feat: Add point-proven kit#297
Open
ravijaanthony wants to merge 23 commits into
Open
Conversation
Contributor
:robot_face: AgentKit Structural ValidationNew Contributions Detected
Check Results
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughChangesThe PR adds the Point Proven kit: Lamatic flows for article indexing and citation-backed digest synthesis, supporting scripts and prompts, a Next.js application for source selection and digest presentation, deployment configuration, guardrails, and documentation. Point Proven kit
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 39
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/point-proven/agent.md`:
- Around line 17-18: Standardize Markdown heading spacing by adding blank lines
after the headings at lines 17, 43, 65, 70, 99, 110, and 128 in
kits/point-proven/agent.md. Update the generating template/source for
kits/point-proven/constitutions/default.md, then regenerate that file so every
section heading is followed by a blank line.
In `@kits/point-proven/apps/actions/check-url.ts`:
- Around line 24-39: Update the URL validation and fetch flow in the server
action around new URL(trimmed) and fetch to allow only HTTP(S) schemes, reject
localhost and private/internal resolved addresses, and validate every
destination before requesting it. Prevent redirect-following from bypassing
these checks by handling redirects explicitly and applying the same validation
to each redirect target before continuing.
- Around line 64-72: Update the catch block in the URL-checking flow to detect
timeouts using the associated controller’s signal aborted state instead of
testing the error message for “abort”. Preserve the existing timeout response
when controller.signal.aborted is true, and leave non-abort errors on the
generic error path.
- Around line 41-49: Update the HEAD fallback logic in the URL-check flow so GET
is retried only for statuses indicating HEAD is unsupported or blocked, rather
than every non-200 response; preserve direct 4xx/5xx results that already
determine the verdict. In the GET fallback, enforce a small response-body size
limit and consume or cancel the body so article HTML is not downloaded
indefinitely merely to inspect res.status.
In `@kits/point-proven/apps/actions/orchestrate.ts`:
- Around line 393-405: Add a cumulative wall-clock deadline around the indexing
loop in the orchestrating function containing indexSingleArticle, stopping
before the serverless maxDuration is reached. Preserve collected partial
results, record every URL not started or interrupted as failed with an
appropriate timeout message, and return the existing result shape; consider
bounded concurrency only if it remains compatible with Firecrawl rate limits.
- Around line 8-26: The formatLamaticNetworkError messages expose stale,
deployment-specific node IDs and private debugging guidance to end users.
Replace the detailed timeout and connection-error text with concise generic
user-facing messages about checking flow deployment and Vector DB configuration,
while preserving the error classification and logging diagnostic details through
console.error or another operator-facing channel.
- Around line 445-459: The digest normalization near the return statement
currently uses asArray<T> casts without validating LLM-produced elements. Define
or reuse Zod schemas for DigestResult and its nested ArticleSummary, SourceItem,
Contradiction, ConsensusPoint, and DigestWarning shapes, then parse each field
with per-field catch fallbacks to empty arrays (while preserving the query
fallback) before returning the result. Replace the generic asArray calls in this
normalization path so malformed elements cannot reach the renderer as trusted
types.
- Around line 223-231: Update the Promise.race setup in runFlow to retain the
soft-timeout timer handle and clear it whenever the race settles, including both
successful execution and timeout/error paths. Preserve the existing 55-second
timeout behavior and do not add request cancellation or AbortController support.
- Around line 352-355: Update indexPayloadForUrl to remove the misleading
comment and align its payload documentation with the shipped Firecrawl flow,
which reads the urls field from triggerNode_1.output.urls. Preserve only the
payload fields required by the current flow, removing sampleInput if it is not
consumed.
- Line 186: Update the final fallback in the payload extraction logic to return
fromRoot only when it passes the same looksLikeFinalPayload validation as the
guarded returns above; otherwise return null. Preserve the existing fromResult
precedence so stray root fields such as requestId remain falsy and allow the
downstream onlyAck diagnostic to run.
In `@kits/point-proven/apps/app/icon.tsx`:
- Around line 7-22: Update the Icon component’s generated ImageResponse styling
to use the kit’s supported theme color variables or tokens instead of hard-coded
PRIMARY and background values. If ImageResponse cannot resolve those theme
variables, document the rendering exemption at the relevant Icon implementation
while preserving the existing icon appearance.
In `@kits/point-proven/apps/app/page.tsx`:
- Around line 400-415: Update the state flow around setSourcesLocked and the
Build brief card to add a “Start over” control that resets the lock, source
chips, query, digest, and maxSources so the analyst can begin again without
refreshing. Also simplify lockedMax to use successCount directly, since the
zero-success case already throws before this assignment.
