fix: restore clean web validation for make all by yacosta738 · Pull Request #337 · dallay/corvus

yacosta738 · 2026-03-27T18:02:11Z

No description provided.

- Replace window with globalThis across useChat.ts, useGateway.ts, useConfig.ts - Move inner functions to module scope (createSessionId, trimSlashes, etc.) - Replace charCodeAt with codePointAt in useGateway.ts - Refactor nested ternaries in onboarding.ts into helper function - Reduce cognitive complexity in validate-docs-metadata.mjs via extracted helpers - Use String.raw and replaceAll in validate-docs-metadata.mjs - Add explicit return 0 in check-tools.sh - ~41 SonarQube issues resolved

- sandbox.rs: 86→~5 — extract 11 path validation helpers - channels/mod.rs: 67→~7 — extract 8 message processing stage helpers - skills/mod.rs: 31→~5, 36→~8 — extract skill loading and install helpers - scanner.rs: 35→~3 — extract pattern scanning helpers - lockfile.rs: 24→~3 — extract disk reconciliation helpers - telegram.rs: 26→~10 — extract content part building helpers - All 6,132 tests passing, clippy clean, fmt clean

Add the missing @vue/compiler-dom dependency required by Vue component coverage tests and remove a non-null assertion in useConfig so the web workspace passes check and coverage during make all.

coderabbitai · 2026-03-27T18:02:19Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

main
develop

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0dd66874-d79c-463a-abf7-e48bd4178d9f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/sonarqube-code-smells

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…tools-only-integration' into fix/sonarqube-code-smells # Conflicts: # clients/web/pnpm-lock.yaml

…ation

…, and related dependencies

cloudflare-workers-and-pages · 2026-03-27T18:27:14Z

Deploying corvus with Cloudflare Pages

Latest commit:	`d62854a`
Status:	✅ Deploy successful!
Preview URL:	https://a14bf30c.corvus-42x.pages.dev
Branch Preview URL:	https://fix-sonarqube-code-smells.corvus-42x.pages.dev

View logs

github-actions · 2026-03-27T18:28:44Z

✅ Contributor Report

User: @yacosta738
Status: Passed (12/13 metrics passed)

Metric	Description	Value	Threshold	Status
PR Merge Rate	PRs merged vs closed	89%	>= 30%	✅
Repo Quality	Repos with ≥100 stars	0	>= 0	✅
Positive Reactions	Positive reactions received	9	>= 1	✅
Negative Reactions	Negative reactions received	0	<= 5	✅
Account Age	GitHub account age	3073 days	>= 30 days	✅
Activity Consistency	Regular activity over time	108%	>= 0%	✅
Issue Engagement	Issues with community engagement	0	>= 0	✅
Code Reviews	Code reviews given to others	457	>= 0	✅
Merger Diversity	Unique maintainers who merged PRs	2	>= 0	✅
Repo History Merge Rate	Merge rate in this repo	91%	>= 0%	✅
Repo History Min PRs	Previous PRs in this repo	182	>= 0	✅
Profile Completeness	Profile richness (bio, followers)	90	>= 0	✅
Suspicious Patterns	Spam-like activity detection	1	N/A	❌

_{Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-03-27 to 2026-03-27}

coderabbitai

Actionable comments posted: 7

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

clients/agent-runtime/src/skills/sandbox.rs (1)
268-389: ⚠️ Potential issue | 🔴 Critical

Confirm that required Rust validation checks have been run

Per coding guidelines, this PR must run cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test for all code in clients/agent-runtime/, or document which checks were skipped and why. Please confirm the results of running these checks.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@clients/agent-runtime/src/skills/sandbox.rs` around lines 268 - 389, Run the
required validation checks for the agent-runtime crate: from the
clients/agent-runtime directory run `cargo fmt --all -- --check`, `cargo clippy
--all-targets -- -D warnings`, and `cargo test` and fix any failures (formatting
issues, clippy warnings, or failing tests such as those in the tests:: module
referencing validate_tool_paths and build_policy); if you cannot run any of
these, document explicitly which check was skipped and why and include the exact
command output for each check in the PR so reviewers can verify the state.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@clients/agent-runtime/src/channels/mod.rs`:
- Around line 788-797: The helper extract_user_text should prefer the canonical
msg.content before recomputing text from parts to avoid duplicated captions;
change its logic in function extract_user_text to first return msg.content if it
is non-empty, and only call/use msg.text_projection() (and return that) when
msg.content is empty, ensuring you still handle the empty-parts case
consistently.

In `@clients/agent-runtime/src/channels/telegram.rs`:
- Around line 24-60: The caption is only added as a ContentPart::Text inside the
photo/allowed-image-document branches, so non-image captioned attachments
(PDF/video/audio) produce no text part; modify the telegram parsing to push the
extracted caption (the local variable caption) into parts as a ContentPart::Text
unconditionally (e.g., immediately after caption is computed and before
photo/document handling) so captions are always preserved; ensure you keep
existing logic that also adds caption when creating Image parts, update
references in build_document_image_part and anywhere handle_unauthorized_message
expects text so bind/approval hints still fire, and add a regression test that
sends a captioned non-image media (e.g., PDF/video) verifying the caption
appears in parts and unauthorized handling behaves correctly.

In `@clients/agent-runtime/src/skills/lockfile.rs`:
- Around line 194-234: The function reconcile_skill_entry currently reads the
file twice; instead, read the file once into an Option<Vec<u8>> (e.g., let
bytes_opt = std::fs::read(skill_md).ok()), compute current_hash from bytes_opt
once, and then reuse bytes_opt when handling the existing entry (compare
compute_content_hash(&bytes) only if bytes_opt.is_some()); remove the second
std::fs::read call inside the existing branch and use bytes_opt to decide
whether to update existing.content_hash/installed_at or increment
summary.unchanged, and keep using current_hash when creating the new LockEntry
so the code never re-reads the file.

In `@clients/agent-runtime/src/skills/sandbox.rs`:
- Around line 155-158: The warning currently logs the raw incoming path variable
arg via tracing::warn!; change it to avoid emitting raw/untrusted input by
replacing the message with a generic statement (e.g., "cannot canonicalize path
— denying access") and, if you need correlation, log a redacted or stable
fingerprint instead (compute a non-reversible hash or truncate/redact arg and
log that value). Update the tracing::warn! call so it never interpolates arg
directly but uses the redacted/hash string or a constant placeholder.

In `@clients/web/apps/dashboard/src/composables/useConfig.ts`:
- Around line 689-693: The 409 conflict path in saveSection bypasses the
tolerant JSON parser and directly calls response.json(), which can throw on
empty/non-JSON bodies; replace the direct call with the existing tolerant helper
readJsonPayload(response) and then extract fields safely (e.g., const conflict =
(await readJsonPayload(response)) as { fields?: string[] } and keep the
Array.isArray check) so errorMessage.value is set to t("form.restartRequired", {
fields }) when appropriate without throwing.

In `@scripts/validate-docs-metadata.mjs`:
- Around line 218-223: The function collectFrontmatterLinkSlugs treats any
non-http/https target as internal (so mailto: and other schemes are incorrectly
considered internal), causing false orphan detection; update
collectFrontmatterLinkSlugs to use the same external-target guard used elsewhere
by rejecting targets that match a URL scheme (e.g., patterns like
/^[a-zA-Z][a-zA-Z0-9+.-]*:/) or otherwise explicitly checking for common schemes
(mailto:, ftp:, tel:, etc.) before adding to referenced, so only true internal
paths (not scheme-prefixed targets) are normalized and added to the referenced
set.
- Around line 203-207: The current candidate probe (variables resolved,
candidates, existingCandidate using existsSync/statSync) can follow relative
targets outside the intended docsRoot; before iterating candidates or calling
existsSync/statSync, validate that each resolved path stays inside the docsRoot
boundary (e.g., compute path.resolve for the candidate and ensure
path.relative(docsRoot, candidateResolved) does not start with '..' or otherwise
confirm candidateResolved.startsWith(docsRoot + path.sep)); reject or skip any
candidate that fails this containment check to prevent path traversal prior to
filesystem probing.

---

Outside diff comments:
In `@clients/agent-runtime/src/skills/sandbox.rs`:
- Around line 268-389: Run the required validation checks for the agent-runtime
crate: from the clients/agent-runtime directory run `cargo fmt --all --
--check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` and fix
any failures (formatting issues, clippy warnings, or failing tests such as those
in the tests:: module referencing validate_tool_paths and build_policy); if you
cannot run any of these, document explicitly which check was skipped and why and
include the exact command output for each check in the PR so reviewers can
verify the state.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2e56259f-76ef-4a2f-b3d2-769f14397e57

📥 Commits

Reviewing files that changed from the base of the PR and between a0f8b17 and 206dd9c.

⛔ Files ignored due to path filters (1)

clients/web/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (16)

clients/agent-runtime/src/channels/mod.rs
clients/agent-runtime/src/channels/telegram.rs
clients/agent-runtime/src/skills/lockfile.rs
clients/agent-runtime/src/skills/mod.rs
clients/agent-runtime/src/skills/sandbox.rs
clients/agent-runtime/src/skills/scanner.rs
clients/web/apps/chat/package.json
clients/web/apps/chat/src/composables/useChat.ts
clients/web/apps/chat/src/composables/useGateway.ts
clients/web/apps/dashboard/package.json
clients/web/apps/dashboard/src/composables/useConfig.ts
clients/web/package.json
clients/web/packages/shared/onboarding.ts
clients/web/pnpm-workspace.yaml
scripts/check-tools.sh
scripts/validate-docs-metadata.mjs

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Cloudflare Pages

🧰 Additional context used

📓 Path-based instructions (5)

**/*

⚙️ CodeRabbit configuration file

**/*: Security first, performance second.
Validate input boundaries, auth/authz implications, and secret management.
Look for behavioral regressions, missing tests, and contract breaks across modules.

Files:

clients/web/apps/dashboard/package.json
clients/web/pnpm-workspace.yaml
scripts/check-tools.sh
clients/web/apps/chat/package.json
clients/web/package.json
clients/web/apps/chat/src/composables/useChat.ts
clients/web/apps/chat/src/composables/useGateway.ts
scripts/validate-docs-metadata.mjs
clients/web/packages/shared/onboarding.ts
clients/agent-runtime/src/skills/lockfile.rs
clients/agent-runtime/src/skills/sandbox.rs
clients/agent-runtime/src/skills/mod.rs
clients/web/apps/dashboard/src/composables/useConfig.ts
clients/agent-runtime/src/skills/scanner.rs
clients/agent-runtime/src/channels/telegram.rs
clients/agent-runtime/src/channels/mod.rs

clients/agent-runtime/src/**/*.rs

📄 CodeRabbit inference engine (clients/agent-runtime/AGENTS.md)

clients/agent-runtime/src/**/*.rs: Never log secrets, tokens, raw credentials, or sensitive payloads in any logging statements
Avoid unnecessary allocations, clones, and blocking operations to maintain performance and efficiency

Files:

clients/agent-runtime/src/skills/lockfile.rs
clients/agent-runtime/src/skills/sandbox.rs
clients/agent-runtime/src/skills/mod.rs
clients/agent-runtime/src/skills/scanner.rs
clients/agent-runtime/src/channels/telegram.rs
clients/agent-runtime/src/channels/mod.rs

clients/agent-runtime/**/*.rs

📄 CodeRabbit inference engine (clients/agent-runtime/AGENTS.md)

Run cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test for code validation, or document which checks were skipped and why

Files:

clients/agent-runtime/src/skills/lockfile.rs
clients/agent-runtime/src/skills/sandbox.rs
clients/agent-runtime/src/skills/mod.rs
clients/agent-runtime/src/skills/scanner.rs
clients/agent-runtime/src/channels/telegram.rs
clients/agent-runtime/src/channels/mod.rs

**/*.rs

⚙️ CodeRabbit configuration file

**/*.rs: Focus on Rust idioms, memory safety, and ownership/borrowing correctness.
Flag unnecessary clones, unchecked panics in production paths, and weak error context.
Prioritize unsafe blocks, FFI boundaries, concurrency races, and secret handling.

Files:

clients/agent-runtime/src/skills/lockfile.rs
clients/agent-runtime/src/skills/sandbox.rs
clients/agent-runtime/src/skills/mod.rs
clients/agent-runtime/src/skills/scanner.rs
clients/agent-runtime/src/channels/telegram.rs
clients/agent-runtime/src/channels/mod.rs

clients/agent-runtime/src/channels/**/*.rs

📄 CodeRabbit inference engine (clients/agent-runtime/AGENTS.md)

Implement Channel trait in src/channels/ with consistent send, listen, and health_check semantics and cover auth/allowlist/health behavior with tests

Files:

clients/agent-runtime/src/channels/telegram.rs
clients/agent-runtime/src/channels/mod.rs

🧠 Learnings (7)