Skip to content

fix(ci): allow third-party provider translator changes in PRs#418

Open
jc01rho wants to merge 210 commits intorouter-for-me:mainfrom
jc01rho:fix/pr-path-guard-allow-third-party-translators
Open

fix(ci): allow third-party provider translator changes in PRs#418
jc01rho wants to merge 210 commits intorouter-for-me:mainfrom
jc01rho:fix/pr-path-guard-allow-third-party-translators

Conversation

@jc01rho
Copy link

@jc01rho jc01rho commented Mar 6, 2026

Summary

  • Fix pr-path-guard.yml workflow to allow third-party provider translator changes
  • Add exclusions for third-party provider translators (kiro, antigravity, codex, gemini-cli)
  • Core translators (claude, openai, gemini) remain protected

Problem

The pr-path-guard.yml workflow was blocking ALL translator changes under internal/translator/**. However, this is the Plus version which accepts third-party provider support. This caused CI failures in PR #414 where Kiro translator changes were incorrectly blocked.

Solution

Updated the workflow to use negative patterns (exclusions) for third-party provider translators:

files: |
  internal/translator/**
  !internal/translator/kiro/**
  !internal/translator/antigravity/**
  !internal/translator/codex/**
  !internal/translator/gemini-cli/**

This allows:

  • ✅ Third-party provider translator changes (kiro, antigravity, codex, gemini-cli)
  • ❌ Core translator changes still blocked (claude, openai, gemini)

Test Plan

  1. Create a PR with changes to internal/translator/kiro/**
  2. Verify translator-path-guard workflow passes
  3. Create a PR with changes to internal/translator/claude/**
  4. Verify translator-path-guard workflow fails as expected

jc01rho and others added 30 commits January 16, 2026 17:20
- Add routing.mode field for key-based routing (ignore provider, use model-only key)
- Add routing.fallback-models for specific model fallback on 429/401/5xx errors
- Add routing.fallback-chain for general fallback chain with max-depth limit
- Implement cycle detection to prevent infinite fallback loops
- Support hot reload for all new routing configurations
- Update config.example.yaml with documentation
- Add GET/PUT /routing/mode for routing mode configuration
- Add GET/PUT /fallback/models for fallback model mappings
- Add GET/PUT /fallback/chain for fallback provider chain
- Include unit tests for all new handlers (6 tests, all passing)

Closes gap between backend RoutingConfig fields and Management API
클라이언트 연결 끊김 또는 요청 취소(context.Canceled) 시
auth 상태가 error로 잘못 표시되는 문제 수정

- context.Canceled/DedlineExceeded 에러는 네트워크/클라이언트 문제이지
  인증 문제가 아니므로 auth 상태를 변경하지 않아야 함
- MarkResult() 호출을 건너뛰고 에러를 그대로 반환

수정된 파일:
- sdk/cliproxy/auth/conductor.go (8개소에서 체크 추가)

참고: 이 변경은 사용자가 연결을 끊었을 때
인증 키가 'error' 상태로 오인식되는 것을 방지합니다.
…onse

API 응답에 auth 상태 관련 필드 추가:
- quota: exceeded, reason, next_recover_at, backoff_level
- last_error: code, message, retryable, http_status (있을 경우)
- next_retry_after: 재시도 대기 시간 (설정된 경우)

프론트엔드에서 인증 키 상태를 시각적으로 표시하기 위한 준비
# Conflicts:
#	README.md
#	README_CN.md
- Add AntigravityProjectInfo struct with ProjectID, TierID, TierName, IsPaid fields
- Implement extractTierInfo() helper with tier priority logic (paidTier > currentTier)
- Rename fetchAntigravityProjectID() to fetchAntigravityProjectInfo()
- Update FetchAntigravityProjectID() wrapper for backward compatibility
- Store tier_id, tier_name, tier_is_paid in Auth.Metadata
- Add tier and tier_name fields to buildAuthFileEntry() for Antigravity provider
- Extract tier info from Auth.Metadata with nil-safe type assertions
- Add Tier field to upstreamRequestLog struct
- Extract tier from Auth.Metadata in antigravity executor
- Include tier in formatAuthInfo() output
# Conflicts:
#	README.md
#	README_CN.md
…pro-high

- Conditionally disable VALIDATED mode for gemini-3-pro-high (incompatible with reasoning output)

Fixes: router-for-me#1113
- Save tier_id, tier_name, tier_is_paid before token refresh
- Restore preserved tier info after metadata update
- Applied to both antigravity_executor.go and api_tools.go
# Conflicts:
#	internal/runtime/executor/antigravity_executor.go
…avity

- Add CleanJSONSchemaForGemini() function to remove unsupported keywords without placeholders
- Apply Gemini schema cleaning for non-Claude models (rename parametersJsonSchema → parameters)
- Preserve upstream toolConfig for non-Claude models
- Force VALIDATED mode only for Claude models (not Gemini)
- Remove nullable/title keywords and placeholder fields for Gemini

Fixes malformed_function_call error with Gemini tool calling via Antigravity.
…avity

- Add CleanJSONSchemaForGemini() function to remove unsupported keywords without placeholders
- Apply Gemini schema cleaning for non-Claude models (rename parametersJsonSchema → parameters)
- Preserve upstream toolConfig for non-Claude models
- Force VALIDATED mode only for Claude models (not Gemini)
- Remove nullable/title keywords and placeholder fields for Gemini
- Merge conflict resolution with remote main branch

Fixes malformed_function_call error with Gemini tool calling via Antigravity.
…router-for-me#1142)

- Add web_search tool detection and googleSearch injection in request translators
- Add extractWebSearchFromAntigravity() to parse groundingMetadata from responses
- Add appendWebSearchBlocks() for streaming web search results
- Add server_tool_use and web_search_tool_result blocks for non-streaming
- Set model to gemini-2.5-flash and requestType to web_search when detected
- Fix quota cooldown check for transient errors (PR router-for-me#1140)
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
…r helpers)

Merged from router-for-me/CLIProxyAPI@abfca6a

Changes:

- Reorder gemini schema cleaner helpers for better code organization

- Add comments for cleanJSONSchema function

- Improve toolConfig handling in antigravity executor

- Various test and translator updates
Resolved conflict in antigravity_executor.go - kept local tool schema cleaning logic
whrho added 24 commits February 27, 2026 19:32
…bypass

- Improve User-Agent to iFlowCLI/0.5.14 (platform; arch) format
- Increase OAuth state from 32 to 64 hex characters (32 bytes)
- Reorder OAuth URL parameters to match iFlow CLI order
- Add buildIFlowUserAgent() for dynamic platform detection
- Add automatic token refresh in ensureFreshAccessToken()
- Add Cline source parity headers (X-CLIENT-TYPE, X-CORE-VERSION, etc.)
- Add applyClineOpenRouterParity() for request payload modifications
- Add HTTP-Referer and X-Title headers to auth endpoints
- Handle workos: prefix in token auth value

Note: 403 on chat/completions is account-level permission issue, not code bug
The theirs merge strategy removed clineCallbackPort=4237 constant.
Re-added with port 1456 (next available after codexCallbackPort=1455).
Add SetProviderAuthInContext calls in three execution functions:
- executeMixedOnce
- executeCountMixedOnce
- executeStreamMixedOnce

This enables gin_logger.go to display which provider handled
the request in the access log output.
Store the resolved model name (after alias resolution) in the request context
so that gin_logger can display both the requested alias and the actual
upstream model name in the log output.

Changes:
- Modified 3 execution paths in conductor.go to store fallback info
  when the model name differs after alias resolution
- Existing gin_logger.go already supports displaying the mapping
  in format: 'alias → actual_model'

Example log output:
  free-code → claude-sonnet-4-6 | claude:auth-label
Previously, 4xx and 5xx status codes were logged at Warn/Error level,
making them less visible in log aggregation systems. Now all status codes
are logged at Info level with consistent format.
The pr-path-guard workflow was blocking ALL translator changes, but this is
the Plus version which accepts third-party provider support. This fix adds
exclusions for third-party provider translators (kiro, antigravity, codex,
gemini-cli) while still blocking changes to core translators (claude, openai,
gemini).

Fixes the CI failures seen in PR router-for-me#414 where Kiro translator changes were
incorrectly blocked.
Copilot AI review requested due to automatic review settings March 6, 2026 02:53
@gemini-code-assist
Copy link

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly expands the platform's capabilities by integrating new third-party AI providers, Kilocode and Cline, and enhancing existing authentication and routing mechanisms. It addresses a critical CI issue that was blocking legitimate third-party translator updates and introduces robust error handling, improved logging, and defensive programming practices across various API executors.

Highlights

  • New AI Provider Integrations: Introduced comprehensive support for two new AI providers, Kilocode and Cline, including their respective authentication flows (device flow for Kilocode, OAuth for Cline), token management, and API executors for handling chat completions.
  • Enhanced Routing Configuration: Implemented advanced routing capabilities, allowing configuration of a routing mode (provider-based or key-based), defining fallback models for automatic retries on errors, and establishing a fallback chain with a configurable maximum depth.
  • Authentication System Improvements: Refined existing authentication processes, particularly for Antigravity, to preserve and fetch subscription tier information during token refreshes. Also, the iFlow authenticator now has an updated refresh lead time and a dedicated refresh method. Token exchange logic for Anthropic, Gemini CLI, and Codex was refactored for direct handling within API handlers.
  • Code Robustness and Logging: Improved overall code stability by implementing defensive copying of byte slices across various API executors and handlers to prevent unintended data modifications. Enhanced the Gin logger to capture more detailed request information, including model names, authentication keys, provider details, and fallback events. Detailed error logging for upstream API failures was also added.
  • CI Workflow Alignment: Addressed a CI workflow issue by allowing changes to third-party provider translators (Kiro, Antigravity, Codex, Gemini-CLI) in pull requests, ensuring that new integrations and updates for these providers are no longer blocked while core translators remain protected.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • .gitignore
    • Updated gitignore rules to include /cliproxy, *.json, .cli-proxy-api/, .sisyphus/, .tldr/, and server.
  • .tldrignore
    • Added a new file defining common ignore patterns for TLDR.
  • cmd/server/main.go
    • Added new command-line flags for Kilocode and Cline login options.
    • Integrated Kilocode and Cline login handlers into the main server logic.
  • config.example.yaml
    • Expanded routing configuration options to include mode, fallback-models, fallback-chain, and fallback-max-depth.
  • go.mod
    • Added new dependency github.com/denisbrodbeck/machineid v1.0.1.
    • Reordered existing dependencies.
  • go.sum
    • Updated checksums for Go modules due to dependency changes.
  • internal/api/.tldrignore
    • Added a new file defining common ignore patterns for TLDR within the internal/api directory.
  • internal/api/handlers/management/.tldrignore
    • Added a new file defining common ignore patterns for TLDR within the management handlers directory.
  • internal/api/handlers/management/api_tools.go
    • Modified Antigravity OAuth token refresh to preserve and restore tier information.
    • Added a new function to sanitize Antigravity filenames.
    • Enhanced auth file entries to include Antigravity tier info, quota, and error details.
    • Implemented new functions to fetch and cache Antigravity tier information and an endpoint to refresh it.
    • Refactored token exchange logic for Anthropic, Gemini CLI, and Codex to handle requests directly within the handler.
    • Updated Antigravity token request to build the auth URL directly and fetch project/tier info.
  • internal/api/handlers/management/auth_files.go
    • Imported Cline authentication package.
    • Defined a new callback port for Cline authentication.
    • Added a new function to sanitize Antigravity filenames.
    • Updated buildAuthFileEntry to include Antigravity tier information.
  • internal/api/handlers/management/config_lists.go
    • Updated OAuth model alias configuration methods to notify the authentication manager of changes.
  • internal/api/handlers/management/config_routing.go
    • Added new API endpoints for managing routing mode, fallback models, and fallback chain configurations.
  • internal/api/handlers/management/config_routing_test.go
    • Added unit tests for the new routing configuration API endpoints.
  • internal/api/server.go
    • Registered new management routes for routing mode, fallback models, and fallback chain.
    • Registered a new endpoint for refreshing Antigravity tier information.
    • Registered a new endpoint for Cline token requests.
  • internal/auth/cline/cline_auth.go
    • Added new Cline authentication service for handling WorkOS OAuth flows.
    • Implemented methods to generate authorization URLs and exchange/refresh tokens.
  • internal/auth/cline/cline_token.go
    • Added new Cline token storage structure and methods for saving/loading tokens to/from files.
    • Implemented a function to generate credential filenames and retrieve authorization header values.
  • internal/auth/iflow/iflow_auth.go
    • Modified AuthorizationURL to ensure explicit parameter order for iFlow CLI compatibility.
    • Enhanced doTokenRequest to handle API-level errors and missing access tokens more robustly.
  • internal/auth/kilocode/errors.go
    • Added new Kilocode-specific authentication error types and a user-friendly message generator.
  • internal/auth/kilocode/kilocode_auth.go
    • Added new Kilocode authentication service for handling device flow.
    • Implemented methods to request device codes, poll for tokens, and fetch models.
  • internal/auth/kilocode/token.go
    • Added new Kilocode token storage structure and methods for saving tokens to files.
    • Defined a KilocodeAuthBundle for bundling authentication data.
  • internal/cmd/auth_manager.go
    • Registered the new Cline authenticator with the authentication manager.
  • internal/cmd/cline_login.go
    • Added a new CLI command for initiating Cline device flow login.
  • internal/cmd/kilocode_login.go
    • Added a new CLI command for initiating Kilocode device flow login.
  • internal/config/config.go
    • Extended RoutingConfig with new fields: Mode, FallbackModels, FallbackChain, and FallbackMaxDepth.
    • Updated SanitizeOAuthModelAlias to deduplicate aliases by name+alias combination, allowing multiple source models to share an alias.
  • internal/config/routing_config_test.go
    • Added unit tests for parsing routing configuration modes.
  • internal/constant/constant.go
    • Added a new constant for the Cline AI provider identifier.
  • internal/logging/gin_logger.go
    • Imported bytes, context, io, and gjson packages.
    • Introduced context keys for provider authentication and fallback information.
    • Enhanced GinLogrusLogger to capture and log request body, model name, auth key name, provider info, and fallback details.
    • Added GetRequestBody helper function to safely retrieve request bodies.
  • internal/misc/oauth.go
    • Increased the length of the generated random state string for OAuth2 flows to 64 characters.
  • internal/registry/cline_models.go
    • Added static model definitions for Cline AI services.
  • internal/registry/kilocode_model_converter.go
    • Added utilities for converting Kilocode API models to internal ModelInfo format, including filtering for free models.
    • Implemented functions to normalize Kilocode model IDs, generate display names and descriptions, and resolve model aliases.
  • internal/registry/kilocode_model_converter_test.go
    • Added unit tests for Kilocode model alias resolution.
  • internal/registry/model_definitions.go
    • Updated GetStaticModelDefinitionsByChannel to include Kilocode and Cline models.
  • internal/registry/model_definitions_static_data.go
    • Added Gemini 3.1 Pro Preview model to static definitions.
  • internal/runtime/executor/aistudio_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
  • internal/runtime/executor/antigravity_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
    • Added detailed logging for external HTTP requests.
    • Preserved and restored tier info during token refresh.
    • Implemented logic to block authentication for 30 minutes if project ID fetching fails.
    • Enhanced Gemini to Antigravity translation to handle request types (web_search, agent) and clean tool parameters schema for compatibility.
  • internal/runtime/executor/claude_executor.go
    • Added detailed logging for external HTTP requests.
  • internal/runtime/executor/cline_executor.go
    • Added a new executor for Cline API, handling non-streaming and streaming requests.
    • Implemented token refresh logic for Cline access tokens.
    • Added functions to apply Cline-specific headers and parity adjustments for OpenRouter compatibility.
    • Included logic to fetch dynamic Cline models from the API.
  • internal/runtime/executor/gemini_cli_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
    • Replaced generic error logging with logDetailedAPIError for more context.
  • internal/runtime/executor/gemini_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
    • Replaced generic error logging with logDetailedAPIError for more context.
  • internal/runtime/executor/gemini_vertex_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
    • Replaced generic error logging with logDetailedAPIError for more context.
  • internal/runtime/executor/iflow_executor.go
    • Imported runtime package.
    • Updated iFlow User-Agent string to match official CLI format and include OS/architecture details.
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
    • Improved error logging for iFlow requests.
    • Added NextRefreshAfter calculation for iFlow tokens.
  • internal/runtime/executor/kilo_executor.go
    • Added constants for Kilo version and tester header.
    • Refactored Kilo header application into a dedicated function.
    • Enhanced token extraction to prioritize 'token' field from metadata/attributes.
    • Added detailed Kilo-specific headers to requests.
  • internal/runtime/executor/kilocode_executor.go
    • Added a new executor for Kilocode API, handling non-streaming and streaming requests.
    • Implemented logic to normalize Kilocode model names for API calls.
    • Added functions to apply Kilocode-specific headers and handle token refresh (validation skipped as per API behavior).
    • Included detailed logging for API requests and responses.
  • internal/runtime/executor/logging_helpers.go
    • Imported cliproxyauth package.
    • Added Tier field to upstreamRequestLog for more detailed logging.
    • Cloned request body before writing to prevent modification issues.
    • Added logDetailedAPIError function for comprehensive error logging with provider and auth info.
  • internal/runtime/executor/openai_compat_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
    • Replaced generic error logging with logDetailedAPIError for more context.
  • internal/runtime/executor/proxy_helpers.go
    • Defined default timeout constants for HTTP client transport.
    • Refactored newProxyAwareHTTPClient to use transport-level timeouts for streaming safety and to build a default transport if none is specified.
    • Updated buildProxyTransport to include comprehensive transport settings for SOCKS5 and HTTP/HTTPS proxies.
  • internal/runtime/executor/qwen_executor.go
    • Cloned byte slices before passing them to sdktranslator functions to prevent unintended modifications.
  • internal/thinking/apply.go
    • Added a note clarifying the precedence of 'thinkingLevel' over 'thinkingBudget' in Gemini configuration.
  • internal/translator/antigravity/claude/antigravity_claude_response.go
    • Imported encoding/base64 and encoding/json packages.
    • Added support for extracting and translating web search queries and results from Antigravity responses into Claude format.
    • Implemented functions to build encrypted content and append web search blocks to streaming responses.
