Skip to content

fix(models): enforce pending selection write guards - #3645

Merged
lidge-jun merged 3 commits into
devfrom
codex/provider-selection-pending-write-fence
Sep 5, 2026
Merged

fix(models): enforce pending selection write guards#3645
lidge-jun merged 3 commits into
devfrom
codex/provider-selection-pending-write-fence

Conversation

@lidge-jun

@lidge-jun lidge-jun commented Sep 5, 2026

Copy link
Copy Markdown
Owner

Summary

  • Follow up the valid late review findings on feat(onboarding): guide registrations to model selection #3636: reject preset and selected-model edits while initial discovery is pending, matching the existing visibility-write 409 response.

  • Preserve existing authentication and input-validation order, and preserve ready/legacy editing behavior.

  • Clarify that the confirmation dialog lets the user open Models. Keep the existing Claude Desktop production filter; add a regression proving that pending candidates are already excluded.

  • Preserve permanent JSON/provider/mode/preset-support validation before the pending-state conflict. Add explicit unsupported-provider and validation-precedence regressions.

  • Document the PUT 409 code and discovery-retry contract in English and all seven directly translated management API references.

Verification

  • Production TypeScript and isolated typechecking of both regression files passed; git diff --check passed.
  • Independent static plan and whole-diff reviews passed with no blockers. No local test suites were run.
  • Added 25 write cases: 5 pending rejection cases, 10 ready/legacy positive cases, 3 unsupported-provider state cases, and 7 permanent-validation precedence cases, including actual selection/marker outcomes and unchanged pending memory/disk state.
  • The Desktop regression uses an actual 20-row pending inventory and calls the shared state builder; no redundant production filtering was added.
  • Final candidate bb05473 needs fresh exact-head hosted CI before the user-authorized admin merge. The previous 3c4ff93 CI is historical only. Documentation build completed successfully (425 pages). Previous CI success is not reused as proof for this patch.

Checklist

  • Scope stays focused and avoids unrelated cleanup.
  • Docs or release notes were updated when needed.
  • Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults; existing auth and validation precede the new state guards.

Summary by CodeRabbit

  • Behavior Changes

    • Model preset and selected-model updates are temporarily unavailable while initial model discovery is pending.
    • Attempts to change selections during this period receive a conflict response and do not modify configuration.
    • Models from a provider still undergoing initial setup are not exposed through the Claude Desktop model endpoint.
  • Documentation

    • Documented model-selection and model-preset management endpoints, including pending-state errors and retry guidance.
    • Updated registration guidance clarifies that users can open the Models page after GUI registration or OAuth login.

t added 2 commits September 5, 2026 18:52
Close the valid late review findings from #3636. Preserve authentication and validation order, test pending rejection plus ready/legacy updates, and prove the existing Claude Desktop pending filter without adding a redundant production path. Clarify that opening Models is a user action.
@lidge-jun
lidge-jun requested a review from Ingwannu as a code owner September 5, 2026 10:01
@github-actions github-actions Bot added the bug Something isn't working label Sep 5, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 5, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-05T10:05:32.478615Z 3c4ff93 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Deterministic PR hygiene checks passed.

@lidge-jun

Copy link
Copy Markdown
Owner Author

리뷰 · 우선순위 73 / 80

설명

이 PR은 방금 dev에 올라간 #3636(등록·로그인 뒤 모델 선택으로 안내)과 #3626(큰 카탈로그면 초기엔 스위치 OFF, 제공자는 ACTIVE) 흐름을 이어서 막는 쓰기 구멍을 닫습니다. 지금 HEAD(cfe95eea0)의 src/server/management/model-routes.ts를 보면, /api/model-visibility PUT만 initialModelSelectionPending일 때 409와 code: "initial_model_selection_pending"으로 거절합니다. 같은 파일의 /api/model-presets PUT과 /api/selected-models PUT은 아직 그 울타리가 없어서, 초기 조회가 끝나기 전에 프리셋·선택 목록을 바꿔 디스크에 쓸 수 있었습니다. GUI Models 화면은 이미 selectionPending일 때 프리셋·일괄 토글·개별 스위치를 꺼 두지만, CLI(src/cli/models-runtime.ts, provider-runtime.ts)와 직접 API 호출은 그 보호가 없습니다. 그래서 서버에서 같은 409로 맞추는 것이 이번 패치의 핵심입니다.

변경은 작습니다. 프리셋 PUT은 provider·mode 검증 뒤에, 선택 목록 PUT은 provider 존재 확인 뒤에 initialModelSelectionPending을 보고, 보이기 쓰기와 같은 문구·같은 code로 409를 돌려줍니다. ready·legacy(마커 없음)는 예전처럼 200으로 바뀝니다. 문서 한 줄은 확인 창이 Models를 “연다”가 아니라 “열 수 있게 한다”로 고쳐 #3636 리뷰 지적을 반영합니다. Claude Desktop 쪽은 새 필터를 넣지 않고, 이미 shared state builder가 pending 후보를 빼는지 회귀 테스트만 추가합니다. 새 파일 tests/providers/initial-selection-write-fence.test.ts는 pending에서 5가지 쓰기(프리셋 all/custom/preset, 선택 목록 채우기/비우기)가 메모리·디스크를 안 건드리는지, ready/legacy는 정상 반영되는지 직접 확인합니다. 레이아웃 JSON에 테스트 배치도 맞춰 두었습니다.

지금 dev가 최적화하는 방향(등록 직후 초기 모델 선택, 대용량 카탈로그 안전 시작)과 바로 맞물리는 후속이라 점수는 높게 잡았습니다. 범위도 좁고, 인증·입력 검증 순서를 건드리지 않으며, 프로덕션 Desktop 필터를 중복으로 넣지 않은 점도 좋습니다. 다만 PR 본문대로 이 커밋 기준 호스트 CI가 아직 pending이라, 초록이 확인되기 전에는 병합하지 않는 편이 맞습니다. gates·hygiene 등은 이미 통과했지만 test/macos/npm-global windows 조각은 기다리는 중입니다.

라인 844-846 - /api/model-presets PUT에 pending 울타리를 visibility와 같은 409/initial_model_selection_pending으로 넣음. mode 검증 뒤라 잘못된 mode는 여전히 400이 먼저 나옴.
라인 910-912 - /api/selected-models PUT에도 동일 울타리. provider 확인 뒤·models 배열 처리 전이라, pending이면 본문을 파싱하기 전에 거절함(기존 동작과 충돌 없음).
docs-site/.../providers.md - “opens the Models page” → “lets you open the Models page”. 확인 창이 자동으로 여는 게 아니라 사용자가 연다는 뜻을 맞춤.
tests/providers/initial-selection-write-fence.test.ts - pending 5건 거절(메모리·디스크 불변) + ready/legacy 10건 정상 쓰기. 실제 handleManagementAPI 경로를 탐.
tests/providers/initial-model-selection.test.ts - /api/claude-desktop이 pending vendor 경로를 안 내보내는지 회귀. 프로덕션 필터를 새로 넣지 않음.
scripts/test-layout/layout.json · fixtures - 새 테스트 파일을 providers 버킷에 등록.

메인테이너의 판단이 필요한 지점

  • /api/disabled-models PUT은 여전히 pending 울타리가 없음. 전역 차단 목록이라 의도적일 수 있으나, 초기 조회 중에 전역 disabled를 바꾸면 초기 선택 재조정과 겹칠 수 있음. 이번 PR 범위 밖으로 둘지, 후속으로 막을지.
  • GUI는 이미 프리셋 버튼을 selectionPending일 때 끄지만, CLI는 서버 409에만 의존함. CLI에 pending 전용 안내 문구를 넣을지는 제품 취향.
  • PR 본문: “Fresh exact-head hosted CI required”. test/macos 조각이 아직 pending — 초록 전에 admin merge 할지, 기다릴지.

너의 추천
CI(특히 test */4, macos, npm-global windows)가 초록이면 바로 merge. #3636 직후 구멍 막기라 dev 방향과 충돌 없고, 닫거나 리베이스할 이유가 없음. CI 실패 시 fence 테스트·레이아웃만 손보고 다시 올리면 됨. disabled-models 울타리는 별 이슈/후속으로 남겨도 됨.

이 댓글은 grok-bot이 작성했습니다

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c4ff93973

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/server/management/model-routes.ts
Comment thread src/server/management/model-routes.ts
@coderabbitai

coderabbitai Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: f2fe22c1-6bcb-42ad-80f6-fa09a2ce15f2

📥 Commits

Reviewing files that changed from the base of the PR and between 3c4ff93 and bb05473.

📒 Files selected for processing (10)
  • docs-site/src/content/docs/fr/reference/management-api.md
  • docs-site/src/content/docs/ja/reference/management-api.md
  • docs-site/src/content/docs/ko/reference/management-api.md
  • docs-site/src/content/docs/reference/management-api.md
  • docs-site/src/content/docs/ru/reference/management-api.md
  • docs-site/src/content/docs/tr/reference/management-api.md
  • docs-site/src/content/docs/zh-cn/reference/management-api.md
  • docs-site/src/content/docs/zh-tw/reference/management-api.md
  • src/server/management/model-routes.ts
  • tests/providers/initial-selection-write-fence.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.


📝 Walkthrough

Walkthrough

The change adds a write fence for pending initial model discovery. Model preset and selected-model updates return HTTP 409 until discovery completes. Tests cover pending, ready, legacy, and validation states. Management API documentation describes the new endpoint and error behavior.

Changes

Initial model selection write fence

Layer / File(s) Summary
Reject writes during pending discovery
src/server/management/model-routes.ts
Model preset updates validate preset availability before materialization. Preset and selected-model updates return 409 initial_model_selection_pending while initial model discovery is pending.
Validate selection states and preserve state
tests/providers/initial-selection-write-fence.test.ts, tests/providers/initial-model-selection.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json
Tests cover pending, ready, legacy, invalid-input, and unsupported-preset cases. Pending writes leave memory, disk, and provider state unchanged. Claude Desktop excludes models routed through the pending provider. Test-layout mappings include the new suite.
Document API and registration behavior
docs-site/src/content/docs/reference/configuration/providers.md, docs-site/src/content/docs/*/reference/management-api.md
The documentation describes GET, PUT /api/model-presets, the pending-selection conflict for both model-selection endpoints, and refreshing model discovery before retrying. Registration guidance states that users can choose to open the Models page.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to bb054

Model-selection writes now return the documented conflict response until initial discovery is ready, without changing saved state; normal ready and legacy editing behavior remains covered.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ManagementAPI
  participant ModelRoutes
  participant Config
  Client->>ManagementAPI: PUT model preset or selected model
  ManagementAPI->>ModelRoutes: Dispatch management request
  ModelRoutes->>Config: Validate input and check discovery status
  Config-->>ModelRoutes: Pending, ready, or legacy
  alt Pending
    ModelRoutes-->>Client: 409 initial_model_selection_pending
  else Ready or legacy
    ModelRoutes->>Config: Apply model selection update
    ModelRoutes-->>Client: 200 updated configuration
  end
Loading

Suggested reviewers: luvs01

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (8 skipped: 8 … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: enforcing write guards while model selection is pending. It matches the changes to model presets and selected-model endpoints.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (8 skipped: 8 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/provider-selection-pending-write-fence

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Keep permanent request errors before the pending-selection conflict, retain ready and legacy editing, and document the conflict/recovery contract in every directly translated API reference. Add unsupported-state and validation-priority regressions without changing authentication or model-value normalization.
@lidge-jun

Copy link
Copy Markdown
Owner Author

Owner-authorized admin approval bypass after fresh verification, not a CI waiver or self-approval. Exact head bb05473 passed Cross-platform CI33961600984; actual merge6028fabb67a677f8041ff9a95bb31d53893f2f65/tree f4f770511db04b01f2b9376833a4f4f5012ae1a7 matches. All current checks pass, independent reviews passed, and no valid unresolved findings or direct open child PRs remain. Logs prove25 write cases and the real Desktop GET filter regression; eight-language documentation build passed. Current dev remains cfe95ee. Landing with exact head match; no release or deployment.

@lidge-jun
lidge-jun merged commit 45f3bed into dev Sep 5, 2026
32 of 33 checks passed
@lidge-jun
lidge-jun deleted the codex/provider-selection-pending-write-fence branch September 5, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant