[davidbzyk]

Summary

• Resolve 84 findings from comprehensive 5-phase codebase review
• Fix 5 critical security issues (path validation bypass, upload allowlist, model name injection, OAuth secret exposure, sidecar health-check restart)
• Add performance improvements (shared HTTP clients, config caching, hardware video encoding, lazy sidecar start)
• Improve code quality (Provider enum, TypeScript union types, consolidated interfaces, extracted duplication)
• Clean up build config (narrowed tokio features, removed unused deps, fixed bundle targets)
• Fix documentation accuracy (README commands, BUILD.md code signing, entitlements rationale)
• Bump version to 0.2.0 with scripts/bump-version.sh for syncing across all config files

Test plan

• 139 Rust tests pass
• 94 frontend tests pass
• 60 Python sidecar tests pass
• svelte-check: 367 files, 0 errors, 0 warnings
• clippy: clean
• Manual test: YouTube extraction for voice creation works

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3fccdb4f-848c-4851-a490-c6016da58a1a

📥 Commits

Reviewing files that changed from the base of the PR and between 6fbc5ed and 1eba240.

⛔ Files ignored due to path filters (1)

• src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (37)

• .gitignore
• CHANGELOG.md
• README.md
• docs/BUILD.md
• package.json
• scripts/bump-version.sh
• src-tauri/Cargo.toml
• src-tauri/entitlements.plist
• src-tauri/sidecar/chunked_tts.py
• src-tauri/sidecar/entitlements.plist
• src-tauri/sidecar/profiles.py
• src-tauri/sidecar/server.py
• src-tauri/sidecar/test_binary.sh
• src-tauri/sidecar/tts.py
• src-tauri/src/commands/recording.rs
• src-tauri/src/config.rs
• src-tauri/src/elevenlabs.rs
• src-tauri/src/ffmpeg.rs
• src-tauri/src/google_drive.rs
• src-tauri/src/lib.rs
• src-tauri/src/local_tts.rs
• src-tauri/src/models.rs
• src-tauri/src/pipeline.rs
• src-tauri/src/secrets.rs
• src-tauri/src/sidecar.rs
• src-tauri/src/tts_provider.rs
• src-tauri/tauri.conf.json
• src/lib/state.svelte.ts
• src/lib/tauri.ts
• src/lib/voicebox.ts
• src/routes/(app)/+layout.ts
• src/routes/(app)/+page.svelte
• src/routes/(app)/create-voice/+page.svelte
• src/routes/(app)/models/+page.svelte
• src/routes/(app)/settings/+page.svelte
• svelte.config.js
• vitest.config.ts

---

📝 Walkthrough

Summary by CodeRabbit

Release Notes – v0.2.0

• New Features

  • Model settings sidebar with browsing, downloading, and tagging
  • In-library video renaming
  • Automatic ELEVENLABS_API_KEY detection from environment
  • Model deletion support
  • Whisper voice selection

• Bug Fixes

  • Fixed TTS initialization after voice switching
  • Fixed video clipping in TTS and voice conversion
  • Improved TTS timing and transcription alignment
  • Fixed model cache refresh after download
  • CosyVoice3 setup improvements

• Other Improvements

  • Models page moved to dedicated sidebar route

Walkthrough

Version bumped from 0.1.0 to 0.2.0 with improvements across model management, type safety, audio processing, security hardening, and architecture refactoring. Includes model deletion API, Python/TypeScript type modernization, macOS code signing enhancements, sidecar lazy startup, config caching, and shared HTTP client management.

Changes

Cohort / File(s)	Summary
Version & Release Infrastructure .gitignore, CHANGELOG.md, package.json, scripts/bump-version.sh, src-tauri/Cargo.toml, src-tauri/tauri.conf.json	Version incremented to 0.2.0; added version bump script; updated @types/node and removed @sveltejs/adapter-auto; restricted macOS bundle targets to ["dmg", "app"].
macOS Code Signing & Entitlements docs/BUILD.md, src-tauri/entitlements.plist, src-tauri/sidecar/entitlements.plist	Added code-signing entitlements for unsigned executable memory, JIT, dyld environment variables, microphone/camera access, and library-validation disabling; updated macOS release notes documenting code-signed builds with Developer ID signing.
Python Type Modernization src-tauri/sidecar/chunked_tts.py, src-tauri/sidecar/profiles.py, src-tauri/sidecar/tts.py	Migrated to PEP 585/604 syntax (list[str] → dict | None); added from __future__ import annotations; new pad_or_truncate_to_duration() utility; added __all__ exports; new whisper state helpers is_whisper_loaded() and get_whisper_model_name(); Qwen warmup and cached-prompt device mapping improvements.
Core Sidecar Logic & Diagnostics src-tauri/sidecar/server.py, src-tauri/sidecar/test_binary.sh	Added global exception handler, generation backpressure limiting (queue maxsize=100, MAX_GENERATIONS=1000), RotatingFileHandler for watchdog logs, extensive audio diagnostics (sample counts, WAV verification, voice-conversion duration warnings), opportunistic generation state cleanup; updated test assertions for 4-model status payload.
Rust Type System & Provider Configuration src-tauri/src/config.rs, src-tauri/src/tts_provider.rs	Replaced string provider with typed Provider enum; added in-memory ConfigCache with async RwLock for get/save operations; removed #[allow(dead_code)] from Provider; updated config tests to use Provider::\* variants.
Security Validation & Model Management src-tauri/src/models.rs, src-tauri/src/recording.rs, src-tauri/src/local_tts.rs	Added validate_model_name() helper rejecting path traversal and special characters; narrowed read_file_bytes allowlist to voiceover-recordings subdirectory; added ALLOWED_UPLOAD_PATHS validation for sidecar uploads; comprehensive unit tests for model-name validation.
API & HTTP Client Architecture src-tauri/src/elevenlabs.rs, src-tauri/src/google_drive.rs, src-tauri/src/sidecar.rs	Refactored HTTP clients to use shared HttpClient from Tauri app state instead of per-call reqwest::Client::new(); added HEALTH_CLIENT OnceLock for reuse; enhanced SidecarState with busy: bool field; improved mutex poisoning handling with unwrap_or_else(...into_inner()); simplified test_api_key tests to focus on validation logic.
Pipeline & Recording Processing src-tauri/src/pipeline.rs, src-tauri/src/ffmpeg.rs, src-tauri/src/secrets.rs	Renamed chrono_timestamp() → unix_timestamp() for deterministic output; switched provider comparison to typed Provider::Local; added A/V sync diagnostic with drift warnings; moved stale-recording cleanup to spawn_blocking; added global ffmpeg constants for audio specs and video codec (H.264 preset, thumbnail width); optimized resolve_ffmpeg_path() with OnceLock caching; marked clear_secrets() with #[allow(dead_code)].
App Startup & Core Setup src-tauri/src/lib.rs, README.md	Deferred sidecar startup to lazy-first-call pattern; added ConfigCache to Tauri app state; removed eager start_sidecar background task; updated README command/route table: removed check_models_downloaded, added delete_model Tauri command and DELETE /models/{model_name} sidecar endpoint.
Frontend Type System & State src/lib/state.svelte.ts, src/lib/voicebox.ts, src/lib/tauri.ts	Added exported type aliases TtsProvider ('elevenlabs' | 'local') and LocalTtsMode ('tts' | 'vc'); tightened AppConfig fields to use unions instead of strings; updated config-load validation for local-mode bypass; added shared voicebox singleton; removed dynamic @tauri-apps/api/core imports in favor of static module-level invoke.
Frontend UI Components & Client Integration src/routes/(app)/\*, src/routes/(app)/models/+page.svelte, src/routes/(app)/create-voice/+page.svelte, src/routes/(app)/settings/+page.svelte	Updated all pages to use shared voicebox instance instead of per-page VoiceboxClient construction; replaced LocalVoice with VoiceboxProfile type; tightened setProvider parameter to provider union; removed local getClient() factories; inherited layout configuration from root +layout.ts.
Build & Development Configuration svelte.config.js, vitest.config.ts	Removed vitePlugin.dynamicCompileOptions for runes/node_modules conditional handling; simplified Vitest Svelte plugin by removing explicit hot: false option.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

• refactor: architecture cleanup — 6 deferred items from master fix list #17 — Overlapping sidecar startup patterns, shared HttpClient usage in app state, and mutex-poisoning handling across Tauri command layer.
• Feature/local tts #13 — Direct code-level overlap with local TTS/Voicebox integration, tts_provider refactoring, and frontend client architecture.
• chore: v0.1.0 release prep — README, changelog, build signing #19 — macOS code signing and entitlements configuration changes for the main app and sidecar.

Poem

🐰 Bumped to two-point-oh, what a feat!
Types are tight, security's sweet,
Shared clients dance, lazy sidecars start,
Audio padding plays its part,
Config cached with provider's gleam,
This release builds the fuller dream! ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/build-script

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/build-script

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}