Repository navigation
Conversation
Studio tells users to export VERYFRONT_API_KEY, which the CLI does not read. whoami, login and the commands that need a credential now say so instead of a bare 'Not logged in'. Fixes veryfront/veryfront-issue-inbox#4220
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
📦 Client bundle boundary
A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in |
|
@codex review |
|
Score: 82/100. Small, well-scoped fix that names
Overall this is ready after the docblock move. The extra tests are optional. Generated by Claude Code |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
They pushed the sanitizer opt-out count over its baseline (342 > 340) and the tests pass without them.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cc64523e4e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| * variable the CLI does read instead of a bare "Not logged in". | ||
| */ | ||
| export function misnamedApiKeyHint(): string | undefined { | ||
| if (!getEnv("VERYFRONT_API_KEY") || getEnv("VERYFRONT_API_TOKEN")) return undefined; |
There was a problem hiding this comment.
When a checkout contains VERYFRONT_API_KEY in its .env, CLI startup loads that repository-controlled value into getEnv, so this condition presents it as though the user exported it and instructs them to copy the same value into the trusted VERYFRONT_API_TOKEN variable. Following that guidance before a push or deploy can authenticate as the repository author's account and upload the checkout to a project they control. Check getEnvSource("VERYFRONT_API_KEY") and only recommend reusing the value when it came from the process environment; for env-file values, do not suggest promoting the credential.
Useful? React with 👍 / 👎.
| * variable the CLI does read instead of a bare "Not logged in". | ||
| */ | ||
| export function misnamedApiKeyHint(): string | undefined { | ||
| if (!getEnv("VERYFRONT_API_KEY") || getEnv("VERYFRONT_API_TOKEN")) return undefined; |
There was a problem hiding this comment.
When VERYFRONT_API_TOKEN_FILE supplies a credential and VERYFRONT_API_KEY is also set, a rejected file credential reaches this helper with the literal VERYFRONT_API_TOKEN variable unset, so whoami, up, and JSON login output recommend setting that variable to the API key. That recovery cannot work because environment configuration resolves the token file ahead of VERYFRONT_API_TOKEN on the next invocation as well. Base this check on the resolved credential inputs, or suppress the hint and identify the token file when it is the effective credential source.
Useful? React with 👍 / 👎.
Skip the hint when the key came from a project .env, or when VERYFRONT_API_TOKEN_FILE supplies the credential.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6529730b8f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| * suggested as the user's own credential. A token file, when set, is the | ||
| * effective credential, and setting the variable would not change that. | ||
| */ | ||
| export function misnamedApiKeyHint(): string | undefined { |
There was a problem hiding this comment.
When veryfront init --deploy --json runs with only a process-supplied VERYFRONT_API_KEY, ensureAuthenticated() intentionally emits nothing in JSON mode and init-command.ts constructs its own AUTH_REQUIRED_DEPLOY_MESSAGE, so this helper is never used and the resulting envelope still says only Authentication required for --deploy. Apply the hint when constructing that caller's deployment failure as well.
AGENTS.md reference: AGENTS.md:L20-L25
Useful? React with 👍 / 👎.
| const originalKey = Deno.env.get("VERYFRONT_API_KEY"); | ||
| const originalToken = Deno.env.get("VERYFRONT_API_TOKEN"); | ||
| try { | ||
| Deno.env.set("VERYFRONT_API_KEY", "vf_misnamed_key"); | ||
| Deno.env.delete("VERYFRONT_API_TOKEN"); |
There was a problem hiding this comment.
When the test process already has VERYFRONT_API_TOKEN_FILE set, misnamedApiKeyHint() suppresses the hint by design, but this fixture only saves and clears VERYFRONT_API_TOKEN. Consequently both new assertions fail on authenticated developer or CI environments that supply credentials through a token file. Save, delete, and restore VERYFRONT_API_TOKEN_FILE alongside the other credential variables.
Useful? React with 👍 / 👎.
| export function misnamedApiKeyHint(): string | undefined { | ||
| if (!getEnv("VERYFRONT_API_KEY")) return undefined; | ||
| if (getEnvSource("VERYFRONT_API_KEY").source !== "process") return undefined; | ||
| if (getEnv("VERYFRONT_API_TOKEN") || getEnv("VERYFRONT_API_TOKEN_FILE")) return undefined; |
There was a problem hiding this comment.
When an exported VERYFRONT_API_KEY exists alongside a stored-login or veryfront.json credential, a transient network or service failure leaves that credential in place but makes whoami and JSON up reach this helper. Because it checks only the two token environment variables, the output incorrectly recommends replacing the credential with the API key even though authentication could not be verified due to availability. Base the hint on the resolved candidate sources or suppress it when validation failed without rejecting the existing credential.
AGENTS.md reference: AGENTS.md:L20-L25
Useful? React with 👍 / 👎.
The hint now stays out when a stored login or veryfront.json token is the credential that failed, and init --deploy --json carries it in its deployment failure message. Config hint tests clear the token-file variable.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dfabc36519
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const candidates = await resolveApiCredentialCandidatesForAuth(env, projectDir); | ||
| return candidates.length > 0; |
There was a problem hiding this comment.
When a project .env steers the API URL and the user has both a stored login and an exported VERYFRONT_API_KEY, resolveApiCredentialCandidatesForAuth() deliberately filters out the token-store candidate, so this helper concludes that no credential is configured and whoami, login, and up recommend copying the API key into VERYFRONT_API_TOKEN. That recovery cannot work because the same repository-host trust rule will filter the new token too. Check the unfiltered configured credential sources, or suppress the hint for a repository-steered host. Fresh evidence beyond the prior retained-credential report is this trust-filtered candidate path.
AGENTS.md reference: AGENTS.md:L26-L28
Useful? React with 👍 / 👎.
That host filters out the user's own credentials, so copying the key into VERYFRONT_API_TOKEN would not help.
|
@codex review |
The fixture's operator API base outranks veryfront.json, so the old test never steered the host.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a0b4563b2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| ): Promise<string | undefined> { | ||
| if (!getEnv("VERYFRONT_API_KEY")) return undefined; | ||
| if (getEnvSource("VERYFRONT_API_KEY").source !== "process") return undefined; | ||
| if (getEnv("VERYFRONT_API_TOKEN") || getEnv("VERYFRONT_API_TOKEN_FILE")) return undefined; |
There was a problem hiding this comment.
When VERYFRONT_API_TOKEN contains only whitespace and a valid process-supplied VERYFRONT_API_KEY is present, this check suppresses the new hint even though resolveApiCredentialCandidates() trims the token and treats it as absent. Authentication therefore fails with the generic message in exactly the configuration where the API-key recovery guidance is needed; trim the token before deciding it is configured, or rely on the resolved candidate set.
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5c9089f36
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| env: EnvironmentConfig = getEnvironmentConfig(), | ||
| projectDir: string = cwd(), | ||
| ): Promise<string | undefined> { | ||
| if (!getEnv("VERYFRONT_API_KEY")) return undefined; |
There was a problem hiding this comment.
When VERYFRONT_API_KEY is exported as whitespace and no credential is configured, this truthiness check treats it as a usable key, so every new authentication error recommends setting VERYFRONT_API_TOKEN to the same whitespace value. The credential resolver trims that copied value and still treats it as absent, making the recovery guidance ineffective; trim the API-key value before deciding to show the hint.
Useful? React with 👍 / 👎.
| // would filter a newly exported VERYFRONT_API_TOKEN the same way. | ||
| const configFile = await readConfigJsonFile(projectDir); | ||
| const trust = resolveApiUrlTrust(env, configFile, join(projectDir, "veryfront.json")); | ||
| if (trust.repositorySteered) return true; |
There was a problem hiding this comment.
When a project's veryfront.json sets a non-default apiUrl but no apiToken, this blanket branch suppresses the hint even if an exported VERYFRONT_API_KEY is the only credential. Unlike the env-file-steered case, resolveApiCredentialCandidatesForAuth() deliberately validates shell and token-store credentials against the environment-derived URL and retains them for config-file steering, so exporting VERYFRONT_API_TOKEN would make whoami and login succeed; preserve the suppression for steeringEnvFile, but do not apply it to config-file steering on those authentication surfaces.
AGENTS.md reference: AGENTS.md:L26-L28
Useful? React with 👍 / 👎.
…steering Shell credentials still validate against the operator host when only veryfront.json names an apiUrl, so exporting VERYFRONT_API_TOKEN works there and the hint applies.
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
With only VERYFRONT_API_KEY set (the name Studio's key page prints), missing-auth messages now name VERYFRONT_API_TOKEN instead of a bare "Not logged in".
misnamedApiKeyHint()incli/auth/login.ts, used bywhoami(human and JSON),login's non-interactive paths,resolveConfig*(push/pull and other commands) andup.Fixes veryfront/veryfront-issue-inbox#4220