The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

• X
• Mastodon
• LinkedIn
• Facebook

deployment/secure_api_server.py (1)

743-749: Consistent logging and message for batch endpoint.

Unify to logger.exception and the same generic 500 text.

-    except Exception as e:
+    except Exception:
         response_time = time.time() - start_time
         update_metrics(
             response_time, success=False, error_type='batch_prediction_error'
         )
-        logger.error("NLP emotion batch error: %s", e)
-        return jsonify({'error': 'An internal server error occurred.'}), 500
+        logger.exception("NLP emotion batch error")
+        return jsonify({'error': 'Internal server error'}), 500

website/comprehensive-demo.html (4)

366-369: Fix Font Awesome 6 icon names.

fa-file-text was removed; use fa-file-lines. Ensures icons render.

-<i class="fas fa-file-text text-success mb-2" style="font-size: 2rem;"></i>
+<i class="fa-solid fa-file-lines text-success mb-2" style="font-size: 2rem;"></i>
@@
-<i class="fas fa-file-text text-success me-2"></i>
+<i class="fa-solid fa-file-lines text-success me-2"></i>

Also applies to: 547-549

---

514-521: Improve a11y for loading state.

Announce progress to AT; mark busy while processing.

-<div id="loadingSection" class="loading-spinner text-center mb-5">
+<div id="loadingSection" class="loading-spinner text-center mb-5" role="status" aria-live="polite" aria-busy="true">
@@
-    <p class="text-muted" id="loadingMessage">Initializing models...</p>
+    <p class="text-muted" id="loadingMessage">Initializing models...</p>

Remember to toggle aria-busy true/false from JS when showing/hiding.

---

301-315: Navbar contrast/toggler visibility.

Using navbar-light on a dark custom background can make the toggler hard to see. Prefer navbar-dark here.

-<nav class="navbar navbar-expand-lg navbar-light fixed-top">
+<nav class="navbar navbar-expand-lg navbar-dark fixed-top">

---

650-652: Harden external links opened in a new tab.

Add rel="noopener noreferrer" to prevent tab‑nabbing.

-<a href="https://github.com/uelkerd/SAMO--DL/blob/main/docs/api/API_DOCUMENTATION.md" class="text-muted text-decoration-none" target="_blank">API Docs</a>
+<a href="https://github.com/uelkerd/SAMO--DL/blob/main/docs/api/API_DOCUMENTATION.md" class="text-muted text-decoration-none" target="_blank" rel="noopener noreferrer">API Docs</a>
-<a href="https://huggingface.co/duelker/samo-goemotions-deberta-v3-large" class="text-muted text-decoration-none" target="_blank">DeBERTa Model</a>
+<a href="https://huggingface.co/duelker/samo-goemotions-deberta-v3-large" class="text-muted text-decoration-none" target="_blank" rel="noopener noreferrer">DeBERTa Model</a>
-<a href="https://github.com/uelkerd/SAMO--DL/blob/main/docs/README.md" class="text-muted text-decoration-none" target="_blank">Support</a>
+<a href="https://github.com/uelkerd/SAMO--DL/blob/main/docs/README.md" class="text-muted text-decoration-none" target="_blank" rel="noopener noreferrer">Support</a>
@@
-<a href="https://github.com/uelkerd/SAMO--DL" class="text-muted text-decoration-none">
+<a href="https://github.com/uelkerd/SAMO--DL" class="text-muted text-decoration-none" target="_blank" rel="noopener noreferrer">

Also applies to: 666-674

website/js/comprehensive-demo.js (5)

12-43: Add timeout and better error propagation in fetch.

Abort long requests; surface server error JSON messages when available.

-    async makeRequest(endpoint, data, method = 'POST') {
+    async makeRequest(endpoint, data, method = 'POST', timeoutMs = 30000) {
         const config = {
             method,
             headers: {
                 'Content-Type': 'application/json',
             }
         };
+        const ctrl = new AbortController();
+        const t = setTimeout(() => ctrl.abort(), timeoutMs);
+        config.signal = ctrl.signal;