- Around line 752-756: Update the error Card rendered by the error conditional
in the page component to include role="alert", ensuring screen readers announce
the message when it mounts while preserving the existing error content and
styling.
- Around line 560-575: Add the ARIA progressbar contract to the indexing
progress bar in the indexing JSX block: mark the filled bar element with
role="progressbar" and expose its current value and bounds using progressPct, 0,
and 100. Keep the existing visual styling and adjacent text unchanged.
- Around line 307-335: Update commitEdit to process all parsed candidates
instead of silently discarding entries after candidates[0], preserving each
pasted URL or surfacing its result. When the edited URL duplicates another chip,
keep the edited chip and set its status to error with a clear duplicate message
rather than removing it via the existing filter path; retain the current
successful non-duplicate update behavior.
- Around line 191-198: Limit the reachability sweep in the effect around
runReachability to a modest bounded concurrency of roughly 4–6 checks, rather
than starting every pending chip simultaneously. Preserve checkingRef
deduplication and let runReachability’s existing finally cleanup and setChips
updates continue draining the remaining pending queue.
In `@kits/point-proven/apps/components/digest-view.tsx`:
- Around line 10-28: Sanitize the HTML in the client-side digest rendering flow
before linkCitations processes it, using DOMPurify with a strict allowlist that
permits only the intended formatting elements and safe attributes/protocols
while preserving citation content. Add the required dompurify dependencies in
the apps package manifest, then update linkCitations to sanitize its input
before returning rewritten markup; keep the generated citation anchors
functional and ensure untrusted tags, attributes, and URLs are removed.
- Around line 118-125: Update the empty-state branch in the digest view around
HtmlRows to show the user actionable, non-debugging copy instead of internal
Studio/API troubleshooting details. Move the diagnostic guidance into a
console.warn while preserving the existing briefStrings.length === 0 condition
and normal HtmlRows rendering.
In `@kits/point-proven/apps/components/hover-tip.tsx`:
- Around line 23-30: Update the HoverTip component around the trigger wrapper
and tooltip span to require or render a keyboard-focusable trigger, and connect
that trigger to the tooltip with a stable aria-describedby relationship. Ensure
the tooltip receives the matching id and remains available to assistive
technology while preserving the existing hover and focus-within visibility
behavior.
In `@kits/point-proven/apps/components/ui/button.tsx`:
- Around line 40-59: Wrap the exported primitives in React.forwardRef so React
18 consumers can access their underlying elements. Update Button in
kits/point-proven/apps/components/ui/button.tsx#L40-L59 to forward its ref to
the button or Slot; Badge in
kits/point-proven/apps/components/ui/badge.tsx#L28-L44 to the span or Slot;
every exported card primitive in
kits/point-proven/apps/components/ui/card.tsx#L5-L82 to its native or Radix
root; Input in kits/point-proven/apps/components/ui/input.tsx#L5-L19 to the
native input; and Label in kits/point-proven/apps/components/ui/label.tsx#L8-L22
to the Radix label.
In `@kits/point-proven/apps/components/ui/scroll-area.tsx`:
- Around line 19-24: Update the ScrollAreaPrimitive.Viewport styling in the
scroll-area component so its height is constrained by the root’s max-height
rather than allowing size-full to expand with content. Reuse the existing root
constraint or establish a definite viewport height while preserving the current
scrolling and focus styles.
In `@kits/point-proven/apps/components/url-chip-list.tsx`:
- Around line 51-63: Add an accessible name to the edit input in the URL chip
editing flow by providing an appropriate aria-label or associated visible label
that identifies the value being edited. Keep the existing editing behavior and
keyboard handlers unchanged.
In `@kits/point-proven/apps/lib/demo-scenarios.ts`:
- Around line 20-29: Remove the deprecated compatibility layer: in
kits/point-proven/apps/lib/demo-scenarios.ts lines 20-29, delete the
DemoScenario type, DEMO_SCENARIOS, DEFAULT_SCENARIO, and the entire file once
any re-export block is removed; in
kits/point-proven/apps/lib/source-templates.ts lines 59-66, delete the duplicate
DEMO_SCENARIOS and DEFAULT_SCENARIO declarations, leaving SOURCE_TEMPLATES as
the sole source of truth.
In `@kits/point-proven/apps/lib/source-templates.ts`:
- Around line 21-28: Replace the OECD URL constant used by the source templates
with another stable source that returns HTTP 200, ensuring both the 2-source and
4-source templates no longer depend on the failing OECD endpoint while
preserving the existing source-chip validation flow.
