Repository navigation
Add source chat commands and improve document chat - #152
Conversation
…g of intermittent summaries.
…arXiv, use abstract to get metadata.
-feat(Import): add `Web Import` dialog for importing multiple URLs at a time
… avoid causing issues with the API.
…tutor. feat(Chat): add a "loading" indicator to Chat tab in Source, allowing the user to switch tabs and still know when the Chat has completed. refactor: Centralize control of Chat services to avoid duplicate work in multiple components. style: fix an issue where the project tree would change sizes mid-render, making it look clunky. style: update appearance of Inbox. style: Fix a rendering issue where visual artifacts would display intermittently when a source dialog was maximized.
…ith Source chatting, and a few superfluous prompts.
…does not end in the .pdf extension.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const limitedChunks = this.tokenizerUtils.chunkLimitText.bind( | ||
| this.tokenizerUtils | ||
|
|
||
| text = limited(text.replace("\n", " "), messageTokens + 400).replace( |
| const limitedChunks = this.tokenizerUtils.chunkLimitText.bind( | ||
| this.tokenizerUtils | ||
|
|
||
| text = limited(text.replace("\n", " "), messageTokens + 400).replace( |
| content: `Existing Projects: | ||
| === | ||
| ${choices} | ||
| ===`, |
| content: `Source:\n===\n${this.tokenizerUtils.limitText( | ||
| input, | ||
| 500 | ||
| )}\n===`, |
| }, | ||
| { | ||
| role: "system", | ||
| content: `Categories:\n===\n${choices.join("\n")}\n===`, |
| }, | ||
| { | ||
| role: "system", | ||
| content: `The Source is titled "${req.body.source.title}".`, |
| }, | ||
| { | ||
| role: "system", | ||
| content: "The Source is titled " + source.title + ".", |
| export class SourceParser { | ||
| static async isPdf(url: string) { | ||
| try { | ||
| const response = await fetch(url, { method: "HEAD" }); |
| getRouter() { | ||
| router.post( | ||
| "/quiz", | ||
| this.projectController.quiz.bind(this.projectController) |
RobRoyce
left a comment
RobRoyce
left a comment
There was a problem hiding this comment.
Focused integration review of PR #152 at b3bf12349a0f0b8060314efc419874cf2d5b1070.
No confirmed blocking finding in the combined revival stack. The independent code review checked storage writes, schema migration, managed files, backup/restore, local authentication, session recovery, Electron startup, and dependency removal. Main's conflicts were resolved without downgrading the stack's dependencies. All original commits are preserved.
Validation on the combined stack at 6ee979b2615db242ca6525bb7d0ccc36d563479f, using Node.js 24.21.0 in an isolated checkout:
- Clean immutable dependency install: passed.
- Development build and storage type check: passed.
- Unit tests: 8 passed.
- Storage tests: 35 passed.
- Hidden-window desktop tests: 4 passed.
- Headless Chrome tests: 6 passed.
- Unsigned production package and packaged workflow: passed (1 test).
Each historical intermediate branch was not rebuilt independently. Signing, live AI credentials, other operating systems, and broad dependency security auditing are outside this review.
This is a review record submitted through the PR author's account, not the independent approving review required by main's branch protection. CodeQL status is reported separately by GitHub.
|
CodeQL result clarification before integration: the analysis jobs succeeded, but the separate results check reports 21 new alerts on the legacy base PR (3 critical and 18 high). Successful analysis is not a clean security result. A focused review of final stack commit 6ee979b found no additional merge blocker for the current local desktop scope. Later commits bind chat to an ephemeral loopback port and require a random bearer token before parsing requests. Storage, migration, and restore validate record IDs. The model has no filesystem or network execution tools. Residual risks remain and are not dismissed as false positives: URL fetching can reach private networks through user-selected URLs or redirects; legacy file metadata from an untrusted backup can cause local file reads; chat cache paths need their own ID validation; source text and summaries appear in system messages; authenticated workloads lack rate limits. These require focused hardening during backend extraction, before hosted or multi-user use. Authentication does not make imported records trustworthy. The merge uses the repository owner's explicit administrator-override authorization. Alerts remain open and branch protection remains unchanged. The 54 passing functional tests do not constitute a security certification. |
2 participants
Add quiz, categorization, topic, and tutor commands to source and project chat. Improve document loading, summarization, metadata editing, and chat presentation.
This legacy branch is the foundation for the revival stack. Main is now included. The conflict resolution preserves the stack's newer axios and follow-redirects versions and main's README changes.
This is the first PR in the stack. Merge the stack in order with merge commits, retargeting each next PR to main after its predecessor lands. Do not squash or delete intermediate branches during integration.
Validation on the combined stack at
6ee979b2615db242ca6525bb7d0ccc36d563479f, using Node.js 24.21.0 in an isolated checkout:Each historical intermediate branch was not rebuilt independently. Signing, live AI credentials, other operating systems, and broad dependency security auditing are outside this review.
Focused review found no confirmed blocker in the combined stack. The review covers basic workflows, data preservation, authentication, and the dependency changes. Broader modernization remains separate work.