Feat: one-command local quickstart (--demo) + Cortex README - #716
Conversation
|
Warning Review limit reached
Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe proxy adds a ChangesLocal demo mode
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant authbridge-proxy
participant writeDemoConfig
participant config
User->>authbridge-proxy: Start with --demo
authbridge-proxy->>writeDemoConfig: Generate demo.yaml
writeDemoConfig-->>authbridge-proxy: Return config path
authbridge-proxy->>config: Load and validate configuration
config-->>authbridge-proxy: Return validated preset
authbridge-proxy-->>User: Start local observe-only proxy
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
5e12f9a to
3068a89
Compare
huang195
changed the title
3068a89 to
a432334
Compare
huang195
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
authbridge/cmd/authbridge-proxy/observe_local_test.go (2)
14-20: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winExercise
writeObserveLocalConfiginstead of duplicating its write path.This test writes
observeLocalConfigYAMLdirectly, so regressions inwriteObserveLocalConfig—including directory creation, destination handling, or overwrite behavior—would go unnoticed. Inject a test destination into the helper, load the returned file, and keep this test aligned with the actual CLI path.Based on the PR objective that the CLI materializes the preset through
writeObserveLocalConfig.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@authbridge/cmd/authbridge-proxy/observe_local_test.go` around lines 14 - 20, Update TestObserveLocalConfig_LoadsAndValidates to use writeObserveLocalConfig with an injected temporary destination instead of calling os.WriteFile with observeLocalConfigYAML directly. Load the file path returned or produced by the helper, preserving the existing validation assertions so the test exercises directory creation, destination handling, and overwrite behavior through the CLI path.
36-38: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert the required parser names, not only their count.
A length check of three would still pass if the list contained incorrect or duplicate plugins. Assert the exact expected values:
inference-parser,mcp-parser, anda2a-parser.Based on the PR objective requiring these parser settings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@authbridge/cmd/authbridge-proxy/observe_local_test.go` around lines 36 - 38, Update the outbound plugin assertions in the test to verify the exact ordered values inference-parser, mcp-parser, and a2a-parser, rather than only checking len(cfg.Pipeline.Outbound.Plugins). Preserve the existing failure-reporting style while ensuring incorrect or duplicate plugin names fail the test.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@authbridge/cmd/authbridge-proxy/observe_local.go`:
- Around line 25-34: Update the local demo preset configuration to set explicit
loopback bind addresses for both the forward proxy listener and unauthenticated
session API, rather than relying on wildcard defaults. Use the listener and
session address symbols consumed by the startup paths in main.go, and extend the
relevant test to assert both addresses are loopback-bound.
In `@README.md`:
- Around line 17-18: Update the source-build fallback in the “Get the binaries”
README step to provide two explicit, copy-pasteable build commands executed from
the repository root: one for authbridge/cmd/abctl and one for
authbridge/cmd/authbridge-proxy. Remove the ambiguous “likewise
cmd/authbridge-proxy” wording while preserving the existing go build commands.
---
Nitpick comments:
In `@authbridge/cmd/authbridge-proxy/observe_local_test.go`:
- Around line 14-20: Update TestObserveLocalConfig_LoadsAndValidates to use
writeObserveLocalConfig with an injected temporary destination instead of
calling os.WriteFile with observeLocalConfigYAML directly. Load the file path
returned or produced by the helper, preserving the existing validation
assertions so the test exercises directory creation, destination handling, and
overwrite behavior through the CLI path.
- Around line 36-38: Update the outbound plugin assertions in the test to verify
the exact ordered values inference-parser, mcp-parser, and a2a-parser, rather
than only checking len(cfg.Pipeline.Outbound.Plugins). Preserve the existing
failure-reporting style while ensuring incorrect or duplicate plugin names fail
the test.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9cf0677d-b6ce-4a5c-a002-8d296e060874
📒 Files selected for processing (4)
README.mdauthbridge/cmd/authbridge-proxy/main.goauthbridge/cmd/authbridge-proxy/observe_local.goauthbridge/cmd/authbridge-proxy/observe_local_test.go
| mode: proxy-sidecar | ||
| listener: | ||
| roles: [forward] | ||
| tls_bridge: | ||
| mode: enabled | ||
| ca_dir: /tmp/ab/ca | ||
| generate_ca: true | ||
| pipeline: | ||
| outbound: | ||
| plugins: [inference-parser, mcp-parser, a2a-parser] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Bind the local demo listeners to loopback.
The preset leaves listener addresses empty. authbridge/authlib/config/presets.go:7-38 therefore defaults the forward proxy to :8081, and authbridge/cmd/authbridge-proxy/main.go:397-413 starts it with that address; :8081 is a wildcard bind, exposing an unauthenticated open forward proxy to the LAN. The unauthenticated session API in authbridge/cmd/authbridge-proxy/main.go:436-449 should not rely on a wildcard default either.
Set explicit loopback addresses, and assert them in the test:
Proposed preset change
listener:
roles: [forward]
+ forward_proxy_addr: 127.0.0.1:8081
+ transparent_proxy_addr: 127.0.0.1:8082
+ session_api_addr: 127.0.0.1:9094Based on the supplied configuration defaults and proxy/session startup wiring.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| mode: proxy-sidecar | |
| listener: | |
| roles: [forward] | |
| tls_bridge: | |
| mode: enabled | |
| ca_dir: /tmp/ab/ca | |
| generate_ca: true | |
| pipeline: | |
| outbound: | |
| plugins: [inference-parser, mcp-parser, a2a-parser] | |
| mode: proxy-sidecar | |
| listener: | |
| roles: [forward] | |
| forward_proxy_addr: 127.0.0.1:8081 | |
| transparent_proxy_addr: 127.0.0.1:8082 | |
| session_api_addr: 127.0.0.1:9094 | |
| tls_bridge: | |
| mode: enabled | |
| ca_dir: /tmp/ab/ca | |
| generate_ca: true | |
| pipeline: | |
| outbound: | |
| plugins: [inference-parser, mcp-parser, a2a-parser] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@authbridge/cmd/authbridge-proxy/observe_local.go` around lines 25 - 34,
Update the local demo preset configuration to set explicit loopback bind
addresses for both the forward proxy listener and unauthenticated session API,
rather than relying on wildcard defaults. Use the listener and session address
symbols consumed by the startup paths in main.go, and extend the relevant test
to assert both addresses are loopback-bound.
6e0446d to
fef1e84
Compare
evaline-ju
left a comment
evaline-ju
left a comment
There was a problem hiding this comment.
Was able to try out the quickstart and have it working
agent minor [non-blocking] notes:
- Config overwrite on every start — writeObserveLocalConfig always overwrites. If a user edited observe-local.yaml (as the README encourages), their edits survive while running (hot-reload), but get clobbered on next --observe-local start. The PR description says "the preset is canonical" so this is intentional, but a --no-overwrite or a "modified; skipping" check could be a follow-up.
- String concatenation in YAML — " + caDir + " in observeLocalConfigYAML works for typical paths but would break if caDir contains a literal " or YAML-special chars. Edge case (who puts quotes in directory names?) but could use a proper YAML marshal if it ever matters.
- CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 in the README example — good call for reducing noise, but worth a one-liner note that it suppresses telemetry/update checks (so users don't wonder why their abctl looks quiet at first).
- No --observe-local in the envoy binary — intentional (envoy mode needs Envoy), but the README doesn't mention this is proxy-only. Fine for now since the README says "authbridge-proxy" explicitly
fef1e84 to
f1f5d99
Compare
huang195
changed the title
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@authbridge/cmd/authbridge-proxy/demo_test.go`:
- Around line 34-46: The demo configuration test should validate the specific
proxy-sidecar contract rather than only plugin count. In the assertions around
cfg.Listener.ActiveRoles and cfg.Pipeline.Outbound.Plugins, require
config.ModeProxySidecar and verify the plugins appear in order with names
inference-parser, mcp-parser, and a2a-parser.
- Around line 38-42: Update the TLSBridge assertions in the relevant demo test
so a nil cfg.TLSBridge failure stops execution before the CADir check, or guard
the CADir assertion with a non-nil check. Preserve validation of TLSBridge mode,
GenerateCA, and CADir when the configuration is present.
In `@authbridge/cmd/authbridge-proxy/demo.go`:
- Line 30: Escape caDir before interpolating it into the YAML configuration in
the demo setup, preserving Windows backslashes and quotes/newlines as literal
path data. Use the YAML-safe encoding or quoting utility already available in
the project, and keep config.Load receiving valid YAML for all path values.
In `@README.md`:
- Line 20: Update the README’s “Start Cortex” description to avoid promising
that the NODE_EXTRA_CA_CERTS hint appears on every run, unless the startup
implementation is changed to log it for every demo startup. Keep the existing CA
generation and --ca-dir behavior accurately documented.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bc7cb3ce-d08e-4906-9f47-ed215475233c
📒 Files selected for processing (4)
README.mdauthbridge/cmd/authbridge-proxy/demo.goauthbridge/cmd/authbridge-proxy/demo_test.goauthbridge/cmd/authbridge-proxy/main.go
| roles: [forward] | ||
| tls_bridge: | ||
| mode: enabled | ||
| ca_dir: "` + caDir + `" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Escape caDir before embedding it in YAML.
Direct interpolation makes paths such as Windows C:\..., or filenames containing quotes/newlines, produce invalid or altered YAML before config.Load can start the proxy.
Proposed fix
import (
"os"
"path/filepath"
+ "strconv"
)
- ca_dir: "` + caDir + `"
+ ca_dir: ` + strconv.Quote(caDir) + `📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ca_dir: "` + caDir + `" | |
| import ( | |
| "os" | |
| "path/filepath" | |
| "strconv" | |
| ) |
| ca_dir: "` + caDir + `" | |
| ca_dir: ` + strconv.Quote(caDir) + ` |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@authbridge/cmd/authbridge-proxy/demo.go` at line 30, Escape caDir before
interpolating it into the YAML configuration in the demo setup, preserving
Windows backslashes and quotes/newlines as literal path data. Use the YAML-safe
encoding or quoting utility already available in the project, and keep
config.Load receiving valid YAML for all path values.
4902192 to
03dfb16
Compare
Add `authbridge-proxy --demo`: a built-in demo config (forward-only proxy + TLS bridge with an auto-generated CA + the LLM/MCP/A2A parsers). No absolute path is baked in — the config is written to demo.yaml inside ca_dir (default ./cortex-ca relative to the cwd; override with --ca-dir), next to the generated CA, and loaded through the normal file path, so editing it hot-reloads live (the reloader watches by filename, so the co-located CA writes don't trigger spurious reloads). An agent's egress is decrypted and parsed with no cluster, Keycloak, or SPIRE. Mutually exclusive with --config. The demo binds the listeners it uses — forward proxy :8081 and session API :9094 — to loopback: it runs on a laptop, so a wildcard bind would expose an open forward proxy and the unauthenticated session API (which carries decrypted bodies and any injected tokens) to the LAN. The forward-role preset also defaults the enforce-redirect transparent listener (:8082), but the demo has no iptables redirecting to it, so --demo skips starting it (config can't unset it — the preset refills an empty transparent_proxy_addr). Rewrite the root README as a short "Cortex" overview (formerly AuthBridge): - position it as more than auth — identity/tokens, protocol-aware observability, egress control/policy — running in Kubernetes or standalone; - quick start is the non-K8s local flow, now a single command (authbridge-proxy --demo), and the written config is editable + hot-reloadable; - point K8s users to the weather-agent walkthrough + the authbridge/ reference; - drop the Container Images and Development sections. Binaries and dirs keep their names (authbridge-proxy, abctl, authlib, authbridge/); a note preserves the AuthBridge-to-binary link. No code rename. Test: writeDemoConfig produces a file in ca_dir that loads/presets/ validates as proxy-sidecar, forward-only, with the forward proxy and session API pinned to loopback, tls_bridge + generate_ca (ca_dir), and the ordered parser set inference-parser, mcp-parser, a2a-parser. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
03dfb16 to
c4f799b
Compare
github-project-automation
Bot
moved this from New/ToDo
to Done
in Rossoctl Issue Prioritization
3 participants
Summary
Makes the local quickstart a single command and rewrites the repo-root README as a short Cortex overview. The flag and the README that documents it ship together so
mainnever advertises a flag that doesn't exist.Change
authbridge-proxy --demo(new flag). Runs a built-in demo config — forward-only proxy + TLS bridge with an auto-generated CA + the LLM/MCP/A2A parsers — so an agent's egress is decrypted and parsed with no cluster, Keycloak, or SPIRE. No absolute path is baked in: the config is written todemo.yamlinsideca_dir(default./cortex-carelative to the cwd; override with--ca-dir), next to the generated CA, and loaded through the normal file path — so editing it hot-reloads live. The reloader matches events by filename, so the co-located CA writes don't cause spurious reloads. Mutually exclusive with--config.Root README → Cortex overview.
abctl), and egress control/policy — running the same way in Kubernetes or standalone.authbridge-proxy --demo); the written config is editable and hot-reloadable.authbridge/architecture reference.Container ImagesandDevelopmentsections.Notes
ca_dirdefaults to./cortex-cain the cwd (overridable via--ca-dir); the config lives in that same dir. Nothing absolute is baked into the binary../cortex-ca/demo.yamlreloads the pipeline live (same file-watch reloader the in-cluster path uses). abctl'seeditor remains cluster-only (it applies to a ConfigMap via kubectl); over--endpointyou edit the file yourself.authbridge-proxy,abctl,authlib,authbridge/), with a one-line note preserving the link. No code/dir rename.generate_ca(Feat: Auto-generate the tls_bridge CA when generate_ca is set #707) androles(Feat: Select active proxies via listener.roles #709).Testing
writeDemoConfigyields a file inca_dirthat loads/presets/validates; forward-only;tls_bridge+generate_ca(ca_dir); 3 parsers.authbridge-proxy --demo --ca-dir …— writesdemo.yamlnext to the CA, arms the reloader (watching for config changes), starts forward-only on:8081; editing the config producedreloader: pipelines swapped(live hot-reload). Fullauthbridge-proxysuite +go vetclean.Assisted-By: Claude (Anthropic AI) noreply@anthropic.com
Summary by CodeRabbit
--demomode for the local proxy, generating a forward-only configuration and CA wiring automatically.--demo,--config, and--ca-dir.