feat: add Custom API Settings for proxy services #387
Conversation
Add UI for configuring proxy services (OpenRouter, LiteLLM, custom deployments) in the onboarding wizard, eliminating the need for manual .env file editing. Features: - Collapsible Custom API Settings section in onboarding wizard - Base URL input for proxy endpoint configuration - Secure Auth Token field with show/hide toggle - Custom Model name mapping (e.g., gemini-claude-sonnet-4-5) - Auto-updates .env with ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, AUTO_BUILD_MODEL - Intelligent fallback path detection for dev/production modes - Input validation and user-friendly error messages Benefits: - Enables cost-effective proxy usage without technical knowledge - Faster provider switching and testing - Safer configuration through UI validation - Better support for enterprise deployments Changes: - insights_runner.py: Read AUTO_BUILD_MODEL from environment - settings-handlers.ts: IPC handler to update .env file - settings-api.ts: Preload API for saveCustomApiSettings - OAuthStep.tsx: Custom API Settings UI component - ipc.ts: Type definitions for custom API settings Co-Authored-By: Claude <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code)
📝 WalkthroughWalkthroughThe PR makes the backend runner's default model environment-driven (model param now optional) and adds frontend support to save custom API settings (base URL, auth token, optional model) into the backend .env via a new IPC channel, preload API, and onboarding UI. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant UI as OAuthStep (renderer)
participant Preload as SettingsAPI (preload)
participant IPC as Electron IPC
participant Handler as settings-handler (main)
participant FS as Backend .env / Filesystem
User->>UI: Enter baseUrl, authToken, (optional) model
User->>UI: Click "Save"
UI->>UI: Validate inputs
alt valid
UI->>Preload: saveCustomApiSettings({baseUrl, authToken, model})
Preload->>IPC: invoke 'settings:saveCustomApi' with settings
IPC->>Handler: deliver settings
rect rgb(235,245,255)
Handler->>Handler: locate autoBuildPath (detect/backups)
Handler->>FS: read existing .env (if present)
Handler->>Handler: update or append env keys (ANTHROPIC_*, NO_PROXY, AUTO_BUILD_MODEL, etc.)
Handler->>FS: write .env
end
alt success
Handler->>IPC: return success IPCResult
IPC->>Preload: resolve
Preload->>UI: notify success
UI->>User: show success
else error
Handler->>IPC: return error IPCResult
IPC->>Preload: reject
Preload->>UI: show error
UI->>User: show error
end
else invalid
UI->>User: show validation error
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used📓 Path-based instructions (2)apps/frontend/src/**/*.{ts,tsx}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
apps/frontend/**/*.{ts,tsx}⚙️ CodeRabbit configuration file
Files:
🧬 Code graph analysis (1)apps/frontend/src/main/ipc-handlers/settings-handlers.ts (3)
🪛 ast-grep (0.40.3)apps/frontend/src/main/ipc-handlers/settings-handlers.ts[warning] 507-507: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns. (regexp-from-variable) 🔇 Additional comments (7)
Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🎉 Thanks for your first PR!
A maintainer will review it soon. Please make sure:
- Your branch is synced with
develop - CI checks pass
- You've followed our contribution guide
Welcome to the Auto Claude community!
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (5)
apps/backend/runners/insights_runner.pyapps/frontend/src/main/ipc-handlers/settings-handlers.tsapps/frontend/src/preload/api/settings-api.tsapps/frontend/src/renderer/components/onboarding/OAuthStep.tsxapps/frontend/src/shared/types/ipc.ts
🧰 Additional context used
📓 Path-based instructions (3)
apps/frontend/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
apps/frontend/src/**/*.{ts,tsx}: Always use translation keys withuseTranslation()for all user-facing text in React/TypeScript frontend components - use formatnamespace:section.key(e.g.,navigation:items.githubPRs)
Never use hardcoded strings in JSX/TSX files for user-facing text - always reference translation keys fromapps/frontend/src/shared/i18n/locales/
Files:
apps/frontend/src/preload/api/settings-api.tsapps/frontend/src/shared/types/ipc.tsapps/frontend/src/main/ipc-handlers/settings-handlers.tsapps/frontend/src/renderer/components/onboarding/OAuthStep.tsx
apps/frontend/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/frontend/**/*.{ts,tsx}: Review React patterns and TypeScript type safety.
Check for proper state management and component composition.
Files:
apps/frontend/src/preload/api/settings-api.tsapps/frontend/src/shared/types/ipc.tsapps/frontend/src/main/ipc-handlers/settings-handlers.tsapps/frontend/src/renderer/components/onboarding/OAuthStep.tsx
apps/backend/**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
apps/backend/**/*.py: Always use the Claude Agent SDK (create_client()fromcore.client) for AI interactions - NEVER useanthropic.Anthropic()directly
Usecreate_client()fromapps/backend/core/client.pywith proper parameters:project_dir,spec_dir,model,agent_type, and optionalmax_thinking_tokens
Files:
apps/backend/runners/insights_runner.py
⚙️ CodeRabbit configuration file
apps/backend/**/*.py: Focus on Python best practices, type hints, and async patterns.
Check for proper error handling and security considerations.
Verify compatibility with Python 3.12+.
Files:
apps/backend/runners/insights_runner.py
🧠 Learnings (1)
📚 Learning: 2025-12-19T15:00:48.233Z
Learnt from: AndyMik90
Repo: AndyMik90/Auto-Claude PR: 41
File: auto-claude/qa/loop.py:126-136
Timestamp: 2025-12-19T15:00:48.233Z
Learning: In auto-claude/qa/loop.py, when creating clients for QA fixer sessions (including human feedback processing), use get_phase_model(spec_dir, "qa", model) instead of hardcoding "sonnet" as the fallback to support dynamic model selection based on profiles.
Applied to files:
apps/backend/runners/insights_runner.py
🧬 Code graph analysis (2)
apps/frontend/src/preload/api/settings-api.ts (1)
apps/frontend/src/renderer/components/settings/utils/hookProxyFactory.ts (1)
settings(15-15)
apps/frontend/src/renderer/components/onboarding/OAuthStep.tsx (4)
apps/frontend/src/renderer/components/settings/utils/hookProxyFactory.ts (1)
setError(19-19).design-system/src/components/Button.tsx (1)
Button(10-44).design-system/src/lib/icons.ts (2)
ChevronRight(23-23)Check(21-21).design-system/src/components/Input.tsx (1)
Input(4-24)
🪛 ast-grep (0.40.3)
apps/frontend/src/main/ipc-handlers/settings-handlers.ts
[warning] 497-497: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(^${key}=.*$, 'm')
Note: [CWE-1333] Inefficient Regular Expression Complexity [REFERENCES]
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://cwe.mitre.org/data/definitions/1333.html
(regexp-from-variable)
🔇 Additional comments (9)
apps/frontend/src/shared/types/ipc.ts (1)
211-216: LGTM!The type definition for
saveCustomApiSettingsis correctly added to theElectronAPIinterface. The signature matches the implementation in the IPC handler and preload API.apps/frontend/src/main/ipc-handlers/settings-handlers.ts (1)
506-527: LGTM on the env variable updates.The logic for updating environment variables is correct. The try/catch around URL parsing for NO_PROXY is good defensive coding. Writing the file with
trim() + '\n'ensures clean formatting.apps/backend/runners/insights_runner.py (4)
12-12: LGTM!Adding
import osto support environment variable reading is appropriate.
136-136: LGTM!Changing the default to
Noneallows for environment-based resolution, which is the correct approach for this feature.
156-158: LGTM!The environment variable resolution with fallback is well implemented. Reading from
AUTO_BUILD_MODELwith a sensible default ensures backward compatibility while enabling configuration flexibility.
343-345: LGTM!The CLI argument change correctly reflects the new environment-based default behavior, and the help text clearly documents the precedence.
apps/frontend/src/renderer/components/onboarding/OAuthStep.tsx (2)
63-69: LGTM!The new state variables follow the existing patterns in the component and are appropriately named for their purpose.
292-320: LGTM!The handler has proper validation, loading state management, and error handling. The success message correctly informs users about the restart requirement.
apps/frontend/src/preload/api/settings-api.ts (1)
26-31: LGTM on the interface definition.The
saveCustomApiSettingsmethod is correctly defined in theSettingsAPIinterface with proper typing.
- Renamed IPC channel for saving custom API settings to improve clarity. - Enhanced .env file handling with regex escaping for keys and values to prevent issues with special characters. - Updated onboarding UI to utilize translation keys for better localization support. - Added new translation entries for custom API settings in both English and French. This refactor improves the robustness of the custom API settings feature and enhances the user experience through better localization.
DK625
force-pushed
the
feature/custom-api-settings
branch
from
5cb0587 to
08985f7
Compare
MikeeBuilds
added
feature
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (3)
apps/frontend/src/main/ipc-handlers/settings-handlers.tsapps/frontend/src/preload/api/settings-api.tsapps/frontend/src/shared/types/ipc.ts
🧰 Additional context used
📓 Path-based instructions (2)
apps/frontend/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
apps/frontend/src/**/*.{ts,tsx}: Always use translation keys withuseTranslation()for all user-facing text in React/TypeScript frontend components - use formatnamespace:section.key(e.g.,navigation:items.githubPRs)
Never use hardcoded strings in JSX/TSX files for user-facing text - always reference translation keys fromapps/frontend/src/shared/i18n/locales/
Files:
apps/frontend/src/preload/api/settings-api.tsapps/frontend/src/shared/types/ipc.tsapps/frontend/src/main/ipc-handlers/settings-handlers.ts
apps/frontend/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/frontend/**/*.{ts,tsx}: Review React patterns and TypeScript type safety.
Check for proper state management and component composition.
Files:
apps/frontend/src/preload/api/settings-api.tsapps/frontend/src/shared/types/ipc.tsapps/frontend/src/main/ipc-handlers/settings-handlers.ts
🧬 Code graph analysis (3)
apps/frontend/src/preload/api/settings-api.ts (1)
apps/frontend/src/shared/constants/ipc.ts (1)
IPC_CHANNELS(6-368)
apps/frontend/src/shared/types/ipc.ts (1)
apps/frontend/src/renderer/components/settings/utils/hookProxyFactory.ts (1)
settings(15-15)
apps/frontend/src/main/ipc-handlers/settings-handlers.ts (2)
apps/frontend/src/main/settings-utils.ts (1)
readSettingsFile(29-43)apps/frontend/src/shared/constants/config.ts (1)
DEFAULT_APP_SETTINGS(19-52)
🪛 ast-grep (0.40.3)
apps/frontend/src/main/ipc-handlers/settings-handlers.ts
[warning] 513-513: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(^${escapedKey}=.*$, 'm')
Note: [CWE-1333] Inefficient Regular Expression Complexity [REFERENCES]
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://cwe.mitre.org/data/definitions/1333.html
(regexp-from-variable)
🔇 Additional comments (3)
apps/frontend/src/shared/types/ipc.ts (1)
211-216: LGTM!The type definition is consistent with the IPC handler and preload API implementations. The optional
modelfield andPromise<IPCResult>return type correctly reflect the backend behavior.apps/frontend/src/main/ipc-handlers/settings-handlers.ts (1)
522-544: LGTM on the env var updates and file write logic.The environment variable updates, URL hostname extraction for
NO_PROXY, and file write handling are well-implemented. The static analysis warning about regex construction (line 513) is a false positive since all key values are controlled internal constants, not user input.apps/frontend/src/preload/api/settings-api.ts (1)
27-32: LGTM!The interface definition and implementation are correctly wired. The
IPC_CHANNELS.SETTINGS_SAVE_CUSTOM_APIconstant is used consistently (addressing the past review), and the type signature matches the handler andElectronAPIinterface.Also applies to: 61-67
…lues
Applied CodeRabbit review feedback to fix bug in updateEnvVar function:
**Issue:**
The escapeReplacement() function was incorrectly used in the append case (line 513),
causing values containing $ to be corrupted when written to .env file.
Example: "abc$def" would become "abc$$def" in the output.
**Solution:**
- Remove escapeReplacement() function entirely (no longer needed)
- Use function replacement pattern: .replace(regex, () => `${key}=${value}`)
- Function replacements don't interpret special characters like $ in the value
- Both replace and append cases now use raw value directly
This approach is cleaner and avoids all special character interpretation issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <[email protected]>
…5/Auto-Claude into feature/custom-api-settings
|
|
5 participants
Add UI for configuring proxy services (OpenRouter, LiteLLM, custom deployments) in the onboarding wizard, eliminating the need for manual .env file editing.
Features:
Benefits:
Changes:
Co-Authored-By: Claude [email protected]
🤖 Generated with Claude Code
Base Branch
developbranch (required for all feature/fix PRs)main(hotfix only - maintainers)Description
Related Issue
Closes #
Type of Change
Area
Commit Message Format
Follow conventional commits:
<type>: <subject>Types: feat, fix, docs, style, refactor, test, chore
Example:
feat: add user authentication systemChecklist
developbranchCI/Testing Requirements
Screenshots
Feature Toggle
use_feature_nameBreaking Changes
Breaking: Yes / No
Details:
Summary by CodeRabbit
New Features
Chores
✏️ Tip: You can customize this high-level summary in your review settings.