Repository navigation
Conversation
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Important Review skippedWe couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting You can disable this status message by setting the Use the checkbox below for a quick retry:
Summary by CodeRabbit
WalkthroughThe PR adds clinical calculators and medication notation, changes clinical-text chunking and RAG query handling, and updates query-storage privacy, cache behavior, test cleanup, page markup, PDF resource handling, therapy catalogue content, and audit documentation. ChangesClinical calculations and medication notation
RAG and query-data safeguards
Cache, test, and PDF resource handling
Page landmarks and browser test waits
Therapy catalogue content and assets
Repository audit and remediation records
Priority: ➖ Normal Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 27.03% which is insufficient. The required threshold is 70.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 37 functions across 33 files. (10 skipped… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
| Verification Claims |  |
The visible verification section names each test file and reports results, and it gives the TypeScript, formatting, and static-guard checks with outcomes. However, the supplied PR description is trunc… | Provide the complete, untruncated PR description, including the remainder of its generated summary, so all verification claims can be checked against the required command/check and result wording. |
| Supabase Project And Schema Safety | |
The review-scoped base and head refs are unavailable in this checkout, so I could not inspect the authoritative PR diff. The supplied change summary lists no Supabase project configuration, migration,… | Provide the review base/head refs or the complete PR diff. Then verify all changed files for Supabase project refs, migrations, schema/data changes, RLS or policy changes, and production database behavior; check any applicable migration pat… |
-
Check name Status Explanation Title check The title clearly identifies the main change: repository audit remediation across three phases. Description check The description includes the required Summary, Verification, Risk and rollout, and Notes sections. It lists affected areas and RAG impact, reports checks, and states risk, rollback, and provider effec… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Generated And Sensitive Files No explicit sensitive-file condition is introduced. The changed-file inventory contains no .envfile, credential file, log, cache, dependency tree, build output, browser artifact, database dump, or …Risky Git Or Deployment Actions No changed instructions recommend force-push, hard reset, destructive clean, branch deletion, rebasing shared branches, production data mutation, or deployment without confirmation. The audit plan req… Runtime And Package Manager Integrity The PR preserves the established npm and runtime policy. The package.json and lockfile/configuration diff is empty. At both base and head, package.json specifies npm@11.17.0 and Node >=24.15.0 <25 wit… Api Route Failure Handling No changed code introduces an API failure-handling gap. The PR changes RAG query serialization and cache versioning, plus cache helpers; it does not change the answer API route handlers. The RAG path …
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 27.03% which is insufficient. The required threshold is 70.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 37 functions across 33 files. (10 skipped: 10 unsupported.)
Full details: Verification Claims
-
Explanation
The visible verification section names each test file and reports results, and it gives the TypeScript, formatting, and static-guard checks with outcomes. However, the supplied PR description is truncated, and the remaining text may contain additional verification claims. The review-scoped base/head refs are also unavailable in this checkout, so I could not inspect the full changed text.
Full details: Supabase Project And Schema Safety
-
Explanation
The review-scoped base and head refs are unavailable in this checkout, so I could not inspect the authoritative PR diff. The supplied change summary lists no Supabase project configuration, migration, schema, or RLS files, but it cannot confirm the complete changed-file set or rule out database-impacting changes. I cannot verify whether this check’s failure conditions were introduced.
Resolution
Provide the review base/head refs or the complete PR diff. Then verify all changed files for Supabase project refs, migrations, schema/data changes, RLS or policy changes, and production database behavior; check any applicable migration path, rollback/safety plan, and verification.
✨ Finishing Touches
-
✨ Simplify code
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
PR Summary by QodoHarden clinical safety, RAG, privacy, and repository reliability
AI Description
Diagram
High-Level Assessment
Files changed (42)
|
🏁 CodeAnt Quality Gate ResultsCommit: ❌ Overall Status: FAILEDQuality Gate Details
View Failure Result🔐 Secrets — 1 findings
|
Merging this PR will improve performance by ×3
Performance Changes
Tip Curious why performance improved? Comment Comparing 
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
codeant-ai
Bot
added
the
size:XXL
Code Review by Qodo
1. Partial eval totals omit unseen cases
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
- Reject non-finite clinical inputs - Reject unsafe lithium dose targets - Reject pediatric adult-equation estimates
- Align Tall Man lettering - Apply Tall Man lettering in displays - Restrict Tall Man registry lookups
Qodo Fixer✅ Committed (9) · ☑ Fixed (9) Commits pushed directly to this PR — no separate fix PR opened. Process — 9 fixed
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1bdb79e734
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
CodeAnt Nitpicks4 code suggestions1. If an aborted entry is replaced before its promise settles, this unconditional delete removes the new same-key flight, breaking deduplication for later callers.Race condition · 2.
