Spaces:
Running
Running
| # Reachy_OpenWebUI Code Audit Report | |
| Scope audited: `C:\Users\jsnmd\Documents\Reachy_OpenWebUI\working\Reachy_OpenWebUI` | |
| No fixes were applied during the audit. | |
| ## High Priority | |
| ### 1. Undefined `BackgroundToolManager` type reference | |
| File: `src/Reachy_OpenWebUI/tools/core_tools.py:266` | |
| `dispatch_tool_call_with_manager()` annotates `tool_manager` as `"BackgroundToolManager"`, but the name is not imported anywhere in the module. Ruff reports this as `F821 Undefined name BackgroundToolManager`. | |
| Suggested fix: import `BackgroundToolManager` under `TYPE_CHECKING` from `Reachy_OpenWebUI.tools.background_tool_manager`, or replace the annotation with a protocol / less specific type. | |
| ### 2. Missing runtime dependency for Marionette upload route | |
| File: `src/Reachy_OpenWebUI/sub_apps/marionette/marionette/routes.py:87` | |
| The route uses `UploadFile = File(...)`, which requires `python-multipart` at runtime. `pyproject.toml` does not currently list `python-multipart` in `[project].dependencies`. | |
| Suggested fix: add `python-multipart` to runtime dependencies. | |
| ### 3. Missing runtime dependency for Marionette community dataset fallback | |
| File: `src/Reachy_OpenWebUI/sub_apps/marionette/marionette/datasets.py:598` | |
| The community dataset fallback lazily imports `requests`, but `pyproject.toml` only lists `types-requests` in dev dependencies. | |
| Suggested fix: add `requests` to runtime dependencies or replace that path with the existing `httpx` dependency. | |
| ### 4. Broad CORS on robot-facing app/tool surfaces | |
| Files: | |
| - `src/Reachy_OpenWebUI/console.py:964` | |
| - `src/Reachy_OpenWebUI/tool_server/openapi_routes.py:35` | |
| Both surfaces use `allow_origins=["*"]`. That is convenient for development, but risky for a LAN-visible robot control UI. | |
| Suggested fix: restrict origins to the expected app/host origins, or gate broad CORS behind a development setting. | |
| ## Dead / Bad Links | |
| ### 5. Missing landing-page GIF | |
| File: `index.html:43` | |
| The landing page references `docs/assets/reachy_mini_dance.gif`, but that file is missing from the tree. | |
| Suggested fix: restore the asset or update the page to reference an existing media file. | |
| ### 6. Broken Marionette dev video paths | |
| Files: | |
| - `dev/Jail/marionette_port/index.html:509` | |
| - `dev/Jail/marionette_port/index.html:570` | |
| The referenced video files exist under `dev/Jail/marionette_port/assets/`, but the HTML points to `marionette/assets/...`. | |
| Suggested fix: update the dev HTML paths or remove the stale dev page from the active tree. | |
| External links checked successfully: | |
| - `https://www.contributor-covenant.org/version/3/0/` | |
| - `https://www.contributor-covenant.org/faq/` | |
| - `https://creativecommons.org/licenses/by-sa/4.0/` | |
| - `https://huggingface.co/spaces/pollen-robotics/Reachy_Mini_Apps` | |
| ## Duplicate / Stale Code | |
| ### 7. Exact duplicate tool modules | |
| Exact duplicate modules exist between the main app and the cookAIware sub-app, including: | |
| - `src/Reachy_OpenWebUI/tools/move_head.py` | |
| - `src/Reachy_OpenWebUI/sub_apps/cookAIware/tools/move_head.py` | |
| - `src/Reachy_OpenWebUI/tools/stop_dance.py` | |
| - `src/Reachy_OpenWebUI/sub_apps/cookAIware/tools/stop_dance.py` | |
| - `src/Reachy_OpenWebUI/tools/stop_emotion.py` | |
| - `src/Reachy_OpenWebUI/sub_apps/cookAIware/tools/stop_emotion.py` | |
| - `src/Reachy_OpenWebUI/tools/head_tracking.py` | |
| - `src/Reachy_OpenWebUI/sub_apps/cookAIware/tools/head_tracking.py` | |
| Suggested fix: keep one shared implementation and have the sub-app import or wrap it. | |
| ### 8. Large stale `dev/` area | |
| The `dev/` directory contains large copied experiments, old bot folders, `.bk` backups, logs, test ports, and stale app copies. It is ignored by `.gitignore`, but still lives in the working tree and affects scans/reviews. | |
| Suggested fix: move archival material outside the repo or keep only documented, intentional dev fixtures. | |
| ### 9. Duplicate image assets | |
| Large image files are duplicated between `src/Reachy_OpenWebUI/images/` and `src/Reachy_OpenWebUI/static/assets/`, including: | |
| - `reachy-conversation-app.png` | |
| - `cooking-chief.png` | |
| - `reachy-how-to-create-app.png` | |
| Suggested fix: choose one asset location and reference it consistently. | |
| ## Maintainability Risks | |
| ### 10. Oversized classes and route/controller files | |
| Notable hotspots: | |
| - `src/Reachy_OpenWebUI/console.py:284` - `LocalStream` | |
| - `src/Reachy_OpenWebUI/sub_apps/conversation_app/local/llm.py:246` - `OpenWebUIClient` | |
| - `src/Reachy_OpenWebUI/sub_apps/conversation_app/local/handler.py:408` - `LocalSessionHandler` | |
| - `src/Reachy_OpenWebUI/sub_apps/marionette/marionette/datasets.py:54` - `DatasetMixin` | |
| - `src/Reachy_OpenWebUI/sub_apps/marionette/marionette/recording.py:46` - `RecordingMixin` | |
| - `src/Reachy_OpenWebUI/sub_apps/marionette/marionette/routes.py:48` - `register_routes` | |
| Suggested fix: split transport, persistence, UI route, robot-control, and OpenWebUI-client responsibilities into smaller services. | |
| ### 11. Heavy use of catch-all exception handling | |
| Static search found many broad `except Exception` handlers across `console.py`, Marionette, cookAIware, and the local conversation code. | |
| Suggested fix: keep catch-all handlers at route/process boundaries; use narrower exception types inside logic paths and preserve actionable error messages. | |
| ### 12. Hardcoded robot/tool-server default | |
| File: `src/Reachy_OpenWebUI/sub_apps/conversation_app/local/llm.py:1449` | |
| The fallback default is `http://172.30.3.8:7860/reachy-tools`. This can silently point at the wrong robot/network. | |
| Suggested fix: require explicit config or derive the tool-server URL from the current settings-app origin. | |
| ## Validation Notes | |
| - Python AST parsing passed for all `.py` files. | |
| - `ruff check . --statistics` found 282 issues. Most are style/doc/import-order findings; the highest-risk functional finding is the undefined `BackgroundToolManager` annotation. | |
| - `ruff check src/Reachy_OpenWebUI --select F` reported 46 pyflakes findings, mostly unused re-export/import warnings plus the one undefined-name issue above. | |
| - Route mapping showed the main UI and Marionette UI route calls mostly line up. Marionette API calls are intentionally rebased through a frontend fetch wrapper when mounted under `/apps/marionette`. | |
| - The working tree was already dirty before the audit. | |