Skip to content

feat: suggest SMS replies on c0mpute first - #137

Closed
ralyodio wants to merge 1 commit into
masterfrom
c0mpute-first
Closed

ralyodio wants to merge 1 commit into
masterfrom
c0mpute-first

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Draft: not to be merged until Anthony decides. This sends the last 20 messages of a private SMS conversation, including what a contact wrote and any one-time codes in it, to peer nodes that may be run by independent operators. The privacy page published today names OpenAI for this. The page is updated here so it would be accurate, but changing where customers' message content goes is his call.

  • suggestReply uses @profullstack/ai-providers@0.1.2: c0mpute first, the OpenAI call kept as the fallback.
  • OPENAI_API_KEY is not configured is now only thrown when c0mpute is off too. A dead OpenAI key still rejects, so the route still answers 500.
  • The contact's phone number is no longer sent to any model.
  • c0mpute gets 100 s; nginx allows 300 s.

.github/scripts/claude-review.js is untouched.

🤖 Generated with Claude Code

suggestReply goes through @profullstack/ai-providers with the OpenAI
call kept as the fallback, and no longer sends the contact's phone
number to any model. The privacy page names c0mpute.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​ai-providers@​0.1.2761009691100

View full report

@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

14 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 8

Severity Rule Location
HIGH sh-unquoted-expansion-destructive public/install.sh:67
HIGH sh-remote-script-execution public/install.sh:89
MEDIUM sh-remote-script-execution public/install.sh:133
MEDIUM js-open-redirect src/app/numbers/page.tsx:180
MEDIUM js-open-redirect src/components/inbox-client.tsx:35
MEDIUM js-unescaped-html-sink src/components/pit-footer.tsx:17
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:24
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:46
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:60
LOW secret-generic-credential src/lib/providers/__tests__/twilio.test.ts:78
LOW secret-generic-credential src/lib/vault/__tests__/vault.test.ts:117
LOW secret-generic-credential src/lib/webhooks/__tests__/supabase-store.test.ts:11
LOW secret-generic-credential supabase/config.toml:287
LOW secret-generic-credential supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.


expect(result.suggestion).toBe("On my way.");
const calls = fetchMock.mock.calls.map(([url]) => String(url));
expect(calls.every((url) => url.includes("infernetprotocol.com"))).toBe(true);

it("falls back to OpenAI, and a dead OpenAI still throws", async () => {
vi.spyOn(global, "fetch").mockImplementation((async (url: string) =>
url.includes("openai.com")
@ralyodio

ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Contributor Author

Closed, not abandoned: gh-prs-merge marks drafts ready and merges them, and this one must wait for Anthony's decision on sending SMS content to peer nodes. Branch c0mpute-first stays; reopen to ship.

@ralyodio ralyodio closed this Nov 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants