fix(sdk): reject Cloudflare-native model IDs, bridge multi-part auth env vars - #397
fix(sdk): reject Cloudflare-native model IDs, bridge multi-part auth env vars#397sentry-junior[bot] wants to merge 5 commits into
1 issue
code-review: Found 1 issue (1 medium)
Medium
`findMissingCloudflareEnv` only checks the first set model field, skipping Cloudflare env validation for `auxiliaryModel`/`synthesisModel` - `packages/warden/src/action/triggers/executor.ts:138`
findMissingCloudflareEnv collapses the three model fields with ??, so when model is a non-Cloudflare selector but auxiliaryModel or synthesisModel is a Cloudflare provider, the Cloudflare provider is never examined and missing CLOUDFLARE_ACCOUNT_ID is not reported. The auxiliary/synthesis Pi calls then fail at runtime with the opaque 'authentication problem' error this PR intends to eliminate.
Also found at:
packages/warden/src/cli/main.ts:1531packages/warden/src/action/workflow/schedule.ts:182packages/warden/src/cli/main.ts:10packages/warden/src/sdk/runtimes/model-selectors.ts:162-168
⏱ 5m 4s · 1.4M in / 75.6k out · $3.25
Annotations
Check warning on line 138 in packages/warden/src/action/triggers/executor.ts
sentry-warden / warden: code-review
`findMissingCloudflareEnv` only checks the first set model field, skipping Cloudflare env validation for `auxiliaryModel`/`synthesisModel`
`findMissingCloudflareEnv` collapses the three model fields with `??`, so when `model` is a non-Cloudflare selector but `auxiliaryModel` or `synthesisModel` is a Cloudflare provider, the Cloudflare provider is never examined and missing `CLOUDFLARE_ACCOUNT_ID` is not reported. The auxiliary/synthesis Pi calls then fail at runtime with the opaque 'authentication problem' error this PR intends to eliminate.
Check warning on line 1531 in packages/warden/src/cli/main.ts
sentry-warden / warden: code-review
[2WJ-2N4] `findMissingCloudflareEnv` only checks the first set model field, skipping Cloudflare env validation for `auxiliaryModel`/`synthesisModel` (additional location)
`findMissingCloudflareEnv` collapses the three model fields with `??`, so when `model` is a non-Cloudflare selector but `auxiliaryModel` or `synthesisModel` is a Cloudflare provider, the Cloudflare provider is never examined and missing `CLOUDFLARE_ACCOUNT_ID` is not reported. The auxiliary/synthesis Pi calls then fail at runtime with the opaque 'authentication problem' error this PR intends to eliminate.
Check warning on line 182 in packages/warden/src/action/workflow/schedule.ts
sentry-warden / warden: code-review
[2WJ-2N4] `findMissingCloudflareEnv` only checks the first set model field, skipping Cloudflare env validation for `auxiliaryModel`/`synthesisModel` (additional location)
`findMissingCloudflareEnv` collapses the three model fields with `??`, so when `model` is a non-Cloudflare selector but `auxiliaryModel` or `synthesisModel` is a Cloudflare provider, the Cloudflare provider is never examined and missing `CLOUDFLARE_ACCOUNT_ID` is not reported. The auxiliary/synthesis Pi calls then fail at runtime with the opaque 'authentication problem' error this PR intends to eliminate.
Check warning on line 10 in packages/warden/src/cli/main.ts
sentry-warden / warden: code-review
[2WJ-2N4] `findMissingCloudflareEnv` only checks the first set model field, skipping Cloudflare env validation for `auxiliaryModel`/`synthesisModel` (additional location)
`findMissingCloudflareEnv` collapses the three model fields with `??`, so when `model` is a non-Cloudflare selector but `auxiliaryModel` or `synthesisModel` is a Cloudflare provider, the Cloudflare provider is never examined and missing `CLOUDFLARE_ACCOUNT_ID` is not reported. The auxiliary/synthesis Pi calls then fail at runtime with the opaque 'authentication problem' error this PR intends to eliminate.
Check warning on line 168 in packages/warden/src/sdk/runtimes/model-selectors.ts
sentry-warden / warden: code-review
[2WJ-2N4] `findMissingCloudflareEnv` only checks the first set model field, skipping Cloudflare env validation for `auxiliaryModel`/`synthesisModel` (additional location)
`findMissingCloudflareEnv` collapses the three model fields with `??`, so when `model` is a non-Cloudflare selector but `auxiliaryModel` or `synthesisModel` is a Cloudflare provider, the Cloudflare provider is never examined and missing `CLOUDFLARE_ACCOUNT_ID` is not reported. The auxiliary/synthesis Pi calls then fail at runtime with the opaque 'authentication problem' error this PR intends to eliminate.