feat(assistant): improve core chat interactions - #289
Conversation
|
Warning Review limit reached
Next review available in: 22 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (9)
📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe PR adds assistant answer feedback, stable streamed message IDs, server-provided starter prompts, actor-scoped draft persistence, feedback actions, retry behavior, API documentation, database migration, and automated coverage. ChangesAssistant feedback and message identity
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant AssistantPage
participant AssistantController
participant AssistantConversationService
participant AssistantAnswerFeedbackRepository
AssistantPage->>AssistantController: submit chat request
AssistantController->>AssistantConversationService: persist completed turn with messageId
AssistantController-->>AssistantPage: stream start frame with messageId
AssistantPage->>AssistantController: set or delete answer feedback
AssistantController->>AssistantConversationService: validate actor and message ownership
AssistantConversationService->>AssistantAnswerFeedbackRepository: save or delete feedback
AssistantAnswerFeedbackRepository-->>AssistantController: feedback result
AssistantController-->>AssistantPage: AssistantAnswerFeedbackView
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
TegamiThis repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under Create a changelog → · Changelog format Release preview
Changelogs in this PR
Run Managed by Tegami. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@core/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java`:
- Around line 136-149: Serialize mutations in setAnswerFeedback and
deleteAnswerFeedback by locking the owned assistant-message row before reading
or modifying AssistantAnswerFeedback, using the repository’s existing
pessimistic-locking approach where available. Ensure concurrent set/set and
set/delete operations cannot race on the message_id feedback row or `@Version`
update, and add PostgreSQL integration tests covering both concurrency
scenarios.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1cbd1781-360c-48fe-9148-9269e5a0a3fc
⛔ Files ignored due to path filters (11)
apps/docs/generated/openapi.public.jsonis excluded by!**/generated/**contracts/openapi.jsonis excluded by!contracts/openapi.jsondocs/increments/active/2026-08-04-assistant-interaction-foundation/challenge-brief.mdis excluded by!docs/**docs/increments/active/2026-08-04-assistant-interaction-foundation/challenge-verdict.mdis excluded by!docs/**docs/increments/active/2026-08-04-assistant-interaction-foundation/design.mdis excluded by!docs/**docs/increments/active/2026-08-04-assistant-interaction-foundation/plan.mdis excluded by!docs/**docs/increments/active/2026-08-04-assistant-interaction-foundation/reference-study.mdis excluded by!docs/**docs/increments/active/2026-08-04-assistant-interaction-foundation/verification.mdis excluded by!docs/**docs/roadmap.mdis excluded by!docs/**docs/specs/domains/assistant-and-mcp.mdis excluded by!docs/**docs/tests/domains/assistant-and-mcp.mdis excluded by!docs/**
📒 Files selected for processing (23)
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javaapps/docs/content/docs/reference/api-reference/assistant.mdxapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/assistant-draft-storage.tsapps/web/src/features/assistant/components/assistant-conversation-list.tsxapps/web/src/features/assistant/components/assistant-page.tsxapps/web/src/features/assistant/hooks/use-assistant-draft.tsapps/web/src/features/session/logout.tsapps/web/test/e2e/assistant-pipeline.spec.tscore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedback.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackRepository.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackView.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerSentiment.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessage.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageRepository.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageView.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javacore/src/main/resources/db/migration/V21__assistant_answer_feedback.sqlcore/src/test/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackMigrationTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Web · Node 24
- GitHub Check: PostgreSQL GraphRAG
- GitHub Check: Backend · Java 25
- GitHub Check: Public docs · Node 24
🧰 Additional context used
📓 Path-based instructions (10)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keepddl-auto=validateand pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, andbootRunis not verification.
Files:
core/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageView.javaapps/web/src/features/session/logout.tscore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerSentiment.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackRepository.javaapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedback.javaapps/web/src/features/assistant/hooks/use-assistant-draft.tscore/src/main/resources/db/migration/V21__assistant_answer_feedback.sqlapps/web/src/features/assistant/components/assistant-conversation-list.tsxcore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessage.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackView.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageRepository.javaapps/docs/content/docs/reference/api-reference/assistant.mdxapps/web/src/features/assistant/assistant-draft-storage.tsapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javaapps/web/test/e2e/assistant-pipeline.spec.tsapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javaapps/web/src/features/assistant/components/assistant-page.tsxcore/src/test/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackMigrationTests.java
**/*.java
📄 CodeRabbit inference engine (AGENTS.md)
Apply IDE inspection only to edited backend Java files.
Files:
core/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageView.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerSentiment.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackRepository.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedback.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessage.javacore/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackView.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageRepository.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javacore/src/test/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackMigrationTests.java
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Extend the established OrgMemory product shell, design tokens, shadcn/Radix primitives, and existing layout patterns; do not introduce a separate visual system in the web application.
Generate ordinary REST clients fromcontracts/openapi.jsonusing Hey API.
Use TanStack Query for server state, TanStack Router for navigation, and limit Zustand to durable or high-frequency UI state.
Preserve keyboard accessibility, light/dark theme support, loading and error states, and responsive behavior in the web application.
Files:
apps/web/src/features/session/logout.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/hooks/use-assistant-draft.tsapps/web/src/features/assistant/components/assistant-conversation-list.tsxapps/web/src/features/assistant/assistant-draft-storage.tsapps/web/test/e2e/assistant-pipeline.spec.tsapps/web/src/features/assistant/components/assistant-page.tsx
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it.
Files:
apps/web/src/features/session/logout.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/hooks/use-assistant-draft.tsapps/web/src/features/assistant/components/assistant-conversation-list.tsxapps/web/src/features/assistant/assistant-draft-storage.tsapps/web/test/e2e/assistant-pipeline.spec.tsapps/web/src/features/assistant/components/assistant-page.tsx
apps/web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
apps/web/src/features/session/logout.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/hooks/use-assistant-draft.tsapps/web/src/features/assistant/components/assistant-conversation-list.tsxapps/web/src/features/assistant/assistant-draft-storage.tsapps/web/src/features/assistant/components/assistant-page.tsx
apps/web/**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
Preserve the existing browser test suite when changing the web application.
Files:
apps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/test/e2e/assistant-pipeline.spec.ts
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: The repository is pre-release: V1 is the intentionally resettable clean
baseline and development data carries no migration cost. Once a release
baseline is frozen, later Flyway migrations are immutable. Check tenant
isolation, foreign keys, uniqueness, indexes, append-only evidence
semantics, safe defaults, and PostgreSQL 18 plus pgvector compatibility.
Files:
core/src/main/resources/db/migration/V21__assistant_answer_feedback.sql
apps/docs/content/docs/**/*.{md,mdx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only inapps/docs/content/docs; internal engineering documents are source evidence, not publication input.
sourceRefsis build-time traceability metadata and must never be rendered in published content.
Draft pages must remain excluded unlessDOCS_INCLUDE_DRAFTS=trueis set for a local or controlled preview.
Files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
apps/docs/content/docs/**/*.mdx
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Use
index.mdxfor a section root and<slug>.mdxfor a named English page; add Vietnamese pages individually as adjacentindex.vi.mdxor<slug>.vi.mdxfiles, using the/vi/docs/...route.
Files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
🧠 Learnings (6)
📚 Learning: 2026-08-02T08:30:57.335Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 270
File: core/src/main/java/com/orgmemory/core/assetregistry/AssetDraftRepository.java:15-23
Timestamp: 2026-08-02T08:30:57.335Z
Learning: For OrgMemory JPA repository methods using `PESSIMISTIC_WRITE`, do not add a finite lock-timeout hint as part of a behavior-preserving refactor. The V1 PostgreSQL configuration uses `lock_timeout = 0`; any finite lock timeout must be established as a platform-wide database and transaction policy rather than configured on an individual method.
Applied to files:
core/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackRepository.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageRepository.java
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
📚 Learning: 2026-07-23T23:30:44.585Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 30
File: core/src/main/resources/db/migration/V32__evidence_scoped_graph_semantics.sql:0-0
Timestamp: 2026-07-23T23:30:44.585Z
Learning: For OrgMemory PostgreSQL Flyway migrations under core/src/main/resources/db/migration, do not recommend using `CREATE INDEX CONCURRENTLY` or `DROP INDEX CONCURRENTLY` inside application-owned Flyway migration SQL. Flyway’s schema-history connection may hold a transaction that can cause concurrent index operations to wait indefinitely (e.g., on a `virtualxid`), and docs/conventions.md forbids this pattern. If you need large production-table index replacement, pre-stage online index operations via the deployment pipeline (outside Flyway) rather than inside the migration; “ordinary” index replacement is acceptable for unreleased projections before production traffic.
Applied to files:
core/src/main/resources/db/migration/V21__assistant_answer_feedback.sql
📚 Learning: 2026-07-28T20:06:14.930Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/administration.mdx:11-11
Timestamp: 2026-07-28T20:06:14.930Z
Learning: In OrgMemory public documentation MDX files, ensure any `lastReviewed` dates are set using the repository project timezone `Asia/Bangkok`, not the reviewer’s local timezone or the runtime/build timezone. When generating or updating API-reference pages, intentionally use the exact same `lastReviewed` date convention as the authored public documentation pages to keep timestamps consistent across both sources.
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-28T20:06:15.064Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/authentication.mdx:12-12
Timestamp: 2026-07-28T20:06:15.064Z
Learning: In OrgMemory docs/tests that describe date-based review checks, treat the project timezone as Asia/Bangkok for all “date” comparisons/validations. Do not assume UTC when interpreting or validating fields like `lastReviewed`. For example, `lastReviewed: '2026-07-29'` should be considered valid when the effective “current date” in Asia/Bangkok is July 29, 2026 (not merely when the UTC date matches).
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-30T06:46:08.031Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 144
File: apps/docs/public-content.manifest.json:13-67
Timestamp: 2026-07-30T06:46:08.031Z
Learning: For the Fumadocs docs portal under apps/docs, follow the expected MDX filename conventions that drive section-root vs named-page routing. Use `index.mdx` for English section-root pages and `<slug>.mdx` for named pages. For Vietnamese, use adjacent locale-suffixed files: `index.vi.mdx` for section roots and `<slug>.vi.mdx` for named pages. Do not require or enforce a `page.mdx` filename; doing so would change/break the intended section-root route structure.
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
🪛 SQLFluff (4.2.2)
core/src/main/resources/db/migration/V21__assistant_answer_feedback.sql
[error] 23-26: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
🪛 Squawk (2.61.0)
core/src/main/resources/db/migration/V21__assistant_answer_feedback.sql
[warning] 2-3: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 2-3: Adding a UNIQUE constraint requires an ACCESS EXCLUSIVE lock which blocks reads and writes to the table while the index is built. Create an index CONCURRENTLY and create the constraint using the index.
(disallowed-unique-constraint)
[warning] 9-9: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
🔇 Additional comments (24)
core/src/main/java/com/orgmemory/core/assistant/AssistantAnswerSentiment.java (1)
3-6: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackView.java (1)
6-10: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedback.java (1)
14-67: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackRepository.java (1)
8-12: LGTM!core/src/main/resources/db/migration/V21__assistant_answer_feedback.sql (1)
1-26: LGTM!core/src/test/java/com/orgmemory/core/assistant/AssistantAnswerFeedbackMigrationTests.java (1)
18-132: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessage.java (1)
43-50: LGTM!Also applies to: 61-66
core/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageView.java (1)
6-13: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantConversationMessageRepository.java (1)
5-5: LGTM!Also applies to: 17-23
core/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java (1)
4-5: LGTM!Also applies to: 21-31, 52-52, 63-74, 113-129, 175-186
core/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.java (1)
13-13: LGTM!Also applies to: 32-33, 47-47, 105-190, 210-218, 232-239, 258-259
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java (1)
4-5: LGTM!Also applies to: 16-16, 32-32, 46-58, 91-91, 106-109, 119-119, 129-166
apps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.java (1)
20-25: LGTM!Also applies to: 65-69
apps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.java (1)
5-26: LGTM!Also applies to: 36-49, 51-89, 91-142
apps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.java (1)
7-7: LGTM!Also applies to: 16-17, 34-34, 43-44, 59-63, 79-79, 99-99
apps/docs/content/docs/reference/api-reference/assistant.mdx (1)
18-23: LGTM!Also applies to: 64-66, 77-80, 109-110, 127-127
apps/web/src/features/assistant/assistant-draft-storage.ts (1)
1-62: LGTM!apps/web/src/features/assistant/assistant-draft-storage.test.ts (1)
1-40: LGTM!apps/web/src/features/assistant/hooks/use-assistant-draft.ts (1)
1-36: LGTM!apps/web/src/features/assistant/components/assistant-page.tsx (2)
2-13: LGTM!Also applies to: 45-61, 221-227, 277-301, 326-337, 368-377, 389-400, 412-412, 480-483, 500-512, 561-594, 620-620
303-311: 🔒 Security & PrivacyInformation Disclosure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor
Verify that an actor change clears local conversation state.
If
actorKeychanges without a full page reload, the early return preservesmessages,feedbackByMessage, andsourcePanelwhenconversationIdstays unchanged. Actor-scoped query keys do not clear this component-local state.Track
actorKeyin the reset scope. Clear the previous actor's state before the new history request renders. Add a browser test that changes the actor while retaining the conversation URL.Proposed reset change
+ const actorKeyRef = useRef(actorKey) + useEffect(() => { - if (conversationIdRef.current === conversationId) return + const actorChanged = actorKeyRef.current !== actorKey + if (!actorChanged && conversationIdRef.current === conversationId) return stop() + actorKeyRef.current = actorKey conversationIdRef.current = conversationId locallyCreatedConversationRef.current = undefined setSourcePanel(null) setFeedbackByMessage({}) setMessages([]) - }, [conversationId, setMessages, stop]) + }, [actorKey, conversationId, setMessages, stop])#!/bin/bash set -euo pipefail # Verify whether actorKey can change while AssistantPage remains mounted. rg -n -C 5 '\bactorKey\b|<AssistantPage\b' apps/web/src apps/web/testapps/web/src/features/assistant/components/assistant-conversation-list.tsx (1)
33-33: LGTM!Also applies to: 78-78
apps/web/src/features/session/logout.ts (1)
23-27: LGTM!apps/web/test/e2e/assistant-pipeline.spec.ts (1)
6-16: LGTM!Also applies to: 25-33, 88-151, 174-175, 317-414, 416-430, 464-464, 475-492
|
Addressed the review hardening findings in cb05dfc: feedback set/set and set/delete mutations now serialize on the owned assistant-message row, and an in-place actor change synchronously hides then clears the prior transcript, feedback state, and source panel. Added PostgreSQL concurrency tests and a browser regression with the replacement actor history held pending. Focused backend tests, 65 web unit tests, production build, and the 11-scenario assistant Playwright pipeline all pass. |
1 participant
Summary
Verification
Evidence:
./gradlew.bat --no-daemon clean test(108 tasks)JetBrains inspection was unavailable; successful Java compile and the full Gradle suite are the documented project fallback. The local Node 23.11.1 runtime produced the repository's Node >=24 engine warning, but all web/docs gates completed.
Documentation impact
apps/docs, or this change has no reader-visible product/API/UI/deployment behavior.Generated public Assistant API reference, the Assistant domain spec/test matrix, roadmap, active design, challenge verdict, reference study, and verification evidence are updated.
Summary by CodeRabbit
New Features
Bug Fixes