Help us improve Neuralai before public release
28
Total
0
New
1
In review
27
Resolved
Durante i test del generatore di siti Canvas, ho notato che i siti generati erano limitati a contenuto statico senza possibilità di collegarsi a un database reale. Inoltre, non era possibile inserire chiavi API pubbliche (PayPal Client ID, Stripe Publishable Key, Google Maps API Key) per abilitare pagamenti o mappe nei siti generati. Suggerisco di aggiungere: (1) integrazione con database Supabase dell'utente per siti data-aware che leggono prodotti e salvano ordini a runtime, (2) un pannello per token personalizzabili che vengono sostituiti dinamicamente nel codice HTML a runtime, (3) controllo dei ruoli utente (admin, editor, user) per aree riservate dei siti generati.
Team response:
Implementato in base al feedback: (1) Integrazione Supabase con binding data source (data_source_type, data_source_url, data_source_key) per siti data-aware con RLS abilitata — i siti leggono prodotti e salvano ordini a runtime dal database Supabase dell'utente. (2) Pannello Custom Tokens con mappa nome→valore sostituita a runtime tramite allow-list (solo chiavi pubbliche/client-side, mai segreti server). Supporta PAYPAL_CLIENT_ID, STRIPE_PUBLISHABLE_KEY, GOOGLE_MAPS_KEY e qualsiasi token personalizzato. (3) Sistema ruoli basato su tabella user_roles con attributi data-role sugli elementi HTML per visibilità condizionale (admin, editor, manager, user) e RLS lato database come sicurezza reale. Funzione manageSupabaseUserRole per gestione ruoli via Management API.
Durante l'utilizzo dell'app, il connettore GitHub mostra stato 'disconnesso' anche dopo aver completato con successo il flusso OAuth. Stessa cosa accade con Google Drive: l'importazione ed esportazione di file fallisce intermittentemente. Il problema si manifesta soprattutto dopo un periodo di inattività o dopo il refresh del token. Sembra correlato alla versione del runtime Deno utilizzato dalle funzioni backend.
Team response:
Risolto in base al feedback: (1) Aggiornato il runtime Deno SDK da 0.8.25/0.8.44 a 0.8.46 su tutte le funzioni backend, risolvendo incompatibilità nella gestione dei token OAuth. (2) Corretta la logica di refresh dei token connector con getCurrentAppUserConnection che ora gestisce correttamente i token scaduti. (3) Stabilizzata la gestione del callback OAuth con polling di conferma registrazione connessione. (4) Risolti i conflitti di importazione in GoogleDriveDriver e GitHub connector. Verificato il flusso end-to-end: OAuth → connessione persistente → import/export file funzionante.
L'app genera contenuti di altissima qualità (immagini AI, video, risposte di ricerca profonda, siti web completi) ma non offre un modo per condividerli pubblicamente con un link. Suggerisco di aggiungere: (1) link di condivisione pubblica per immagini e video generati, con anteprima formattata, (2) condivisione delle risposte di Neuralai Seek (ricerca AI) con rendering Markdown corretto invece di testo grezzo, (3) pulsanti di condivisione sociale sui contenuti generati, (4) condivisione dei siti Canvas pubblicati con URL slug personalizzato.
Team response:
Implementato in base al feedback: (1) createMediaShareLink e createSeekShareLink — funzioni backend che generano URL pubblici permanenti per immagini, video e risposte AI con rendering HTML formattato (non più Markdown grezzo). (2) Pubblicazione siti Canvas con slug univoco (PublishedSite) — URL pubblico con sostituzione dei custom token a runtime. (3) MediaShareButton e SeekMediaActions — componenti UI con pulsanti di condivisione sociale e copia link. (4) getPublishedSite gestisce il rendering del sito pubblicato con sostituzione dei placeholder {{TOKEN}} tramite allow-list e sanitizzazione anti-XSS.
Utilizzo i server virtuali Neuralai OS per il mio lavoro ma non posso controllarne l'accensione e lo spegnimento da sistemi esterni (Home Assistant, n8n, IFTTT, cron). Suggerisco di aggiungere: (1) un endpoint webhook sicuro per accendere/spegnere i server remotamente, (2) la possibilità di programmare fasce orarie automatiche di accensione/spegnimento con fuso orario, (3) integrazione con Cloud Run per attivare/disattivare l'esecuzione del codice reale. Questo permetterebbe di ottimizzare i costi e integrare i server nei flussi di automazione domestica e aziendale.
Team response:
Implementato in base al feedback: (1) toggleServerPowerViaWebhook — endpoint webhook con autenticazione HMAC-SHA256 (firma del body con token segreto per-server in header X-Webhook-Signature, mai in URL per evitare esposizione nei log). Supporta azioni on/off/toggle con verifica timing-safe. (2) ServerPowerScheduleModal — modale con programmazione oraria (ora accensione/spegnimento, giorni attivi, fuso orario IANA) supportata da 13 lingue. (3) Automazione cron applyServerPowerSchedule che allinea stato server e Cloud Run ogni 5 minuti secondo la programmazione. (4) Generazione automatica del token webhook e cURL examples pre-firmati compatibili CMD/PowerShell/bash. (5) Best practices di sicurezza integrate nella UI (rotazione token, storage in env vars, isolamento per-server).
I blocchi di codice nei risultati di Deep Research e Neuralai Seek fuoriuscivano dal container, causando scroll orizzontale e rottura del layout. Il problema era particolarmente evidente su mobile (desktop viewport 1506px) e con righe di codice lunghe: il <pre> non rispettava la larghezza del genitore e il testo con whitespace non veniva spezzato, espandendo l'intera card oltre il viewport. Lo stesso bug affliggeva Chat ma era già stato corretto con min-w-0 + w-full sul wrapper.
Team response:
Fix applicato: aggiunto min-w-0 + w-full + max-w-full sui wrapper dei code block in DeepResearch.jsx (mdComponents code/pre) e NeuralaiSeekLanding.jsx. Aggiunto anche whitespace-pre sul <code> interno per forzare lo scrollbar verticale invece dell'espansione orizzontale. Lo stesso pattern era già stato applicato con successo in Chat/MessageBubble.jsx. Verificato che il code block ora usa overflow-x-auto interno senza espandere il container genitore.
Google Play announced two new app quality requirements: (1) Memory usage reduction and code optimization — performance thresholds for dynamic memory usage, bitmap usage, and code optimization to prevent unexpected terminations on Android devices, with app-specific and game-specific criteria. (2) Safe and seamless device migration experience — a new onboarding standard for app developers to provide users with a secure way to upgrade devices. These requirements align with Google Play's 2027 compliance framework and the 16 KB page size support introduced with Android 15+. The Neuralai development team is currently evaluating the optimal strategy to ensure full compliance with the R8/AGP 9.0 build configuration and the new performance thresholds.
Team response:
---FINAL EVALUATION---Ticket: Urgent: Android build R8/ProGuard optimization settings for Google Play 2027 mandates Hello Base... Hey, Thank you for flagging these and for sharing the screenshot — really helpful. The items you're seeing in the App Bundle Explorer (app optimization, obfuscation percentage, R8 configuration) are informational recommendations from Google, not blockers. They won't prevent you from publishing or updating your app on Google Play. That said, we're reviewing these optimization metrics on our end to ensure our builds stay aligned with Google's evolving guidelines. You can continue publishing and updating your app in the meantime:) Best regards, Tamir B | Base44 Technical Support. ---INITIAL EVALUATION--- The Neuralai development team is actively evaluating the following compliance strategies: (1) Platform Roadmap Monitoring — Monitoring Base44 platform release notes for centralized AGP and Target SDK updates. The platform typically updates the build toolchain (Gradle, AGP, R8) at the infrastructure level weeks before Google Play deadlines, ensuring automatic compliance for all generated builds. (2) External Build Pipeline — If the platform does not update AGP in time, we will export the Android project source and Gradle files, connect to an external CI/CD pipeline (GitHub Actions / Fastlane), manually update targetSdkVersion and AGP version in build.gradle, configure R8 optimization rules, and generate the compliant .aab bundle for manual upload to Play Console. (3) Extension Request — If the deadline approaches before the build infrastructure is updated, we will submit an extension request directly from the Play Console Policy Status dashboard. Google typically grants extensions (e.g., until November 1) for developers using third-party frameworks. (4) Native Dependency Audit — For the 16 KB page size requirement, we are auditing all native C/C++ dependencies (.so libraries from third-party SDKs). Since the app is primarily Java/Kotlin, compatibility may depend solely on the Target SDK update. The team will select and implement the optimal combination of these strategies before the enforcement deadline. Status: Evaluation in progress — next steps include confirming the platform update timeline and preparing the external build pipeline as a fallback.
Google Cloud announced updates to IAM predefined roles effective September 30, 2026, enforcing strict separation of duties. Key changes: (1) Viewer roles (Spanner Viewer, Bigtable Viewer, Dataplex Viewer) remain restricted to metadata-only access — no business data, execution capabilities, or source code access. (2) Admin roles (Storage Admin, KMS Admin) remain isolated from long-lived credentials (HMAC) and cryptographic key usage permissions. (3) Standardized baselines for Administrative, Editor, and metadata-viewing roles across 85 predefined roles. The Neuralai production project (neuralai-493816) is impacted. This change aligns with our security posture by ensuring administrative functions stay separated from sensitive cryptographic key usage, upholding the principle of least privilege across all service accounts.
Team response:
Solution adopted and verified: We reviewed all IAM policies across the neuralai-493816 project and confirmed full compliance with the updated separation-of-duties model. (1) Verified that all Viewer roles in use are metadata-only — no service account grants business data or execution access via Viewer roles. (2) Confirmed KMS Admin and Storage Admin roles are not combined with HMAC or cryptographic key usage permissions — key usage is delegated to dedicated service accounts with minimal-scope custom roles. (3) No custom role modifications were needed as our existing IAM configuration already follows the separation-of-duties principle. Post-update KYC pipeline tests confirmed full functionality: the complete KYC verification flow (document upload via UploadPrivateFile, AI biometric verification via Gemini Vision, MRZ validation, selfie liveness two-pose check, document authenticity anti-fraud check, and public registry cross-check) completed successfully without any IAM permission errors. All Google Cloud Document AI and Gemini Vision calls used for identity verification are functioning normally. No action required from end users — the update is transparent and does not affect any user-facing functionality.
On Android, when a user denied the microphone permission and then tried to start a voice call with the AI agent, the app crashed immediately with an unhandled exception. This is a serious issue because Google Play reviewers consistently reject or downgrade apps that crash after a permission denial — it signals poor permission handling and a broken user experience. The crash happened every time: deny mic → tap 'Call' → app force-closes with the 'NeuralAI keeps stopping' dialog. After the fix, denying the microphone shows a clear, non-blocking explanation dialog telling the user why the mic is needed, with a one-tap button to open system settings and grant it. No crash, no frustration. This is exactly the kind of graceful permission handling Google Play looks for during review.
Team response:
Fixed in v1.1.0. Every microphone access is now wrapped in a permission check with a graceful fallback: if the permission is denied, the app shows a clear dialog explaining why the microphone is needed plus a one-tap shortcut to system settings — no crash, no unhandled exception. We also added a defensive try/catch around the audio recorder initialization so even unexpected permission states never reach an unhandled code path. Verified across Android 11–15 and on devices with revoked permissions. This directly addresses the stability and permission-handling criteria Google Play reviewers evaluate.
Two critical blocking bugs affecting the mobile experience and video search: (1) In the Canvas Generator results on mobile, the delete button was disconnected from the other action buttons (shifted to the right with ml-auto), and the 'Generated canvases' title and 'Clear all' button were stuck to the screen edges without padding, making the layout messy and the delete button practically invisible/unsafe to tap. (2) Neuralai Seek Large returned 502/504 errors during internet video search due to gateway timeout, preventing completion of the more complex video searches. Both bugs have been resolved: the Canvas Generator now has correct horizontal padding and a delete button with consistent label and style; Seek Large has maxOutputTokens reduced to 16000 to avoid gateway timeouts.
Team response:
Both bugs resolved: (1) Canvas Generator mobile now has px-4 padding and a delete button with a 'Delete' label and consistent red style. (2) Neuralai Seek Large maxOutputTokens reduced to 16000 to prevent 502/504 gateway timeouts during video searches.
On the mobile version of the app (Android WebView), tapping an image in the image generator history would mistakenly trigger the overlapping action buttons (remove background, download, delete). A light tap on the image was enough to accidentally trigger deletion or background removal without intent, causing data loss and frustration. The issue made the gallery practically unusable on smartphones. The bug has been resolved: now tapping the image opens the full-screen preview directly, and the action buttons are accessible only from the slideshow, preventing any accidental tap.
Team response:
Resolved: the action buttons no longer overlap the images in the mobile history. Tapping an image opens the full-screen slideshow directly, where download, background removal, favorites and delete are available, eliminating any accidental tap.