New Fixes and Improvements #43
Conversation
- Gate CPAL device enumeration behind onboarding_completed flag - Backend auto-starts device watcher when both conditions met - Add checkOnMount option to permission hooks - Disable unused Rust doc tests
- Add audio confirmation when recording starts (macOS/Windows) - Add 'Sound on Recording' setting toggle (default: on) - Reduce minimum recording duration to 0.5s for both Toggle and PTT modes - Add 300ms throttle for Toggle mode hotkey to prevent rapid re-presses - Show 'recording-too-short' feedback in pill before hiding (1.5s) - Add severity-based feedback colors (info/warn/error) - Handle hotkey press during Starting state with pending_stop flag - Show spinner for Starting/Stopping states in pill
|
@codex review |
Pull Request ReviewI have reviewed PR #43 and identified several important issues that should be addressed before merging. HIGH PRIORITY Issues1. Security - API Key HandlingLocation: src/utils/keyring.ts:40-57 The API key validation logic allows empty keys when no_auth is true without proper validation at the keyring layer. Additionally there is no error handling if validation fails. This needs proper validation and error handling before storing sensitive credentials. 2. Type Safety ViolationsLocation: src/components/OpenAICompatConfigModal.tsx:92 Using any type defeats TypeScript purpose and violates CLAUDE.md guidelines. Should use unknown and properly narrow the type. 3. ESLint Configuration Too PermissiveLocation: eslint.config.cjs:41-68 18 critical rules are disabled including no-explicit-any, no-unsafe-* rules, no-floating-promises, no-unused-vars, and prefer-const. This contradicts CLAUDE.md emphasis on type safety and directly allows unsafe code patterns. Recommendation: Re-enable critical rules incrementally and fix violations rather than disabling rules. MEDIUM PRIORITY Issues4. Missing Test CoverageCritical security code has no tests:
5. Error Handling Gapssrc-tauri/src/ai/openai.rs:91 uses generic Unknown error message with no debugging context. 6. Hardcoded Valuessrc/utils/keyring.ts:84 has hardcoded providers array that should be a shared constant. Positive Changes
Overall AssessmentCode Quality: 7/10 This PR adds valuable functionality but the security gaps and overly permissive linting could introduce bugs. The disabled ESLint rules defeat the TypeScript-first approach outlined in CLAUDE.md. Recommendation: Request Changes - Address security and type safety issues before merging. Happy to help implement any of these fixes! |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
resolves #34 #41 #32 #36