In `@kits/point-proven/apps/lib/url-validation.ts`:
- Around line 55-66: The hostnameHasAllowedTld helper contains unreachable
checks because ALLOWED_TLDS only stores individual TLD labels. Retain the
allowlist and simplify hostnameHasAllowedTld to validate only whether the final
hostname label exists in ALLOWED_TLDS, removing the dotted-entry and redundant
multi-label branches.
- Around line 1-21: Remove ALLOWED_TLDS and the hostnameHasAllowedTld helper
from kits/point-proven/apps/lib/url-validation.ts, then update its validation
call site around lines 114-120 to require only that the hostname contains a dot.
No direct change is needed at the consolidated helper site beyond deleting
hostnameHasAllowedTld; preserve the remaining URL validation and reachability
behavior.
In `@kits/point-proven/apps/lib/utils.ts`:
- Around line 1-6: Upgrade the tailwind-merge dependency from the v2 line to a
v3-compatible version in the app’s package manifest, while keeping the existing
cn function in utils.ts unchanged.
In `@kits/point-proven/apps/next.config.mjs`:
- Around line 8-10: Remove the ignoreBuildErrors setting from the TypeScript
configuration in kits/point-proven/apps/next.config.mjs#L8-L10, and enable
strict: true in kits/point-proven/apps/tsconfig.json#L11-L11. Resolve all
resulting TypeScript diagnostics before merging.
In `@kits/point-proven/apps/package.json`:
- Line 8: Update the package.json lint script configuration: either declare the
intended ESLint dependency and provide the required ESLint configuration for the
"lint" script, or remove the script if linting is not supported by this app
package.
In `@kits/point-proven/flows/index-articles.ts`:
- Line 412: Update the output mapping for the article-indexing flow to aggregate
per-iteration outcomes from the transform and index nodes instead of returning a
literal empty errors array. Report indexed_count from successfully indexed
chunks or pages, not firecrawlNode_785.output.data.length, and ensure scrape,
vectorization, and index-write failures reach indexSingleArticle through
parsed.errors.
- Around line 173-176: Add the missing bundled script files under the scripts
directory referenced by the index_articles_extract_chunks and
index_articles_transform_metadata entries in index-articles.ts, implementing the
extraction and metadata transformation needed to produce citation_id and
chunk_id before vectorization and persistence. Ensure both declared script
bindings resolve successfully during deployment.
- Line 63: Update the walkthrough prose for the API Request step in the flow
documentation to describe async mode instead of realtime mode. Keep the existing
explanation of the urls trigger field unchanged, and align the wording with the
async responseType configuration and operator guidance.
In `@kits/point-proven/flows/synthesize-digest.ts`:
- Around line 141-144: The point-proven kit references synthesis scripts that
are not included, leaving the declared scripts and downstream API fields
unavailable. Add the missing implementations for
synthesize_digest_group_by_source and synthesize_digest_post_process under the
kit’s scripts directory, and ensure the post-process script produces
numbered_source_list, validates [n] citations, converts bold text to mark tags,
and emits warnings as expected by the API Response mapping; also resolve the
corresponding missing script assets for the index-articles flow.
- Around line 187-201: Update the synthesize-digest user prompt to reference the
existing Group By Source node identifier codeNode_551 instead of codeNode_174
for both numbered_source_list and grouped_chunks interpolations. Also update the
stale node ID in the related operator error string within orchestrate so it
names codeNode_551 consistently.
- Around line 176-183: Update the Vector Search node’s fixed limit in the
synthesizeDigest flow to use the propagated max_articles value, ensuring the
UI-configured cap reaches retrieval. Verify the group-by-source processing still
enforces max_articles after ranking; if it does not, apply the cap there as
well. Preserve the existing flow behavior when max_articles is provided.
In `@kits/point-proven/model-configs/synthesize-digest_llm-node.ts`:
- Around line 4-8: Replace the self-referential metadata in the default export
of synthesize-digest_llm-node.ts with a re-export of the Studio/externalized
configuration artifact. Ensure the exported metadata contains the actual
generative model parameters, including temperature, and remains compatible with
the generativeModelName, memories, and messages references used by LLMNode_812.
In `@kits/point-proven/prompts/synthesize-digest_llm-node_system.md`:
- Line 7: Add a sanitization boundary in HtmlRows before passing generated brief
content to DigestView’s dangerouslySetInnerHTML, using an appropriate DOM
sanitizer dependency. Configure it to allow only the mark tag and the existing
citation anchor markup, preserving required anchor attributes while stripping
all other injected HTML.
In `@kits/point-proven/prompts/synthesize-digest_llm-node_user.md`:
- Line 4: Replace the nonexistent codeNode_174 references in the
synthesize-digest prompt with codeNode_551, the Group By Source node that
provides numbered_source_list and grouped_chunks. Update both interpolations and
the stale node reference in orchestrate.ts so the LLM receives the grouped
source data and citations remain grounded.
In `@kits/point-proven/README.md`:
- Line 12: Update the flow diagram code fence in the README to specify the text
language tag, preserving the existing ASCII diagram content.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4ec8622a-d912-4e30-bbe3-20dcc31d7c57
⛔ Files ignored due to path filters (1)
kits/point-proven/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (44)
.gitignorekits/point-proven/.gitignorekits/point-proven/README.mdkits/point-proven/agent.mdkits/point-proven/apps/.env.examplekits/point-proven/apps/.gitignorekits/point-proven/apps/actions/check-url.tskits/point-proven/apps/actions/orchestrate.tskits/point-proven/apps/app/globals.csskits/point-proven/apps/app/icon.tsxkits/point-proven/apps/app/layout.tsxkits/point-proven/apps/app/page.tsxkits/point-proven/apps/components.jsonkits/point-proven/apps/components/digest-view.tsxkits/point-proven/apps/components/hover-tip.tsxkits/point-proven/apps/components/theme-provider.tsxkits/point-proven/apps/components/theme-toggle.tsxkits/point-proven/apps/components/ui/badge.tsxkits/point-proven/apps/components/ui/button.tsxkits/point-proven/apps/components/ui/card.tsxkits/point-proven/apps/components/ui/input.tsxkits/point-proven/apps/components/ui/label.tsxkits/point-proven/apps/components/ui/scroll-area.tsxkits/point-proven/apps/components/ui/separator.tsxkits/point-proven/apps/components/ui/tabs.tsxkits/point-proven/apps/components/ui/textarea.tsxkits/point-proven/apps/components/url-chip-list.tsxkits/point-proven/apps/lib/demo-scenarios.tskits/point-proven/apps/lib/lamatic-client.tskits/point-proven/apps/lib/source-templates.tskits/point-proven/apps/lib/url-validation.tskits/point-proven/apps/lib/utils.tskits/point-proven/apps/next.config.mjskits/point-proven/apps/package.jsonkits/point-proven/apps/postcss.config.mjskits/point-proven/apps/tsconfig.jsonkits/point-proven/apps/vercel.jsonkits/point-proven/constitutions/default.mdkits/point-proven/flows/index-articles.tskits/point-proven/flows/synthesize-digest.tskits/point-proven/lamatic.config.tskits/point-proven/model-configs/synthesize-digest_llm-node.tskits/point-proven/prompts/synthesize-digest_llm-node_system.mdkits/point-proven/prompts/synthesize-digest_llm-node_user.md
Comment on lines
+4
to
+8
| export default { | ||
| "generativeModelName": "@model-configs/synthesize-digest_llm-node.ts", | ||
| "memories": "@model-configs/synthesize-digest_llm-node.ts", | ||
| "messages": "@model-configs/synthesize-digest_llm-node.ts" | ||
| }; |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Compare against model-config artifacts in other kits to see the expected shape.
fd -t f . --glob '*/model-configs/*.ts' kits | head -20
echo "=== sample contents ==="
fd -t f . --glob '*/model-configs/*.ts' kits --exec sh -c 'echo "--- $1 ---"; head -30 "$1"' _ {} \; | head -80Repository: Lamatic/AgentKit
Length of output: 728
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== locate model-configs dirs/files ==="
git ls-files 'kits/*/model-configs/*.ts' | sed -n '1,80p'
echo "=== target config ==="
if [ -f kits/point-proven/model-configs/synthesize-digest_llm-node.ts ]; then
cat -n kits/point-proven/model-configs/synthesize-digest_llm-node.ts
else
echo "missing"
fi
echo "=== outline/imports in synthesize-digest flow ==="
if [ -f kits/point-proven/flows/synthesize-digest.ts ]; then
wc -l kits/point-proven/flows/synthesize-digest.ts
rg -n "synthesize-digest_llm-node|generativeModelName|memories|messages|temperature|LLMNode_812" kits/point-proven/flows/synthesize-digest.ts -C 3 || true
fi
echo "=== sample nearby model config files ==="
git ls-files 'kits/*/model-configs/*.ts' | head -20 | while read -r f; do
echo "--- $f ---"
sed -n '1,80p' "$f"
doneRepository: Lamatic/AgentKit
Length of output: 17598
Mission: replace the circular model config with real exportable metadata.
kits/point-proven/model-configs/synthesize-digest_llm-node.ts has generativeModelName, memories, and messages pointing back at itself, while LLMNode_812 ties those fields directly to this artifact. The flow doc lists lower temperature as a remedy, but this config has no temperature to adjust. Re-export this artifact from Studio/externalized config so it carries the real model parameters for this generative node.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/point-proven/model-configs/synthesize-digest_llm-node.ts` around lines 4
- 8, Replace the self-referential metadata in the default export of
synthesize-digest_llm-node.ts with a re-export of the Studio/externalized
configuration artifact. Ensure the exported metadata contains the actual
generative model parameters, including temperature, and remains compatible with
the generativeModelName, memories, and messages references used by LLMNode_812.
