feat!: rename credentials mode "auth0" to "oauth" - #188
Conversation
Breaking change to ~/.arkor/credentials.json: the OAuth login path now tags credentials with mode: "oauth" instead of the vendor-named mode: "auth0". No migration from the old value is provided; in the worst case an OAuth user recovers by re-running `arkor login --oauth`, which rewrites the credentials file with the new tag. Renamed alongside the tag value for consistency: - public SDK type Auth0Credentials -> OAuthCredentials - telemetry authMode / auth_mode value "auth0" -> "oauth" - AUTH0_MISSING_STATE_MESSAGE -> OAUTH_MISSING_STATE_MESSAGE - Studio header identity label auth0 -> oauth - docs (EN/JA): cli/auth, concepts/project-structure, studio/overview, sdk/overview References to the Auth0 vendor itself are unchanged: the persisted auth0Domain field, core/auth0.ts, PKCE / token-exchange error copy, and JWT sub fixtures (auth0|user-123) in tests.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
WalkthroughThe change replaces Auth0-specific credential terminology with OAuth terminology across credential types, persisted mode values, telemetry, project-state errors, Studio handling, tests, and English/Japanese documentation. ChangesOAuth credential migration
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/arkorThe overall coverage remains at 99%, unchanged from the TypeScript / code-coverage/create-arkorThe overall coverage remains at 56%, unchanged from the TypeScript / code-coverage/cli-internalThe overall coverage remains at 97%, unchanged from the TypeScript / code-coverage/studio-appThe overall coverage remains at 53%, unchanged from the Updated |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
![drift-check[bot]](https://avatars.githubusercontent.com/in/4198242?s=60&v=4){kind=small}
There was a problem hiding this comment.
Documentation drift
Code Review Bot flagged 1 possible documentation drift(s). These are advisory.
AGENTS.md(info):The code changes rename the authentication mode 'auth0' to 'oauth' in the Studio app's API and UI logic, but the documentation doesn't explicitly mention this specific string, so it's a minor terminology drift. However, since this is a change in a core concept (Auth0 -> OAuth), it's worth noting if the documentation ever references Auth0. Looking at the provided AGENTS.md, it doesn't mention Auth0, but the change is a conceptual shift in the codebase. Wait, the prompt asks if the CURRENT documentation is inaccurate. AGENTS.md does not mention 'auth0' or 'oauth'. Therefore, it is not inaccurate.
Results are for commit 5028ccb. On newer commits, the bot's summary comment reflects the latest run.
Code Review BotDocumentation driftFound 1 possible documentation drift(s) — see the bot's latest pull request review for details. These are advisory. Reviewed 26 file(s); skipped 0. |
Greptile SummaryThis PR renames the OAuth credential mode from
Confidence Score: 5/5The changed flow looks mergeable after small cleanup for legacy credential diagnostics.
packages/studio-app/src/components/layout/IdentityChip.tsx; packages/arkor/src/core/telemetry.ts
|
| Filename | Overview |
|---|---|
| packages/arkor/src/core/credentials.ts | Renames the OAuth credential interface and discriminator to OAuthCredentials and mode: "oauth". |
| packages/arkor/src/core/auth0.ts | Updates the Auth0-backed PKCE exchange wrapper to persist the new OAuth mode string. |
| packages/arkor/src/core/telemetry.ts | Updates telemetry mode values to oauth, with a remaining legacy credential misclassification path. |
| packages/arkor/src/index.ts | Replaces the public Auth0Credentials type export with OAuthCredentials. |
| packages/arkor/src/core/projectState.ts | Renames the OAuth missing-state constant while keeping the same non-anonymous guard behavior. |
| packages/arkor/src/studio/server.ts | Updates the renamed missing-state import and keeps passing credential mode values through to the SPA. |
| packages/studio-app/src/lib/api.ts | Updates the Studio credentials type to the new oauth discriminator. |
| packages/studio-app/src/components/layout/IdentityChip.tsx | Updates the Studio identity label to show oauth, with a remaining legacy credential display mismatch. |
Prompt To Fix All With AI
Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 2
packages/studio-app/src/components/layout/IdentityChip.tsx:46
**Legacy OAuth Sessions Look Anonymous**
When Studio reads an existing credentials file with `mode: "auth0"`, `/api/credentials` passes that mode through while still using the OAuth access token. This branch treats every non-`oauth` mode as anonymous, so an upgraded OAuth user can be shown as `anonymous` until they re-run login.
```suggestion
const modeLabel = creds.mode === "anon" ? "anonymous" : "oauth";
```
### Issue 2 of 2
packages/arkor/src/core/telemetry.ts:138-142
**Legacy OAuth Telemetry Becomes None**
Existing `mode: "auth0"` credentials still have the OAuth `accessToken` shape, but this check skips them and falls through to `authMode: "none"`. Upgraded OAuth users can therefore emit unauthenticated telemetry until they re-run `arkor login --oauth`.
Reviews (1): Last reviewed commit: "feat!: rename credentials mode "auth0" t..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| ); | ||
| } | ||
| const modeLabel = creds.mode === "auth0" ? "auth0" : "anonymous"; | ||
| const modeLabel = creds.mode === "oauth" ? "oauth" : "anonymous"; |
There was a problem hiding this comment.
When Studio reads an existing credentials file with mode: "auth0", /api/credentials passes that mode through while still using the OAuth access token. This branch treats every non-oauth mode as anonymous, so an upgraded OAuth user can be shown as anonymous until they re-run login.
| const modeLabel = creds.mode === "oauth" ? "oauth" : "anonymous"; | |
| const modeLabel = creds.mode === "anon" ? "anonymous" : "oauth"; |
Prompt To Fix With AI
This is a comment left during a code review.
Path: packages/studio-app/src/components/layout/IdentityChip.tsx
Line: 46
Comment:
**Legacy OAuth Sessions Look Anonymous**
When Studio reads an existing credentials file with `mode: "auth0"`, `/api/credentials` passes that mode through while still using the OAuth access token. This branch treats every non-`oauth` mode as anonymous, so an upgraded OAuth user can be shown as `anonymous` until they re-run login.
```suggestion
const modeLabel = creds.mode === "anon" ? "anonymous" : "oauth";
```
How can I resolve this? If you propose a fix, please make it concise.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
| if (creds?.mode === "oauth") { | ||
| const sub = decodeJwtSub(creds.accessToken); | ||
| if (sub) return { distinctId: sub, authMode: "auth0" }; | ||
| return { distinctId: readOrCreateTelemetryId(), authMode: "auth0" }; | ||
| if (sub) return { distinctId: sub, authMode: "oauth" }; | ||
| return { distinctId: readOrCreateTelemetryId(), authMode: "oauth" }; | ||
| } |
There was a problem hiding this comment.
Existing mode: "auth0" credentials still have the OAuth accessToken shape, but this check skips them and falls through to authMode: "none". Upgraded OAuth users can therefore emit unauthenticated telemetry until they re-run arkor login --oauth.
Prompt To Fix With AI
This is a comment left during a code review.
Path: packages/arkor/src/core/telemetry.ts
Line: 138-142
Comment:
**Legacy OAuth Telemetry Becomes None**
Existing `mode: "auth0"` credentials still have the OAuth `accessToken` shape, but this check skips them and falls through to `authMode: "none"`. Upgraded OAuth users can therefore emit unauthenticated telemetry until they re-run `arkor login --oauth`.
How can I resolve this? If you propose a fix, please make it concise.![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/arkor/src/core/auth0.ts`:
- Line 4: Handle legacy mode: "auth0" credentials in readCredentials() or
ensureCredentials(): detect the stale discriminant before credentials flow
through unchanged, then either migrate them to the current credential shape or
explicitly reject them with a clear message instructing the user to log in
again.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ce573d91-3d9f-44c7-9ab2-93cef9a3f007
📒 Files selected for processing (26)
docs/cli/auth.mdxdocs/concepts/project-structure.mdxdocs/ja/cli/auth.mdxdocs/ja/concepts/project-structure.mdxdocs/ja/sdk/overview.mdxdocs/ja/studio/overview.mdxdocs/sdk/overview.mdxdocs/studio/overview.mdxpackages/arkor/README.mdpackages/arkor/src/cli/commands/login.test.tspackages/arkor/src/cli/commands/whoami.test.tspackages/arkor/src/core/auth0.test.tspackages/arkor/src/core/auth0.tspackages/arkor/src/core/client.test.tspackages/arkor/src/core/credentials.test.tspackages/arkor/src/core/credentials.tspackages/arkor/src/core/projectState.test.tspackages/arkor/src/core/projectState.tspackages/arkor/src/core/telemetry.test.tspackages/arkor/src/core/telemetry.tspackages/arkor/src/index.tspackages/arkor/src/studio/server.test.tspackages/arkor/src/studio/server.tspackages/studio-app/src/components/layout/IdentityChip.tsxpackages/studio-app/src/lib/api.tspackages/studio-app/src/pages/Endpoints.tsx
📜 Review details
⏰ Context from checks skipped due to timeout. (176)
- GitHub Check: CodeRabbit
- GitHub Check: install · yarn-berry · macos-latest · node 24.0.0
- GitHub Check: install · pnpm-9 · windows-latest · node 24.0.0
- GitHub Check: install · npm · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-9 · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-9 · windows-latest · node >=22.22.0 <23
- GitHub Check: install · pnpm-10 · windows-latest · node 22.22.0
- GitHub Check: install · bun · windows-latest · node >=22.22.0 <23
- GitHub Check: install · bun · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-11 · windows-latest · node 22.22.0
- GitHub Check: install · yarn-berry · windows-latest · node >=22.22.0 <23
- GitHub Check: install · yarn-berry · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-11 · windows-latest · node >=22.22.0 <23
- GitHub Check: install · yarn · windows-latest · node 22.22.0
- GitHub Check: install · yarn · ubuntu-latest · node 26.0.0
- GitHub Check: install · npm · ubuntu-latest · node >=24.12.0 <25
- GitHub Check: install · yarn · ubuntu-latest · node >=24.12.0 <25
- GitHub Check: install · yarn · ubuntu-latest · node 24.12.0
- GitHub Check: install · yarn · ubuntu-latest · node 24.0.0
- GitHub Check: install · bun · ubuntu-latest · node >=24.12.0 <25
- GitHub Check: install · yarn-berry · ubuntu-latest · node 24.12.0
- GitHub Check: install · pnpm-9 · ubuntu-latest · node 24.0.0
- GitHub Check: install · pnpm-11 · ubuntu-latest · node 24.12.0
- GitHub Check: install · npm · ubuntu-latest · node 24.0.0
- GitHub Check: install · yarn-berry · ubuntu-latest · node >=22.22.0 <23
- GitHub Check: install · bun · ubuntu-latest · node 24.0.0
- GitHub Check: install · npm · ubuntu-latest · node >=22.22.0 <23
- GitHub Check: install · pnpm-11 · ubuntu-latest · node 22.22.0
- GitHub Check: install · pnpm-10 · ubuntu-latest · node >=22.22.0 <23
- GitHub Check: install · pnpm-10 · ubuntu-latest · node 24.0.0
- GitHub Check: install · pnpm-10 · ubuntu-latest · node 22.22.0
- GitHub Check: install · pnpm-9 · ubuntu-latest · node 22.22.0
- GitHub Check: install · pnpm-11 · ubuntu-latest · node >=22.22.0 <23
- GitHub Check: install · yarn · ubuntu-latest · node 22.22.0
- GitHub Check: install · npm · ubuntu-latest · node 22.22.0
- GitHub Check: Seer Code Review
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.10.0 <24.12.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=26.0.0 <27
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.12.0 <25
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.1.0 <24.3.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.10.0 <24.12.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.5.0 <24.8.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.3.0 <24.5.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node 26.0.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=22.22.0 <23
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.12.0 <25
- GitHub Check: typecheck · lint · test · build · macos-latest · node 22.22.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.5.0 <24.8.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node 24.12.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.8.0 <24.10.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.3.0 <24.5.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.0.0 <24.1.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.8.0 <24.10.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=22.22.0 <23
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.1.0 <24.3.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node 24.12.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.0.0 <24.1.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=26.0.0 <27
- GitHub Check: typecheck · lint · test · build · windows-latest · node 26.0.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.12.0 <25
- GitHub Check: typecheck · lint · test · build · windows-latest · node 22.22.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.1.0 <24.3.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.10.0 <24.12.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.5.0 <24.8.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.3.0 <24.5.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node 24.12.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.0.0 <24.1.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=26.0.0 <27
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node 26.0.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=22.22.0 <23
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.8.0 <24.10.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node 22.22.0
- GitHub Check: coverage · upload to Codecov
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: install · bun · macos-latest · node 26.0.0
- GitHub Check: install · yarn · macos-latest · node >=26.0.0 <27
- GitHub Check: install · npm · macos-latest · node >=26.0.0 <27
- GitHub Check: install · pnpm-11 · macos-latest · node >=26.0.0 <27
- GitHub Check: install · npm · macos-latest · node 26.0.0
- GitHub Check: install · pnpm-10 · macos-latest · node >=26.0.0 <27
- GitHub Check: install · yarn-berry · macos-latest · node 26.0.0
- GitHub Check: install · pnpm-11 · macos-latest · node 26.0.0
- GitHub Check: install · pnpm-9 · macos-latest · node 26.0.0
- GitHub Check: install · bun · macos-latest · node >=24.12.0 <25
- GitHub Check: install · pnpm-11 · macos-latest · node >=24.12.0 <25
- GitHub Check: install · yarn · macos-latest · node >=24.12.0 <25
- GitHub Check: install · bun · macos-latest · node 24.12.0
- GitHub Check: install · bun · macos-latest · node 24.0.0
- GitHub Check: install · yarn · macos-latest · node 22.22.0
- GitHub Check: install · yarn · macos-latest · node 24.0.0
- GitHub Check: install · pnpm-9 · macos-latest · node 24.12.0
- GitHub Check: install · yarn · macos-latest · node 24.12.0
- GitHub Check: install · pnpm-10 · macos-latest · node 22.22.0
- GitHub Check: install · pnpm-11 · windows-latest · node >=26.0.0 <27
- GitHub Check: install · yarn-berry · windows-latest · node >=26.0.0 <27
- GitHub Check: install · yarn-berry · macos-latest · node 22.22.0
- GitHub Check: install · npm · windows-latest · node >=26.0.0 <27
- GitHub Check: install · yarn · windows-latest · node 26.0.0
- GitHub Check: install · bun · windows-latest · node >=26.0.0 <27
- GitHub Check: install · bun · macos-latest · node 22.22.0
- GitHub Check: install · yarn · windows-latest · node >=26.0.0 <27
- GitHub Check: install · pnpm-9 · windows-latest · node >=26.0.0 <27
- GitHub Check: install · yarn-berry · windows-latest · node 26.0.0
- GitHub Check: install · npm · windows-latest · node >=24.12.0 <25
- GitHub Check: install · pnpm-9 · windows-latest · node 26.0.0
- GitHub Check: install · pnpm-10 · windows-latest · node >=26.0.0 <27
- GitHub Check: install · pnpm-10 · windows-latest · node 26.0.0
- GitHub Check: install · pnpm-11 · windows-latest · node >=24.12.0 <25
- GitHub Check: install · yarn · windows-latest · node >=24.12.0 <25
- GitHub Check: install · bun · windows-latest · node >=24.12.0 <25
- GitHub Check: install · npm · windows-latest · node 26.0.0
- GitHub Check: install · pnpm-11 · windows-latest · node 26.0.0
- GitHub Check: install · npm · windows-latest · node 24.12.0
- GitHub Check: install · pnpm-9 · windows-latest · node >=24.12.0 <25
- GitHub Check: install · bun · windows-latest · node 24.12.0
- GitHub Check: install · pnpm-10 · windows-latest · node >=24.12.0 <25
- GitHub Check: install · npm · windows-latest · node 24.0.0
- GitHub Check: install · pnpm-11 · windows-latest · node 24.12.0
- GitHub Check: install · bun · windows-latest · node 24.0.0
- GitHub Check: install · pnpm-10 · windows-latest · node 24.12.0
- GitHub Check: install · yarn-berry · windows-latest · node 24.12.0
- GitHub Check: install · yarn-berry · windows-latest · node 24.0.0
- GitHub Check: install · pnpm-9 · windows-latest · node 24.12.0
- GitHub Check: install · pnpm-10 · windows-latest · node 24.0.0
- GitHub Check: install · pnpm-11 · windows-latest · node 24.0.0
- GitHub Check: install · yarn · windows-latest · node 24.0.0
- GitHub Check: install · yarn · windows-latest · node 24.12.0
- GitHub Check: install · npm · windows-latest · node >=22.22.0 <23
- GitHub Check: install · npm · windows-latest · node 22.22.0
- GitHub Check: install · yarn · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-9 · windows-latest · node 22.22.0
- GitHub Check: install · yarn-berry · windows-latest · node >=22.22.0 <23
- GitHub Check: install · pnpm-11 · windows-latest · node >=22.22.0 <23
- GitHub Check: install · yarn · windows-latest · node >=22.22.0 <23
- GitHub Check: install · pnpm-10 · windows-latest · node >=22.22.0 <23
- GitHub Check: install · yarn-berry · windows-latest · node 22.22.0
- GitHub Check: install · bun · windows-latest · node >=22.22.0 <23
- GitHub Check: install · pnpm-9 · windows-latest · node 24.0.0
- GitHub Check: install · pnpm-11 · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-10 · windows-latest · node 22.22.0
- GitHub Check: install · pnpm-9 · windows-latest · node >=22.22.0 <23
- GitHub Check: install · bun · windows-latest · node 22.22.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node 26.0.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.10.0 <24.12.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.8.0 <24.10.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node 24.12.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.5.0 <24.8.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node 24.12.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.1.0 <24.3.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.5.0 <24.8.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=22.22.0 <23
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=22.22.0 <23
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.10.0 <24.12.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node 26.0.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=24.0.0 <24.1.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node 24.12.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node >=22.22.0 <23
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.10.0 <24.12.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.8.0 <24.10.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=26.0.0 <27
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.1.0 <24.3.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.1.0 <24.3.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.5.0 <24.8.0
- GitHub Check: typecheck · lint · test · build · macos-latest · node 22.22.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node 22.22.0
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.12.0 <25
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.3.0 <24.5.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=26.0.0 <27
- GitHub Check: typecheck · lint · test · build · windows-latest · node >=24.0.0 <24.1.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.0.0 <24.1.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.12.0 <25
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node 26.0.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.3.0 <24.5.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node >=24.8.0 <24.10.0
- GitHub Check: typecheck · lint · test · build · ubuntu-latest · node 22.22.0
- GitHub Check: coverage · upload to Codecov
🧰 Additional context used
📓 Path-based instructions (8)
docs/**/*.{mdx,md}
📄 CodeRabbit inference engine (AGENTS.md)
If you edit English docs under
docs/, update the corresponding Japanese mirror underdocs/ja/in the same change.
Files:
docs/studio/overview.mdxdocs/sdk/overview.mdxdocs/ja/concepts/project-structure.mdxdocs/ja/sdk/overview.mdxdocs/cli/auth.mdxdocs/concepts/project-structure.mdxdocs/ja/cli/auth.mdxdocs/ja/studio/overview.mdx
**/*.mdx
📄 CodeRabbit inference engine (AGENTS.md)
Do not assume GitHub-style heading slugging in Mintlify docs; verify rendered heading ids before adding or changing cross-page anchor links.
Files:
docs/studio/overview.mdxdocs/sdk/overview.mdxdocs/ja/concepts/project-structure.mdxdocs/ja/sdk/overview.mdxdocs/cli/auth.mdxdocs/concepts/project-structure.mdxdocs/ja/cli/auth.mdxdocs/ja/studio/overview.mdx
**
⚙️ CodeRabbit configuration file
**: # Arkor Development GuideNote: Claude Code automatically loads this file.
Repository shape
pnpm + Turbo monorepo. Workspaces are declared in
pnpm-workspace.yaml(packages/*,e2e/*,examples/*,docs).
Path Role packages/arkor Published arkorSDK + CLI + bundled local Studio server (Hono).bin/arkor→dist/bin.mjs. Library entry →dist/index.mjs.packages/create-arkor Published create-arkorscaffolder (pnpm create arkor).packages/cli-internal Private workspace package. Source is bundled into arkorandcreate-arkorvia tsdown'sdeps.alwaysBundle. Never appears as a runtime dependency on npm.packages/studio-app Private Vite + React 19 SPA. pnpm --filter@arkor/studio-appbundlebuilds it;packages/arkor/scripts/copy-studio-assets.mjscopiesdist/intopackages/arkor/dist/assets/.e2e/cli Private vitest suite that spawns the built dist/bin.mjsof both CLIs in temp dirs.e2e/studio Private Playwright suite that spawns arkor devagainst an in-process fake cloud-api and drives the Studio SPA in Chromium.examples/doc-drift Private use-case example: documentation drift check against an Arkor deployment (zero-dependency script + copy-me workflow). docs Mintlify sources for docs.arkor.ai. Common commands
Root scripts fan out via Turbo (which respects
^builddeps in turbo.json):pnpm install pnpm build # turbo run build across all packages pnpm typecheck # tsc --noEmit across all packages pnpm lint # oxlint --deny-warnings, then strict ESLint 10 (single root config each) pnpm format # oxfmt --write across the repo (config in oxfmt.config.ts) pnpm format:check # oxfmt --check; CI gates on this (no wri...
Files:
docs/studio/overview.mdxpackages/arkor/src/index.tspackages/studio-app/src/lib/api.tspackages/arkor/src/core/client.test.tsdocs/sdk/overview.mdxdocs/ja/concepts/project-structure.mdxpackages/arkor/src/core/auth0.test.tspackages/studio-app/src/pages/Endpoints.tsxdocs/ja/sdk/overview.mdxpackages/arkor/src/cli/commands/whoami.test.tspackages/studio-app/src/components/layout/IdentityChip.tsxdocs/cli/auth.mdxpackages/arkor/src/core/projectState.test.tsdocs/concepts/project-structure.mdxpackages/arkor/README.mdpackages/arkor/src/core/auth0.tspackages/arkor/src/core/projectState.tsdocs/ja/cli/auth.mdxpackages/arkor/src/core/credentials.tspackages/arkor/src/cli/commands/login.test.tspackages/arkor/src/core/telemetry.tspackages/arkor/src/studio/server.tspackages/arkor/src/studio/server.test.tsdocs/ja/studio/overview.mdxpackages/arkor/src/core/credentials.test.tspackages/arkor/src/core/telemetry.test.ts
packages/arkor/src/**/*.{ts,mts,cts}
📄 CodeRabbit inference engine (AGENTS.md)
When touching the Studio server or SPA fetch layer, preserve the token-in-header flow for
fetch, thestudioTokenquery parameter forEventSource, the host-header allow-list, no CORS, and timing-safe token comparison.
Files:
packages/arkor/src/index.tspackages/arkor/src/core/client.test.tspackages/arkor/src/core/auth0.test.tspackages/arkor/src/cli/commands/whoami.test.tspackages/arkor/src/core/projectState.test.tspackages/arkor/src/core/auth0.tspackages/arkor/src/core/projectState.tspackages/arkor/src/core/credentials.tspackages/arkor/src/cli/commands/login.test.tspackages/arkor/src/core/telemetry.tspackages/arkor/src/studio/server.tspackages/arkor/src/studio/server.test.tspackages/arkor/src/core/credentials.test.tspackages/arkor/src/core/telemetry.test.ts
packages/**/*.{js,jsx,ts,tsx,mjs,cjs}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Avoid using the em dash character (U+2014) in comments, string literals, and template literals in any package file; this includes CLI runtime messages, generated-file template bodies, and test names.
Files:
packages/arkor/src/index.tspackages/studio-app/src/lib/api.tspackages/arkor/src/core/client.test.tspackages/arkor/src/core/auth0.test.tspackages/studio-app/src/pages/Endpoints.tsxpackages/arkor/src/cli/commands/whoami.test.tspackages/studio-app/src/components/layout/IdentityChip.tsxpackages/arkor/src/core/projectState.test.tspackages/arkor/src/core/auth0.tspackages/arkor/src/core/projectState.tspackages/arkor/src/core/credentials.tspackages/arkor/src/cli/commands/login.test.tspackages/arkor/src/core/telemetry.tspackages/arkor/src/studio/server.tspackages/arkor/src/studio/server.test.tspackages/arkor/src/core/credentials.test.tspackages/arkor/src/core/telemetry.test.ts
**/*.{js,jsx,ts,tsx,mjs,cjs}
📄 CodeRabbit inference engine (CONTRIBUTING.ja.md)
Do not use em dashes (U+2014) in comments, string literals, or template literals anywhere in the codebase; use colons, periods, commas, parentheses, spaced hyphens (
" - "), or rephrasing instead.
Files:
packages/arkor/src/index.tspackages/studio-app/src/lib/api.tspackages/arkor/src/core/client.test.tspackages/arkor/src/core/auth0.test.tspackages/studio-app/src/pages/Endpoints.tsxpackages/arkor/src/cli/commands/whoami.test.tspackages/studio-app/src/components/layout/IdentityChip.tsxpackages/arkor/src/core/projectState.test.tspackages/arkor/src/core/auth0.tspackages/arkor/src/core/projectState.tspackages/arkor/src/core/credentials.tspackages/arkor/src/cli/commands/login.test.tspackages/arkor/src/core/telemetry.tspackages/arkor/src/studio/server.tspackages/arkor/src/studio/server.test.tspackages/arkor/src/core/credentials.test.tspackages/arkor/src/core/telemetry.test.ts
packages/*/src/**/*.test.ts
📄 CodeRabbit inference engine (AGENTS.md)
Add Vitest tests under
packages/*/src/**/*.test.tsfor SDK/CLI/scaffold logic changes.
Files:
packages/arkor/src/core/client.test.tspackages/arkor/src/core/auth0.test.tspackages/arkor/src/cli/commands/whoami.test.tspackages/arkor/src/core/projectState.test.tspackages/arkor/src/cli/commands/login.test.tspackages/arkor/src/studio/server.test.tspackages/arkor/src/core/credentials.test.tspackages/arkor/src/core/telemetry.test.ts
**/*.md
📄 CodeRabbit inference engine (AGENTS.md)
Do not assume GitHub-style heading slugging in Mintlify docs; verify rendered heading ids before adding or changing cross-page anchor links.
Files:
packages/arkor/README.md
🪛 ast-grep (0.44.1)
packages/arkor/src/studio/server.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔇 Additional comments (27)
docs/cli/auth.mdx (1)
58-58: LGTM!Also applies to: 165-165, 188-188
docs/concepts/project-structure.mdx (1)
88-88: LGTM!docs/ja/cli/auth.mdx (1)
58-58: LGTM!Also applies to: 165-165, 188-188
docs/ja/concepts/project-structure.mdx (1)
81-81: LGTM!docs/ja/studio/overview.mdx (1)
12-12: LGTM!docs/studio/overview.mdx (1)
12-12: LGTM!packages/arkor/src/core/telemetry.ts (1)
86-86: LGTM!Also applies to: 138-141, 154-154
packages/arkor/src/core/telemetry.test.ts (1)
43-43: LGTM!Also applies to: 159-182, 217-232, 247-257, 274-286
packages/arkor/README.md (2)
89-89: LGTM!Also applies to: 160-163
89-89: 📐 Maintainability & Code QualityNo Japanese README mirror here —
packages/arkor/README.ja.mddoes not exist, so there’s nothing to update alongsidepackages/arkor/README.md.> Likely an incorrect or invalid review comment.packages/arkor/src/core/credentials.ts (1)
9-27: LGTM!Also applies to: 38-38, 115-116
packages/studio-app/src/lib/api.ts (1)
5-5: LGTM!packages/arkor/src/core/credentials.test.ts (1)
17-17: LGTM!Also applies to: 73-75, 100-102, 169-176, 191-191, 207-212
packages/arkor/src/cli/commands/whoami.test.ts (2)
226-226: LGTM!Also applies to: 257-257
280-285: Stale "Auth0" wording left in an otherwise-renamed test.Title suffix and mode were renamed to
oauth, but the test description ("uses the Auth0 access token…") and the comment ("auth0-specific token") still use the pre-rename vendor term for what is now a generic OAuth credential field.✏️ Suggested wording fix
- it("uses the Auth0 access token in the bearer header (oauth mode)", async () => { + it("uses the access token in the bearer header (oauth mode)", async () => { // Branch coverage for `creds.mode === "anon" ? creds.token : creds.accessToken`. // The token closure runs lazily on the first request, so the spy must - // observe the auth0-specific token reaching /v1/me. + // observe the oauth-mode token reaching /v1/me.packages/arkor/src/core/projectState.ts (1)
14-30: LGTM!Also applies to: 53-63
packages/arkor/src/core/projectState.test.ts (1)
12-12: LGTM!Also applies to: 24-25, 91-94
packages/arkor/src/index.ts (1)
34-34: LGTM!docs/ja/sdk/overview.mdx (1)
64-64: LGTM!packages/arkor/src/core/client.test.ts (1)
666-666: LGTM!Also applies to: 677-677
packages/arkor/src/core/auth0.test.ts (1)
63-63: LGTM!Also applies to: 72-72
packages/arkor/src/cli/commands/login.test.ts (1)
366-366: LGTM!Also applies to: 433-433, 510-510, 592-592
docs/sdk/overview.mdx (1)
64-64: LGTM!packages/arkor/src/studio/server.ts (1)
24-24: LGTM!Also applies to: 506-541, 661-672, 734-738
packages/arkor/src/studio/server.test.ts (1)
816-816: LGTM!Also applies to: 2067-2075, 2095-2095
packages/studio-app/src/components/layout/IdentityChip.tsx (1)
46-46: LGTM!packages/studio-app/src/pages/Endpoints.tsx (1)
212-212: LGTM!
|
@coderabbitai approve |
✅ Action performedComments resolved and changes approved. |
2 participants
Summary
Renames the OAuth-side identifier in
~/.arkor/credentials.jsonfrom the vendor-namedmode: "auth0"to the protocol-namedmode: "oauth"(ENG-723).Breaking change. No migration from the old value is provided; in the worst case an OAuth user recovers by re-running
arkor login --oauth, which rewrites the credentials file with the new tag.Renamed alongside the tag value
Auth0Credentials→OAuthCredentials(exported fromarkor)authMode/auth_modevalue"auth0"→"oauth"AUTH0_MISSING_STATE_MESSAGE→OAUTH_MISSING_STATE_MESSAGE(message copy unchanged)auth0→oauthcli/auth,concepts/project-structure,studio/overview,sdk/overviewpackages/arkor/README.md: telemetryauth_modeenum and the CLI table rowDeliberately unchanged (Auth0 vendor references, not mode names)
auth0Domainfield and thecore/auth0.tsmodule (PKCE flow against the Auth0 tenant)subfixtures (auth0|user-123) in telemetry testsrunAuth0Login(drives the Auth0-specific PKCE flow, same boundary asauth0.ts)Verification
oxfmt --checkcleandist/bin.mjsand the bundled Studio SPA contain zero mode-levelauth0literals; remainingauth0strings are the vendor contexts listed abovedist/bin.mjs, including the/api/*token and host-header guard contract specsgit grep -i auth0over all tracked files triaged to completion: every surviving occurrence is a deliberate vendor referenceSummary by cubic
Rename the credentials mode from "auth0" to "oauth" across CLI, SDK, Studio, and telemetry to align with protocol naming (ENG-723). This breaks existing
~/.arkor/credentials.json; re-login is required.Refactors
mode: "auth0"→mode: "oauth"; telemetryauthMode/auth_modeupdated to"oauth".Auth0Credentials→OAuthCredentials(exported fromarkor).AUTH0_MISSING_STATE_MESSAGE→OAUTH_MISSING_STATE_MESSAGE; Studio header now showsoauth.auth0Domain,core/auth0.ts, error strings).Migration
OAuthCredentials.arkor login --oauthto rewrite credentials withmode: "oauth".mode: "auth0".Written for commit 5028ccb. Summary will update on new commits.
Summary by CodeRabbit
Documentation
Bug Fixes
oauth.API
OAuthCredentials.