|
|
No code changes since the last review — review skipped |
CI failed: Three CI error templates across 157 logs point to tooling and infrastructure issues: a strict design-system check failing on arbitrary font sizes (relation to this PR unclear), a Supabase drift-manifest mismatch, and a bundle-budget route regression; none are clearly caused by the PR's diff.OverviewThree unique error templates were found across 157 logs for commit d131594. Each template is consistent with a tooling or CI-check failure rather than a compile or runtime break, and the supplied findings do not link any failure directly to the PR's changes. FailuresStrict design-system check: arbitrary font sizes present (confidence: high)
Supabase drift manifest is stale (confidence: high)
Bundle budget regression on one route (confidence: medium)
Summary
Code Review 👍 Approved with suggestions 9 closed / 11 findings🔴 High risk · New proxy/indexing authorization and teaching-table RLS/write policies govern access to sensitive records; mistakes could permit unauthorized disclosure or mutation. Adds clinical calculators, Tall Man lettering, RAG query delimiting, chunk negation preservation, and query PII scrubbing, with proxy auth and on-call safe-number fixes resolved. Approved with suggestions: a late save can mark the note "saved" while newer edits remain unsaved in 💡 Bug: A late save marks the note "saved" even though newer edits haven't saved📄 src/components/clinical-notes/note-editor.tsx:101-109 📄 src/components/clinical-notes/note-editor.tsx:118-132 📄 src/components/clinical-notes/note-editor.tsx:148-153 The sequence number only goes up when a save starts, not on each keystroke. Say save A (text X) is in flight and the user types Y. Invalidate in-flight saves on every edit so a late completion cannot report the note as saved💡 Edge Case: Overlapping BarcodeDetector calls can submit the same check-in twice📄 src/components/teaching/qr-check-in-helper.tsx:152-166
Allow one detection at a time and ignore results from a stopped scan✅ 9 closed✅ Bug: Prohibition lookback regex matches the whole window, not the last sentence
✅ Bug: Stray
|
| Auto-apply | Compact |
|
|
Important
Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.
Was this helpful? React with 👍 / 👎 | Gitar
|
Closing in favour of #3538, which carries the same audit remediation and fixes (including the review threads still open here). Closed at the owner's direction. Generated by Claude Code |
Pull request was closed
…ds_review (owner decision 13 Oct 10:23 PM AWST) Ported from #3510 (eddedf4) onto this branch's own data: the status change was applied to src/data/therapies-source.json and the hashed catalogue files, index, asset list and site-content baseline were regenerated with the repo's own generators, not copied across. No re-signing; old sign-off hashes and dates are cleared. Sign-off pins: therapy 48 -> 53, signable 22 -> 27. New test pins the needs_review state. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KpmSAVMAELX796AzEujHSw
…ed from #3510) planRequestBatch now orders adds first, so a close/update whose UUID sorts before the add that creates its issue no longer aborts the batch. Test: 'pending add ordering'. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KpmSAVMAELX796AzEujHSw
…rust derivation (ported from #3510) Exports deriveTrust from answer-render-policy and uses it in the recalculation script, replacing a duplicate that ignored source backing, faithfulness warnings, unverified numbers and evidence-gap mode and could label stronger than the app renders. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KpmSAVMAELX796AzEujHSw
User description
Summary
This pull request implements comprehensive remediation across all three phases of the repository audit, spanning clinical math accuracy, medication safety, memory isolation, RAG prompt protection, and privacy controls.
TS-01: Vitest node environment mock isolation intests/setup/node.setup.ts.MEM-01&MEM-02: Bounded LRU cache eviction and falsy key safety insrc/lib/bounded-ttl-cache.ts,src/lib/openai.ts, andsrc/lib/signed-url-cache.ts.CS-001: Dedicated psychiatric clinical math modules insrc/lib/calculators/clinical-math/(renal Cockcroft-Gault/eGFR, QTc prolongation formulas Bazett/Fridericia/Hodges/Framingham, and lithium 12h trough evaluation).CS-002: Australian ACSQHC/ISMP Tall Man lettering module insrc/lib/medications/tall-man.tsfor look-alike/sound-alike psychotropics (cloZAPine/cloNIDine, etc.).CHK-01: Chunk boundary clinical negation preservation insrc/lib/chunking.ts(preservesDO NOT,CONTRAINDICATED,NEVER,AVOID,WITHHOLDacross chunk overlaps).INJ-01: RAG user query sanitization & delimiter wrapping (<user_query>) insrc/lib/rag/rag.tsandsrc/lib/rag/rag-cache.tscache key versioning.TS-02: Replaced arbitrarypage.waitForTimeoutsleeps with condition-basedexpect.pollintests/ui-chrome-scroll.spec.ts.PY-01: PyMuPDF document handle deterministic reclamation viatry...finally: document.close()inworker/python/extract_pdf_assets.py.LOG-01/SEC-03: Incidental Australian Medicare number, phone number, and hospital MRN scrubbing insrc/lib/query-privacy.ts.Areas touched: Answer engine, Knowledge and records, Clinical reference content, Data platform and access, Source intake and indexing, App experience, Delivery and assurance (plus 4 files not yet placed in any area)
RAG impact: no retrieval behaviour change — prompt delimiter hardening and negation boundary preservation only
Verification
tests/clinical-math-calculators.test.ts(14/14 passed)tests/tall-man-lettering.test.ts(10/10 passed)tests/chunking-negation.test.ts(passed)tests/rag-prompt-injection.test.ts(passed)tests/bounded-ttl-cache.test.ts(passed)tests/privacy.test.ts(passed)tests/setup-node.test.ts(passed)tsc -p tsconfig.typecheck.json(0 errors)npm run format:changed(clean)guard-push.mjs(0 errors)Risk and rollout
1bdb79e734.Notes
docs/audit/full-repository-audit-2026-10-11.md.Summary by cubic
Implements the full-repository audit remediation across phases 1, 2, and 3: clinical math safety, medication and RAG prompt hardening, cache memory bounds, privacy, accessibility, and database security, with tests for each fix.
Behavior changes
<user_query>delimiters in both the legacy and adaptive answer prompts; only the prompt's own delimiters are stripped, so a raw<like "<5 mg" survives. The answer fingerprint includes a query serialization version, so cached answers are not reused.CHUNKER_VERSIONby a version ratchet test./api/proxyverifies onlyPROXY_AUTH, refuses the service-role key, and fails closed using a dedicated claim signing key. Control-plane tables getFORCE ROW LEVEL SECURITY, anonymous rate-limit subject keys are salted with a 7-day retention purge, and eval summaries report counts only while ledger intents reconcile so pending adds land before their target mutations./mockupsto/admin/developer-hub(with redirects), and dev scripts raise the Node heap cap.finally, registers a global Node test setup that restores mocks and globals between cases, and replaces fixed scroll waits with condition polling.<main>landmarks to the DSM and First Nations layouts without duplicating the shell's#main-contentid, and replaces chat-import wording in therapy descriptions with regenerated catalogue data that resets unsupported review claims. The site-content owner manifest points at the regenerated hashed therapy assets so CI scope checks pass, and catalogue responses carry a private cache.Written for commit d131594. Summary will update on new commits.
CodeAnt-AI Description
Add clinical safety safeguards to calculations, medication displays, and answers
What Changed
Impact
✅ Fewer unsafe adult-equation estimates for children✅ Clearer distinction between look-alike medicines✅ Less risk of exposed query identifiers💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by Gitar
/api/proxyaccepts onlyPROXY_AUTHand fails closed with 503 when unsetPROXY_AUTH_SIGNING_KEY, neverPROXY_AUTHThis will update automatically on new commits.