feat(gateway,ui): the generic endpoint protocol travels through the setup contract - #3046
Conversation
GitHub Actions
Inactive
|
You have reached your Codex usage limits for security reviews. Please try again later. |
|
Keiko for Quality — run summary
Budget: 1155986 tokens allotted, 100620 reported Recent runs
|
GitHub Actions
Inactive
|
Warning Review limit reached
Next review available in: 36 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughChangesGeneric gateway endpoint protocol handling
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ❌ 2❌ Failed checks (2 warnings)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/keiko-server/src/gateway-setup.test.ts`:
- Around line 6528-6587: Extend the gateway setup tests around
handleGatewaySetup to cover requests that omit endpointStyle and apiVersion.
Assert that using the same baseUrl preserves the existing stored endpointStyle
and apiVersion, while changing the baseUrl leaves both fields absent. Cover both
endpoint-inheritance branches and inspect the persisted provider through
currentGatewayConfig.
In
`@packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts`:
- Around line 1330-1343: Add a separate test alongside the existing
generic-provider protocol test using two Azure providers with the same Azure
endpoint style but different valid apiVersion values. Assert
parseGatewayConfigUpload returns { outcome: "invalid" }, ensuring the apiVersion
uniformity guard is exercised independently of endpointStyle validation.
In
`@packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsx`:
- Around line 2153-2199: The test around “drops the imported generic protocol
when the user retypes the gateway URL” only covers a changed URL; add a separate
valid preserve-existing submission case with the base URL empty. Submit the
imported configuration without entering a replacement URL, then assert the setup
payload omits both endpointStyle and apiVersion, covering the empty-base-URL
branch of importedEndpointPayload.
In `@packages/keiko-ui/src/lib/api.ts`:
- Around line 618-620: Move the GatewaySetupInput request DTO, including
endpointStyle and apiVersion, from the UI API definitions into keiko-contracts;
export it there and update both UI and server boundary code to import and use
that shared type, removing the local redeclaration.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: bb97bf2e-6576-4f44-9627-38dd9501787e
📒 Files selected for processing (8)
packages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-ui/src/lib/api.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (13)
- GitHub Check: Cross-platform smoke (ubuntu-latest)
- GitHub Check: Cross-platform smoke (macos-latest)
- GitHub Check: Cross-platform smoke (windows-latest)
- GitHub Check: Coverage suite (scripts)
- GitHub Check: Coverage shard (packages 1/3)
- GitHub Check: ui
- GitHub Check: Coverage shard (packages 2/3)
- GitHub Check: Coverage shard (packages 3/3)
- GitHub Check: Coverage suite (keiko-ui)
- GitHub Check: Core quality
- GitHub Check: Build, scan, SBOM, smoke
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (12)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript settings, forbidany, require explicit function return types, and model states with discriminated unions rather than casts.
Keep cyclomatic complexity at or below 10, keep functions within 50 non-comment lines, and extract helpers when necessary.
Use the intended logger or diagnostic sink instead ofconsole.*in product code.
Validate hostile inputs before processing, fail closed at trust boundaries, and never route generated or model-produced code around the sandbox egress boundary.
Do not swallow errors with empty catches; surface sufficient diagnostic context, including a correlation ID for server-visible opaque 500 errors.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
packages/keiko-ui/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
packages/keiko-ui/**/*.{ts,tsx}: Thekeiko-uiworkspace must enforce the root values for complexity, maximum function length, and explicit function return types; its suppression register may only shrink.
The UI must communicate with the server through shared contract types and must not redeclare governed wire types.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.ts
**/*.{ts,tsx,js,mjs,json}
📄 CodeRabbit inference engine (AGENTS.md)
Use Prettier formatting: 2-space indentation, double quotes, semicolons, 100-column width, trailing commas, and LF endings.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Use English in code, comments, identifiers, documentation, commit messages, issues, and pull requests.
Respect the inward dependency direction:keiko-contractsis the leaf,keiko-securitydepends only on contracts, and cross-package types belong in contracts.
Inspect and reuse existing helpers, contracts, and subsystems; do not create parallel workspace, graph, policy, evidence, memory, connector, workflow, or UI subsystems without a documented capability gap.
Keep manifests, audit exports, diagnostics, logs, configuration, tests, and evidence redacted: never expose secrets, keys, raw content, endpoints, PII, memory bodies, or customer data.
Never weaken trust boundaries, evidence redaction, governance gates, required checks, or authority limits to make a change pass; fail closed.
Never directly push todev, force-push, bypass required checks, dismiss findings to obtain green status, or merge outside the approved direct-check path.
Use branch names in the formtype/short-slug, never work directly ondev, and use imperative conventional commit subjects with an issue or PR reference and no secrets.
Run the applicable local typecheck, lint, format check, tests, architecture checks, Sonar gate, and touched-area gates before claiming a change or pull request is green; report only commands actually executed.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
**/*.{ts,tsx,js,mjs}
📄 CodeRabbit inference engine (AGENTS.md)
Delete dead code instead of commenting it out and do not leave scaffolding or TODOs hiding unfinished branches.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
packages/keiko-ui/**/*.{ts,tsx,css}
📄 CodeRabbit inference engine (AGENTS.md)
When changing UI code or styling, preserve the SHA-pinned visual-proof and accessibility expectations and run the required UI gates.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.ts
packages/**/src/**
⚙️ CodeRabbit configuration file
packages/**/src/**: Enforce ADR-0019 package direction and the owning trust boundary. Flag provider SDK imports
outside keiko-model-gateway, cross-package wire types outside contracts, workspace escape,
raw evidence bodies, silent failures, and parallel subsystems that should extend an owner.
Files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
**/*.{test,spec}.{ts,tsx,js}
📄 CodeRabbit inference engine (AGENTS.md)
Tests must be hermetic: no real network, shared mutable global state, wall-clock or ordering races, or assumptions that a port is free; await conditions instead of sleeping.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-server/src/gateway-setup.test.ts
**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{test,spec}.{ts,tsx}: Regression tests must fail before the fix and pass afterward; fixtures and mocks must derive expectations through production entry points rather than reimplementing formulas.
Cover empty, boundary, malformed, and hostile inputs, including both branches of every guard added.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-server/src/gateway-setup.test.ts
**/*.test.{ts,tsx,mjs}
⚙️ CodeRabbit configuration file
**/*.test.{ts,tsx,mjs}: A behavioral fix needs a failure-first regression proof that fails without the fix. Cover
malformed, hostile, empty, and boundary inputs; never relax a regression pin or duplicate a
production formula inside a fixture.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-server/src/gateway-setup.test.ts
packages/keiko-model-gateway/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Only
keiko-model-gatewaymay import provider SDKs such asopenai,@anthropic-ai/*, or*-ai-sdk.
Files:
packages/keiko-model-gateway/src/config.ts
packages/keiko-server/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
The server may use domain packages but must not depend on
keiko-editor; domain packages must not depend on the server.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
🧠 Learnings (5)
📚 Learning: 2026-07-26T21:23:56.288Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2755
File: packages/keiko-server/src/grounded-qa-hybrid.ts:1006-1012
Timestamp: 2026-07-26T21:23:56.288Z
Learning: In Keiko’s internal “stable-ID” hash helper functions (e.g., where stable identifiers are computed for persistence/comparison), preserve the existing UTF-16 code-unit iteration semantics when modernizing. Specifically, if the current implementation iterates with `charCodeAt(i)` (code units) rather than `codePointAt(i)` (Unicode code points), keep `charCodeAt(i)` to avoid changing the resulting stable IDs. If changing from `charCodeAt` to `codePointAt` is ever desired, it must be an explicitly planned compatibility/migration decision (e.g., versioning, backfill, or dual-read/write) rather than a mechanical refactor.
Applied to files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-27T10:55:30.485Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2766
File: packages/keiko-server/src/qualityIntelligence/figmaSnapshotRoutes.test.ts:1738-1738
Timestamp: 2026-07-27T10:55:30.485Z
Learning: When reviewing TypeScript files, do not flag single-quoted string literals as a violation if they match Prettier’s formatter-approved output. Specifically, if Prettier is configured to prefer double quotes but retains a single-quoted literal solely because switching to double quotes would require escaping embedded double quotes, allow the single quotes (i.e., don’t “fix” it beyond what Prettier would produce).
Applied to files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-27T18:08:22.461Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2780
File: packages/keiko-server/src/store/migrations.test.ts:78-95
Timestamp: 2026-07-27T18:08:22.461Z
Learning: When reviewing TypeScript lint findings (e.g., from typescript-eslint/no-unsafe-assignment), ensure the issue is reproducible using the repository’s configured ESLint setup/TS project settings. Do not treat diagnostics observed under a mismatched TypeScript project/tsconfig as authoritative; only accept them as real if you can reproduce them with the same ESLint configuration the repo uses (e.g., via its full/targeted lint scripts). In related test code, prefer deriving branded identity types from the production function return types to keep RootIdentity/brand fields type-compatible and avoid unsafe assignments.
Applied to files:
packages/keiko-ui/src/lib/api.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-25T18:42:13.123Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2716
File: packages/keiko-tools/src/editor-agent-client.test.ts:692-692
Timestamp: 2026-07-25T18:42:13.123Z
Learning: In Keiko TypeScript test files, do not request explicit return type annotations for callbacks passed to typed Vitest `it(...)` and `it.each(...)`. Specifically, avoid adding `: void` or `: Promise<void>` to those callback functions when the ESLint rule `typescript-eslint/explicit-function-return-type` is configured with `allowTypedFunctionExpressions: true` (i.e., typed function expressions are intentionally exempt). Only ask for explicit return types if the ESLint configuration changes; otherwise preserve the existing surrounding test-file style.
Applied to files:
packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-server/src/gateway-setup.test.ts
📚 Learning: 2026-07-24T19:25:13.892Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2697
File: packages/keiko-server/src/editor/inlineCompletionRoutes.ts:616-616
Timestamp: 2026-07-24T19:25:13.892Z
Learning: In `packages/keiko-server`, follow ADR-0141 D5’s AppSession/request-authorization model for workspace root resolution. When reviewing code that performs the `resolveRequestRoot`-style authorization gate, ensure it (1) re-proves persisted workspace identity, (2) derives the request root path, (3) enforces canonical realpath containment within the expected workspace/root to prevent path traversal, (4) verifies workspace presence/validity, and (5) requires a live AppSession (launcher-attested, process-scoped authority per BFF). Do not require a task identity for this gate if AppSession does not model task identity; authorization should be uniform and based on the same-user local threat model rather than per-task/per-workspace session semantics.
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
🔇 Additional comments (7)
packages/keiko-model-gateway/src/config.ts (1)
578-593: LGTM!Also applies to: 1273-1273
packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.ts (1)
43-44: LGTM!Also applies to: 62-70, 114-119, 620-620, 957-960, 977-978, 1062-1103
packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts (1)
312-330: LGTM!Also applies to: 1068-1076, 1301-1329, 1345-1351
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx (1)
596-599: LGTM!Also applies to: 651-683, 2179-2181, 2550-2550, 2559-2567, 2619-2621
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsx (1)
2105-2152: LGTM!packages/keiko-server/src/gateway-setup.ts (1)
308-310: LGTM!Also applies to: 466-495, 1631-1633, 1690-1700, 2129-2158, 3592-3594, 3676-3677, 3791-3792, 3953-3986, 4248-4249
packages/keiko-server/src/gateway-setup.test.ts (1)
6588-6608: LGTM!
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7bda4771c3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review findings on #3046, all legitimate coverage gaps: - Server: a preserve-mode rotation on the SAME endpoint inherits the stored style and api version; the same submit against a DIFFERENT host leaves both absent. - Upload parser: two Azure providers whose api versions differ (the earlier fixture differed in style too, so it short-circuited before the version axis) refuse as invalid. - Dialog: an empty gateway URL takes the other branch of the URL binding and omits the imported protocol. Also relocates the four protocol tests that the rebase had inserted into the neighbouring 'rawConfigFromCurrent' describe instead of 'handleGatewaySetup' — syntactically valid but semantically misplaced. Verified against a FORCED rebuild of keiko-model-gateway: keiko-server resolves the built package, and a stale dist had been masking the canonical api-version fix. 218 server + 241 modals + 1042 gateway tests, tsc, both lints, prettier, sonar PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
![keiko-for-quality[bot]](https://avatars.githubusercontent.com/in/4290143?s=60&v=4){kind=small}
GitHub Actions
Inactive
…rrored version shape and endpoint identity (#3046) Four Codex findings, each pinned red first: - A submitted endpointStyle now replaces the protocol ATOMICALLY: mixing it with an inherited apiVersion built a protocol the canonical parser refuses, so switching an Azure provider to openai-compatible on the same URL failed the save instead of performing it. - A preserve-mode update carrying ONLY the protocol takes the rebuilding path; the settings-only path accepted the change and never wrote it. - The upload parser mirrors API_VERSION_RE for generic providers, as the voice endpoint already did — 'not-a-date' no longer reports upload success for a file Test & Save refuses. - The dialog binds the imported protocol by CANONICAL endpoint identity, so a semantics-preserving edit (a trailing slash) keeps it while a real endpoint change still drops it. The identity helper reuses the gateway's own linear stripTrailingSlashes shape rather than a backtracking regex. 220 server + 243 modals tests, tsc across three packages, both lints, prettier, sonar PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
A file that states no gateway URL states no endpoint protocol either. The early return left the previous upload's style bound to a URL the visible field still held, so the stale protocol matched the binding and rode the next submit unseen — the same file-scoped-hidden-state class already closed for the synthesis flag (#3041) and the voice roles (#3042). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
… names (#3046) An endpoint protocol is a property of the connection, not of voice. Both sections have always validated against one contract list, but the voice-prefixed constant and helper names made a reviewer read the generic check this PR adds as a voice-only whitelist. Names now carry no section; VOICE_REALTIME_AUTH_MODES keeps its prefix because realtime auth really is voice-only. Behavior identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a71fc0eb37
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… keep a declared protocol (#3046) Four review findings, one root each: - readSetupGatewayCredentials read the gateway connection off providers[0]. Array order is not a contract — a stored file may list a voice provider first — so a stored Azure chat endpoint lost its protocol on an unchanged rotation. It now uses the same primary-chat selection the sharing classification uses. - The deployment requirement keyed only off a Foundry hostname, so a classic Azure host explicitly stated as azure-openai-deployment fell through to generic /models discovery and failed there instead of naming the missing deployments. - The upload cleared a declared protocol whenever the file left the URL to the operator. The declaration now survives unbound and applies to the URL the operator enters; a file declaring nothing still clears it. - The client endpoint identity did not mirror the server's terminal /chat/completions trim, so editing an imported URL down to the form the server derives read as an endpoint change and dropped the protocol. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7dafbe997b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ormed version (#3046) Two review findings: - Dropping every undeclared protocol value from the durable view broke a file that declares azure-openai-deployment and takes its required version from KEIKO_MODEL_<ID>_API_VERSION: the durable view carried azure with no version and inheritance then rejected a routine rotation with 400. Only a version the pair does not need is dropped now — the same coherence argument that stopped #3040 from masking that namespace. - A malformed apiVersion threw inside the candidate loop and surfaced as an opaque 502; the canonical YYYY-MM-DD[-preview] shape is now a named 400. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/keiko-server/src/gateway-setup.ts`:
- Around line 321-330: Move the capability-reuse comment from above
storedPrimaryOrSelf to existingCapabilityForSetup, where the described fallback
behavior is implemented. Rename storedPrimaryOrSelf to storedProviderForModel
and update its call site to use storedProviderForModel(options.stored, modelId),
preserving the existing lookup behavior.
In `@packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx`:
- Line 2597: Move the applyUploadedGenericEndpoint(fields) call from
applyUploadedVoiceConfig to applyUploadedConfig, placing it immediately after
applyUploadedVoiceConfig completes. Keep applyUploadedVoiceConfig voice-scoped
and ensure applyUploadedGenericEndpoint runs for uploaded configurations
regardless of whether a voice section is present.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 18874d2e-5e0d-4971-902e-274699765661
📒 Files selected for processing (7)
packages/keiko-model-gateway/src/config.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (12)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript settings, forbidany, require explicit function return types, and model states with discriminated unions rather than casts.
Keep cyclomatic complexity at or below 10, keep functions within 50 non-comment lines, and extract helpers when necessary.
Use the intended logger or diagnostic sink instead ofconsole.*in product code.
Validate hostile inputs before processing, fail closed at trust boundaries, and never route generated or model-produced code around the sandbox egress boundary.
Do not swallow errors with empty catches; surface sufficient diagnostic context, including a correlation ID for server-visible opaque 500 errors.
Files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*.{ts,tsx,js,mjs,json}
📄 CodeRabbit inference engine (AGENTS.md)
Use Prettier formatting: 2-space indentation, double quotes, semicolons, 100-column width, trailing commas, and LF endings.
Files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Use English in code, comments, identifiers, documentation, commit messages, issues, and pull requests.
Respect the inward dependency direction:keiko-contractsis the leaf,keiko-securitydepends only on contracts, and cross-package types belong in contracts.
Inspect and reuse existing helpers, contracts, and subsystems; do not create parallel workspace, graph, policy, evidence, memory, connector, workflow, or UI subsystems without a documented capability gap.
Keep manifests, audit exports, diagnostics, logs, configuration, tests, and evidence redacted: never expose secrets, keys, raw content, endpoints, PII, memory bodies, or customer data.
Never weaken trust boundaries, evidence redaction, governance gates, required checks, or authority limits to make a change pass; fail closed.
Never directly push todev, force-push, bypass required checks, dismiss findings to obtain green status, or merge outside the approved direct-check path.
Use branch names in the formtype/short-slug, never work directly ondev, and use imperative conventional commit subjects with an issue or PR reference and no secrets.
Run the applicable local typecheck, lint, format check, tests, architecture checks, Sonar gate, and touched-area gates before claiming a change or pull request is green; report only commands actually executed.
Files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*.{ts,tsx,js,mjs}
📄 CodeRabbit inference engine (AGENTS.md)
Delete dead code instead of commenting it out and do not leave scaffolding or TODOs hiding unfinished branches.
Files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
packages/keiko-model-gateway/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Only
keiko-model-gatewaymay import provider SDKs such asopenai,@anthropic-ai/*, or*-ai-sdk.
Files:
packages/keiko-model-gateway/src/config.ts
packages/**/src/**
⚙️ CodeRabbit configuration file
packages/**/src/**: Enforce ADR-0019 package direction and the owning trust boundary. Flag provider SDK imports
outside keiko-model-gateway, cross-package wire types outside contracts, workspace escape,
raw evidence bodies, silent failures, and parallel subsystems that should extend an owner.
Files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
packages/keiko-ui/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
packages/keiko-ui/**/*.{ts,tsx}: Thekeiko-uiworkspace must enforce the root values for complexity, maximum function length, and explicit function return types; its suppression register may only shrink.
The UI must communicate with the server through shared contract types and must not redeclare governed wire types.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx
**/*.{test,spec}.{ts,tsx,js}
📄 CodeRabbit inference engine (AGENTS.md)
Tests must be hermetic: no real network, shared mutable global state, wall-clock or ordering races, or assumptions that a port is free; await conditions instead of sleeping.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts
**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{test,spec}.{ts,tsx}: Regression tests must fail before the fix and pass afterward; fixtures and mocks must derive expectations through production entry points rather than reimplementing formulas.
Cover empty, boundary, malformed, and hostile inputs, including both branches of every guard added.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts
packages/keiko-ui/**/*.{ts,tsx,css}
📄 CodeRabbit inference engine (AGENTS.md)
When changing UI code or styling, preserve the SHA-pinned visual-proof and accessibility expectations and run the required UI gates.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx
**/*.test.{ts,tsx,mjs}
⚙️ CodeRabbit configuration file
**/*.test.{ts,tsx,mjs}: A behavioral fix needs a failure-first regression proof that fails without the fix. Cover
malformed, hostile, empty, and boundary inputs; never relax a regression pin or duplicate a
production formula inside a fixture.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts
packages/keiko-server/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
The server may use domain packages but must not depend on
keiko-editor; domain packages must not depend on the server.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
🧠 Learnings (5)
📚 Learning: 2026-07-27T10:55:30.485Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2766
File: packages/keiko-server/src/qualityIntelligence/figmaSnapshotRoutes.test.ts:1738-1738
Timestamp: 2026-07-27T10:55:30.485Z
Learning: When reviewing TypeScript files, do not flag single-quoted string literals as a violation if they match Prettier’s formatter-approved output. Specifically, if Prettier is configured to prefer double quotes but retains a single-quoted literal solely because switching to double quotes would require escaping embedded double quotes, allow the single quotes (i.e., don’t “fix” it beyond what Prettier would produce).
Applied to files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-27T18:08:22.461Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2780
File: packages/keiko-server/src/store/migrations.test.ts:78-95
Timestamp: 2026-07-27T18:08:22.461Z
Learning: When reviewing TypeScript lint findings (e.g., from typescript-eslint/no-unsafe-assignment), ensure the issue is reproducible using the repository’s configured ESLint setup/TS project settings. Do not treat diagnostics observed under a mismatched TypeScript project/tsconfig as authoritative; only accept them as real if you can reproduce them with the same ESLint configuration the repo uses (e.g., via its full/targeted lint scripts). In related test code, prefer deriving branded identity types from the production function return types to keep RootIdentity/brand fields type-compatible and avoid unsafe assignments.
Applied to files:
packages/keiko-model-gateway/src/config.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsxpackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-26T21:23:56.288Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2755
File: packages/keiko-server/src/grounded-qa-hybrid.ts:1006-1012
Timestamp: 2026-07-26T21:23:56.288Z
Learning: In Keiko’s internal “stable-ID” hash helper functions (e.g., where stable identifiers are computed for persistence/comparison), preserve the existing UTF-16 code-unit iteration semantics when modernizing. Specifically, if the current implementation iterates with `charCodeAt(i)` (code units) rather than `codePointAt(i)` (Unicode code points), keep `charCodeAt(i)` to avoid changing the resulting stable IDs. If changing from `charCodeAt` to `codePointAt` is ever desired, it must be an explicitly planned compatibility/migration decision (e.g., versioning, backfill, or dual-read/write) rather than a mechanical refactor.
Applied to files:
packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.tspackages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-24T19:25:13.892Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2697
File: packages/keiko-server/src/editor/inlineCompletionRoutes.ts:616-616
Timestamp: 2026-07-24T19:25:13.892Z
Learning: In `packages/keiko-server`, follow ADR-0141 D5’s AppSession/request-authorization model for workspace root resolution. When reviewing code that performs the `resolveRequestRoot`-style authorization gate, ensure it (1) re-proves persisted workspace identity, (2) derives the request root path, (3) enforces canonical realpath containment within the expected workspace/root to prevent path traversal, (4) verifies workspace presence/validity, and (5) requires a live AppSession (launcher-attested, process-scoped authority per BFF). Do not require a task identity for this gate if AppSession does not model task identity; authorization should be uniform and based on the same-user local threat model rather than per-task/per-workspace session semantics.
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-25T18:42:13.123Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2716
File: packages/keiko-tools/src/editor-agent-client.test.ts:692-692
Timestamp: 2026-07-25T18:42:13.123Z
Learning: In Keiko TypeScript test files, do not request explicit return type annotations for callbacks passed to typed Vitest `it(...)` and `it.each(...)`. Specifically, avoid adding `: void` or `: Promise<void>` to those callback functions when the ESLint rule `typescript-eslint/explicit-function-return-type` is configured with `allowTypedFunctionExpressions: true` (i.e., typed function expressions are intentionally exempt). Only ask for explicit return types if the ESLint configuration changes; otherwise preserve the existing surrounding test-file style.
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts
🔇 Additional comments (7)
packages/keiko-model-gateway/src/config.ts (1)
576-603: LGTM!Also applies to: 663-672, 1284-1284
packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.ts (1)
43-44: LGTM!Also applies to: 62-70, 114-119, 620-620, 886-889, 904-904, 959-962, 979-980, 1064-1097, 1109-1109
packages/keiko-ui/src/app/components/desktop/modals/gatewayConfigParsing.test.ts (1)
312-314: LGTM!Also applies to: 330-330, 1068-1076, 1301-1394
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx (1)
596-599: LGTM!Also applies to: 651-709, 730-730, 2226-2228
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.test.tsx (1)
2105-2462: LGTM!packages/keiko-server/src/gateway-setup.ts (1)
308-319: LGTM!Also applies to: 332-357, 466-473, 501-511, 530-530, 1666-1668, 1725-1735, 1900-1942, 2135-2286, 3539-3542, 3646-3646, 3723-3725, 3807-3808, 3922-3978, 3999-4052, 4073-4073, 4131-4164, 4426-4427, 4526-4602, 4732-4737, 4790-4793
packages/keiko-server/src/gateway-setup.test.ts (1)
6125-6860: LGTM!
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0183d44c1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…#3046) Found while pinning the env-completed tuple: the connection probe parsed a provider with NO protocol, so on a server that sets only KEIKO_DEFAULT_ENDPOINT_STYLE the environment turned every probe into an Azure provider with no api version and the canonical pairing rejected EVERY setup request — including one that submitted its own protocol. Four more review findings with it: - The declared protocol pair stays coherent in BOTH directions: a file that declares the version while the environment supplies the style is as valid as the inverse, and clearing either half broke the next rotation. - A dedicated embedding that spoke its own protocol over a shared connection is no longer rebuilt with the setup-wide one. - withFileDeclaredProtocol now runs only inside the successful durable parse, never over the runtime fallback a failed parse returns. - Renamed storedPrimaryOrSelf to storedProviderForModel and moved the capability-reuse comment onto the rule it describes; the generic upload apply moved out of the voice-scoped helper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 21e10890f6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
#3046) Two review findings: - An absent endpoint style and an explicit openai-compatible are the same protocol — the adapter sends the identical request shape — so a same-URL import that merely spells the default out no longer discards verified capability observations. - The deployment requirement follows the EFFECTIVE style: a request that omits the field still lands on the Azure deployment path when KEIKO_DEFAULT_ENDPOINT_STYLE says so, and generic /models discovery fails there exactly the same way. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx (1)
2604-2619: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSplit the comment block so each paragraph sits above the function it describes.
Lines 2604-2609 describe the voice endpoint protocol ("when the file speaks about the voice connection at all, its protocol declaration REPLACES the previous upload's"). That rule belongs to
applyUploadedVoiceEndpointon Line 2621, not toapplyUploadedGenericEndpoint. A reader attributes the voice rule to the generic helper, whose contract is the opposite: the generic helper is file-scoped without exception and never returns early. Move the voice paragraph aboveapplyUploadedVoiceEndpointand keep only the generic paragraph here.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx` around lines 2604 - 2619, Split the comments above applyUploadedGenericEndpoint and applyUploadedVoiceEndpoint: keep only the generic endpoint paragraph above applyUploadedGenericEndpoint, and move the voice protocol paragraph describing replacement when a voice section is present above applyUploadedVoiceEndpoint. Preserve the existing function implementations and comment wording aside from relocating the paragraphs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/keiko-server/src/gateway-setup.test.ts`:
- Around line 6322-6327: Extend the test around the saved provider lookup to
assert that saved?.apiVersion is undefined, alongside the existing endpointStyle
assertion. Keep the assertion focused on the persisted provider after the
gateway update so inherited environment values cannot complete the provider
configuration unnoticed.
---
Outside diff comments:
In `@packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx`:
- Around line 2604-2619: Split the comments above applyUploadedGenericEndpoint
and applyUploadedVoiceEndpoint: keep only the generic endpoint paragraph above
applyUploadedGenericEndpoint, and move the voice protocol paragraph describing
replacement when a voice section is present above applyUploadedVoiceEndpoint.
Preserve the existing function implementations and comment wording aside from
relocating the paragraphs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 499121ae-c0bb-4a17-be10-7daec0b06572
📒 Files selected for processing (3)
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (csharp)
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (11)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript settings, forbidany, require explicit function return types, and model states with discriminated unions rather than casts.
Keep cyclomatic complexity at or below 10, keep functions within 50 non-comment lines, and extract helpers when necessary.
Use the intended logger or diagnostic sink instead ofconsole.*in product code.
Validate hostile inputs before processing, fail closed at trust boundaries, and never route generated or model-produced code around the sandbox egress boundary.
Do not swallow errors with empty catches; surface sufficient diagnostic context, including a correlation ID for server-visible opaque 500 errors.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*.{ts,tsx,js,mjs,json}
📄 CodeRabbit inference engine (AGENTS.md)
Use Prettier formatting: 2-space indentation, double quotes, semicolons, 100-column width, trailing commas, and LF endings.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Use English in code, comments, identifiers, documentation, commit messages, issues, and pull requests.
Respect the inward dependency direction:keiko-contractsis the leaf,keiko-securitydepends only on contracts, and cross-package types belong in contracts.
Inspect and reuse existing helpers, contracts, and subsystems; do not create parallel workspace, graph, policy, evidence, memory, connector, workflow, or UI subsystems without a documented capability gap.
Keep manifests, audit exports, diagnostics, logs, configuration, tests, and evidence redacted: never expose secrets, keys, raw content, endpoints, PII, memory bodies, or customer data.
Never weaken trust boundaries, evidence redaction, governance gates, required checks, or authority limits to make a change pass; fail closed.
Never directly push todev, force-push, bypass required checks, dismiss findings to obtain green status, or merge outside the approved direct-check path.
Use branch names in the formtype/short-slug, never work directly ondev, and use imperative conventional commit subjects with an issue or PR reference and no secrets.
Run the applicable local typecheck, lint, format check, tests, architecture checks, Sonar gate, and touched-area gates before claiming a change or pull request is green; report only commands actually executed.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*.{ts,tsx,js,mjs}
📄 CodeRabbit inference engine (AGENTS.md)
Delete dead code instead of commenting it out and do not leave scaffolding or TODOs hiding unfinished branches.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
packages/keiko-server/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
The server may use domain packages but must not depend on
keiko-editor; domain packages must not depend on the server.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
**/*.{test,spec}.{ts,tsx,js}
📄 CodeRabbit inference engine (AGENTS.md)
Tests must be hermetic: no real network, shared mutable global state, wall-clock or ordering races, or assumptions that a port is free; await conditions instead of sleeping.
Files:
packages/keiko-server/src/gateway-setup.test.ts
**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{test,spec}.{ts,tsx}: Regression tests must fail before the fix and pass afterward; fixtures and mocks must derive expectations through production entry points rather than reimplementing formulas.
Cover empty, boundary, malformed, and hostile inputs, including both branches of every guard added.
Files:
packages/keiko-server/src/gateway-setup.test.ts
packages/**/src/**
⚙️ CodeRabbit configuration file
packages/**/src/**: Enforce ADR-0019 package direction and the owning trust boundary. Flag provider SDK imports
outside keiko-model-gateway, cross-package wire types outside contracts, workspace escape,
raw evidence bodies, silent failures, and parallel subsystems that should extend an owner.
Files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
**/*.test.{ts,tsx,mjs}
⚙️ CodeRabbit configuration file
**/*.test.{ts,tsx,mjs}: A behavioral fix needs a failure-first regression proof that fails without the fix. Cover
malformed, hostile, empty, and boundary inputs; never relax a regression pin or duplicate a
production formula inside a fixture.
Files:
packages/keiko-server/src/gateway-setup.test.ts
packages/keiko-ui/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
packages/keiko-ui/**/*.{ts,tsx}: Thekeiko-uiworkspace must enforce the root values for complexity, maximum function length, and explicit function return types; its suppression register may only shrink.
The UI must communicate with the server through shared contract types and must not redeclare governed wire types.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx
packages/keiko-ui/**/*.{ts,tsx,css}
📄 CodeRabbit inference engine (AGENTS.md)
When changing UI code or styling, preserve the SHA-pinned visual-proof and accessibility expectations and run the required UI gates.
Files:
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx
🧠 Learnings (5)
📚 Learning: 2026-07-24T19:25:13.892Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2697
File: packages/keiko-server/src/editor/inlineCompletionRoutes.ts:616-616
Timestamp: 2026-07-24T19:25:13.892Z
Learning: In `packages/keiko-server`, follow ADR-0141 D5’s AppSession/request-authorization model for workspace root resolution. When reviewing code that performs the `resolveRequestRoot`-style authorization gate, ensure it (1) re-proves persisted workspace identity, (2) derives the request root path, (3) enforces canonical realpath containment within the expected workspace/root to prevent path traversal, (4) verifies workspace presence/validity, and (5) requires a live AppSession (launcher-attested, process-scoped authority per BFF). Do not require a task identity for this gate if AppSession does not model task identity; authorization should be uniform and based on the same-user local threat model rather than per-task/per-workspace session semantics.
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-25T18:42:13.123Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2716
File: packages/keiko-tools/src/editor-agent-client.test.ts:692-692
Timestamp: 2026-07-25T18:42:13.123Z
Learning: In Keiko TypeScript test files, do not request explicit return type annotations for callbacks passed to typed Vitest `it(...)` and `it.each(...)`. Specifically, avoid adding `: void` or `: Promise<void>` to those callback functions when the ESLint rule `typescript-eslint/explicit-function-return-type` is configured with `allowTypedFunctionExpressions: true` (i.e., typed function expressions are intentionally exempt). Only ask for explicit return types if the ESLint configuration changes; otherwise preserve the existing surrounding test-file style.
Applied to files:
packages/keiko-server/src/gateway-setup.test.ts
📚 Learning: 2026-07-26T21:23:56.288Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2755
File: packages/keiko-server/src/grounded-qa-hybrid.ts:1006-1012
Timestamp: 2026-07-26T21:23:56.288Z
Learning: In Keiko’s internal “stable-ID” hash helper functions (e.g., where stable identifiers are computed for persistence/comparison), preserve the existing UTF-16 code-unit iteration semantics when modernizing. Specifically, if the current implementation iterates with `charCodeAt(i)` (code units) rather than `codePointAt(i)` (Unicode code points), keep `charCodeAt(i)` to avoid changing the resulting stable IDs. If changing from `charCodeAt` to `codePointAt` is ever desired, it must be an explicitly planned compatibility/migration decision (e.g., versioning, backfill, or dual-read/write) rather than a mechanical refactor.
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-27T10:55:30.485Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2766
File: packages/keiko-server/src/qualityIntelligence/figmaSnapshotRoutes.test.ts:1738-1738
Timestamp: 2026-07-27T10:55:30.485Z
Learning: When reviewing TypeScript files, do not flag single-quoted string literals as a violation if they match Prettier’s formatter-approved output. Specifically, if Prettier is configured to prefer double quotes but retains a single-quoted literal solely because switching to double quotes would require escaping embedded double quotes, allow the single quotes (i.e., don’t “fix” it beyond what Prettier would produce).
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
📚 Learning: 2026-07-27T18:08:22.461Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2780
File: packages/keiko-server/src/store/migrations.test.ts:78-95
Timestamp: 2026-07-27T18:08:22.461Z
Learning: When reviewing TypeScript lint findings (e.g., from typescript-eslint/no-unsafe-assignment), ensure the issue is reproducible using the repository’s configured ESLint setup/TS project settings. Do not treat diagnostics observed under a mismatched TypeScript project/tsconfig as authoritative; only accept them as real if you can reproduce them with the same ESLint configuration the repo uses (e.g., via its full/targeted lint scripts). In related test code, prefer deriving branded identity types from the production function return types to keep RootIdentity/brand fields type-compatible and avoid unsafe assignments.
Applied to files:
packages/keiko-server/src/gateway-setup.test.tspackages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsxpackages/keiko-server/src/gateway-setup.ts
🔇 Additional comments (4)
packages/keiko-ui/src/app/components/desktop/modals/GatewaySetupDialog.tsx (1)
2226-2228: LGTM!Also applies to: 2519-2523, 2671-2673
packages/keiko-server/src/gateway-setup.ts (2)
325-329: LGTM!Also applies to: 338-369, 476-483, 873-893, 1438-1467, 2154-2214, 2282-2320, 4540-4562, 4572-4614, 4772-4786, 4801-4801, 4838-4838
4584-4614: 🩺 Stability & AvailabilityNo change needed.
parseProviderConfigrejects definedapiVersionwhenendpointStyleis notazure-openai-deployment, so an orphan version cannot reachfileDeclaredProtocol.packages/keiko-server/src/gateway-setup.test.ts (1)
6330-6373: LGTM!Also applies to: 6375-6419, 6421-6445, 6447-6495
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d86302b7ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
#3046) Comparing the durable view against the raw submitted fields read a file that declares nothing while KEIKO_DEFAULT_* resolves Azure as "unchanged" when the request explicitly switched to openai-compatible, so observations made over the deployment path survived onto a different request shape. Both sides are now the effective protocol: the statement if there is one, else the declared value, else what the environment already resolves the provider to — which keeps a plain rotation comparing equal. The env-default override pin also asserts the environment adds no api version to a provider it was told not to apply to. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
|
…3048) Both branches grew the same client-side endpoint identity independently. Resolved to ONE helper: the generic gateway and the audio endpoint are compared by the same server rule, so they are compared by the same rule here. 254 modals tests and 241 server tests green on the merged tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Summary
An uploaded LiteLLM config states
endpointStyle: "openai-compatible"explicitly, and the upload parser tolerated it — butGatewayConfigUploadFieldscould not carry it, so on a server runningKEIKO_DEFAULT_ENDPOINT_STYLE=azure-openai-deploymentthe rebuilt providers resolved the environment default over the file's own statement. A reported upload success, then every request in the wrong URL shape (Codex finding on #3042, deferred there).The protocol now travels end to end, mirroring the voice endpoint fields added on #3037:
endpointStyle/apiVersionon the setup request: enum-parsed, inherited from the stored primary only while the connection stays on the SAME endpoint, carried into the candidate probe so the URL shape is exercised as it will persist, and written verbatim onto rebuilt generic providers.KEIKO_DEFAULT_API_VERSIONapplies only where an api version is meaningful (the Azure deployment style). A style-blind global default made every explicitlyopenai-compatibleprovider on an Azure-default server fail the pairing rule; per-model and file values stay authoritative and still fail loudly.invalid). Only an unknown style keeps theunsupportedSettingrefusal.outputTokenParameterremains refused on generic providers (it is not silently dropped today) — noted, not expanded.Reuse / No-Duplication
No new mechanism: the fields follow the voice endpoint pattern (parse → canonical validation → verbatim persistence → URL-bound dialog state) that #3037 established, and the parser reuses the existing uniform-scalar machinery.
Verification
tsc -bacross three packages, repo ESLint, keiko-ui workspace lint, prettier,npm run gates:sonarPASS, gitleaks clean overorigin/dev..HEAD.Update-Impact
Behavioral: an explicit endpoint style in an uploaded config survives a server-side default; an Azure file keeps its deployment path. No wire-format break — the fields are optional and absent submissions behave exactly as before.
🤖 Generated with Claude Code