@@
-        try {
-            const response = await fetch(`${this.baseURL}${endpoint}`, config);
+        try {
+            const response = await fetch(`${this.baseURL}${endpoint}`, config);
             
             if (!response.ok) {
-                if (response.status === 429) {
-                    throw new Error('Rate limit exceeded. Please try again in a moment.');
-                }
-                throw new Error(`HTTP error! status: ${response.status}`);
+                const is429 = response.status === 429;
+                let serverMsg = '';
+                try {
+                    const errJson = await response.clone().json();
+                    serverMsg = errJson?.error || errJson?.message || '';
+                } catch {}
+                const msg = is429
+                    ? 'Rate limit exceeded. Please try again shortly.'
+                    : (serverMsg ? `${serverMsg} (HTTP ${response.status})`
+                                 : `HTTP ${response.status}`);
+                throw new Error(msg);
             }
             
-            return await response.json();
+            return await response.json();
         } catch (error) {
             console.error('API request failed:', error);
             throw error;
-        }
+        } finally {
+            clearTimeout(t);
+        }
     }

---

45-64: Transcription: send API key header and handle unified /predict fallback.

Some deployments expect /predict with base64 payload. Keep FormData path but add API key; optionally allow a JSON path if needed later.

-            const response = await fetch(`${this.baseURL}/transcribe/voice`, {
+            const response = await fetch(`${this.baseURL}/transcribe/voice`, {
                 method: 'POST',
-                body: formData
+                body: formData,
+                headers: this.apiKey ? { 'X-API-Key': this.apiKey } : undefined
             });

---

70-72: Pass model identifier for emotion detection (unified /predict compatibility).

Aligns with “single /predict endpoint” objective; harmless for servers that ignore it.

-        return await this.makeRequest('/predict', { text });
+        return await this.makeRequest('/predict', { text, model: 'deberta-goemotions' });

---

445-458: Average confidence calc fails when emotions are not an array.

Support {probabilities:{...}} structure.

-        // Calculate average confidence
-        if (results.emotions && Array.isArray(results.emotions)) {
-            const avgConfidence = results.emotions.reduce((sum, e) => 
-                sum + (e.confidence || e.score || 0), 0) / results.emotions.length;
-            document.getElementById('avgConfidence').textContent = 
-                `${Math.round(avgConfidence * 100)}%`;
-        }
+        // Calculate average confidence
+        const em = results.emotions;
+        if (em) {
+            let avg = null;
+            if (Array.isArray(em)) {
+                avg = em.reduce((s, e) => s + (e.confidence || e.score || 0), 0) / Math.max(em.length, 1);
+            } else if (em.probabilities && typeof em.probabilities === 'object') {
+                const vals = Object.values(em.probabilities);
+                avg = vals.reduce((s, v) => s + (Number(v) || 0), 0) / Math.max(vals.length, 1);
+            }
+            if (avg != null) {
+                document.getElementById('avgConfidence').textContent = `${Math.round(avg * 100)}%`;
+            }
+        }

---

421-443: Color map is incomplete for 28 GoEmotions labels.

Add missing labels to improve chart readability.

Happy to add a full 28‑label palette if you want it in this PR.

tests/integration/test_demo_functionality.py (3)

56-68: Request shape in tests vs. frontend mismatch (audio).

Tests expect JSON {audio_data, model:'whisper'} while the demo sends multipart/form-data with audio_file. Align one of them to avoid confusion for future E2E.

Do you want to move the frontend to the single /predict JSON shape (per PR summary) or keep multipart and update tests?

---

69-81: Request shape mismatch (summarization).

Tests include "model": "t5" but the demo sends only { text } to /summarize/text. Decide on unified /predict with model or keep separate endpoints and update tests accordingly.

---

44-44: Silence unused‑fixture warnings.

Prefix unused args with _ or use them to build URLs.

-    def test_demo_emotion_detection_request_format(self, demo_api_url, sample_text):
+    def test_demo_emotion_detection_request_format(self, _demo_api_url, sample_text):
@@
-    def test_demo_whisper_request_format(self, demo_api_url, sample_audio_data):
+    def test_demo_whisper_request_format(self, _demo_api_url, sample_audio_data):
@@
-    def test_demo_t5_request_format(self, demo_api_url, sample_text):
+    def test_demo_t5_request_format(self, _demo_api_url, sample_text):
@@
-    def test_demo_full_workflow(self, demo_api_url, sample_text, sample_audio_data):
+    def test_demo_full_workflow(self, _demo_api_url, _sample_text, _sample_audio_data):

Also applies to: 56-56, 69-69, 137-137

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

tests/integration/test_demo_functionality.py (4)

133-139: Loop in test violates testing best practices.

---

34-41: Test only validates local constants, not actual API behavior.

