Skip to content

fix: harden input validation, file safety, and error handling #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ankit1999 wants to merge 8 commits into
base: main
Choose a base branch
from
Open

fix: harden input validation, file safety, and error handling #227

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9c97815
feat: add custom HuggingFace voice model support
ankit1999 Mar 1, 2026
a7e698a
fix: harden input validation, file safety, and error handling
ankit1999 Mar 2, 2026
888d5a5
fix(review): address second round of code review feedback
ankit1999 Apr 19, 2026
10446f1
fix(review): address third round of code review feedback
ankit1999 Apr 19, 2026
d983119
fix(review): address fourth round of code review feedback
ankit1999 Apr 19, 2026
4447a87
fix(review): address fifth round of code review feedback
ankit1999 Apr 19, 2026
ff9c08d
Merge origin/main into feat/custom-voice-models
ankit1999 Apr 19, 2026
ae135ae
chore: remove workflow files (will be added separately with workflow …
ankit1999 Apr 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 39 additions & 7 deletions app/src/components/Generation/FloatingGenerateBox.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,17 @@ import { Form, FormControl, FormField, FormItem, FormMessage } from '@/component
import {
Select,
SelectContent,
SelectGroup,
SelectItem,
SelectLabel,
Comment on lines +11 to +13
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove unused imports.

SelectGroup and SelectLabel are imported but never used in this component.

🧹 Proposed fix to remove unused imports 
 import {
   Select,
   SelectContent,
-  SelectGroup,
   SelectItem,
-  SelectLabel,
   SelectTrigger,
   SelectValue,
 } from '@/components/ui/select';
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
SelectGroup,
SelectItem,
SelectLabel,
import {
Select,
SelectContent,
SelectItem,
SelectTrigger,
SelectValue,
} from '@/components/ui/select';
🧰 Tools
🪛 Biome (2.4.11)

[error] 11-13: Several of these imports are unused.

(lint/correctness/noUnusedImports)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/src/components/Generation/FloatingGenerateBox.tsx` around lines 11 - 13,
The import list in FloatingGenerateBox.tsx includes unused symbols SelectGroup
and SelectLabel; remove these two from the named imports (the import that
currently lists SelectGroup, SelectItem, SelectLabel) so only used symbols like
SelectItem remain, then run a quick type-check/ESLint to ensure no other unused
imports remain.

SelectTrigger,
SelectValue,
} from '@/components/ui/select';
import { Textarea } from '@/components/ui/textarea';
import { useToast } from '@/components/ui/use-toast';
import { LANGUAGE_OPTIONS } from '@/lib/constants/languages';
import { useGenerationForm } from '@/lib/hooks/useGenerationForm';
import { useModelStatus } from '@/lib/hooks/useModelStatus';
import { useProfile, useProfiles } from '@/lib/hooks/useProfiles';
import { useAddStoryItem, useStory } from '@/lib/hooks/useStories';
import { cn } from '@/lib/utils/cn';
Expand Down Expand Up @@ -46,6 +49,9 @@ export function FloatingGenerateBox({
const addStoryItem = useAddStoryItem();
const { toast } = useToast();

// Use shared hook for model status fetching and grouping
const { builtInModels, customModels } = useModelStatus();

// Calculate if track editor is visible (on stories route with items)
const hasTrackEditor = isStoriesRoute && currentStory && currentStory.items.length > 0;

Expand Down Expand Up @@ -173,7 +179,7 @@ export function FloatingGenerateBox({
'fixed right-auto',
isStoriesRoute
? // Position aligned with story list: after sidebar + padding, width 360px
'left-[calc(5rem+2rem)] w-[360px]'
'left-[calc(5rem+2rem)] w-[360px]'
: 'left-[calc(5rem+2rem)] w-[calc((100%-5rem-4rem)/2-1rem)]',
)}
style={{
Expand Down Expand Up @@ -414,12 +420,38 @@ export function FloatingGenerateBox({
</SelectTrigger>
</FormControl>
<SelectContent>
<SelectItem value="1.7B" className="text-xs text-muted-foreground">
Qwen3-TTS 1.7B
</SelectItem>
<SelectItem value="0.6B" className="text-xs text-muted-foreground">
Qwen3-TTS 0.6B
</SelectItem>
<SelectGroup>
<SelectLabel className="text-xs">Built-in</SelectLabel>
{builtInModels.length > 0 ? (
builtInModels.map((model) => {
const sizeValue = model.model_name.replace('qwen-tts-', '');
return (
<SelectItem key={model.model_name} value={sizeValue} className="text-xs text-muted-foreground">
{model.display_name}
</SelectItem>
);
})
) : (
<>
<SelectItem value="1.7B" className="text-xs text-muted-foreground">
Qwen3-TTS 1.7B
</SelectItem>
<SelectItem value="0.6B" className="text-xs text-muted-foreground">
Qwen3-TTS 0.6B
</SelectItem>
</>
)}
</SelectGroup>
{customModels.length > 0 && (
<SelectGroup>
<SelectLabel className="text-xs">Custom</SelectLabel>
{customModels.map((model) => (
<SelectItem key={model.model_name} value={model.model_name} className="text-xs text-muted-foreground">
{model.display_name}
</SelectItem>
))}
</SelectGroup>
)}
</SelectContent>
</Select>
<FormMessage className="text-xs" />
Expand Down
41 changes: 37 additions & 4 deletions app/src/components/Generation/GenerationForm.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,16 @@ import { Input } from '@/components/ui/input';
import {
Select,
SelectContent,
SelectGroup,
SelectItem,
SelectLabel,
Comment on lines +18 to +20
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove unused imports.

SelectGroup and SelectLabel are imported but never used in this component.

🧹 Proposed fix to remove unused imports 
 import {
   Select,
   SelectContent,
-  SelectGroup,
   SelectItem,
-  SelectLabel,
   SelectTrigger,
   SelectValue,
 } from '@/components/ui/select';
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
SelectGroup,
SelectItem,
SelectLabel,
import {
Select,
SelectContent,
SelectItem,
SelectTrigger,
SelectValue,
} from '@/components/ui/select';
🧰 Tools
🪛 Biome (2.4.11)

[error] 18-20: Several of these imports are unused.

(lint/correctness/noUnusedImports)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/src/components/Generation/GenerationForm.tsx` around lines 18 - 20, The
imports SelectGroup and SelectLabel in the GenerationForm component are unused;
remove them from the import list that currently includes SelectGroup,
SelectItem, SelectLabel so only the needed symbols (e.g., SelectItem) remain,
updating the import statement at the top of GenerationForm.tsx (the
component/function named GenerationForm) to eliminate SelectGroup and
SelectLabel.

SelectTrigger,
SelectValue,
} from '@/components/ui/select';
import { Textarea } from '@/components/ui/textarea';
import { LANGUAGE_OPTIONS } from '@/lib/constants/languages';
import { useGenerationForm } from '@/lib/hooks/useGenerationForm';
import { useModelStatus } from '@/lib/hooks/useModelStatus';
import { useProfile } from '@/lib/hooks/useProfiles';
import { useUIStore } from '@/stores/uiStore';

Expand All @@ -30,6 +33,9 @@ export function GenerationForm() {

const { form, handleSubmit, isPending } = useGenerationForm();

// Use shared hook for model status fetching and grouping
const { builtInModels, customModels } = useModelStatus();
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Prevent built-in/custom option overlap from hook classification.

builtInModels from useModelStatus is based on model_name.startsWith('qwen-tts'). A custom repo like qwen-tts/my-voice can appear in both groups and be misinterpreted in built-in mapping.

🔧 Proposed fix (in app/src/lib/hooks/useModelStatus.ts) 
-const builtInModels =
-  modelStatus?.models.filter((m) => m.model_name.startsWith('qwen-tts')) || [];
+const builtInModels =
+  modelStatus?.models.filter((m) => !m.is_custom && m.model_name.startsWith('qwen-tts-')) || [];
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/src/components/Generation/GenerationForm.tsx` at line 37, The hook
useModelStatus currently classifies builtInModels using
model_name.startsWith('qwen-tts'), which incorrectly flags repos like
"qwen-tts/my-voice" as built-in; update the predicate in useModelStatus (the
filter that builds builtInModels/customModels) to only treat true built-ins such
as the core qwen-tts identifier (e.g., model_name === 'qwen-tts' or match a
pattern that disallows a following '/'), for example replace
startsWith('qwen-tts') with a stricter check (exact equality or a regex like
/^qwen-tts($|[:@])/) so repo-qualified names with a slash go to customModels.


async function onSubmit(data: Parameters<typeof handleSubmit>[0]) {
await handleSubmit(data, selectedProfileId);
}
Expand Down Expand Up @@ -129,19 +135,46 @@ export function GenerationForm() {
name="modelSize"
render={({ field }) => (
<FormItem>
<FormLabel>Model Size</FormLabel>
<FormLabel>Model</FormLabel>
<Select onValueChange={field.onChange} defaultValue={field.value}>
<FormControl>
<SelectTrigger>
<SelectValue />
</SelectTrigger>
</FormControl>
<SelectContent>
<SelectItem value="1.7B">Qwen TTS 1.7B (Higher Quality)</SelectItem>
<SelectItem value="0.6B">Qwen TTS 0.6B (Faster)</SelectItem>
<SelectGroup>
<SelectLabel>Built-in</SelectLabel>
{builtInModels.length > 0 ? (
builtInModels.map((model) => {
// Map model_name (qwen-tts-1.7B) back to model_size value (1.7B)
const sizeValue = model.model_name.replace('qwen-tts-', '');
return (
<SelectItem key={model.model_name} value={sizeValue}>
{model.display_name}
</SelectItem>
);
})
) : (
<>
<SelectItem value="1.7B">Qwen TTS 1.7B (Higher Quality)</SelectItem>
<SelectItem value="0.6B">Qwen TTS 0.6B (Faster)</SelectItem>
</>
)}
</SelectGroup>
{customModels.length > 0 && (
<SelectGroup>
<SelectLabel>Custom</SelectLabel>
{customModels.map((model) => (
<SelectItem key={model.model_name} value={model.model_name}>
{model.display_name}
</SelectItem>
))}
</SelectGroup>
)}
</SelectContent>
</Select>
<FormDescription>Larger models produce better quality</FormDescription>
<FormDescription>Select voice generation model</FormDescription>
<FormMessage />
</FormItem>
)}
Expand Down
Loading