Repository navigation
Consolidate Go gateway and update project documentation - #147
Conversation
The src/ tree was the pre-migration Express/Bun monolith and was still wired in three places: package.json scripts (start/dev), the root Dockerfile, and the e2e workflow path filter. `bun run start` and `docker build .` would launch the old app on port 3000, shadowing the Go gateway and contradicting the polyglot architecture documented in the README. - Delete src/ (Express routes, x402 middleware, ai/payment services) - Delete root Dockerfile (CMD pointed at src/index.ts) - Drop express, cors, uuid and matching @types from package.json - Drop dead start/dev/agent/dev:all scripts; keep stack and tests - Mark package as private (not publishable) - Regenerate bun.lock (6 packages removed) - Remove src/** from .github/workflows/e2e.yml path filter Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- README: replace the false `httputil.ReverseProxy` claim with an accurate description of the gateway's verify-then-proxy flow. - README: relabel the architecture diagram's "Receipt Store" as "In-memory Receipt Map" so the diagram matches the implementation (gateway/main.go:779). Drop the "Persistence" alias since one of the two boxes (Redis) is the only persistent member. - README: add a Limitations & What's Next section documenting the in-memory receipt store, lack of on-chain settlement check, single -chain hardcoding, replay-window choice, per-process rate limiter, hardcoded CORS, and free-model demo tradeoff. - README: add CI badges (go-tests, rust-tests, web-build, e2e, MIT) and a one-line provenance note about the open-source contributors. - web/README: drop Phantom (Solana wallet, irrelevant on EVM) and update the Next.js version from 14 to 16 to match the actual deps. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
These three comments were leftover scratch labels from an AI-assisted work session. They tagged code with "VIBE FIX:" or "CORRECT:" prefixes that explained nothing about WHY the code is structured the way it is. Rewritten: - gateway/main.go middleware-registration site now states the real invariant (Correlation IDs must be assigned before any later middleware can reject the request, so all errors stay traceable). - gateway/main.go verifier-call site: the comment said what the code does; deleted, the line is self-evident. - gateway/middleware.go context-set site now explains the Go convention for typed context keys (collision avoidance), which is the actual non-obvious reason that line exists. No behavior change. \`go build ./...\` clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
|
@codex review |
📝 WalkthroughWalkthroughThis PR removes the Node.js/Express TypeScript server (configs, middleware, services, routes, Dockerfile), trims Node dependencies, updates E2E GitHub Actions path triggers to exclude ChangesNode.js / Express TypeScript server removal
Documentation, CI workflow, and gateway comment updates
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsTimed out fetching pipeline failures after 30000ms Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
README.md (1)
192-204: 💤 Low valueExcellent transparency in documenting limitations.
This section is exceptionally well-written and demonstrates professional honesty about the system's current constraints. Each limitation is concrete, actionable, and explains the trade-offs clearly.
Minor suggestion: Consider moving the note about paused PR reviews (line 204) to a pinned GitHub issue or CONTRIBUTING.md, as it's temporal information that may become stale in the main README.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 192 - 204, Remove the temporal note "PR reviews are paused for the current placement season and will resume after" from the README.md limitations section and instead add it to a CONTRIBUTING.md entry or create a pinned GitHub Issue/Notice that tracks the pause (include the same text and any expected resume date or maintenance contact). Update README.md to reference CONTRIBUTING.md or the pinned issue for contributor status info (e.g., "See CONTRIBUTING.md or pinned issue for current PR review status") so the main README remains evergreen.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@README.md`:
- Around line 192-204: Remove the temporal note "PR reviews are paused for the
current placement season and will resume after" from the README.md limitations
section and instead add it to a CONTRIBUTING.md entry or create a pinned GitHub
Issue/Notice that tracks the pause (include the same text and any expected
resume date or maintenance contact). Update README.md to reference
CONTRIBUTING.md or the pinned issue for contributor status info (e.g., "See
CONTRIBUTING.md or pinned issue for current PR review status") so the main
README remains evergreen.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: acb800dd-7a42-4d34-8523-edc8110c2d7b
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (14)
.github/workflows/e2e.ymlDockerfileREADME.mdgateway/main.gogateway/middleware.gopackage.jsonsrc/config.tssrc/index.tssrc/middleware/correlation.tssrc/middleware/x402.tssrc/routes/ai.tssrc/services/ai.tssrc/services/payment.tsweb/README.md
💤 Files with no reviewable changes (9)
- src/middleware/correlation.ts
- .github/workflows/e2e.yml
- src/routes/ai.ts
- src/middleware/x402.ts
- Dockerfile
- src/index.ts
- src/services/ai.ts
- src/config.ts
- src/services/payment.ts
AnkanMisra
changed the title
|
To use Codex here, create an environment for this repo. |
|
Codex couldn't complete this request. Try again later. |
|
@codex review the changes |
|
Codex Review: Didn't find any major issues. You're on a roll. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex retry the previous request now that the Codex Cloud environment setup has been fixed. Add or update the repo’s AGENTS.md with strict Codex review guidelines. Deeply inspect the codebase first and make the instructions project-specific. Future Codex reviews should catch small actionable bugs, edge cases, missing tests, docs issues, PR hygiene issues, security risks, config problems, and maintainability issues, not only major bugs. Also update related review instruction files if they exist, but keep the change focused and do not change app logic. Validate the change with the relevant safe checks before opening or updating a PR. |
Summary
Testing
|
Co-authored-by: codex <codex@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
AGENTS.md (1)
68-68: 💤 Low valueConsider clarifying "web typed data" for readability.
The phrase "web typed data" is grammatically ambiguous. Consider using "web-typed data" (if referring to typed data from the web service) or rephrasing to "web TypeScript typed data" for clarity.
✍️ Suggested rephrase
-Protocol changes must update all participants: gateway structs, verifier structs, web typed data, E2E signing, OpenAPI, README diagrams/flow, and `.env.example` when env/config is involved. +Protocol changes must update all participants: gateway structs, verifier structs, web-typed data, E2E signing, OpenAPI, README diagrams/flow, and `.env.example` when env/config is involved.As per coding guidelines: Treat grammar mistakes in docs as reviewable user-facing defects.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 68, The phrase "web typed data" in AGENTS.md is ambiguous—locate the exact occurrence of the token "web typed data" and replace it with a clearer term such as "web-typed data" if you mean typed data from the web service, or "web TypeScript typed data" if you specifically mean TypeScript-typed data coming from the web layer; update the sentence so the new wording reads smoothly with the surrounding list (gateway structs, verifier structs, web-typed data, E2E signing, OpenAPI, README diagrams/flow, and `.env.example`) to preserve parallel structure and readability.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Line 7: AGENTS.md currently contradicts itself about OPENROUTER_API_KEY for
E2E: update the E2E entry that references tests/ and run_e2e.sh to explicitly
state the intended behavior (optional: tests skip AI calls when
OPENROUTER_API_KEY is absent; required: tests fail without it; or conditional:
only needed for full upstream validation), and make the same wording consistent
with the other E2E mention on the file (line referencing full upstream AI path)
so both entries match the actual behavior of the tests and workflows; reference
the E2E (`tests/`, `run_e2e.sh`) description and the "full upstream AI path"
sentence when editing to ensure alignment with CI/test scripts.
- Line 69: Update the dependency-lockfile checklist entry in AGENTS.md so it
references the Bun lockfile instead of npm's package-lock: replace the
occurrence of "web/package-lock.json" with "web/bun.lock" to match the project's
"Use Bun (not npm/node)" requirement (see the checklist line that currently
reads "Dependency changes must be justified, minimal, and reflected in the
correct lockfile"). Ensure the wording remains consistent with other references
to Bun in the file.
---
Nitpick comments:
In `@AGENTS.md`:
- Line 68: The phrase "web typed data" in AGENTS.md is ambiguous—locate the
exact occurrence of the token "web typed data" and replace it with a clearer
term such as "web-typed data" if you mean typed data from the web service, or
"web TypeScript typed data" if you specifically mean TypeScript-typed data
coming from the web layer; update the sentence so the new wording reads smoothly
with the surrounding list (gateway structs, verifier structs, web-typed data,
E2E signing, OpenAPI, README diagrams/flow, and `.env.example`) to preserve
parallel structure and readability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| - **Gateway (`gateway/`)**: Go/Gin API gateway on port 3000. It owns request timeouts, CORS/gzip, token-bucket rate limits, Redis-backed response caching, x402 payment challenge/verification orchestration, OpenRouter/Ollama upstream calls, and receipt signing/storage. | ||
| - **Verifier (`verifier/`)**: Rust/Axum service on port 3002. It verifies EIP-712 payment signatures and returns recovered wallet information. | ||
| - **Web (`web/`)**: Next.js/Bun frontend on port 3001. It requests summaries, handles 402 payment contexts, prompts wallet chain switching/signing, retries with `X-402-*` headers, and displays results. | ||
| - **E2E (`tests/`, `run_e2e.sh`)**: Bun tests that exercise the gateway/verifier payment flow and may call the AI provider when `OPENROUTER_API_KEY` is available. |
There was a problem hiding this comment.
Clarify OPENROUTER_API_KEY requirement for E2E tests.
Line 7 states E2E tests "may call the AI provider when OPENROUTER_API_KEY is available" (suggesting optional), while Line 15 states E2E tests "requires OPENROUTER_API_KEY for a full upstream AI path" (suggesting required). This inconsistency could confuse contributors about whether the key is mandatory for running E2E tests.
Consider clarifying whether the key is:
- Optional (tests skip AI calls when absent), or
- Required (tests fail without it), or
- Conditionally required (only for full upstream validation)
As per coding guidelines: Review documentation for inconsistent versions and mismatch with code/workflows.
Also applies to: 15-15
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 7, AGENTS.md currently contradicts itself about
OPENROUTER_API_KEY for E2E: update the E2E entry that references tests/ and
run_e2e.sh to explicitly state the intended behavior (optional: tests skip AI
calls when OPENROUTER_API_KEY is absent; required: tests fail without it; or
conditional: only needed for full upstream validation), and make the same
wording consistent with the other E2E mention on the file (line referencing full
upstream AI path) so both entries match the actual behavior of the tests and
workflows; reference the E2E (`tests/`, `run_e2e.sh`) description and the "full
upstream AI path" sentence when editing to ensure alignment with CI/test
scripts.
|
|
||
| ### Cross-Service Review Checklist | ||
| - Protocol changes must update all participants: gateway structs, verifier structs, web typed data, E2E signing, OpenAPI, README diagrams/flow, and `.env.example` when env/config is involved. | ||
| - Dependency changes must be justified, minimal, and reflected in the correct lockfile (`bun.lock`, `web/bun.lock`, `web/package-lock.json`, `gateway/go.sum`, `verifier/Cargo.lock`). |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check which lockfiles are present in the project
# Check for Bun lockfile
echo "=== Bun lockfiles ==="
fd -t f 'bun.lock' .
fd -t f 'bun.lockb' .
# Check for npm lockfile
echo "=== npm lockfiles ==="
fd -t f 'package-lock.json' .
# Check web directory specifically
echo "=== Web directory lockfiles ==="
fd -t f -e lock -e lockb web/Repository: AnkanMisra/MicroAI-Paygate
Length of output: 536
Update line 69 to reference the correct Bun lockfile.
Line 69 lists web/package-lock.json in the dependency lockfiles checklist, but line 25 explicitly states "Use Bun (not npm/node) for JS/TS runtime commands in this repo." The correct Bun lockfile is web/bun.lock, not npm's package-lock.json. Update line 69 to reference web/bun.lock to align with the project's package manager requirement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 69, Update the dependency-lockfile checklist entry in
AGENTS.md so it references the Bun lockfile instead of npm's package-lock:
replace the occurrence of "web/package-lock.json" with "web/bun.lock" to match
the project's "Use Bun (not npm/node)" requirement (see the checklist line that
currently reads "Dependency changes must be justified, minimal, and reflected in
the correct lockfile"). Ensure the wording remains consistent with other
references to Bun in the file.
Co-authored-by: codex <codex@users.noreply.github.com>
There was a problem hiding this comment.
♻️ Duplicate comments (2)
AGENTS.md (2)
73-73:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winRemove
web/package-lock.jsonreference - project uses Bun, not npm.Line 73 lists
web/package-lock.jsonin the lockfile checklist, but line 25 explicitly states "Use Bun (not npm/node) for JS/TS runtime commands." The npm lockfile should not exist in this project. Sinceweb/bun.lockis already listed, remove theweb/package-lock.jsonreference entirely.✂️ Proposed fix
-- Dependency changes must be justified, minimal, and reflected in the correct lockfile (`bun.lock`, `web/bun.lock`, `web/package-lock.json`, `gateway/go.sum`, `verifier/Cargo.lock`). +- Dependency changes must be justified, minimal, and reflected in the correct lockfile (`bun.lock`, `web/bun.lock`, `gateway/go.sum`, `verifier/Cargo.lock`).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 73, Remove the npm lockfile reference by deleting "web/package-lock.json" from the lockfile checklist entry in AGENTS.md and ensure the checklist only lists Bun lockfiles (e.g., "web/bun.lock") consistent with the project's "Use Bun (not npm/node)" policy; update the checklist line that currently contains "web/package-lock.json" so it no longer references npm lockfiles.
7-7:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winClarify OPENROUTER_API_KEY requirement for E2E tests.
Line 7 states E2E tests "may call the AI provider when
OPENROUTER_API_KEYis available" (suggesting optional), while line 15 states E2E tests "requiresOPENROUTER_API_KEYfor a full upstream AI path" (suggesting conditionally required). This phrasing could confuse contributors about when the key is actually necessary.📝 Suggested clarification
Consider unifying the language. For example:
Option A (if the key is optional):
- Line 7: "E2E (
tests/,run_e2e.sh): Bun tests that exercise the gateway/verifier payment flow; optionally tests upstream AI provider integration whenOPENROUTER_API_KEY` is set."- Line 15: "E2E tests:
bun run test:e2e(setOPENROUTER_API_KEYto test the full upstream AI integration)"Option B (if the key is required for meaningful E2E):
- Line 7: "E2E (
tests/,run_e2e.sh): Bun tests requiringOPENROUTER_API_KEY` that exercise the full gateway/verifier/AI provider flow."- Line 15: "E2E tests:
bun run test:e2e(requiresOPENROUTER_API_KEY)"Also applies to: 15-15
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 7, Unify the wording about OPENROUTER_API_KEY in AGENTS.md by choosing one of the suggested phrasings and updating both places that mention E2E tests — the line that starts "E2E (`tests/`, `run_e2e.sh`)" and the later "**E2E tests**: `bun run test:e2e`" entry — so they consistently state whether the key is optional (e.g., "optionally tests upstream AI provider integration when OPENROUTER_API_KEY is set") or required (e.g., "requires OPENROUTER_API_KEY for the full upstream AI flow"); apply the same chosen wording to both occurrences and ensure the run command note matches (e.g., "set OPENROUTER_API_KEY" vs "requires OPENROUTER_API_KEY").
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@AGENTS.md`:
- Line 73: Remove the npm lockfile reference by deleting "web/package-lock.json"
from the lockfile checklist entry in AGENTS.md and ensure the checklist only
lists Bun lockfiles (e.g., "web/bun.lock") consistent with the project's "Use
Bun (not npm/node)" policy; update the checklist line that currently contains
"web/package-lock.json" so it no longer references npm lockfiles.
- Line 7: Unify the wording about OPENROUTER_API_KEY in AGENTS.md by choosing
one of the suggested phrasings and updating both places that mention E2E tests —
the line that starts "E2E (`tests/`, `run_e2e.sh`)" and the later "**E2E
tests**: `bun run test:e2e`" entry — so they consistently state whether the key
is optional (e.g., "optionally tests upstream AI provider integration when
OPENROUTER_API_KEY is set") or required (e.g., "requires OPENROUTER_API_KEY for
the full upstream AI flow"); apply the same chosen wording to both occurrences
and ensure the run command note matches (e.g., "set OPENROUTER_API_KEY" vs
"requires OPENROUTER_API_KEY").
Need help on this PR? Tag
@codesmithwith what you need.Summary by CodeRabbit