  • internal/translator/kiro/claude/kiro_claude_response.go
    • Modified UUID generation for message IDs to remove hyphens, ensuring compatibility.
  • internal/translator/kiro/claude/kiro_claude_stream.go
    • Modified UUID generation for message IDs in stream events to remove hyphens.
  • internal/translator/kiro/claude/kiro_claude_tools.go
    • Removed direct UUID import and replaced with common utility for tool use ID generation.
    • Implemented sanitization for tool use IDs and added a warning for invalid IDs.
  • internal/translator/kiro/common/utils.go
    • Imported strings, uuid, and log packages.
    • Added SanitizeToolUseID function to ensure tool_use.id matches Claude API patterns.
    • Added GenerateToolUseID function to create valid tool use IDs without hyphens.
  • internal/translator/kiro/common/utils_test.go
    • Added unit tests for SanitizeToolUseID and GenerateToolUseID functions.
  • internal/translator/kiro/openai/kiro_openai_request_test.go
    • Updated model names in test cases to reflect current Claude Sonnet versions.
  • internal/usage/logger_plugin.go
    • Added FailureCount to apiStats and modelStats structures to track failed requests.
    • Updated updateAPIStats and Snapshot methods to increment and report failure counts.
  • internal/watcher/synthesizer/file.go
    • Added 'auth_kind: oauth' attribute to synthesized authentication records.
  • sdk/api/handlers/handlers.go
    • Cloned rawJSON and response payload byte slices before use to prevent unintended modifications.
  • sdk/auth/antigravity.go
    • Refactored Antigravity authentication logic, moving client credentials and helper functions directly into the SDK.
    • Introduced AntigravityProjectInfo struct for better handling of project and tier data.
    • Implemented direct functions for exchanging code, fetching user info, building auth URLs, and sanitizing filenames.
    • Added detailed logic for extracting tier information and onboarding users to fetch project IDs.
  • sdk/auth/cline.go
    • Added a new Cline authenticator for handling OAuth login flows.
    • Implemented logic to extract and parse base64-encoded JSON tokens from callback URLs.
    • Added a function to wait for Cline OAuth callbacks and handle manual URL input.
  • sdk/auth/filestore.go
    • Enhanced NextRefreshAfter calculation to consider 'expired' metadata field and provider-specific refresh leads (e.g., iFlow).
  • sdk/auth/iflow.go
    • Updated RefreshLead duration to 36 hours for iFlow authenticator.
    • Implemented a Refresh method for iFlow to handle token refreshes using refresh tokens.
  • sdk/auth/kilo.go
    • Imported browser and log packages.
    • Improved Kilo login experience with clearer prompts and automatic browser opening.
    • Updated metadata handling for Kilo authentication.
  • sdk/auth/kilocode.go
    • Added a new Kilocode authenticator for handling device flow login.
    • Implemented logic to initiate device flow, display verification instructions, and poll for user authorization.
    • Created metadata and file naming conventions for Kilocode authentication records.
  • sdk/auth/refresh_registry.go
    • Registered the new Kilocode and Cline authenticators for refresh lead management.
  • sdk/cliproxy/auth/.tldrignore
    • Added a new file defining common ignore patterns for TLDR within the SDK authentication directory.
  • sdk/cliproxy/auth/conductor.go
    • Imported gin package.
    • Introduced context functions (SetProviderAuthInContext, GetProviderAuthFromContext, SetFallbackInfoInContext, GetFallbackInfoFromContext) for logging and tracking authentication and fallback details.
    • Added atomic values for fallbackModels, fallbackChain, and fallbackMaxDepth, along with their setters and getters.
    • Modified execution methods (executeMixedOnce, executeCountMixedOnce, executeStreamMixedOnce) to utilize new context functions and apply model aliases.
    • Implemented rotateProviders function for round-robin load balancing strategy.
  • sdk/cliproxy/auth/oauth_model_alias.go
    • Imported log package.
    • Added debug logging to applyOAuthModelAlias and resolveUpstreamModelFromAliasTable for better visibility.
    • Updated OAuthModelAliasChannel to include 'kilo', 'kilocode', and 'cline' as supported channels.
  • sdk/cliproxy/auth/selector.go
    • Added a Mode field to RoundRobinSelector to support different routing behaviors.
  • sdk/cliproxy/builder.go
    • Updated the Build method to configure the RoundRobinSelector with the new Mode field.
    • Set fallback models, fallback chain, and fallback maximum depth in the core authentication manager.
  • sdk/cliproxy/service.go
    • Imported kilocodeauth package.
    • Registered the new Cline and Kilocode executors with the service.
    • Updated reloadCallback to dynamically adjust routing selector mode based on configuration changes.
    • Modified registerModelsForAuth to fetch models for Cline and Kilocode providers.
    • Added fetchKilocodeModels and extractKilocodeToken functions for Kilocode model and token management.
    • Enhanced generateKiroAgenticVariants to explicitly add virtual friendly IDs for KiroExecutor and skip existing agentic variants.
  • test/config_migration_test.go
    • Added new test cases for validating legacy configuration migration to new formats, including mixed and new-only field scenarios.
Ignored Files
  • Ignored by pattern: .github/workflows/** (3)
    • .github/workflows/docker-image.yml
    • .github/workflows/pr-path-guard.yml
    • .github/workflows/release.yaml
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates CI path-guard rules to allow third-party translator changes, while also introducing broad new functionality across auth/providers, routing behavior, logging, and executor request handling.

Changes:

  • Adjust translator-path-guard workflow to exclude specific third-party translator subtrees from restriction checks.
  • Add new providers/auth flows (notably cline and kilocode) plus related executor/model-registry support.
  • Extend routing configuration (mode + fallback settings) and enhance request/logging behavior (context metadata, API error logging, payload cloning).

Reviewed changes

Copilot reviewed 73 out of 77 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
test/config_migration_test.go Adds tests for legacy→new config migration behavior.
sdk/cliproxy/service.go Updates routing selector on config reload; adds cline/kilocode model fetching and Kiro virtual models.
sdk/cliproxy/builder.go Passes routing mode and fallback config into core manager at build time.
sdk/cliproxy/auth/selector.go Adds Mode field to round-robin selector.
sdk/cliproxy/auth/oauth_model_alias.go Adds extensive debug logging + expands supported channels list.
sdk/cliproxy/auth/conductor.go Adds gin-context metadata helpers; adds fallback config storage; modifies execute paths.
sdk/cliproxy/auth/.tldrignore Adds TLDR ignore patterns file.
sdk/auth/refresh_registry.go Registers refresh leads for kilocode and cline.
sdk/auth/kilocode.go Implements Kilocode device-flow login and auth record creation.
sdk/auth/kilo.go Enhances Kilo login UX (browser open) and formatting.
sdk/auth/iflow.go Adjusts refresh lead; adds refresh implementation; enriches auth timestamps/refresh scheduling.
sdk/auth/filestore.go Computes NextRefreshAfter from additional metadata fields (incl. iFlow special-case).
sdk/auth/cline.go Implements Cline OAuth login with local callback server + token parsing.
sdk/auth/antigravity.go Reworks Antigravity OAuth flow and adds tier/project discovery helpers.
sdk/api/handlers/handlers.go Clones request/response payload bytes to avoid mutation/aliasing; clones stored response bytes.
internal/watcher/synthesizer/file.go Adds auth_kind=oauth attribute to synthesized auths.
internal/usage/logger_plugin.go Adds failure counters to aggregated usage stats and snapshots.
internal/translator/kiro/openai/kiro_openai_request_test.go Updates Kiro model IDs used in tests.
internal/translator/kiro/common/utils_test.go Adds tests for tool-use-id sanitization/generation.
internal/translator/kiro/common/utils.go Adds tool-use-id sanitization + deterministic generator.
internal/translator/kiro/claude/kiro_claude_tools.go Uses shared tool-use-id generator; sanitizes toolUseId and drops invalid events.
internal/translator/kiro/claude/kiro_claude_stream.go Removes hyphens from generated Claude message IDs.
internal/translator/kiro/claude/kiro_claude_response.go Removes hyphens from generated Claude message IDs.
internal/translator/antigravity/claude/antigravity_claude_response.go Adds web-search blocks extraction/emission for Claude formatted responses.
internal/thinking/apply.go Clarifies Gemini thinking config precedence to avoid incompatible combinations.
internal/runtime/executor/qwen_executor.go Clones payload before translation to avoid mutation/aliasing.
internal/runtime/executor/proxy_helpers.go Adds streaming-safe transport defaults and transport-level timeouts.
internal/runtime/executor/openai_compat_executor.go Clones payload before translation; centralizes detailed API error logging.
internal/runtime/executor/logging_helpers.go Clones bodies before logging; adds tier field; adds detailed API error logger.
internal/runtime/executor/kilocode_executor.go Adds Kilocode executor implementation for OpenRouter-like endpoint + SSE handling.
internal/runtime/executor/kilo_executor.go Refactors/standardizes Kilo request headers; broadens token extraction keys.
internal/runtime/executor/iflow_executor.go Clones payload before translation; improves error logging; updates UA/signature behavior; refresh scheduling.
internal/runtime/executor/gemini_vertex_executor.go Clones payload before translation; uses detailed API error logging.
internal/runtime/executor/gemini_executor.go Clones payload before translation; uses detailed API error logging.
internal/runtime/executor/gemini_cli_executor.go Clones payload before translation; uses detailed API error logging; clones DONE marker.
internal/runtime/executor/claude_executor.go Adds extra “external HTTP request” info logging.
internal/runtime/executor/antigravity_executor.go Clones payload before translation; adds external request logging; adds tier logging; model resolution tweaks; schema cleaning.
internal/runtime/executor/aistudio_executor.go Clones payload/response bytes through logging/translation path.
internal/registry/model_definitions_static_data.go Adds gemini-3.1-pro-preview model definition.
internal/registry/model_definitions.go Treats kilocode as alias for kilo in static model definitions.
internal/registry/kilocode_model_converter_test.go Adds tests for Kilocode model alias resolution.
internal/registry/kilocode_model_converter.go Adds Kilocode dynamic model conversion/filtering + static free models list + alias resolver.
internal/registry/cline_models.go Adds static model list for Cline.
internal/misc/oauth.go Increases OAuth state size to 32 bytes (64 hex chars).
internal/logging/gin_logger.go Enhances Gin logging with request body/model/provider info and gin-context propagation.
internal/constant/constant.go Adds constant for cline provider.
internal/config/routing_config_test.go Adds tests for parsing new routing mode.
internal/config/config.go Adds routing mode + fallback settings; adjusts OAuth model alias dedupe rules.
internal/cmd/kilocode_login.go Adds CLI command helper for Kilocode login.
internal/cmd/cline_login.go Adds CLI command helper for Cline login.
internal/cmd/auth_manager.go Registers Cline authenticator in CLI auth manager.
internal/auth/kilocode/token.go Adds Kilocode token storage file format.
internal/auth/kilocode/kilocode_auth.go Implements Kilocode device-flow client and model fetching.
internal/auth/kilocode/errors.go Adds Kilocode-specific auth error types and user-friendly messages.
internal/auth/iflow/iflow_auth.go Adjusts auth URL param order; adds API-level error checks and response fields.
internal/auth/cline/cline_token.go Adds Cline token storage format and helpers.
internal/auth/cline/cline_auth.go Implements Cline WorkOS OAuth URL generation + token exchange/refresh.
internal/api/server.go Adds management routes for routing mode + fallback config; adds auth-tier refresh + cline token route.
internal/api/handlers/management/config_routing_test.go Adds tests for new management endpoints (routing mode/fallback).
internal/api/handlers/management/config_routing.go Implements management endpoints for routing mode and fallback settings.
internal/api/handlers/management/config_lists.go Ensures runtime auth manager receives updated OAuthModelAlias after persist.
internal/api/handlers/management/api_tools.go Preserves tier metadata during Antigravity refresh flow.
internal/api/handlers/management/.tldrignore Adds TLDR ignore patterns file.
internal/api/.tldrignore Adds TLDR ignore patterns file.
go.sum Reorders a couple of entries.
go.mod Adds machineid dependency and reorders an indirect dependency line.
config.example.yaml Documents routing mode and fallback configuration keys.
cmd/server/main.go Adds CLI flags for kilocode-login and cline-login.
.tldrignore Adds TLDR ignore patterns file.
.gitignore Adjusts ignored binary path and adds broad ignore patterns (incl. *.json).
.github/workflows/release.yaml Adds Discord webhook notification step on successful release job.
.github/workflows/pr-path-guard.yml Allows translator changes for select third-party providers via negated patterns.
.github/workflows/docker-image.yml Removes docker-image workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 76 to +81
func (m *Manager) applyOAuthModelAlias(auth *Auth, requestedModel string) string {
channel := modelAliasChannel(auth)
log.Debugf("[DEBUG] applyOAuthModelAlias: provider=%s model=%s channel=%s auth_kind=%v", auth.Provider, requestedModel, channel, auth.Attributes)
upstreamModel := m.resolveOAuthUpstreamModel(auth, requestedModel)
if upstreamModel == "" {
log.Debugf("[DEBUG] applyOAuthModelAlias: no alias found, returning original model=%s", requestedModel)
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This debug log prints auth.Attributes (auth_kind and potentially other fields). In this codebase, Attributes can contain secrets (e.g., API keys/tokens), so logging the full map risks credential leakage even at debug level. Log only non-sensitive fields (e.g., provider/auth kind/channel) and avoid dumping the full attributes map.

Copilot uses AI. Check for mistakes.
Comment on lines +30 to +34
const (
antigravityClientID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"
antigravityClientSecret = "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"
antigravityCallbackPort = 51121
)
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoding the OAuth client secret in the repository is a security risk (secrets can be harvested from git history). Move this secret to a secure configuration mechanism (environment variable / secrets manager) or switch to a public client flow that does not require embedding a client secret.

Copilot uses AI. Check for mistakes.

require (
github.com/andybalholm/brotli v1.0.6
github.com/denisbrodbeck/machineid v1.0.1
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR adds github.com/denisbrodbeck/machineid to go.mod, but there are no references to it in the Go codebase. Please remove the dependency (or add the missing usage) to avoid unnecessary supply-chain surface area and keep go.mod tidy.

Suggested change
github.com/denisbrodbeck/machineid v1.0.1

Copilot uses AI. Check for mistakes.
Comment on lines 17 to 22
- name: Detect internal/translator changes
id: changed-files
uses: tj-actions/changed-files@v45
with:
files: |
internal/translator/**
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR title/description indicates this change is only about pr-path-guard.yml, but this PR also introduces substantial new functionality (new providers, auth flows, routing mode/fallback, logging changes, etc.). Please update the PR description/title to reflect the full scope or split this into smaller PRs so review/rollback risk is manageable.

Copilot uses AI. Check for mistakes.
Comment on lines 208 to 212
entry := log.WithField("request_id", requestID)

switch {
log.WithField("request_id", requestID).Info(logLine)
case statusCode >= http.StatusInternalServerError:
entry.Error(logLine)
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logging branch selection is syntactically broken: the case ... clauses appear without a surrounding switch statement, which will prevent the project from compiling. Restore the switch { ... } (or equivalent if/else) around the status-code severity logic and remove the unconditional Info(logLine) call if the switch is meant to control the log level.

Copilot uses AI. Check for mistakes.
Comment on lines 831 to +833
execReq := req
execReq.Model = rewriteModelForAuth(routeModel, auth)
execReq.Model = m.applyAPIKeyModelAlias(auth, execReq.Model)
// Store actual model name in context for logging
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

executeCountMixedOnce no longer rewrites the model per-auth (it uses req.Model directly), unlike executeMixedOnce/executeStreamMixedOnce which call rewriteModelForAuth(routeModel, auth) first. This can cause CountTokens to use the wrong upstream model for auths that need model rewriting. Align the model rewrite/alias order with the Execute/Stream paths (start from routeModel + rewriteModelForAuth).

Copilot uses AI. Check for mistakes.
Comment on lines 837 to +842
execReq.Model = m.applyOAuthModelAlias(auth, execReq.Model)
execReq.Model = m.applyAPIKeyModelAlias(auth, execReq.Model)
// Store actual model name in context for logging
if execReq.Model != routeModel {
execCtx = SetFallbackInfoInContext(execCtx, routeModel, execReq.Model)
}
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

executeCountMixedOnce applies API-key model alias twice and sets fallback info twice (before and after OAuth alias). This is redundant and risks inconsistent behavior if aliasing is not strictly idempotent. Consider applying model rewrites/aliases once in a single, consistent order and only recording fallback info after the final model value is determined.

Copilot uses AI. Check for mistakes.
Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request is described as a fix for the CI workflow, but it contains a substantial number of changes beyond that. It introduces support for new authentication providers (cline, kilocode), adds model fallback and advanced routing capabilities, and includes significant refactoring of authentication flows and logging. While the changes are generally positive, I've identified a few areas for improvement regarding code duplication and consistency. My feedback focuses on improving maintainability by refactoring duplicated logic and standardizing error logging.

Note: Security Review did not run due to the size of the PR.

"state": state,
"grant_type": "authorization_code",
"client_id": clientID,
"redirect_uri": "http://localhost:54545/callback",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The redirect_uri is hardcoded. To improve maintainability and consistency, consider constructing it dynamically using the anthropicCallbackPort constant. This would make it easier to update the port in one place. Similar hardcoded URIs are present for the Gemini (line 1355) and Codex (line 1711) token request handlers in this file.

Comment on lines +1267 to +1288
httpClient := util.SetProxy(&h.cfg.SDKConfig, &http.Client{})
req, _ := http.NewRequestWithContext(ctx, "POST", "https://console.anthropic.com/v1/oauth/token", strings.NewReader(string(bodyJSON)))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Accept", "application/json")
resp, errDo := httpClient.Do(req)
if errDo != nil {
authErr := claude.NewAuthenticationError(claude.ErrCodeExchangeFailed, errDo)
log.Errorf("Failed to exchange authorization code for tokens: %v", authErr)
SetOAuthSessionError(state, "Failed to exchange authorization code for tokens")
return
}
defer func() {
if errClose := resp.Body.Close(); errClose != nil {
log.Errorf("failed to close response body: %v", errClose)
}
}()
respBody, _ := io.ReadAll(resp.Body)
if resp.StatusCode != http.StatusOK {
log.Errorf("token exchange failed with status %d: %s", resp.StatusCode, string(respBody))
SetOAuthSessionError(state, fmt.Sprintf("token exchange failed with status %d", resp.StatusCode))
return
}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The logic for exchanging an authorization code for a token is very similar across RequestAnthropicToken, RequestCodexToken, and RequestAntigravityToken. Consider refactoring this into a shared helper function to reduce code duplication and improve maintainability. The helper could handle creating the HTTP client, making the request, and processing the response, while the calling functions would just prepare the specific URL, body, and headers for each provider.

b, _ := io.ReadAll(httpResp.Body)
appendAPIResponseChunk(ctx, e.cfg, b)
logWithRequestID(ctx).Debugf("request error, error status: %d error message: %s", httpResp.StatusCode, summarizeErrorBody(httpResp.Header.Get("Content-Type"), b))
log.Debugf("iflow request error: status %d body %s", httpResp.StatusCode, summarizeErrorBody(httpResp.Header.Get("Content-Type"), b))

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This log message for a request error is missing the request ID, which is valuable for debugging. Other executors in this PR have been updated to use a new logDetailedAPIError helper which provides richer error logging, including the request ID. Consider using that helper here for consistency and better debuggability.

Suggested change
log.Debugf("iflow request error: status %d body %s", httpResp.StatusCode, summarizeErrorBody(httpResp.Header.Get("Content-Type"), b))
logDetailedAPIError(ctx, e.Identifier(), url, httpResp.StatusCode, httpResp.Header.Get("Content-Type"), b)

err = statusErr{code: httpResp.StatusCode, msg: string(data)}
bodyStr := string(data)
summary := summarizeErrorBody(httpResp.Header.Get("Content-Type"), data)
log.Errorf("iflow streaming error: status %d, summary: %s, full body: %s", httpResp.StatusCode, summary, bodyStr)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Similar to the non-streaming case, this error log for streaming requests is missing the request ID. Using the new logDetailedAPIError helper function introduced in this PR would provide more consistent and context-rich logging.

Suggested change
log.Errorf("iflow streaming error: status %d, summary: %s, full body: %s", httpResp.StatusCode, summary, bodyStr)
logDetailedAPIError(ctx, e.Identifier(), url, httpResp.StatusCode, httpResp.Header.Get("Content-Type"), data)

The case statements were used without a switch block, causing syntax error.
Now uses proper switch statement for log level based on status code.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants