fix(codeql): break remaining release alert flows

[senamakel]

Summary

• Routes chat attachment raster data URIs through blob object URLs before rendering image previews.
• Keeps non-raster or malformed attachment data out of the image rendering path.
• Replaces mock LLM stream delays with a fixed allowlist of literal timer durations.

Problem

• Release PR Release: merge main into release #4490 is still blocked by two CodeQL annotations after feat(memory): W3 chunk store-op flip — delegate get_chunks_batch + list_chunks (source_scope-preserving) #4555 merged.
• The remaining alerts are the chat attachment image sink in Conversations.tsx and the mock LLM stream timer in scripts/mock-api/routes/llm.mjs.

Solution

• Validate image data URIs, decode them into Blob objects, and render generated object URLs instead of assigning the raw data URI to <img src>.
• Normalize mock stream delays to a small set of fixed literal values and call setTimeout only with those literals.

Submission Checklist

• N/A: Tests not added; this is CodeQL hardening for existing release-gate annotations.
• N/A: Local coverage was intentionally deferred to GitHub runners per maintainer instruction.
• N/A: Coverage matrix unchanged; no feature behavior added/removed.
• N/A: No coverage matrix feature IDs apply.
• No new external network dependencies introduced (mock backend used per Testing Strategy)
• N/A: Manual smoke checklist unchanged; no release-cut user workflow changed.
• N/A: No linked issue.

Impact

• Security: addresses the two remaining CodeQL release-blocking alert flows.
• Runtime: normal raster attachment previews still render; malformed or non-raster data URI payloads do not.
• Mock infrastructure: stream delay knobs remain available but are rounded to bounded literal durations.

Related

• Closes:
• Follow-up PR(s)/TODOs:

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: fix/codeql-release-alerts-followup
• Commit SHA: 045d32118

Validation Run

• pnpm --dir app exec prettier --write src/pages/Conversations.tsx ../scripts/mock-api/routes/llm.mjs
• git diff --check -- app/src/pages/Conversations.tsx scripts/mock-api/routes/llm.mjs
• N/A: pnpm --filter openhuman-app format:check deferred to GitHub runners per maintainer instruction.
• N/A: pnpm typecheck deferred to GitHub runners per maintainer instruction.
• N/A: Focused tests deferred to GitHub runners per maintainer instruction.
• N/A: Rust fmt/check not applicable; no Rust files changed.
• N/A: Tauri fmt/check not applicable; no Tauri files changed.

Validation Blocked

• command: local CI/test commands
• error: maintainer requested tests run on GitHub runners, not locally; local pre-push hook also runs unavailable Rust check path in this checkout
• impact: pushed with --no-verify; PR validation will come from GitHub Actions

Behavior Changes

• Intended behavior change: unsafe attachment image payloads are no longer assigned directly to image src; mock stream delays are bounded and rounded.
• User-visible effect: none expected for normal raster image attachments.

Parity Contract

• Legacy behavior preserved: raster image attachments still render and mock streaming still delays chunks, within bounded values.
• Guard/fallback/dispatch parity checks: CodeQL runner will verify alert suppression; full CI remains on GitHub.

Duplicate / Superseded PR Handling

• Duplicate PR(s): N/A
• Canonical PR: this PR
• Resolution (closed/superseded/updated): N/A

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 28 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1782dc4e-e1c9-472e-887e-eb917d1d1f41

📥 Commits

Reviewing files that changed from the base of the PR and between 8dda0fc and 045d321.

📒 Files selected for processing (2)

• app/src/pages/Conversations.tsx
• scripts/mock-api/routes/llm.mjs

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 045d321180

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve a renderable fallback for valid attachments

In the Vitest/jsdom environment configured by app/test/vitest.config.ts, URL.createObjectURL is not globally polyfilled, so imageDataUriToObjectUrl() catches that TypeError and this branch renders only the 1x1 spacer for otherwise valid attachmentDataUris. The existing thumbnail coverage in app/src/pages/__tests__/Conversations.attachments.test.tsx still expects user image attachments to render, so the full frontend suite will fail unless the blob URL path is supported in test setup or this component keeps a renderable fallback for validated images.

Useful? React with 👍 / 👎.