String concatenation operator used to assemble the prefix string. Refactor to use a template literal (e.g., ${deepLinkScheme.toLowerCase()}://) for improved readability and fewer errors.

Kody rule violation: Use Template Literals Instead of String Concatenation

File electron/main.js:

Line 32:

String concatenation operator used to assemble the prefix string. Refactor to use a template literal (e.g., `${deepLinkScheme.toLowerCase()}://`) for improved readability and fewer errors.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Unstructured error logging detected in the deep-link catch block. Replace console.error with a structured logger.error call, including operation names and relevant identifiers for searchability and correlation.

Kody rule violation: Include error context in structured logs

File electron/preload.js:

Line 66:

Unstructured error logging detected in the `deep-link` catch block. Replace `console.error` with a structured `logger.error` call, including operation names and relevant identifiers for searchability and correlation.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Memory leak vulnerability identified in onDeepLink due to a missing unsubscribe function for ipcRenderer.on. Return a deterministic cleanup function (e.g., () => ipcRenderer.removeListener('deep-link', handler)) to prevent duplicate listener stacking.

Kody rule violation: Provide error handlers to subscription/listener APIs

File electron/preload.js:

Line 62 to 68:

Memory leak vulnerability identified in `onDeepLink` due to a missing unsubscribe function for `ipcRenderer.on`. Return a deterministic cleanup function (e.g., `() => ipcRenderer.removeListener('deep-link', handler)`) to prevent duplicate listener stacking.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Resource leak identified where ipcRenderer.on event listeners are never removed. Store the listener reference and expose a removal function to allow proper cleanup on unmount.

Kody rule violation: Proper memory management in event listeners

File electron/preload.js:

Line 62 to 68:

Resource leak identified where `ipcRenderer.on` event listeners are never removed. Store the listener reference and expose a removal function to allow proper cleanup on unmount.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Deadlock state in initialization logic permanently blocks retries if initPromise never settles. Reset isInitializing.current = false in the catch block after the 30-second timeout rejection to unblock the initializeApp guard at line 101.

  initPromise
    .catch((error) => {
      if (initTimedOut.current) {
        logger.error({
          message: 'App initialization failed after initialization timeout',
          context: { error, platform: Platform.OS },
        });
      }
    })
    .finally(() => {
      isInitializing.current = false;
    });

  await Promise.race([initPromise, initTimeout]);
} catch (error) {
  logger.error({
    message: 'Failed to initialize app',
    context: { error, platform: Platform.OS },
  });
  // Reset initialization state on error so it can be retried
  hasInitialized.current = false;
  // If the init promise is still hanging, clear the guard so a retry is possible
  isInitializing.current = false;
}

File src/app/(app)/_layout.tsx:

Line 198:

Deadlock state in initialization logic permanently blocks retries if `initPromise` never settles. Reset `isInitializing.current = false` in the catch block after the 30-second timeout rejection to unblock the `initializeApp` guard at line 101.

Suggested Code:

      initPromise
        .catch((error) => {
          if (initTimedOut.current) {
            logger.error({
              message: 'App initialization failed after initialization timeout',
              context: { error, platform: Platform.OS },
            });
          }
        })
        .finally(() => {
          isInitializing.current = false;
        });

      await Promise.race([initPromise, initTimeout]);
    } catch (error) {
      logger.error({
        message: 'Failed to initialize app',
        context: { error, platform: Platform.OS },
      });
      // Reset initialization state on error so it can be retried
      hasInitialized.current = false;
      // If the init promise is still hanging, clear the guard so a retry is possible
      isInitializing.current = false;
    }

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Performance degradation caused by inline arrow functions within JSX props. Move function definitions outside the render method to prevent unnecessary memory allocations and re-renders.

Kody rule violation: Avoid using .bind() or arrow functions in JSX props

File src/app/(app)/home.tsx:

Line 950:

Performance degradation caused by inline arrow functions within JSX props. Move function definitions outside the render method to prevent unnecessary memory allocations and re-renders.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Unnecessary state re-render detected in DispatchConsoleWeb due to an unused currentTime setInterval. Remove the currentTime useState and the setInterval useEffect (lines 140 and 152-159) to eliminate redundant renders.

// Removed: currentTime is no longer passed to StatsHeader (it manages its own clock)
// const [currentTime, setCurrentTime] = useState(...);
// useEffect(() => { ... setInterval ... }, []);

File src/app/(app)/home.web.tsx:

Line 140:

Unnecessary state re-render detected in `DispatchConsoleWeb` due to an unused `currentTime` `setInterval`. Remove the `currentTime` useState and the `setInterval` useEffect (lines 140 and 152-159) to eliminate redundant renders.

Suggested Code:

// Removed: currentTime is no longer passed to StatsHeader (it manages its own clock)
// const [currentTime, setCurrentTime] = useState(...);
// useEffect(() => { ... setInterval ... }, []);

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

PII exposure risk identified by logging raw geolocation latitude. Hash or bucket the value (e.g., Math.round(location.latitude * 10) / 10) to comply with GDPR/LGPD data minimization requirements.

Kody rule violation: Mask PII and secrets in logs

File src/app/(app)/map.tsx:

Line 173:

PII exposure risk identified by logging raw geolocation latitude. Hash or bucket the value (e.g., `Math.round(location.latitude * 10) / 10`) to comply with GDPR/LGPD data minimization requirements.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

GDPR compliance violation detected from emitting verbatim latitude in diagnostic logs. Replace raw values with bucketed/hashed coordinates and append gdpr: { purpose: 'map_tracking', lawful_basis: 'consent' } to the context payload.

Kody rule violation: Redact PII in logs and metrics by default

File src/app/(app)/map.tsx:

Line 173:

GDPR compliance violation detected from emitting verbatim latitude in diagnostic logs. Replace raw values with bucketed/hashed coordinates and append `gdpr: { purpose: 'map_tracking', lawful_basis: 'consent' }` to the context payload.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Unsafe third-party script injection detected for hls.js. Utilize the Next.js <Script> component with an appropriate loading strategy and onLoad callbacks instead of raw inline <script> tags.

Kody rule violation: Use next/script safely and avoid inline scripts

File src/components/callVideoFeeds/video-player.tsx:

Line 51:

Unsafe third-party script injection detected for `hls.js`. Utilize the Next.js `<Script>` component with an appropriate loading strategy and `onLoad` callbacks instead of raw inline `<script>` tags.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Unhandled exception risk found in the web-platform download path during URL.createObjectURL execution. Wrap the DOM API operations in a try/catch block and utilize finally to clear the downloadingFiles state during failures.

Kody rule violation: Add try-catch blocks for external calls

File src/components/calls/call-files-modal.tsx:

Line 111:

Unhandled exception risk found in the web-platform download path during `URL.createObjectURL` execution. Wrap the DOM API operations in a try/catch block and utilize `finally` to clear the `downloadingFiles` state during failures.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Silent exception swallowing detected in the getCallExtraData catch handler. Implement structured logging with context (e.g., logger.error('getCallExtraData failed', { callId, err })) before returning default values.

Kody rule violation: Avoid empty catch blocks

File src/components/dispatch-console/active-calls-panel.tsx:

Line 418:

Silent exception swallowing detected in the `getCallExtraData` catch handler. Implement structured logging with context (e.g., `logger.error('getCallExtraData failed', { callId, err })`) before returning default values.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Batch execution failure risk identified using Promise.all for independent API calls. Replace with Promise.allSettled to isolate individual rejections and inspect each settlement's status explicitly.

Kody rule violation: Use Promise.allSettled for batch operations with partial failures

File src/components/dispatch-console/active-calls-panel.tsx:

Line 414:

Batch execution failure risk identified using `Promise.all` for independent API calls. Replace with `Promise.allSettled` to isolate individual rejections and inspect each settlement's status explicitly.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

CSS scope violation caused by a raw <style> tag injecting global @keyframes on every component render. Move the keyframes into a CSS Module (e.g., animated-refresh-icon.module.css) to prevent style collisions.

Kody rule violation: Use component-scoped styling

File src/components/dispatch-console/animated-refresh-icon.web.tsx:

Line 21:

CSS scope violation caused by a raw `<style>` tag injecting global `@keyframes` on every component render. Move the keyframes into a CSS Module (e.g., `animated-refresh-icon.module.css`) to prevent style collisions.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Magic string vulnerability detected using the literal 'notes' as a card-identifier key. Extract shared keys into a centralized constant (e.g., NOTES_CARD_KEY) or an enum to prevent typos and streamline refactoring.

Kody rule violation: Centralize string constants

File src/components/dispatch-console/notes-panel.tsx:

Line 85:

Magic string vulnerability detected using the literal `'notes'` as a card-identifier key. Extract shared keys into a centralized constant (e.g., `NOTES_CARD_KEY`) or an enum to prevent typos and streamline refactoring.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Inverted UI logic causes collapsed panels to display ChevronUp instead of ChevronDown, misleading user perception of state. Swap the conditional back to isCollapsed ? ChevronDown : ChevronUp to accurately reflect expansion state.

{onToggleCollapse ? <Icon as={isCollapsed ? ChevronDown : ChevronUp} size="sm" className="text-gray-500 dark:text-gray-400" /> : null}

File src/components/dispatch-console/panel-header.tsx:

Line 42:

Inverted UI logic causes collapsed panels to display ChevronUp instead of ChevronDown, misleading user perception of state. Swap the conditional back to `isCollapsed ? ChevronDown : ChevronUp` to accurately reflect expansion state.

Suggested Code:

{onToggleCollapse ? <Icon as={isCollapsed ? ChevronDown : ChevronUp} size="sm" className="text-gray-500 dark:text-gray-400" /> : null}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Cross-Site Scripting (XSS) vulnerability identified by interpolating pin.Title directly into mapboxgl.Popup.setHTML(). Sanitize the value using escapeHtml() or DOMPurify before rendering untrusted remote data.

Kody rule violation: Always sanitize user inputs

File src/components/maps/unified-map-view.web.tsx:

Line 229:

Cross-Site Scripting (XSS) vulnerability identified by interpolating `pin.Title` directly into `mapboxgl.Popup.setHTML()`. Sanitize the value using `escapeHtml()` or `DOMPurify` before rendering untrusted remote data.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Magic numbers detected for default map center coordinates (-98.5795, 39.8283). Extract these values into a named constant (e.g., DEFAULT_CENTER) at module scope or a configuration file to improve maintainability.

Kody rule violation: Replace magic numbers with named constants

File src/components/maps/unified-map-view.web.tsx:

Line 93:

Magic numbers detected for default map center coordinates (`-98.5795, 39.8283`). Extract these values into a named constant (e.g., `DEFAULT_CENTER`) at module scope or a configuration file to improve maintainability.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Redundant calculation detected where Appearance.getColorScheme() is invoked independently in multiple style rules. Compute const isDark once at the module level and reference it in each ternary operation to optimize execution.

Kody rule violation: Use computed/derived properties for repeated calculations

File src/components/notifications/NotificationDetail.tsx:

Line 210:

Redundant calculation detected where `Appearance.getColorScheme()` is invoked independently in multiple style rules. Compute `const isDark` once at the module level and reference it in each ternary operation to optimize execution.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Naming convention violation detected in the styled arrow-function parameter Component. Rename the parameter to camelCase (e.g., component) to comply with standard naming conventions for local variables.

Kody rule violation: Use proper naming conventions

File src/components/settings/__tests__/login-info-bottom-sheet-simple.test.tsx:

Line 20:

Naming convention violation detected in the `styled` arrow-function parameter `Component`. Rename the parameter to camelCase (e.g., `component`) to comply with standard naming conventions for local variables.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Type safety violation found in createMotionAnimatedComponent casting. Utilize the as operator or pattern matching for safe casts and explicitly guard null results prior to usage.

Kody rule violation: Use safe type casting with as operator

File src/components/ui/actionsheet/index.tsx:

Line 23:

Type safety violation found in `createMotionAnimatedComponent` casting. Utilize the `as` operator or pattern matching for safe casts and explicitly guard null results prior to usage.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Code duplication identified in the parallel ternary chains of exitingAnimation and enteringAnimation. Extract a single lookup map (e.g., animMap) to synchronize anchor branching logic and simplify future maintenance.

Kody rule violation: Extract duplicated logic into functions

File src/components/ui/drawer/index.tsx:

Line 171:

Code duplication identified in the parallel ternary chains of `exitingAnimation` and `enteringAnimation`. Extract a single lookup map (e.g., `animMap`) to synchronize anchor branching logic and simplify future maintenance.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Magic strings detected hardcoding 'dark' and 'light' inline for SystemBars styling. Define a centralized enum (e.g., ThemeStyle) to replace these fragile string literals and prevent mistyping.

Kody rule violation: Use enums instead of magic strings

File src/components/ui/focus-aware-status-bar.tsx:

Line 67:

Magic strings detected hardcoding `'dark'` and `'light'` inline for `SystemBars` styling. Define a centralized enum (e.g., `ThemeStyle`) to replace these fragile string literals and prevent mistyping.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Unguarded asynchronous operation in clearPasswordVerificationHash allows unhandled promise rejection if removeItem fails. Wrap the awaited removeItem call in a try/catch block and log the error context via logger.error(...) to match sibling function patterns.

Kody rule violation: Handle async operations with proper error handling

File src/lib/auth/api.tsx:

Line 75:

Unguarded asynchronous operation in `clearPasswordVerificationHash` allows unhandled promise rejection if `removeItem` fails. Wrap the awaited `removeItem` call in a try/catch block and log the error context via `logger.error(...)` to match sibling function patterns.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Memory leak risk caused by uncaptured setTimeout return values in the toast store. Capture the timer ID and invoke clearTimeout(timerId) during manual removal to prevent state-update-on-unmounted warnings.

Kody rule violation: Clear timers on teardown/unmount

File src/stores/toast/store.ts:

Line 39:

Memory leak risk caused by uncaptured `setTimeout` return values in the toast store. Capture the timer ID and invoke `clearTimeout(timerId)` during manual removal to prevent state-update-on-unmounted warnings.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Unstructured logging in the catch block bypasses centralized logging and violates Rule [3] by omitting required structured fields. Replace console.error with a structured logger call, such as logger.error('deep-link callback failed', { op: 'onDeepLink', err }), to include operation names and relevant identifiers.

Kody rule violation: Include error context in structured logs

File electron/preload.js:

Line 67:

Unstructured logging in the catch block bypasses centralized logging and violates Rule [3] by omitting required structured fields. Replace `console.error` with a structured logger call, such as `logger.error('deep-link callback failed', { op: 'onDeepLink', err })`, to include operation names and relevant identifiers.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Race condition triggered when the timeout catch block sets isInitializing.current = false and allows a retry while the previous init promise is still pending. The old promise's .finally block (lines 209-211) clears the guard early, causing duplicate SignalR hub connections (connectUpdateHub) and store inits; making the .finally conditional on an epoch counter resolves this.

// capture an instance id so only the CURRENT init's settle clears the guard
const initInstanceId = ++initInstanceRef.current;

initPromise
  .catch((error) => { /* ... */ })
  .finally(() => {
    if (initInstanceRef.current === initInstanceId) {
      isInitializing.current = false;
    }
  });

await Promise.race([initPromise, initTimeout]);
} catch (error) {
  // ...
  hasInitialized.current = false;
  // Only clear the retry guard if we are still the active instance
  if (initInstanceRef.current === initInstanceId) {
    isInitializing.current = false;
  }
}

File src/app/(app)/_layout.tsx:

Line 221 to 222:

Race condition triggered when the timeout catch block sets `isInitializing.current = false` and allows a retry while the previous init promise is still pending. The old promise's `.finally` block (lines 209-211) clears the guard early, causing duplicate SignalR hub connections (`connectUpdateHub`) and store inits; making the `.finally` conditional on an epoch counter resolves this.

Suggested Code:

// capture an instance id so only the CURRENT init's settle clears the guard
const initInstanceId = ++initInstanceRef.current;

initPromise
  .catch((error) => { /* ... */ })
  .finally(() => {
    if (initInstanceRef.current === initInstanceId) {
      isInitializing.current = false;
    }
  });

await Promise.race([initPromise, initTimeout]);
} catch (error) {
  // ...
  hasInitialized.current = false;
  // Only clear the retry guard if we are still the active instance
  if (initInstanceRef.current === initInstanceId) {
    isInitializing.current = false;
  }
}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Code duplication identified: the rounding and bucketing logic is repeated across multiple call sites (src/app/(app)/map.tsx:221-222, 176-177). Duplicated logic drifts and complicates GDPR compliance auditing; extract a utility function like bucketCoordinate(v: number, scale = COORDINATE_BUCKET_SCALE) to centralize it.

Kody rule violation: Extract duplicated logic into functions

File src/app/(app)/map.tsx:

Line 157 to 158:

Code duplication identified: the rounding and bucketing logic is repeated across multiple call sites (`src/app/(app)/map.tsx:221-222`, `176-177`). Duplicated logic drifts and complicates GDPR compliance auditing; extract a utility function like `bucketCoordinate(v: number, scale = COORDINATE_BUCKET_SCALE)` to centralize it.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Inline script violation: using a raw <script> tag for the third-party library hls.js ignores next/script loading strategies. Replace it with next/script using an appropriate strategy and onLoad callbacks.

Kody rule violation: Use next/script safely and avoid inline scripts

File src/components/callVideoFeeds/video-player.tsx:

Line 74:

Inline script violation: using a raw `<script>` tag for the third-party library `hls.js` ignores `next/script` loading strategies. Replace it with `next/script` using an appropriate strategy and `onLoad` callbacks.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Improper variable declaration: var hls is function-scoped and prone to accidental redeclaration, whereas const provides block-scoping and prevents reassignment. Replace var with const across all instances (src/components/callVideoFeeds/video-player.tsx:56, 64), as the Hls instance is never reassigned.

Kody rule violation: Always use const and let

File src/components/callVideoFeeds/video-player.tsx:

Line 66:

Improper variable declaration: `var hls` is function-scoped and prone to accidental redeclaration, whereas `const` provides block-scoping and prevents reassignment. Replace `var` with `const` across all instances (`src/components/callVideoFeeds/video-player.tsx:56`, `64`), as the `Hls` instance is never reassigned.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

Magic number identified: the literal 3000 represents the default toast auto-dismiss duration but reduces readability and makes future tuning error-prone. Extract a named constant such as DEFAULT_TOAST_DURATION_MS = 3000 and apply it in the ?? fallback across all occurrences in src/app/(app)/map.tsx:157-158, 176-177, and 221-222.

Kody rule violation: Replace magic numbers with named constants

File src/stores/toast/store.ts:

Line 44:

Magic number identified: the literal `3000` represents the default toast auto-dismiss duration but reduces readability and makes future tuning error-prone. Extract a named constant such as `DEFAULT_TOAST_DURATION_MS = 3000` and apply it in the `??` fallback across all occurrences in `src/app/(app)/map.tsx:157-158`, `176-177`, and `221-222`.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​