apps/mail/.node-version (1)

1-2: 💡 Verification agent

🧩 Analysis chain

Verify compatibility with Node.js 22

Node.js 22 is a very recent version (released in April 2024). Ensure that:

1. Your critical dependencies are compatible with this version
2. Your deployment environments support Node.js 22
3. The team is aware of any breaking changes from previous Node.js versions

---

🏁 Script executed:

#!/bin/bash
# Check if there are any package.json files that might be affected
echo "Checking for package.json files in the mail app:"
find apps/mail -name "package.json" -type f | grep -v "node_modules"

# Check for engines field in package.json files
echo -e "\nChecking for Node.js engine requirements in package.json:"
find apps/mail -name "package.json" -type f -exec grep -l "\"engines\"" {} \; | 
  xargs -I{} bash -c 'echo "File: {}"; cat {} | jq ".engines"'

# Look for CI/CD configuration files to check deployment environments
echo -e "\nChecking CI/CD configurations:"
find . -name "*.yml" -o -name "*.yaml" | grep -E "github|gitlab|azure|jenkins|circleci|travis" | 
  xargs grep -l "node" 2>/dev/null

Length of output: 722

---

🏁 Script executed:

#!/bin/bash
echo "Scanning CI workflows for Node.js version configuration…"

echo -e "\n1. Checking for actions/setup-node usage:"
grep -R "actions/setup-node" -n .github/workflows/*.yml || echo "→ No setup-node action found."

echo -e "\n2. Checking for explicit node-version fields:"
grep -R "node-version" -n .github/workflows/*.yml || echo "→ No node-version field found."

echo -e "\n3. Checking for matrix definitions with node:"  
grep -R "matrix" -n .github/workflows/*.yml | grep -C3 "node" || echo "→ No node matrix found."

Length of output: 992

---

Ensure Node.js 22 Compatibility and Pin Version

Please update your configuration to explicitly target and verify Node.js 22:

• In apps/mail/package.json, add an “engines” field to lock to Node 22 (e.g.

"engines": {  
  "node": ">=22 <23"  
}

)
• In your GitHub workflows (.github/workflows/ci.yml & main.yml), replace node-version: latest with node-version: 22.x to guarantee CI runs on Node 22
• Confirm all critical dependencies have been tested on Node 22 and that your deployment environments support it
• Document any known breaking changes for the team’s awareness

apps/mail/actions/ai.ts (2)

4-4: Remove unused import to avoid TS --noUnusedLocals breakage

generateEmailBody is no longer referenced after the switch to generateEmailBodyV2.

-import { generateEmailBody, generateEmailBodyV2, generateSubjectForEmail } from '@/lib/ai';
+import { generateEmailBodyV2, generateSubjectForEmail } from '@/lib/ai';

---

74-85: Early guard duplicates work – consider returning early

You test for an empty responseBody directly after assigning a default '', which will always be falsy. The guard therefore always triggers. Either drop the default or invert the check.

-const responseBody = response.body ?? '';
-if (!responseBody) {
+const responseBody = response.content?.trim() ?? '';
+if (responseBody === '') {

apps/mail/services/writing-style-service.ts (2)

165-174: updateStat lacks sample-count tracking → cannot derive variance later

You keep running m2 but never record n, so computing variance elsewhere as m2 / (n-1) won’t be possible.
Either:

1. Store count alongside mean & m2, or
2. Infer it from numMessages when reading, but document that contract.

export type RunningStat = {
  mean: number;
  m2: number;
  n: number; // <-- add
}

---

129-153: Coverage algorithm may drop the last needed element

takeWhile stops before the predicate fails, so the last element that pushes coverage ≥ 0.95 is excluded.
Switch to reduce or include the current element before evaluating coverage.

-    takeWhile(([_, count]) => {
-      running += count
-      return running / total < coverage
-    }),
+    takeWhile(([_, count]) => {
+      running += count
+      return running / total <= coverage   // include boundary
+    }),

apps/mail/.npmrc (1)

1-6: Risky npm flags – please confirm necessity

legacy-peer-deps=true and the two package-manager-strict* flags disable critical safety nets.
This can mask incompatible versions at install-time and make deterministic builds harder.