Sources: Coding guidelines, Learnings
|
|
||
| Rules: | ||
| 1. **Cite every factual claim.** No statement of fact without a `[n]` citation. Quotes count as facts; cite the source they came from. | ||
| 2. **Surface contradictions.** When two or more sources disagree on a point, populate the `cross_source_contradictions` array AND wrap the contested span in markdown `**bold**` inside the executive brief. |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Locate the render path for the <mark>-converted brief.
rg -n 'dangerouslySetInnerHTML|innerHTML|<mark' kits/point-proven/apps -C3
echo "=== sanitizer present? ==="
rg -n 'dompurify|sanitize-html|xss' kits/point-proven/apps/package.jsonRepository: Lamatic/AgentKit
Length of output: 836
🏁 Script executed:
#!/bin/bash
set -u
echo "=== digest-view.tsx ==="
sed -n '1,140p' kits/point-proven/apps/components/digest-view.tsx
echo "=== search markdown conversion / mark handling ==="
rg -n -C 3 'markdown|markdownToHtml|marked|<mark>|mark|cross_source_contradictions|synthesize|prompts' kits/point-proven -S
echo "=== package scripts/deps top-level if any ==="
for f in kits/point-proven/package.json kits/point-proven/apps/package.json; do
[ -f "$f" ] && { echo "--- $f"; sed -n '1,220p' "$f"; }
done
echo "=== diff stat/name status ==="
git diff --stat -- kits/point-proven || trueRepository: Lamatic/AgentKit
Length of output: 46830
Add/verify the sanitizer boundary before rendering the brief.
DigestView renders generated brief rows with dangerouslySetInnerHTML, and package deps do not list DOM sanitization. **bold** is converted to <mark> from LLM response text that is grounded in scraped third-party pages, so the model can inject markup through content. Add sanitizer usage in HtmlRows and keep the allowed tag set to <mark> plus the citation anchor markup.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/point-proven/prompts/synthesize-digest_llm-node_system.md` at line 7,
Add a sanitization boundary in HtmlRows before passing generated brief content
to DigestView’s dangerouslySetInnerHTML, using an appropriate DOM sanitizer
dependency. Configure it to allow only the mark tag and the existing citation
anchor markup, preserving required anchor attributes while stripping all other
injected HTML.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
kits/point-proven/apps/app/page.tsx (1)
391-467: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftEnforce a per-call race before
indexSingleArticle()returnsThe
deadlinegate prevents starting the next batch URL after 270s, butindexSingleArticleis allowed to run until Lamatic polling with a 280s budget. A slow or hung index call can therefore outlast this Server Action’smaxDurationand get killed mid-flight instead of failing intofailed_urls. Wrap thisawaitwith a controller-based/timeout race and pass that abort context intorunFlowif needed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/point-proven/apps/app/page.tsx` around lines 391 - 467, The handleIndex flow must enforce the deadline for each indexSingleArticle call, not only before starting the next URL. Add a per-call timeout/AbortController race that rejects before the serverless limit, pass the abort signal through indexSingleArticle into runFlow where supported, and handle the timeout through the existing catch path so the URL is added to failedUrls and errors.kits/point-proven/apps/lib/url-validation.ts (1)
43-53: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winYour target list just got smaller than intended.
The hard
www.-prefix requirement (lines 43-53, 69-72) rejects any legitimate article URL served from an apex domain — arXiv, and plenty of modern news/blog sites don't use awwwsubdomain at all. This is the same category of problem the removed TLD allowlist had (over-restrictive gatekeeping of valid public article sources), just via a different rule that survived this cleanup.🎯 Proposed fix
- if (!trimmed.toLowerCase().startsWith("https://www.")) { - if (trimmed.toLowerCase().startsWith("http://")) { - return { ok: false, error: "must use https:// (not http://)" }; - } - if ( - trimmed.toLowerCase().startsWith("https://") && - !trimmed.toLowerCase().startsWith("https://www.") - ) { - return { ok: false, error: "hostname must start with www." }; - } - return { ok: false, error: "must start with https://www." }; - } + if (trimmed.toLowerCase().startsWith("http://")) { + return { ok: false, error: "must use https:// (not http://)" }; + } + if (!trimmed.toLowerCase().startsWith("https://")) { + return { ok: false, error: "must start with https://" }; + }- const host = parsed.hostname.toLowerCase(); - if (!host.startsWith("www.")) { - return { ok: false, error: "hostname must start with www." }; - } - - if (!host.includes(".")) { + const host = parsed.hostname.toLowerCase(); + if (!host.includes(".")) { return { ok: false, error: "hostname must include a domain (e.g. www.example.com)" };Also applies to: 69-72
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/point-proven/apps/lib/url-validation.ts` around lines 43 - 53, Remove the hard www. prefix requirement from the URL validation logic around the visible https://www. checks, including the corresponding validation at the later referenced range. Accept valid HTTPS article URLs on both apex and www hostnames while retaining the existing protocol validation and error handling for non-HTTPS URLs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/point-proven/apps/actions/check-url.ts`:
- Around line 61-99: Update the flow between assertSafeUrl and
fetchWithRedirectGuard to prevent DNS rebinding: after validation, fetch the
request through a custom undici dispatcher/connector pinned to the validated
public address while preserving the original hostname for HTTP Host/TLS
semantics. Ensure redirects repeat validation and use the corresponding pinned
address, or restrict/remove hostname fetching if pinning cannot be implemented
safely.
In `@kits/point-proven/apps/package.json`:
- Line 23: Update the Next.js dependency in the kit app’s package manifest from
16.0.10 to a supported 14.x or 15.x release. Align eslint-config-next and the
React tooling dependencies with the selected Next.js version, then verify the
complete dependency stack remains compatible.
In `@kits/point-proven/scripts/index-articles_transform-metadata.ts`:
- Around line 13-15: Update the node-id bindings in the transform-metadata
script to use the shipped flow’s symbols: vectorizeNode_314 for vectorOut,
codeNode_794 for texts, and variablesNode_658 for varsOut. Keep the downstream
keptVectors, metadataProps, and Index processing unchanged so the flow receives
the actual node outputs.
---
Outside diff comments:
In `@kits/point-proven/apps/app/page.tsx`:
- Around line 391-467: The handleIndex flow must enforce the deadline for each
indexSingleArticle call, not only before starting the next URL. Add a per-call
timeout/AbortController race that rejects before the serverless limit, pass the
abort signal through indexSingleArticle into runFlow where supported, and handle
the timeout through the existing catch path so the URL is added to failedUrls
and errors.
In `@kits/point-proven/apps/lib/url-validation.ts`:
- Around line 43-53: Remove the hard www. prefix requirement from the URL
validation logic around the visible https://www. checks, including the
corresponding validation at the later referenced range. Accept valid HTTPS
article URLs on both apex and www hostnames while retaining the existing
protocol validation and error handling for non-HTTPS URLs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d479aef7-1002-40d3-b475-3edd77c46df9
⛔ Files ignored due to path filters (1)
kits/point-proven/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (23)
kits/point-proven/README.mdkits/point-proven/agent.mdkits/point-proven/apps/actions/check-url.tskits/point-proven/apps/actions/orchestrate.tskits/point-proven/apps/app/page.tsxkits/point-proven/apps/components/digest-view.tsxkits/point-proven/apps/components/hover-tip.tsxkits/point-proven/apps/components/theme-toggle.tsxkits/point-proven/apps/components/ui/scroll-area.tsxkits/point-proven/apps/components/url-chip-list.tsxkits/point-proven/apps/eslint.config.mjskits/point-proven/apps/lib/source-templates.tskits/point-proven/apps/lib/url-validation.tskits/point-proven/apps/next.config.mjskits/point-proven/apps/package.jsonkits/point-proven/apps/tsconfig.jsonkits/point-proven/constitutions/default.mdkits/point-proven/flows/index-articles.tskits/point-proven/prompts/synthesize-digest_llm-node_user.mdkits/point-proven/scripts/index-articles_extract-chunks.tskits/point-proven/scripts/index-articles_transform-metadata.tskits/point-proven/scripts/synthesize-digest_group-by-source.tskits/point-proven/scripts/synthesize-digest_post-process.ts
💤 Files with no reviewable changes (2)
- kits/point-proven/apps/next.config.mjs
- kits/point-proven/apps/lib/source-templates.ts
