feat: Add google-reviews-ai-manager kit#286
Conversation
:robot_face: AgentKit Structural ValidationNew Contributions Detected
Check Results
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughChangesThe PR adds a Google Reviews AI Manager kit with a Lamatic reply-generation flow, a Next.js dashboard using Google OAuth and Business Profile APIs, reply drafting and publishing actions, project metadata, and automated Lamatic flow synchronization. Google Reviews AI Manager
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 22
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/lamatic-update.yml:
- Around line 17-20: Pin both actions in the workflow—actions/checkout and
Lamatic/sync-flows-to-lamatic—to full immutable commit SHAs instead of the
mutable v4 and v1 tags, preserving their existing action versions and workflow
behavior.
- Around line 1-25: Add a top-level permissions configuration to the workflow
granting only contents read access, so the detect-flow-changes job and its
checkout/sync steps do not inherit broader GITHUB_TOKEN permissions. Keep the
existing triggers, job conditions, and action inputs unchanged.
- Around line 3-14: Add workflow-level concurrency to the Lamatic sync workflow,
using a stable group for the main-branch sync jobs and preventing overlapping
runs so only the latest relevant run proceeds. Place it alongside the top-level
on/jobs configuration without changing the existing trigger or
detect-flow-changes condition.
- Around line 16-17: Update the actions/checkout@v4 step in the Checkout
repository workflow step to set persist-credentials to false, preventing the
repository token from being retained in the workspace.
In `@kits/google-reviews-ai-manager/agent.md`:
- Around line 3-15: Update the Markdown in agent.md by inserting a blank line
immediately after the headings Role, Tone & Style, and Capabilities, while
preserving all existing text and list content.
In `@kits/google-reviews-ai-manager/apps/app/actions/gmb.ts`:
- Around line 19-21: Add a shared fetch helper in gmb.ts that applies an
AbortSignal timeout and converts timeout aborts into one consistent timeout
error, then route all four Google API fetches through it:
kits/google-reviews-ai-manager/apps/app/actions/gmb.ts lines 19-21, 37-39,
61-63, and 86-93. Preserve each request’s existing URL, headers, and response
handling while replacing direct fetch calls with the helper.
In `@kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts`:
- Around line 53-60: Remove the raw response logging around resText and replace
it with redacted, non-content metadata only. In the JSON.parse error path within
the orchestration action, stop including resText in the returned error and
return a generic client-facing parse failure message instead.
- Around line 40-51: Update the fetch call in the orchestrate action to use an
AbortController-based timeout, aborting stalled Lamatic requests after the
configured duration. Catch timeout aborts and return the action’s existing
controlled error response, while preserving normal response handling for
successful or non-timeout failures.
- Around line 4-12: Add an authenticated-session check at the start of
generateReply, before reading or sending review data to Lamatic. Use the
existing server-session mechanism and return an appropriate error when no
session is present; preserve the current environment-variable validation for
authenticated callers.
- Around line 8-12: Update the `apiUrl` configuration in the orchestration flow
to remove the hardcoded tenant-specific fallback; require `LAMATIC_API_URL` and
include it in the existing missing-configuration validation so execution fails
fast when it is unset.
- Around line 63-74: Update the executeWorkflow result handling around anyData
so it fails fast unless anyData?.status is exactly "success". Only return a
reply when the selected response field is a string; for successful payloads
without a string reply, return the JSON-serialized anyData as the review
response instead of treating arbitrary values as a reply.
In `@kits/google-reviews-ai-manager/apps/app/api/auth/`[...nextauth]/route.ts:
- Around line 20-28: The NextAuth callbacks in jwt and session currently expose
the Google bearer token and omit renewal metadata. Keep access and refresh
credentials plus expiry state in the server-side JWT, stop assigning
token.accessToken in session, and update the GMB actions to obtain and refresh
the provider token from the JWT/server-side auth state rather than
session.accessToken.
In `@kits/google-reviews-ai-manager/apps/app/components/ReviewList.tsx`:
- Around line 181-408: Refactor the main ReviewList render into sibling
components for the top-level sections: extract the metrics row into MetricsBar,
filters into FilterBar, each mapped review into ReviewCard, and the location
selector overlay into LocationModal. Move each section’s required data,
callbacks, and state handlers into explicit props while preserving the existing
behavior, styling, and conditional rendering in ReviewList.
In `@kits/google-reviews-ai-manager/apps/app/globals.css`:
- Around line 22-26: Update the global body font-family declaration to use the
configured --font-geist-sans variable first, retaining the existing fallback
fonts afterward. Remove Arial as the primary font so the Geist font loaded by
layout.tsx is applied globally.
In `@kits/google-reviews-ai-manager/apps/app/layout.tsx`:
- Around line 15-18: Update the exported metadata object in layout.tsx,
replacing the default “Create Next App” title and generated description with
Google Reviews AI Manager-specific title and description values.
In `@kits/google-reviews-ai-manager/apps/app/page.tsx`:
- Around line 1-13: Update the Home function’s getServerSession call to pass the
shared authOptions configuration used by app/actions/gmb.ts, ensuring this page
validates sessions with the same NextAuth setup.
In `@kits/google-reviews-ai-manager/apps/package.json`:
- Around line 11-18: Replace the react-icons dependency with lucide-react in the
package configuration, then update icon imports and usages in ReviewList.tsx to
use Lucide equivalents while preserving the existing UI behavior. Regenerate the
lockfile so it reflects the dependency swap and removes react-icons.
In `@kits/google-reviews-ai-manager/apps/README.md`:
- Around line 1-36: Replace the scaffold content in the README with kit-specific
setup instructions covering dependency installation, copying .env.example to the
active environment file, configuring Google OAuth credentials and callback URL,
setting the Lamatic project and flow variables, starting the application, and
updating NEXTAUTH_URL for deployments. Remove the generic create-next-app
guidance and document the required environment variable names using the
repository’s existing configuration symbols.
In `@kits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_user_1.md`:
- Line 1: Update the prompt text in the user message to replace the literal
[starRating variable] and [reviewText variable] placeholders with Lamatic
trigger interpolation using trigger.output.starRating and
trigger.output.reviewText, so the LLM receives the actual review values.
In `@kits/google-reviews-ai-manager/README.md`:
- Around line 38-43: Update the Next.js version in the README’s “Tech Stack”
section to match the shipped version declared in the apps package.json: 16.2.10.
Leave the other stack entries unchanged.
- Around line 1-72: Update the README Markdown structure to satisfy the
configured lint rules: add a Markdown H1 (or explicitly adjust the lint
configuration), and insert required blank lines before and after headings and
fenced code blocks. Preserve the existing content and presentation while
ensuring all sections pass Markdown linting.
In `@lamatic/flows/MyFirstFlow.ts`:
- Around line 42-52: Update the user prompt content in the prompts configuration
to use Lamatic {{...}} interpolation for the starRating and reviewText fields
instead of bracketed placeholders, ensuring the rendered prompt contains the
actual values. Add a render test covering both interpolated values in the final
prompt.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: a10b704a-ab3a-49ac-acaf-add362087ce3
⛔ Files ignored due to path filters (8)
kits/google-reviews-ai-manager/apps/app/favicon.icois excluded by!**/*.icokits/google-reviews-ai-manager/apps/package-lock.jsonis excluded by!**/package-lock.jsonkits/google-reviews-ai-manager/apps/public/file.svgis excluded by!**/*.svgkits/google-reviews-ai-manager/apps/public/globe.svgis excluded by!**/*.svgkits/google-reviews-ai-manager/apps/public/logo.pngis excluded by!**/*.pngkits/google-reviews-ai-manager/apps/public/next.svgis excluded by!**/*.svgkits/google-reviews-ai-manager/apps/public/vercel.svgis excluded by!**/*.svgkits/google-reviews-ai-manager/apps/public/window.svgis excluded by!**/*.svg
📒 Files selected for processing (28)
.github/workflows/lamatic-update.ymlkits/google-reviews-ai-manager/README.mdkits/google-reviews-ai-manager/agent.mdkits/google-reviews-ai-manager/apps/.env.examplekits/google-reviews-ai-manager/apps/.gitignorekits/google-reviews-ai-manager/apps/AGENTS.mdkits/google-reviews-ai-manager/apps/CLAUDE.mdkits/google-reviews-ai-manager/apps/README.mdkits/google-reviews-ai-manager/apps/app/actions/gmb.tskits/google-reviews-ai-manager/apps/app/actions/orchestrate.tskits/google-reviews-ai-manager/apps/app/api/auth/[...nextauth]/route.tskits/google-reviews-ai-manager/apps/app/components/ReviewList.tsxkits/google-reviews-ai-manager/apps/app/globals.csskits/google-reviews-ai-manager/apps/app/layout.tsxkits/google-reviews-ai-manager/apps/app/page.tsxkits/google-reviews-ai-manager/apps/eslint.config.mjskits/google-reviews-ai-manager/apps/next.config.tskits/google-reviews-ai-manager/apps/package.jsonkits/google-reviews-ai-manager/apps/postcss.config.mjskits/google-reviews-ai-manager/apps/tsconfig.jsonkits/google-reviews-ai-manager/constitutions/default.mdkits/google-reviews-ai-manager/flows/my-first-flow.tskits/google-reviews-ai-manager/lamatic.config.tskits/google-reviews-ai-manager/model-configs/my-first-flow_llm-node_generative-model-name.tskits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_system_0.mdkits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_user_1.mdlamatic/flows/MyFirstFlow.tslamatic/project.json
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
🛑 Comments failed to post (22)
.github/workflows/lamatic-update.yml (4)
1-25: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '--- .github/workflows/lamatic-update.yml ---\n' cat -n .github/workflows/lamatic-update.yml printf '\n--- workflows with explicit permissions ---\n' rg -n "^\s*permissions:" .github/workflows || trueRepository: Lamatic/AgentKit
Length of output: 245
🏁 Script executed:
#!/bin/bash set -euo pipefail python3 - <<'PY' from pathlib import Path p = Path('.github/workflows/lamatic-update.yml') text = p.read_text() print("has permissions block:", 'permissions:' in text) print("uses checkout persist-credentials explicitly:", 'persist-credentials' in text) print("workflow trigger:", text.splitlines()[:15]) PYRepository: Lamatic/AgentKit
Length of output: 582
Mission directive: lock down the workflow token permissions. Add
permissions: contents: readhere so this job doesn’t inherit broader defaultGITHUB_TOKENaccess than it needs for checkout and sync.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 3-3: truthy value should be one of [false, true]
(truthy)
🪛 zizmor (1.26.1)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-27: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[info] 11-11: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-8: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lamatic-update.yml around lines 1 - 25, Add a top-level permissions configuration to the workflow granting only contents read access, so the detect-flow-changes job and its checkout/sync steps do not inherit broader GITHUB_TOKEN permissions. Keep the existing triggers, job conditions, and action inputs unchanged.Source: Linters/SAST tools
3-14: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Inspect the workflow and nearby references to concurrency/cancellation behavior. git ls-files '.github/workflows/*' | sed -n '1,120p' printf '\n--- workflow ---\n' cat -n .github/workflows/lamatic-update.yml printf '\n--- search concurrency/cancel/safe markers ---\n' rg -n "concurrency|cancel-in-progress|LAMATIC-COMMIT|lamatic-flow-sync|cancellation-safe|cancel safe|queue runs" .github/workflows . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || trueRepository: Lamatic/AgentKit
Length of output: 2838
Serialize Lamatic sync jobs. Add a workflow-level concurrency group here so only one
mainpush sync runs at a time; otherwise an older run can finish after a newer one and overwrite the latest Lamatic state.⏱️ Proposed hardening
on: push: branches: - main paths: - '**/lamatic/flows/**' + +concurrency: + group: lamatic-flow-sync + cancel-in-progress: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.on: push: branches: - main paths: - '**/lamatic/flows/**' concurrency: group: lamatic-flow-sync cancel-in-progress: false jobs: detect-flow-changes: environment: main runs-on: ubuntu-latest if: "!contains(github.event.head_commit.message, '[LAMATIC-COMMIT]')"🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 3-3: truthy value should be one of [false, true]
(truthy)
🪛 zizmor (1.26.1)
[info] 11-11: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-8: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lamatic-update.yml around lines 3 - 14, Add workflow-level concurrency to the Lamatic sync workflow, using a stable group for the main-branch sync jobs and preventing overlapping runs so only the latest relevant run proceeds. Place it alongside the top-level on/jobs configuration without changing the existing trigger or detect-flow-changes condition.Source: Linters/SAST tools
16-17: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,120p' .github/workflows/lamatic-update.ymlRepository: Lamatic/AgentKit
Length of output: 850
🌐 Web query:
actions/checkout persist-credentials default local git config third-party action security💡 Result:
The persist-credentials input in actions/checkout is enabled by default [1][2][3]. When set to true, it configures the repository's local git config with the provided token or SSH key, allowing subsequent steps in the same job to execute authenticated git commands (e.g., git fetch, git push) without manual configuration [1][2][4]. Security Considerations: 1. Credential Exposure: Historically, actions/checkout stored these credentials directly in the.git/config file [1][5]. This created a risk where, if a later step in the workflow unintentionally exposed the repository's files (such as by uploading artifacts or logs), the credentials could be compromised [5]. 2. Mitigation: In newer versions (e.g., actions/checkout v4 and later), credentials are stored in a separate file under $RUNNER_TEMP rather than directly in.git/config, which improves security by reducing the likelihood of accidental exposure [1][3]. 3. Principle of Least Privilege: Security best practices, including guidance from the OWASP Foundation, recommend setting persist-credentials: false unless specifically required for git operations [6]. Disabling this feature prevents the credentials from being persisted to the environment, thereby limiting the risk of exposure if the workflow environment is compromised [6][5]. 4. Token Access: It is important to note that even when persist-credentials is set to false, the GITHUB_TOKEN itself remains available to other actions in the job unless job-level permissions are restricted [7][8]. Therefore, while setting persist-credentials to false is a recommended hardening step, it should be part of a broader security strategy that includes limiting GITHUB_TOKEN permissions [7][5]. For sensitive workflows, you can explicitly opt-out of this behavior by adding the following configuration to your workflow YAML [1][5]: - name: Checkout repository uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/master/adrs/0153-checkout-v2.md
- 3: https://github.com/actions/checkout/tree/v6.0.0
- 4: https://github.com/marketplace/actions/checkout?version=v3.6.0
- 5: GHSA-3959-6v5q-45q2
- 6: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 7: actions/checkout#485
- 8: actions/checkout#2312
🌐 Web query:
GitHub Actions checkout v4 persist-credentials token accessible to later action same job security💡 Result:
