src/hooks/useWebRTC.js-100-116 (1)

100-116: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Prevent replay of processed signal documents.

Firestore sends existing matching documents as added when this listener starts. The handler only checks peersRef.current[data.senderUid], so an unprocessed signal from before a disconnect can be applied to the new peer. Restore one-time consumption or add a call-session/document ID and consume/deduplicate signals once before calling peer.signal().

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useWebRTC.js` around lines 100 - 116, Update the signal handling in
useWebRTC’s onSnapshot callback to consume or deduplicate each signal document
before creating a peer or calling peer.signal(). Ensure documents replayed as
added on listener startup, including stale pre-disconnect signals, are ignored
after prior processing while allowing each current call-session signal to be
applied once.

eslint.config.js-24-30 (1)

24-30: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Register Vitest globals for src/hooks/__tests__ files.

Vitest includes src/**/__tests__/**/*.{test,spec}.{js,jsx} and enables globals, but these imports use describe, it, expect, and vi directly. Add a later flat-config entry for src/hooks/__tests__ that sets languageOptions.globals.vitest.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@eslint.config.js` around lines 24 - 30, Update the flat ESLint configuration
after the existing config entry with a later rule targeting src/hooks/__tests__
test files, and set languageOptions.globals.vitest for that pattern so direct
describe, it, expect, and vi usage is recognized.

vite.config.js-20-26 (1)

20-26: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not externalize Monaco in the browser build.

external leaves monaco-editor/esm/vs/editor/editor.api as a bare browser import. @monaco-editor/react and monaco-vim need Monaco resolved by the bundler; with this config, the Editor route can fail in production. Remove the rolldownOptions.external entry and add monaco-editor directly if peer resolution fails.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@vite.config.js` around lines 20 - 26, Update the build configuration’s
rolldownOptions by removing the external entry for
monaco-editor/esm/vs/editor/editor.api so Monaco is bundled for browser
production builds; if peer dependency resolution still fails, add monaco-editor
directly to the build inputs or dependencies using the existing project
convention.

server/services/judge0Service.js-3-29 (1)

3-29: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Honor custom JUDGE0_API_URL values.

getJudge0Config returns either the RapidAPI endpoint or https://ce.judge0.com/submissions?wait=true; it never uses envUrl for non-RapidAPI values. A configured self-hosted Judge0 URL is discarded, and code execution then posts source code to the public Judge0 CE endpoint. Add a branch that uses envUrl for custom, non-RapidAPI URLs unless that configuration option is no longer supported.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/judge0Service.js` around lines 3 - 29, Update getJudge0Config
so configured non-RapidAPI envUrl values are preserved instead of falling back
to the public Judge0 endpoint. Add a custom-URL branch after the RapidAPI
handling, returning envUrl with the required submissions?wait=true path and JSON
headers, while retaining the existing RapidAPI and default public endpoint
behavior.

server/middleware/rateLimiter.js-4-5 (1)

4-5: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Return the actual client IP from getIpKey.

ipKeyGenerator(req) does not create an IP-based limiter key. getIpKey should fall back to a client IP, with IPv6 normalized via ipKeyGenerator(req.ip), otherwise the rate limiter can get one bucket per request object and allow clients to bypass max: 5.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/middleware/rateLimiter.js` around lines 4 - 5, Update getIpKey to
derive the key from the client IP rather than passing the request object to
ipKeyGenerator: use req.ip as the fallback input and normalize it through
ipKeyGenerator(req.ip), preserving the actual client-IP-based limiter bucket.

src/hooks/useRoom.js-136-147 (1)

136-147: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

join-room always reports the stale initial role.

Line 145 sends role: myRole. myRole derives from roomData (Lines 107-109), and roomData is loaded by the separate effect at Lines 202-216, which resolves after the socket connects.

At connect time roomData is null, so myRole evaluates to 'viewer' for every user, including the room host. The effect deps at Line 185 omit myRole, and join-room is emitted only inside the connect handler, so the role is never corrected. The presence list built at socketService.js Lines 68-73 therefore shows every collaborator as a viewer for the whole session.

Emit a role update after roomData resolves, or wait for roomData before joining.

🐛 Proposed fix

Send the role in a separate effect that reacts to myRole:

+  // Re-announce the role whenever it resolves or changes.
+  useEffect(() => {
+    if (!roomId || !user || !socket || !isConnected) return;
+    socket.emit('join-room', {
+      roomId,
+      user: {
+        uid: user.uid,
+        displayName: user.displayName || user.email?.split('@')[0] || 'Guest',
+        email: user.email,
+      },
+      role: myRole,
+    });
+  }, [roomId, user, socket, isConnected, myRole]);

The server treats join-room as idempotent (socketService.js Lines 67-79), so the repeat call updates the existing entry. The server must still resolve the authoritative role itself, as noted on server/services/socketService.js.

Also applies to: 185-185

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useRoom.js` around lines 136 - 147, Update the socket join flow
around the connect handler and the effect at line 185 so room membership is
emitted again when myRole changes after roomData loads. Keep the initial
connection behavior, but add a role-reactive join-room emission using the
existing payload and socket state, ensuring the server receives the
authoritative resolved role instead of retaining the initial viewer value.

firestore.rules-56-58 (1)

56-58: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Any signed-in user can delete other users' subcollection documents.

votes, signals, and drawings now allow delete for any authenticated user, with no participant check and no owner check. create is also unconstrained, so a document is not tied to its author.

A signed-in user who is not a participant can delete another room's whiteboard drawings and WebRTC signal documents, which breaks the call setup and the whiteboard for that room.

Restrict these rules to room participants, and restrict delete to the author or the intended recipient.

🔒 Proposed direction

+      function isParticipant() {
+        let room = get(/databases/$(database)/documents/rooms/$(roomId)).data;
+        return request.auth != null
+               && (request.auth.uid == room.createdBy || request.auth.uid in room.participantIds);
+      }
+
       match /signals/{signalId} {
-        allow read, create, delete: if request.auth != null;
+        allow read: if isParticipant();
+        allow create: if isParticipant() && request.resource.data.senderId == request.auth.uid;
+        allow delete: if isParticipant()
+                      && (resource.data.senderId == request.auth.uid
+                          || resource.data.recipientId == request.auth.uid);
       }
 
       match /drawings/{drawingId} {
-        allow read, create, delete: if request.auth != null;
+        allow read, create: if isParticipant();
+        allow delete: if isParticipant() && resource.data.uid == request.auth.uid;
       }

Adjust the field names to match the documents that src/hooks/useWebRTC.js and the whiteboard component write.

Also applies to: 84-91

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@firestore.rules` around lines 56 - 58, Update the Firestore rules for the
affected subcollections around the `allow read/create/update/delete` statements
so access requires room participation, creation binds the document to its author
using the field names written by `useWebRTC.js` and the whiteboard component,
and deletion is limited to that author or the intended recipient. Apply the same
restrictions to the additional affected rule block.

src/hooks/useRoom.js-356-361 (1)

356-361: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

The execution vote no longer reaches a real quorum.

Presence moved to Socket.IO, so activeUsers is no longer written to the room document. This join path updates participantIds and roles only.

castVote still reads presence from Firestore: const totalUsersCount = (data.activeUsers || []).length; at Line 504. That value is now always 0. The initiator pre-approves at Line 459, so approvals.length > 0 / 2 is true immediately and the vote status becomes approved on creation. The consensus gate on code execution is bypassed. The deadlock-resolution effect at Line 607 has the same problem.

Make the active-user count available to the vote logic. Two options:

• Have the server write the current activeUsers count into the room document on each presence-update, so the transaction reads a fresh value.
• Pass the socket-derived activeUsers.length into castVote and store it on the vote when it is created.

The first option is safer, because a client-supplied count lets any client force a quorum.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useRoom.js` around lines 356 - 361, Update the Socket.IO
presence-update handling so the server persists the current active-user count in
the room document, preserving the existing activeUsers field shape consumed by
castVote and the deadlock-resolution effect. Ensure the write occurs whenever
presence changes and that vote creation and quorum checks read this fresh
server-derived value instead of defaulting to an empty list.

src/components/Chat/ChatPanel.jsx-46-66 (1)

46-66: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Chat messages are no longer persisted, so history is lost.

This component now receives messages only from the live socket. server/services/socketService.js Lines 142-146 relays chat-message without storing it, and nothing else writes the messages subcollection.

Consequences:

• A user who joins after a message was sent never sees it.
• A page reload clears the entire conversation.
• Messages sent while a user's socket is down are lost permanently, because the server relays with socket.to(roomId) and keeps no buffer.

firestore.rules Lines 68-70 still grant read, create on rooms/{roomId}/messages, which indicates the collection is still expected to hold the history.

Write each message to Firestore from the server when it relays the event, and load the recent history when the panel mounts.

Do you want me to open an issue for restoring chat persistence?

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/Chat/ChatPanel.jsx` around lines 46 - 66, Restore chat
persistence by updating the server’s chat-message relay in socketService to
write each message to the room’s Firestore messages subcollection before or
alongside broadcasting it. In ChatPanel’s mount effect, load recent messages for
roomId from Firestore, initialize messages with that history, and retain the
existing socket listener for new-message updates and deduplication.

server/services/socketService.js-5-7 (1)

5-7: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Room state survives only in process memory and is flushed only when the room empties.

activeRooms is module-level state in a single Node process, and Firestore receives a write only when activeUsers.length === 0 (Line 165).

Two failure modes follow:

• A crash, a deploy, or a restart loses every unsaved edit for every active room. The previous Firestore-backed sync wrote continuously, so this migration removes durability that users relied on.
• With more than one server instance, two users in the same room can connect to different instances. Each instance keeps its own activeRooms entry, so the users never see each other's edits. The instance that empties last overwrites the other instance's saved code.

Recommended changes:

• Flush room.code, room.language, room.stdin, and updatedAt on a debounced interval, for example every 10 seconds when room.code !== room.lastSavedCode. lastSavedCode is already tracked at Line 60 but never read.
• Add the Socket.IO Redis adapter and move activeRooms to shared storage before running more than one instance.
• Flush all rooms on SIGTERM before the process exits.

Do you want me to implement the debounced flush and the SIGTERM handler?

Also applies to: 164-180

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/socketService.js` around lines 5 - 7, Make room persistence
durable by periodically flushing each activeRooms entry when room.code differs
from lastSavedCode, including code, language, stdin, and updatedAt, then update
lastSavedCode after a successful write. Add a SIGTERM shutdown handler that
flushes all rooms before exit, and configure the Socket.IO Redis adapter with
shared room-state storage so users connected to different instances observe the
same edits.

server/services/socketService.js-149-182 (1)

149-182: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

One disconnected tab removes a user who is still connected elsewhere.

currentRoomId and currentUser are per-socket closures, but activeUsers is deduplicated by uid at Line 67. If one user opens two tabs, the room holds a single entry for that uid.

When the first tab disconnects, Line 159 filters the uid out of activeUsers. The second tab is still joined, but presence reports the user as gone. If that user was the only member, Line 165 treats the room as empty, flushes it, and calls activeRooms.delete(roomId) at Line 179. The surviving socket keeps emitting code-update, but Line 95 returns early because activeRooms no longer holds the room. That tab silently stops syncing until the user reloads.

Track connections per uid, and remove the user only when the last socket for that uid disconnects.

A second problem in the same handler: a socket can call join-room again with a different roomId. Line 28 overwrites currentRoomId, but the socket never leaves the previous Socket.IO room, so it keeps receiving events from it and is never removed from its activeUsers list.

🐛 Proposed direction

     socket.on('join-room', async ({ roomId, user, role }) => {
       if (!roomId || !user) return;
+      if (currentRoomId && currentRoomId !== roomId) {
+        socket.leave(currentRoomId);
+        removeSocketFromRoom(currentRoomId, currentUser, socket.id);
+      }

Store sockets: Set<socketId> on each activeUsers entry. On disconnect, delete socket.id from that set and remove the user only when the set is empty.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/socketService.js` around lines 149 - 182, Update the room
membership flow around join-room and the disconnect handler to track socket IDs
per active user, adding and removing socket.id from each user’s sockets Set and
removing the user only when that Set becomes empty. Before switching rooms,
remove the socket from its previous room’s membership and Socket.IO room so
rejoining cannot leave stale presence or subscriptions; preserve the existing
empty-room persistence and cleanup only after the last member is gone.

server/services/socketService.js-94-114 (1)

94-114: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Cap the size of code and stdin payloads.

Neither handler limits the payload size. room.code and room.stdin accept unbounded strings from a client, retain them in the activeRooms map, and broadcast them to every room member.

A single client can push megabytes per event. That grows the process heap without bound and multiplies outbound bandwidth by the number of room members. src/hooks/useRoom.js Lines 540-548 already cap execution output at 10 000 characters, so the codebase has a precedent for this limit.

A payload above the 1 MiB Firestore document limit also makes the persistence write at Line 169 fail permanently, so the room can never be saved again.

Reject or truncate oversized payloads, and set maxHttpBufferSize on the Socket.IO server.

🛡️ Proposed fix

+const MAX_CODE_BYTES = 500 * 1024; // stays under the 1 MiB Firestore document limit
+const MAX_STDIN_BYTES = 64 * 1024;
+
 function initSocketServer(server, allowedOrigins) {
   const io = new Server(server, {
+    maxHttpBufferSize: 1e6,
     cors: { ... },
   });

     socket.on('code-update', ({ roomId, code, language }) => {
       if (!roomId || !activeRooms.has(roomId)) return;
+      if (typeof code !== 'string' || Buffer.byteLength(code, 'utf8') > MAX_CODE_BYTES) {
+        logger.warn(`[Socket] Rejected oversized code-update for room ${roomId}`);
+        return;
+      }

Apply the equivalent guard with MAX_STDIN_BYTES in stdin-update.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/socketService.js` around lines 94 - 114, Cap incoming code
and stdin payloads before storing or broadcasting them: define and reuse
byte-size limits, including the proposed MAX_STDIN_BYTES guard, and reject or
truncate values exceeding the limits. Update both the code-update and
stdin-update handlers in the socket service, and configure the Socket.IO
server’s maxHttpBufferSize to enforce the transport-level limit while preserving
normal room updates.

firestore.rules-11-14 (1)

11-14: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove the public read allow on /users/{userId}.

The broader rule permits unauthenticated reads on every user document because it matches above the owner-only rule. User documents store uid, displayName, and email, so this exposes PII. The required display-name uniqueness check can use a public displayNames/{normalizedName} collection or a server-side Admin SDK check instead of public reads of user documents.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@firestore.rules` around lines 11 - 14, Remove the `allow read: if true` rule
from the `/users/{userId}` match block, preserving the existing owner-only
access rule. Update signup display-name uniqueness checks to use the
`displayNames/{normalizedName}` collection or a server-side Admin SDK lookup
rather than reading user documents publicly.

src/hooks/useRoom.js-246-296 (1)

246-296: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Store password materials when creating password-protected rooms.

createRoom sets passwordProtected: true, but neither the Firestore write nor /api/rooms/create stores passwordHash or passwordSalt; Firestore rules only block client writes to those fields. Joined users then reach POST /api/rooms/verify-password, which returns 500 Room configuration error. Derive the hash with a fresh salt over HTTPS and write passwordHash and passwordSalt using the Admin SDK.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useRoom.js` around lines 246 - 296, Update createRoom to derive a
password hash and fresh salt when trimmedPassword is present, then include
passwordHash and passwordSalt in the server room-creation payload over HTTPS; do
not rely on the client-side setDoc for these protected fields, since they must
be written through the Admin SDK. Ensure password-protected rooms persist both
materials and unprotected rooms retain the existing behavior.

src/components/Auth/AuthModal.jsx-75-86 (1)

75-86: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Fail closed when display-name lookup fails.

