web/src/components/home/CourseList.tsx-219-232 (1)

219-232: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use data-driven week filters instead of a hardcoded week range.

Line 219 hardcodes weeks 1–4, but the displayed data is grouped dynamically by sortedWeeks. If the dataset includes Week 5+, users can’t filter to those weeks via the controls. Generate these buttons from the available week list.

Suggested patch

-          {[1, 2, 3, 4].map((wk) => (
+          {sortedWeeks.map((wk) => (
             <button
               key={wk}
               onClick={() => setSelectedWeek(wk)}
               className={cn(
                 "px-3 py-1.5 text-xs font-bold rounded-lg border cursor-pointer transition-colors",
                 selectedWeek === wk
                   ? "bg-sea-ink text-white border-sea-ink"
                   : "bg-sand/30 border-line text-sea-ink hover:bg-sand/65"
               )}
             >
               Week {wk}
             </button>
           ))}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/home/CourseList.tsx` around lines 219 - 232, The week
filter buttons are hardcoded to display weeks 1 through 4 using a static array
in the map function, but the component dynamically groups data into sortedWeeks.
Replace the hardcoded [1, 2, 3, 4] array in the map function with the
sortedWeeks variable so that the buttons are generated based on the actual weeks
present in the dataset, allowing users to filter to any week that has data.

web/convex/courses.ts-4-12 (1)

4-12: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Misleading function name and comment.

The function is named getAllCourses but queries the questions table and returns questions. The comment mentions "last 100 tasks" but ascending order returns the first 100 records.

Consider renaming to getAllQuestions or getQuestionsByWeek and updating the comment.

📝 Suggested fix

-// Return the last 100 tasks in a given task list.
-export const getAllCourses = query({
+// Return up to 100 questions ordered by week (ascending).
+export const getAllQuestions = query({
   args: {},
   handler: async (ctx, _args) => {
-    // take is not 100 - all
     const questions = await ctx.db.query("questions").withIndex("by_week").order("asc").take(100);
     return questions;
   },
 });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/convex/courses.ts` around lines 4 - 12, The function `getAllCourses` has
a misleading name and comment that do not match its actual implementation. The
function queries the "questions" table and returns questions (not courses), and
the comment incorrectly states "last 100 tasks" when the ascending order
actually returns the first 100 records. Rename the function to accurately
reflect what it does (either `getAllQuestions` or `getQuestionsByWeek`) and
update the comment to correctly describe that it returns the first 100 questions
ordered by week in ascending order.

.github/workflows/pr-preview.yaml.disabled-31-37 (1)

31-37: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Guard against empty version parse before writing output.

If git_cliff_dry fails or returns no semver match, Line 36 writes calculated_version=v, which posts misleading preview output.

Suggested guard

       - name: Parse Version
         id: version_parse
         run: |
           # git-cliff outputs text; we grab the version line
           VERSION=$(echo "${{ steps.git_cliff_dry.outputs.content }}" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n 1)
-          echo "calculated_version=v$VERSION" >> $GITHUB_OUTPUT
+          if [ -z "$VERSION" ]; then
+            echo "calculated_version=unavailable" >> "$GITHUB_OUTPUT"
+          else
+            echo "calculated_version=v$VERSION" >> "$GITHUB_OUTPUT"
+          fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-preview.yaml.disabled around lines 31 - 37, The version
parsing logic in the "Parse Version" step does not validate that a version was
actually found before writing the output. If git_cliff_dry fails or the grep
command finds no semver match, the VERSION variable will be empty and the echo
command will write an invalid calculated_version=v value. Add a guard condition
after the VERSION assignment to check if VERSION is not empty before writing to
GITHUB_OUTPUT, and either fail the step or provide clear error handling if no
valid version is extracted from the git_cliff_dry output.

server/main.py-26-33 (1)

26-33: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

CORS allow_origins=["*"] with allow_credentials=True is ineffective.

Browsers ignore credentials when the origin is a wildcard. If you need credentials (cookies), you must specify explicit origins. The current config gives a false sense of security while not actually enabling credentialed cross-origin requests.

Either remove allow_credentials=True if you don't need cookies, or specify explicit origins in production.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/main.py` around lines 26 - 33, The CORSMiddleware configuration has a
conflicting setup where allow_origins is set to a wildcard ["*"] while
allow_credentials is set to True, which browsers will reject. Either remove
allow_credentials=True from the middleware configuration if credentials are not
needed for cross-origin requests, or replace the wildcard allow_origins with
explicit origin URLs (such as your frontend domain) to properly support
credentialed requests in production environments.

web/test/studentcode.test.ts-4-18 (1)

4-18: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Test will fail with unclear error if VITE_BACKEND_URL is undefined.

If the environment variable is not set, axios will POST to undefined/execute, causing a confusing network error rather than a clear configuration failure. Consider validating the env var or providing a default.

🛠️ Proposed fix

+const BACKEND_URL = process.env.VITE_BACKEND_URL;
+if (!BACKEND_URL) {
+    throw new Error("VITE_BACKEND_URL environment variable is required for integration tests");
+}
+
 describe("Student Code", () => {
     it("should execute student code", async () => {
-        const response = await axios.post(`${process.env.VITE_BACKEND_URL}/execute`, {
+        const response = await axios.post(`${BACKEND_URL}/execute`, {
             code: "print('Hello, World!')"
         });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/test/studentcode.test.ts` around lines 4 - 18, The test "should execute
student code" directly uses process.env.VITE_BACKEND_URL without validating it
exists, which will cause a confusing network error if the environment variable
is undefined. Add validation at the start of the test (or in a beforeEach hook)
to check that VITE_BACKEND_URL is defined and throw a clear error message if it
is missing, so developers know to configure the environment variable rather than
debugging a network failure.

web/tsconfig.json-5-5 (1)

5-5: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove backup file from TypeScript include scope.

Line 5 includes a likely stale artifact (auth.tsx.old), which can pollute type-checking and route generation with obsolete code.

Suggested fix

   "include": [
     "**/*.ts",
     "**/*.tsx",
-    "src/routes/auth.tsx.old"
   ],

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/tsconfig.json` at line 5, The TypeScript configuration file includes a
stale backup file `src/routes/auth.tsx.old` in the include array, which should
be removed to prevent obsolete code from polluting type-checking and route
generation. Locate the include array in the TypeScript config and remove the
entry for `src/routes/auth.tsx.old`.

web/src/components/ide/Terminal.tsx-45-47 (1)

45-47: ⚠️ Potential issue | 🟡 Minor

Handle zero-memory values correctly in the memory display.

At line 45, the truthy check treats 0 as missing and shows "N/A". Use a nullish check so valid zero values are rendered.

Suggested fix

-                            {executionResult.memory
+                            {executionResult.memory != null
                                 ? `${(executionResult.memory / 1024).toFixed(2)} MB`
                                 : "N/A"}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/ide/Terminal.tsx` around lines 45 - 47, The memory display
in the Terminal.tsx component uses a truthy check on executionResult.memory
which incorrectly treats a value of 0 as missing data and displays "N/A". Change
the conditional check from a truthy evaluation to a nullish check (checking only
for null or undefined) so that valid zero memory values are properly rendered as
"0.00 MB" instead of "N/A". This ensures accurate memory reporting when the
actual memory usage is zero bytes.

web/src/components/student/problem/ChatBox.tsx-254-283 (1)

254-283: ⚠️ Potential issue | 🟡 Minor

Clear pending timeout when resetting chat and on unmount.

The setTimeout at line 254 is not stored or cancellable. If a user clears the chat while isTyping, the timeout will still fire after 1200ms and inject the assistant message into the reset state. Similarly, unmounting while a timeout is pending leaves an orphaned callback.

Suggested fix

 export default function ChatBox() {
+  const replyTimeoutRef = React.useRef<ReturnType<typeof setTimeout> | null>(null);
   const [messages, setMessages] = React.useState<Message[]>([
     {
       id: "welcome",
       sender: "assistant",
       content:
         "Hi there! I am your AI learning assistant. I can help you understand the 'Two Sum' problem, offer hints, or explain algorithms without giving away the direct solution. What would you like to discuss?",
       timestamp: new Date(),
     },
   ]);
   const [isTyping, setIsTyping] = React.useState(false);

   const handleSendMessage = (text: string) => {
+    if (replyTimeoutRef.current) {
+      clearTimeout(replyTimeoutRef.current);
+      replyTimeoutRef.current = null;
+    }
     // 1. Add User Message
     const userMsg: Message = {
       id: Math.random().toString(),
       sender: "user",
       content: text,
       timestamp: new Date(),
     };
     setMessages((prev) => [...prev, userMsg]);
     setIsTyping(true);

     // 2. Simulate AI response
-    setTimeout(() => {
+    replyTimeoutRef.current = setTimeout(() => {
       let reply =
         "I'm here to help! Could you explain your current approach, or would you like a hint about a brute force solution vs. using a hash map?";

       const lower = text.toLowerCase();
       if (lower.includes("hint") || lower.includes("clue")) {
         reply =
           "Here's a hint: Think about how you can check if the complement (`target - nums[i]`) exists in the array as you iterate. Can we store seen numbers to find it in O(1) time?";
       } else if (lower.includes("complexity") || lower.includes("o(n)")) {
         reply =
           "A brute force solution takes O(N²) time. However, using a Hash Map lets you search for the complement in O(1) average time, bringing the overall complexity down to O(N) time and O(N) space.";
       } else if (
         lower.includes("code") ||
         lower.includes("solution") ||
         lower.includes("answer")
       ) {
         reply =
           "I can't write the final code for you, but I can guide you! Try creating a map that stores key-value pairs of `{ number: index }`. While iterating, check if `target - current_number` is already in the map.";
       }

       const assistantMsg: Message = {
         id: Math.random().toString(),
         sender: "assistant",
         content: reply,
         timestamp: new Date(),
       };
       setMessages((prev) => [...prev, assistantMsg]);
       setIsTyping(false);
+      replyTimeoutRef.current = null;
     }, 1200);
   };

   const handleClearChat = () => {
+    if (replyTimeoutRef.current) {
+      clearTimeout(replyTimeoutRef.current);
+      replyTimeoutRef.current = null;
+    }
+    setIsTyping(false);
     setMessages([
       {
         id: "welcome-reset",
         sender: "assistant",
         content: "Chat reset. How can I help you with this problem?",
         timestamp: new Date(),
       },
     ]);
   };
+
+  React.useEffect(() => {
+    return () => {
+      if (replyTimeoutRef.current) {
+        clearTimeout(replyTimeoutRef.current);
+      }
+    };
+  }, []);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/student/problem/ChatBox.tsx` around lines 254 - 283, The
setTimeout call in the message handling logic needs to be cancellable to prevent
orphaned timeouts. Store the setTimeout ID in a useRef variable, then clear it
in two places: first, add a useEffect cleanup function that clears the timeout
on component unmount, and second, clear the timeout before resetting the chat
state in the function that handles chat clearing. This ensures the pending
timeout is always cancelled before it can fire and update state after unmounting
or after the chat has been reset.

web/src/components/student/CodeEditor.tsx-4-4 (1)

4-4: ⚠️ Potential issue | 🟡 Minor

Reset activeTab to "result" when new execution results arrive.

Currently, activeTab is never reset when executionResult changes. If a user views the stdout tab from a previous run and the next execution has no stdout output, the activeTab remains on "stdout" even though the tab button won't render (since hasStdout is false). This leaves the UI displaying an empty stdout pane with no visible way to switch back to the result view.

Add a useEffect to reset the tab on new results:

Suggested fix

-import { useState } from "react";
+import { useEffect, useState } from "react";
@@
 	const [activeTab, setActiveTab] = useState<"result" | "stdout">("result");
+	useEffect(() => {
+		setActiveTab("result");
+	}, [executionResult]);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/student/CodeEditor.tsx` at line 4, The activeTab state is
not reset when executionResult changes, causing the UI to display empty panes if
a user was viewing a tab from a previous execution that has no content in the
new results. Import useEffect from "react" alongside the existing useState
import, then add a useEffect hook with executionResult as a dependency that
resets the activeTab state back to "result" whenever new execution results
arrive.

web/src/routes/auth.tsx-49-55 (1)

49-55: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Trim invitation codes before validation.

Whitespace around the submitted code currently causes avoidable validation failures.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/routes/auth.tsx` around lines 49 - 55, In the handleModalSubmit
function, the codeToSubmit parameter is passed directly to the convex.query call
for validating the invitation code without trimming whitespace. Apply the trim()
method to codeToSubmit before passing it to the
convex.query(api.invitationCodes.validateCode) call to remove any leading or
trailing whitespace that could cause validation failures.

web/src/lib/auth.functions.ts-11-11 (1)

11-11: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Validator needs real runtime checks.

Line 11 currently passes raw input through. Add runtime validation/normalization (type, trim, format, length) before calling findUserByEmail.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/lib/auth.functions.ts` at line 11, The validator function at the
.validator() call is currently just passing the email parameter through without
performing any actual validation or normalization. Replace the simple
passthrough with proper runtime validation that includes type checking to ensure
it's a string, trimming whitespace, validating the email format matches a proper
email pattern, checking reasonable length constraints, and normalizing the value
before it's used by findUserByEmail downstream. Return the validated and
normalized email or throw an error if any validation check fails.

web/src/components/auth/forms/MagicLinkForm.tsx-28-30 (1)

28-30: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Normalize email before existence check and magic-link request.

Using raw input can misclassify users when whitespace is present.

Proposed fix

     onSubmit: async ({ value }) => {
       try {
+        const email = value.email.trim()
+
         // Check if email exists in authentication database
-        const { exists } = await checkUserExists({ data: value.email });
+        const { exists } = await checkUserExists({ data: email });
         if (!exists) {
-          onUserNotFound(value.email);
+          onUserNotFound(email);
           return;
         }
@@
         const { error } = await authClient.signIn.magicLink({
-          email: value.email,
+          email,
           callbackURL: redirectUrl || "/",
         });

Also applies to: 37-38

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/auth/forms/MagicLinkForm.tsx` around lines 28 - 30, The
email value is being used directly without normalization in the checkUserExists
function call and the subsequent magic-link request, which can cause user
misclassification when whitespace is present. Normalize the email value from
value.email by trimming whitespace and converting to lowercase before passing it
to the checkUserExists function call at line 28, and also use this normalized
email in the magic-link request at lines 37-38. Store the normalized email in a
variable and use it consistently throughout this form submission logic.

web/src/components/auth/AlreadySignedIn.tsx-39-45 (1)

39-45: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add fallbacks for optional profile fields.

name and email are nullable in the prop type, but Line 40/Line 44 render them directly.

Proposed fix

-              {session.user.name}
+              {session.user.name ?? "there"}
@@
-              {session.user.email}
+              {session.user.email ?? "an unknown email"}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/auth/AlreadySignedIn.tsx` around lines 39 - 45, The
AlreadySignedIn component renders session.user.name and session.user.email
directly without handling cases where these fields might be null or undefined,
even though they are marked as optional in the prop type. Add fallback values
for both the name field (around line 40) and the email field (around line 44) to
ensure the component handles missing profile data gracefully. Use the OR
operator or conditional rendering to display a sensible default message when
either field is missing.

web/src/integrations/tanstack-query/root-provider.tsx-10-10 (1)

10-10: ⚠️ Potential issue | 🟡 Minor

TanstackQueryProvider is unused and would render undefined if mounted.

The component is not currently imported or mounted anywhere in the codebase. However, if it's intended for use as a provider wrapper, it must accept and render children to work correctly. The empty function definition will cause any mounted descendants to be dropped.

Proposed fix

+import * as React from "react"
 import { QueryClient } from '`@tanstack/react-query`'
@@
-export default function TanstackQueryProvider() {}
+export default function TanstackQueryProvider({
+  children,
+}: {
+  children: React.ReactNode
+}) {
+  return <>{children}</>
+}

Consider either removing this unused component or implementing it properly if React Query provider integration is planned. Currently, the QueryClient is only used for SSR router integration via setupRouterSsrQueryIntegration().

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/integrations/tanstack-query/root-provider.tsx` at line 10, The
TanstackQueryProvider component is currently unused and empty, meaning it would
not render any child components if mounted. Either remove the
TanstackQueryProvider component entirely if it's no longer needed, or if React
Query provider integration is planned, modify the TanstackQueryProvider function
to accept children as a prop parameter and render those children wrapped
appropriately within a QueryClientProvider component to ensure proper provider
functionality.

web/src/components/auth/InvitationCodeModal.tsx-27-30 (1)

27-30: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Normalize invitation code before invoking submit.

At Line 77, emptiness is checked with trim(), but Line 29 submits the untrimmed value. This can reject otherwise valid codes with accidental whitespace.

Suggested patch

   const handleSubmit = (e: React.FormEvent) => {
     e.preventDefault();
-    onSubmit(code);
+    const normalizedCode = code.trim();
+    if (!normalizedCode) return;
+    onSubmit(normalizedCode);
   };

Also applies to: 77-77

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/auth/InvitationCodeModal.tsx` around lines 27 - 30, The
handleSubmit function submits the invitation code value without trimming
whitespace, while validation at line 77 uses trim() to check for emptiness.
Modify the handleSubmit function to trim the code value before passing it to the
onSubmit callback to ensure consistency and allow codes with accidental
surrounding whitespace to be properly validated and submitted.

web/src/components/auth/AuthTextField.tsx-68-75 (1)

68-75: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add an explicit accessible name/state to the password toggle.

At Line 68, the toggle relies on title only. Add aria-label (and ideally aria-pressed) so assistive tech can reliably announce the control state.

Suggested patch

               <button
                 type="button"
                 onClick={() => setShowPassword((prev) => !prev)}
                 className="p-1 rounded-full text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800 hover:text-zinc-600 dark:hover:text-zinc-200 transition-colors"
                 title={showPassword ? "Hide password" : "Show password"}
+                aria-label={showPassword ? "Hide password" : "Show password"}
+                aria-pressed={showPassword}
               >

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/components/auth/AuthTextField.tsx` around lines 68 - 75, The password
toggle button in the AuthTextField component relies only on the title attribute
for accessibility, which is insufficient for assistive technology. Add
aria-label and aria-pressed attributes to the button element that toggles the
password visibility. The aria-label should provide a descriptive name for the
button, and aria-pressed should be set to the boolean value of showPassword to
properly communicate the current state to screen readers and other assistive
technologies.

web/src/routes/_authenticated.index.tsx (1)

14-34: ⚡ Quick win

Consolidate loading ownership to avoid duplicated skeleton logic.

Line 14 introduces a Suspense fallback, but CourseList already renders its own loading skeleton (Line 90 in web/src/components/home/CourseList.tsx). Keeping both paths risks UI drift and redundant maintenance. Prefer a single loading strategy (either Suspense-driven or internal conditional loading).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/routes/_authenticated.index.tsx` around lines 14 - 34, The Suspense
component with its fallback skeleton loading UI around the CourseList component
is duplicating the loading state management that CourseList already handles
internally. Remove the entire Suspense wrapper (including the fallback prop with
the skeleton div structure) around CourseList and render CourseList directly,
allowing it to manage its own loading skeleton as it already does at line 90 in
CourseList.tsx.

.github/workflows/pr-preview.yaml.disabled (1)

17-17: Pin action SHAs before enabling this workflow.

Lines 17, 24, and 40 use mutable version tags (@v*). Even though this file is disabled, addressing SHA pinning before enabling prevents supply-chain risk exposure when the workflow is activated.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-preview.yaml.disabled at line 17, Replace the mutable
version tags for the GitHub Actions on lines 17, 24, and 40 with specific commit
SHAs. For each action reference using the format `actions/OWNER/ACTION@v*`,
replace the mutable tag with the full commit SHA (e.g.,
`actions/checkout@<40-character-commit-sha>`). This pins the actions to specific
versions and prevents supply-chain risk from unexpected action updates when the
workflow is eventually enabled.

Source: Linters/SAST tools

server/main.py (1)

80-82: 💤 Low value

Stub endpoint should be removed or documented.

This /items/{item_id} endpoint appears to be boilerplate from FastAPI's default template. Consider removing it to avoid confusion, or add a TODO comment if it's intended for future use.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/main.py` around lines 80 - 82, The read_item endpoint decorated with
`@app.get`("/items/{item_id}") appears to be unused boilerplate code from the
FastAPI template that may confuse developers about the API's actual
functionality. Either remove the entire endpoint definition including the
decorator and the read_item function, or if this endpoint is planned for future
implementation, add a TODO comment above the decorator explaining its intended
purpose and when it should be implemented.

server/model/student_code.py (1)

7-10: Remove CodeSubmission class or use it consistently throughout the codebase.

This model is unused—main.py only imports StudentCode and manually constructs the Judge0 payload (lines 54–57) rather than using CodeSubmission. Additionally, the inherited code field and the defined source_code field create semantic redundancy. Either remove the class entirely, or use it to standardize the Judge0 submission contract by importing and using it in the /execute endpoint.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/model/student_code.py` around lines 7 - 10, The CodeSubmission class
in student_code.py is unused and creates semantic redundancy with inherited and
defined fields. Either remove the CodeSubmission class entirely from
student_code.py, or standardize the codebase by updating main.py to import and
use CodeSubmission in the /execute endpoint instead of manually constructing the
Judge0 payload. Choose one approach and ensure consistency: if keeping
CodeSubmission, replace the manual payload construction (currently around lines
54-57 in main.py) with an instance of CodeSubmission, and remove the StudentCode
import if it becomes unnecessary.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes