cometchat-angular-calls — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cometchat-angular-calls (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Production-grade voice + video calling for Angular UI Kit v5 (@cometchat/chat-uikit-angular@5) apps. Loaded by cometchat-calls when framework === "angular". Operates in two modes:
UIKitSettingsBuilder, drop <cometchat-call-buttons> next to a user/group, and mount <cometchat-incoming-call> at the root of AppComponent so calls ring app-wide.<cometchat-ongoing-call>, <cometchat-call-logs>, custom button screens) without <cometchat-conversations> / <cometchat-message-*>.v5 is standalone-component-based and targets Angular 17–21. Import each call component class into the consuming standalone component's imports: [] — there is no NgModule and no `CUSTOM_ELEMENTS_SCHEMA` (that was a v4 mental model; v5 components are real Angular components).
Read these other skills first:
cometchat-calls — dispatcher (modes, hard rules, anti-patterns)cometchat-angular-core — UIKitSettingsBuilder init, APP_INITIALIZER pattern, login(uid) (bare string), loggedInUser$, environment.tscometchat-angular-components — full call-component binding tables (the @Input-callback-vs-@Output split)cometchat-angular-patterns — standalone wiring, route guards, NgZone, change detectionGround truth:
@cometchat/[email protected] → node_modules/@cometchat/chat-uikit-angular/types/cometchat-chat-uikit-angular.d.ts. Verify any non-obvious symbol against the installed .d.ts before relying on it.@cometchat/calls-sdk-javascript@^5 (same underlying JS SDK as the React kit; the CometChatUIKitCalls namespace ships from this package)This is the single biggest difference from the old v4 calls skill. In v5 you do not hand-wire CometChatCalls.init / CometChatCalls.login for the kit path. You enable calling on the `UIKitSettingsBuilder` and the kit initializes the Calls SDK for you after CometChatUIKit.login() resolves.
import { UIKitSettingsBuilder, CometChatUIKit } from "@cometchat/chat-uikit-angular";
import { environment } from "../environments/environment";
const settings = new UIKitSettingsBuilder()
.setAppId(environment.cometchat.appId)
.setRegion(environment.cometchat.region) // "us" | "eu" | "in"
.setAuthKey(environment.cometchat.authKey) // dev only — omit in production
.subscribePresenceForAllUsers()
.setCallingEnabled(true) // ← turns calling on (verified builder method)
.build();
await CometChatUIKit.init(settings);
// ... later, after login:
await CometChatUIKit.login("cometchat-uid-1"); // kit initializes the Calls SDK internallysetCallingEnabled(true) is a real UIKitSettingsBuilder method (verified in the kit .d.ts). It is off by default — without it the call components render disabled and CometChatUIKit.isCallingEnabled() returns false.CometChatUIKit.isCallingEnabled() (static, returns boolean) before rendering call UI on a custom screen.CometChatUIKitCalls.CallAppSettingsBuilder() and pass it via .setCallAppSettings(callAppSettings). CometChatUIKitCalls is re-exported by the UI Kit — import it from @cometchat/chat-uikit-angular (the kit wraps the optional @cometchat/calls-sdk-javascript dependency; the calls SDK itself exports CometChatCalls, not CometChatUIKitCalls): import { CometChatUIKitCalls } from "@cometchat/chat-uikit-angular";
const callAppSettings = new CometChatUIKitCalls.CallAppSettingsBuilder()
.setAppId(environment.cometchat.appId)
.setRegion(environment.cometchat.region)
.build();
const settings = new UIKitSettingsBuilder()
.setAppId(environment.cometchat.appId)
.setRegion(environment.cometchat.region)
.setCallingEnabled(true)
.setCallAppSettings(callAppSettings) // optional — kit builds defaults from appId+region if omitted
.build();Most integrations do not need setCallAppSettings — setCallingEnabled(true) is enough; the kit derives defaults from appId + region.
The Calls SDK is a separate peer dependency you must install yourself — the kit declares it as a peer but does not bundle it:
npm install @cometchat/calls-sdk-javascript@^5Without it, setCallingEnabled(true) fails at runtime when the kit tries to load CometChatUIKitCalls — symptom: "Cannot find module @cometchat/calls-sdk-javascript" or call components that never connect.
Browsers don't have VoIP push. A closed tab cannot ring. Web Push (Service Worker + Notification API) is an opt-in fallback to nudge the user to an open tab; it does not bypass tab/page-load. Production web calls UX typically pairs with email/SMS fallback for missed calls.
getUserMedia cleanupBrowsers don't release the camera/mic until tracks are stopped. The kit's <cometchat-ongoing-call> handles this internally — when the component is destroyed (ngOnDestroy ends the session). If you build a custom WebRTC surface with the raw Calls SDK (§4c), you must getTracks().forEach(t => t.stop()) on hangup yourself.
Production login uses CometChatUIKit.loginWithAuthToken(tokenFromBackend) — see cometchat-angular-core §4 and cometchat-angular-production. Because the kit owns calls init/login, the same auth-token login covers calls too on the kit path; there is no separate calls token step. (Raw-SDK custom surfaces in §4c that talk to CometChatCalls directly mint a session token via CometChatCalls.generateToken(sessionId).)
When a Calls SDK or Chat SDK callback fires outside Angular's zone, change detection doesn't run and the UI looks frozen until the next user interaction. The kit components run their own handlers inside the zone, but any handler you write (e.g. an onAccept callback, a raw CometChat.addCallListener listener, or the error @Output) that mutates component state should be safe under change detection. Two correct approaches:
import { NgZone, ChangeDetectorRef } from "@angular/core";
// Approach A — wrap UI-mutating work in NgZone.run
constructor(private zone: NgZone) {}
handleAccept = (call: CometChat.Call) => {
this.zone.run(() => {
this.activeSessionId = call.getSessionId();
this.inCall = true;
});
};
// Approach B (recommended for new code) — use signals; reactive readers
// re-render regardless of which zone the .set() ran in.
readonly inCall = signal(false);
handleAccept = (call: CometChat.Call) => { this.inCall.set(true); };Rule: any service/component state a template observes under OnPush MUST be a signal (or an observable via the async pipe / toSignal). A plain property set from outside the component's input/event surface never triggers OnPush change detection — the template stays stuck on the initial value forever. See cometchat-angular-patterns for the full signals-vs-plain-property rule.
getUserMediaThe browser prompts for camera/mic automatically when the Calls SDK starts media. Surface NotAllowedError (denied) and NotFoundError (no device) to a clear message via the error @Output / onError callback. HTTPS is required (or localhost) — getUserMedia returns NotAllowedError over plain HTTP. ng serve --ssl for local HTTPS.
<cometchat-incoming-call> mounted at app rootFor calls to ring on every route, <cometchat-incoming-call> must live in a component that stays mounted across navigation — AppComponent (above <router-outlet>) is the simplest place. A persistent authenticated shell works equally well: the canonical Angular sample mounts it in its post-login home/shell component (cometchat-home.component.html), not literally in AppComponent. The rule is "lives in a host that outlives route changes," not "must be AppComponent specifically." Below uses AppComponent as the no-shell default:
<!-- app.component.html -->
<cometchat-incoming-call></cometchat-incoming-call>
<router-outlet></router-outlet>// app.component.ts — import the class into imports: []
import { Component } from "@angular/core";
import { RouterOutlet } from "@angular/router";
import { CometChatIncomingCallComponent } from "@cometchat/chat-uikit-angular";
@Component({
selector: "app-root",
standalone: true,
imports: [RouterOutlet, CometChatIncomingCallComponent],
templateUrl: "./app.component.html",
})
export class AppComponent {}Mounting it inside a feature-route component means the listener disappears on navigation → calls only ring while that route is active. That is the canonical "calls don't ring" bug. For lazy-loaded features, keep the incoming-call mount in the eagerly-loaded AppComponent, not the lazy chunk.
@Input-callback vs @Output binding split (the #1 Angular-v5 calls trap)The call components expose accept/decline/error as `@Input` callback props (functions passed into the component), NOT @Output events — but several also expose @Output EventEmitters for observing. Bind the form that exists for what you need:
<!-- ✓ accept/decline/error are @Input CALLBACK props — pass a function reference -->
<cometchat-incoming-call
[onAccept]="handleAccept"
[onDecline]="handleDecline"
[onError]="handleError">
</cometchat-incoming-call>
<!-- ✓ the SAME component also exposes @Outputs for observation -->
<cometchat-incoming-call
(callAccepted)="onAccepted($event)"
(callDeclined)="onDeclined($event)"
(error)="onErr($event)">
</cometchat-incoming-call>[onAccept]="handleAccept" binds an @Input — handleAccept is a function reference (do NOT call it: [onAccept]="handleAccept()" is wrong). Prefer the @Input callbacks for accept/decline because they carry the kit's built-in call handling.(callAccepted)="onAccepted($event)" binds an @Output — use $event and these for pure observation.(onAccept) (as if it were an output) or [callAccepted] (as if it were an input) silently does nothing.See cometchat-angular-components for the exact per-component split.
# additive mode: @cometchat/chat-uikit-angular@^5 is already installed.
# Always add the calls peer:
npm install @cometchat/calls-sdk-javascript@^5The chat SDK (@cometchat/chat-sdk-javascript@^4.1) and dompurify@^3 are pulled in by the kit's peers. Do not install @cometchat/uikit-shared / -elements / -resources — they don't exist in v5.
// main.ts
import { bootstrapApplication } from "@angular/platform-browser";
import { APP_INITIALIZER } from "@angular/core";
import { provideRouter } from "@angular/router";
import { provideAnimations } from "@angular/platform-browser/animations";
import { UIKitSettingsBuilder, CometChatUIKit } from "@cometchat/chat-uikit-angular";
import { AppComponent } from "./app/app.component";
import { routes } from "./app/app.routes";
import { environment } from "./environments/environment";
function initCometChat() {
return () => {
const settings = new UIKitSettingsBuilder()
.setAppId(environment.cometchat.appId)
.setRegion(environment.cometchat.region)
.setAuthKey(environment.cometchat.authKey) // dev only
.subscribePresenceForAllUsers()
.setCallingEnabled(true) // ← enable calls
.build();
return CometChatUIKit.init(settings); // return Promise so bootstrap waits
};
}
bootstrapApplication(AppComponent, {
providers: [
provideRouter(routes),
provideAnimations(),
{ provide: APP_INITIALIZER, useFactory: initCometChat, multi: true },
],
});Login (dev user or production token) then runs in a route guard / auth service after init resolves — see cometchat-angular-core §4. The kit initializes the Calls SDK on login when setCallingEnabled(true) was set.
NgModule app (not yet migrated to standalone)? You can still import these standalone component classes into an@NgModule({ imports: [...] }). You still do not needCUSTOM_ELEMENTS_SCHEMA.
Calls icons come from the same kit asset bundle as chat — confirm the angular.json assets glob from cometchat-angular-core §2 is present, or call buttons render without icons.
All are standalone — import the *Component class into the consuming component's imports: []. Selectors and bindings below are verified against @cometchat/[email protected] types.
Class (import into imports: []) | Selector | Key bindings |
|---|---|---|
CometChatCallButtonsComponent | <cometchat-call-buttons> | @Input: user, group, callSettingsBuilder, hideVoiceCallButton, hideVideoCallButton, hideOverlays, outgoingCallDisableSoundForCalls, outgoingCallCustomSoundForCalls · @Input callbacks: onVoiceCallClick, onVideoCallClick, onError · @Output: error |
CometChatIncomingCallComponent | <cometchat-incoming-call> | @Input: call, disableSoundForCalls, customSoundForCalls · @Input callbacks: onAccept, onDecline, onError · @Output: callAccepted, callDeclined, error |
CometChatOutgoingCallComponent | <cometchat-outgoing-call> | @Input: call, disableSoundForCalls, customSoundForCalls · @Input callback: onError · @Output: callCanceled, error |
CometChatOngoingCallComponent | <cometchat-ongoing-call> | @Input: sessionID, callSettingsBuilder, callWorkflow, isAudioOnly · @Input callback: onError · @Output: callEnded, error |
CometChatCallLogsComponent | <cometchat-call-logs> | @Input: activeCall, callLogRequestBuilder, callSettingsBuilder, showScrollbar, callInitiatedDateTimeFormat, menuView, plus template overrides (itemView, leadingView, titleView, subtitleView, trailingView, loadingView, emptyView, errorView) · @Input callback: onError · @Output: itemClick, callButtonClicked |
Notes:
callSettingsBuilder is typed typeof CometChatUIKitCalls.CallSettingsBuilder — pass the unbuilt builder instance if you customize it; the kit calls .build() internally. Most integrations omit it and let the kit build defaults.@cometchat/calls-sdk-javascript — the web family). The SessionSettings idle fields are ms, not seconds: idleTimeoutPeriodBeforePrompt: 180 means 180 ms, so a solo session shows the "Are you still there?" prompt and exits almost instantly on join. Use ms — { idleTimeoutPeriodBeforePrompt: 180_000, idleTimeoutPeriodAfterPrompt: 60_000 } (the JS SDK defaults are 60_000 / 120_000; some docs surfaces list 180_000 for the before-prompt — either is fine; the load-bearing point is ms-not-seconds). The timer only runs while you're the sole participant. (Native Android/iOS/Flutter use seconds here — Angular/web/RN are the ms outliers.)callWorkflow on <cometchat-ongoing-call> is the CallWorkflow enum: CallWorkflow.defaultCalling (Chat-SDK signaling, the default) or CallWorkflow.directCalling (Calls-SDK direct). Import CallWorkflow from @cometchat/chat-uikit-angular.<cometchat-message-header> auto-renders call buttons when a user/group is set (it has its own hideVoiceCallButton / hideVideoCallButton / voiceCallClick / videoCallClick). Don't add a second <cometchat-call-buttons> next to it — see anti-pattern 2.ERR_ALREADY_LOGGED_IN in the console — the kit re-runs its calling init against a still-live session. It's harmless; a full page refresh clears it. Do NOT add retry/teardown logic to "fix" it.CometChat.addCallListener), onIncomingCallReceived may not fire (the server routes, but the listener stays silent — suspected stale-session/mixed-version interop). Reverse direction (Angular kit caller → kit receiver) is reliable. If you build a custom receiver surface, verify the listener attaches BEFORE any call can arrive, and prefer the kit's <cometchat-incoming-call> over a hand-rolled receiver until this is resolved.When cometchat-angular-core chat is already wired. The skill:
@cometchat/calls-sdk-javascript@^5..setCallingEnabled(true) to the existing UIKitSettingsBuilder chain (rule 1.0). Optionally .setCallAppSettings(...).<cometchat-incoming-call> in AppComponent above <router-outlet> (rule 1.7) and imports CometChatIncomingCallComponent.<cometchat-message-header> render the call buttons automatically (a user/group is already bound on the messages screen), OR — on a custom contact/profile screen with no message header — drops a standalone <cometchat-call-buttons [user]="user">./calls route hosting <cometchat-call-logs>.// contact-actions.component.ts (custom screen, no message header)
import { Component, Input } from "@angular/core";
import { CometChat } from "@cometchat/chat-sdk-javascript";
import { CometChatCallButtonsComponent } from "@cometchat/chat-uikit-angular";
@Component({
selector: "app-contact-actions",
standalone: true,
imports: [CometChatCallButtonsComponent],
template: `
<cometchat-call-buttons
[user]="user"
[onError]="handleError">
</cometchat-call-buttons>
`,
})
export class ContactActionsComponent {
@Input() user!: CometChat.User;
handleError = (e: CometChat.CometChatException) => console.error("call error", e);
}Same kit init + setCallingEnabled(true), but no <cometchat-conversations> / <cometchat-message-*>. The skill scaffolds:
APP_INITIALIZER with setCallingEnabled(true) (§2).<cometchat-call-buttons [user]="selectedUser"> to start a call.<router-outlet> so the device rings (rule 1.7).<cometchat-call-logs (itemClick)="onLog($event)"> for history.cometchat-angular-core).The kit's incoming/outgoing/ongoing components handle the WebRTC surface end-to-end; you do not call joinSession yourself on this path.
Only when the user explicitly wants a fully custom in-call UI (custom controls/layout) instead of the kit's <cometchat-ongoing-call>. This uses the raw @cometchat/calls-sdk-javascript API directly — the same JS Calls SDK surface documented in `cometchat-react-calls` §3 (CometChat.initiateCall for signaling, then CometChatCalls.generateToken(sessionId) → CometChatCalls.joinSession(token, settings, htmlElement) → CometChatCalls.leaveSession()). Angular specifics:
<div> must be in the DOM with non-zero dimensions when joinSession runs. Gate it correctly:@if) whether to instantiate it. ngAfterViewInit then fires with the @ViewChild resolved — no setTimeout(0) needed.@if (inCall()), a microtask runs before Angular renders the block, so a @ViewChild read is still null — use a full task tick (await new Promise(r => setTimeout(r, 0))) before reading nativeElement.NgZone.run (or drive state through signals) — rule 1.5.CometChatCalls.leaveSession() then stop any custom MediaStream tracks (rule 1.3).setIsAudioOnlyCall(true) on the Calls-SDK CallSettingsBuilder used for joinSession — see cometchat-react-calls §4c.Do NOT invent token-mint helpers: the v5 method is CometChatCalls.generateToken(sessionId) — auth is internal after login (the signature is generateToken(sessionId, authToken?), but the optional second arg is only for explicit-token flows; omit it on the post-login path). There is no getRTCToken in v5.
CometChatUIKit.isCallingEnabled() is false. (rule 1.0)user/group is bound — you get a duplicate set. Use the header's own hideVoiceCallButton/hideVideoCallButton or its voiceCallClick/videoCallClick instead. (rule 1.8 / §3)*Component class into imports: [] instead.AppComponent. (rule 1.7)(onAccept)) or an `@Output` as an `@Input` ([callAccepted]). Silently does nothing — bind the form that exists. (rule 1.8)[onAccept]="handleAccept()"). Pass a reference ([onAccept]="handleAccept").setCallingEnabled(true) is set — don't double-init. Manual CometChatCalls.* is only for the raw-SDK custom surface (§4c). (rule 1.0)getUserMedia denies. Use HTTPS or localhost (ng serve --ssl). (rule 1.6)<cometchat-*> renders and before a call can arrive. Use APP_INITIALIZER (or gate on an isReady flag) — see cometchat-angular-core §3.Static:
@cometchat/calls-sdk-javascript@^5 in package.json (calls peer)@cometchat/chat-uikit-angular@^5 in package.json.setCallingEnabled(true) on the UIKitSettingsBuilder chain<cometchat-incoming-call> in AppComponent template above <router-outlet>, and CometChatIncomingCallComponent in AppComponent's imports: []imports: [] (no CUSTOM_ELEMENTS_SCHEMA)@Input callbacks ([onAccept]="fn"), or @Outputs ((callAccepted)="fn($event)") — the correct form per cometchat-angular-components[onAccept]="handleAccept")<cometchat-call-buttons> next to a <cometchat-message-header> that already shows themAPP_INITIALIZER (not a lazy route); <cometchat-*> gated until init+login resolveOnPush is a signal / async pipe (not a plain property)environment.ts has cometchat: { appId, region, authKey } (dev) or token-endpoint config (prod)CometChatCalls.leaveSession() + stops custom MediaStream tracksRuntime (browser):
getUserMedia worksreferences/virtual-background.md — blur / custom image / clear (web-only)cometchat-angular-core — UIKitSettingsBuilder, init/login order, environment.ts, themingcometchat-angular-components — full call-component binding tables (the @Input-callback-vs-@Output split)cometchat-angular-patterns — standalone wiring, route guards, NgZone, signals-under-OnPushcometchat-angular-production — server-minted auth tokens, user managementcometchat-angular-troubleshooting — runtime failures, zone issues, SSR/Universalcometchat-react-calls — raw JS Calls SDK API surface (shared underlying SDK; §4c custom-surface reference)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.