If the duplicate lookup throws, this code logs and then runs createUserWithEmailAndPassword, so signup can bypass the read. Client-side Firestore reads are not atomic under match /users/{userId} { allow read: if true; }, and the server has no displayed uniqueness reservation for displayNameLower. Block signup when the lookup cannot complete, or use a trusted atomic reservation.

Proposed fail-closed handling

         } catch (err) {
-          console.warn('[AuthModal] Username uniqueness check failed:', err.message);
+          toast.error('Could not verify the display name. Please try again.');
+          return;
         }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/Auth/AuthModal.jsx` around lines 75 - 86, Update the username
uniqueness-check catch block in AuthModal’s signup flow to fail closed: after
logging the lookup error, stop signup, clear the loading state, and surface an
appropriate error instead of continuing to create the account. Preserve the
existing duplicate-name rejection behavior and ensure
createUserWithEmailAndPassword runs only when the lookup completes successfully.

server/tests/cors.test.js-15-18 (1)

15-18: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Import the Vitest globals in server/tests/cors.test.js.

The lint config only defines browser/ES globals and server/tests/cors.test.js does not explicitly import it, expect, or describe. Add the import above the describe block to avoid these undefined-globals errors.

Proposed fix

+import { expect, it } from 'vitest';

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/tests/cors.test.js` around lines 15 - 18, Import the Vitest globals
used by server/tests/cors.test.js—describe, it, and expect—before the existing
describe block so the test file passes lint without relying on implicit globals.

Source: Linters/SAST tools

server/services/judge0Service.js-6-7 (1)

6-7: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Fix no-undef for process in ESLint’s server rules.

eslint.config.js declares globals.browser and globals.es2020 for **/*.{js,jsx}, but not globals.node. Add globals.node or an equivalent Node environment for the server/ files so process is not flagged by no-undef.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/judge0Service.js` around lines 6 - 7, Update the ESLint
configuration for server-side JavaScript files to include the Node globals
environment, ensuring process in judge0Service.js and other server files is
recognized and no longer triggers no-undef. Preserve the existing browser and
ES2020 globals configuration for non-server files.

Source: Linters/SAST tools

src/components/Chat/ChatPanel.jsx-80-81 (1)

80-81: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Use crypto.randomUUID() for the message id.

Math.random().toString(36).substring(2, 9) produces at most 7 base-36 characters, and fewer whenever toString(36) drops trailing zeros. That is roughly 36^7 values at best, generated independently by every client.

The id serves as the React key at Line 387 and as the deduplication key at Line 52. A collision between two users silently discards a legitimate message.

src/hooks/useRoom.js Line 252 already uses crypto.randomUUID(). The comment on Line 80 also calls this a "UUID prefix", which does not match the implementation.

♻️ Proposed fix

-    // Generate standard client-side UUID prefix
-    const msgId = Math.random().toString(36).substring(2, 9);
+    const msgId =
+      typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
+        ? crypto.randomUUID()
+        : `${Date.now()}-${user.uid}-${Math.random().toString(36).slice(2)}`;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/Chat/ChatPanel.jsx` around lines 80 - 81, Update the
message-id assignment in ChatPanel to use crypto.randomUUID() instead of the
Math.random-based value, preserving the resulting id’s use as the React key and
deduplication key.

src/hooks/useRoom.js-173-178 (1)

173-178: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Remote cursors are never removed when a user leaves.

The cursor-move handler only adds and updates entries. No handler deletes an entry, and presence-update (Line 160) does not prune remoteCursors.

src/components/Editor/EditorPage.jsx Lines 592-638 renders one decoration and one injected <style> element per entry. Its cleanup at Lines 645-654 removes style elements only for uids that are absent from remoteCursors, and that object never shrinks. A user who leaves the room keeps a visible ghost cursor and a <style> element in the document head until the page reloads.