This test and many others in this file don't actually test the API or application logic - they only assert on local variables, providing no real test coverage.

---

44-54: Test doesn't make actual API calls or validate request format.

The test creates a local dictionary and asserts on it, which doesn't validate the actual request format sent by the demo.

---

123-139: Test provides no value as it only validates local data.

This error handling test doesn't test any actual error handling logic.

.gitignore (1)

21-31: Deduplicate ignore patterns for website/config.js and .env.

Redundant entries make maintenance error‑prone without functional benefit.

Apply this diff to keep a single, grouped block:

-website/config.js
-.env
-website/config.js.*.local
-.env
-website/config.js.development
-.env
-website/config.js.local
-.env
-website/config.js.production
-.env
-website/config.js.test
+website/config.js
+website/config.js.*.local
+website/config.js.development
+website/config.js.local
+website/config.js.production
+website/config.js.test

And remove the duplicate later occurrence:

-website/config.js

Also applies to: 95-95

deployment/cloud-run/secure_api_server.py (4)

239-248: Guard duration variable in after_request.

If g.start_time is ever missing (e.g., early failure before before_request), duration is undefined when logging.

 def after_request(response):
     """Add request tracking headers"""
-    if hasattr(g, 'start_time'):
-        duration = time.time() - g.start_time
-        response.headers['X-Request-Duration'] = str(duration)
+    duration = 0.0
+    if hasattr(g, 'start_time'):
+        duration = time.time() - g.start_time
+        response.headers['X-Request-Duration'] = str(duration)
@@
-    logger.info(f"📤 Response: {response.status_code} for {request.method} {request.path} "
-                f"from {request.remote_addr} (ID: {g.request_id}, Duration: {duration:.3f}s)")
+    logger.info(f"📤 Response: {response.status_code} for {request.method} {request.path} "
+                f"from {request.remote_addr} (ID: {getattr(g,'request_id','-')}, Duration: {duration:.3f}s)")

---

455-459: Log full tracebacks in error handlers for parity with endpoint try/except.

Use logger.exception to capture stack traces.

 def internal_error(error):
     """Handle internal server errors"""
-    logger.error(f"Internal server error for {request.remote_addr}: {str(error)}")
+    logger.exception("Internal server error")
     return create_error_response('Internal server error', 500)
@@
 def handle_unexpected_error(error):
     """Handle any unexpected errors"""
-    logger.error(f"Unexpected error for {request.remote_addr}: {str(error)}")
+    logger.exception("Unexpected error")
     return create_error_response('An unexpected error occurred', 500)

Also applies to: 470-474

---

139-139: Verify emotion label set size vs. product claim (28 labels).

This mapping contains 12 entries, while the demo and docs reference 28 GoEmotions labels. Confirm the intended set and update or add a source of truth shared across API and UI.

---

511-514: Nit: trailing comments without code can be removed or moved near definitions.

Keeps module tidy.

website/css/comprehensive-demo.css (1)

238-247: Respect reduced motion and add focus-visible styles for accessibility.

Animations can hinder users with motion sensitivities; buttons lack visible keyboard focus.

 @keyframes pulse {
   0% { transform: scale(1); }
   50% { transform: scale(1.1); }
   100% { transform: scale(1); }
 }
+
+/* Reduce motion for users who prefer it */
+@media (prefers-reduced-motion: reduce) {
+  .step.active .step-circle,
+  .spinner {
+    animation: none !important;
+  }
+  .btn:hover {
+    transform: none !important;
+    box-shadow: none !important;
+  }
+}

 .btn-primary:hover {
-    transform: translateY(-2px);
-    box-shadow: 0 8px 20px rgba(102, 126, 234, 0.3);
+    transform: translateY(-2px);
+    box-shadow: 0 8px 20px rgba(102, 126, 234, 0.3);
 }
+
+.btn:focus-visible {
+    outline: 3px solid #667eea;
+    outline-offset: 2px;
+}

Also applies to: 186-191, 119-122

website/js/chart-utils.js (4)

10-12: Use 2D rendering context for Chart.js initialization.

Passing the canvas element works, but using the 2D context is clearer and avoids accidental non-canvas targets.

-const ctx = document.getElementById(containerId);
+const canvas = document.getElementById(containerId);
+if (!canvas) return;
+const ctx = canvas.getContext('2d');

---

29-48: Color palette too short for up to 28 emotions; generate deterministic colors.

Avoid repeated colors when labels > 8.

