Updated ARchon with latest code from main branch of Cole#853
Updated ARchon with latest code from main branch of Cole#853rohitmathur507 wants to merge 2 commits intocoleam00:mainfrom
Conversation
WalkthroughThis PR adds Azure OpenAI and AWS Bedrock support across the stack: env/docs updates, UI for cloud provider credential management, DB migration entries for provider credentials, a new AWS Bedrock adapter and Azure embedding adapter, config and service changes to recognize providers, auto-switching provider logic on credential save, and boto3 dependency. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant CloudUI as CloudProvidersSection
participant BackendAPI as Settings API
participant CredentialsSvc as credentialsService
User->>CloudUI: Open Settings
CloudUI->>BackendAPI: GET /credentials
BackendAPI-->>CloudUI: Return credentials (masked/encrypted flags)
User->>CloudUI: Edit provider fields
CloudUI->>CloudUI: Track hasChanges
User->>CloudUI: Click Save Changes
CloudUI->>CredentialsSvc: Create/Update credential entries
CredentialsSvc->>BackendAPI: Persist credentials
BackendAPI->>BackendAPI: Validate required fields for provider
BackendAPI->>BackendAPI: Auto-set LLM_PROVIDER/EMBEDDING_PROVIDER if complete
BackendAPI-->>CloudUI: Success
CloudUI->>BackendAPI: Refresh credentials
BackendAPI-->>CloudUI: Updated credentials
sequenceDiagram
participant Client
participant LLMSvc as llm_provider_service
participant BedrockAdapter as AWSBedrockClientAdapter
participant Bedrock as AWS Bedrock
Client->>LLMSvc: get_llm_client("aws-bedrock")
LLMSvc->>Bedrock: create boto3 bedrock client
LLMSvc->>BedrockAdapter: wrap client
Client->>BedrockAdapter: create(model, messages)
BedrockAdapter->>BedrockAdapter: translate OpenAI → Bedrock
BedrockAdapter->>Bedrock: invoke Converse API
Bedrock-->>BedrockAdapter: response
BedrockAdapter->>BedrockAdapter: normalize to OpenAI format
BedrockAdapter-->>Client: OpenAI-compatible response
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Areas needing extra attention:
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
archon-ui-main/src/components/settings/APIKeysSection.tsx (1)
152-167: Ensure renamed credentials delete the original key.If someone renames an existing credential locally and then clicks Delete before saving, we end up calling the backend with the new key—which doesn’t exist yet—so the API returns 404 and the original credential survives. Delete should target the persisted key (
originalKeywhen it differs). The diff below fixes the bug and keeps the toast accurate.- await credentialsService.deleteCredential(cred.key); - setCustomCredentials(customCredentials.filter((_, i) => i !== index)); - showToast(`Deleted ${cred.key}`, 'success'); + const keyToDelete = + cred.originalKey && cred.originalKey !== cred.key ? cred.originalKey : cred.key; + await credentialsService.deleteCredential(keyToDelete); + setCustomCredentials(customCredentials.filter((_, i) => i !== index)); + showToast(`Deleted ${keyToDelete}`, 'success');python/src/server/config/config.py (1)
239-334: Load AWS Bedrock env vars into EnvironmentConfig.We introduced AWS Bedrock fields but never read the corresponding environment variables, nor pass them into
EnvironmentConfig. As written, every AWS value staysNone, so Bedrock can’t be configured and the new provider support breaks at runtime. Please pull theAWS_*env vars, run the provided validators, and include them in the returned dataclass.- # Azure OpenAI configuration (optional) + # Azure OpenAI configuration (optional) azure_openai_endpoint = os.getenv("AZURE_OPENAI_ENDPOINT") azure_openai_api_key = os.getenv("AZURE_OPENAI_API_KEY") azure_openai_api_version = os.getenv("AZURE_OPENAI_API_VERSION") azure_openai_deployment = os.getenv("AZURE_OPENAI_DEPLOYMENT") + + # AWS Bedrock configuration (optional) + aws_access_key_id = os.getenv("AWS_ACCESS_KEY_ID") + aws_secret_access_key = os.getenv("AWS_SECRET_ACCESS_KEY") + aws_region = os.getenv("AWS_REGION") + aws_bedrock_model_id = os.getenv("AWS_BEDROCK_MODEL_ID") @@ - if azure_openai_api_version: + if azure_openai_api_version: validate_azure_openai_api_version(azure_openai_api_version) + if aws_access_key_id: + validate_aws_access_key_id(aws_access_key_id) + if aws_region: + validate_aws_region(aws_region) @@ - transport=transport, - azure_openai_endpoint=azure_openai_endpoint, - azure_openai_api_key=azure_openai_api_key, - azure_openai_api_version=azure_openai_api_version, - azure_openai_deployment=azure_openai_deployment, + transport=transport, + azure_openai_endpoint=azure_openai_endpoint, + azure_openai_api_key=azure_openai_api_key, + azure_openai_api_version=azure_openai_api_version, + azure_openai_deployment=azure_openai_deployment, + aws_access_key_id=aws_access_key_id, + aws_secret_access_key=aws_secret_access_key, + aws_region=aws_region, + aws_bedrock_model_id=aws_bedrock_model_id, )
🧹 Nitpick comments (1)
python/src/server/adapters/aws_bedrock_adapter.py (1)
262-267: Useget_running_loop()inside async code.