Prune remoteCursors against the presence list.

🐛 Proposed fix

     newSocket.on('presence-update', (users) => {
       setActiveUsers(users);
+      const liveUids = new Set(users.map((u) => u.uid));
+      setRemoteCursors((prev) => {
+        const next = {};
+        for (const [uid, cursor] of Object.entries(prev)) {
+          if (liveUids.has(uid)) next[uid] = cursor;
+        }
+        return next;
+      });
     });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useRoom.js` around lines 173 - 178, Update the presence-update
handling in useRoom so remoteCursors is pruned against the current presence
list, removing entries for users who are no longer present while preserving
active cursor entries. Keep the existing cursor-move updates in the newSocket
handler unchanged.

package.json-11-11 (1)

11-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Extend lint to cover server/ with a CommonJS Node config.

lint only runs eslint src, so the new server files never get lint coverage. If server/**.js files are added, ESLint will still apply the existing files: ['**/*.{js,jsx}'] config, which sets sourceType: 'module', browser globals, and React rules. Add a later config block with files: ['server/**/*.js'], sourceType: 'commonjs', and globals: { node: true }, then update the script to include server while excluding the React JSX/client pattern.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 11, Extend the lint script to lint server files
alongside src while excluding the React JSX/client pattern, and add a later
ESLint configuration block targeting server/**/*.js with CommonJS source type
and Node globals. Preserve the existing client/React configuration for src and
ensure the server override takes precedence.

Source: Linters/SAST tools

src/components/Auth/AuthModal.jsx-77-79 (1)

77-79: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Use one canonical display name for lookup and storage.

Line 78 trims name for the query, but Line 89 passes the raw name to updateProfile. saveUser then derives displayNameLower from that value at Lines 36-38. An input such as " Alice " can store " alice " while a later lookup searches "alice".

Trim the value once. Use it for the query, updateProfile, and displayNameLower.

Proposed normalization

+        const normalizedName = name.trim();
         try {
           const { collection, query, where, getDocs } = await import('firebase/firestore');
           const q = await getDocs(
-            query(collection(db, 'users'), where('displayNameLower', '==', name.trim().toLowerCase()))
+            query(collection(db, 'users'), where('displayNameLower', '==', normalizedName.toLowerCase()))
           );
...
-        await updateProfile(result.user, { displayName: name });
+        await updateProfile(result.user, { displayName: normalizedName });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/Auth/AuthModal.jsx` around lines 77 - 79, Normalize the
display name once in the AuthModal submission flow, then reuse that trimmed
value for the users query, updateProfile call, and saveUser/displayNameLower
derivation. Update the relevant variable and references near getDocs and
updateProfile so inputs such as surrounding whitespace produce one canonical
stored and queried name.

server/services/judge0Service.js (2)

86-102: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Log the fallback when Judge0 returns an unexpected response shape.

If data.status.id is undefined, execution falls through to the Wandbox fallback without any log message. The catch block below logs a warning, so this specific fallback path is comparatively silent. Add a log statement before falling through, so operators can distinguish "Judge0 unreachable" from "Judge0 returned an unexpected payload."

🔍 Proposed fix to log malformed Judge0 responses

     const data = response.data;
     if (data && data.status && data.status.id !== undefined) {
       const stdout = (data.stdout || '').slice(0, MAX_OUTPUT_LENGTH);
       const stderr = (data.stderr || data.compile_output || data.message || '').slice(0, MAX_OUTPUT_LENGTH);
       
       return {
         stdout: stdout || null,
         stderr: stderr || null,
         compile_output: data.compile_output || null,
         status: data.status,
         time: data.time || null,
         memory: data.memory || null,
       };
     }
+    console.warn('[Execution] Judge0 CE returned an unexpected response shape. Falling back to Wandbox...');
   } catch (judge0Error) {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/judge0Service.js` around lines 86 - 102, Add a warning
immediately before the Judge0 response-handling block falls through when
data.status.id is undefined, clearly indicating that Judge0 returned an
unexpected response payload and execution is falling back to Wandbox. Keep the
existing catch warning for request failures unchanged.

---

125-130: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Consider marking the maintenance error as retryable for callers.

The thrown maintenance error is a plain Error with only a message string. server/routes/execute.js passes it to next(err) with no special handling, so callers can only detect "retryable" failures by matching a substring in the message. Attach a machine-readable marker (e.g., err.statusCode = 503 or err.retryable = true) so the route and downstream error handling can respond with the correct HTTP status and support automated retry.

♻️ Proposed fix to mark the error as retryable

     if (isWandboxRuntimeFailure) {
-      throw new Error('Remote execution engine is currently undergoing maintenance. Please retry in a few moments.');
+      const maintenanceError = new Error('Remote execution engine is currently undergoing maintenance. Please retry in a few moments.');
+      maintenanceError.statusCode = 503;
+      maintenanceError.retryable = true;
+      throw maintenanceError;
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/services/judge0Service.js` around lines 125 - 130, Update the
maintenance error thrown in the isWandboxRuntimeFailure branch to include a
machine-readable retryable marker, such as statusCode 503 or retryable true,
while preserving the existing message and next(err) propagation through
execute.js.

server/routes/webhooks.js (1)

186-189: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Cover the changed no-destination response contract.

Line 186 changes /api/webhooks/room-event from HTTP 503 to HTTP 200 without dispatching an event. Add a regression test for the status and response body. Verify that callers do not rely on HTTP 503 to detect missing integration configuration. Keep a separate test for configured destination failures returning HTTP 502.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/routes/webhooks.js` around lines 186 - 189, Add regression coverage
for the no-destination branch in the room-event webhook handler, asserting HTTP
200 and the complete response body including success, empty dispatched results,
and the configuration message. Verify callers do not depend on HTTP 503 for
missing integrations, while preserving a separate test that configured
destination failures return HTTP 502.

src/hooks/useRoom.js (1)

119-127: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the redundant early-return branch that calls setState in the effect body.

When roomId or user becomes falsy, React runs the previous effect's cleanup (Lines 180-184) before this body executes. That cleanup already calls disconnect(), setSocket(null), and setIsConnected(false).

The branch is therefore redundant. It also reads socket, which is not in the dependency list at Line 185, so it can act on a stale value. The synchronous setSocket(null) call triggers the ESLint react-hooks/set-state-in-effect error reported for Line 123 and forces an extra render.

Delete the branch.

♻️ Proposed refactor

   useEffect(() => {
-    if (!roomId || !user) {
-      if (socket) {
-        socket.disconnect();
-        setSocket(null);
-      }
-      setIsConnected(false);
-      return;
-    }
+    if (!roomId || !user) return;
 
     const apiUrl = import.meta.env.VITE_API_URL || 'http://localhost:3001';

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useRoom.js` around lines 119 - 127, Remove the early-return branch
in the useRoom effect that checks !roomId or !user, including its socket
disconnect and state updates, so the effect no longer performs redundant
setState calls or reads stale socket state; rely on the existing cleanup for
disconnect and reset behavior.

Source: Linters/SAST tools

server/package.json (1)

30-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove unused Yjs dependencies. Both manifests add yjs and y-websocket, and the client also adds y-monaco, but the repository has no code that consumes them. Keep the CRDT/editor binding only if this PR lands it.

• server/package.json#L30-L31: remove y-websocket and yjs.
• package.json#L50-L54: remove y-monaco, y-websocket, or add the Yjs binding that uses them.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/package.json` around lines 30 - 31, Remove the unused Yjs
dependencies: in server/package.json lines 30-31, remove y-websocket and yjs; in
package.json lines 50-54, remove y-monaco and y-websocket unless this PR adds
the Yjs binding that consumes them.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes