chore: blocker triage integration lane (2026-03-03)#839
Closed
KooshaPari wants to merge 10 commits intomainfrom
Closed
chore: blocker triage integration lane (2026-03-03)#839KooshaPari wants to merge 10 commits intomainfrom
KooshaPari wants to merge 10 commits intomainfrom
Conversation
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Add shared devops checker/push wrappers and task targets for cliproxyapi++. Add VitePress Ops page describing shared CI/CD behavior and sibling references. Co-authored-by: Codex <noreply@openai.com>
Standardize README, CONTRIBUTING, and docs/help text branding to cliproxyapi-plusplus for consistent project naming. Co-authored-by: Codex <noreply@openai.com>
…<noreply@openai.com>
Includes security guard wiring, docs/policy updates, and auth/runtime triage changes. Residual blocker: Taskfile parsing fails at line 359, so task-based validation is currently blocked. Co-authored-by: Codex <noreply@openai.com>
|
Important Review skippedToo many files! This PR contains 194 files, which is 44 over the limit of 150. ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (194)
You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis PR introduces comprehensive refactoring of authentication infrastructure, security enforcement, and project branding. Changes include security guard hooks and workflows, migration of auth-related modules from internal to pkg/llmproxy paths, a new phenotype-go-auth third-party module with token storage and PKCE support, substantial auth conductor enhancements with orchestration logic, token storage restructuring using a shared BaseTokenStorage pattern, and standardization of project naming and repository references (kooshapari/cliproxyapi-plusplus). Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant SDK as SDK (conductor)
participant AuthMgr as Auth Manager
participant Executor as Provider Executor
participant Auth as Auth (stored)
Client->>SDK: ExecuteStream(providers, request)
SDK->>AuthMgr: pickNextMixed(providers, model)
AuthMgr->>AuthMgr: checkRefreshes()
AuthMgr->>Auth: Load() [if needed]
AuthMgr-->>SDK: selected Auth + Executor
SDK->>Executor: ExecuteStream(auth, request)
Executor-->>SDK: StreamChunk
SDK-->>Client: StreamChunk
Note over AuthMgr: Auto-refresh loop<br/>monitors token expiry,<br/>applies cooldowns,<br/>persists state
sequenceDiagram
participant User
participant GitHub as GitHub OAuth
participant DeviceFlow as Device Flow Client
participant Local as Local OAuth Server
participant API as Copilot API
User->>DeviceFlow: RequestDeviceCode()
DeviceFlow->>API: POST /device_code
API-->>DeviceFlow: device_code, user_code
DeviceFlow-->>User: Display user_code
User->>GitHub: Visit link, authorize
DeviceFlow->>API: Poll /token with device_code
Note over DeviceFlow: Wait for user authorization
GitHub->>API: Confirm authorization
API-->>DeviceFlow: access_token
DeviceFlow->>API: FetchUserInfo(access_token)
API-->>DeviceFlow: username
DeviceFlow-->>User: Authenticated as username
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request establishes a dedicated integration lane for blocker triage, incorporating essential security and quality checks directly into the development workflow. It prepares a previously isolated worktree for review by adding pre-commit hooks for security scanning and code quality, while also refining Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Co-authored-by: Codex <noreply@openai.com>
There was a problem hiding this comment.
Pull request overview
Converts a blocker-triage worktree into a PR branch by removing worktree/local/generated artifacts, and adding governance/security guardrails (Git hooks + CI pre-commit) plus a few runtime/docs tweaks.
Changes:
- Remove large sets of mission templates / generated workflow & prompt files under
.kittify/,.kilocode/,.cursor/, and.github/prompts/. - Add CI “Security Guard” workflows and repo-managed Git hooks to enforce pre-commit/secret scanning.
- Adjust Docker workflow tag deletion behavior and rename app references in
.env.example/ workflow env.
Reviewed changes
Copilot reviewed 109 out of 190 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| .kittify/scripts/tasks/task_helpers.py | Removed legacy shim module (now deleted). |
| .kittify/scripts/tasks/acceptance_support.py | Removed legacy acceptance script entrypoint (now deleted). |
| .kittify/scripts/debug-dashboard-scan.py | Removed debug-only dashboard scan script. |
| .kittify/missions/software-dev/templates/tasks-template.md | Removed software-dev tasks template. |
| .kittify/missions/software-dev/templates/task-prompt-template.md | Removed software-dev task prompt template. |
| .kittify/missions/software-dev/templates/spec-template.md | Removed software-dev spec template. |
| .kittify/missions/software-dev/templates/plan-template.md | Removed software-dev plan template. |
| .kittify/missions/software-dev/mission.yaml | Removed software-dev mission definition. |
| .kittify/missions/software-dev/command-templates/review.md | Removed software-dev review command template. |
| .kittify/missions/software-dev/command-templates/plan.md | Removed software-dev plan command template. |
| .kittify/missions/software-dev/command-templates/implement.md | Removed software-dev implement command template. |
| .kittify/missions/software-dev/command-templates/dashboard.md | Removed software-dev dashboard command template. |
| .kittify/missions/software-dev/command-templates/clarify.md | Removed software-dev clarify command template. |
| .kittify/missions/software-dev/command-templates/analyze.md | Removed software-dev analyze command template. |
| .kittify/missions/software-dev/command-templates/accept.md | Removed software-dev accept command template. |
| .kittify/missions/research/templates/tasks-template.md | Removed research tasks template. |
| .kittify/missions/research/templates/task-prompt-template.md | Removed research task prompt template. |
| .kittify/missions/research/templates/spec-template.md | Removed research spec template. |
| .kittify/missions/research/templates/research/source-register.csv | Removed research source register template CSV. |
| .kittify/missions/research/templates/research/evidence-log.csv | Removed research evidence log template CSV. |
| .kittify/missions/research/templates/research-template.md | Removed research decision log template. |
| .kittify/missions/research/templates/plan-template.md | Removed research plan template. |
| .kittify/missions/research/templates/data-model-template.md | Removed research data model template. |
| .kittify/missions/research/mission.yaml | Removed research mission definition. |
| .kittify/missions/research/command-templates/tasks.md | Removed research tasks command template. |
| .kittify/missions/research/command-templates/specify.md | Removed research specify command template. |
| .kittify/missions/research/command-templates/review.md | Removed research review command template. |
| .kittify/missions/research/command-templates/plan.md | Removed research plan command template. |
| .kittify/missions/research/command-templates/implement.md | Removed research implement command template. |
| .kittify/missions/documentation/templates/tasks-template.md | Removed documentation tasks template. |
| .kittify/missions/documentation/templates/task-prompt-template.md | Removed documentation task prompt template. |
| .kittify/missions/documentation/templates/spec-template.md | Removed documentation spec template. |
| .kittify/missions/documentation/templates/release-template.md | Removed documentation release template. |
| .kittify/missions/documentation/templates/generators/sphinx-conf.py.template | Removed Sphinx conf template. |
| .kittify/missions/documentation/templates/generators/jsdoc.json.template | Removed JSDoc config template. |
| .kittify/missions/documentation/templates/divio/tutorial-template.md | Removed Divio tutorial template. |
| .kittify/missions/documentation/templates/divio/reference-template.md | Removed Divio reference template. |
| .kittify/missions/documentation/templates/divio/howto-template.md | Removed Divio how-to template. |
| .kittify/missions/documentation/templates/divio/explanation-template.md | Removed Divio explanation template. |
| .kittify/missions/documentation/mission.yaml | Removed documentation mission definition. |
| .kittify/missions/documentation/command-templates/tasks.md | Removed documentation tasks command template. |
| .kittify/missions/documentation/command-templates/specify.md | Removed documentation specify command template. |
| .kittify/metadata.yaml | Removed generated spec-kitty metadata file. |
| .kittify/.dashboard | Removed local dashboard state file. |
| .kilocode/workflows/spec-kitty.status.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.review.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.research.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.plan.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.implement.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.dashboard.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.clarify.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.analyze.md | Removed generated workflow doc. |
| .kilocode/workflows/spec-kitty.accept.md | Removed generated workflow doc. |
| .github/workflows/security-guard.yml | Added CI workflow to run pre-commit checks. |
| .github/workflows/security-guard-hook-audit.yml | Added CI workflow to verify repo-managed Git hooks execute. |
| .github/workflows/docker-image.yml | Adjusted env + hardened Docker Hub tag deletion behavior. |
| .github/scripts/security-guard.sh | Added local script for ggshield + optional codespell pass. |
| .github/prompts/spec-kitty.status.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.review.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.research.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.plan.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.implement.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.dashboard.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.clarify.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.analyze.prompt.md | Removed generated prompt file. |
| .github/prompts/spec-kitty.accept.prompt.md | Removed generated prompt file. |
| .github/hooks/security-guard.sh | Added repo-managed pre-commit hook runner. |
| .github/hooks/pre-commit | Added repo-managed pre-commit hook entrypoint. |
| .github/copilot-instructions.md | Removed Copilot instructions file. |
| .env.example | Updated app naming in comment header. |
| .cursorignore | Removed Cursor ignore config. |
| .cursor/commands/spec-kitty.status.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.review.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.research.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.plan.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.implement.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.dashboard.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.clarify.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.analyze.md | Removed generated Cursor command doc. |
| .cursor/commands/spec-kitty.accept.md | Removed generated Cursor command doc. |
| .coderabbit.yaml | Added CodeRabbit review configuration. |
| .claudeignore | Removed Claude ignore config. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| env: | ||
| APP_NAME: CLIProxyAPI | ||
| APP_NAME: cliproxyapi++ |
There was a problem hiding this comment.
APP_NAME contains ++, which is invalid in common Docker/OCI naming contexts (and often gets reused in tags/labels/artifact names). This is likely to break image naming/tagging or any script that assumes [a-z0-9._-]+. Use a Docker-safe identifier (e.g., cliproxyapi-plus or cliproxyapi) and keep any “++” branding only in human-facing docs.
Suggested change
| APP_NAME: cliproxyapi++ | |
| APP_NAME: cliproxyapi-plus |
| @@ -1,4 +1,4 @@ | |||
| # Example environment configuration for CLIProxyAPI. | |||
| # Example environment configuration for cliproxyapi++. | |||
There was a problem hiding this comment.
The cliproxyapi++ rename in the example header will drift from tooling/config expectations if the project still uses the existing DockerHub repo slug cli-proxy-api-plus / prior CLIProxyAPI naming elsewhere. Consider aligning this comment with the canonical app/repo identifier used in build/publish tooling (or adding a short note mapping “branding name” to “artifact-safe name”).
Suggested change
| # Example environment configuration for cliproxyapi++. | |
| # Example environment configuration for cli-proxy-api-plus (CLIProxyAPI). |
.github/scripts/security-guard.sh
Outdated
Comment on lines
+21
to
+28
| changed_files=$(git diff --cached --name-only --diff-filter=ACM || true) | ||
| if [ -z "${changed_files}" ]; then | ||
| changed_files=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true) | ||
| fi | ||
|
|
||
| if [ -n "${changed_files}" ]; then | ||
| echo "[security-guard] Running optional codespell fast pass" | ||
| echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | xargs -r codespell -q 2 -L "hte,teh" || true |
There was a problem hiding this comment.
This pipeline is not portable and can mis-handle filenames: xargs -r is not supported on macOS/BSD, and piping newline-delimited paths through grep | xargs will break on paths with spaces. Prefer using NUL-delimited output (git diff --name-only -z) and xargs -0, or iterate in a while IFS= read -r loop; also avoid relying on -r for correctness.
Suggested change
| changed_files=$(git diff --cached --name-only --diff-filter=ACM || true) | |
| if [ -z "${changed_files}" ]; then | |
| changed_files=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true) | |
| fi | |
| if [ -n "${changed_files}" ]; then | |
| echo "[security-guard] Running optional codespell fast pass" | |
| echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | xargs -r codespell -q 2 -L "hte,teh" || true | |
| diff_cmd=() | |
| # Prefer staged changes; fall back to the last commit if there are none. | |
| if git diff --cached --name-only --diff-filter=ACM --quiet >/dev/null 2>&1; then | |
| # No staged changes (or unable to diff); try last commit range. | |
| if ! git diff --name-only HEAD~1..HEAD --quiet >/dev/null 2>&1; then | |
| diff_cmd=(git diff --name-only -z HEAD~1..HEAD) | |
| fi | |
| else | |
| # There are staged changes to check. | |
| diff_cmd=(git diff --cached --name-only --diff-filter=ACM -z) | |
| fi | |
| if [ "${#diff_cmd[@]}" -ne 0 ]; then | |
| echo "[security-guard] Running optional codespell fast pass" | |
| files=() | |
| "${diff_cmd[@]}" | while IFS= read -r -d '' path; do | |
| case "$path" in | |
| *.md|*.txt|*.py|*.ts|*.tsx|*.js|*.go|*.rs|*.kt|*.java|*.yaml|*.yml) | |
| files+=("$path") | |
| ;; | |
| esac | |
| done | |
| if [ "${#files[@]}" -gt 0 ]; then | |
| codespell -q 2 -L "hte,teh" "${files[@]}" || true | |
| fi |
Comment on lines
+12
to
+14
| echo "pre-commit executable not found; trying to install via pip" | ||
| python -m pip install --quiet pre-commit | ||
| PRE_COMMIT="pre-commit" |
There was a problem hiding this comment.
Auto-installing pre-commit from inside a Git hook modifies the user environment unexpectedly and may pull unpinned dependencies at commit time. Safer behavior is to fail with a clear instruction (e.g., “install pre-commit via pipx/uv/pip in your venv”) or install into a controlled toolchain (like uv tool run / pipx run) rather than performing an implicit global install.
Suggested change
| echo "pre-commit executable not found; trying to install via pip" | |
| python -m pip install --quiet pre-commit | |
| PRE_COMMIT="pre-commit" | |
| echo "pre-commit executable not found." >&2 | |
| echo "Please install it before committing, for example:" >&2 | |
| echo " - In your virtualenv: python -m pip install pre-commit" >&2 | |
| echo " - Or with pipx: pipx install pre-commit" >&2 | |
| echo "After installation, re-run your commit." >&2 | |
| exit 1 |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces several changes related to development workflow and tooling, including adding configuration for CodeRabbit, pre-commit hooks for security scanning, and updating the .gitignore file. My review focuses on the new shell scripts and the .gitignore changes. I've identified a potential bug in the security-guard.sh script related to handling filenames with spaces, and a redundant entry in the .gitignore file. Addressing these points will improve the robustness and maintainability of the new scripts and configurations.
.github/scripts/security-guard.sh
Outdated
|
|
||
| if [ -n "${changed_files}" ]; then | ||
| echo "[security-guard] Running optional codespell fast pass" | ||
| echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | xargs -r codespell -q 2 -L "hte,teh" || true |
There was a problem hiding this comment.
The current use of xargs will not correctly handle filenames that contain spaces, because xargs splits its input on whitespace by default. This can result in codespell either failing or not scanning the intended files. To make this script more robust, you should use a method that correctly handles spaces in file paths, such as using null-delimited streams.
Suggested change
| echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | xargs -r codespell -q 2 -L "hte,teh" || true | |
| echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | tr '\n' '\0' | xargs -0 -r codespell -q 2 -L "hte,teh" || true |
| .roo/ | ||
| .amazonq/ | ||
| .github/copilot/ | ||
| .kittify/.dashboard |
There was a problem hiding this comment.
This entry .kittify/.dashboard is redundant because of the more general .kittify/ entry on line 75. To keep the .gitignore file clean and avoid confusion, it's best to remove this redundant line.
KooshaPari
added a commit
that referenced
this pull request
Mar 3, 2026
- reconcile PR #839 with current main content and path moves - apply CodeRabbit/Copilot requested hardening updates - keep release-prep remediation scoped to touched files in this lane Co-authored-by: Codex <noreply@openai.com>
KooshaPari
had a problem deploying
to
github-pages
GitHub Actions
Failure
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
KooshaPari
had a problem deploying
to
github-pages
GitHub Actions
Failure
KooshaPari
had a problem deploying
to
github-pages
GitHub Actions
Failure
Owner
Author
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
KooshaPari
added
the
ci:coderabbit-bypass
github-actions
bot
removed
the
ci:coderabbit-bypass
coderabbitai
bot
added
HELIOS-CODEX
github-actions
bot
removed
the
ci:coderabbit-bypass
KooshaPari
added
the
ci:coderabbit-bypass
github-actions
bot
removed
the
ci:coderabbit-bypass
Owner
Author
|
@coderabbitai review |
KooshaPari
added
the
ci:coderabbit-bypass
✅ Actions performedReview triggered.
|
github-actions
bot
removed
the
ci:coderabbit-bypass
KooshaPari
force-pushed
the
chore/blocker-triage-canonical-dirty-20260303
branch
from
5ab71fd to
319f6d3
Compare
Owner
Author
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
Owner
Author
|
Status update: I’m treating this as the canonical blocker-lane PR for cliproxy right now. Current blocker is true branch conflict (CONFLICTING/DIRTY) after upstream drift plus a live branch rewrite during prior cleanup runs. I’m not proceeding with a risky history rewrite here; next step is to close/rebase this lane from a clean PR branch that includes only non-conflicting 839 deltas, then rerun checks. 838 appears to be a likely duplicate of earlier policy-federation lane and can be closed once 839 is reconstituted. |
Owner
Author
|
Closing this stale blocker-triage lane: it now has very large structural drift (196 files, 20k+ deletions) and is conflict-heavy against current main. Please reopen as a clean replay PR if any remaining deltas are still needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
task quality:fmt-staged:checkcannot run becauseTaskfile.ymlparse fails (line 359)Residual Blockers
Taskfile.ymlsyntax error before task-driven quality gates can executeSummary by CodeRabbit
Release Notes
New Features
Bug Fixes
Documentation
Refactor
Chores