Conversation
…ec providers, GitHub Copilot /v1/messages, opencode effort tiers, xAI quota handler, ModelAccessModal crash fix Features: - New providers: Forge Workspace (33 models, 3 tiers), TokenRouter (with management key + Quota Tracker), Huancheng (hcnsec), Qwen Cloud + Qwen Cloud Token Plan, Alibaba + Alibaba CN - GitHub Copilot native /v1/messages routing for Claude models (targetFormat:claude, anthropic-version header) - GitHub Copilot model catalog synced to OmniRoute fea1d54 (20 models) - opencode-go effort-tier aliases (9 models) + EFFORT_TIERS table (port of OmniRoute 1843b34) - Qwen3.8 Max Preview on Qwen Web (Subscription) with REQUIRED_THINKING_MODELS Fixes: - C1 Critical: dashboardGuard method-based auth routing (mutations always require JWT/CLI token even when requireLogin=false) - Cline/GLM 500 stream_options (inject stream_options on streaming requests) - HuggingChat HTML 200 (DEFAULT_MODEL omni + preprompt + native fetch) - xAI Quota Tracker empty card (billing API removed; show informative message) - ModelAccessModal crash (Cannot read properties of null (reading 'length')) - TokenRouter quota null plan crash - Playground value/key/object Object crashes (3 separate fixes) Improvements: - SanitizeHtml utility + unit tests - Playground MessageContent markdown renderer - AddApiKeyModal TokenRouter management key field - 8 new provider SVG icons Bumps package.json + cli/package.json to 0.7.4
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughVersion 0.7.4 adds Forge, TokenRouter, Alibaba, Qwen Cloud, and Huancheng providers; updates GitHub, HuggingChat, OpenCode, and Qwen execution; adds TokenRouter quota tracking; hardens API mutations and HTML sanitization; fixes dashboard state handling; and updates release metadata. ChangesProvider catalogs and capability metadata
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant GitHubExecutor
participant GitHubCopilot
Client->>GitHubExecutor: send Claude-targeted model request
GitHubExecutor->>GitHubCopilot: route to messagesUrl with anthropic-version
GitHubExecutor->>GitHubCopilot: preserve Claude-native request body
GitHubCopilot-->>Client: return model response
sequenceDiagram
participant Dashboard
participant UsageService
participant TokenRouter
participant QuotaView
Dashboard->>UsageService: submit TokenRouter credentials
UsageService->>TokenRouter: fetch wallet usage with management key
TokenRouter-->>UsageService: return wallet balances
UsageService->>QuotaView: normalize quota rows
QuotaView-->>Dashboard: display wallet, top-up, and voucher quotas
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
tests/unit/sanitize-html.test.js (1)
41-90: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
process.exit()inside a test file risks killing the shared vitest worker.This file is designed to double as a standalone script and a vitest test, but calling
process.exit(0/1)directly (rather than throwing/expect()-failing) can abort the whole worker process mid-suite when run under vitest, potentially masking or truncating results from other tests sharing that worker.Consider wrapping the cases in real
it.each/expectassertions whensanitizeHtmlis available, and reserving the manualconsole.log/process.exitpath only for the standalone-script fallback.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/unit/sanitize-html.test.js` around lines 41 - 90, Update the test flow around the cases loop so vitest execution uses real it.each/expect assertions when sanitizeHtml is available, allowing failures to be reported through the test framework instead of process.exit. Keep the existing console.log and process.exit behavior only in the standalone-script fallback, and ensure the standalone mode still reports all case results.open-sse/services/usage/xai.js (1)
30-38: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
void U;doesn't actually verify anything.The comment says this "confirms the provider config still exists," but
void Uonly references the imported function object — it never callsU('xai'), so no config lookup happens. It's a no-op that satisfies "unused import" concerns without doing what the comment claims. Either callU('xai')to genuinely validate the provider is registered, or drop the import/comment until it's actually needed.♻️ Suggested tweak
- // Sanity reference — confirms the provider config still exists. Intentionally - // unused for network calls while the handler is in the informational state. - void U; + // Sanity check — confirms the provider config is still registered. + void U("xai");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@open-sse/services/usage/xai.js` around lines 30 - 38, Remove the unused U import and its misleading “Sanity reference” comment from getXaiUsage, since the current void U statement performs no configuration lookup and the handler does not need this validation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@open-sse/providers/registry/github.js`:
- Around line 69-73: Update GithubExecutor.buildUrl() to select responsesUrl
whenever the resolved model’s targetFormat is "openai-responses", while
preserving the existing Claude routing and baseUrl behavior for other formats.
Ensure the GPT entries in the model registry are routed to the Responses
endpoint without changing their metadata.
In `@open-sse/providers/registry/hcnsec.js`:
- Around line 39-45: Update the provider configuration near modelsFetcher to
expose a selectable fallback when discovery fails or returns no models: seed
models with a verified HCNSEC model, or add the repository’s established
free-form/discovery-failure option. Preserve passthroughModels behavior while
ensuring the model picker has at least one usable choice without successful
discovery.
---
Nitpick comments:
In `@open-sse/services/usage/xai.js`:
- Around line 30-38: Remove the unused U import and its misleading “Sanity
reference” comment from getXaiUsage, since the current void U statement performs
no configuration lookup and the handler does not need this validation.
In `@tests/unit/sanitize-html.test.js`:
- Around line 41-90: Update the test flow around the cases loop so vitest
execution uses real it.each/expect assertions when sanitizeHtml is available,
allowing failures to be reported through the test framework instead of
process.exit. Keep the existing console.log and process.exit behavior only in
the standalone-script fallback, and ensure the standalone mode still reports all
case results.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e309bb44-3d9a-4ff8-963b-81ded7c0425f
⛔ Files ignored due to path filters (7)
public/providers/alibaba-cn.svgis excluded by!**/*.svgpublic/providers/alibaba.svgis excluded by!**/*.svgpublic/providers/forge.svgis excluded by!**/*.svgpublic/providers/hcnsec.svgis excluded by!**/*.svgpublic/providers/qwen-cloud-token-plan.svgis excluded by!**/*.svgpublic/providers/qwen-cloud.svgis excluded by!**/*.svgpublic/providers/tokenrouter.svgis excluded by!**/*.svg
📒 Files selected for processing (34)
CHANGELOG.mdcli/package.jsonopen-sse/executors/base.jsopen-sse/executors/github.jsopen-sse/executors/huggingchat.jsopen-sse/executors/opencode-go.jsopen-sse/executors/qwen-web.jsopen-sse/providers/capabilities.jsopen-sse/providers/pricing.jsopen-sse/providers/registry/alibaba-cn.jsopen-sse/providers/registry/alibaba.jsopen-sse/providers/registry/forge.jsopen-sse/providers/registry/github.jsopen-sse/providers/registry/hcnsec.jsopen-sse/providers/registry/huggingchat.jsopen-sse/providers/registry/index.jsopen-sse/providers/registry/opencode-go.jsopen-sse/providers/registry/qwen-cloud-token-plan.jsopen-sse/providers/registry/qwen-cloud.jsopen-sse/providers/registry/qwen-web.jsopen-sse/providers/registry/tokenrouter.jsopen-sse/providers/registry/xai.jsopen-sse/services/usage.jsopen-sse/services/usage/tokenrouter.jsopen-sse/services/usage/xai.jspackage.jsonsrc/app/(dashboard)/dashboard/endpoint/EndpointPageClient.jssrc/app/(dashboard)/dashboard/providers/[id]/AddApiKeyModal.jssrc/app/(dashboard)/dashboard/quota/components/ProviderLimits/index.jssrc/app/(dashboard)/dashboard/quota/components/ProviderLimits/utils.jssrc/dashboardGuard.jssrc/shared/utils/providerIcon.jssrc/shared/utils/sanitizeHtml.jstests/unit/sanitize-html.test.js
| { id: "gpt-5.5", name: "GPT-5.5", targetFormat: "openai-responses", contextWindow: 1050000, maxOutput: 128000 }, | ||
| { id: "gpt-5.4", name: "GPT-5.4", targetFormat: "openai-responses", contextWindow: 1050000, maxOutput: 128000 }, | ||
| { id: "gpt-5.4-mini", name: "GPT-5.4 Mini", targetFormat: "openai-responses", contextWindow: 400000, maxOutput: 128000 }, | ||
| { id: "gpt-5.3-codex", name: "GPT-5.3 Codex", targetFormat: "openai-responses", contextWindow: 400000, maxOutput: 128000 }, | ||
| { id: "gpt-5-mini", name: "GPT-5 Mini", targetFormat: "openai-responses", contextWindow: 264000, maxOutput: 64000 }, |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Route Responses-format models to responsesUrl.
targetFormat: "openai-responses" changes the request shape, but GithubExecutor.buildUrl() only special-cases Claude and otherwise returns baseUrl (/chat/completions). These GPT requests will send a Responses payload to the chat-completions endpoint. Select responsesUrl when the model target format is openai-responses.
Proposed executor update
if (getModelTargetFormat("gh", model) === "claude" && this.config.messagesUrl) {
return this.config.messagesUrl;
}
+if (getModelTargetFormat("gh", model) === "openai-responses" && this.config.responsesUrl) {
+ return this.config.responsesUrl;
+}
return this.config.baseUrl;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@open-sse/providers/registry/github.js` around lines 69 - 73, Update
GithubExecutor.buildUrl() to select responsesUrl whenever the resolved model’s
targetFormat is "openai-responses", while preserving the existing Claude routing
and baseUrl behavior for other formats. Ensure the GPT entries in the model
registry are routed to the Responses endpoint without changing their metadata.
| // Live discovery only — /v1/models exposes whatever the key has access to. | ||
| // Empty seed catalog; passthroughModels allows any model id. | ||
| models: [], | ||
| passthroughModels: true, | ||
| modelsFetcher: { | ||
| url: "https://api.hcnsec.cn/v1/models", | ||
| type: "openai", |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Provide a selectable fallback model when discovery is unavailable.
models: [] leaves this provider with no default model option if /v1/models fails or returns no data. passthroughModels bypasses validation, but the model picker still builds options from registered aliases and custom models. Seed a verified fallback model or provide an explicit free-form/discovery-failure path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@open-sse/providers/registry/hcnsec.js` around lines 39 - 45, Update the
provider configuration near modelsFetcher to expose a selectable fallback when
discovery fails or returns no models: seed models with a verified HCNSEC model,
or add the repository’s established free-form/discovery-failure option. Preserve
passthroughModels behavior while ensuring the model picker has at least one
usable choice without successful discovery.
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. An unexpected error occurred while generating fixes: Request timed out after 1200000ms (requestId=b9c20bd4-a38c-48dd-8059-b3125a554168) |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 2 unresolved review comments. A stacked PR containing fixes has been created.
Time taken: |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. An unexpected error occurred while generating fixes: Request timed out after 1200000ms (requestId=9b955847-103f-48c0-8a94-d03873468345) |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 2 unresolved review comments. A stacked PR containing fixes has been created.
Time taken: |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 2 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
1 participant
…ec providers, GitHub Copilot /v1/messages, opencode effort tiers, xAI quota handler, ModelAccessModal crash fix
Features:
Fixes:
Improvements:
Bumps package.json + cli/package.json to 0.7.4
Summary by CodeRabbit