Add mossJARVIS community demo - #401
Open
AyanBhardwaj1 wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 28 out of 35 changed files in this pull request and generated 6 comments.
Files not reviewed (2)
- moss-live-labs/community-demos/mossJARVIS/app/globals.css: Generated file
- moss-live-labs/community-demos/mossJARVIS/pnpm-lock.yaml: Generated file
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Author
|
Committed Copilot changes, please merge. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| } | ||
|
|
||
| const response = await fetch("/api/jarvis/tts", { | ||
| method: "POST", |
There was a problem hiding this comment.
BLOCKING ```ts
const response = await fetch("/api/jarvis/tts", { ... });
...
const response = await fetch("/api/jarvis/tts", {
This redeclares block-scoped `response` and `url` in the same `try` block, so the Next/TypeScript build fails before the app can run; if renamed, it would also bill/play the same TTS response twice. Delete the second fetch/playback block and keep one request with `URL.revokeObjectURL` in a `finally`.
| const remoteDocuments = (await client.getDocs(indexName)).filter(validDocument).map(withoutEmbedding); | ||
| const remoteById = new Map(remoteDocuments.map((doc) => [doc.id, JSON.stringify(doc)])); | ||
| documents = mergeDocuments(remoteDocuments, localDocuments); | ||
| const pending = documents.filter((doc) => remoteById.get(doc.id) !== JSON.stringify(doc)); |
There was a problem hiding this comment.
BLOCKING ```ts
documents = mergeDocuments(remoteDocuments, localDocuments);
Offline deletes are not durable: `deleteBrainMemory()` removes the doc locally when Moss is offline, but the remote copy remains, and the next successful startup merges every remote doc back into local storage. Track deletion tombstones/`deletedAt` IDs in the local store, apply them before this merge, and replay `deleteDocs()` when cloud sync recovers.
| const directory = dataDirectory(); | ||
| const destination = memoryFile(); | ||
| const temporary = `${destination}.${process.pid}.tmp`; | ||
| const payload: LocalStore = { |
There was a problem hiding this comment.
BLOCKING ```ts
const temporary = ${destination}.${process.pid}.tmp;
Every local-memory write in the process uses the same temp file, and the read/merge/write sequence is not serialized. Concurrent turn, ingest, remember, or delete requests can overwrite the temp payload, fail `rename()` with `ENOENT`, or drop one request's documents. Put store mutations behind a process-wide mutex/queue or durable store, and use unique temp names such as `randomUUID()` inside that critical section.
| export async function POST(request: Request) { | ||
| try { | ||
| const body = (await request.json()) as Record<string, unknown>; | ||
| const action = typeof body.action === "string" ? body.action : ""; |
There was a problem hiding this comment.
BLOCKING ```ts
const body = (await request.json()) as Record<string, unknown>;
The loopback API executes cost-incurring actions using process-global API keys without any origin check or request token; after credentials are configured, another local process or reachable browser context can POST to `/api/jarvis` and use the user's OpenRouter/ElevenLabs keys. Reject non-same-origin requests and require a per-session CSRF/auth token header before parsing and dispatching actions.
| .arg("server.js") | ||
| .current_dir(server_dir) | ||
| .env("PORT", "3000") | ||
| .env("HOSTNAME", "127.0.0.1") |
There was a problem hiding this comment.
CONSIDER ```rust
.env("PORT", "3000")
The packaged desktop app always starts and opens port 3000. If anything else is already listening there, the sidecar Next server can fail while `wait_for_server()` succeeds against the unrelated process, and the WebView opens the wrong app. Pick/probe a free loopback port, pass it to `PORT`, `wait_for_server(port)`, and `WebviewUrl`, and check `child.try_wait()` or a Jarvis health endpoint during startup.
Codex reviewThe PR adds a large standalone Jarvis demo, but several issues break the app or undermine the memory/security guarantees. The highest-impact problems are a compile-time duplicate declaration, data consistency bugs, and unauthenticated loopback APIs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Checklist
Please ensure that your PR meets the following requirements:
Description
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context.
Fixes # (issue number)
Type of Change