feat(mastracode): support external tool injection and auth storage init#13561
Closed
Kitenite wants to merge 19 commits into
Closed
feat(mastracode): support external tool injection and auth storage init#13561Kitenite wants to merge 19 commits into
Kitenite wants to merge 19 commits into
Conversation
🦋 Changeset detectedLatest commit: efdeda2 The changes in this PR will be included in the next version bump. This PR includes changesets to release 21 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
@Kitenite is attempting to deploy a commit to the Mastra Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds exported createAuthStorage and wires it into provider modules; makes createDynamicTools accept extra tools and an optional HookManager and wraps tools with pre/post hooks; renames harness image payloads to files (including stream/type updates); adds related tests and a fork-sync GitHub Actions workflow. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
mastracode/src/__tests__/create-auth-storage.test.ts (1)
6-12: Consider test isolation for global state.This test mutates module-level state in the provider modules. If other tests in the suite rely on auth storage being unset or differently configured, they could fail or behave unexpectedly.
Consider adding cleanup or running this test in isolation:
🧹 Optional: Add afterEach cleanup
+import { afterEach } from 'vitest'; +import { setAuthStorage as resetClaudeAuth } from '../providers/claude-max.js'; +import { setAuthStorage as resetOpenAIAuth } from '../providers/openai-codex.js'; + describe('createAuthStorage', () => { + afterEach(() => { + // Reset to undefined to avoid polluting other tests + resetClaudeAuth(undefined as any); + resetOpenAIAuth(undefined as any); + }); + it('wires a shared auth storage instance to provider modules', () => {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@mastracode/src/__tests__/create-auth-storage.test.ts` around lines 6 - 12, The test mutates global provider state via createAuthStorage and the getters getClaudeAuthStorage and getOpenAIAuthStorage; add cleanup to restore isolation by resetting those module-level storages after the test: either call the appropriate reset/unset functions on the provider modules (or set their internal storage back to undefined) in an afterEach, or use test framework isolation (e.g., resetModules) so createAuthStorage only affects the current test, ensuring other tests won't see the mutated state.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@mastracode/src/__tests__/create-auth-storage.test.ts`:
- Around line 6-12: The test mutates global provider state via createAuthStorage
and the getters getClaudeAuthStorage and getOpenAIAuthStorage; add cleanup to
restore isolation by resetting those module-level storages after the test:
either call the appropriate reset/unset functions on the provider modules (or
set their internal storage back to undefined) in an afterEach, or use test
framework isolation (e.g., resetModules) so createAuthStorage only affects the
current test, ensuring other tests won't see the mutated state.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
mastracode/src/__tests__/create-auth-storage.test.tsmastracode/src/agents/__tests__/tools.test.tsmastracode/src/agents/tools.tsmastracode/src/index.ts
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/core/src/harness/harness.ts`:
- Around line 1289-1296: In the 'case "file"' branch inside harness.ts you are
silently coercing non-string part.data to '', which masks malformed file
payloads; instead validate that part.data is a string before calling
content.push (in the case 'file' block) and if it's not a string either throw a
descriptive Error or return/report a validation failure (do not replace with an
empty string), preserving mediaType and filename handling (the mediaType
property and filename spread logic) so callers can detect and handle the
malformed record upstream.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
mastracode/src/tui/mastra-tui.tspackages/core/src/harness/harness.tspackages/core/src/harness/types.ts
abhiaiyer91
approved these changes
Feb 27, 2026
* feat(harness): rename images→files and use AI SDK FilePart shape - sendMessage now accepts `files` (matching AI SDK FilePart: data, mediaType, filename) instead of `images` (custom shape with mimeType field mismatch) - Mapping is now a direct passthrough instead of pointless field rename - Add `type: 'file'` to HarnessMessageContent union for generic file parts - Handle `file` parts in convertToHarnessMessage for history reload * fix(mastracode): remap images→files in TUI fireMessage The harness sendMessage param was renamed from `images` (custom shape) to `files` (AI SDK FilePart shape). Remap at the TUI boundary so clipboard paste still works.
- Add afterEach cleanup in auth storage test for isolation - Skip malformed file parts (non-string data) instead of silently coercing - Add changesets for mastracode (minor) and @mastra/core (patch) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/huge-boxes-travel.md:
- Line 6: Update the changelog entry to include a concise before/after migration
and a short code example showing how to change calls to the harness sendMessage
API from the old images field to the new files field that matches the AI SDK
FilePart shape (data, mediaType, filename); explicitly show the previous usage
with images and the new usage with files, mention any required import or type
changes (e.g., FilePart) and note that filenames and mediaType are now
required/expected by sendMessage to avoid regressions.
In @.changeset/real-wolves-thank.md:
- Around line 2-6: Update the changeset frontmatter and description so they
match: either add `@mastra/core` to the human-readable description (line
mentioning mastracode-facing behavior) or remove `@mastra/core` from the
frontmatter; ensure the description only refers to packages listed in the
frontmatter. Also add a short usage example for the new public API
createAuthStorage in the description (showing import and a one-line
instantiation/usage) so the changeset documents the new feature. Ensure the
final frontmatter reflects the intended version bumps ('mastracode': minor,
'@mastra/core': patch) and the body lists only applicable package changes plus
the createAuthStorage example.
In @.changeset/thin-walls-bet.md:
- Around line 1-5: The changeset file .changeset/thin-walls-bet.md has an empty
YAML frontmatter (the `---` block) which is invalid; either remove this
changeset file entirely (since it’s an infrastructure-only workflow change) or
replace the empty frontmatter with a valid package entry and change type (e.g.,
`package-name: patch`) so it becomes a proper release changeset; ensure the file
no longer contains only infrastructure notes outside the frontmatter.
In `@mastracode/src/__tests__/create-auth-storage.test.ts`:
- Around line 8-9: Update the setter signatures for setClaudeAuthStorage and
setOpenAIAuthStorage so they accept undefined: change their parameter type to
(storage: AuthStorage | undefined): void and adjust any related type annotations
so the functions assign the passed value directly to the internal nullable state
(which is declared AuthStorage | null); this lets tests call
setClaudeAuthStorage(undefined) and setOpenAIAuthStorage(undefined) without
using type assertions.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
.changeset/huge-boxes-travel.md.changeset/real-wolves-thank.md.changeset/thin-walls-bet.md.github/workflows/sync-upstream-fork.ymlREADME.mdmastracode/src/__tests__/create-auth-storage.test.tspackages/core/src/harness/harness.ts
Comment on lines
+1
to
+5
| --- | ||
| --- | ||
|
|
||
| Added a daily GitHub Action workflow for forks to sync the default branch from `mastra-ai/mastra`. | ||
| This is an infrastructure-only change and does not modify published packages. |
Contributor
There was a problem hiding this comment.
Empty changeset frontmatter is invalid for release notes.
Line 1–Line 2 has no package entries, and Line 4–Line 5 documents an infrastructure-only change. This should not ship as a package changeset.
potential_issue
As per coding guidelines: "Each changeset file contains a YAML frontmatter at the top. It will be one or more package names followed by a colon and the type of change."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.changeset/thin-walls-bet.md around lines 1 - 5, The changeset file
.changeset/thin-walls-bet.md has an empty YAML frontmatter (the `---` block)
which is invalid; either remove this changeset file entirely (since it’s an
infrastructure-only workflow change) or replace the empty frontmatter with a
valid package entry and change type (e.g., `package-name: patch`) so it becomes
a proper release changeset; ensure the file no longer contains only
infrastructure notes outside the frontmatter.
Comment on lines
+8
to
+9
| setClaudeAuthStorage(undefined as any); | ||
| setOpenAIAuthStorage(undefined as any); |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== 1. Locate and read the test file ==="
fd 'create-auth-storage\.test\.ts$' --type f
echo
echo "=== 2. Read the full test file to understand context ==="
cat -n mastracode/src/__tests__/create-auth-storage.test.ts
echo
echo "=== 3. Find auth storage setter functions ==="
find mastracode -name "*.ts" -type f | xargs rg -l "export.*setClaudeAuthStorage|export.*setOpenAIAuthStorage" 2>/dev/null || echo "Searching in broader context..."
echo
echo "=== 4. Search for setAuthStorage/setClaudeAuthStorage/setOpenAIAuthStorage signatures ==="
rg -n "setClaudeAuthStorage|setOpenAIAuthStorage" mastracode/src --type ts -A 2 -B 2
echo
echo "=== 5. Check if 'undefined' is ever used as valid input elsewhere ==="
rg -n "setClaudeAuthStorage|setOpenAIAuthStorage" --type ts -A 1 | grep -E "(undefined|null)" || echo "No undefined/null patterns found"
echo
echo "=== 6. Search for reset patterns in auth-related files ==="
fd 'auth' mastracode/src --type f --glob '*.ts' | head -20Repository: mastra-ai/mastra
Length of output: 3425
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Find provider files ==="
fd 'claude-max\.ts|openai-codex\.ts' mastracode/src --type f
echo
echo "=== Read claude-max.ts to find setAuthStorage signature ==="
cat -n mastracode/src/providers/claude-max.ts
echo
echo "=== Read openai-codex.ts to find setAuthStorage signature ==="
cat -n mastracode/src/providers/openai-codex.tsRepository: mastra-ai/mastra
Length of output: 16716
Update auth storage setters to accept undefined for test cleanup.
Lines 8–9 use undefined as any because the setter functions (from claude-max.js and openai-codex.js) are typed to accept only AuthStorage, not undefined. However, their internal state variables are declared as AuthStorage | null, indicating they support nullable values. Update both setter signatures to (storage: AuthStorage | undefined): void to allow typed cleanup without bypassing strict type checking.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@mastracode/src/__tests__/create-auth-storage.test.ts` around lines 8 - 9,
Update the setter signatures for setClaudeAuthStorage and setOpenAIAuthStorage
so they accept undefined: change their parameter type to (storage: AuthStorage |
undefined): void and adjust any related type annotations so the functions assign
the passed value directly to the internal nullable state (which is declared
AuthStorage | null); this lets tests call setClaudeAuthStorage(undefined) and
setOpenAIAuthStorage(undefined) without using type assertions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix(mastracode): use auth storage as source of truth for anthropic/openai auth
# Conflicts: # packages/core/src/harness/harness.ts
# Conflicts: # packages/core/src/harness/harness.ts
# Conflicts: # packages/core/src/harness/harness.ts
feat(mastracode): add disabledTools API and extract permission rule utils
…ain-upstream # Conflicts: # mastracode/src/index.ts
Contributor
Author
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createAuthStorage()export so auth providers can be initialized without creating a fullcreateMastraCodeinstancecreateMastraCodeto usecreateAuthStoragecreateDynamicToolsto mergeextraToolsand wrap tool execution withHookManagerpre/post hooksimages→filesin harnesssendMessageto use AI SDKFilePartshape (mediaType+ optionalfilename)Conflict resolution (rebased onto latest main)
mastracode/src/agents/tools.ts— merged upstream's safe extra-tool merge (no-overwrite of built-ins) andpermissionRulesdeny filtering with PR'swrapToolWithHooksandhookManagerparametermastracode/src/index.ts— keptcreateAuthStorageexport and agent-after-hooks ordering on top of upstream changespackages/core/src/harness/harness.ts— combinedimages→filesrename with upstream's newtracingContext/tracingOptionsparamsValidation
pnpm -C mastracode test --run src/__tests__/create-auth-storage.test.ts src/agents/__tests__/tools.test.tsSummary by CodeRabbit
New Features
Tests
Chores