| "isomorphic-dompurify": "^2.26.0", | ||
| "lamatic": "0.3.2", | ||
| "lucide-react": "^0.454.0", | ||
| "next": "16.0.10", |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target package =="
cat -n kits/point-proven/apps/package.json 2>/dev/null || true
echo
echo "== supported next mentions in repo =="
rg -n "Next\.js|Next.js|next.js|next [0-9]|14-15|14–15|next:" kits next.config.mjs package.json 2>/dev/null | head -200
echo
echo "== git status/stat =="
git diff --stat kits/point-proven/apps/package.json 2>/dev/null || true
git diff -- kits/point-proven/apps/package.json 2>/dev/null | sed -n '1,160p' || trueRepository: Lamatic/AgentKit
Length of output: 40720
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== point-proven package metadata/files =="
python3 - <<'PY'
from pathlib import Path
p=Path("kits/point-proven/apps/package.json")
print("exists", p.exists())
for name in ["package.json","next.config.mjs","tsconfig.json",".env.example","README.md"]:
rel=Path("kits/point-proven/apps")/name
print(f"{name}", rel.exists(), "lines", len(rel.read_text() if rel.exists() else "") .splitlines())
PY
echo
echo "== exact supported next range occurrences =="
rg -n --fixed-strings "Next.js 14–15" --hidden 2>/dev/null || true
rg -n --fixed-strings "Next.js 14-15" --hidden 2>/dev/null || true
rg -n --fixed-strings "Next.js 14-15" --hidden 2>/dev/null || true
rg -n --fixed-strings "Next.js 14–15" --hidden 2>/dev/null || true
rg -n 'Next\.js?\s*(14|15).*|Next\.js?\s*14–15|Next\.js?\s*14-15' --hidden 2>/dev/null | head -200Repository: Lamatic/AgentKit
Length of output: 340
🌐 Web query:
Next.js 16 release version eslint-config-next 16 React 19 compatibility
💡 Result:
Next.js 16 was released on October 22, 2025 [1][2]. It fully supports and integrates with React 19, utilizing the latest React Canary releases (including features such as React 19.2) to provide stable support for its features, including the React Compiler [3][4]. Regarding eslint-config-next and ESLint configuration in version 16: 1. Native Flat Config Support: Starting with version 16, eslint-config-next natively supports the ESLint Flat Config format [5][6]. This eliminates the need for legacy compatibility wrappers like @eslint/eslintrc's FlatCompat in many cases [6]. You can now import the configuration directly into your eslint.config.mjs file [5][6]. 2. Removal of next lint: The next lint command was removed in Next.js 16 [4][7]. Developers should now use the standard ESLint CLI (e.g., npx eslint.) to run linting [7][6]. 3. Configuration Changes: The eslint option in next.config.js is no longer supported and should be removed [7][8]. When upgrading to Next.js 16, it is recommended to use the provided codemods to migrate from the legacy linting setup to the new ESLint CLI approach [4][7]. If you encounter issues with peer dependencies regarding React 19 compatibility in third-party libraries, ensure those libraries are updated to versions that explicitly support React 19, or use package manager overrides if necessary [9].
Citations:
- 1: https://github.com/vercel/next.js/releases/tag/v16.0.0
- 2: https://newreleases.io/project/npm/next/release/16.0.0
- 3: https://nextjs.org/blog/next-16
- 4: https://nextjs.org/docs/app/guides/upgrading/version-16
- 5: [eslint-config] [Breaking] Use Flat config by default vercel/next.js#84874
- 6: https://nx.dev/docs/technologies/eslint/guides/flat-config
- 7: https://nextjs.org/docs/app/api-reference/config/eslint
- 8: ESLint config missing in next.config after upgrading to 16.0.0-beta.0 vercel/next.js#84772
- 9: https://www.frontendhorizon.com/blog/next-js-16-1-in-production-the-migration-playbook-we-run-on-every-fh-site
Keep the kit app in the supported Next.js lane.
next: "16.0.10" is outside the supported Next.js 14–15 lane for this kit. Pin a supported 14.x or 15.x release and align eslint-config-next and the React tooling versions accordingly. Mission control: verify the final dependency stack before launch.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/point-proven/apps/package.json` at line 23, Update the Next.js
dependency in the kit app’s package manifest from 16.0.10 to a supported 14.x or
15.x release. Align eslint-config-next and the React tooling dependencies with
the selected Next.js version, then verify the complete dependency stack remains
compatible.
Source: Coding guidelines
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/point-proven/apps/actions/check-url.ts`:
- Around line 151-169: Update fetchPinned so dispatcher.close() does not block
returning the response while an in-flight body remains pending. Trigger
dispatcher cleanup without awaiting it, while preserving the existing error
suppression and response-fetch behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f048a386-dae5-4cc8-8d29-ce76c07b6a7a
⛔ Files ignored due to path filters (1)
kits/point-proven/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (6)
kits/point-proven/apps/actions/check-url.tskits/point-proven/apps/actions/orchestrate.tskits/point-proven/apps/app/page.tsxkits/point-proven/apps/lib/url-validation.tskits/point-proven/apps/package.jsonkits/point-proven/scripts/index-articles_transform-metadata.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
Adds Point Proven, a debate-research kit that indexes public article URLs and builds citation-backed briefs with key claims, clash points, agreed points, themes, and per-source summaries.
Live demo: pointproven
1. Select Contribution Type
kits/point-proven)2. General Requirements
kebab-caseand matches the flow IDREADME.md(purpose, setup, usage)3. File Structure (Check what applies)
config.jsonpresent with valid metadata (name, description, tags, steps, author, env keys)flows/<flow-name>/(where applicable) include:config.json(Lamatic flow export)inputs.jsonmeta.jsonREADME.md.env.examplewith placeholder values only (kits only)config.jsonnode graphs (changes via Lamatic Studio export)4. Validation
npm install && npm run devworks locally (kits: UI runs; bundles/templates: flows are valid)[kit] Add <name> for <use case>)kits/point-proven(debate-research flows + UI demo).kits/point-proven/lamatic.config.tskits/point-proven/README.mdkits/point-proven/agent.mdkits/point-proven/constitutions/default.mdkits/point-proven/model-configs/synthesize-digest_llm-node.tskits/point-proven/flows/index-articles.ts(Index Articles)kits/point-proven/flows/synthesize-digest.ts(Synthesize Digest)kits/point-proven/prompts/synthesize-digest_llm-node_system.mdkits/point-proven/prompts/synthesize-digest_llm-node_user.mdkits/point-proven/scripts/index-articles_extract-chunks.tskits/point-proven/scripts/index-articles_transform-metadata.tskits/point-proven/scripts/synthesize-digest_group-by-source.tskits/point-proven/scripts/synthesize-digest_post-process.tskits/point-proven/apps) including environment placeholders:kits/point-proven/apps/package.json,kits/point-proven/apps/tsconfig.json,kits/point-proven/apps/eslint.config.mjs,kits/point-proven/apps/next.config.mjs,kits/point-proven/apps/postcss.config.mjs,kits/point-proven/apps/vercel.jsonkits/point-proven/apps/app/layout.tsx,kits/point-proven/apps/app/page.tsx,kits/point-proven/apps/app/globals.css,kits/point-proven/apps/app/icon.tsxkits/point-proven/apps/.env.examplekits/point-proven/apps/actions/check-url.ts(SSRF-safe URL reachability probing)kits/point-proven/apps/actions/orchestrate.ts(executes Index/Synthesize flows; normalizes/validates results)kits/point-proven/apps/actions/orchestrate.tskits/point-proven/apps/components.jsonkits/point-proven/apps/components/digest-view.tsxkits/point-proven/apps/components/url-chip-list.tsxkits/point-proven/apps/components/hover-tip.tsxkits/point-proven/apps/components/theme-provider.tsxkits/point-proven/apps/components/theme-toggle.tsxkits/point-proven/apps/components/ui/badge.tsxkits/point-proven/apps/components/ui/button.tsxkits/point-proven/apps/components/ui/card.tsxkits/point-proven/apps/components/ui/label.tsxkits/point-proven/apps/components/ui/scroll-area.tsxkits/point-proven/apps/components/ui/separator.tsxkits/point-proven/apps/components/ui/tabs.tsxkits/point-proven/apps/lib/utils.ts,kits/point-proven/apps/lib/lamatic-client.ts,kits/point-proven/apps/lib/url-validation.ts,kits/point-proven/apps/lib/source-templates.ts.gitignore(ignores.cursor/)kits/point-proven/.gitignorekits/point-proven/apps/.gitignoreFlow behavior and node/edge types (from the flow TS definitions)
Index Articles (
kits/point-proven/flows/index-articles.ts)triggerNode,dynamicNode,forLoopNode,forLoopEndNode,select,model,monacoTextdefaultEdge,conditionEdge,loopEdge,responseEdgeurls→ FirecrawlsyncBatchScrape→ loops scraped pages → chunks markdown → extracts chunk text + normalizes chunk outputs → vectorizes embeddings → transforms metadata into deterministic citation/chunk IDs → indexes vectors+metadata into the configured vector DB using composite keys (citation_id,chunk_id) → returns{ indexed_count, collection, errors }.Synthesize Digest (
kits/point-proven/flows/synthesize-digest.ts)triggerNode,dynamicNode,select,modeldefaultEdge,responseEdgequery→ vector retrieval/search → groups hits by source (via script) and prepares a numbered source list + grouped chunks → LLM produces strict JSON digest (system/user prompts + model config) → post-process validates/parses citations, drops invalid citations into warnings, highlights claims (e.g. converts**...**to<mark>...), and reconstructs the orderedsourcesblock → returns{ query, executive_brief, article_summaries, cross_cutting_themes, cross_source_contradictions, consensus_points, warnings }.