Findings

• [Blocker] Silent error swallow in log-opening flow violates the no-silent-fallback rule — handleShowLog catches and ignores failures, so users get no feedback when opening logs fails, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:63
  Suggested fix:

  async function handleShowLog() {
    if (!logsPath || !window.codesign) return;
    try {
      await window.codesign.settings.openFolder(logsPath);
    } catch (err) {
      // Surface to UI instead of silently swallowing.
      const message = err instanceof Error ? err.message : 'Failed to open logs folder';
      // e.g. set local panel state and render the message
      setLocalError(message);
    }
  }

• [Major] Provider-specific billing action points to OpenAI for all providers — 402 handling always opens OpenAI billing URL, which is incorrect for Anthropic/OpenRouter and can send users to the wrong remediation path, evidence packages/shared/src/diagnostics.ts:64
  Suggested fix:

  function billingUrlFor(provider: string): string | undefined {
    if (provider === 'openai') return 'https://platform.openai.com/settings/organization/billing';
    if (provider === 'anthropic') return 'https://console.anthropic.com/settings/billing';
    if (provider === 'openrouter') return 'https://openrouter.ai/settings/credits';
    return undefined;
  }
  
  // in 402 branch
  suggestedFix: {
    label: 'diagnostics.fix.addCredits',
    ...(billingUrlFor(ctx.provider) ? { externalUrl: billingUrlFor(ctx.provider)! } : {}),
  }

• [Minor] Hardcoded English UI string bypasses i18n and breaks locale consistency — panel title/body is localized, but “Most likely cause” is hardcoded and won’t translate, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:111
  Suggested fix:

  <span className="font-medium text-[var(--color-text-primary)]">
    {t('diagnostics.mostLikelyCause')}{' '}
  </span>

Summary

• Review mode: initial
• 3 issues found in the latest diff: 1 blocker (silent fallback), 1 major (provider-incorrect billing link), 1 minor (missing i18n on new label).

Testing

• Not run (automation)
• Suggested tests:
  1. ConnectionDiagnosticPanel test for openFolder rejection asserting visible error state.
  2. diagnose('402', { provider }) table test asserting provider-specific externalUrl.
  3. i18n rendering test asserting diagnostics.mostLikelyCause is used instead of hardcoded text.

open-codesign Bot

Findings

• [Blocker] Silent fallback when resolving app paths violates the no-silent-fallback rule — failures from getPaths() are swallowed and never surfaced to UI or thrown, evidence apps/desktop/src/renderer/src/components/Settings.tsx:267.
  Suggested fix:

  const pushToast = useCodesignStore((s) => s.pushToast);
  
  useEffect(() => {
    if (!window.codesign) return;
    void window.codesign.settings
      .getPaths()
      .then((p) => setLogsFolder(p.logsFolder))
      .catch((err) => {
        const message = err instanceof Error ? err.message : 'Failed to load app paths';
        pushToast({
          variant: 'error',
          title: t('diagnostics.showLogFailed'),
          description: message,
        });
      });
  }, [pushToast, t]);

• [Major] 402 remediation link is hardcoded to OpenAI billing for all providers — for Anthropic/OpenRouter this routes users to the wrong action path, evidence packages/shared/src/diagnostics.ts:64.
  Suggested fix:

  function billingUrlFor(provider: string): string | undefined {
    if (provider === 'openai') return 'https://platform.openai.com/settings/organization/billing';
    if (provider === 'anthropic') return 'https://console.anthropic.com/settings/billing';
    if (provider === 'openrouter') return 'https://openrouter.ai/settings/credits';
    return undefined;
  }
  
  const externalUrl = billingUrlFor(ctx.provider);
  suggestedFix: {
    label: 'diagnostics.fix.addCredits',
    ...(externalUrl ? { externalUrl } : {}),
  }

• [Minor] New diagnostics panel contains hardcoded English text, bypassing i18n — Most likely cause: is not localized, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:118.
  Suggested fix:

  <span className="font-medium text-[var(--color-text-primary)]">
    {t('diagnostics.mostLikelyCause')}{' '}
  </span>

Summary

• Review mode: follow-up after new commits
• 3 issues found in the latest PR diff: 1 blocker, 1 major, 1 minor.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.

Testing

• Not run (automation)
• Suggested tests:

1. Add a renderer test that mocks window.codesign.settings.getPaths() rejection and asserts an error toast is surfaced.
2. Extend diagnostics.test.ts with provider-parametrized assertions for 402 externalUrl values.
3. Add a UI/i18n test asserting the diagnostics cause label uses diagnostics.mostLikelyCause.

open-codesign Bot

Findings

• [Major] 402 remediation link is hardcoded to OpenAI billing for all providers — this sends Anthropic/OpenRouter users to the wrong recovery flow, reducing fixability after failed validation, evidence packages/shared/src/diagnostics.ts:64.
  Suggested fix:

  function billingUrlFor(provider: string): string | undefined {
    if (provider === 'openai') return 'https://platform.openai.com/settings/organization/billing';
    if (provider === 'anthropic') return 'https://console.anthropic.com/settings/billing';
    if (provider === 'openrouter') return 'https://openrouter.ai/settings/credits';
    return undefined;
  }
  
  const externalUrl = billingUrlFor(ctx.provider);
  suggestedFix: {
    label: 'diagnostics.fix.addCredits',
    ...(externalUrl ? { externalUrl } : {}),
  }

• [Minor] Diagnostics panel includes hardcoded English text (Most likely cause:), so this new UI path is not fully localized, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:118.
  Suggested fix:

  <span className="font-medium text-[var(--color-text-primary)]">
    {t('diagnostics.mostLikelyCause')}{' '}
  </span>

Summary

• Review mode: follow-up after new commits
• 2 issues found in the latest diff (1 major, 1 minor).
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.

Testing

• Not run (automation)
• Suggested tests:

1. Add provider-parametrized assertions for 402 in packages/shared/src/diagnostics.test.ts to verify provider-specific billing URLs.
2. Add a renderer test asserting the diagnostics cause-prefix label is localized via i18n key lookup.

open-codesign Bot

Findings

• [Minor] Hardcoded English cause label breaks localization in the new diagnostics panel, so non-English locales will show mixed-language UI, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:118.
  Suggested fix:

  <span className="font-medium text-[var(--color-text-primary)]">
    {t('diagnostics.mostLikelyCause')}{' '}
  </span>

Summary

• Review mode: follow-up after new commits
• 1 issue found in the latest diff (minor).
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.

Testing

• Not run (automation)
• Suggested tests:

1. Add a renderer/component test asserting the diagnostics cause-prefix label is localized via i18n key lookup.

open-codesign Bot

Findings

• [Minor] Hardcoded English cause label breaks localization in diagnostics panel — non-English users will see mixed-language UI, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:118
  Suggested fix:

  <span className="font-medium text-[var(--color-text-primary)]">
    {t('diagnostics.mostLikelyCause')}{' '}
  </span>

Summary

• Review mode: follow-up after new commits
• 1 issue found in the latest diff.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.

Testing

• Not run (automation)
• Suggested tests:

1. Add a renderer/component test asserting the cause-prefix label is localized via i18n key lookup for both en and zh-CN.

open-codesign Bot

Findings

• [Minor] Hardcoded English cause prefix breaks localization in diagnostics panel — non-English users still see mixed-language UI, evidence apps/desktop/src/renderer/src/components/ConnectionDiagnosticPanel.tsx:118
  Suggested fix:

  // ConnectionDiagnosticPanel.tsx
  <span className="font-medium text-[var(--color-text-primary)]">
    {t('diagnostics.mostLikelyCause')}{' '}
  </span>

Summary

• Review mode: follow-up after new commits
• 1 issue found in the latest PR head diff.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.
• Residual risk/testing gap: renderer behavior for the new diagnostic panel (localized prefix rendering and action flows) is not covered by tests in this diff.

Testing

• Not run (automation)
• Suggested tests:

1. Add a renderer test for ConnectionDiagnosticPanel asserting the cause-prefix label is read from i18n keys in both en and zh-CN.
2. Add a Settings interaction test for failed validation with errorCode to verify panel rendering, dismiss, and onApplyFix state transitions.

open-codesign Bot

Findings

• [Major] Applying the /v1 quick-fix can write an invalid relative Base URL when the current Base URL is empty, which can break subsequent provider validation/generation calls until the user manually repairs it, evidence packages/shared/src/diagnostics.ts:90, apps/desktop/src/renderer/src/components/Settings.tsx:446
  Suggested fix:

  baseUrlTransform: (cur: string) => {
    const cleaned = cur.trim().replace(/\/+$/, '');
    if (cleaned.length === 0) return cur; // no custom base URL configured
    return cleaned.endsWith('/v1') ? cleaned : `${cleaned}/v1`;
  },

Summary

• Review mode: follow-up after new commits
• 1 issue found in the latest PR head diff.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.
• Residual risk/testing gap: no renderer interaction test in this diff verifies diagnostic-panel apply-flow when baseUrl is empty.

Testing

• Not run (automation)
• Suggested tests:

1. Add a unit test for diagnostics ensuring the 404 baseUrlTransform does not mutate an empty string.
2. Add a Settings component interaction test for failed validation + Apply fix to verify baseUrl remains unchanged when initially empty.

open-codesign Bot

Findings

• No blocking/major/minor findings on added/modified lines in this head diff.

Summary

• Review mode: follow-up after new commits
• No new issues introduced in the latest diff.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md (missing in this checkout), so those constraints could not be cross-checked directly.
• Residual risk/testing gap: no component interaction test in Settings verifies diagnostic panel flows (Apply this fix, Test again, Show full log) end-to-end.

Testing

• Not run (automation)
• Suggested tests:

1. Renderer interaction test: failed validate with 404 + absolute baseUrl -> clicking Add /v1 updates baseUrl, clears error state.
2. Renderer interaction test: failed validate with 404 + empty/non-absolute baseUrl -> quick-fix remains disabled and tooltip shown.
3. Renderer interaction test: failed openFolder IPC -> error toast uses diagnostics.showLogFailed.

open-codesign Bot