Repository navigation
Conversation
|
Warning Review limit reachedThe included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Next included review available in 20 minutes. View limit details
|
5cfb098 to
e4708d4
Compare
e4708d4 to
233ec3b
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 233ec3b204
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| fixture.kind === 'key' | ||
| ? validateOrganizationApiKey | ||
| : validateProjectToken | ||
| expect(validate(fixture.token)).toBe(fixture.token) |
There was a problem hiding this comment.
With the committed dependency graph, @polymorfa/sdk remains pinned to 0.1.0-dev.20261004024706, which rejects these opaque credentials, as documented in docs/opaque-credentials-cutover.md. Consequently, this acceptance assertion and the many existing tests switched to the same credentials fail during validation before reaching storage or transport. Update both the SDK dependency and lockfile to an accepted compatible artifact before enabling these fixtures; documenting the external gate does not make the committed tests compatible with a clean install.
Useful? React with 👍 / 👎.
| static override description = | ||
| 'Store an organization key or project token in the operating-system keyring.' | ||
| 'Store an opaque team key or project token in the operating-system keyring. Never parse credentials or assume a fixed length.' |
There was a problem hiding this comment.
The changed command descriptions are not reflected in contracts/cli-reference.json; for example, its auth login summary and description still contain the previous organization-key wording. scripts/cli-reference.mjs derives both fields from the compiled command and its --check mode throws on any difference, so the reference-check stage of npm run verify will fail even after the SDK compatibility issue is resolved. Regenerate and commit the reference with npm run docs:reference for all modified command metadata.
Useful? React with 👍 / 👎.
Prepares opaque machine-credential acceptance and growth-safe CLI authentication guidance. The canonical API credential fixture remains byte-identical to the accepted producer.
Head
9e72acfalso merges currentmain(b7ad48a) and adds separate account-device CLI profiles and sevenaccountcommands:login,list,use,status,logout,teamsandprojects. The account session lives in a separate keyring namespace and never reaches a machine SDK client. Login accepts only the configured Console/deviceapproval URL, and the browser build refuses all seven commands. The consumer is bound to the API producer in polymorfa/polymorfa#880. Design and check record:docs/internal/2026-11-05-cli-account-device-source.md.The one merge conflict, in
docs/command-research/calls.md, keeps main's simultaneous-call guidance together with the team-key terminology.Checks on the merged source (Node 24, public SDK
0.1.0-dev.20261004024706)Six-part assessment
Merge gates
Blocked on an SDK release. The pinned public SDK
0.1.0-dev.20261004024706predates the opaque-credential validators merged in polymorfa/sdks#355, so it rejects opaquepmfa_keys and hosted CI fails 522 tests. No SDK has been published since 2026-10-17: the scheduled publisher fails becauseSDK_COVERAGE_CLIENT_IDandSDK_COVERAGE_APP_PRIVATE_KEYare not set. Once a dev SDK containing #355 is published, this PR re-pins to that exact version.Current-head hosted CI, CodeRabbit, a correctness and security review and the ready producer (polymorfa/polymorfa#880) are required before merge. Publication and deployed availability are separate steps.