asyncio.get_event_loop()is deprecated in async contexts on Python 3.12. Switching toasyncio.get_running_loop()avoids deprecation warnings and is the recommended pattern.- loop = asyncio.get_event_loop() + loop = asyncio.get_running_loop()
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (15)
.env.example(1 hunks)README.md(5 hunks)archon-ui-main/src/components/settings/APIKeysSection.tsx(7 hunks)archon-ui-main/src/components/settings/CloudProvidersSection.tsx(1 hunks)archon-ui-main/src/pages/SettingsPage.tsx(2 hunks)migration/complete_setup.sql(1 hunks)python/pyproject.toml(2 hunks)python/src/server/adapters/__init__.py(1 hunks)python/src/server/adapters/aws_bedrock_adapter.py(1 hunks)python/src/server/api_routes/knowledge_api.py(43 hunks)python/src/server/api_routes/settings_api.py(9 hunks)python/src/server/config/config.py(7 hunks)python/src/server/services/credential_service.py(13 hunks)python/src/server/services/embeddings/embedding_service.py(17 hunks)python/src/server/services/llm_provider_service.py(39 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
archon-ui-main/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
archon-ui-main/src/**/*.{ts,tsx}: Frontend TypeScript must use strict mode with no implicit any
Use TanStack Query for all data fetching; avoid prop drilling
Use database values directly in the frontend; avoid mapping layers between BE and FE types
Files:
archon-ui-main/src/components/settings/CloudProvidersSection.tsxarchon-ui-main/src/pages/SettingsPage.tsxarchon-ui-main/src/components/settings/APIKeysSection.tsx
python/src/**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
python/src/**/*.py: On service startup, missing configuration, DB connection failures, auth/authorization failures, critical dependency outages, or invalid/corrupting data: fail fast and bubble errors
For batch processing, background tasks, WebSocket events, optional features, and external API calls: continue processing but log errors (with retries/backoff for APIs)
Never accept or persist corrupted data; skip failed items entirely (e.g., zero embeddings, null FKs, malformed JSON)
Error messages must include operation context, IDs/URLs, use specific exception types, preserve full stack traces (logging with exc_info=True), and avoid returning None/null—raise exceptions instead; for batches report success counts and detailed failures
Backend code targets Python 3.12 and adheres to a 120 character line length
Use Ruff for linting (errors, warnings, unused imports) in backend code
Use Mypy for static type checking in backend code
Files:
python/src/server/services/embeddings/embedding_service.pypython/src/server/adapters/__init__.pypython/src/server/services/credential_service.pypython/src/server/adapters/aws_bedrock_adapter.pypython/src/server/api_routes/settings_api.pypython/src/server/api_routes/knowledge_api.pypython/src/server/config/config.pypython/src/server/services/llm_provider_service.py
🧠 Learnings (6)
📚 Learning: 2025-09-19T10:32:55.580Z
Learnt from: CR
Repo: coleam00/Archon PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-09-19T10:32:55.580Z
Learning: Applies to archon-ui-main/src/features/*/components/**/*.{ts,tsx} : Place new UI components under src/features/[feature]/components
Applied to files:
archon-ui-main/src/components/settings/CloudProvidersSection.tsxarchon-ui-main/src/pages/SettingsPage.tsx
📚 Learning: 2025-09-19T10:32:55.580Z
Learnt from: CR
Repo: coleam00/Archon PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-09-19T10:32:55.580Z
Learning: Applies to python/src/**/*.py : For batch processing, background tasks, WebSocket events, optional features, and external API calls: continue processing but log errors (with retries/backoff for APIs)
Applied to files:
python/src/server/services/embeddings/embedding_service.py
📚 Learning: 2025-10-19T09:25:49.653Z
Learnt from: CR
Repo: coleam00/Archon PR: 0
File: archon-example-workflow/CLAUDE.md:0-0
Timestamp: 2025-10-19T09:25:49.653Z
Learning: Before any task management work, stop and check if the Archon MCP server is available
Applied to files:
README.md
📚 Learning: 2025-08-20T19:38:04.097Z
Learnt from: Chillbruhhh
Repo: coleam00/Archon PR: 378
File: python/src/server/services/storage/document_storage_service.py:304-306
Timestamp: 2025-08-20T19:38:04.097Z
Learning: The archon_crawled_pages table in the Archon project has a table-level unique constraint on (url, chunk_number) defined inline in the CREATE TABLE statement in migration/complete_setup.sql at line 202, which allows upsert operations with on_conflict="url,chunk_number" to work properly without requiring additional migrations.
Applied to files:
migration/complete_setup.sql
📚 Learning: 2025-08-20T19:38:04.097Z
Learnt from: Chillbruhhh
Repo: coleam00/Archon PR: 378
File: python/src/server/services/storage/document_storage_service.py:304-306
Timestamp: 2025-08-20T19:38:04.097Z
Learning: The archon_crawled_pages table in the Archon project has a table-level unique constraint on (url, chunk_number) defined inline in the CREATE TABLE statement in migration/complete_setup.sql at line 202, which allows upsert operations with on_conflict="url,chunk_number" to work properly.
Applied to files:
migration/complete_setup.sql
📚 Learning: 2025-09-19T10:32:55.580Z
Learnt from: CR
Repo: coleam00/Archon PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-09-19T10:32:55.580Z
Learning: Applies to .env : Require SUPABASE_URL and SUPABASE_SERVICE_KEY in .env
Applied to files:
.env.example
🧬 Code graph analysis (10)
archon-ui-main/src/components/settings/CloudProvidersSection.tsx (4)
archon-ui-main/src/features/shared/hooks/useToast.ts (1)
useToast(26-32)archon-ui-main/src/services/credentialsService.ts (1)
credentialsService(604-604)archon-ui-main/src/features/ui/primitives/card.tsx (1)
Card(23-136)archon-ui-main/src/features/ui/primitives/button.tsx (1)
Button(11-130)
python/src/server/services/embeddings/embedding_service.py (4)
python/src/server/services/embeddings/embedding_exceptions.py (2)
EmbeddingRateLimitError(61-72)EmbeddingAPIError(86-99)python/src/server/services/llm_provider_service.py (2)
get_llm_client(370-704)get_embedding_model(775-883)python/src/server/services/credential_service.py (1)
get_credentials_by_category(345-394)python/src/server/services/threading_service.py (1)
rate_limited_operation(459-479)
python/src/server/adapters/__init__.py (1)
python/src/server/adapters/aws_bedrock_adapter.py (1)
AWSBedrockClientAdapter(18-280)
python/src/server/services/credential_service.py (1)
python/src/server/api_routes/settings_api.py (1)
get_credential(146-191)
python/src/server/adapters/aws_bedrock_adapter.py (1)
python/src/server/config/logfire_config.py (1)
get_logger(137-147)
python/src/server/api_routes/settings_api.py (1)
python/src/server/services/credential_service.py (4)
get_credential(160-179)get_credential(620-622)set_credential(192-285)set_credential(625-635)
archon-ui-main/src/pages/SettingsPage.tsx (1)
archon-ui-main/src/components/settings/CloudProvidersSection.tsx (1)
CloudProvidersSection(117-463)
archon-ui-main/src/components/settings/APIKeysSection.tsx (3)
archon-ui-main/src/services/credentialsService.ts (3)
credentialsService(604-604)updateCredential(276-303)deleteCredential(331-346)archon-ui-main/src/features/ui/primitives/button.tsx (1)
Button(11-130)archon-ui-main/src/features/ui/primitives/card.tsx (1)
Card(23-136)
python/src/server/api_routes/knowledge_api.py (5)
python/src/server/services/embeddings/provider_error_adapters.py (2)
ProviderErrorFactory(121-162)sanitize_provider_error(135-137)python/src/server/utils/progress/progress_tracker.py (5)
error(196-219)start(75-91)complete(166-194)get_progress(45-47)update(93-164)python/src/server/services/credential_service.py (1)
get_active_provider(451-555)python/src/server/utils/document_processing.py (1)
extract_text_from_document(158-221)python/src/server/services/crawling/crawling_service.py (2)
get_active_orchestration(47-51)unregister_orchestration(61-65)
python/src/server/services/llm_provider_service.py (3)
python/src/server/services/credential_service.py (4)
get_credentials_by_category(345-394)get_active_provider(451-555)get_credential(160-179)get_credential(620-622)python/src/server/adapters/aws_bedrock_adapter.py (1)
AWSBedrockClientAdapter(18-280)python/src/server/services/ollama/model_discovery_service.py (1)
check_instance_health(958-1012)
🪛 ast-grep (0.39.7)
python/src/server/config/config.py
[warning] 165-175: A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).
Context: jwt.decode(
supabase_key,
"",
options={
"verify_signature": False,
"verify_aud": False,
"verify_exp": False,
"verify_nbf": False,
"verify_iat": False,
},
)
Note: [CWE-798]: Use of Hard-coded Credentials [OWASP A01:2021]: Identification and Authentication Failures [REFERENCES]
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
(python-pyjwt-hardcoded-secret-python)
🪛 markdownlint-cli2 (0.18.1)
README.md
212-212: Bare URL used
(MD034, no-bare-urls)
🔇 Additional comments (3)
python/pyproject.toml (1)
35-69: Dependency addition looks appropriate.Bringing in
boto3>=1.34.0aligns with the new Bedrock adapters and keeps the server/all groups consistent. No concerns here.python/src/server/adapters/__init__.py (1)
1-7: Good export surface.Exposing
AWSBedrockClientAdaptervia__all__keeps the package boundary clean and makes the adapter discoverable. Looks solid..env.example (1)
57-83: Nice guidance on cloud provider variables.Calling out both Azure OpenAI and AWS Bedrock env vars (and nudging users toward the UI) makes onboarding smoother. Looks good.
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
python/src/server/config/config.py (1)
340-351: AWS Bedrock fields missing from EnvironmentConfig constructor.The AWS Bedrock fields are not being passed to the
EnvironmentConfigconstructor, even though they were added to the dataclass. After loading the AWS environment variables (see previous comment), they must be included in the returned configuration.Add the AWS fields to the constructor after line 350:
azure_openai_endpoint=azure_openai_endpoint, azure_openai_api_key=azure_openai_api_key, azure_openai_api_version=azure_openai_api_version, azure_openai_deployment=azure_openai_deployment, + aws_access_key_id=aws_access_key_id, + aws_secret_access_key=aws_secret_access_key, + aws_region=aws_region, + aws_bedrock_model_id=aws_bedrock_model_id, )
🧹 Nitpick comments (1)
python/src/server/config/config.py (1)
135-163: Consider dynamic AWS region validation.The validator uses a hardcoded list of AWS regions, which may become stale as AWS frequently adds new regions, especially for Bedrock. While the validator allows non-standard regions (lines 159-161), consider documenting this list's maintenance requirements or fetching valid regions dynamically if boto3 is already a dependency.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.env.example(1 hunks)README.md(3 hunks)python/pyproject.toml(2 hunks)python/src/server/config/config.py(6 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- .env.example
- python/pyproject.toml
- README.md
🧰 Additional context used
📓 Path-based instructions (1)
python/src/**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
python/src/**/*.py: On service startup, missing configuration, DB connection failures, auth/authorization failures, critical dependency outages, or invalid/corrupting data: fail fast and bubble errors
For batch processing, background tasks, WebSocket events, optional features, and external API calls: continue processing but log errors (with retries/backoff for APIs)
Never accept or persist corrupted data; skip failed items entirely (e.g., zero embeddings, null FKs, malformed JSON)
Error messages must include operation context, IDs/URLs, use specific exception types, preserve full stack traces (logging with exc_info=True), and avoid returning None/null—raise exceptions instead; for batches report success counts and detailed failures
Backend code targets Python 3.12 and adheres to a 120 character line length
Use Ruff for linting (errors, warnings, unused imports) in backend code
Use Mypy for static type checking in backend code
Files:
python/src/server/config/config.py
1 participant
Pull Request
Summary
Changes Made
Type of Change
Affected Services
Testing
Test Evidence
Checklist
Breaking Changes
Additional Notes
Summary by CodeRabbit
New Features
Documentation