feat(providers): manage provider headers via PATCH and ocx provider edit --headers (#959) - #1033
Conversation
PATCH /api/providers now accepts a headers field, shallow-merged onto the existing block (null or {} clears it), and ocx provider edit gains --headers <json>. Custom providers such as Agent Router can restore required fingerprint headers through the management plane instead of hand-editing config.json. POST /api/providers already round-trips headers; validation reuses providerHeadersConfigError.
- redact --headers values from CLI usage errors so tokens never hit stderr (P1) - merge header blocks case-insensitively so a casing-only PATCH replaces the existing key instead of leaving a combined duplicate for Headers (P2) - restore registry static headers when clearing custom headers so transports like opencode-free keep their client marker (P2) - re-apply the field mask under the config mutation lock immediately before saving so concurrent PATCHes merge instead of clobbering each other (major) - regression tests for redaction, casing merge, static-header clear, and concurrent PATCH persistence
|
Warning Review limit reached
Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2640c44cfe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for (const [key, value] of Object.entries(next.headers ?? {})) { | ||
| if (!incoming.has(key.toLowerCase())) merged[key] = value; | ||
| } | ||
| for (const [key, value] of incoming.values()) merged[key] = value; | ||
| next.headers = merged; |
There was a problem hiding this comment.
When a registry provider whose transport relies on staticHeaders is configured normally (for example opencode-free), the saved config has those headers stripped and enrichProviderFromRegistry only re-adds them while prov.headers is absent. This merge starts from next.headers ?? {}, so PATCH /api/providers?name=opencode-free with { "headers": { "X-Trace": "v" } } persists only the user header; subsequent requests no longer include the required x-opencode-client marker and can be rejected or handled as the wrong upstream tier. Seed or merge the matching registry static headers before adding user-managed headers, or make derivation merge static headers into an existing header block.
AGENTS.md reference: src/AGENTS.md:L18-L18
Useful? React with 👍 / 👎.
| const headersError = providerHeadersConfigError(headersValue); | ||
| if (headersError) return { error: headersError }; |
There was a problem hiding this comment.
When users pass valid JSON through the new --headers/PATCH path but one value is invalid, e.g. {"X-Token":42}, this returns providerHeadersConfigError verbatim; that helper includes the header name in some messages, and runtimeRequest prints the management error to stderr. The CLI redacts parse errors because header names/values can identify tokens or accounts, so this PATCH validation should return a generic/redacted header error instead of echoing the name.
AGENTS.md reference: src/AGENTS.md:L20-L20
Useful? React with 👍 / 👎.
| if (replay.editorTouched) { | ||
| const syncError = providerManagementConfigError(name, replay.next); | ||
| if (syncError) { | ||
| replayError = syncError; | ||
| return; | ||
| } |
There was a problem hiding this comment.
When a PATCH awaits the async destination probe, another provider PATCH can commit a different baseUrl/allowPrivateNetwork before this lock-scoped replay. These lines only rerun synchronous validation on the recombined provider, so an update that was safe with allowPrivateNetwork:true can race with a separately validated allowPrivateNetwork:false PATCH and persist a hostname that resolves to private space without the opt-in; that hostname case is caught only by providerDestinationResolvedError, which no longer runs after replay. Re-run the resolved destination check for the replayed provider, or fail/retry if destination-related fields changed.
AGENTS.md reference: src/AGENTS.md:L20-L20
Useful? React with 👍 / 👎.
#1033 review blocker. The validator already rejects standard credential header names and points at apiKey/authMode, but nothing said so where a user would read it, and a code comment claimed header values 'may contain tokens' — which reads as sanction for exactly the use the validator refuses. Documents the contract in all five locales: --headers is non-secret request metadata; an arbitrary name like X-My-Token cannot be recognized by the validator, so the boundary is the user's to respect; and names the two concrete exposures (the JSON is argv, so it reaches shell history and the process list before any redaction runs, and header values persist in config.json in cleartext unlike API keys). The comment is corrected to say the entry is defensive rather than a supported credential channel.
2 participants
Bug-stack campaign lane (
devlog/_plan/260805_bug_stack_campaign/120). Fixes #959. Adopts PR #961 with contributor authorship preserved plus one hardening slice.From #961 (Yuxin-Qiao, carried commits):
PATCH /api/providersacceptsheaders: shallow case-insensitive merge,null/{}clear, registry static-header preservation, mutation-lock replay, validation reuse (credential headers stay rejected).ocx provider edit --headerswith argument redaction; docs in five locales.Hardening on top:
GET /api/providersexposeshasHeaders(presence only) — header names/values never leave the process; a sentinel serialization test pins GET and PATCH responses.tests/management-provider-validation + cli-headless-parity 61/61;
bun run typecheck0 errors;bun run privacy:scanpass; full suite on ssh lidge 8314/0 (campaign tree).Closes #961.