Hidden extension bypass: filter `is_hidden_extension` on both the
write path (`apply_to_config`) and read path (`from_config`), not
just the HTTP response layer.
Type safety: add `deserialize_string_or_number` for 8 DATABRICKS/GCP
retry fields so the API accepts both `"5"` and `5` without silent
data loss.
Security hardening: make `GOOSE_DISABLE_KEYRING` read-only via the
typed API to prevent downgrading secret storage from keyring to
plaintext. Guard `active_provider` batch-write to avoid double-write
when `GOOSE_PROVIDER` is also set.
Error propagation: `push_if_some!` and `push_secret!` macros now
propagate serialization errors via `?` instead of swallowing them.
Test maintainability: replace 48-entry hardcoded `non_string_keys`
exclusion set with schema-derived type detection using
`schema_for!(GooseConfigSchema)` property types.
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
The crossfire review (Codex + Gemini) confirmed 4 P1/P2 bugs from
automated PR comments plus identified two additional gaps.
Fix 1 (P1): apply_to_config fell back to the current active provider's
model when switching GOOSE_PROVIDER without GOOSE_MODEL, cross-
contaminating provider entries. Now reads the target provider's saved
model via get_provider_entry.
Fix 2 (P2): ANTHROPIC_THINKING_BUDGET was missing from GooseConfigSchema
despite being the primary key read by Anthropic request construction.
Fix 3 (P2): GooseConfigUpdate wrote non-secrets to config.yaml before
attempting keyring secret writes. Reordered to write secrets first so a
keyring failure leaves no partial config.yaml state.
Fix 4 (P2): set_goose_model was a silent no-op when no active provider
existed. Now falls back to writing the legacy flat GOOSE_MODEL key.
Fix 5: check-config-schema now uses the --check flag instead of
regenerating and diffing, avoiding workspace mutation during CI checks.
Fix 6: GET/PATCH /config/typed responses now filter hidden extensions,
matching the existing GET /config/extensions behavior.
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
PR #8977 introduced structured per-provider config (`providers:` block + `active_provider` key). Wire these into GooseConfigSchema so they flow through the typed API endpoints and both JSON schemas.
GOOSE_PROVIDER/GOOSE_MODEL reads now use the resolution-chain accessors (env → active_provider → legacy flat key), and writes route through set_active_provider to keep the providers block canonical.
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Round-2 crossfire review (3 Claude agents + Codex + Gemini) surfaced
a missing config key, a CLI display bug, incomplete test coverage, and
the root cause of the CI codegen mismatch. This commit addresses all
actionable findings and eliminates the manual TS codegen patching.
Key changes:
- Add GOOSE_DISABLE_TOOL_CALL_SUMMARY to GooseConfigSchema
- Add NANOGPT_API_KEY and LITELLM_CUSTOM_HEADERS to GooseConfigUpdate
- Fix configure.rs keyring status display for boolean GOOSE_DISABLE_KEYRING
- Add exhaustive from_config/apply_to_config coverage test
- Add CI check-config-schema job + Justfile targets
- Fix generate-config-schema error message (underscores → hyphens)
- Pin @hey-api/openapi-ts to 0.93.1, matching the lockfile
- Update PATCH endpoint docs (sparse semantics, nested replacement, env caution)
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Flatten GooseConfigUpdate to embed GooseConfigSchema via #[serde(flatten)],
eliminating ~500 lines of duplication and reducing edit sites from 6 to 3
per new config key. Fix GOOSE_DISABLE_KEYRING type (String → bool), add
7 missing provider secret keys, make ALL_KEYS test bidirectional, add
config roundtrip test, and log warnings on serialization failures.
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Single GooseConfigSchema struct derives both utoipa::ToSchema (for
OpenAPI → TypeScript type safety) and schemars::JsonSchema (for
standalone config.schema.json consumed by downstream tools).
Adds GET/PATCH /config/typed endpoints alongside existing per-key
endpoints. GooseConfigUpdate struct includes secret fields routed
through the keyring. Existing UI and endpoints are unchanged.
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Will Pfleger