Skip to content

fix(openai): support reasoning effort#101

Merged
galzilber merged 4 commits into
mainfrom
gz/add-reasoning-effort-option-to-the-hub
May 3, 2026
Merged

fix(openai): support reasoning effort#101
galzilber merged 4 commits into
mainfrom
gz/add-reasoning-effort-option-to-the-hub

Conversation

@galzilber

@galzilber galzilber commented May 3, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • New Features

    • Chat completion requests now accept an optional "reasoning effort" parameter.
  • Behavior Change

    • Providers prefer the explicit reasoning-effort when present; legacy reasoning is used only as a fallback and its validation runs only when reasoning-effort is absent.
  • Tests

    • Provider tests updated to include the new reasoning-effort field (unset by default).

@galzilber galzilber changed the title fix(openai): support reasoning effort direct fix(openai): support reasoning effort May 3, 2026
@coderabbitai

coderabbitai Bot commented May 3, 2026

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

Adds an optional reasoning_effort: Option<String> to ChatCompletionRequest. Azure and OpenAI conversions prefer this top-level field and fall back to deriving from legacy reasoning; legacy reasoning validation is skipped when reasoning_effort is present. Tests updated to include reasoning_effort: None.

Changes

Reasoning Effort Configuration

Layer / File(s) Summary
Data Shape
src/models/chat.rs
Adds reasoning_effort: Option<String> to ChatCompletionRequest.
Provider Conversion
src/providers/azure/provider.rs, src/providers/openai/provider.rs
From<ChatCompletionRequest> conversions now consume base.reasoning_effort first; if absent, they derive an effort from base.reasoning via existing conversion; base.reasoning is cleared for outbound requests.
Provider Validation / Control Flow
src/providers/azure/provider.rs, src/providers/openai/provider.rs
chat_completions handlers validate/log legacy payload.reasoning only when payload.reasoning_effort is None; legacy validation is skipped if explicit reasoning_effort is provided.
Tests — Provider Fixtures
src/providers/anthropic/test.rs, src/providers/bedrock/test.rs, src/providers/openai/test.rs, src/providers/vertexai/tests.rs
Updated test ChatCompletionRequest struct literals to include reasoning_effort: None alongside existing reasoning fields.
Unit Tests
src/providers/azure/provider.rs (tests), src/providers/openai/provider.rs (tests)
Added unit tests asserting precedence: top-level reasoning_effort wins, fallback to nested reasoning when absent, direct use when only top-level set, and omission when neither set.
Manifest
Cargo.toml
Minor manifest edits recorded in diffs.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 I found a tiny field today,
tucked in requests where values play.
Top-level first, then old notes peek —
Tests say "None", the path is sleek.
Hopping changes, soft and spry.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding support for a reasoning_effort optional field across the request models and providers (OpenAI, Azure, and others), with proper precedence handling and validation logic.
Docstring Coverage ✅ Passed Docstring coverage is 84.44% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch gz/add-reasoning-effort-option-to-the-hub

Review rate limit: 4/5 reviews remaining, refill in 12 minutes.

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented May 3, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub-migrations - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:c741f40ed02fba66024544aa70fac9c27f97ca03-amd64 (debian 13.4)
===========================================================================
Total: 14 (UNKNOWN: 0, LOW: 7, MEDIUM: 7, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5435    │          │              │                             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │              │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │              │                             │               │ format specifier and...                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │              │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │              │                             │               │ via ungetwc function with...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented May 3, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub-migrations - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:c741f40ed02fba66024544aa70fac9c27f97ca03-arm64 (debian 13.4)
===========================================================================
Total: 14 (UNKNOWN: 0, LOW: 7, MEDIUM: 7, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5435    │          │              │                             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │              │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │              │                             │               │ format specifier and...                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │              │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │              │                             │               │ via ungetwc function with...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/providers/azure/provider.rs`:
- Around line 27-30: The Azure path gives precedence to base.reasoning_effort
when constructing reasoning_effort (variable reasoning_effort using
base.reasoning_effort and base.reasoning), but the legacy validation still
checks payload.reasoning first and can reject a request even when
base.reasoning_effort is present; update the Azure validation logic so it
mirrors construction precedence: if base.reasoning_effort (or reasoning_effort
after construction) is present, skip/avoid validating legacy payload.reasoning,
otherwise validate payload.reasoning as before. Locate and change the validation
block that references payload.reasoning in the Azure provider to only run when
base.reasoning_effort is None (or when reasoning_effort is None), keeping the
variable names reasoning_effort, base.reasoning_effort, base.reasoning, and
payload.reasoning as references.

In `@src/providers/openai/provider.rs`:
- Around line 26-30: The validation path currently validates legacy
payload.reasoning before the conversion fallback, causing requests with a valid
base.reasoning_effort and an invalid base.reasoning to be rejected; update the
validation logic to mirror the conversion precedence used when building
reasoning_effort: first accept and validate base.reasoning_effort if present,
and only if it is None perform the legacy conversion/validation via
base.reasoning and to_openai_effort(); adjust the validator that checks
payload.reasoning to only run when base.reasoning_effort is absent so the
precedence is consistent with the reasoning_effort initialization.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6ef84bca-aacb-4080-9754-7618e58dbd2e

📥 Commits

Reviewing files that changed from the base of the PR and between 156dfa7 and caffe05.

📒 Files selected for processing (3)
  • src/models/chat.rs
  • src/providers/azure/provider.rs
  • src/providers/openai/provider.rs

Comment thread src/providers/azure/provider.rs
Comment thread src/providers/openai/provider.rs
@github-actions

github-actions Bot commented May 3, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:c741f40ed02fba66024544aa70fac9c27f97ca03-amd64 (debian 13.4)
================================================================
Total: 14 (UNKNOWN: 0, LOW: 7, MEDIUM: 7, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5435    │          │              │                             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │              │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │              │                             │               │ format specifier and...                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │              │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │              │                             │               │ via ungetwc function with...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented May 3, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:c741f40ed02fba66024544aa70fac9c27f97ca03-arm64 (debian 13.4)
================================================================
Total: 14 (UNKNOWN: 0, LOW: 7, MEDIUM: 7, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5435    │          │              │                             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │              │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │              │                             │               │ format specifier and...                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │              │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │              │                             │               │ via ungetwc function with...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
src/providers/openai/provider.rs (1)

88-97: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add direct validation for top-level reasoning_effort.

When reasoning_effort is present, invalid values (including whitespace-only) currently bypass validation and are sent downstream. This keeps validation behavior inconsistent with legacy reasoning and defers a user input error to the provider call path.

Suggested fix
-        if payload.reasoning_effort.is_none() {
+        if let Some(effort) = payload.reasoning_effort.as_deref() {
+            let effort = effort.trim();
+            if !["low", "medium", "high"].contains(&effort) {
+                tracing::error!("Invalid reasoning_effort: {}", effort);
+                return Err(StatusCode::BAD_REQUEST);
+            }
+        } else {
             if let Some(reasoning) = &payload.reasoning {
                 if let Err(e) = reasoning.validate() {
                     tracing::error!("Invalid reasoning config: {}", e);
                     return Err(StatusCode::BAD_REQUEST);
                 }
             }
         }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/openai/provider.rs` around lines 88 - 97, The top-level
payload.reasoning_effort is not validated when present, so
invalid/whitespace-only values get sent downstream; update the same validation
flow used for legacy payload.reasoning by validating payload.reasoning_effort
when Some(...) and returning Err(StatusCode::BAD_REQUEST) on failure: call the
same validation routine (or replicate its checks: trim/empty and semantic
validation) and log errors via tracing::error! (consistent with
reasoning.validate() handling), ensuring behavior matches
OpenAIChatCompletionRequest::from precedence.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@src/providers/openai/provider.rs`:
- Around line 88-97: The top-level payload.reasoning_effort is not validated
when present, so invalid/whitespace-only values get sent downstream; update the
same validation flow used for legacy payload.reasoning by validating
payload.reasoning_effort when Some(...) and returning
Err(StatusCode::BAD_REQUEST) on failure: call the same validation routine (or
replicate its checks: trim/empty and semantic validation) and log errors via
tracing::error! (consistent with reasoning.validate() handling), ensuring
behavior matches OpenAIChatCompletionRequest::from precedence.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7eda2a90-130a-4ffa-b852-c4a36ef9843e

📥 Commits

Reviewing files that changed from the base of the PR and between a2459bd and 43d765c.

📒 Files selected for processing (2)
  • src/providers/azure/provider.rs
  • src/providers/openai/provider.rs
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/providers/azure/provider.rs

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
src/providers/azure/provider.rs (1)

286-330: 🏗️ Heavy lift

Add one provider-level test for the chat_completions guard path.

These tests cover conversion well, but they don’t directly lock behavior in AzureProvider::chat_completions (Line 87). A regression there could reintroduce the old rejection path even with a valid top-level effort. Consider adding one async/provider-level test where top-level reasoning_effort is set and legacy reasoning is invalid, and assert it is not rejected at validation time.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/azure/provider.rs` around lines 286 - 330, Add an async
provider-level test that ensures AzureProvider::chat_completions accepts a
request with a top-level reasoning_effort when a legacy nested Reasoning is
invalid: create a #[tokio::test] async fn (e.g.,
accepts_top_level_effort_over_legacy_rejection) that builds the same
base_request, sets req.reasoning_effort = Some("minimal".to_string()) and sets
req.reasoning = Some(ReasoningConfig { effort: None, ..Default::default() }) or
otherwise invalid legacy reasoning, constructs an AzureProvider instance
(matching existing test setup), calls provider.chat_completions(req).await and
asserts the call succeeds (is Ok) or does not return the old
validation/rejection error; reference AzureProvider::chat_completions and
AzureChatCompletionRequest conversion to locate where to wire the request.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/providers/azure/provider.rs`:
- Around line 286-330: Add an async provider-level test that ensures
AzureProvider::chat_completions accepts a request with a top-level
reasoning_effort when a legacy nested Reasoning is invalid: create a
#[tokio::test] async fn (e.g., accepts_top_level_effort_over_legacy_rejection)
that builds the same base_request, sets req.reasoning_effort =
Some("minimal".to_string()) and sets req.reasoning = Some(ReasoningConfig {
effort: None, ..Default::default() }) or otherwise invalid legacy reasoning,
constructs an AzureProvider instance (matching existing test setup), calls
provider.chat_completions(req).await and asserts the call succeeds (is Ok) or
does not return the old validation/rejection error; reference
AzureProvider::chat_completions and AzureChatCompletionRequest conversion to
locate where to wire the request.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 346a015b-79a4-4745-9c79-af6ac986f8c8

📥 Commits

Reviewing files that changed from the base of the PR and between 43d765c and 3852e39.

📒 Files selected for processing (2)
  • src/providers/azure/provider.rs
  • src/providers/openai/provider.rs
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/providers/openai/provider.rs

@galzilber
galzilber merged commit dfeec78 into main May 3, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants