Extension mandarin, pinyin, english 3 in 1 synchronised #3694
Extension mandarin, pinyin, english 3 in 1 synchronised #3694persopourytb-wq wants to merge 1 commit intospicetify:mainfrom
Conversation
📝 WalkthroughWalkthroughThe pull request adds a new extension entry "Mandarin Lyrics" to manifest.json, including metadata fields such as name, description, preview URL, and main script URL alongside existing extensions. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@manifest.json`:
- Line 47: The manifest's "preview" value currently points to a personal test
repo image which is unstable; update the "preview" field in manifest.json (the
"preview" key) to either null or a stable, trusted image URL (e.g., an approved
Imgur/CID-hosted asset) so the extension uses a consistent external preview
source.
- Around line 44-49: The manifest entry for the extension named "Mandarin
Lyrics" currently points its "main" field to an external URL, which bypasses
review — download or copy the extension bundle from
https://raw.githubusercontent.com/persopourytb-wq/test/main/dist/index.js into
the repository under the Extensions/ directory (e.g.,
Extensions/mandarin-lyrics.js), update the "main" value in the manifest from the
external URL to the new relative path ("Extensions/mandarin-lyrics.js"), remove
any remaining externally hosted references (and optionally vendor the preview
image under Extensions or assets and update "preview"), and include the vendored
files in this PR so the code is reviewable and auditable.
🧹 Nitpick comments (1)
manifest.json (1)
46-46: Description is missing a trailing period for consistency.Minor nit: most other extension descriptions end with a period/full sentence. This one does not. Not blocking, but worth aligning.
| { | ||
| "name": "Mandarin Lyrics", | ||
| "description": "Display Mandarin Chinese lyrics with synchronized pinyin romanization and English translation", | ||
| "preview": "https://raw.githubusercontent.com/persopourytb-wq/test/main/preview.png", | ||
| "main": "https://raw.githubusercontent.com/persopourytb-wq/test/main/dist/index.js" | ||
| } |
There was a problem hiding this comment.
🚨 Critical security risk: externally hosted extension code bypasses all review controls.
Every other extension in this manifest uses a local relative path (e.g., "Extensions/trashbin.js"), meaning the code is vendored in-repo and subject to PR review. This entry points main to https://raw.githubusercontent.com/persopourytb-wq/test/main/dist/index.js — a personal GitHub repo named "test".
This means:
- No code review is possible — the actual extension source is not part of this PR or this repository.
- Arbitrary code injection — the repo owner can push any changes to their
mainbranch at any time, and those changes would be served to all users automatically, with zero oversight. - No stability guarantee — the repo can be deleted, renamed, or made private at any time, breaking the extension for all users.
The extension JS should be vendored locally under Extensions/ like all other entries, so it goes through the normal review process.
- "main": "https://raw.githubusercontent.com/persopourytb-wq/test/main/dist/index.js"
+ "main": "Extensions/mandarinLyrics.js"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| { | |
| "name": "Mandarin Lyrics", | |
| "description": "Display Mandarin Chinese lyrics with synchronized pinyin romanization and English translation", | |
| "preview": "https://raw.githubusercontent.com/persopourytb-wq/test/main/preview.png", | |
| "main": "https://raw.githubusercontent.com/persopourytb-wq/test/main/dist/index.js" | |
| } | |
| { | |
| "name": "Mandarin Lyrics", | |
| "description": "Display Mandarin Chinese lyrics with synchronized pinyin romanization and English translation", | |
| "preview": "https://raw.githubusercontent.com/persopourytb-wq/test/main/preview.png", | |
| "main": "Extensions/mandarinLyrics.js" | |
| } |
🤖 Prompt for AI Agents
In `@manifest.json` around lines 44 - 49, The manifest entry for the extension
named "Mandarin Lyrics" currently points its "main" field to an external URL,
which bypasses review — download or copy the extension bundle from
https://raw.githubusercontent.com/persopourytb-wq/test/main/dist/index.js into
the repository under the Extensions/ directory (e.g.,
Extensions/mandarin-lyrics.js), update the "main" value in the manifest from the
external URL to the new relative path ("Extensions/mandarin-lyrics.js"), remove
any remaining externally hosted references (and optionally vendor the preview
image under Extensions or assets and update "preview"), and include the vendored
files in this PR so the code is reviewable and auditable.
| { | ||
| "name": "Mandarin Lyrics", | ||
| "description": "Display Mandarin Chinese lyrics with synchronized pinyin romanization and English translation", | ||
| "preview": "https://raw.githubusercontent.com/persopourytb-wq/test/main/preview.png", |
There was a problem hiding this comment.
External preview image should be hosted consistently with other extensions.
The preview URL points to the same personal "test" repo. Other extensions either use null or stable Imgur links. If this extension is accepted, the preview image should be hosted on a stable, trusted location rather than a repo the author could delete or modify at any time.
🤖 Prompt for AI Agents
In `@manifest.json` at line 47, The manifest's "preview" value currently points to
a personal test repo image which is unstable; update the "preview" field in
manifest.json (the "preview" key) to either null or a stable, trusted image URL
(e.g., an approved Imgur/CID-hosted asset) so the extension uses a consistent
external preview source.
|
Use your own repo to get it on marketplace. There is a wiki with how to publish it there |
2 participants
discord v2vymlkn for any inquiries
Summary by CodeRabbit