cometchat-flutter-v6-calls — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cometchat-flutter-v6-calls (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ground truth: the call UI ships INSIDEcometchat_chat_uikit, but in a second barrel, and the WebRTC engine is a separate package (cometchat_calls_sdk). Every symbol below is catalog-verified against 6.1.0. Exhaustive props: FETCH the twin via../cometchat-flutter-v6-core/references/docs-map.md(call-features·incoming-call·outgoing-call·call-logs·call-buttons). APPEND to the user's app — additive wiring only.
cometchat-flutter-v6-core — install, credentials, the settings asset, init→login→render. This skill ASSUMES it (calling rides the SAME init).cometchat-flutter-v6-components — the widget catalog.cometchat-flutter-v6-placement — where call surfaces sit in the app shell (incoming calls need only the root navigatorKey — no widget)."add voice & video calls", "enable video call", "add call buttons", "show call logs". Precondition: chat already works (core done).
cometchat_chat_uikit already depends on `cometchat_calls_sdk` (^5.0.4, in the kit's own dependencies: — verified in the 6.1.x pubspec), so the WebRTC engine is pulled in transitively; you do not need to add it. Add an explicit direct dependency only if you import cometchat_calls_sdk symbols directly (then pin it to keep resolution predictable):
flutter pub add cometchat_calls_sdk # optional — only if you import the package directlyThen the native config the docs require — all four steps, or calling silently never rings:
cometchat_calls_sdk (transitive via the kit; pin ^5.0.4 in pubspec.yaml only if you added it directly).android/app/build.gradle.kts: minSdk = 26.ios/Podfile: platform :ios, '15.1', then pod install.AndroidManifest.xml; NSCameraUsageDescription / NSMicrophoneUsageDescription in Info.plist). Without them the call surface opens black.⚠️ The docs' floors are too low and these are compiler-verified instead.cometchat_calls_sdkpinsminSdkVersion 26in itsandroid/build.gradleandplatform :ios, '15.1'in its podspec (5.0.7; it was 13.0 through 5.0.6). Gradle and CocoaPods take the MAXIMUM across the dependency graph, so a lower app-level value is a build error, not a warning. Docs say 24 / 13.0 — DOCS-BACKLOG D7. Platform floors do move: re-verify against the installed package, not the page.
Every call widget resolves only from the calls barrel, and that barrel does not re-export the chat widgets. A calls screen imports both:
import 'package:cometchat_chat_uikit/cometchat_chat_uikit.dart'; // chat widgets + SDK types
import 'package:cometchat_chat_uikit/cometchat_calls_uikit.dart'; // ALL call widgetsImporting only the chat barrel and then emitting CometChatIncomingCall fails to compile with "Undefined name" — the single most common calls mistake.
Calling is off until (a) the Calls SDK is installed and (b) calling is enabled in settings. Core inits via initFromSettings, which reads cometchat-settings.json — so flip it in the file:
{
"appId": "APP_ID",
"region": "REGION",
"credentials": { "authKey": "AUTH_KEY" },
"uiKit": { "subscribePresenceForAllUsers": true, "enableCalling": true },
"chatSDK": { "autoEstablishSocketConnection": true }
}uiKit.enableCallingis the only way to enable calling on theinitFromSettingspath —UIKitSettingsdefaults it to false. (If the project uses the classic builder instead, the equivalent is..enableCalls = trueplus..callingConfiguration = CallingConfiguration().)
1. A navigator key at the app root so the kit can present call screens from anywhere:
import 'package:cometchat_chat_uikit/cometchat_calls_uikit.dart';
import 'package:flutter/material.dart';
Widget app(Widget home) => MaterialApp(
navigatorKey: CallNavigationContext.navigatorKey, // REQUIRED for call routing
home: home,
);2. That's it for incoming calls — the kit does the rest. Do NOT add your own root CallListener or present CometChatIncomingCall yourself. When uiKit.enableCalling is true, the kit's CallEventService registers its own CometChat.addCallListener(...) on login and shows the incoming-call overlay automatically via IncomingCallOverlay (verified in cometchat_chat_uikit 6.1.x). Adding a second listener + a manual overlay produces a DOUBLE incoming-call screen. All you owe it is the navigatorKey from step 1 (that is how the overlay finds a context to present — without it the kit logs "Incoming call overlay cannot be shown").
To customize the incoming/outgoing/call-button surfaces, pass a `CallingConfiguration` — not a hand-rolled listener. On the classic builder path: ..callingConfiguration = CallingConfiguration(incomingCallConfiguration: ..., outgoingCallConfiguration: ..., callButtonsConfiguration: ...). CallingConfiguration (with incomingCallConfiguration / outgoingCallConfiguration / callButtonsConfiguration) is the kit's supported entry point; fetch its fields via the twin (call-features).
3. Extra surfaces you place yourself — call logs, and the incoming/outgoing widgets only when you build a fully custom flow — from the CALLS barrel:
import 'package:cometchat_chat_uikit/cometchat_calls_uikit.dart';
import 'package:flutter/material.dart';
Widget logs() => const CometChatCallLogs();
// Only when replacing the built-in overlay with a fully custom flow — otherwise the kit
// already presents these for you:
Widget incoming(Call call, User user) => CometChatIncomingCall(call: call, user: user);
Widget outgoing(Call call, User user) => CometChatOutgoingCall(call: call, user: user);Call buttons are already in `CometChatMessageHeader` — do NOT hand-roll them. They appear once calling is enabled; hide withhideVoiceCallButton/hideVideoCallButton.CometChatCallButtonsis for placing them somewhere else (e.g. a profile screen).
enableCalling false (or vice-versa) ⇒ every call affordance stays hidden, with no error.CallEventService already listens and shows the overlay when calling is enabled — don't duplicate it; customize via CallingConfiguration.CallNavigationContext.navigatorKey on your MaterialApp) ⇒ the kit's overlay has no context to present from and logs "Incoming call overlay cannot be shown".../cometchat-flutter-v6-core/references/layout.md).call-features.CometChatCallLogDetails widget; build it from guide-call-log-details.On TWO real devices (not simulators): calling enabled in the settings file and the Calls SDK installed → the header shows call buttons → placing a call rings the other device → accept shows the ongoing surface with real video → decline/end returns both sides cleanly → the call appears in CometChatCallLogs. A black surface means permissions; no ring means the enable pair or a missing navigatorKey; two incoming screens means a hand-added listener/CometChatIncomingCall.
Build the feature; do not write tests unless asked (RULES.md) — the above is an advisory human pass.Close (after it builds): end with the shared 3-option selectable menu and WAIT — ① add another feature · ② customize theming · ③ test it manually (same contract as core, RULES.md §19).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.