[feat]: Expose calculated request cost in HTTP responses and final stream chunks - #5696
Open
oritmosko wants to merge 34 commits into
Open
[feat]: Expose calculated request cost in HTTP responses and final stream chunks#5696oritmosko wants to merge 34 commits into
oritmosko wants to merge 34 commits into
Conversation
|
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (19)
🚧 Files skipped from review as they are similar to previous changes (18)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe model catalog now distinguishes unavailable pricing from a valid zero cost. Completed responses store available cost metadata, final stream chunks preserve it, and HTTP responses expose it through ChangesCalculated cost exposure
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant RequestHandler
participant BifrostContext
participant ModelCatalog
participant ResponseHeaders
participant HTTPClient
RequestHandler->>BifrostContext: calculate cost for completed response
BifrostContext->>ModelCatalog: resolve cost availability
ModelCatalog-->>BifrostContext: return cost or nil
BifrostContext-->>RequestHandler: populate optional Cost
RequestHandler->>ResponseHeaders: apply response metadata
ResponseHeaders->>HTTPClient: emit x-bifrost-cost-usd when Cost is present
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies" Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@core/bifrost.go`:
- Around line 5049-5052: Update CalculateCost and the response-cost assignment
so unavailable model-catalog pricing remains nil instead of being represented as
zero. Expose pricing availability through a nullable result or explicit resolved
indicator, assign resp.GetExtraFields().Cost only when pricing was resolved, and
preserve a non-nil pointer when the legitimately calculated cost is zero.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: b0d950c3-9804-4b94-bf4a-d187552d4a4d
📒 Files selected for processing (7)
core/bifrost.gocore/changelog.mdcore/modelcataloghooks_test.gocore/schemas/bifrost.gotransports/bifrost-http/lib/responseheaders.gotransports/bifrost-http/lib/responseheaders_test.gotransports/changelog.md
Contributor
|
Hi @oritmosko — thanks for the contribution! This PR is currently blocked because our CLA bot shows the Contributor License Agreement as not yet signed. Could you sign it here so we can move this forward: https://cla-assistant.io/maximhq/bifrost?pullRequest=5696 Let us know if you run into any issues signing. |
Author
Thanks, the CLA is signed. |
oritmosko
force-pushed
the
codex/expose-cost-header
branch
from
August 2, 2026 09:01
6ef86b5 to
ab2660e
Compare
oritmosko
force-pushed
the
codex/expose-cost-header
branch
from
August 3, 2026 07:33
ab2660e to
6239add
Compare
…iew maintenance (maximhq#5693) * feat: support matview_refresh_interval "off" to disable logstore matview maintenance The materialized views back only the dashboard UI. Deployments that run Bifrost headless behind their own observability stack pay the REFRESH MATERIALIZED VIEW CONCURRENTLY cost for views nothing reads, and the 5s floor means the interval alone cannot turn maintenance off. With "off" (or a non-positive duration) the logs store skips view creation, the initial refresh, and the periodic refresher entirely. matViewsReady stays false, so dashboard queries fall back to the raw tables, and the runtime self-heal path cannot re-arm maintenance since it only triggers from matview-path queries. * fix: guard matview self-heal when maintenance is disabled Review follow-up: carry the resolved disabled state onto the store so triggerMatViewSelfHeal cannot recreate views the configuration says must not exist, and make the schema/docs explicit that a zero duration also disables (positive sub-5s values still clamp up).
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> * **Bug Fixes** * Improved token parameter compatibility handling to preserve alternative formats when the primary option is unsupported. * **Chores** * Version updated to 2.0.0. * Enhanced load testing configuration for more reliable builds. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
## Summary Adds a `THIRD_PARTY_NOTICES.md` file to formally document third-party components used in Bifrost that carry license terms requiring explicit attribution — specifically MPL-2.0 licensed dependencies and embedded source code derived from external projects. ## Changes - Introduces `THIRD_PARTY_NOTICES.md` to attribute: - Embedded source code in `framework/migrator/migrator.go` derived from `go-gormigrate/gormigrate` (MIT) - Go binary dependencies carrying MPL-2.0 terms: `github.com/cyphar/filepath-securejoin` and `github.com/hashicorp/go-version` - npm build-time devDependencies carrying MPL-2.0 terms: `lightningcss` (never shipped to end users) and `dompurify` (Apache-2.0 option elected) - All MPL-2.0 components are used unmodified and combined as a "Larger Work" per MPL-2.0 Section 3.3; no Bifrost source files are themselves MPL-licensed. ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [x] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [x] Docs ## How to test No functional changes — review the file contents to confirm accuracy of license attributions against the listed upstream repositories. ## Breaking changes - [ ] Yes - [x] No ## Related issues N/A ## Security considerations This change has no security implications. It is a legal/compliance attribution document only. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…aximhq#5759) ## Summary Closes a race-condition security gap where an unauthenticated network caller could reach a freshly deployed, not-yet-configured Bifrost instance and create the first admin account before the real operator does. Previously, `PUT /api/config` was intentionally open when no admin account existed (zero-config UX), but this left a window of exposure on any publicly reachable host. The fix introduces a one-time **setup token** — generated in-memory at startup when no admin account is configured, printed to the server's startup logs, and required alongside the username/password when creating the first admin account. The token is never persisted, is regenerated on every restart until an admin account exists, and is permanently invalidated once the first admin account is created. ## Changes - **Bootstrap token generation (`middlewares.go`):** `InitAuthMiddleware` generates a UUID setup token via `atomic.Pointer[string]` when no admin account is configured, logs it prominently to stdout, and exposes `CheckBootstrapToken` (constant-time comparison) and `ClearBootstrapToken` methods. - **Token validation in the config handler (`config.go`):** `updateConfig` now calls `ValidateSetupToken` before allowing the first admin account to be created. Returns HTTP 403 if the token is missing or wrong. - **Token cleared on first admin account creation (`server.go`):** `UpdateAuthConfig` calls `ClearBootstrapToken` after successfully persisting the first admin account, permanently closing the gate. - **`setup_token`** **field added to** **`UpdateConfigRequest`:** The field is accepted in the request body but never persisted or returned by `GET /api/config`. - **UI (`securityView.tsx`):** When no `auth_config` exists server-side (`isFirstTimeSetup`), a **Setup token** input field is shown below the password field. The token is validated client-side before submission and cleared from state after a successful save. - **TypeScript types (`config.ts`):** `setup_token?: string` added to `BifrostConfig`. - **OpenAPI schema (`config.yaml`):** `setup_token` documented on `UpdateConfigRequest`. - **Docs:** A `<Warning>` block added to `security-best-practices.mdx` and a `<Note>` added to `setting-up-auth.mdx` explaining the setup token flow, where to find it, and that it only applies once. - **Tests (`middlewares_test.go`):** Two new test cases cover the no-token-generated (pass-through) case and the validate-then-clear lifecycle. ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [x] UI (React) - [x] Docs ## How to test **Manual flow:** 1. Start a fresh Bifrost instance with no existing admin account. 2. Check startup logs for the block beginning `No admin account is configured for this Bifrost instance yet.` and copy the setup token. 3. Open the dashboard → Security Settings. Confirm the **Setup token** field appears below the password field. 4. Attempt to save with auth enabled but without the setup token — expect a toast error. 5. Paste the correct token and save — expect success and the Setup token field to disappear on reload. 6. Confirm that `PUT /api/config` without the token returns HTTP 403 while no admin account exists. 7. Restart the server before completing setup and confirm a new token is printed. ```sh # Core/Transports go test ./transports/bifrost-http/handlers/... # UI cd ui pnpm i pnpm build ``` ## Breaking changes - [x] Yes - [ ] No Any automation or scripts that call `PUT /api/config` to create the first admin account on a fresh instance must now include `setup_token` in the request body. The token is available in the server's startup logs. Instances that already have an admin account configured are unaffected — the field is ignored once an admin account exists. ## Security considerations - The setup token is generated with `uuid.NewString()` (crypto-random UUID), stored only in process memory, and compared with `crypto/subtle.ConstantTimeCompare` to prevent timing attacks. - The token is never written to disk, never returned by any API endpoint, and is permanently invalidated after first use. - Operators must have access to the process's stdout/log stream (`docker logs`, `kubectl logs`, or terminal) to retrieve the token, which is the same access level required to operate the host — this is the intended trust boundary. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicablecg
## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
Loading a custom plugin `path` causes native code (a `.so`) to be `dlopen()`'d directly into the gateway process. Previously, this was allowed even when dashboard authentication was disabled or unconfigured — meaning any caller who could reach the management API could inject arbitrary native code. This PR closes that gap by requiring a genuinely authenticated admin session for any create or update operation that sets a non-builtin plugin `path`, and separately hardens the plugin downloader against SSRF. - Added `BifrostContextKeyAuthBypassed` context key, set by the auth middleware exclusively when a request is let through because dashboard auth is disabled/unconfigured (distinct from `IsLocalAdminContextKey`, which is also set on real authenticated sessions). - `createPlugin` and `updatePlugin` handlers now check `BifrostContextKeyAuthBypassed` and return `403` before any DB write when a non-builtin `path` is supplied without genuine authentication. - Replaced the `fasthttp`-based plugin downloader with a `net/http` client backed by `network.SSRFSafeDialContext`, matching the SSRF hardening already applied to `core/providers/utils.FetchAndEncodeURL`. The new client: rejects non-`http`/`https` schemes before any network call, refuses connections to loopback, private, CGNAT, link-local, and unspecified addresses (including IPv4-in-IPv6 transition addresses) at dial time (not just DNS lookup time, so DNS rebinding doesn't bypass it), applies the same IP check to redirect targets, caps redirect depth at 5, and limits response body reads to 200 MB. - Tests for `DownloadPlugin` now use a `useNonSSRFGuardedClient` helper that swaps in a plain dialer for the duration of each test (since `httptest` servers bind to loopback, which the production dialer correctly blocks). A new `TestDownloadPlugin_BlocksSSRFToLoopback` test verifies the production guard is active by default, and `TestDownloadPlugin_RejectsNonHTTPScheme` verifies `file://` and similar schemes are rejected before any network call. - New handler tests cover all four cases: create with bypassed auth (expect 403, no DB write), create with real auth (expect 201, path stored), update with bypassed auth (expect 403, no DB write), and the existing config-merge behaviour. - OpenAPI docs and the plugin sequencing guide updated to document the 403 response and the authentication requirement for `path`. - Dependency bumps: `aws-sdk-go-v2/config` → v1.32.14, `aws-sdk-go-v2/service/s3` → v1.99.0, `aws-sdk-go-v2/internal/ini` → v1.8.6, `buger/jsonparser` → v1.2.0. - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI > This is primarily a security hardening change. - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [x] Docs ```sh go test ./... go test ./transports/bifrost-http/handlers/... -run TestCreatePlugin_RejectsCustomPathWhenAuthBypassed go test ./transports/bifrost-http/handlers/... -run TestCreatePlugin_AllowsCustomPathWhenNotBypassed go test ./transports/bifrost-http/handlers/... -run TestUpdatePlugin_RejectsCustomPathWhenAuthBypassed go test ./framework/plugins/... -run TestDownloadPlugin_BlocksSSRFToLoopback go test ./framework/plugins/... -run TestDownloadPlugin_RejectsNonHTTPScheme ``` To manually verify the 403 behaviour: start the gateway with no dashboard auth configured, then attempt `POST /api/plugins` with a `path` field pointing to a `.so`. The response should be `403` with a message instructing the operator to enable dashboard authentication first. - [x] Yes - [ ] No Operators running with dashboard authentication disabled who were previously able to create or update custom plugin paths via the API will now receive a `403`. To restore the capability, enable dashboard authentication and authenticate before calling those endpoints. - Closes an unauthenticated native code injection vector: without this change, any network-reachable caller could `dlopen()` an attacker-controlled `.so` into the gateway process when dashboard auth was off. - The SSRF fix on the plugin downloader prevents a crafted plugin URL from causing the gateway to fetch from internal/metadata endpoints (e.g. cloud IMDS). The guard runs at dial time, not DNS resolution time, so DNS rebinding attacks do not bypass it. - `BifrostContextKeyAuthBypassed` is intentionally separate from `IsLocalAdminContextKey` so that future handlers gating other high-risk operations can use the same signal without ambiguity. - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable
…aximhq#5805) * [fix]: clear stuck entity-assignment validation on virtual key sheet Eager trigger on assignment-type changes left a refine error on entityType that selecting a team/customer never cleared; also align the assignment controls to items-start. Co-authored-by: Cursor <cursoragent@cursor.com> * [docs]: add before/after screenshots for virtual key entity-assignment fix Co-authored-by: Cursor <cursoragent@cursor.com> * [docs]: add on-submit validation screenshot for entity-assignment fix Co-authored-by: Cursor <cursoragent@cursor.com> * [chore]: remove PR screenshots from .github/assets Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
…ntainers are not relabelled (maximhq#5823)
maximhq#5847) ## Summary Provider-specific model IDs (e.g. Bedrock cross-region inference profiles, dated OpenAI/Anthropic snapshots) were creating separate metric series for what is logically the same model. This PR introduces a `NormalizeModelName` function that strips vendor/region prefixes, Bedrock version suffixes, and trailing date/version segments before model names are used as metric labels, preventing cardinality explosion in Prometheus and OTel metrics. Additionally, pre-dispatch rejections where both provider and model are empty are now skipped entirely to avoid polluting metric series with empty labels. ## Changes - Added `NormalizeModelName` in `core/schemas/utils.go` that: - Strips Bedrock region and vendor prefixes (e.g. `us.anthropic.`, `anthropic.`) using a regex that only matches letter/hyphen tokens, leaving digit-dotted names like `gpt-3.5-turbo` and `gemini-1.5-pro` untouched - Strips Bedrock version suffixes (e.g. `-v1:0`) - Delegates to the existing `BaseModelName` to strip trailing date/version segments - Preserves OpenAI fine-tune IDs (`ft:...`) as-is - Trims surrounding whitespace, collapsing blank input to `""` - Applied `NormalizeModelName` to the model label in both the Prometheus plugin (`PostLLMHook`) and the OTel plugin (`buildSpanAttrs`, `buildContextAttrs`) - Added early-return guards in both plugins when provider and model are both empty, skipping metric recording for pre-dispatch rejections - Added a comprehensive test suite for `NormalizeModelName` covering Bedrock inference profiles, OpenAI dated snapshots, Anthropic dated names, digit-dotted names, fine-tune IDs, whitespace, and empty input ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh go test ./core/schemas/... -run TestNormalizeModelName -v go test ./plugins/otel/... go test ./plugins/telemetry/... go test ./... ``` Expected: all tests pass, and metrics emitted for Bedrock inference profile model IDs (e.g. `us.anthropic.claude-opus-4-20250101-v1:0`) use the normalized label `claude-opus-4` rather than the full provider-specific string. ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations None. This change only affects metric label values and does not touch auth, secrets, or PII handling. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…#5848) ## Summary Adds support for multi-valued team, customer, and business unit identity dimensions in telemetry and metrics. Previously, only a single scalar value per dimension was recorded. This PR introduces a `CanonicalEntitySet` utility that deduplicates, sorts, and comma-joins parallel id/name arrays into stable strings, ensuring the same set of entities always produces the same metric label value regardless of input ordering. ## Changes - Added `CanonicalEntitySet` in `core/schemas/utils.go` that accepts index-aligned id/name slices, drops empty ids, deduplicates by id (keeping the first name), sorts by id, and returns comma-joined `(idsCSV, namesCSV)` strings. - Added `canonicalentityset_test.go` covering empty input, single values, sorted/deduped sets, duplicate ids, missing names, and empty id filtering. - Added `getStringSliceAttr` in the otel plugin to tolerate both `[]string` and `[]any` encodings of array-valued span attributes. - Added `entitySetFromAttrs` and `entitySetFromContext` helpers in the otel plugin that resolve a dimension from the plural governance arrays when present, falling back to the scalar as a set of one. - Added `canonicalEntitySet` helper in the telemetry plugin with the same fallback logic for the Prometheus path. - Extended `BuildBifrostAttributes` to accept and emit `business_unit_id`/`business_unit_name` attributes alongside the existing team and customer dimensions. - All label names remain singular (`team_id`, `customer_id`, `business_unit_id`) for dashboard backward-compatibility; the values are now canonical comma-joined sets. ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh go test ./core/schemas/... -run TestCanonicalEntitySet -v go test ./plugins/otel/... ./plugins/telemetry/... go test ./... ``` Verify that a request carrying multiple team ids (e.g. `["t1","t2"]`) produces a `team_id` label of `"t1,t2"` (sorted) in both Prometheus metrics and OTel span attributes, and that a single-team request continues to produce the same label format as before. ## Screenshots/Recordings N/A ## Breaking changes - [ ] Yes - [x] No The `BuildBifrostAttributes` function signature has changed (two new parameters added for `businessUnitIDs`/`businessUnitNames`, and scalar team/customer args replaced with their CSV equivalents). Any direct callers outside this repo will need to update their call sites. ## Related issues N/A ## Security considerations Label values are derived from governance context keys set server-side. No user-supplied PII is introduced beyond what was already present in the scalar team/customer labels. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
## Summary Several correctness fixes across model name normalization, OTel metrics alignment, and Prometheus active-request tracking. The common theme is preventing data loss or label pollution caused by edge-case inputs (fine-tune model IDs with date-like suffixes, mixed-type attribute arrays, spans with no provider/model, and pre-dispatch rejections that left active-request counters incremented). ## Changes - **`NormalizeModelName` fine-tune short-circuit**: OpenAI fine-tune IDs prefixed with `ft:` are now returned immediately before `BaseModelName` is called, preventing a date-like custom suffix (e.g. `custom-20250514`) from being stripped as if it were a Bedrock version tag. - **`getStringSliceAttr` index preservation**: When a `[]any` attribute value contains non-string elements, the slot is now kept as an empty string rather than being dropped. This keeps id and name arrays index-aligned so that `entitySetFromAttrs` can correctly pair and filter them. - **OTel span filtering**: Spans with both an empty provider and an empty model are skipped before final-span selection in `recordMetricsFromTrace`, preventing empty-label metric series from being emitted. - **`serviceInstanceID` as a package-level variable**: The hostname/fallback resolution is now computed once at startup and reused in both the resource attribute and as a `service_instance_id` datapoint label, so per-replica breakdown survives collector configurations that drop resource attributes. - **Prometheus `ActiveRequests` decrement on pre-dispatch rejection**: `PostLLMHook` now decrements `ActiveRequests` before returning early for no-provider/no-model requests, fixing a counter leak introduced when `PreLLMHook` incremented it. - **Key rotation event uses normalized model name**: `KeyRotationEventsTotal` now records the normalized `model` value instead of `originalModel`, keeping label values consistent with other metrics. ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh go test ./core/schemas/... ./plugins/otel/... ./plugins/telemetry/... ``` - `TestNormalizeModelName` covers the new `ft:gpt-4o-mini:acme:custom-20250514` case. - `TestGetStringSliceAttr_AnyPreservesIndex` verifies that non-string elements produce an empty string at the correct index. - `TestEntitySetFromAttrs_MixedAnyKeepsAlignment` verifies that a non-string ID element drops both that ID and its paired name without shifting remaining entries. ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations None. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…cing overrides OpenAPI spec (maximhq#5852) ## Summary Extends the Pricing Overrides API with user-scoped override support, pagination/search on the list endpoint, and a significantly expanded set of priceable fields covering new token tiers, cache variants, image quality/size tiers, and OCR costs. ## Changes - Introduced a shared `PricingOverrideScopeKind` schema component, replacing inline enum definitions across `PricingOverride`, `CreatePricingOverrideRequest`, `UpdatePricingOverrideRequest`, and the list query parameter. The enum now includes three new `user*` scopes: `user`, `user_provider`, and `user_provider_key`. Resolution priority is documented: `virtual_key*` > `user*` > `provider`/`global`, with more-specific matches winning within a family. - Added `user_id` field to override request/response schemas and as a query filter on the list endpoint, required when using `user*` scopes. - Updated `provider_id` and `provider_key_id` descriptions to reflect their applicability to the new `user_provider` and `user_provider_key` scopes. - Added pagination and search to the list endpoint via `limit`, `offset`, and `search` query parameters. When any of these are present, the response switches to a paginated shape with `total_count`, `limit`, and `offset` fields alongside the existing `count`. The non-paginated path remains backward-compatible. - Expanded `PricingPatch` with many new pricing fields, organized into logical sections: - **Text**: `input/output_cost_per_token_flex`, `input/output_cost_per_token_fast` (Anthropic research preview, flat rate with no tiering) - **128k tier**: `input_cost_per_image/video/audio_above_128k_tokens` - **200k tier**: priority variants for input and output - **272k tier**: standard, priority, and flex variants for input and output - **Cache**: flex, priority, fast, and 272k-tier variants; `cache_creation_input_token_cost_above_1hr` and its 200k/fast variants - **Image**: `premium_image` combined tiers at 512px and 1024px, `input_cost_per_image_token` - **Other**: `inference_geo_us_multiplier` (Anthropic data-residency), `ocr_cost_per_page`, `annotation_cost_per_page` ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [x] Docs ## How to test Verify the updated OpenAPI spec is valid and that the new fields and parameters appear correctly: ```sh # Validate the OpenAPI spec npx @redocly/cli lint docs/openapi/openapi.yaml # Confirm new scope kinds are present grep -E "user|user_provider|user_provider_key" docs/openapi/openapi.yaml # Confirm pagination parameters are present on the list endpoint grep -E "limit|offset|search" docs/openapi/paths/management/governance.yaml ``` ## Breaking changes - [ ] Yes - [x] No The list endpoint response gains new optional fields (`total_count`, `limit`, `offset`) and the non-paginated path continues to behave as before. Existing `scope_kind` enum values are unchanged; new values are additive. ## Related issues ## Security considerations The new `user_id` scoping field allows pricing overrides to be applied per user. Ensure that `user_id` values are validated against authenticated session context server-side and are not accepted from untrusted input without authorization checks. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [x] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
oritmosko
changed the title
Author
|
Thanks @lucacolombo97 — implemented in the latest commits.\n\nStreaming responses now expose the model-catalog-calculated total cost on the final chunk in extra_fields.cost; intermediate chunks omit it. Unavailable pricing remains omitted, while a legitimate zero cost is preserved. I also covered the post-hook recovery path and Responses API stream normalization.\n\nThe full affected core/schema suites and focused HTTP response-header tests pass. |
|
@oritmosko many thanks for the useful contribution! |
## Summary Resolves merge conflicts in `core/go.sum` that were left over from merging the path normalization auth bypass fix (maximhq#5763). ## Changes - Removed leftover `<<<<<<< HEAD`, `=======`, and `>>>>>>> e0057ff` conflict markers from `core/go.sum` - Retained the correct `go.mod` hash lines for `aws-sdk-go-v2/config`, `aws-sdk-go-v2/internal/ini`, and `aws-sdk-go-v2/service/s3` that were dropped during the conflict ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh cd core go mod verify go test ./... ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues Closes maximhq#5763 ## Security considerations No security implications. This is a cleanup of unresolved merge conflict markers in the dependency lockfile. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…ntle) (maximhq#5867) ## Summary Fixes detection of GPT-5 series models so that reasoning effort support is correctly identified regardless of where "gpt-5" appears in the model name string (e.g., fine-tuned or versioned variants like `ft:gpt-5-...`). ## Changes - Replaced `strings.HasPrefix` with `strings.Contains` when checking if a model belongs to the GPT-5 series, allowing model names that include "gpt-5" in positions other than the start to be correctly recognized as reasoning models. ## Type of change - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [ ] Transports (HTTP) - [x] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh go test ./core/providers/openai/... ``` Verify that model names such as `ft:gpt-5-mini` or other variants containing "gpt-5" not at the start of the string are correctly identified as reasoning models and have `reasoning.effort` applied. ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations None. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…thods (maximhq#5462) The Vertex cached content methods (create/list/retrieve/update/delete) all authenticate via the shared vertexAuthHeaders helper, which unconditionally fetched an OAuth token from the key credentials and overwrote the Authorization header. This mirrors the pre-fix Embedding behaviour and prevents callers from supplying their own bearer token via context extra headers (e.g. a proxy that holds short-lived credentials out of band). Make vertexAuthHeaders take the API-key query-parameter path when the key carries a value — the same escape hatch the Gemini generation endpoints already use — leaving any Authorization header set from context extra headers intact. Signed-off-by: Charlie Gildawie <charlieg@monzo.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Akshay Deo <akshay@akshaydeo.com>
## Summary Adds a dedicated **MCP Guardrails** section to the guardrails documentation, explaining how guardrails apply at the tool-execution boundary for MCP targets, including phase behavior, UI field descriptions, and provider compatibility notes. ## Changes - Replaced the brief inline mention of MCP rule behavior in the Architecture section with a cross-reference link to the new dedicated section. - Added a new `## MCP Guardrails` section covering: - How `input`, `output`, and `both` phases apply at the tool-execution boundary. - A table describing the flow and block behavior for each phase. - Guidance on selecting MCP clients, tools, and tool arguments when creating rules. - A note clarifying that all supported guardrail providers work with MCP rules and that redaction support follows the same provider constraints as LLM rules. - Cross-references to existing sections for rule configuration and CEL expression examples. - Added a screenshot (`ui-mcp-guardrail-rule.png`) showing the MCP guardrail rule editor in the UI. ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [x] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [x] Docs ## How to test Navigate to the rendered guardrails documentation page and verify: - The Architecture section links to `#mcp-guardrails` instead of containing inline MCP text. - The new MCP Guardrails section renders correctly with the phase table, screenshot, and note. - The screenshot image loads without errors. ## Screenshots/Recordings The new section includes a screenshot of the MCP guardrail rule editor (`ui-mcp-guardrail-rule.png`). ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations None. Documentation-only change. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [x] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
* feat: send HTTP/2 PING keepalives on the Bedrock provider When enforce_http2 is set, configure http.HTTP2Config.SendPingTimeout so the client sends PING frames while a streaming or unary response is idle, keeping a long-lived connection from being closed by an intermediary idle timeout (which the AWS EventStream decoder would otherwise surface as an "unexpected EOF"). The interval is configurable via network_config http2_keepalive_interval_in_seconds (default 30s). * fix: expose Bedrock HTTP/2 keepalive interval in Helm values schema Mirror http2_ping_interval_in_seconds into the chart values.schema.json networkConfig def so Helm deployments can set it. * fix: make Bedrock HTTP/2 keepalive ping opt-in (0 = disabled) There was no HTTP/2 ping keepalive before this change, so the 30s default-fill was an arbitrary imposition. Treat 0 as disabled (matching net/http's own SendPingTimeout semantics) and only send pings when a positive interval is configured, keeping enforce_http2 orthogonal to keepalive. * fix: declare http2_ping_interval_in_seconds in UI NetworkConfig types The TS NetworkConfig interface and its three Zod mirrors (providerForm's NetworkConfigSchema, and schemas.ts's networkConfigSchema / networkFormConfigSchema) were missing the field added alongside enforce_http2 in the Go schema, so a value round-tripped through those validators would be silently stripped. * fix: cap http2_ping_interval_in_seconds at 3600s in provider form schema Matches the sibling stream_idle_timeout_in_seconds / keep_alive_timeout_in_seconds bounds in the same schema, and the 3600s ceiling already enforced in ui/lib/types/schemas.ts. Without it, a value above 3600 could pass this schema but fail the shared one later. * fix: clamp Bedrock HTTP/2 ping interval to avoid int64 overflow http2_ping_interval_in_seconds is converted to time.Duration via * time.Second in the Bedrock transport; a value above ~9.2 billion seconds overflows int64 silently. Clamp in CheckAndSetDefaults (same pattern as MaxConnsPerHost) and cap the config.schema.json / values.schema.json bounds accordingly. Also extends TestBedrockTransportHTTP2Config to assert transport.HTTP2 across all three enforce_http2 x interval gate combinations, which the existing test never exercised. * fix: align http2_ping_interval_in_seconds ceiling with UI and sibling fields The prior overflow-safety fix (5c45ef3) capped this at the raw int64 overflow boundary (9223372036) in the Go constant and both JSON schemas, but the UI's three Zod mirrors already capped it at 3600 — matching the sibling stream_idle_timeout_in_seconds / keep_alive_timeout_in_seconds fields, which cap at 3600 everywhere including config.schema.json. Align all six copies on 3600: a config value between 3601 and 9223372036 passed the backend but would fail the UI's validation on round-trip.
…5877) ## Summary `candidates[0].safetyRatings`, `candidates[0].avgLogprobs`, and the native Gemini `responseId` were silently dropped when a Gemini/Vertex response passed through Bifrost's OpenAI-shaped Responses schema. Because Bifrost's schema has no fields for these values, they need to be round-tripped via `ProviderExtraFields` and restored on egress. This fix covers both the non-streaming (`generateContent`) and streaming (`streamGenerateContent`) paths. Closes maximhq#5843 ## Changes - **`responses.go`** **— non-streaming path**: `ToResponsesBifrostResponsesResponse` now stashes `responseId`, `safetyRatings`, and `avgLogprobs` into `ProviderExtraFields` when converting inbound Gemini responses to Bifrost format. `ToGeminiResponsesResponse` reads them back out and restores them onto the outbound `GenerateContentResponse`. - **`responses.go`** **— streaming path**: `GeminiResponsesStreamState` gains `SafetyRatings` and `AvgLogprobs` fields. `ToBifrostResponsesStream` captures these from the terminal chunk (the only chunk that carries them, alongside `finishReason`). `closeGeminiOpenItems` writes them into `ProviderExtraFields` on the `response.completed` event. `ToGeminiResponsesStreamResponse` restores them onto the outbound stream chunk. - **`extractGeminiSafetyRatings`** **/** **`extractGeminiAvgLogprobs`**: Two helper functions handle both the in-memory pointer form (normal path) and the JSON-decoded `[]interface{}`/`map` form that can appear after a JSON round-trip. - **`gemini_test.go`**: Regression test `TestGenAISafetyRatingsAvgLogprobsResponseIDStreamRoundTrip` covers the non-streaming round-trip, asserting all three fields survive `ToResponsesBifrostResponsesResponse` → `ToGeminiResponsesResponse`. - **`safetyratingsstream_test.go`**: New test file with `TestGeminiSafetyRatingsAvgLogprobsResponseIDStreamRoundTrip`, which drives a two-chunk stream through the full forward (`ToBifrostResponsesStream`) and reverse (`ToGeminiResponsesStreamResponse`) conversion loop and asserts `safetyRatings`, `avgLogprobs`, and `responseId` are present on the terminal chunk. - **`SKILL.md`**: The investigate-issue skill now enforces AGENTS.md's "red before green" rule for Bug-classified issues — tests are written and confirmed failing before any fix code is applied, and the todo list ordering reflects this sequence. ## Type of change - [x] Bug fix ## Affected areas - [x] Core (Go) - [x] Providers/Integrations ## How to test ```sh go test ./core/providers/gemini/... -run TestGenAISafetyRatingsAvgLogprobsResponseIDStreamRoundTrip go test ./core/providers/gemini/... -run TestGeminiSafetyRatingsAvgLogprobsResponseIDStreamRoundTrip go test ./core/providers/gemini/... ``` Both new tests should pass. The streaming test validates that `safetyRatings`, `avgLogprobs`, and `responseId` appear on the `response.completed` chunk after a two-chunk stream round-trip. The non-streaming test validates the same fields survive a single `GenerateContentResponse` → Bifrost → `GenerateContentResponse` round-trip. ## Breaking changes - [x] No ## Related issues Closes maximhq#5843 ## Security considerations None. The change only preserves existing provider-supplied metadata through an internal schema boundary; no new data is introduced or exposed. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…#5879) * [test]: Bedrock provider - cover encrypted reasoning replay Affected packages: - core/providers/bedrock/ - add a failing regression test for empty-summary encrypted reasoning replay * [fix]: Bedrock provider - preserve encrypted reasoning replay Affected packages: - core/providers/bedrock/ - map encrypted Responses reasoning to the native Bedrock signature field - core/ - document the user-facing fix
* feat: support matview_refresh_interval "off" to disable logstore matview maintenance (maximhq#5693) * feat: support matview_refresh_interval "off" to disable logstore matview maintenance The materialized views back only the dashboard UI. Deployments that run Bifrost headless behind their own observability stack pay the REFRESH MATERIALIZED VIEW CONCURRENTLY cost for views nothing reads, and the 5s floor means the interval alone cannot turn maintenance off. With "off" (or a non-positive duration) the logs store skips view creation, the initial refresh, and the periodic refresher entirely. matViewsReady stays false, so dashboard queries fall back to the raw tables, and the runtime self-heal path cannot re-arm maintenance since it only triggers from matview-path queries. * fix: guard matview self-heal when maintenance is disabled Review follow-up: carry the resolved disabled state onto the store so triggerMatViewSelfHeal cannot recreate views the configuration says must not exist, and make the schema/docs explicit that a zero duration also disables (positive sub-5s values still clamp up). * V2.0.0 (maximhq#4365) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved token parameter compatibility handling to preserve alternative formats when the primary option is unsupported. * **Chores** * Version updated to 2.0.0. * Enhanced load testing configuration for more reliable builds. <!-- end of auto-generated comment: release notes by coderabbit.ai --> * gomod fixes (maximhq#5731) ## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * third party notice (maximhq#5735) ## Summary Adds a `THIRD_PARTY_NOTICES.md` file to formally document third-party components used in Bifrost that carry license terms requiring explicit attribution — specifically MPL-2.0 licensed dependencies and embedded source code derived from external projects. ## Changes - Introduces `THIRD_PARTY_NOTICES.md` to attribute: - Embedded source code in `framework/migrator/migrator.go` derived from `go-gormigrate/gormigrate` (MIT) - Go binary dependencies carrying MPL-2.0 terms: `github.com/cyphar/filepath-securejoin` and `github.com/hashicorp/go-version` - npm build-time devDependencies carrying MPL-2.0 terms: `lightningcss` (never shipped to end users) and `dompurify` (Apache-2.0 option elected) - All MPL-2.0 components are used unmodified and combined as a "Larger Work" per MPL-2.0 Section 3.3; no Bifrost source files are themselves MPL-licensed. ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [x] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [x] Docs ## How to test No functional changes — review the file contents to confirm accuracy of license attributions against the listed upstream repositories. ## Breaking changes - [ ] Yes - [x] No ## Related issues N/A ## Security considerations This change has no security implications. It is a legal/compliance attribution document only. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * feat(mcp-guardrails): add MCP log redaction changes (maximhq#5744) ## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * feat(mcp-guardrails): ui changes (maximhq#5745) ## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * added plugin logs in mcp logs (maximhq#5746) ## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * dependabot alert fixes (maximhq#5756) ## Summary Bumps several Go dependencies to their latest patch/minor versions across all modules in the repository. ## Changes - `github.com/aws/aws-sdk-go-v2/service/s3`: `v1.97.3` → `v1.99.0` - `github.com/aws/aws-sdk-go-v2/config`: `v1.32.11` → `v1.32.14` - `github.com/aws/aws-sdk-go-v2/internal/ini`: `v1.8.5` → `v1.8.6` - `github.com/weaviate/weaviate`: `v1.36.5` → `v1.38.0` - `github.com/buger/jsonparser`: `v1.1.2` → `v1.2.0` - `github.com/go-openapi/spec`: `v0.22.2` → `v0.22.3` - `github.com/google/cel-go`: `v0.28.1` → `v0.29.0` - `github.com/stretchr/objx`: `v0.5.3` added as an indirect dependency ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh go test ./... ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues ## Security considerations None. All changes are dependency version bumps with no security-sensitive modifications. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * mcp guardrails : config,helm and docs changes (maximhq#5758) * adds first time setup token to avoid opening new setup to the world (maximhq#5759) ## Summary Closes a race-condition security gap where an unauthenticated network caller could reach a freshly deployed, not-yet-configured Bifrost instance and create the first admin account before the real operator does. Previously, `PUT /api/config` was intentionally open when no admin account existed (zero-config UX), but this left a window of exposure on any publicly reachable host. The fix introduces a one-time **setup token** — generated in-memory at startup when no admin account is configured, printed to the server's startup logs, and required alongside the username/password when creating the first admin account. The token is never persisted, is regenerated on every restart until an admin account exists, and is permanently invalidated once the first admin account is created. ## Changes - **Bootstrap token generation (`middlewares.go`):** `InitAuthMiddleware` generates a UUID setup token via `atomic.Pointer[string]` when no admin account is configured, logs it prominently to stdout, and exposes `CheckBootstrapToken` (constant-time comparison) and `ClearBootstrapToken` methods. - **Token validation in the config handler (`config.go`):** `updateConfig` now calls `ValidateSetupToken` before allowing the first admin account to be created. Returns HTTP 403 if the token is missing or wrong. - **Token cleared on first admin account creation (`server.go`):** `UpdateAuthConfig` calls `ClearBootstrapToken` after successfully persisting the first admin account, permanently closing the gate. - **`setup_token`** **field added to** **`UpdateConfigRequest`:** The field is accepted in the request body but never persisted or returned by `GET /api/config`. - **UI (`securityView.tsx`):** When no `auth_config` exists server-side (`isFirstTimeSetup`), a **Setup token** input field is shown below the password field. The token is validated client-side before submission and cleared from state after a successful save. - **TypeScript types (`config.ts`):** `setup_token?: string` added to `BifrostConfig`. - **OpenAPI schema (`config.yaml`):** `setup_token` documented on `UpdateConfigRequest`. - **Docs:** A `<Warning>` block added to `security-best-practices.mdx` and a `<Note>` added to `setting-up-auth.mdx` explaining the setup token flow, where to find it, and that it only applies once. - **Tests (`middlewares_test.go`):** Two new test cases cover the no-token-generated (pass-through) case and the validate-then-clear lifecycle. ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [x] UI (React) - [x] Docs ## How to test **Manual flow:** 1. Start a fresh Bifrost instance with no existing admin account. 2. Check startup logs for the block beginning `No admin account is configured for this Bifrost instance yet.` and copy the setup token. 3. Open the dashboard → Security Settings. Confirm the **Setup token** field appears below the password field. 4. Attempt to save with auth enabled but without the setup token — expect a toast error. 5. Paste the correct token and save — expect success and the Setup token field to disappear on reload. 6. Confirm that `PUT /api/config` without the token returns HTTP 403 while no admin account exists. 7. Restart the server before completing setup and confirm a new token is printed. ```sh # Core/Transports go test ./transports/bifrost-http/handlers/... # UI cd ui pnpm i pnpm build ``` ## Breaking changes - [x] Yes - [ ] No Any automation or scripts that call `PUT /api/config` to create the first admin account on a fresh instance must now include `setup_token` in the request body. The token is available in the server's startup logs. Instances that already have an admin account configured are unaffected — the field is ignored once an admin account exists. ## Security considerations - The setup token is generated with `uuid.NewString()` (crypto-random UUID), stored only in process memory, and compared with `crypto/subtle.ConstantTimeCompare` to prevent timing attacks. - The token is never written to disk, never returned by any API endpoint, and is permanently invalidated after first use. - Operators must have access to the process's stdout/log stream (`docker logs`, `kubectl logs`, or terminal) to retrieve the token, which is the same access level required to operate the host — this is the intended trust boundary. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicablecg * brings back onboarding widget (maximhq#5784) ## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * path normalization auth bypass (maximhq#5763) ## Summary Loading a custom plugin `path` causes native code (a `.so`) to be `dlopen()`'d directly into the gateway process. Previously, this was allowed even when dashboard authentication was disabled or unconfigured — meaning any caller who could reach the management API could inject arbitrary native code. This PR closes that gap by requiring a genuinely authenticated admin session for any create or update operation that sets a non-builtin plugin `path`, and separately hardens the plugin downloader against SSRF. ## Changes - Added `BifrostContextKeyAuthBypassed` context key, set by the auth middleware exclusively when a request is let through because dashboard auth is disabled/unconfigured (distinct from `IsLocalAdminContextKey`, which is also set on real authenticated sessions). - `createPlugin` and `updatePlugin` handlers now check `BifrostContextKeyAuthBypassed` and return `403` before any DB write when a non-builtin `path` is supplied without genuine authentication. - Replaced the `fasthttp`-based plugin downloader with a `net/http` client backed by `network.SSRFSafeDialContext`, matching the SSRF hardening already applied to `core/providers/utils.FetchAndEncodeURL`. The new client: rejects non-`http`/`https` schemes before any network call, refuses connections to loopback, private, CGNAT, link-local, and unspecified addresses (including IPv4-in-IPv6 transition addresses) at dial time (not just DNS lookup time, so DNS rebinding doesn't bypass it), applies the same IP check to redirect targets, caps redirect depth at 5, and limits response body reads to 200 MB. - Tests for `DownloadPlugin` now use a `useNonSSRFGuardedClient` helper that swaps in a plain dialer for the duration of each test (since `httptest` servers bind to loopback, which the production dialer correctly blocks). A new `TestDownloadPlugin_BlocksSSRFToLoopback` test verifies the production guard is active by default, and `TestDownloadPlugin_RejectsNonHTTPScheme` verifies `file://` and similar schemes are rejected before any network call. - New handler tests cover all four cases: create with bypassed auth (expect 403, no DB write), create with real auth (expect 201, path stored), update with bypassed auth (expect 403, no DB write), and the existing config-merge behaviour. - OpenAPI docs and the plugin sequencing guide updated to document the 403 response and the authentication requirement for `path`. - Dependency bumps: `aws-sdk-go-v2/config` → v1.32.14, `aws-sdk-go-v2/service/s3` → v1.99.0, `aws-sdk-go-v2/internal/ini` → v1.8.6, `buger/jsonparser` → v1.2.0. ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI > This is primarily a security hardening change. ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [x] Docs ## How to test ```sh # Run all tests go test ./... # Specifically verify the new plugin handler guards go test ./transports/bifrost-http/handlers/... -run TestCreatePlugin_RejectsCustomPathWhenAuthBypassed go test ./transports/bifrost-http/handlers/... -run TestCreatePlugin_AllowsCustomPathWhenNotBypassed go test ./transports/bifrost-http/handlers/... -run TestUpdatePlugin_RejectsCustomPathWhenAuthBypassed # Verify SSRF guard on plugin downloader go test ./framework/plugins/... -run TestDownloadPlugin_BlocksSSRFToLoopback go test ./framework/plugins/... -run TestDownloadPlugin_RejectsNonHTTPScheme ``` To manually verify the 403 behaviour: start the gateway with no dashboard auth configured, then attempt `POST /api/plugins` with a `path` field pointing to a `.so`. The response should be `403` with a message instructing the operator to enable dashboard authentication first. ## Breaking changes - [x] Yes - [ ] No Operators running with dashboard authentication disabled who were previously able to create or update custom plugin paths via the API will now receive a `403`. To restore the capability, enable dashboard authentication and authenticate before calling those endpoints. ## Security considerations - Closes an unauthenticated native code injection vector: without this change, any network-reachable caller could `dlopen()` an attacker-controlled `.so` into the gateway process when dashboard auth was off. - The SSRF fix on the plugin downloader prevents a crafted plugin URL from causing the gateway to fetch from internal/metadata endpoints (e.g. cloud IMDS). The guard runs at dial time, not DNS resolution time, so DNS rebinding attacks do not bypass it. - `BifrostContextKeyAuthBypassed` is intentionally separate from `IsLocalAdminContextKey` so that future handlers gating other high-risk operations can use the same signal without ambiguity. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable * go mod fixes (maximhq#5789) ## Summary Briefly explain the purpose of this PR and the problem it solves. ## Changes - What was changed and why - Any notable design decisions or trade-offs ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Describe the steps to validate this change. Include commands and expected outcomes. ```sh # Core/Transports go version go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` If adding new configs or environment variables, document them here. ## Screenshots/Recordings If UI changes, add before/after screenshots or short clips. ## Breaking changes - [ ] Yes - [ ] No If yes, describe impact and migration instructions. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations Note any security implications (auth, secrets, PII, sandboxing, etc.). ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable * [fix]: clear stuck entity-assignment validation on virtual key sheet (maximhq#5805) * [fix]: clear stuck entity-assignment validation on virtual key sheet Eager trigger on assignment-type changes left a refine error on entityType that selecting a team/customer never cleared; also align the assignment controls to items-start. Co-authored-by: Cursor <cursoragent@cursor.com> * [docs]: add before/after screenshots for virtual key entity-assignment fix Co-authored-by: Cursor <cursoragent@cursor.com> * [docs]: add on-submit validation screenshot for entity-assignment fix Co-authored-by: Cursor <cursoragent@cursor.com> * [chore]: remove PR screenshots from .github/assets Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> * test(anthropic): cover message request extra params * perf(anthropic): avoid copying known request fields --------- Signed-off-by: Akshay Deo <akshay@akshaydeo.com> Co-authored-by: jeremym-tanium <jeremy.maness@tanium.com> Co-authored-by: Akshay Deo <akshay@akshaydeo.com> Co-authored-by: Madhu Shantan <madhushantangot@gmail.com> Co-authored-by: CMWR421 <182079927+CMWR421@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary Bumps several transitive dependencies to newer versions to address potential security vulnerabilities and keep lockfiles up to date. ## Changes - `ip-address` upgraded from `10.2.0` to `10.3.1` in the `temperature` and `test-tools-server` MCP example lockfiles - `nanoid` upgraded from `3.3.12` to `3.3.16` in the `ui` and TypeScript integration test lockfiles - `postcss` upgraded from `8.5.15` to `8.5.24` in the `ui` and TypeScript integration test lockfiles - `golang.org/x/net` upgraded from `v0.33.0` to `v0.55.0` in the `realtime-test` script - Removed erroneous `"peer": true` flags from several packages in the TypeScript integration test lockfile, correcting their classification as direct or dev dependencies ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [ ] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [x] UI (React) - [ ] Docs ## How to test ```sh # UI cd ui npm i npm run build # TypeScript integrations cd tests/integrations/typescript npm i npm test ``` ## Breaking changes - [ ] Yes - [x] No ## Security considerations `golang.org/x/net` v0.33.0 contained known vulnerabilities. Upgrading to v0.55.0 resolves those. The `nanoid` and `postcss` upgrades similarly address reported issues in the older patch versions. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
…hq#5450) * fix(core): carry tool-result is_error through the chat completions surface The chat-surface neutral format had no carrier for a failed tool execution: ChatToolMessage held only tool_call_id, so an Anthropic tool_result's is_error was dropped on replay (acknowledged in maximhq#190), and the Bedrock Converse converter hard-coded every toolResult to status "success". The sibling Responses surface already preserves the marker (via ResponsesToolMessage.Error / status "incomplete", maximhq#1580); this brings the chat surface to parity. - schemas: add ChatToolMessage.IsError (*bool, is_error, omitempty) - anthropic: map IsError onto the tool_result block's is_error - bedrock: derive Converse toolResult status ("error"/"success") from IsError instead of hard-coding "success" - openai, huggingface: strip is_error before serialization — the OpenAI wire has no such field and OpenAI-compatible providers reject unknown message parameters (same failure class as the Responses-path "input[N].error" incident maximhq#1580 fixed). Cohere/Gemini/etc. build their wire structs by explicit field mapping and need no strip. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EEbNA7pmJy67SgZFsM3Sno * test(core): cover explicit is_error:false in the tool-message round trip The round-trip test asserted only is_error:true and the absent case, so an implementation that collapsed an explicit false into "unspecified" would still pass. Because IsError is a *bool, false and nil are distinct states and the converters read them differently — Bedrock folds false into status "success" (same as nil), Anthropic emits is_error:false on the wire. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(core): add changelog entry for tool-result is_error fix The contributing guide (docs/contributing/raising-a-pr.mdx) requires a changelog.md entry for each package a PR modifies, and core/changelog.md is what .github/workflows/scripts/release-core.sh reads to generate release notes — without an entry this fix would ship unlisted. Follows the format used in the file itself (leading dash, bare `fix:`, author link) rather than the bracketed `[fix]:` form the doc shows; no existing entry uses brackets. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLAk8e2G5WLiFMqGafaxVP * docs(core): document ConvertBifrostMessagesToOpenAIMessages and refresh HF sanitizer doc The exported OpenAI message converter had no doc comment, which is what put this PR's docstring coverage at 66.67% against the 80% threshold. Its two non-obvious behaviours — signature stripping on over-long tool call IDs and the is_error drop — are now stated, along with the no-mutation guarantee. sanitizeMessagesForHuggingFace's comment claimed it removed unsupported ChatAssistantMessage fields; this PR also made it strip ChatToolMessage is_error, so the comment no longer matched the body. Comments only, no behaviour change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLAk8e2G5WLiFMqGafaxVP --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Affected packages: - core/ - annotate completed unary responses with model-catalog cost - transports/bifrost-http/lib/ - emit x-bifrost-cost-usd Tests: - core model catalog response cost - HTTP cost header presence, zero, and absence
oritmosko
force-pushed
the
codex/expose-cost-header
branch
from
August 6, 2026 11:56
212cc9f to
fd1519e
Compare
Contributor
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
Author
|
Hi @akshaydeo @TejasGhatte @danpiths — friendly follow-up on this. The requested streaming-cost support is implemented, the branch is current with |
akshaydeo
dismissed
coderabbitai[bot]’s stale review
August 10, 2026 22:20
The merge-base changed after approval.
akshaydeo
force-pushed
the
dev
branch
3 times, most recently
from
August 13, 2026 09:47
244a01d to
ce1b2a6
Compare
|
I'd like this feature for my application. Where are we at with this? And will it be compatible with the web socket mode(s)? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Expose Bifrost authoritative model-catalog cost to clients without requiring them to duplicate pricing logic.
Completed non-streaming responses expose the cost in response metadata and through
x-bifrost-cost-usd. Streaming responses expose it in the final chunkextra_fields.cost, because HTTP headers have already been sent by the time final usage is known.Changes
nil) and a legitimate calculated zero.BifrostResponseExtraFields.Costafter routing, fallbacks, and post-hooks complete.WithDefaults.x-bifrost-cost-usdfor completed non-streaming HTTP responses when cost is available.Type of change
Affected areas
How to test
The full affected core/schema suites and focused HTTP response-header tests pass.
No new configuration or environment variables are required.
Screenshots/Recordings
Not applicable.
Breaking changes
Related issues
Closes #5695. Streaming parity was added in response to review feedback.
Security considerations
The response exposes only the calculated aggregate request cost. It does not expose credentials, prompts, responses, or model-catalog configuration.
Checklist
docs/contributing/README.mdand followed the guidelines