feat(evi): attested one-call before/after capture tool - #534
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
4 Skipped Deployments
|
|
|
Warning Review limit reached
Next review available in: 9 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe PR adds an authorized ChangesBefore-after capture workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Session
participant capture__before_after
participant Browser
participant BlobStorage
Session->>capture__before_after: authorize and register tool
capture__before_after->>Browser: navigate and capture before and after frames
Browser-->>capture__before_after: image frames
capture__before_after->>BlobStorage: upload validated public images
BlobStorage-->>capture__before_after: hosted image URLs
capture__before_after-->>Session: Markdown and attestation receipt
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Thank you for following the naming conventions! 🙏 |
e1637b6 to
92dfb03
Compare
92dfb03 to
4c326a9
Compare
4c326a9 to
bf63d1c
Compare
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/evi/agent/lib/capture.ts`:
- Around line 55-74: Update captureMarkdown and captureAttestation to sanitize
all Markdown/HTML-bound values: normalize beforeImageUrl and afterImageUrl
before embedding them as image links, convert caption to one-line plain text and
escape Markdown-sensitive content, and escape attestation fields including
selector before placing them inside <sub>. Reuse existing normalization or
escaping utilities if available, and ensure raw input URLs and line breaks
cannot create additional sections or HTML.
In `@apps/evi/agent/tools/capture.ts`:
- Around line 59-77: Update the capture flow in execute and its upload path via
hostFrame to enforce the public-image boundary: require trusted approval before
uploading captures of sensitive route classes, or reject those routes unless the
source is a sanitized demo environment. Preserve the existing authorization
check, and ensure no successful sensitive capture can reach the access: 'public'
upload without this validation.
In `@apps/evi/evals/contributing/visual-evidence.eval.ts`:
- Around line 9-11: Update the closedQA criterion in the visual-evidence
evaluation to require the attestation receipt in addition to the
capture__before_after tool or before-after skill flow and hosted before/after
screenshots. Keep the existing visual evidence requirements while rejecting
answers that omit the receipt.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 71ce68d5-2fbe-4985-882d-32e424aebcdf
📒 Files selected for processing (6)
apps/evi/agent/extensions/browser.tsapps/evi/agent/lib/capture.test.tsapps/evi/agent/lib/capture.tsapps/evi/agent/skills/before-after/SKILL.mdapps/evi/agent/tools/capture.tsapps/evi/evals/contributing/visual-evidence.eval.ts
1 participant
Stacked on #533. Collapses the multi-step capture flow into one authored tool and makes the visual evidence unfakeable.
capture__before_after
One call per comparison: opens both URLs in the sandbox Chromium (via
runAgentBrowser), waits the 5s settle, screenshots cropped to the selector, validates the bytes (magic numbers + trailers, shared withblob__upload_image), uploads both frames to the Blob store, and returns the finished markdown — table, caption, and an attestation receipt naming the compared URLs, viewport, frame, and timestamp.Trust properties:
agent/lib/capture.ts(single source). Gated to maintainer/schedule sessions, re-resolved per turn.Skill
before-aftershrinks to: start the dev server early, review sensitive surfaces first (public-the-instant-it-runs caveat), find the selector, one tool call, paste the returned markdown verbatim — the receipt is never stripped.Eval
contributing/visual-evidencepins that visual proof flows through the tool.Latency: replaces ~8 sequential model round-trips with one tool call.
No changeset: confined to
apps/evi. Verified:tsc, 44 unit tests,eve build. End-to-end capture validates on the preview deployment.Summary by CodeRabbit
New Features
Bug Fixes
Tests