- backgroundColor: [
-   'rgba(102, 126, 234, 0.8)', 'rgba(168, 85, 247, 0.8)', ...
- ],
- borderColor: [
-   'rgba(102, 126, 234, 1)', 'rgba(168, 85, 247, 1)', ...
- ],
+ backgroundColor: labels.map((_, i) => `hsla(${(i*360/labels.length)|0},70%,60%,0.8)`),
+ borderColor:    labels.map((_, i) => `hsla(${(i*360/labels.length)|0},70%,45%,1)`),

---

70-91: Improve axis/legend contrast for light backgrounds.

#e2e8f0 can be too faint on white cards. Use a darker neutral.

- color: '#e2e8f0',
+ color: '#475569',

Also applies to: 127-147

---

101-154: Handle undefined summary metrics gracefully.

Default to 0 to avoid NaN in charts if fields are missing.

- data: [summaryData.original_length, summaryData.summary_length],
+ data: [
+   Number(summaryData?.original_length ?? 0),
+   Number(summaryData?.summary_length ?? 0)
+],

deployment/cloud-run/cloudbuild.yaml (2)

3-9: Pin deploy to the exact image built and set basic service controls.

Current deploy uses a floating tag; prefer digest or a versioned tag and set min instances/concurrency if desired.

Example adjustments:

• Tag with the build ID, deploy that tag, and record the digest.
• Optionally set --min-instances, --max-instances, --concurrency, and env vars.

-args: ['build', '-t', 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api', '-f', 'deployment/cloud-run/Dockerfile.unified', '.']
+args: ['build', '-t', 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api:${BUILD_ID}', '-f', 'deployment/cloud-run/Dockerfile.unified', '.']
@@
-args: ['push', 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api']
+args: ['push', 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api:${BUILD_ID}']
@@
-args: ['run', 'deploy', 'samo-unified-api', '--image', 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api', '--region', 'us-central1', '--platform', 'managed', '--allow-unauthenticated']
+args: ['run', 'deploy', 'samo-unified-api',
+       '--image', 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api:${BUILD_ID}',
+       '--region', 'us-central1', '--platform', 'managed', '--allow-unauthenticated',
+       '--concurrency', '80', '--min-instances', '0', '--max-instances', '5']
@@
-images:
-  - 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api'
+images:
+  - 'us-central1-docker.pkg.dev/the-tendril-466607-n8/samo-dl/samo-unified-api:${BUILD_ID}'

---

7-7: Set critical env vars at deploy time if needed (e.g., HF tokens, limits).

If the unified API needs configuration, add --set-env-vars now to avoid accidental defaults.

deployment/cloud-run/Dockerfile.unified (3)

33-34: Remove unused copy of deployment/cloud-run/requirements.txt.

Not installed anywhere; dead layer.

-COPY deployment/cloud-run/requirements.txt ./deployment/cloud-run/

---

44-46: Note: Docker HEALTHCHECK is ignored by Cloud Run.

Keep if useful locally, but Cloud Run uses request health checks and startup probes configured at deploy time.

---

47-48: Consider gunicorn for multi‑worker serving on Cloud Run.

Uvicorn direct is fine for light loads; gunicorn with uvicorn workers improves resiliency.

Example CMD:

gunicorn -k uvicorn.workers.UvicornWorker -w $((CPU_COUNT*2)) -b 0.0.0.0:8080 src.unified_ai_api:app

website/API_SETUP.md (1)

55-57: Specify a language for fenced code block (markdownlint MD040).

Add text for the URL block.

-```
+```text
 http://localhost:8080/comprehensive-demo.html

</blockquote></details>
<details>
<summary>website/js/comprehensive-demo-new.js (1)</summary><blockquote>

`23-38`: **Validate inputs early and handle “text‑only” runs by completing step 1.**

Avoid leaving step1 in “active” when no audio, and fail fast if both inputs are empty.


```diff
 try {
     this.uiController.showLoading();
     this.uiController.updateProgressStep('step1', 'active');
 
     // Step 1: Transcribe audio if provided
-    if (audioFile) {
+    if (audioFile) {
       try {
         results.transcription = await this.apiClient.transcribeAudio(audioFile);
         results.modelsUsed.push('Whisper');
         this.uiController.updateProgressStep('step1', 'completed');
         this.uiController.showTranscriptionResults(results.transcription);
       } catch (error) {
         console.error('Transcription failed:', error);
         this.uiController.updateProgressStep('step1', 'error');
       }
-    }
+    } else {
+      // No audio provided; mark step as completed for text-only flow
+      this.uiController.updateProgressStep('step1', 'completed');
+    }

Optional (fail fast):

-// Step 2: Summarize text
+// Step 2: Summarize text
 let currentText = text;
 if (results.transcription && results.transcription.text) {
   currentText = results.transcription.text;
 }
+if (!audioFile && (!currentText || !currentText.trim())) {
+  throw new Error('Provide audio or text to process.');
+}

website/js/api-client.js (2)

11-11: Unused retryAttempts configuration.

The retryAttempts property is initialized but never used. Consider implementing retry logic or removing it.

Would you like me to implement retry logic with exponential backoff for better resilience against transient failures?

---

88-103: Mock response could be more realistic.

The mock summarization simply truncates the text, which doesn't provide a meaningful demo experience.

Consider implementing a more intelligent mock summarization:

     getMockSummaryResponse(text) {
-        // Mock summarization response for demo purposes
-        const words = text.split(' ');
-        const summaryLength = Math.max(10, Math.floor(words.length * 0.3));
-        const summary = words.slice(0, summaryLength).join(' ') + '...';
+        // Extract key sentences for a more realistic summary
+        const sentences = text.match(/[^.!?]+[.!?]+/g) || [text];
+        const keywordCount = {};
+        
+        // Simple keyword extraction
+        text.toLowerCase().split(/\W+/).forEach(word => {
+            if (word.length > 4) {
+                keywordCount[word] = (keywordCount[word] || 0) + 1;
+            }
+        });
+        
+        // Take first and most relevant sentences
+        const summaryLength = Math.max(1, Math.ceil(sentences.length * 0.3));
+        const summary = sentences.slice(0, summaryLength).join(' ').trim();
         
         return {
             summary: summary,
             original_length: text.length,
             summary_length: summary.length,
             compression_ratio: (summary.length / text.length).toFixed(2),
             request_id: 'demo-' + Date.now(),
             timestamp: Date.now() / 1000,
             mock: true
         };
     }

website/js/ui-controller.js (5)

48-50: Check for demo initialization before calling methods.

The code assumes window.demo exists and has the processCompleteWorkflow method, but doesn't handle the case where it might be undefined or missing the method.

Add proper validation:

         // Trigger the main processing workflow
         if (window.demo) {
-            window.demo.processCompleteWorkflow(audioFile, text);
+            if (typeof window.demo.processCompleteWorkflow === 'function') {
+                window.demo.processCompleteWorkflow(audioFile, text);
+            } else {
+                this.showError('Demo not properly initialized. Please refresh the page.');
+            }
+        } else {
+            this.showError('Demo not loaded. Please refresh the page.');
         }
-        }

---

224-224: Potential precision loss with confidence clamping.

The clamping logic on Line 224 might cause confusion as it silently modifies confidence values that are out of range.

Consider logging when values are clamped for debugging:

-            const confidence = Math.max(0, Math.min(1, emotion.confidence)) * 100; // Clamp between 0-100
+            const rawConfidence = emotion.confidence;
+            const confidence = Math.max(0, Math.min(1, rawConfidence)) * 100;
+            if (rawConfidence < 0 || rawConfidence > 1) {
+                console.warn(`Confidence value ${rawConfidence} was clamped to [0,1] range`);
+            }

---

133-139: Potential XSS vulnerability in innerHTML usage.

While the stats content appears safe, using innerHTML for dynamic content is a security risk if any values come from user input or external sources.

Consider using safer DOM manipulation:

         const stats = document.createElement('div');
         stats.className = 'transcription-stats';
-        stats.innerHTML = `
-            <small class="text-muted">
-                Duration: ${transcription.duration || 'N/A'} | 
-                Confidence: ${((transcription.confidence || 0) * 100).toFixed(1)}% |
-                Language: ${transcription.language || 'en'}
-            </small>
-        `;
+        const small = document.createElement('small');
+        small.className = 'text-muted';
+        small.textContent = `Duration: ${transcription.duration || 'N/A'} | ` +
+            `Confidence: ${((transcription.confidence || 0) * 100).toFixed(1)}% | ` +
+            `Language: ${transcription.language || 'en'}`;
+        stats.appendChild(small);

---

6-10: Consider extracting error message element to initialization.

The errorMsgEl is initialized as null in the constructor but created dynamically later. This could be simplified.

Initialize the error element once during setup:

     constructor() {
         this.initializeElements();
         this.setupEventListeners();
-        this.errorMsgEl = null;
     }

     initializeElements() {
         // Input elements
         this.audioFileInput = document.getElementById('audioFile');
         this.textInput = document.getElementById('textInput');
         this.processBtn = document.getElementById('processBtn');
         
+        // Create error message element
+        this.errorMsgEl = document.createElement('div');
+        this.errorMsgEl.className = 'error-message';
+        this.errorMsgEl.style.cssText = 'color: #dc3545; background: #f8d7da; border: 1px solid #f5c6cb; border-radius: 8px; padding: 0.75rem; margin-top: 0.5rem; display: none;';
+        this.textInput.parentNode.insertBefore(this.errorMsgEl, this.textInput.nextSibling);
+        
         // Progress elements

Then simplify the showError method:

     showError(message) {
-        if (!this.errorMsgEl) {
-            // Create error message element if it doesn't exist
-            this.errorMsgEl = document.createElement('div');
-            this.errorMsgEl.className = 'error-message';
-            this.errorMsgEl.style.color = '#dc3545';
-            this.errorMsgEl.style.background = '#f8d7da';
-            this.errorMsgEl.style.border = '1px solid #f5c6cb';
-            this.errorMsgEl.style.borderRadius = '8px';
-            this.errorMsgEl.style.padding = '0.75rem';
-            this.errorMsgEl.style.marginTop = '0.5rem';
-            this.textInput.parentNode.insertBefore(this.errorMsgEl, this.textInput.nextSibling);
-        }
         this.errorMsgEl.textContent = message;
         this.errorMsgEl.style.display = 'block';
     }

---

247-251: Remove or use unused escapeHtml helper (security/cleanup).

escapeHtml is defined at website/js/ui-controller.js:247 and not referenced anywhere — remove it or apply it when assigning untrusted text to innerHTML to prevent XSS.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

src/security_setup.py (3)

1-1: Remove the shebang; this module isn’t an entrypoint.

Shebang suggests direct execution, which conflicts with the new relative import.

-#!/usr/bin/env python3

---

25-42: Set the canonical flags actually used by the middleware, not just the aliases.

SecurityHeadersMiddleware checks enable_content_security_policy and enable_strict_transport_security. Make these explicit to avoid future drift if defaults change.

 return SecurityHeadersConfig(
-        enable_csp=True,
-        enable_hsts=True,
+        enable_csp=True,
+        enable_hsts=True,
+        enable_content_security_policy=True,
+        enable_strict_transport_security=True,
         enable_x_frame_options=True,
         enable_x_content_type_options=True,
         enable_x_xss_protection=True,
         enable_referrer_policy=True,
-        enable_permissions_policy=True,
+        enable_permissions_policy=is_production,
         enable_cross_origin_embedder_policy=True,
         enable_cross_origin_opener_policy=True,
         enable_cross_origin_resource_policy=True,
         enable_origin_agent_cluster=True,
         enable_request_id=True,
         enable_correlation_id=True,
         enable_enhanced_ua_analysis=True,
         ua_suspicious_score_threshold=4,
         ua_blocking_enabled=is_production  # Block suspicious UAs in production only
     )

---

25-42: Demo needs microphone; current Permissions-Policy denies it.

_build_permissions_policy() returns microphone=(), which blocks getUserMedia. Since the demo records audio, gate the header by env (already suggested above) or override the policy to allow microphone for the UI origin.

Confirm whether the demo HTML is ever served by this Flask app in dev/staging. If yes, either:

• disable Permissions-Policy in non-prod (as above), or
• customize the policy in configs/security.yaml to: microphone=(self) (and any other needed features), and ensure CSP allows any required blob:/CDN sources for audio/Chart.js.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

scripts/training/debug_colab_compatibility.py (3)

22-25: Avoid naive .split(); use shlex.split, enforce shell=False, add a timeout

.split() breaks quoted args/paths and can mis-tokenize; shlex.split() is safer and satisfies the static analysis concern. Also add an explicit timeout to prevent hangs.

Apply this diff within this hunk:

-        # Convert string command to list if needed
-        if isinstance(command, str):
-            command = command.split()
-        result = subprocess.run(command, capture_output=True, text=True, check=False)
+        # Convert string command to argv safely
+        if isinstance(command, str):
+            command = shlex.split(command)
+        elif isinstance(command, tuple):
+            command = list(command)
+        result = subprocess.run(
+            command,
+            capture_output=True,
+            text=True,
+            check=False,
+            shell=False,
+            timeout=300,
+        )

Outside this hunk, add the missing import:

import shlex  # near the other imports

---

149-161: Call pip via the running interpreter to avoid Colab/env mismatches

Using the bare pip can target a different environment. Prefer sys.executable -m pip and pass argv as a list to skip re-splitting.

-    success, _ = run_command(
-        "pip uninstall torch torchvision torchaudio -y",
-        "Uninstalling existing PyTorch"
-    )
+    success, _ = run_command(
+        [sys.executable, "-m", "pip", "uninstall", "-y", "torch", "torchvision", "torchaudio"],
+        "Uninstalling existing PyTorch"
+    )
@@
-    success, _ = run_command(
-        "pip install torch==2.1.0 torchvision==0.16.0 torchaudio==2.1.0 --index-url https://download.pytorch.org/whl/cu118",
-        "Installing compatible PyTorch"
-    )
+    success, _ = run_command(
+        [sys.executable, "-m", "pip", "install",
+         "--index-url", "https://download.pytorch.org/whl/cu118",
+         "torch==2.1.0", "torchvision==0.16.0", "torchaudio==2.1.0"],
+        "Installing compatible PyTorch"
+    )

---

176-187: Do the same for Transformers install/uninstall

Keep installs tied to the active interpreter and avoid string commands.

-    success, _ = run_command(
-        "pip uninstall transformers -y",
-        "Uninstalling existing Transformers"
-    )
+    success, _ = run_command(
+        [sys.executable, "-m", "pip", "uninstall", "-y", "transformers"],
+        "Uninstalling existing Transformers"
+    )
@@
-    success, _ = run_command(
-        "pip install transformers==4.30.0",
-        "Installing compatible Transformers"
-    )
+    success, _ = run_command(
+        [sys.executable, "-m", "pip", "install", "transformers==4.30.0"],
+        "Installing compatible Transformers"
+    )

deployment/cloud-run/debug_errorhandler_detailed.py (3)

6-8: Don’t clobber an existing ADMIN_API_KEY in the environment.
Use a default to avoid overwriting a real key when running the script locally.

Apply this diff:

-import os
-os.environ['ADMIN_API_KEY'] = 'test123'
+import os
+os.environ.setdefault('ADMIN_API_KEY', 'test123')

---

16-18: Prefer sys.exit over exit() in scripts.
exit() is meant for interactive shells; sys.exit() is clearer and reliable.

Apply this diff:

+import sys
 try:
     import flask
     from flask import Flask
     from flask_restx import Api
     print("✅ Imports successful")
 except Exception as e:
     print(f"❌ Import failed: {e}")
-    exit(1)
+    sys.exit(1)

 try:
     app = Flask(__name__)
     api = Api(app, version='1.0.0', title='Test')
     print("✅ API object created")
 except Exception as e:
     print(f"❌ API creation failed: {e}")
-    exit(1)
+    sys.exit(1)

Also applies to: 24-26

---

72-78: Make Flask version reporting robust across releases.
flask.__version__ can be absent in some versions; fall back to importlib.metadata.

Apply this diff:

 try:
     import flask_restx
-    print(f"\n🔍 Flask-RESTX version: {flask_restx.__version__}")
-    print(f"Flask version: {flask.__version__}")
+    print(f"\n🔍 Flask-RESTX version: {getattr(flask_restx, '__version__', 'unknown')}")
+    try:
+        from importlib.metadata import version as pkg_version
+        flask_ver = getattr(flask, '__version__', None) or pkg_version('flask')
+    except Exception:
+        flask_ver = getattr(flask, '__version__', 'unknown')
+    print(f"Flask version: {flask_ver}")
 except Exception as e:
     print(f"❌ Could not get versions: {e}")

scripts/training/robust_domain_adaptation_training.py (5)

17-19: Top-level torch/nn/F imports look good; drop duplicate local imports.

torch is re-imported inside functions (Lines 314, 352). Prefer relying on the top-level import for consistency.

---

57-65: Same pip concerns for install steps.

Bind to sys.executable -m pip, add timeout, and consider CPU-only fallback if CUDA wheels are unavailable.

Minimal change pattern:

subprocess.run([sys.executable, "-m", "pip", "install", "torch==2.1.0", "torchvision==0.16.0", "torchaudio==2.1.0",
                "--index-url", "https://download.pytorch.org/whl/cu118", "--no-cache-dir"],
               text=True, check=False, timeout=1800)

---

235-238: FocalLoss change to top-level F is fine; add light input validation.

Guard common misuses to fail fast (dtype/shape).

 def __call__(self, inputs, targets):
-    ce_loss = F.cross_entropy(inputs, targets, reduction='none')
+    if targets.dtype != torch.long:
+        raise TypeError(f"targets.dtype must be torch.long, got {targets.dtype}")
+    if inputs.ndim != 2:
+        raise ValueError(f"inputs must be [N, C], got {inputs.shape}")
+    ce_loss = F.cross_entropy(inputs, targets, reduction='none')

---

70-98: Verification step: prefer warnings over hard failure when CUDA is absent.

Current behavior is fine, but consider gating torch.backends.cudnn.benchmark = True behind is_available() and fixed input sizes; it can hurt variability.

---

333-349: End-to-end flow will abort on earlier failures; add checks and clear next-step hints.

If setup_repository() or dataset loading fails, raise or exit with nonzero status to aid CI detection.

scripts/legacy/retrain_with_expanded_dataset.py (1)

72-76: Make pooling robust across transformer backbones

outputs.pooler_output can be None (e.g., RoBERTa/DeBERTa). Fall back to masked mean of last_hidden_state to avoid silent degradation if model_name changes.

-        outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
-        pooled_output = outputs.pooler_output
+        outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask, return_dict=True)
+        pooled_output = getattr(outputs, "pooler_output", None)
+        if pooled_output is None:
+            last_hidden = outputs.last_hidden_state
+            mask = attention_mask.unsqueeze(-1)
+            pooled_output = (last_hidden * mask).sum(dim=1) / mask.sum(dim=1).clamp(min=1e-9)
         logits = self.classifier(self.dropout(pooled_output))

Confirm that any checkpoints you plan to fine-tune here aren’t reliant on a pooler (e.g., DeBERTa, RoBERTa). If they are, this change will prevent a runtime error and keep metrics meaningful.

scripts/training/focal_loss_training_fixed.py (3)

129-137: Define test_dataset and fix dataset size logs.

Currently you touch datasets["test"] without assigning, and logs use literal braces. Define the variable and log counts with parameters.

-        train_dataset = datasets["train"]
-        val_dataset = datasets["validation"]
-        datasets["test"]
-        datasets["class_weights"]
+        train_dataset = datasets["train"]
+        val_dataset = datasets["validation"]
+        test_dataset = datasets["test"]
+        _class_weights = datasets.get("class_weights")
@@
-        logger.info("Dataset loaded successfully:")
-        logger.info("   • Train: {len(train_dataset)} examples")
-        logger.info("   • Validation: {len(val_dataset)} examples")
-        logger.info("   • Test: {len(test_dataset)} examples")
+        logger.info("Dataset loaded successfully:")
+        logger.info("   • Train: %d examples", len(train_dataset))
+        logger.info("   • Validation: %d examples", len(val_dataset))
+        logger.info("   • Test: %d examples", len(test_dataset))

---

139-141: Log exception with traceback in dataset loading.

Capture full context using logger.exception inside the except block.

-    except Exception:
-        logger.error("Failed to load dataset: {e}")
-        raise
+    except Exception:
+        logger.exception("Failed to load dataset")
+        raise

---

25-25: Shebang should be the first line.

If you intend to execute this file directly, move #!/usr/bin/env python3 to line 1.

scripts/maintenance/fix_all_imports_aggressive.py (2)

128-132: Initialize logging once.

Ensure INFO logs are visible in CLI runs.

 def main():
     """Fix all import and linting issues aggressively."""
-    script_dir = Path(__file__).parent
+    logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
+    script_dir = Path(__file__).parent

---

106-108: Remove no-op regex substitutions.

These two substitutions don’t change content. Drop them or replace with a real f-string simplifier if needed.

-    content = re.sub(r'"([^"]*)"', r'"\1"', content)
-    content = re.sub(r"'([^']*)'", r"'\1'", content)

scripts/testing/simple_threshold_test.py (1)

9-9: Shebang is not at the top of the file.

Either move it to line 1 or drop it (tests typically run via pytest).

scripts/testing/minimal_eval_test.py (1)

7-7: Shebang is not at the top.

Move to line 1 or remove (pytest-run tests don’t need it).

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro