Conversation
- Add Prettier config (no semi, 2-space indent) - Integrate eslint-plugin-prettier + eslint-config-prettier - Add format script: prettier --write . - Apply Prettier formatting Co-authored-by: Cursor <cursoragent@cursor.com>
WalkthroughAdds Prettier code formatter to the monorepo with configuration files, ESLint integration, and applies formatting rules (no semicolons, 2-space indentation) across the codebase. Updates workflow documentation to include agent naming step. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Co-authored-by: Cursor <cursoragent@cursor.com>
…ersal Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
Review feedback addressed (33bb766)Fixed:
|
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
package.json (1)
14-14:formatscript bypasses Turbo — intentional?The previous
formatscript usedturbo run format(leveraging Turbo's caching and workspace-aware execution), while the new script runsprettier --write .directly at the root. This is a reasonable approach for a repo-wide formatter, but it meanspnpm formatwon't benefit from Turbo's caching. Just confirming this is intentional.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 14, The root package.json "format" script currently runs "prettier --write ." which bypasses Turbo caching; if that was not intentional, change the "format" script back to delegate to Turbo (use "turbo run format") so pnpm format benefits from Turbo's workspace-aware caching, otherwise explicitly document/rename the script (e.g., keep "format" for a true repo-wide Prettier pass and add a "format:turbo" or restore "turbo run format") so intent is clear; update the "format" script entry in package.json accordingly and ensure each workspace package still exposes its own "format" task consumed by Turbo.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/ai-orchestrator/src/prompts/registry.mjs`:
- Line 4: PROMPTS_ROOT is currently set with resolve(...) which doesn't follow
symlinks, breaking the later boundary check that uses realpathSync and
startsWith; change the PROMPTS_ROOT initialization to use
realpathSync(resolve(process.cwd(), "../../packages/ai-config/prompts")) so both
PROMPTS_ROOT and the resolved file paths use realpathSync and symlinks are
normalized before the startsWith check in the registry logic.
In `@apps/web/src/app/api/preview/route.ts`:
- Line 7: The redirect query handling is vulnerable to open-redirects: validate
and constrain the redirect before using new URL(redirect, url.origin). Ensure
the value in the redirect variable is an absolute-path-only string
(startsWith("/") and does not contain "//" after the leading slash), and if it
fails validation replace it with a safe default (e.g., "/"); update the code
paths that call new URL(redirect, url.origin) to use this validated/sanitized
redirect (you can extract the logic into a helper like isSafeRedirect or
sanitizeRedirect and reference the redirect variable and the new URL(...)
usage).
---
Nitpick comments:
In `@package.json`:
- Line 14: The root package.json "format" script currently runs "prettier
--write ." which bypasses Turbo caching; if that was not intentional, change the
"format" script back to delegate to Turbo (use "turbo run format") so pnpm
format benefits from Turbo's workspace-aware caching, otherwise explicitly
document/rename the script (e.g., keep "format" for a true repo-wide Prettier
pass and add a "format:turbo" or restore "turbo run format") so intent is clear;
update the "format" script entry in package.json accordingly and ensure each
workspace package still exposes its own "format" task consumed by Turbo.
| import { resolve } from "node:path" | ||
|
|
||
| const PROMPTS_ROOT = resolve(process.cwd(), "../../packages/ai-config/prompts"); | ||
| const PROMPTS_ROOT = resolve(process.cwd(), "../../packages/ai-config/prompts") |
There was a problem hiding this comment.
PROMPTS_ROOT should also be resolved via realpathSync for the boundary check to work correctly.
resolve() does not follow symlinks, but realpathSync(filePath) on Line 13 does. If any path component in ../../packages/ai-config/prompts is a symlink, the resolved file path will differ from PROMPTS_ROOT and the startsWith check on Line 14 will always reject valid prompts.
Proposed fix
-const PROMPTS_ROOT = resolve(process.cwd(), "../../packages/ai-config/prompts")
+const PROMPTS_ROOT = realpathSync(
+ resolve(process.cwd(), "../../packages/ai-config/prompts"),
+)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const PROMPTS_ROOT = resolve(process.cwd(), "../../packages/ai-config/prompts") | |
| const PROMPTS_ROOT = realpathSync( | |
| resolve(process.cwd(), "../../packages/ai-config/prompts"), | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/ai-orchestrator/src/prompts/registry.mjs` at line 4, PROMPTS_ROOT is
currently set with resolve(...) which doesn't follow symlinks, breaking the
later boundary check that uses realpathSync and startsWith; change the
PROMPTS_ROOT initialization to use realpathSync(resolve(process.cwd(),
"../../packages/ai-config/prompts")) so both PROMPTS_ROOT and the resolved file
paths use realpathSync and symlinks are normalized before the startsWith check
in the registry logic.
| const redirect = url.searchParams.get("redirect") ?? "/"; | ||
| const url = new URL(request.url) | ||
| const token = url.searchParams.get("token") | ||
| const redirect = url.searchParams.get("redirect") ?? "/" |
There was a problem hiding this comment.
Pre-existing open redirect risk via the redirect query parameter.
new URL(redirect, url.origin) does not constrain redirect to a relative path — an absolute URL (e.g. https://evil.com) bypasses the origin base entirely, allowing an authenticated attacker to craft a preview link that redirects to an arbitrary domain. Consider validating that redirect starts with / and doesn't contain //.
🛡️ Suggested mitigation
const redirect = url.searchParams.get("redirect") ?? "/"
+ if (!redirect.startsWith("/") || redirect.startsWith("//")) {
+ return NextResponse.json({ error: "invalid_redirect" }, { status: 400 })
+ }Also applies to: 21-21
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/web/src/app/api/preview/route.ts` at line 7, The redirect query handling
is vulnerable to open-redirects: validate and constrain the redirect before
using new URL(redirect, url.origin). Ensure the value in the redirect variable
is an absolute-path-only string (startsWith("/") and does not contain "//" after
the leading slash), and if it fails validation replace it with a safe default
(e.g., "/"); update the code paths that call new URL(redirect, url.origin) to
use this validated/sanitized redirect (you can extract the logic into a helper
like isSafeRedirect or sanitizeRedirect and reference the redirect variable and
the new URL(...) usage).
This was referenced Feb 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add Prettier to lint with config: no semicolons, 2-space indent. Integrates via eslint-plugin-prettier so
pnpm lintruns Prettier checks.Contracts Changed
Regeneration Required
Validation
Resolves #33
Summary by CodeRabbit
Release Notes
New Features
Documentation
Chores