Ai inteigration - #6
Conversation
- Fix generate() 3-arg signature mismatch in studyPlanner, chatAssistant, ragAssistant, llmRoutes (options were silently dropped) - Switch studyPlanner and quiz generation to generateJSON() with native Gemini JSON mode - Add missing 'theme' field to StudyPlan weekPlanSchema (was silently stripped by Mongoose strict mode) - Fix infinite loop in documentProcessor chunkText() with proper forward-progress guard - Restrict /api/llm raw endpoint to admin-only access - Fix insightEngine error swallowing so controller stale-cache fallback works - Move system instructions to dedicated SDK field for lower token cost - Update embedding dimension comments (1536 -> 768 for Gemini) - Update .env.example DEFAULT_LLM_MODEL to gemini-2.0-flash
… and downgrade Node.js CI version to 20.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Dependency ReviewThe following issues were found:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| try { | ||
| await onSave({ | ||
| stream: stream || undefined, |
| const { generate } = require("../llmService"); | ||
| const { differenceInWeeks, format } = require("date-fns"); | ||
| const { generateJSON } = require("../llmService"); | ||
| const { differenceInWeeks, format, addDays } = require("date-fns"); |
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.
Formal verification. No changes could be formally verified in this run.
Graphify review — findings
Pins CI Node from 24 to 20 and switches the default LLM model to gemini-2.0-flash. Rebuilds the backend Dockerfile as a two-stage image that installs production-only deps, runs as the non-root node user, and starts via node src/server.js instead of npm run dev. Adds nodemailer to backend dependencies and ignores graphify-out.
Worth a look
- Authenticated users are no longer allowed to call raw LLM endpoint unless admin —
backend/src/routes/llmRoutes.js:16· Escalate · high- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Production image still runs on EOL Node 18 —
backend/Dockerfile:7· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- User query is used as an unescaped MongoDB regex —
backend/src/controllers/aiController.js:362· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Keyword RAG fallback treats user query terms as raw regex —
backend/src/controllers/aiController.js:365· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Regex fallback search injects raw user query into $regex allowing ReDoS / regex-injection —
backend/src/controllers/aiController.js:366· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 367 functions depend on the 367 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 367 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 367 function(s) in the blast radius were not formally verified this run
Formal verification
Could not verify: Could not verify configuredOrigins.
The verifier did not have enough to check configuredOrigins, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify \_searchSimilarChunks.
The verifier did not have enough to check \_searchSimilarChunks, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify chunkText.
The verifier did not have enough to check chunkText, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify buildInsightPrompt.
The verifier did not have enough to check buildInsightPrompt, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify generateInsights.
The verifier did not have enough to check generateInsights, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify parseInsightResponse.
The verifier did not have enough to check parseInsightResponse, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify peakHoursFormatted.
The verifier did not have enough to check peakHoursFormatted, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify askQuestion.
The verifier did not have enough to check askQuestion, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify generateQuiz.
The verifier did not have enough to check generateQuiz, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify buildPlannerPrompt.
The verifier did not have enough to check buildPlannerPrompt, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify generateStudyPlan.
The verifier did not have enough to check generateStudyPlan, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify parsePlanResponse.
The verifier did not have enough to check parsePlanResponse, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify peakHoursFormatted.
The verifier did not have enough to check peakHoursFormatted, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify subjectList.
The verifier did not have enough to check subjectList, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
Could not verify: Could not verify analyzeFocusDropoff.
The verifier did not have enough to check analyzeFocusDropoff, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: verifiability pre-flight: exec_tiers_disarmed
2 participants
No description provided.