Disabling these gosec taint analysis rules (G702, G703, G704, G705) and the integer overflow check (G115) across the entire project is highly risky. These rules protect against critical vulnerabilities like Command Injection, Path Traversal, SSRF, and XSS. The comment "those reports are not relevant" is not a sufficient justification for disabling such important security checks globally. If there are specific false positives, they should be excluded on a case-by-case basis using //nolint:gosec comments with a clear explanation for each case. Please remove this global exclusion.

There is a bug in the UpdateChannelInput.Mutate method. When AppendEndpoints is used in a mutation, the code incorrectly appends i.Endpoints instead of i.AppendEndpoints. This will lead to incorrect data being persisted.

🔴 SupportedAPIFormats allows formats that buildNonDefaultEndpointOutbound cannot handle, silently disabling channels

ValidateEndpoints (channel_override.go:218-233) uses SupportedAPIFormats which includes openai/responses_compact, openai/video, and gemini/embeddings. However, buildNonDefaultEndpointOutbound (channel_llm.go:228-289) has no case for these formats and returns an error via the default branch. This means: (1) a user can successfully save an endpoint with e.g. openai/responses_compact because validation passes, (2) on the next enabled-channels cache reload, buildChannelWithOutbounds propagates the error, and (3) reloadEnabledChannels (channel.go:227-228) logs a warning and skips the channel entirely via continue. The channel silently disappears from load balancing with no user-visible error at save time.

The SupportedAPIFormats map in channel_override.go (used by ValidateEndpoints) accepts formats that buildNonDefaultEndpointOutbound in channel_llm.go cannot build outbound transformers for. The formats openai/responses_compact, openai/video, and gemini/embeddings pass validation but cause buildChannelWithOutbounds to fail, which silently excludes the channel from the enabled channels list.

Two possible fixes:
1. Remove the unsupported formats (openai/responses_compact, openai/video, gemini/embeddings) from SupportedAPIFormats so they are rejected at validation time.
2. Add handling for these formats in buildNonDefaultEndpointOutbound so they actually work.

Option 1 is safer if these formats are not yet implemented. The key files are internal/server/biz/channel_override.go (SupportedAPIFormats map) and internal/server/biz/channel_llm.go (buildNonDefaultEndpointOutbound switch).

Was this helpful? React with 👍 or 👎 to provide feedback.

🟡 Three channel types missing from defaultEndpointsForChannelType map

The defaultEndpointsForChannelType map in channel_llm.go:1085-1138 is missing entries for TypeXiaomiAnthropic, TypeVolcengineAnthropic, and TypeAihubmixAnthropic. These types are valid channel types (defined in internal/ent/channel/channel.go) and use Anthropic transformers. Without entries, ResolveEndpoints() returns nil for these types, so buildChannelWithOutbounds returns early with a nil Outbounds map and the multi-endpoint feature is inoperative. The same three types are also missing from the frontend's CHANNEL_TYPE_TO_DEFAULT_ENDPOINTS in frontend/src/features/channels/data/config_channels.ts:708-761, causing the endpoints dialog to show empty defaults for these channel types.

Three channel types are missing from the defaultEndpointsForChannelType map in internal/server/biz/channel_llm.go: TypeXiaomiAnthropic, TypeVolcengineAnthropic, and TypeAihubmixAnthropic. All three should map to []objects.ChannelEndpoint{{APIFormat: "anthropic/messages"}} since they are Anthropic-protocol variants of their respective providers.

The same three types (xiaomi_anthropic, volcengine_anthropic, aihubmix_anthropic) are also missing from CHANNEL_TYPE_TO_DEFAULT_ENDPOINTS in frontend/src/features/channels/data/config_channels.ts. They should each map to [{ apiFormat: ANTHROPIC_MESSAGES }].

Both maps need to be updated together to keep frontend and backend consistent.

Was this helpful? React with 👍 or 👎 to provide feedback.

SupportedAPIFormats and frontend apiFormatSchema are out of sync

SupportedAPIFormats contains gemini/embeddings, openai/responses_compact, and openai/video — none of which appear in the frontend's apiFormatSchema enum. Conversely, the frontend enum includes aisdk/text and aisdk/datastream which are absent from SupportedAPIFormats (see related comment on schema.ts). Consider either adding a shared source-of-truth (e.g. GraphQL enum) that both sides derive from, or at least a test that cross-checks them. Without this, divergence will silently re-occur whenever formats are added on one side.