Recommend enabling strictness in CI (at least) or pinning peer ranges explicitly.

apps/mail/lib/ai.ts (1)

106-166: Duplicate post-processing logic – extract to shared util

postProcessMessage duplicates almost line-for-line the cleaning logic present further down in the legacy generateEmailBody. Maintaining two copies increases bug-fix surface and drift risk.

Refactor into a single helper (e.g., sanitizeGeneratedBody(text): AIBodyResponse[]) and invoke it from both functions.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

apps/mail/lib/ai.ts (1)

32-40: 🛠️ Refactor suggestion

conversationHistories is never mutated – feature is inert

The cache is allocated but nothing writes to it, so conversation context is lost and memory is wasted.
Either remove the structure or push the user/assistant messages into it after each generation.

apps/mail/lib/prompts.ts (1)

162-165: ⚠️ Potential issue

Escape untrusted dynamic context to prevent prompt-injection

currentSubject, currentDraft, and the recipients list are injected verbatim into the pseudo-XML envelope.
If any of these contain <, >, &, quotes, or XML-like substrings, the prompt becomes malformed and opens the door to prompt-injection.

-const currentSubjectContent = currentSubject ? `\n\n<current_subject>${currentSubject}</current_subject>\n\n` : '';
-const currentDraftContent   = currentDraft   ? `\n\n<current_draft>${currentDraft}</current_draft>\n\n`   : '';
-const recipientsContent     = recipients     ? `\n\n<recipients>${recipients.join(', ')}</recipients>\n\n` : '';
+const currentSubjectContent = currentSubject
+  ? `\n\n<current_subject>${escapeXml(currentSubject)}</current_subject>\n\n`
+  : '';
+const currentDraftContent   = currentDraft
+  ? `\n\n<current_draft>${escapeXml(currentDraft)}</current_draft>\n\n`
+  : '';
+const recipientsContent = recipients && recipients.length
+  ? `\n\n<recipients>${recipients.map(escapeXml).join(', ')}</recipients>\n\n`
+  : '';

apps/mail/lib/prompts.ts (1)

185-195: Escape serialized JSON style profile before embedding

styleProfileJSON may contain >, <, or & via user greetings/sign-offs, breaking the surrounding XML.
Escape it just like userName:

-const styleProfileJSON = JSON.stringify(styleProfile, null, 2);
+const styleProfileJSON = escapeXml(JSON.stringify(styleProfile, null, 2));

apps/mail/services/writing-style-service.ts (1)

201-204: RunningStat lacks the email count – variance cannot be recovered

You store only mean and m2. To compute variance later you’ll need n (numMessages).
Either embed count in RunningStat or always pass numMessages alongside the stat.

apps/mail/lib/ai.ts (2)

42-53: userContext declared in the type but not destructured

The parameter list omits userContext; callers can still pass it silently, causing confusion.
Add it to the destructuring list or drop it from the signature.

---

134-140: Over-zealous unsafe pattern may block valid addresses

The regex flags any <…> which matches common email address formats (<john@example.com>).
Consider a narrower pattern that targets HTML tags (/<\s*(script|style|[a-z]+[^>]*)>/i) instead of any angle-bracket pair.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

apps/mail/services/writing-style-service.ts (3)

152-157: Fix the takeTopCoverage function to include the threshold element.

The current implementation terminates too early and never reaches the requested coverage. Since the predicate runs after running is incremented and uses a strict <, the loop exits while coverage is still below the threshold.

-takeWhile(([_, count]) => {
-  running += count
-  return running / total < coverage
-}),
+reduce((acc, [key, count]) => {
+  if (running / total >= coverage) return acc;
+  running += count;
+  acc[key] = count;
+  return acc;
+}, {} as Record<string, number>),

---

113-118: Recalculate total after trimming counts.

After applying takeTopCoverage/takeTopK, you're dropping low-frequency entries but still using the old greetingTotal to compute probabilities. This makes pGreet inconsistent with the sum of greetingCounts.

-newStyle.greetingCounts = TAKE_TYPE === 'coverage'
-  ? takeTopCoverage(newStyle.greetingCounts)
-  : takeTopK(newStyle.greetingCounts)
-
-// Record the total number of greetings
-newStyle.greetingTotal = newStyle.greetingTotal + 1
-newStyle.pGreet = newStyle.greetingTotal / newNumMessages
+newStyle.greetingCounts = TAKE_TYPE === 'coverage'
+  ? takeTopCoverage(newStyle.greetingCounts)
+  : takeTopK(newStyle.greetingCounts)
+
+// Recompute total and probability from the trimmed counts
+const updatedGreetingTotal = Object.values(newStyle.greetingCounts)
+  .reduce((sum, count) => sum + count, 0)
+newStyle.greetingTotal = updatedGreetingTotal
+newStyle.pGreet = updatedGreetingTotal / newNumMessages

---

125-130: 🛠️ Refactor suggestion

Apply the same fix for signOff counts.

The same issue applies to signOffCounts. After trimming, you need to recalculate the total.

-newStyle.signOffCounts = TAKE_TYPE === 'coverage' 
-  ? takeTopCoverage(newStyle.signOffCounts) 
-  : takeTopK(newStyle.signOffCounts)
-
-// Record the total number of sign offs
-newStyle.signOffTotal = newStyle.signOffTotal + 1
-newStyle.pSign = newStyle.signOffTotal / newNumMessages
+newStyle.signOffCounts = TAKE_TYPE === 'coverage' 
+  ? takeTopCoverage(newStyle.signOffCounts) 
+  : takeTopK(newStyle.signOffCounts)
+
+// Recompute total and probability from the trimmed counts
+const updatedSignOffTotal = Object.values(newStyle.signOffCounts)
+  .reduce((sum, count) => sum + count, 0)
+newStyle.signOffTotal = updatedSignOffTotal
+newStyle.pSign = updatedSignOffTotal / newNumMessages

apps/mail/lib/ai.ts (1)

86-98: Missing conversation history update.

Unlike the legacy implementation, this code doesn't update conversationHistories, so any context from previous interactions is lost.

Add code to initialize and update conversation histories:

  const {
    text,
  } = await generateText({
    model: openai('gpt-4o'),
    system: systemPrompt,
    prompt: finalPrompt,
    maxTokens: 600,
    temperature: 0.35, // controlled creativity
    frequencyPenalty: 0.2, // dampen phrase repetition
    presencePenalty: 0.1, // nudge the model to add fresh info
    maxRetries: 1,
  })
+  
+  // Record conversation history
+  if (!conversationHistories[userId]) {
+    conversationHistories[userId] = {}
+  }
+  
+  const conversationId = generateConversationId(prompt) // Or however you want to track conversations
+  if (!conversationHistories[userId][conversationId]) {
+    conversationHistories[userId][conversationId] = []
+  }
+  
+  conversationHistories[userId][conversationId].push({ role: 'user', content: prompt })
+  conversationHistories[userId][conversationId].push({ role: 'assistant', content: text })

apps/mail/services/writing-style-service.ts (1)

57-89: Add error handling for the service operation.

The updateWritingStyleMatrix function lacks specific error handling. If extractStyleMatrix or database operations fail, errors will propagate to the caller, potentially causing unhandled exceptions.

Consider adding explicit error handling:

 export const updateWritingStyleMatrix = async (connectionId: string, emailBody: string) => {
+  try {
     const emailStyleMatrix = await extractStyleMatrix(emailBody)
 
     await db.transaction(async (tx) => {
       // ... existing implementation
     })
+  } catch (error) {
+    console.error('Failed to update writing style matrix:', error)
+    // Either rethrow or handle gracefully depending on requirements
+    throw error
+  }
 }

apps/mail/lib/ai.ts (2)

143-157: Consider expanding refusal detection patterns.

The current list of refusal patterns is good but could be expanded to catch more variations.

Consider adding more common refusal patterns:

const isRefusal =
  lowerBody.includes("i cannot") ||
  lowerBody.includes("i'm unable to") ||
  lowerBody.includes("i am unable to") ||
  lowerBody.includes("as an ai") ||
  lowerBody.includes("my purpose is to assist") ||
  lowerBody.includes("violates my safety guidelines") ||
+ lowerBody.includes("i don't have the ability") ||
+ lowerBody.includes("i'm not able to") ||
+ lowerBody.includes("i'm not designed to") ||
+ lowerBody.includes("against my programming") ||
+ lowerBody.includes("ethical concerns") ||
  lowerBody.includes("sorry, i can only assist with email body");

---

196-197: Consider more deterministic subject generation.

For subject generation, you're using a relatively high temperature (0.5) compared to the email body generation (0.35) and style extraction (0). For consistency in subject lines, you might consider lowering this.

const { completion: generatedSubjectRaw } = await generateCompletions({
    model: 'gpt-4', // Using the more capable model
    systemPrompt: systemPrompt,
    prompt: subjectPrompt,
-   temperature: 0.5,
+   temperature: 0.35, // Same temperature as email body for consistency
});

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

apps/mail/lib/ai.ts (1)

32-39: 🛠️ Refactor suggestion

conversationHistories is never mutated – feature is inert

You define an in-memory store but never push messages into it, so every call starts with an empty history.
Either:

1. Remove the variable, or
2. Persist user/assistant turns after generateText completes (see earlier review on generateEmailBodyV2).

Neglecting this defeats multi-turn context and wastes memory.

apps/mail/services/writing-style-service.ts (1)

170-174: takeTopCoverage still stops one element short of the requested coverage
This was reported in an earlier review and remains unfixed.
See prior diff suggestion for the correct reducer-based implementation.

apps/mail/services/writing-style-service.ts (1)

118-121: Empty for-loop is dead code

The loop over TOP_COUNTS_KEYS performs no body work and can be removed.
Keeping it around is confusing and may hint at an unfinished implementation.

apps/mail/lib/ai.ts (1)

47-52: Unused userContext parameter

userContext is accepted but ignored entirely. Delete the param or make use of it (e.g., pass the sender’s email/name into prompts).
Leaving dead interface surface invites bugs down the line.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

apps/mail/lib/ai.ts (2)

50-51: Remove unnecessary await from headers() call.

The headers() function from next/headers is synchronous and doesn't return a Promise - awaiting it can cause the request to hang in Edge runtimes.

-    const headersList = await headers()
+    const headersList = headers()

---

64-68: ⚠️ Potential issue

Fix the writingStyleMatrix property access.

The writingStyleMatrix.style property access appears incorrect - based on the definition in the writing style service, the whole object IS the style profile.

-    const systemPrompt = writingStyleMatrix ?
-      StyledEmailAssistantSystemPrompt(userName, writingStyleMatrix.style) :
+    const systemPrompt = writingStyleMatrix ?
+      StyledEmailAssistantSystemPrompt(userName, writingStyleMatrix) :
       EmailAssistantSystemPrompt(userName);

apps/mail/lib/ai.ts (3)

125-131: Consider adding test for HTML sanitization.

The safety check pattern is well-implemented, but consider adding a unit test to verify it catches all unsafe patterns you're concerned about.

---

237-307: Strong implementation of writing style extraction.

The extractStyleMatrix function is well designed with:

• Comprehensive style metrics extraction
• Proper schema validation using zod
• Appropriate error handling for empty content
• Good normalization of greeting and sign-off strings

Consider adding a caching mechanism if this function is called frequently, as it could be expensive in terms of API usage and latency.

---

242-296: Consider handling potential AI model errors.

The generateObject call could fail if the model struggles to extract certain metrics from unusual email content. Consider adding more specific error handling for this case.

 const {
   object,
- } = await generateObject({
+ } = await generateObject({
   // ...existing configuration
 })
+} catch (error) {
+  console.error('Failed to extract style matrix:', error);
+  // Return default/empty style matrix or rethrow with more context
+  throw new Error(`Style extraction failed: ${error.message}`);
 }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro