[Marukome0743]

Summary

• inject mise's existing URL replacement callback into the vfox runtime instead of duplicating settings or regex handling in the vfox crate
• apply replacements to direct artifact downloads and all built-in Lua HTTP APIs (get, try_get, head, try_head, download_file, and try_download_file)
• only attach automatically resolved GitHub credentials when URL rewriting stays on the same origin, while keeping artifact filenames based on the original URL

Problem

The vfox backend owns separate reqwest clients for artifact downloads and Lua HTTP helpers. Those requests bypassed mise's shared HTTP layer, so settings.url_replacements had no effect for vfox plugins.

Implementation

Vfox now accepts an optional URL-rewriter callback. Mise supplies its existing http::apply_url_replacements implementation, while standalone users of the vfox library and CLI retain the previous no-op behavior.

Lua requests apply the rewrite before resolving default GitHub authentication. Automatically resolved GitHub credentials are attached only when the rewritten URL retains the original scheme, host, and effective port; cross-origin mirrors receive no implicit token. Cross-origin rewrites remove known credential-bearing plugin headers while retaining required non-credential headers. Direct artifact downloads determine their local filename from the original URL, then use the rewritten URL for requests, retries, and logging. This allows mirrors whose paths do not preserve the upstream filename or extension.

Testing

• mise --cd crates/vfox run test (110 passed, 2 ignored)
• mise run test:e2e e2e/backend/test_vfox_url_replacements
• mise run test:e2e e2e/backend/test_vfox_install_env e2e/backend/test_vfox_rolling_install
• mise exec -- cargo check --all-features
• mise exec -- cargo clippy --workspace --all-features --all-targets -- -D warnings
• mise --cd crates/vfox run lint
• mise exec -- cargo fmt --all --check
• mise exec -- shfmt -d e2e/backend/test_vfox_url_replacements
• mise exec -- shellcheck e2e/backend/test_vfox_url_replacements

The repository-level mise run format and mise run lint wrappers could not run hk because it does not recognize this Sapling working copy as a Git repository. The corresponding Rustfmt, Clippy, shfmt, ShellCheck, and vfox lint checks were run individually as listed above.

Addresses #8427

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.

Summary by CodeRabbit

• New Features

  • Added URL replacement support for vfox artifact downloads and Lua HTTP requests.
  • URL replacements apply to GET, HEAD, download, and retryable HTTP operations.
  • Requests preserve existing behavior when no replacements are configured.
  • GitHub credentials are retained for same-origin rewritten requests and protected from cross-origin forwarding.

• Documentation

  • Documented URL replacement support across vfox downloads and HTTP operations.

• Tests

  • Added coverage for URL rewriting, downloads, plugin workflows, default behavior, and authorization handling.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Vfox now supports configurable URL rewriting for artifact downloads and Lua HTTP GET, HEAD, and download operations. The change includes origin-aware credential handling, tests, documentation, and an end-to-end plugin workflow.

Changes

URL rewriting

Layer / File(s)	Summary
Rewriter configuration and artifact downloads crates/vfox/src/vfox.rs, crates/vfox/src/plugin.rs, src/plugins/vfox_plugin.rs	Vfox stores and propagates URL rewriters. Plugins register the callback with the Lua HTTP module. Artifact downloads rewrite request URLs before HTTP requests.
Lua HTTP URL rewriting crates/vfox/src/http.rs, crates/vfox/src/lua_mod/http.rs	Lua GET, HEAD, and download operations rewrite URLs before requests. Cross-origin rewrites suppress default GitHub credentials. Same-origin rewrites preserve them.
Validation and documentation docs/dev-tools/backends/vfox.md, e2e/backend/test_vfox_url_replacements	Documentation describes URL replacements. An end-to-end plugin test verifies version discovery, installation, executable output, and supplement downloads.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Vfox
  participant Plugin
  participant LuaHTTP
  participant HTTPServer
  Vfox->>Plugin: register URL rewriter
  Plugin->>LuaHTTP: store url_rewriter_fn callback
  LuaHTTP->>LuaHTTP: rewrite request URL
  LuaHTTP->>HTTPServer: send rewritten request
  Vfox->>HTTPServer: download rewritten artifact

Loading

Poem

A rabbit maps each changing URL,
Through plugin paths and Lua as well.
Same origins keep credentials near,
Cross-origin headers disappear.
Tests and docs mark every trail.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling URL replacements in vfox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/vfox/src/plugin.rs`:
- Around line 145-150: Update Plugin::set_url_rewriter and its callers in
try_get, try_head, and try_download_file so URL rewrite failures preserve each
try_* method’s (nil, error) contract instead of raising an uncaught Lua error.
Either convert callback failures within every try_* path before request-error
handling, or make set_url_rewriter retain the original URL when Url::parse
fails.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f221e360-b13d-46f3-a7fd-7c639e857995

📥 Commits

Reviewing files that changed from the base of the PR and between b3ebfb9 and 3bcc6c1.

📒 Files selected for processing (7)

• crates/vfox/src/http.rs
• crates/vfox/src/lua_mod/http.rs
• crates/vfox/src/plugin.rs
• crates/vfox/src/vfox.rs
• docs/dev-tools/backends/vfox.md
• e2e/backend/test_vfox_url_replacements
• src/plugins/vfox_plugin.rs

[greptile-apps]

Greptile Summary

The PR makes vfox honor mise URL replacements for artifact downloads and Lua HTTP requests while preserving original artifact filenames and preventing credentials from crossing origins.

• Adds a configurable URL-rewriter callback to the vfox runtime and registers mise’s shared replacement implementation.
• Applies rewritten URLs across direct downloads and all Lua HTTP helpers.
• Uses same-origin checks and credential-header filtering to prevent implicit or explicit credentials from reaching replacement origins.
• Adds unit and end-to-end coverage and documents the behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/vfox/src/lua_mod/http.rs	Rewrites every Lua HTTP request before dispatch and now filters known credential-bearing headers on cross-origin replacements while retaining the safe headers identified in prior feedback.
crates/vfox/src/plugin.rs	Registers the runtime URL-rewriter callback in each plugin Lua registry and preserves invalid URL strings.
crates/vfox/src/vfox.rs	Adds optional URL rewriting to vfox and applies it to artifact requests without changing filename derivation.
src/plugins/vfox_plugin.rs	Connects mise’s existing URL-replacement implementation to newly created vfox runtimes.
e2e/backend/test_vfox_url_replacements	Exercises replacements for version discovery, direct artifact installation, and Lua-managed supplemental downloads.

_{Reviews (10): Last reviewed commit: "fix(vfox): honor url replacements" | Re-trigger Greptile}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.