When using actions/checkout@v4, the persist-credentials input defaults to true [1][2]. When enabled, the action configures the local Git repository's configuration files (.git/config) with the authentication token (usually the GITHUB_TOKEN) used to perform the checkout [1][3]. Security Implications: 1. Accessibility: Because the token is written to the disk in cleartext within the workspace, any subsequent steps or actions running within the same job have the ability to read the token from the.git/config file [4][3]. 2. Artifact Leakage (ArtiPACKED): A significant security risk arises if a later step in the same job uploads build artifacts (e.g., using actions/upload-artifact) [3]. If the.git directory or its configuration files are included in the uploaded artifacts, the persisted token may be leaked to anyone with access to those artifacts [5][3]. This is a known attack vector often referred to as ArtiPACKED [5][3]. 3. Token Scope: While the GITHUB_TOKEN is scoped to the repository and expires at the end of the job, a compromised token can still be used maliciously within that timeframe, such as to push code, modify releases, or access other secrets if the token has sufficient permissions [5][6]. Recommendation: To enhance security, it is best practice to set persist-credentials to false unless it is strictly necessary for your workflow to perform authenticated Git operations [1][3]: - uses: actions/checkout@v4 with: persist-credentials: false If you must use persist-credentials: true, ensure that no subsequent steps in the job include the.git directory in any artifacts uploaded to GitHub or other services [3]. Additionally, always adhere to the principle of least privilege by configuring appropriate permissions for the GITHUB_TOKEN in your workflow file [4].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: GHSA-3959-6v5q-45q2
- 4: actions/checkout#485
- 5: https://nvd.nist.gov/vuln/detail/cve-2026-40313
- 6: https://github.com/github/docs/blob/main/content/actions/concepts/security/compromised-runners.md
🌐 Web query:
actions/checkout v4 persist-credentials where token stored .git/config runner temp README💡 Result:
In versions of actions/checkout up to and including v5, the persist-credentials input (which defaults to true) causes the authentication token or SSH key to be stored directly in the local.git/config file of the checked-out repository [1][2][3]. This behavior is designed to allow subsequent scripts in the workflow to run authenticated git commands [1][4]. Starting with actions/checkout v6, this mechanism was updated to store these credentials in a temporary file located within the directory specified by the $RUNNER_TEMP environment variable, rather than in.git/config [2][3]. This change helps mitigate risks associated with credential leakage, such as the accidental inclusion of the token in workflow artifacts that might be uploaded from the workspace [3][5]. Regardless of the storage location, the action is responsible for removing the credentials during the post-job cleanup phase [1][6][7]. To prevent credentials from being persisted entirely, you can set the persist-credentials input to false [1][3][5]: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: actions/checkout@v5.0.1...v6.0.0
- 3: https://sisaku-security.github.io/lint/docs/rules/artipacked/
- 4: https://github.com/actions/checkout/blob/v4/action.yml
- 5: https://yossarian.net/til/post/actions-checkout-can-leak-github-credentials/
- 6: https://github.com/actions/checkout
- 7: https://github.com/actions/checkout/tree/cbb722410c2e876e24abbe8de2cc27693e501dcb
Disable checkout credential persistence
actions/checkout@v4still persists the repo token by default, so a compromised Lamatic step could read it from the workspace. Setpersist-credentials: falsehere.🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lamatic-update.yml around lines 16 - 17, Update the actions/checkout@v4 step in the Checkout repository workflow step to set persist-credentials to false, preventing the repository token from being retained in the workspace.Source: Linters/SAST tools
17-20: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'File: .github/workflows/lamatic-update.yml\n' cat -n .github/workflows/lamatic-update.yml printf '\nNearby action pins in workflows:\n' rg -n "uses:\s*(actions/checkout|Lamatic/sync-flows-to-lamatic)@" .github/workflows -nRepository: Lamatic/AgentKit
Length of output: 1570
🏁 Script executed:
#!/bin/bash set -euo pipefail python3 - <<'PY' from pathlib import Path import re path = Path('.github/workflows/lamatic-update.yml') text = path.read_text() for m in re.finditer(r'uses:\s*([^\s]+)', text): print(m.group(1)) PYRepository: Lamatic/AgentKit
Length of output: 207
🏁 Script executed:
#!/bin/bash set -euo pipefail # Show the workflow with surrounding context and line numbers. sed -n '1,120p' .github/workflows/lamatic-update.yml | cat -nRepository: Lamatic/AgentKit
Length of output: 1032
Pin both workflow actions to immutable SHAs in
.github/workflows/lamatic-update.yml:17-20.
actions/checkout@v4andLamatic/sync-flows-to-lamatic@v1are mutable refs; full commit pins reduce supply-chain risk in a workflow that has repo access and deployment credentials.🧰 Tools
🪛 zizmor (1.26.1)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lamatic-update.yml around lines 17 - 20, Pin both actions in the workflow—actions/checkout and Lamatic/sync-flows-to-lamatic—to full immutable commit SHAs instead of the mutable v4 and v1 tags, preserving their existing action versions and workflow behavior.Source: Linters/SAST tools
kits/google-reviews-ai-manager/agent.md (1)
3-15: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Mission detail: clear the configured Markdown lint warnings.
Insert blank lines after the headings on Lines 3, 6, and 11.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 3-3: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 6-6: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 11-11: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/agent.md` around lines 3 - 15, Update the Markdown in agent.md by inserting a blank line immediately after the headings Role, Tone & Style, and Capabilities, while preserving all existing text and list content.Source: Linters/SAST tools
kits/google-reviews-ai-manager/apps/app/actions/gmb.ts (1)
19-21: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== gmb.ts ==" sed -n '1,220p' kits/google-reviews-ai-manager/apps/app/actions/gmb.ts echo echo "== search for abort/timeout helpers in app ==" rg -n "AbortController|signal:|timeout|bounded fetch|fetchWith|withTimeout|deadline" kits/google-reviews-ai-manager/apps/app -g '!**/node_modules/**' || true echo echo "== next docs present? ==" fd -a "app-router.mdx" node_modules/next/dist/docs 2>/dev/null | head -n 20 || trueRepository: Lamatic/AgentKit
Length of output: 3996
Put a deadline on the Google API fetches Route the four
fetchcalls inkits/google-reviews-ai-manager/apps/app/actions/gmb.tsthrough a shared helper that attaches anAbortSignaltimeout and returns a consistent timeout error.📍 Affects 1 file
kits/google-reviews-ai-manager/apps/app/actions/gmb.ts#L19-L21(this comment)kits/google-reviews-ai-manager/apps/app/actions/gmb.ts#L37-L39kits/google-reviews-ai-manager/apps/app/actions/gmb.ts#L61-L63kits/google-reviews-ai-manager/apps/app/actions/gmb.ts#L86-L93🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/actions/gmb.ts` around lines 19 - 21, Add a shared fetch helper in gmb.ts that applies an AbortSignal timeout and converts timeout aborts into one consistent timeout error, then route all four Google API fetches through it: kits/google-reviews-ai-manager/apps/app/actions/gmb.ts lines 19-21, 37-39, 61-63, and 86-93. Preserve each request’s existing URL, headers, and response handling while replacing direct fetch calls with the helper.kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts (5)
4-12: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -e printf '\n== file list ==\n' git ls-files 'kits/google-reviews-ai-manager/apps/app/actions/*' 'kits/google-reviews-ai-manager/apps/app/**/*' | sed -n '1,200p' printf '\n== orchestrate.ts outline ==\n' ast-grep outline kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts --view expanded || true printf '\n== read orchestrate.ts ==\n' cat -n kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts | sed -n '1,220p' printf '\n== search for generateReply usages ==\n' rg -n "generateReply\(" kits/google-reviews-ai-manager/apps/app -S || true printf '\n== search for auth/session/middleware references ==\n' rg -n "middleware|auth\\(|session|getServerSession|next-auth|clerk|supabase|tenant|authorize|authorization" kits/google-reviews-ai-manager/apps/app -S || trueRepository: Lamatic/AgentKit
Length of output: 5913
🏁 Script executed:
set -e printf '\n== page.tsx ==\n' cat -n kits/google-reviews-ai-manager/apps/app/page.tsx | sed -n '1,220p' printf '\n== ReviewList.tsx ==\n' cat -n kits/google-reviews-ai-manager/apps/app/components/ReviewList.tsx | sed -n '1,260p' printf '\n== middleware/auth boundary search ==\n' git ls-files 'kits/google-reviews-ai-manager/apps/**/middleware.ts' 'kits/google-reviews-ai-manager/apps/**/middleware.js' 'kits/google-reviews-ai-manager/apps/**/middleware.tsx' | sed -n '1,200p' rg -n "getServerSession\\(|middleware|authOptions|SessionProvider|useSession\\(" kits/google-reviews-ai-manager/apps/app -S || trueRepository: Lamatic/AgentKit
Length of output: 15114
Add a session check inside
generateReply. The page gatesReviewListbehindgetServerSession(), but this Server Action still needs its own caller check before it spends Lamatic quota or accepts review text.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts` around lines 4 - 12, Add an authenticated-session check at the start of generateReply, before reading or sending review data to Lamatic. Use the existing server-session mechanism and return an appropriate error when no session is present; preserve the current environment-variable validation for authenticated callers.
8-12: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== target file ==" sed -n '1,220p' kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts | cat -n echo echo "== search for LAMATIC_API_URL and fallback host ==" rg -n --hidden --no-ignore-vcs 'LAMATIC_API_URL|toufiqsorganization806-toufiqsproject110\.lamatic\.dev|lamatic\.dev/graphql' kits/google-reviews-ai-manager/apps -S echo echo "== next docs candidates ==" fd -a 'README.md' node_modules/next/dist/docs 2>/dev/null | head -n 20Repository: Lamatic/AgentKit
Length of output: 3444
🏁 Script executed:
#!/bin/bash set -euo pipefail python3 - <<'PY' from pathlib import Path p = Path('kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts') text = p.read_text() for i, line in enumerate(text.splitlines(), 1): if 1 <= i <= 220: print(f"{i:4d}: {line}") PYRepository: Lamatic/AgentKit
Length of output: 2992
Mission control: remove the hardcoded tenant fallback.
If
LAMATIC_API_URLis unset, the review payload and bearer token go tohttps://toufiqsorganization806-toufiqsproject110.lamatic.dev/graphql. Make the URL required, or use only a documented environment-neutral default and fail fast on missing config.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts` around lines 8 - 12, Update the `apiUrl` configuration in the orchestration flow to remove the hardcoded tenant-specific fallback; require `LAMATIC_API_URL` and include it in the existing missing-configuration validation so execution fails fast when it is unset.
40-51: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== orchestrate.ts ==" sed -n '1,220p' kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts echo echo "== search for timeout/abort handling in app actions ==" rg -n "AbortController|signal:|timeout|setTimeout|clearTimeout|fetch\\(" kits/google-reviews-ai-manager/apps/app -g '*.ts' -g '*.tsx' -g '*.js' -g '*.jsx'Repository: Lamatic/AgentKit
Length of output: 3484
Bound the Lamatic fetch with a timeout. A stalled upstream can leave the Server Action and dashboard request hanging indefinitely. Abort the request and return a controlled error on timeout.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts` around lines 40 - 51, Update the fetch call in the orchestrate action to use an AbortController-based timeout, aborting stalled Lamatic requests after the configured duration. Catch timeout aborts and return the action’s existing controlled error response, while preserving normal response handling for successful or non-timeout failures.
53-60: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Mission-critical: stop logging and echoing raw provider responses.
resTextmay contain customer review text, generated replies, PII, or internal diagnostics. It is written verbatim to server logs and partially returned to the browser on parse failure. Log only redacted metadata and return a generic client-facing error.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts` around lines 53 - 60, Remove the raw response logging around resText and replace it with redacted, non-content metadata only. In the JSON.parse error path within the orchestration action, stop including resText in the returned error and return a generic client-facing parse failure message instead.
63-74: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== File map ==\n' git ls-files 'kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts' 'kits/google-reviews-ai-manager/apps/app/**' 'kits/google-reviews-ai-manager/**/ReviewList*' 'kits/google-reviews-ai-manager/**/review*' | sed -n '1,200p' printf '\n== Outline of orchestrate.ts ==\n' ast-grep outline kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts --view expanded || true printf '\n== Relevant occurrences ==\n' rg -n "executeWorkflow|result\.reply|result\.error|status ===|Lamatic Workflow Error|GraphQL Error|pending|success|failed|error" kits/google-reviews-ai-manager/apps/app kits/google-reviews-ai-manager -g '!**/node_modules/**' || true printf '\n== File size ==\n' wc -l kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts || trueRepository: Lamatic/AgentKit
Length of output: 13566
🏁 Script executed:
#!/bin/bash set -euo pipefail # Read the specific action and consumer files in small slices if they exist. for f in \ kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts \ $(rg -l "result\.reply|result\.error" kits/google-reviews-ai-manager/apps/app -g '!**/node_modules/**' || true) do [ -f "$f" ] || continue echo "===== $f =====" nl -ba "$f" | sed -n '1,220p' doneRepository: Lamatic/AgentKit
Length of output: 270
🏁 Script executed:
#!/bin/bash set -euo pipefail read_file() { f="$1" echo "===== $f =====" awk '{printf "%4d %s\n", NR, $0}' "$f" | sed -n '1,220p' echo } read_file kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts read_file kits/google-reviews-ai-manager/apps/app/components/ReviewList.tsxRepository: Lamatic/AgentKit
Length of output: 13628
🌐 Web query:
Lamatic executeWorkflow GraphQL status success error result response generatedResponse documentation💡 Result:
In Lamatic.ai, the executeWorkflow mutation is the primary GraphQL method used to trigger flows programmatically [1][2]. Key details regarding the execution and response are as follows: Structure of the GraphQL Mutation To execute a flow, you send a POST request to your project's GraphQL endpoint with the following mutation [1][2]: query ExecuteWorkflow($workflowId: String!, $payload: JSON) { executeWorkflow(workflowId: $workflowId, payload: $payload) { status result } } The payload variable should contain the specific input data required by your workflow, and the workflowId is the unique identifier for the flow you wish to trigger [1][3][2]. Response Structure The response from the server follows a standard structure that includes the status of the execution and the result [1][2]: { "data": { "executeWorkflow": { "status": "success", "result": { // Your custom output as configured in the Schema } } } } The status field typically returns success upon a successful execution [1][2]. The result field contains the output generated by your flow, which is dynamically configured within the Schema of the GraphQL Response node in your workflow [1][2]. Error Handling If an error occurs, the GraphQL response will include an errors array or specific error details within the response body [3][4]. Developers are encouraged to check for the presence of the errors field in the JSON response or handle rejection in their client code (e.g., using.catch in JavaScript) to capture and manage API or flow-related failures [3][4]. Detailed error codes and troubleshooting information are available in the official integration documentation [5][6].
Citations:
- 1: https://lamatic.ai/docs/api-integration/integration-guide
- 2: https://lamatic.ai/docs/api-overview
- 3: https://lamatic.ai/docs/studio/studio-keys
- 4: https://github.com/lamatic/docs/blob/main/pages/docs/flow-integration.mdx
- 5: https://lamatic.ai/docs/sdk/integration-guide
- 6: https://lamatic.ai/docs/flow-integration
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '== package references ==\n' rg -n '"lamatic"|from "lamatic"|executeWorkflow|status|generatedResponse|response' \ kits/google-reviews-ai-manager/apps/package.json \ kits/google-reviews-ai-manager/apps/package-lock.json \ kits/google-reviews-ai-manager/apps/app \ -g '!**/node_modules/**' || true printf '\n== next docs presence ==\n' fd -a 'next' kits/google-reviews-ai-manager/apps/node_modules 2>/dev/null | sed -n '1,40p' || true fd -a 'docs' kits/google-reviews-ai-manager/apps/node_modules/next/dist 2>/dev/null | sed -n '1,80p' || trueRepository: Lamatic/AgentKit
Length of output: 2263
Reject anything but an explicit successful workflow reply.
executeWorkflowis expected to returnstatus: "success"on completion, so this should fail fast on any non-success payload and only return{ reply }when the reply field is a string; otherwiseJSON.stringify(anyData)can be posted as the review response.kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts:67-74🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/actions/orchestrate.ts` around lines 63 - 74, Update the executeWorkflow result handling around anyData so it fails fast unless anyData?.status is exactly "success". Only return a reply when the selected response field is a string; for successful payloads without a string reply, return the JSON-serialized anyData as the review response instead of treating arbitrary values as a reply.kits/google-reviews-ai-manager/apps/app/api/auth/[...nextauth]/route.ts (1)
20-28: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Map the target file and nearby NextAuth/Next.js context. git ls-files 'kits/google-reviews-ai-manager/apps/app/api/auth/[...nextauth]/route.ts' \ 'kits/google-reviews-ai-manager/apps/app/api/**' \ 'kits/google-reviews-ai-manager/apps/**' | sed -n '1,120p' echo '--- FILE: route.ts ---' cat -n 'kits/google-reviews-ai-manager/apps/app/api/auth/[...nextauth]/route.ts' echo '--- SEARCH: nextauth/session usage ---' rg -n "accessToken|refreshToken|jwt\\(|session\\(" 'kits/google-reviews-ai-manager/apps' -g '!**/node_modules/**' || true echo '--- NEXT DOCS (if present) ---' fd -a 'auth' 'node_modules/next/dist/docs' 2>/dev/null | sed -n '1,80p' || true fd -a 'next-auth' 'node_modules/next/dist/docs' 2>/dev/null | sed -n '1,80p' || trueRepository: Lamatic/AgentKit
Length of output: 3372
🏁 Script executed:
#!/bin/bash set -euo pipefail # If the docs exist, inspect the relevant Next.js auth guidance lightly. if [ -d 'node_modules/next/dist/docs' ]; then echo '--- DOCS TREE ---' fd -a '' 'node_modules/next/dist/docs' | sed -n '1,120p' fiRepository: Lamatic/AgentKit
Length of output: 154
🏁 Script executed:
#!/bin/bash set -euo pipefail # Read the target file and the minimal surrounding app structure. echo '--- route.ts ---' cat -n 'kits/google-reviews-ai-manager/apps/app/api/auth/[...nextauth]/route.ts' echo '--- related auth files ---' fd -a '' 'kits/google-reviews-ai-manager/apps/app/api/auth' | sed -n '1,120p' echo '--- next docs snippets under node_modules/next/dist/docs ---' if [ -d 'node_modules/next/dist/docs' ]; then fd -a '' 'node_modules/next/dist/docs' | sed -n '1,120p' else echo 'node_modules/next/dist/docs not present' fiRepository: Lamatic/AgentKit
Length of output: 1615
🏁 Script executed:
#!/bin/bash set -euo pipefail # Inspect the Google Business actions and auth-related helpers. echo '--- gmb.ts ---' cat -n 'kits/google-reviews-ai-manager/apps/app/actions/gmb.ts' echo '--- search for getServerSession / auth usage ---' rg -n "getServerSession|useSession|getSession|authOptions|session.accessToken|accessToken" 'kits/google-reviews-ai-manager/apps/app' -g '!**/node_modules/**'Repository: Lamatic/AgentKit
Length of output: 5891
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- app/page.tsx ---' cat -n 'kits/google-reviews-ai-manager/apps/app/page.tsx' echo '--- AGENTS.md ---' cat -n 'kits/google-reviews-ai-manager/apps/AGENTS.md' echo '--- nextauth package version ---' node - <<'JS' const p = require('./kits/google-reviews-ai-manager/apps/package.json'); console.log(p.dependencies?.['next-auth'] || p.devDependencies?.['next-auth'] || 'missing'); console.log(p.dependencies?.next || p.devDependencies?.next || 'missing'); JSRepository: Lamatic/AgentKit
Length of output: 1681
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- app/page.tsx ---' cat -n 'kits/google-reviews-ai-manager/apps/app/page.tsx' echo '--- AGENTS.md ---' cat -n 'kits/google-reviews-ai-manager/apps/AGENTS.md' echo '--- nextauth package version ---' node - <<'JS' const p = require('./kits/google-reviews-ai-manager/apps/package.json'); console.log('next-auth:', p.dependencies?.['next-auth'] || p.devDependencies?.['next-auth'] || 'missing'); console.log('next:', p.dependencies?.next || p.devDependencies?.next || 'missing'); JSRepository: Lamatic/AgentKit
Length of output: 1698
Keep the Google bearer token out of
session.session.accessTokenis exposed through the NextAuth session response, and the JWT callback still drops refresh/expiry state, so the token cannot be renewed safely before it expires. Keep the provider credential server-side only, persist refresh metadata, and have the GMB actions read the refreshed token there instead of fromsession.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/api/auth/`[...nextauth]/route.ts around lines 20 - 28, The NextAuth callbacks in jwt and session currently expose the Google bearer token and omit renewal metadata. Keep access and refresh credentials plus expiry state in the server-side JWT, stop assigning token.accessToken in session, and update the GMB actions to obtain and refresh the provider token from the JWT/server-side auth state rather than session.accessToken.kits/google-reviews-ai-manager/apps/app/components/ReviewList.tsx (1)
181-408: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff
Agent, this safehouse has three floors crammed into one room.
The render method mixes top bar, metrics, filter bar, review feed, and a location modal in one 400+ line component. Extracting
MetricsBar,FilterBar,ReviewCard, andLocationModalas siblings would make future missions (edits) far less risky.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/components/ReviewList.tsx` around lines 181 - 408, Refactor the main ReviewList render into sibling components for the top-level sections: extract the metrics row into MetricsBar, filters into FilterBar, each mapped review into ReviewCard, and the location selector overlay into LocationModal. Move each section’s required data, callbacks, and state handlers into explicit props while preserving the existing behavior, styling, and conditional rendering in ReviewList.kits/google-reviews-ai-manager/apps/app/globals.css (1)
22-26: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Mission note: apply the configured Geist font.
layout.tsxloads Geist and exposes--font-geist-sans, but this declaration forces Arial globally. Use the Geist variable first so the configured application typography is actually visible.Suggested fix
body { background: var(--background); color: var(--foreground); - font-family: Arial, Helvetica, sans-serif; + font-family: var(--font-geist-sans), Arial, Helvetica, sans-serif; }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.body { background: var(--background); color: var(--foreground); font-family: var(--font-geist-sans), Arial, Helvetica, sans-serif; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/globals.css` around lines 22 - 26, Update the global body font-family declaration to use the configured --font-geist-sans variable first, retaining the existing fallback fonts afterward. Remove Arial as the primary font so the Geist font loaded by layout.tsx is applied globally.kits/google-reviews-ai-manager/apps/app/layout.tsx (1)
15-18: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Mission-critical branding: replace the default metadata.
The deployed application will display “Create Next App” in browser tabs and link previews. Use Google Reviews AI Manager-specific title and description values.
Suggested fix
export const metadata: Metadata = { - title: "Create Next App", - description: "Generated by create next app", + title: "Google Reviews AI Manager", + description: "Generate and publish AI-assisted replies to Google Reviews.", };📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.export const metadata: Metadata = { title: "Google Reviews AI Manager", description: "Generate and publish AI-assisted replies to Google Reviews.", };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/layout.tsx` around lines 15 - 18, Update the exported metadata object in layout.tsx, replacing the default “Create Next App” title and generated description with Google Reviews AI Manager-specific title and description values.kits/google-reviews-ai-manager/apps/app/page.tsx (1)
1-13: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Locate the relevant files and inspect the surrounding code. git ls-files 'kits/google-reviews-ai-manager/apps/app/page.tsx' \ 'kits/google-reviews-ai-manager/apps/**/gmb.ts' \ 'kits/google-reviews-ai-manager/apps/**/route.ts' \ 'kits/google-reviews-ai-manager/apps/**/[...nextauth]/*' \ 'kits/google-reviews-ai-manager/apps/**/authOptions*' \ 'node_modules/next/dist/docs/**/*' | sed -n '1,200p' printf '\n--- page.tsx ---\n' cat -n kits/google-reviews-ai-manager/apps/app/page.tsx | sed -n '1,120p' printf '\n--- gmb.ts candidates ---\n' for f in $(git ls-files 'kits/google-reviews-ai-manager/apps/**/gmb.ts'); do echo "### $f" cat -n "$f" | sed -n '1,200p' done printf '\n--- nextauth route candidates ---\n' for f in $(git ls-files 'kits/google-reviews-ai-manager/apps/**/route.ts' 'kits/google-reviews-ai-manager/apps/**/[...nextauth]/*'); do case "$f" in *route.ts|*[[]...nextauth[]]/*) echo "### $f" cat -n "$f" | sed -n '1,220p' ;; esac done printf '\n--- next docs candidates ---\n' fd -a 'getServerSession|NextAuth' node_modules/next/dist/docs 2>/dev/null | sed -n '1,120p' EOFRepository: Lamatic/AgentKit
Length of output: 7293
🏁 Script executed:
#!/bin/bash set -euo pipefail # Locate the relevant files and inspect the surrounding code. git ls-files 'kits/google-reviews-ai-manager/apps/app/page.tsx' \ 'kits/google-reviews-ai-manager/apps/**/gmb.ts' \ 'kits/google-reviews-ai-manager/apps/**/route.ts' \ 'kits/google-reviews-ai-manager/apps/**/[...nextauth]/*' \ 'kits/google-reviews-ai-manager/apps/**/authOptions*' \ 'node_modules/next/dist/docs/**/*' | sed -n '1,200p' printf '\n--- page.tsx ---\n' cat -n kits/google-reviews-ai-manager/apps/app/page.tsx | sed -n '1,120p' printf '\n--- gmb.ts candidates ---\n' for f in $(git ls-files 'kits/google-reviews-ai-manager/apps/**/gmb.ts'); do echo "### $f" cat -n "$f" | sed -n '1,200p' done printf '\n--- nextauth route candidates ---\n' for f in $(git ls-files 'kits/google-reviews-ai-manager/apps/**/route.ts' 'kits/google-reviews-ai-manager/apps/**/[...nextauth]/*'); do case "$f" in *route.ts|*[[]...nextauth[]]/*) echo "### $f" cat -n "$f" | sed -n '1,220p' ;; esac done printf '\n--- next docs candidates ---\n' fd -a 'getServerSession|NextAuth' node_modules/next/dist/docs 2>/dev/null | sed -n '1,120p'Repository: Lamatic/AgentKit
Length of output: 7293
🏁 Script executed:
#!/bin/bash set -euo pipefail # Read the relevant NextAuth/Next.js local docs and type definitions if present. printf '\n--- next docs around server session ---\n' fd -a 'server session|getServerSession|authOptions|NextAuth' node_modules/next/dist/docs 2>/dev/null | sed -n '1,200p' printf '\n--- next-auth type definitions ---\n' fd -a 'next-auth' node_modules 2>/dev/null | sed -n '1,200p'Repository: Lamatic/AgentKit
Length of output: 195
🌐 Web query:
next-auth v4 getServerSession authOptions app router docs💡 Result:
In NextAuth.js v4, the getServerSession function is the recommended way to retrieve the session object within the Next.js App Router [1][2]. Unlike the older getSession method, getServerSession does not perform an additional network request, which improves performance [1][3]. Setup and Usage To use getServerSession in the App Router, you must first define and export your authentication configuration (authOptions) in your Route Handler file [1][4]. 1. Configure authOptions: Define your NextAuth configuration in app/api/auth/[...nextauth]/route.ts [4][5]. // app/api/auth/[...nextauth]/route.ts import NextAuth from "next-auth"; export const authOptions = { // your providers and callbacks }; const handler = NextAuth(authOptions); export { handler as GET, handler as POST }; 2. Use getServerSession in Server Components: Import both getServerSession and your authOptions to retrieve the session [1][6]. // app/page.tsx (or any Server Component) import { getServerSession } from "next-auth"; import { authOptions } from "./api/auth/[...nextauth]/route"; export default async function Page { const session = await getServerSession(authOptions); if (!session) { return
Access Denied; } returnWelcome, {session.user?.name}; } Key Considerations - Server Components: getServerSession is designed to run in server-side contexts, including Server Components and Route Handlers [1][3]. - Middleware Limitations: You cannot use getServerSession inside Next.js Middleware because Middleware runs on the Edge Runtime, which does not support the necessary Node.js APIs [7]. For protecting routes at the middleware level in v4, you typically use the provided withAuth middleware [7]. - Client Components: While getServerSession is for the server, you should continue to use the useSession hook for client-side components to manage session state across your application [2][3]. - Migration Note: If you are planning to migrate to NextAuth.js (Auth.js) v5, note that the API has changed significantly, replacing getServerSession with a simpler auth method [7][8]. The v4 approach described above is specific to the v4 lifecycle [7].Citations:
- 1: https://next-auth.js.org/configuration/nextjs
- 2: https://next-auth.js.org/getting-started/client
- 3: https://next-auth.js.org/tutorials/securing-pages-and-api-routes
- 4: https://next-auth.js.org/configuration/initialization
- 5: https://next-auth.js.org/getting-started/example
- 6: https://stackoverflow.com/questions/75413452/how-do-i-use-next-auth-getserversession-in-next-js-13-beta-server-component-in-a
- 7: https://stackoverflow.com/questions/77975247/can-nextauth-middleware-work-to-protect-pages-when-using-nextjs-14-and-the-app-r
- 8: https://authjs.dev/reference/nextjs
Pass
authOptionsintogetServerSession— this page should use the same NextAuth config asapp/actions/gmb.ts; otherwise the session check can fail and signed-in users get sent back to the sign-in screen.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/app/page.tsx` around lines 1 - 13, Update the Home function’s getServerSession call to pass the shared authOptions configuration used by app/actions/gmb.ts, ensuring this page validates sessions with the same NextAuth setup.kits/google-reviews-ai-manager/apps/package.json (1)
11-18: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== Relevant files ==\n' git ls-files 'kits/google-reviews-ai-manager/apps/**' | sed 's#^`#-` #' printf '\n== package.json ==\n' cat -n kits/google-reviews-ai-manager/apps/package.json printf '\n== lucide/react-icons usage ==\n' rg -n --hidden --glob '!**/node_modules/**' --glob '!**/.git/**' '\b(lucide-react|react-icons)\b' kits/google-reviews-ai-manager/apps kits/google-reviews-ai-manager -g '!**/package-lock.json' -g '!**/pnpm-lock.yaml' -g '!**/yarn.lock' printf '\n== icon import statements ==\n' rg -n --hidden --glob '!**/node_modules/**' --glob '!**/.git/**' 'from [\"\x27](lucide-react|react-icons)[\"\x27]' kits/google-reviews-ai-manager/apps kits/google-reviews-ai-managerRepository: Lamatic/AgentKit
Length of output: 3336
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== package.json ==\n' cat -n kits/google-reviews-ai-manager/apps/package.json printf '\n== icon-related files ==\n' rg -n --hidden --glob '!**/node_modules/**' --glob '!**/.git/**' '\b(lucide-react|react-icons)\b' kits/google-reviews-ai-manager/apps kits/google-reviews-ai-managerRepository: Lamatic/AgentKit
Length of output: 2434
🏁 Script executed:
#!/bin/bash set -euo pipefail cat -n kits/google-reviews-ai-manager/apps/package.jsonRepository: Lamatic/AgentKit
Length of output: 968
🌐 Web query:
lucide-react kit standard replace react-icons Next.js app package.json💡 Result:
Migrating from react-icons to lucide-react in a Next.js application is a recommended practice in 2026 for improved bundle size, better tree-shaking, and a consistent design language [1][2]. Installation and Configuration To begin the transition, install the package using your preferred package manager [3][4]: npm install lucide-react For Next.js applications, especially when using the App Router, ensuring efficient tree-shaking is critical. In your next.config.js, you can optimize package imports to prevent bloat [5]: // next.config.js /
@type{import('next').NextConfig} */ const nextConfig = { experimental: { optimizePackageImports: ['lucide-react'], }, }; module.exports = nextConfig; If you encounter issues with dynamic imports or specific build setups, you can also add the package to transpilePackages [6]: // next.config.js const nextConfig = { transpilePackages: ['lucide-react'], }; Migration Strategy 1. Identify Replacements: Lucide-react uses a naming convention similar to the Feather icon set (which is commonly used within react-icons). Often, a one-to-one migration is possible by simply removing the prefix used by react-icons (e.g., FiSearch becomes Search) [7]. 2. Refactor Imports: Replace your react-icons import statements with named imports from lucide-react [7]: // Before: react-icons import { FiSearch, FiSettings } from 'react-icons/fi'; // After: lucide-react import { Search, Settings } from 'lucide-react'; 3. Handle Missing Icons: Lucide does not include brand logos or niche icon sets found in react-icons [1][8]. For these, keep the specific icons you need or use dedicated SVG files to avoid maintaining large legacy dependencies [1][7]. Benefits - Bundle Size: Lucide-react is fully tree-shakable, significantly reducing the production bundle compared to the CJS-heavy react-icons [1][7]. - Modern API: It provides a consistent interface where you can control size, color, and stroke width directly via props, making it highly compatible with Tailwind CSS utilities [9][10]. - TypeScript Support: It offers first-class TypeScript support, reducing runtime errors associated with icon prop mismatches [1][9].Citations:
- 1: https://iconsearch.info/blog/react-icons-vs-lucide-react-2026
- 2: https://medium.nkcroft.com/the-hidden-bundle-cost-of-react-icons-why-lucide-wins-in-2026-1ddb74c1a86c
- 3: https://lucide.dev/guide/installation
- 4: https://github.com/lucide-icons/lucide/blob/main/packages/lucide-react/README.md
- 5: https://devradar.dev/check/lucide-react-icons-with-nextjs-bundle-size
- 6: lucide-icons/lucide@c5cfbed
- 7: https://iconsearch.info/blog/icon-subsetting-nextjs-bundle-size-optimization
- 8: shadcn-ui/ui#2603
- 9: https://lucide.dev/guide/react
- 10: https://codingarchitect.dev/blog/choosing-the-right-icons-for-next-js-with-tailwind-css-project/
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== kit guidance files ==\n' for f in kits/google-reviews-ai-manager/apps/AGENTS.md kits/google-reviews-ai-manager/apps/CLAUDE.md kits/google-reviews-ai-manager/apps/README.md; do if [ -f "$f" ]; then echo "--- $f" cat -n "$f" | sed -n '1,260p' fi done printf '\n== lucide usage across repo ==\n' rg -n --hidden --glob '!**/node_modules/**' --glob '!**/.git/**' '\blucide-react\b' . printf '\n== react-icons usage across repo ==\n' rg -n --hidden --glob '!**/node_modules/**' --glob '!**/.git/**' '\breact-icons\b' .Repository: Lamatic/AgentKit
Length of output: 50374
Swap
react-iconsforlucide-reactReplace the dependency here and update the imports inkits/google-reviews-ai-manager/apps/app/components/ReviewList.tsx(and the lockfile) to match the kit’s Lucide icon standard.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/package.json` around lines 11 - 18, Replace the react-icons dependency with lucide-react in the package configuration, then update icon imports and usages in ReviewList.tsx to use Lucide equivalents while preserving the existing UI behavior. Regenerate the lockfile so it reflects the dependency swap and removes react-icons.Source: Coding guidelines
kits/google-reviews-ai-manager/apps/README.md (1)
1-36: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Mission brief: replace scaffold documentation with kit setup instructions.
This README never explains copying
.env.example, configuring Google OAuth and its callback URL, setting Lamatic project/flow variables, or updatingNEXTAUTH_URLfor deployment. Add those steps before merge so the application is actually operable from the documented procedure.🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/apps/README.md` around lines 1 - 36, Replace the scaffold content in the README with kit-specific setup instructions covering dependency installation, copying .env.example to the active environment file, configuring Google OAuth credentials and callback URL, setting the Lamatic project and flow variables, starting the application, and updating NEXTAUTH_URL for deployments. Remove the generic create-next-app guidance and document the required environment variable names using the repository’s existing configuration symbols.kits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_user_1.md (1)
1-1: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Lamatic Studio LLM node prompt reference trigger input variable syntax curly braces💡 Result:
In Lamatic Studio, you use double curly braces
{{ }}to reference input variables within LLM node prompt templates [1][2]. Key syntax and usage details: - Variable Reference: To inject a dynamic variable, enclose the variable path in double curly braces, such as{{triggerNode_1.output.chatMessage}}[1][2]. - Insertion Method: You can either manually type{{to trigger a variable selection menu in the prompt editor or use the interface's built-in "insert Variable" button to select available variables [1][2][3]. - YAML Configuration: When configuring nodes via YAML, the variable syntax remains the same within thepromptTemplatestring (e.g.,promptTemplate: "Prompt text here {{triggerNode_1.output.input}}"), though in some contexts, such as theattachmentsfield or certain templates, a dollar sign prefix might appear in documentation examples (e.g.,${{triggerNode_1.output.topic}}), though the standard variable reference is{{variableName}}[4][5][6][7]. For best practice, utilize the Prompt IDE or editor interface to select variables, which ensures the correct pathing is automatically applied [1][2][3].Citations:
- 1: https://lamatic.ai/guides/tutorials/prompt-engineering-with-lamatic
- 2: https://github.com/lamatic/docs/blob/main/pages/guides/tutorials/prompt-engineering-with-lamatic.mdx
- 3: https://lamatic.ai/guides/tutorials/get-started
- 4: https://lamatic.ai/docs/nodes/ai/multimodal-node
- 5: https://lamatic.ai/docs/flows/flow-config
- 6: https://lamatic.ai/docs/nodes/ai/generate-image-node
- 7: https://lamatic.ai/docs/nodes/ai/generate-json-node
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== Files ==\n' git ls-files 'kits/google-reviews-ai-manager/**' | sed 's#^`#-` #' printf '\n== Prompt file ==\n' sed -n '1,80p' 'kits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_user_1.md' | cat -n printf '\n== Flow file references ==\n' rg -n --hidden --no-ignore-vcs 'my-first-flow_llm-node_user_1\.md|reviewText|starRating|promptTemplate|prompts/' 'kits/google-reviews-ai-manager' -S printf '\n== Nearby prompt files ==\n' find 'kits/google-reviews-ai-manager/prompts' -maxdepth 1 -type f | sortRepository: Lamatic/AgentKit
Length of output: 4612
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== Flow outline ==\n' ast-grep outline 'kits/google-reviews-ai-manager/flows/my-first-flow.ts' --view expanded printf '\n== Prompt usage in flow ==\n' sed -n '1,140p' 'kits/google-reviews-ai-manager/flows/my-first-flow.ts' | cat -n printf '\n== Any curly-brace variable examples in this kit ==\n' rg -n --hidden --no-ignore-vcs '\{\{[^}]+\}\}' 'kits/google-reviews-ai-manager' -SRepository: Lamatic/AgentKit
Length of output: 4801
Replace the literal review placeholders with Lamatic interpolation —
[starRating variable]and[reviewText variable]are plain text here, so the LLM never sees the trigger values. Use the trigger fields instead, e.g.{{trigger.output.starRating}}and{{trigger.output.reviewText}}.🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
[warning] 1-1: Files should end with a single newline character
(MD047, single-trailing-newline)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_user_1.md` at line 1, Update the prompt text in the user message to replace the literal [starRating variable] and [reviewText variable] placeholders with Lamatic trigger interpolation using trigger.output.starRating and trigger.output.reviewText, so the LLM receives the actual review values.kits/google-reviews-ai-manager/README.md (2)
1-72: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Mission detail: clear the configured Markdown lint warnings.
Add a Markdown H1 or adjust the lint configuration, then add the required blank lines around headings and fenced blocks.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
[warning] 17-17: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 20-20: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 38-38: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 49-49: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 50-50: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 59-59: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 61-61: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 63-63: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 68-68: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
[warning] 69-69: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 71-71: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/README.md` around lines 1 - 72, Update the README Markdown structure to satisfy the configured lint rules: add a Markdown H1 (or explicitly adjust the lint configuration), and insert required blank lines before and after headings and fenced code blocks. Preserve the existing content and presentation while ensuring all sections pass Markdown linting.Source: Linters/SAST tools
38-43: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Mission detail: correct the declared framework version.
Line 39 says Next.js 15, while
kits/google-reviews-ai-manager/apps/package.jsondeclares 16.2.10. Update the stack description to the shipped version.🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 38-38: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/google-reviews-ai-manager/README.md` around lines 38 - 43, Update the Next.js version in the README’s “Tech Stack” section to match the shipped version declared in the apps package.json: 16.2.10. Leave the other stack entries unchanged.lamatic/flows/MyFirstFlow.ts (1)
42-52: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Inspect the target file with line numbers sed -n '1,180p' lamatic/flows/MyFirstFlow.ts | cat -n # Search for prompt interpolation / variable syntax examples in the repo rg -n "\[.*variable\]|\{\{.*\}\}|\$\{.*\}|prompt|interpolat|template" lamatic -SRepository: Lamatic/AgentKit
Length of output: 5533
🏁 Script executed:
#!/bin/bash set -euo pipefail # Search the repository for docs/examples that mention prompt variable syntax or interpolation rg -n "\[\w+ variable\]|\{\{\w+.*\}\}|\bvariable\b|\binterpolation\b|\btemplate\b|\bprompt\b" . -S --glob '!*.log' --glob '!node_modules/**' # Look for any README/docs in the repo that mention Lamatic or prompt formatting fd -a -t f 'README*|*.md|*.mdx|*.txt' .Repository: Lamatic/AgentKit
Length of output: 50373
🌐 Web query:
Lamatic prompt variable interpolation syntax [name variable] {{variable}} prompts documentation💡 Result:
Lamatic uses double curly brace syntax {{variableName}} for variable interpolation within prompts and configurations [1][2][3]. Key details regarding this syntax include: Interpolation Syntax: To inject dynamic variables into a prompt template, use the format {{variableName}} [1][4]. Usage in Prompts: You can type {{ directly in the prompt editor to trigger a variable selection menu [1]. These variables are used to parameterize prompts or personalize content [1]. Usage in Workflow Nodes: When referencing the output of another node within a flow configuration, the syntax is {{nodeId.output.field}} [2][3]. Variable Management: The Variable Node allows you to define custom variables, which can then be referenced in other nodes using syntax such as {{variables.variableName}} [3]. In YAML flow configurations, this syntax is used within the values section, such as in the promptTemplate field [2]. Always ensure that node identifiers match the defined node in your workflow when using output references [3].
Citations:
- 1: https://lamatic.ai/guides/tutorials/prompt-engineering-with-lamatic
- 2: https://lamatic.ai/docs/flows/flow-config
- 3: https://lamatic.ai/docs/nodes/logic/variable-node
- 4: https://lamatic.ai/guides/tutorials/get-started
Use Lamatic interpolation for the review fields.
[starRating variable]and[reviewText variable]read as literal text here; switch to Lamatic’s{{...}}syntax so the prompt receives the actual rating and review, and add a render test that checks both values appear in the final prompt.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@lamatic/flows/MyFirstFlow.ts` around lines 42 - 52, Update the user prompt content in the prompts configuration to use Lamatic {{...}} interpolation for the starRating and reviewText fields instead of bracketed placeholders, ensuring the rendered prompt contains the actual values. Add a render test covering both interpolated values in the final prompt.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/google-reviews-ai-manager/.env.example`:
- Line 9: Replace the truthy placeholder value for LAMATIC_API_URL in the
environment example with an empty value, allowing orchestrate.ts to use its
fallback URL; alternatively, document only the actual deployed GraphQL endpoint
rather than a dummy URL.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: dbb8bbb1-b69b-44cb-914e-0ad991e0d377
📒 Files selected for processing (1)
kits/google-reviews-ai-manager/.env.example
|
Hi @ToufiqQureshi! 👋 Before this PR can be reviewed by maintainers, please resolve all comments and requested changes from the CodeRabbit automated review. Steps to follow:
This helps keep the review process efficient for everyone. Thank you! 🙏 |
|
@ToufiqQureshi the PR is not up to the mark. Please check contributing.md and the github copilot comments |
2 participants
Description
This PR introduces the Google Reviews AI Manager Kit. It is a complete Next.js application that integrates with the Google My Business API and Lamatic.ai Edge Engine to automatically generate context-aware replies to Google Reviews.
Features:
(Note: All PR Checklist items have been verified and tested locally.)
.github/workflows/lamatic-update.ymlto sync Lamatic flows when**/lamatic/flows/**changes (skips when head commit message contains[LAMATIC-COMMIT]).kits/google-reviews-ai-manager/README.mdkits/google-reviews-ai-manager/agent.mdkits/google-reviews-ai-manager/constitutions/default.mdkits/google-reviews-ai-manager/lamatic.config.tskits/google-reviews-ai-manager/.env.example(includesGOOGLE_*,NEXTAUTH_*, andLAMATIC_*placeholders;LAMATIC_API_URLplaceholder fixed/set)kits/google-reviews-ai-manager/apps/.env.example(Google/NextAuth +LAMATIC_*placeholders)kits/google-reviews-ai-manager/apps/.gitignorekits/google-reviews-ai-manager/apps/AGENTS.mdkits/google-reviews-ai-manager/apps/CLAUDE.mdkits/google-reviews-ai-manager/apps/README.mdkits/google-reviews-ai-manager/flows/my-first-flow.ts(flow definition referencing prompt + model-config files)kits/google-reviews-ai-manager/model-configs/my-first-flow_llm-node_generative-model-name.tskits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_system_0.mdkits/google-reviews-ai-manager/prompts/my-first-flow_llm-node_user_1.mdlamatic/flows/MyFirstFlow.ts(the expandedflowConfigwith concrete node/prompt mappings)lamatic/project.json(project metadata)kits/google-reviews-ai-manager/apps/:apps/package.json,apps/tsconfig.json,apps/next.config.ts,apps/eslint.config.mjs,apps/postcss.config.mjsapps/app/layout.tsx,apps/app/page.tsx,apps/app/globals.cssapps/app/components/ReviewList.tsx(UI: location selection, review list/search/filter, AI draft generation, edit/publish reply)apps/app/actions/gmb.ts(server actions for Google Business Profile: list locations, fetch reviews, post replies)apps/app/actions/orchestrate.ts(server actiongenerateReply()that calls LamaticexecuteWorkflowand returns{ reply })apps/app/api/auth/[...nextauth]/route.ts(Google OAuth via NextAuth; exposessession.accessToken)triggerNode(“API Request”, GraphQL) to accept inputsreviewTextandstarRating.dynamicNode(“Generate Text”, LLM) to generate a Google-review reply using the system/user prompt templates and the configured DeepSeek model credential/config.responseNode(“API Response”, GraphQL) to map{{llmNode.output.generatedResponse}}into the returnedresponsefield.trigger -> llmNode -> responseNode, plus an explicitresponseEdgefromtriggertoresponseNode.