with spaces; update the script to
collect staged names using git's null-delimited output and iterate with a
null-delimited read loop instead of "for file in $STAGED", then ensure every use
of the file variable is quoted (e.g., "$file") inside the body; replace the
current loop that spans the "for file in $STAGED" block (lines ~45-110) with the
null-delimited reader and adjust downstream checks/commands to use the quoted
file variable.
src/components/common/Onboarding/steps/Step4.tsx (1)

83-96: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix Livekit card logo asset in Step4.tsx

The “Livekit” IntegrationCard is enabled, but its logo uses src="/onboarding/Zoom.svg" (with alt="Livekit"), so the wrong asset becomes user-visible. Add a proper Livekit logo under public/onboarding/ (currently only Google.svg, MeetmindLogo.svg, and Zoom.svg exist) and point the Image src for the Livekit card to that asset.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/common/Onboarding/steps/Step4.tsx` around lines 83 - 96, The
Livekit IntegrationCard in Step4.tsx uses the wrong image asset
(src="/onboarding/Zoom.svg" with alt="Livekit"); add a proper Livekit logo file
(e.g., Livekit.svg) to the public/onboarding/ directory and update the Image src
in the IntegrationCard for Livekit to point to that new asset (keep
width/height/alt as appropriate) so the IntegrationCard component
(IntegrationCard) displays the correct logo when onConnect/updateData is used.
src/app/call/sessions/[id]/edit/page.tsx (1)

37-37: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix broken back-link route
src/app/call/sessions/[id]/edit/page.tsx links to /sessions/${id}, but the interview routes in src/app are under /call/sessions/... (no src/app/sessions route), so this back link will likely 404. Change it to /call/sessions/${id}.

🐛 Proposed fix
-          <Link href={`/sessions/${id}`}>
+          <Link href={`/call/sessions/${id}`}>
             <ArrowLeft /> Back to interview
           </Link>
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/app/call/sessions/`[id]/edit/page.tsx at line 37, The back-link in the
Edit page currently uses Link href={`/sessions/${id}`} which points to a
non-existent route; update the Link component to use the correct route prefix by
changing the href to `/call/sessions/${id}` (locate the Link in the edit page
where the id variable is used and replace the path string).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/app/call/layout.tsx`:
- Around line 60-71: Remove the dead commented ThemeProvider/ThemeToggle markup
and the now-empty wrapper div that renders on every call page; specifically
delete the commented blocks referencing ThemeProvider and ThemeToggle and remove
the <div className="group fixed bottom-0 left-1/2 z-50 mb-2 -translate-x-1/2">
which only contains commented code so only {children} remains in layout.tsx.

In `@src/app/call/page.tsx`:
- Around line 24-29: Extract the duplicated API base resolution into a single
exported constant and import it where needed: replace the inline API_BASE
definition in the call pages (the const API_BASE and its use in the
fetch(`${API_BASE}/api/v1/interviews/`, ...) call) with an import from a new
shared module (e.g., export const API_BASE =
process.env.NEXT_PUBLIC_API_BASE_URL ||
"https://api.staging.meetmind.hng14.com";). Update all call sites that declare
their own API_BASE to import this shared API_BASE constant and ensure the fetch
calls continue to use the imported API_BASE.

In
`@src/components/common/call/agents-ui/blocks/agent-session-view-01/components/agent-session-block.tsx`:
- Around line 201-245: The permission change listener is being registered inside
the inner async function checkPermissions and its cleanup is returned from that
async function (lost by React), so hoist listener registration and cleanup into
the outer useEffect scope: have useEffect declare a let micStatus:
PermissionStatus | null = null, call await checkPermissions() (or move the
navigator.permissions.query logic into the effect), then add
micStatus.addEventListener("change", handlePermissionChange) from the effect and
return a cleanup function that calls micStatus?.removeEventListener("change",
handlePermissionChange); ensure handlePermissionChange and setPermissionDenied
remain the same and keep try/catch around navigator.permissions.query to handle
unsupported browsers.

In `@src/components/common/dash/createInterview/fileUpload.tsx`:
- Line 107: The request in
src/components/common/dash/createInterview/fileUpload.tsx is explicitly setting
"Content-Type": "multipart/form-data", which breaks FormData boundaries; remove
that header from the headers object used in the Axios/fetch upload call (leave
timeout: 60000 intact) so the browser/Axios can set the correct Content-Type
including the boundary; locate the upload function or the headers variable in
fileUpload.tsx (e.g., where the FormData is sent) and delete the hardcoded
"Content-Type" entry instead of changing other headers.

In `@src/lib/livekit/init.ts`:
- Around line 14-30: The file contains a dead helper initLiveKitRoom that is not
referenced anywhere and also emits a noisy console.log of the full Room object;
remove the unused initLiveKitRoom function (and its example usage comment) from
src/lib/livekit/init.ts or, if you prefer to keep it, export it only after
adding a debug-gated log instead of console.log — e.g., stop logging the entire
Room on connect and replace the console.log with a conditional/debug log or a
minimal message; target symbols: initLiveKitRoom, Room.connect, and the
console.log("LiveKit room connected:", room).

---

Outside diff comments:
In @.husky/pre-commit:
- Around line 80-98: The current pre-commit check unconditionally overwrites any
postcss.* file larger than 500 bytes (using the heredoc that writes the minimal
config and setting FIXED=1), which can destroy legitimate configs; change the
behavior in the postcss size check (the block that computes SIZE and compares to
500) to be non-destructive: instead of auto-replacing via the cat > "$file"
heredoc and git add, emit a clear warning/error, prevent the commit (exit
non-zero) or prompt the user for confirmation, and/or raise the SIZE threshold
and add content-based validation (e.g., check for known malicious markers)
before attempting any automatic fix; keep variables/flags like IS_NODE, SIZE,
file, and FIXED but remove the unconditional rewrite to preserve user files.
- Line 13: The boolean test for detecting Python repo leaves IS_PYTHON unset due
to operator precedence; change the condition so IS_PYTHON is assigned when any
of the three file tests succeeds by grouping the ORs or using an explicit if:
update the line that uses [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f
"requirements.txt" ] && IS_PYTHON=1 to a grouped test (e.g., [ \( -f
"pyproject.toml" -o -f "setup.py" -o -f "requirements.txt" \) ] && IS_PYTHON=1)
or replace it with an if-statement that sets IS_PYTHON=1 when any of the three
file checks succeed; reference the IS_PYTHON variable and the three file
existence tests to locate the change.
- Around line 37-42: The helper function fix_create_require currently uses grep
-v which exits with code 1 when no match is found and, combined with set -e, can
abort the pre-commit hook; update fix_create_require to avoid failing on
no-match (e.g., first test with grep -q 'createRequire\|from '\''module'\'' ||
true or use grep -v ... || true, or switch to a non-failing tool like sed) so
that it only rewrites the file when matches exist and does not cause the script
to exit; locate the function named fix_create_require to implement the guard and
ensure mv only runs after a successful create of the cleaned file.
- Around line 100-109: The current pre-commit check in the IS_PYTHON branch
flags any occurrence of "exec\s*\(", "compile\s*\(", "__import__", and
"subprocess" which creates false positives; update the logic in that block so
the forbidden-pattern check (the for loop that sets FAILED=1) only triggers on
suspicious contexts (e.g., use regexes that detect obfuscated strings,
base64-like payloads, eval/exec of dynamic strings, or chained/indirect calls)
or implement an explicit allowlist mechanism (e.g., a file-level marker or
comment token to skip the check) and update the grep patterns accordingly so
legitimate uses of compile(), subprocess, __import__ and exec() are not blocked
while still catching likely injection attempts; keep references to IS_PYTHON,
the for pattern loop, file and FAILED so reviewers can locate and verify the
change.
- Around line 44-110: The pre-commit hook auto-applies fixes and immediately
git-adds files (calls to fix_long_lines and fix_create_require followed by git
add and setting FIXED), which can stage invalid or unreviewed edits and is
inefficient; update the flow to 1) run fixes but do not auto-stage—collect
modified files in a list instead of calling git add immediately, 2) validate
each modified file syntactically using the appropriate validator (JS/TS linter
or Node/TypeScript compiler when IS_NODE/IS_PYTHON flags apply) and run a
formatter/linter check for fix_long_lines and fix_create_require outputs, 3) if
validation passes, log the diff/changes for observability and then stage those
files (only then run git add and set FIXED), otherwise mark FAILED and surface
actionable errors so the developer can review; also consider batching grep/awk
checks across $STAGED to reduce per-file overhead.
- Around line 28-35: The fix_long_lines helper currently truncates lines which
can corrupt valid code; remove the fix_long_lines function and any calls to it
(references to fix_long_lines in the hook) and replace it with a non-destructive
blocker: implement a check that scans staged files for lines exceeding the
threshold and fails the commit with a clear error message asking for manual
review (e.g., use awk/grep to detect length and exit non-zero with
instructions). Ensure the hook reports file and line numbers for offending lines
and do the same for the other similar helper occurrences so no automatic
truncation occurs.
- Line 25: The STAGED variable and the unquoted loop "for file in $STAGED" will
break on filenames with spaces; update the script to collect staged names using
git's null-delimited output and iterate with a null-delimited read loop instead
of "for file in $STAGED", then ensure every use of the file variable is quoted
(e.g., "$file") inside the body; replace the current loop that spans the "for
file in $STAGED" block (lines ~45-110) with the null-delimited reader and adjust
downstream checks/commands to use the quoted file variable.

In `@src/app/call/sessions/`[id]/edit/page.tsx:
- Line 37: The back-link in the Edit page currently uses Link
href={`/sessions/${id}`} which points to a non-existent route; update the Link
component to use the correct route prefix by changing the href to
`/call/sessions/${id}` (locate the Link in the edit page where the id variable
is used and replace the path string).

In `@src/components/common/Onboarding/steps/Step4.tsx`:
- Around line 83-96: The Livekit IntegrationCard in Step4.tsx uses the wrong
image asset (src="/onboarding/Zoom.svg" with alt="Livekit"); add a proper
Livekit logo file (e.g., Livekit.svg) to the public/onboarding/ directory and
update the Image src in the IntegrationCard for Livekit to point to that new
asset (keep width/height/alt as appropriate) so the IntegrationCard component
(IntegrationCard) displays the correct logo when onConnect/updateData is used.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7192121f-a4f4-49ca-b31e-8fc12b8d48e9

📥 Commits

Reviewing files that changed from the base of the PR and between 8f0902a and 5624dd8.

📒 Files selected for processing (16)
  • .husky/pre-commit
  • src/app/call/layout.tsx
  • src/app/call/page.tsx
  • src/app/call/sessions/[id]/edit/page.tsx
  • src/app/call/sessions/[id]/page.tsx
  • src/app/call/sessions/new/page.tsx
  • src/app/layout.tsx
  • src/components/common/Onboarding/steps/Step4.tsx
  • src/components/common/call/agents-ui/agent-track-toggle.tsx
  • src/components/common/call/agents-ui/blocks/agent-session-view-01/components/agent-session-block.tsx
  • src/components/common/call/app/app.tsx
  • src/components/common/call/app/view-controller.tsx
  • src/components/common/call/session-form.tsx
  • src/components/common/dash/createInterview/fileUpload.tsx
  • src/components/common/dash/liveInterview/apiCall.ts
  • src/lib/livekit/init.ts

Comment thread src/app/call/layout.tsx
Comment thread src/app/call/page.tsx
Comment thread src/components/common/dash/createInterview/fileUpload.tsx
Comment thread src/lib/livekit/init.ts
@Demi-la Demi-la merged commit 15b325a into dev Jun 1, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants