Repository navigation
feat(providers): add TokenLab API-key preset - #6221
Conversation
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (23)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe registry adds TokenLab as an API-key provider with live model discovery. Documentation and preset-count references now describe 100 built-in presets, including 83 key-based presets. ChangesTokenLab provider
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant TokenLabRegistry as TokenLab registry preset
participant TokenLabModels as TokenLab models endpoint
participant DiscoveryFilter as Registry discovery filter
participant ProviderRouting as Provider routing
TokenLabRegistry->>TokenLabModels: Request chat models with bearer authentication
TokenLabModels-->>DiscoveryFilter: Return model entries
DiscoveryFilter->>DiscoveryFilter: Keep chat entries with tool-use capability
DiscoveryFilter-->>ProviderRouting: Provide eligible discovered models
Merge Risk: ⚪ Minimal · up to This change adds TokenLab as an ordinary API-key provider preset with filtered model discovery and updates the documented preset counts. No actionable merge-blocking risk was identified in the supplied changes. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to TokenLab is an optional new destination for API keys and inference requests. Normal discovery applies the intended model filter, but degraded discovery can show a seeded model without confirming that the key can use it. Credential changes outside the reviewed provider-edit path also need verification before key-scoped catalog behavior can be assured. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (20 skipped: 20 unsupported.)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
⏳ DRAFT
What to do
Review readiness checklist
3/4 boxes ticked. The PR is more than 10 commits behind |
리뷰 · 우선순위 56 / 80이 PR은 TokenLab을 일반 API 키 공급자로 넣습니다. 대시보드의 공급자 추가, CLI 초기 설정, 모델 목록은 가이드와 작성자가 공개 API로 확인한 값은 이 리뷰에서도 맞습니다. 라인 - PR 본문 · 승인 증거. 작성자는 TOKENLAB AI INC. 운영자이고, 재판매·라우팅 허가 서류를 이 PR에 붙이지 않았다고 스스로 적었습니다. 공개 문서와 회사 이름만으로는 그 허가를 증명하지 않는다고도 적었습니다. 코드 버그가 아니라, 게이트웨이 프리셋을 받을지 막는 입장 게이트입니다. 지금 상태는 draft이고, 리뷰 준비 체크는 4칸 중 2칸만 채워져 있습니다. 라인 - 라이브 추론. 본문은 실제 키로 스트리밍·도구 호출 실행을 안 했다고 적습니다. 로컬 테스트는 발견·검증 픽스처입니다. 목록 필터와 키 401은 공개 응답과 맞지만, 에이전트 턴이 끝까지 가는지는 이 헤드만으로는 증명되지 않습니다. 라인 - 메인테이너의 판단이 필요한 지점 운영자가 직접 올린 게이트웨이 프리셋입니다. 재판매·라우팅 허가 서류를 받기 전에는 draft로 둘지, 공개 계약과 약관만으로 받을지 정해 주세요. 라이브 도구 호출 확인을 머지 전에 필수으로 둘지도 정해 주세요. 베이스 너의 추천 레지스트리·문서·테스트 모양은 Opper 같은 키 게이트웨이 프리셋과 같고, 발견 필터도 공개 목록과 맞습니다. 닫을 중복·무효 PR은 없습니다. 허가 서류와 (가능하면) 실제 키 한 번의 도구 호출 확인이 오기 전에는 머지하지 마세요. 그 두 가지가 오면 draft를 풀고 체크리스트를 채운 뒤 이 댓글은 grok-bot이 작성했습니다 |
|
Thanks for the review. I have now completed the real-key streaming/tool-call verification on the unchanged PR head The harness used the actual TokenLab registry seed and
This verifies one real model/key through the production adapter and client-side tool loop. It is not a claim of full Codex UI/proxy coverage or of a live restricted-key catalog matrix; those boundaries are retained in the description. No credentials or internal routing details are included. For the separate provider-admission question, could a maintainer clarify which evidence forms you accept: applicable upstream public terms, a redacted supply/reseller agreement, or an authorization email? If non-public supporting documents are needed, is there a private review channel, and which minimum facts must remain visible after redaction? We have not attached authorization documents, and this technical verification is not presented as proof of resale/routing rights. The PR remains a draft pending the admission decision. |
The English provider guide already states 100 presets (83 key-based) after the TokenLab entry, but the translated guides, every quickstart and the structure ops record still said 99 (82). tests/ci-workflows/docs-provider-preset-counts.test.ts, which landed on dev after this branch was cut, derives both numbers from the registry and failed in 16 places on the merge with dev.
Maintainer integration into
|
|
Maintainer note: I ticked the last two readiness boxes as the integrating maintainer. CodeRabbit's assertive review at |
2 participants
Summary
Add TokenLab as an ordinary API-key provider in the dashboard, CLI initializer and
ocx provider add tokenlab. The preset reusesopenai-chatathttps://api.tokenlab.sh/v1; it adds no sponsor status, ranking preference, OAuth flow or adapter.Discovery sends the configured Bearer key to
/v1/models?category=chatand retains only rows with an explicit chat category andtool-usecapability. The authenticated live catalog takes precedence over the seededgpt-5.6-terramodel, so a key that cannot access that model does not acquire it through the fallback. Existing same-named custom destinations remain unchanged. The provider guide documents setup, discovery scope and service terms.Provider evidence (checked 2026-09-29)
Verification
bun test tests/providers/tokenlab-provider.test.ts tests/providers/provider-registry-parity.test.ts tests/providers/provider-model-discovery-contract.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts— 131 passed, 0 failed. Covers entry-point derivation, upstream model identity, canonical/renamed/custom destinations, mixed-catalog filtering, per-key catalog precedence, and rejected/unavailable key checks.bun test tests/providers/provider-static-model-discovery.test.ts tests/providers/sponsor-presets.test.ts tests/ci-workflows/file-size-ratchet.test.ts— 20 passed, 0 failed.bun test tests/providers/tokenlab-provider.test.ts— 6 passed after aligning the dashboard link with TokenLab's published/dashboard/api?tab=keysURL.bun run typecheck,bun run privacy:scan,bun run structure:check— passed.cd docs-site && bun install --frozen-lockfile && bun run build— passed; 537 pages built and 73,657 internal links checked. The final documentation build was repeated after correcting the dashboard link.openai_chat_completions. An intentionally invalid Bearer key returned HTTP 401 /invalid_api_key; anonymous discovery returned HTTP 200. This verifies the distinction between public discovery and supplied-key validation.routeModel, and the productioncreateOpenAIChatAdapter().buildRequest/parseStreampath. Authenticated discovery returned HTTP 200: 142 chat rows, 112 admitted tool-capable rows, withgpt-5.6-terrapresent. Two real streamed requests completed the tool round trip: the model emittedadd({a:19,b:23}), the local harness returned42under the same tool-call ID, and the model answered42. Both responses were HTTP 200 /text/event-stream, ended with[DONE], and parsed to one successful terminal event. Finish reasons weretool_callsthenstop; reported usage totaled 350 input and 26 output tokens. Each request was capped at 1,024 output tokens with no retries.Checklist
Review readiness
Required local validation passed; commands, results, and any full-suite exception are documented.
I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.
Summary by CodeRabbit
gpt-5.6-terraas the default.