Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard/bedrock-runtime.ts (1)

89-96: Run the Bedrock-compatible Anthropic E2E job before merge.

This branch touches the Bedrock Runtime compatible onboarding path; running the targeted E2E is a good final guard for sandbox-route behavior.

As per coding guidelines "src/lib/onboard/bedrock-runtime.ts: This file is part of the Bedrock Runtime compatible Anthropic endpoint path... E2E test recommendation: bedrock-runtime-compatible-anthropic-e2e."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/bedrock-runtime.ts` around lines 89 - 96, This change affects
the Bedrock Runtime onboarding path around replaceNamedCredential in
src/lib/onboard/bedrock-runtime.ts (the block that calls
options.replaceNamedCredential and returns { action: "retry-selection" }), so
before merging run the targeted end-to-end test suite named
bedrock-runtime-compatible-anthropic-e2e to validate sandbox-route and
Anthropic-compatible Bedrock behavior; if the E2E fails, iterate on the
onboarding flow (especially the replaceNamedCredential handling and
retry-selection branch) until the E2E passes.

src/lib/onboard.ts (1)

6620-6621: Spot-run the onboarding E2Es that cover remote-provider and Bedrock paths.

This change now threads credential navigation through the shared provider-selection loop and the Bedrock-compatible endpoint adapter, so I’d sanity-check cloud-e2e and bedrock-runtime-compatible-anthropic-e2e before merge.

As per coding guidelines: src/lib/onboard.ts: "This file contains core onboarding logic. Changes here affect the full sandbox creation and configuration flow."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 6620 - 6621, Run the E2E suites that
exercise the remote-provider and Bedrock code paths (specifically run the
cloud-e2e and bedrock-runtime-compatible-anthropic-e2e tests) to validate the
credential navigation changes in src/lib/onboard.ts; focus your checks on the
provider-selection loop and the Bedrock endpoint adapter where
credentialPrompt.replaceNamedCredential is threaded, confirming that providers
are selectable, credentials are persisted/updated correctly, and
Bedrock-compatible endpoints are invoked without errors or regressions.

src/lib/onboard/credential-navigation.ts (1)

4-4: ⚡ Quick win

Use ES6 import instead of require() for consistency with codebase conventions.

This file uses require() with a type annotation instead of an ES6 import statement. There is no circular dependency justifying this pattern—credentials/store.ts does not reference this file. Other files in the src/lib/onboard/ directory use ES6 imports (e.g., wechat-config.ts), and the codebase predominantly follows this standard.

Convert to:

import * as credentials from "../credentials/store";

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/credential-navigation.ts` at line 4, Replace the CommonJS
require with an ES6 namespace import: remove the typed require assignment that
declares the variable credentials and instead import the credentials store using
an ES6 import into the same credentials identifier (i.e., use a namespace import
of the credentials store module so other code referencing credentials continues
to work); ensure you remove the type-on-require pattern and keep the module's
exported types available via the credentials symbol.

test/onboard-selection.test.ts (1)

3767-3827: ⚡ Quick win

Cover the provider-level exit path too.

These scenarios only exercise back, but this PR also changes how { kind: "exit" } is routed through the same credential branches. A branch that accidentally maps exit to “return to provider selection” would still pass here. Extending the scenario shape with the expected terminal intent/result and adding at least one exit case would close that gap.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/onboard-selection.test.ts` around lines 3767 - 3827, The test data in
secretCredentialBackScenarios only covers the "back" intent so it misses
provider-level "exit" routing; extend the scenario shape (used by
runCredentialBackScenario) to include an expected terminal intent/result field
(e.g., expectedFinalIntent or expectedResult) and add at least one scenario with
answers that include the { kind: "exit" } flow, then update
runCredentialBackScenario to assert the scenario.expectedResult is reached (or
that the provider selection/termination behavior occurs) so the test ensures
exit is routed to the correct terminal path rather than being treated as a
back-to-provider selection.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard/credential-navigation.ts (1)

14-21: 💤 Low value

Minor redundancy with getCredentialPromptIntent in store.ts.

This function duplicates the navigation keyword detection logic from getCredentialPromptIntent. Consider whether this could be consolidated, or document why both are needed (one operates on raw strings for non-credential prompts, the other on credential prompt results).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/credential-navigation.ts` around lines 14 - 21,
getNavigationChoice duplicates logic already implemented in
getCredentialPromptIntent; consolidate to avoid redundancy by extracting the
shared normalization + keyword checks into a single utility (e.g., a new
function like normalizeAndDetectNavigation or move detection into
getCredentialPromptIntent and have getNavigationChoice call it) and update both
call sites to use the shared helper, or if you intentionally need two separate
functions, add a brief comment above getNavigationChoice referencing
getCredentialPromptIntent and explaining why both exist (one for raw string
inputs, the other for credential-prompt result types). Ensure you reference the
existing symbols getNavigationChoice and getCredentialPromptIntent when making
the change so callers are updated accordingly.

src/lib/onboard.ts (1)

1398-1399: Run the onboarding E2Es before merge.

This changes the shared credential-navigation entry point for core onboarding, so I’d smoke the provider-selection, compatible-endpoint, Bedrock-compatible Anthropic, and Hermes messaging E2Es on this branch before merging.

As per coding guidelines: src/lib/onboard.ts: E2E test recommendation: cloud-e2e ... messaging-compatible-endpoint-e2e ... bedrock-runtime-compatible-anthropic-e2e ... hermes-discord-e2e ... hermes-slack-e2e.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 1398 - 1399, This change alters the shared
credential-navigation entry point (createCredentialPromptHelpers in
src/lib/onboard.ts), so before merging run the full set of onboarding E2E
suites: cloud-e2e, messaging-compatible-endpoint-e2e,
bedrock-runtime-compatible-anthropic-e2e, hermes-discord-e2e and
hermes-slack-e2e; if any fail, fix the onboarding flow around
createCredentialPromptHelpers/exitOnboardFromPrompt to ensure
provider-selection, compatible-endpoint checks, Bedrock Anthropic compatibility,
and Hermes messaging flows behave correctly, then re-run the listed E2Es until
all pass.

src/lib/onboard/bedrock-runtime.ts (1)

58-114: Run the targeted Bedrock-compatible Anthropic E2E lane for this path.

This change touches Bedrock-compatible onboarding/back-navigation behavior; please run:
gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=bedrock-runtime-compatible-anthropic-e2e

As per coding guidelines: src/lib/onboard/bedrock-runtime.ts changes should run the bedrock-runtime-compatible-anthropic-e2e recommendation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/bedrock-runtime.ts` around lines 58 - 114, Changes in
selectBedrockRuntimeCustomAnthropic (src/lib/onboard/bedrock-runtime.ts) affect
Bedrock-compatible Anthropic onboarding/back-navigation behavior; trigger the
nightly E2E job for that lane by running the GitHub Actions workflow with the
bedrock-runtime-compatible-anthropic-e2e job: run `gh workflow run
nightly-e2e.yaml --ref <branch> -f
jobs=bedrock-runtime-compatible-anthropic-e2e` and verify the end-to-end tests
for this code path pass.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard/bedrock-runtime.ts (1)

58-114: Run the Bedrock-compatible Anthropic E2E for this path.

Given this file’s runtime role, run bedrock-runtime-compatible-anthropic-e2e to validate adapter/token isolation and sandbox-route behavior after these navigation-contract changes.

As per coding guidelines, src/lib/onboard/bedrock-runtime.ts changes affect the Bedrock Runtime compatible Anthropic path and should be validated with bedrock-runtime-compatible-anthropic-e2e.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/bedrock-runtime.ts` around lines 58 - 114, The PR changes
affect the Bedrock-compatible Anthropic path in
selectBedrockRuntimeCustomAnthropic; run the
bedrock-runtime-compatible-anthropic-e2e end-to-end test to validate
adapter/token isolation and sandbox-route behavior after the navigation-contract
changes—execute that test suite locally or in CI, verify
selectBedrockRuntimeCustomAnthropic flows (credential replacement, prompt
fallback, and preferredInferenceApi) behave correctly, and fix any failures
found (e.g., adjust credentialEnv handling or backToSelection returns) until the
E2E passes.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard/bedrock-runtime.ts (1)

94-113: Run the Bedrock-compatible Anthropic E2E job before merge.

This edit touches credential/back navigation in the Bedrock-compatible onboarding path; a targeted E2E run is a good safety check for endpoint classification and adapter flow regressions.

As per coding guidelines: src/lib/onboard/bedrock-runtime.ts changes should run bedrock-runtime-compatible-anthropic-e2e.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/bedrock-runtime.ts` around lines 94 - 113, This change
touches the Bedrock-compatible onboarding flow (see calls to
options.replaceNamedCredential, options.promptInputModel and the return path
that sets preferredInferenceApi to "openai-completions"); before merging, run
the targeted end-to-end test suite bedrock-runtime-compatible-anthropic-e2e to
validate endpoint classification and adapter flow behavior for
Bedrock-compatible Anthropic paths and ensure no regressions in
credential/back-navigation or model selection flows; if the test fails, fix the
flow (credentialResult/backToSelection handling or model type checks) until the
E2E passes.

src/lib/onboard.ts (1)

275-281: ⚡ Quick win

Remove the unused printReturningToProviderSelection import.

printReturningToProviderSelection is never referenced in this file, so it leaves a static-analysis warning on the new onboarding path for no benefit.

♻️ Proposed fix

 const {
   BACK_TO_SELECTION,
   createCredentialPromptHelpers,
   getNavigationChoice,
   isBackToSelection,
-  printReturningToProviderSelection,
 } = credentialNavigation;

As per coding guidelines: **/*.{js,ts,tsx,jsx}: "Unused variables should be prefixed with underscore (_) following Biome conventions".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 275 - 281, The destructured import
printReturningToProviderSelection from credentialNavigation is unused and
causing a lint warning; remove it from the destructuring list (leaving
BACK_TO_SELECTION, createCredentialPromptHelpers, getNavigationChoice,
isBackToSelection) or, if you prefer to signal intentional unusedness, rename it
to _printReturningToProviderSelection to follow the Biome convention; update the
destructuring in the credentialNavigation import/const accordingly.

src/lib/onboard/bedrock-runtime.ts (1)

58-114: Please run the Bedrock-compatible Anthropic E2E job before merge.

This path now handles back-sentinel propagation in credential/model selection, so validating adapter startup/isolation and inference.local routing in the targeted E2E is worth doing for release confidence.

As per coding guidelines, src/lib/onboard/bedrock-runtime.ts changes should run bedrock-runtime-compatible-anthropic-e2e.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/bedrock-runtime.ts` around lines 58 - 114, The change to
selectBedrockRuntimeCustomAnthropic (and related flows using
classifyCustomAnthropicEndpoint, replaceNamedCredential and promptInputModel)
requires running the bedrock-runtime-compatible-anthropic-e2e job before
merging; run that E2E, verify adapter startup/isolation, credential/model
back-sentinel behavior, and confirm routing for inference.local and
openai-completions is correct, then only merge once the E2E passes and any
failures are fixed.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard/credential-navigation.ts (1)

119-122: 💤 Low value

Consider using exitOnboardFromPrompt consistently for all exit paths.

The function receives exitOnboardFromPrompt but calls process.exit(1) directly when envName is null. While this is a programming error rather than user-initiated exit, using the injected exit function would maintain consistency and improve testability.

♻️ Optional consistency improvement

   if (!envName) {
     console.error(`  Missing credential target for ${label}.`);
-    process.exit(1);
+    exitOnboardFromPrompt();
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/credential-navigation.ts` around lines 119 - 122, The
early-exit branch that currently does console.error(...) followed by
process.exit(1) should call the injected exit handler instead: replace the
process.exit(1) call inside the if (!envName) check with
exitOnboardFromPrompt(1) so the function uses the provided exitOnboardFromPrompt
for exits (keep the console.error message using label as-is); update the block
around envName and label to call exitOnboardFromPrompt(1) rather than
process.exit.

src/lib/onboard.ts (1)

6068-6085: Run the targeted onboarding E2E slices before merge.

These back-navigation changes now sit in the core provider-selection loop, so I’d still run the focused nightly jobs that cover cloud onboarding plus the Bedrock/Hermes/messaging branches touched by this flow.

As per coding guidelines: src/lib/onboard.ts: "This file contains core onboarding logic. Changes here affect the full sandbox creation and configuration flow."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 6068 - 6085, The changes to the
provider-selection loop (variables model, provider, nimContainer, endpointUrl,
credentialEnv and the resetSelectionAttemptState function, plus
hermesAuthMethod, hermesToolGateways and preferredInferenceApi) affect core
onboarding flow; before merging, run the targeted onboarding E2E slices (cloud
onboarding + Bedrock/Hermes/messaging branches) that exercise the
provider-selection/back-navigation paths and the resetSelectionAttemptState
behavior to ensure sandbox creation/configuration and back-navigation work
end-to-end without regressions.

src/lib/onboard.ts (1)

6068-6085: Run the onboarding E2E subset on this branch.

This now threads back/exit control flow through provider selection, credential replacement, local-provider fallbacks, and Bedrock/Hermes branches, so targeted cloud-e2e, messaging-compatible-endpoint-e2e, and bedrock-runtime-compatible-anthropic-e2e coverage feels worthwhile before merge.

As per coding guidelines: src/lib/onboard.ts: "This file contains core onboarding logic. Changes here affect the full sandbox creation and configuration flow."

Also applies to: 6278-7332

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 6068 - 6085, Run the onboarding E2E subset
(cloud-e2e, messaging-compatible-endpoint-e2e,
bedrock-runtime-compatible-anthropic-e2e) to exercise the full threaded control
flow through provider selection, credential replacement, local-provider
fallbacks, and Bedrock/Hermes branches; if failures occur, inspect the
onboarding flow that uses the variables model, provider, nimContainer,
endpointUrl, credentialEnv, hermesAuthMethod, hermesToolGateways,
preferredInferenceApi and the resetSelectionAttemptState function to ensure all
mutated state is correctly reset and all branches (remote vs local provider,
Bedrock vs Hermes) behave as expected, then fix logic or add guards/tests so
those branches pass the E2E subset.

test/onboard-brave-validation.test.ts (1)

355-366: ⚡ Quick win

Tighten the back-navigation assertion to reject any credential staging.

The current check only rejects a literal "back" value. Assert no save calls happened for this path.

Suggested diff

-    expect(payload.saved.every((entry) => entry.value !== "back")).toBe(true);
+    expect(payload.saved).toEqual([]);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/onboard-brave-validation.test.ts` around lines 355 - 366, The test's
current assertion only forbids a literal "back" in payload.saved entries;
instead assert that no save operations occurred by checking payload.saved is
empty. Update the assertion in the "does not stage back as a Brave Search API
key" test (which uses runInteractiveConfigureWebSearch and inspects
payload.saved) to explicitly expect payload.saved toHaveLength(0) or
toEqual([]), ensuring no credentials were staged for the "back" path.

src/lib/onboard/bedrock-runtime.ts (1)

58-114: Run the Bedrock-compatible Anthropic E2E job before merge.

This path is security/endpoint-sensitive; a targeted E2E pass would de-risk regressions in adapter routing and back-navigation behavior.

As per coding guidelines: src/lib/onboard/bedrock-runtime.ts includes the recommendation to run bedrock-runtime-compatible-anthropic-e2e via gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=bedrock-runtime-compatible-anthropic-e2e.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/bedrock-runtime.ts` around lines 58 - 114, The
selectBedrockRuntimeCustomAnthropic path is endpoint- and auth-sensitive and
must be validated by the dedicated E2E job before merging; run the nightly-e2e
workflow for the bedrock-runtime-compatible-anthropic-e2e job against your
branch (gh workflow run nightly-e2e.yaml --ref <branch> -f
jobs=bedrock-runtime-compatible-anthropic-e2e) and confirm the adapter routing,
credential replacement flow (replaceNamedCredential), backToSelection behavior,
and non-interactive branch (isNonInteractive/defaultModel) all pass before
merging.

test/onboard-selection.test.ts (1)

3847-3915: ⚡ Quick win

Cover help and ? at secret credential prompts too.

The linked credential-navigation fix also calls out help/?, but this matrix only exercises back and one exit path. A regression that still stages those help keywords as literal secrets would pass this suite.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/onboard-selection.test.ts` around lines 3847 - 3915, The test matrix
secretCredentialBackScenarios only checks "back" and one "exit" path so it
misses the help keywords; add entries to secretCredentialBackScenarios that
exercise typing "help" and "?" at a secret credential prompt (e.g., mirror the
existing "Anthropic" case with answers ["4","help"] and ["4","?"] or similar for
another provider), set an expectedOutcome (e.g., "help") for those cases, and
ensure the test harness loop that calls runCredentialBackScenario interprets
expectedOutcome "help" appropriately so the new cases are executed and asserted.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes