AIT-322: correct the production token, drop retired terms and internal names - #11
Conversation
…l names The env table claimed WHATSAPP_ACCESS_TOKEN is "a Meta access token in production". It never is: `channels env` writes our hmat_ gateway token in both sandbox and production, and the endpoint never returns a Meta token. Integrators were told to expect a credential they do not receive. Also: "activation code" is the pre-Wave-1 name for the sandbox channel token (AIT-322), our internal service name "forwarder" appeared throughout including the README diagram, and the token-custody clause is gone (MAR-3). A copy guard now fails the build on those terms.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThe changes replace sandbox activation-code terminology with channel-token terminology, clarify HookMyApp webhook signing and body handling, and add a workflow that blocks retired copy. ChangesTerminology and copy guard
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 376e2685dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | `WHATSAPP_ACCESS_TOKEN` | Gateway channel token (`hmat_`), written by `sandbox env` or `channels env`. | | ||
| | `WHATSAPP_PHONE_NUMBER_ID` | Phone number ID from your sandbox session or Meta app. | | ||
| | `INSTAGRAM_API_URL` | Instagram Graph API base URL. Sandbox `sandbox env` writes this. A real Instagram channel's `channels env` writes it as `INSTAGRAM_GRAPH_API_URL`; the kit reads either. | | ||
| | `INSTAGRAM_ACCESS_TOKEN` | Sandbox activation code (CLI-provided) or Meta access token for Instagram. | | ||
| | `INSTAGRAM_ACCESS_TOKEN` | Gateway channel token (`hmat_`) for Instagram, written by `sandbox env` or `channels env`. | |
There was a problem hiding this comment.
When an integrator chooses the documented direct-Meta transport, these variables must contain Meta access tokens, because the provider modules send them as the Bearer credentials regardless of transport. Describing WHATSAPP_ACCESS_TOKEN and the analogous Instagram variable exclusively as hmat_ gateway tokens contradicts the direct-Meta setup later in this README and can cause users to supply the wrong credential; retain the corrected CLI-output wording while also documenting the direct-Meta meaning.
AGENTS.md reference: AGENTS.md:L135-L135
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/copy-guard.yml (1)
15-15: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable Git credential persistence for this read-only workflow.
Add
permissions: contents: readand setpersist-credentials: falseforactions/checkout@v4. The workflow only scans files and does not need Git credentials or write permissions.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/copy-guard.yml at line 15, Update the copy-guard workflow to grant only read access with permissions contents: read, and configure the actions/checkout@v4 step with persist-credentials: false. Keep the workflow’s existing scan behavior unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/copy-guard.yml:
- Line 18: Update the copy-scan command in the workflow so it preserves grep’s
exit status instead of masking errors with `|| true`; treat status 0 (matches)
and 1 (no matches) as valid, while failing the workflow for any status greater
than 1. Keep the existing scan targets and matching patterns unchanged.
In `@README.md`:
- Line 110: Specify the text language on the fenced ASCII diagram beginning at
the documented README section by changing its opening fence to use the text
language; leave the diagram contents unchanged.
---
Nitpick comments:
In @.github/workflows/copy-guard.yml:
- Line 15: Update the copy-guard workflow to grant only read access with
permissions contents: read, and configure the actions/checkout@v4 step with
persist-credentials: false. Keep the workflow’s existing scan behavior
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 089389d7-98b2-4984-89a8-509ee5a930dd
📒 Files selected for processing (4)
.env.example.github/workflows/copy-guard.ymlAGENTS.mdREADME.md
… guard The rewrite said the access tokens are always HookMyApp channel tokens. True for the CLI path, but the kit also documents a direct-Meta transport (AGENTS.md 'Choose exactly one transport'), where the value is the integrator's own Meta token. Both rows now cover both, without the original error of calling production a Meta-token path. Also: guard no longer fails open on a grep error, token narrowed to contents: read with persist-credentials: false, and the diagram fence declares 'text' (MD040). MAR-3 AIT-322
The bug. The env tables in
README.mdandAGENTS.mdsaidWHATSAPP_ACCESS_TOKENis "a Meta access token in production". It never is.cli/src/commands/env.tsstates it outright — the endpoint never returns the real Meta token — andchannels envwrites ourhmat_gateway token in production exactly assandbox envdoes. The kit was telling integrators to expect a credential they never receive.Retired term. "activation code" is the pre-Wave-1 name for the sandbox channel token, and it also named the wrong object: the code the user sends to the sandbox number is the bind code. Fixed in both tables and in
.env.example, whose placeholder every integrator copies.Internal mechanics.
forwarderis our service name, not something a reader can call or debug. Replaced with HookMyApp throughout, including the README's ASCII diagram. The token-custody clause is gone too.copy-guard.ymlfails on those terms; this repo had no CI.The package version is untouched at 3.0.1 — a 3.0.2 release for the
.env.examplechange is a separate call.Part of the same sweep as hookmyapp/agent-skills#16.
Refs MAR-3
Refs AIT-322
Summary by CodeRabbit
Documentation
Chores