fix: harden OpenAI-compatible agent transport by Jhacarreiro · Pull Request #512 · nyldn/claude-octopus · GitHub

Summary

Harden the generic OpenAI-compatible tool-loop agent transport without changing its provider interface.

This adds:

OPENAI_COMPAT_MAX_RETRIES with retries for transient HTTP 429/502/503/504 responses;
OPENAI_COMPAT_REQUEST_TIMEOUT for chat/completions requests;
OPENAI_COMPAT_COMMAND_TIMEOUT for run_command and git_diff tools;
OPENAI_COMPAT_MAX_TOKENS=0 support, which omits max_tokens and lets the provider choose its default;
stderr transport logs with attempt, response size, timeout, and provider-default max token visibility.

Default behavior remains conservative: max tokens still defaults to the existing 1400 unless explicitly set to 0.

Why

OpenAI-compatible endpoints can be gateway-backed and occasionally return transient 429/502/503/504 failures. This mirrors the resilience we validated in local OpenAI-compatible tool-loop runs: retry transient provider failures, make timeouts tunable, and allow provider-default token limits when requested.

Validation

python3 -m py_compile scripts/helpers/openai-compatible-agent.py
bash -n tests/unit/test-openai-compatible-agent.sh
bash tests/unit/test-openai-compatible-agent.sh
bash tests/unit/test-agent-command-validation.sh

Summary by CodeRabbit

New Features
- Added environment-configurable API request timeout and max-retry behavior for model calls
- CLI defaults can now be set via environment variables for maximum turns/tokens
Bug Fixes
- Improved resilience by retrying transient HTTP failures (e.g., 429/502/503/504)
- Better request validation and safer handling when max_tokens is set to 0
Tests
- Added unit coverage for request payload construction and retry/error handling behavior

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info ⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8f5620aa-ec9a-436e-b40b-86cc4c1dfd73

📥 Commits

Reviewing files that changed from the base of the PR and between 1b1564c and 55f2273.

📒 Files selected for processing (2)

scripts/helpers/openai-compatible-agent.py
tests/unit/test-openai-compatible-agent.sh

📝 Walkthrough

Walkthrough

The script gains env_int and env_float helpers for safe environment-variable parsing with defaults, minimums, and stderr warnings. api_call is extended with request_timeout and max_retries parameters, base URL scheme validation, conditional max_tokens omission, and a retry loop for HTTP 429/502/503/504. Tool command timeouts, max_tokens, and retry settings are now all env-driven. Three unit tests are added covering max_tokens=0 omission, transient-error retry behavior, and unsupported URL scheme rejection.

Changes

OpenAI-compatible agent: env config, retry logic, and tests

Layer / File(s)	Summary
env_int/env_float utilities scripts/helpers/openai-compatible-agent.py	Adds env_int and env_float helpers that parse env vars with defaults, minimum bounds, and stderr warnings on invalid values.
Configurable timeout, retry, and URL validation in api_call/tool_exec scripts/helpers/openai-compatible-agent.py	Updates tool_exec to read OPENAI_COMPAT_COMMAND_TIMEOUT via env_float; rewrites api_call to accept request_timeout and max_retries, validate base URL scheme, omit max_tokens when zero, retry on HTTP 429/502/503/504, and log attempt/status/elapsed info to stderr.
CLI and main loop env-driven wiring scripts/helpers/openai-compatible-agent.py	Changes --max-turns default to use env_int with minimum of 1; computes max_tokens, request_timeout, and max_retries from env vars in main and passes them into api_call each turn.
Unit tests: max_tokens, retry, and URL scheme validation tests/unit/test-openai-compatible-agent.sh	Adds a test asserting max_tokens is absent from request payload when zero and present when nonzero; adds a test mocking a single HTTP 503 failure followed by success to verify retry behavior and call count; adds a test validating api_call rejects unsupported non-HTTP URL schemes with ValueError.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

nyldn/claude-octopus#465: Introduced the original openai-compatible-agent.py tool-loop implementation that this PR directly extends with retry logic, env-driven config, and unit tests.

Poem

🐇 Hopping through retries, one, two, three,
When 503 says "wait," I persist with glee.
env_float, env_int, no hardcodes remain,
A timeout configured, I hop back again.
Each attempt is logged, each error explained —
This rabbit's requests shall never be drained! 🌟

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: harden OpenAI-compatible agent transport' accurately summarizes the main change—improving resilience and configurability of the OpenAI-compatible agent's HTTP transport layer through retry logic, timeouts, and environment variable support.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches 🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/helpers/openai-compatible-agent.py`:
- Around line 56-61: The git_diff command is using shell=True unnecessarily for
a constant command. In the git_diff block where subprocess.run is called with
the git diff command, convert from using shell=True with a string command to
passing a list of arguments (["git", "diff", "--", "."]) without shell=True.
Additionally, make check=False explicit in both subprocess.run calls in this
section (the initial run_command subprocess.run call around line 57 and the
git_diff subprocess.run call) to clearly document that the code intentionally
handles non-zero exit codes by returning the exit code in the output.
- Around line 77-80: The base_url parameter is not validated for its URL scheme
before being passed to urllib.request.urlopen, which creates a security
vulnerability because urllib.request.urlopen accepts the file:// scheme by
default and could be exploited for local file disclosure via SSRF. Add explicit
scheme validation immediately after accepting base_url to ensure it uses only
http or https schemes, and reject or raise an error for any other schemes
(file://, ftp://, or malformed schemes). Perform this validation before
constructing the urllib.request.Request object to prevent any non-HTTP(S) URLs
from being processed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info ⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 22053304-682b-4dd4-a147-836d67fd2cc2

📥 Commits

Reviewing files that changed from the base of the PR and between 5c75632 and 1b1564c.

📒 Files selected for processing (2)

scripts/helpers/openai-compatible-agent.py
tests/unit/test-openai-compatible-agent.sh

fix: harden OpenAI-compatible agent transport

1b1564c

coderabbitai Bot requested changes Jun 15, 2026

View reviewed changes

Comment thread scripts/helpers/openai-compatible-agent.py Resolved

Comment thread scripts/helpers/openai-compatible-agent.py Resolved

fix: address OpenAI-compatible hardening review feedback

55f2273

coderabbitai Bot approved these changes Jun 15, 2026

View reviewed changes

Merge branch 'main' into fix/openai-compatible-agent-hardening

6828c58

nyldn merged commit 25d9ebf into nyldn:main Jun 18, 2026
16 checks passed

This was referenced Jul 23, 2026

fix: let OpenAI-compatible providers choose output limits #658

Merged

fix: validate OpenAI-compatible runtime arguments #671

Closed

fix: harden OpenAI-compatible agent transport by Jhacarreiro · Pull Request #512 · nyldn/claude-octopus · GitHub

Repository navigation

fix: harden OpenAI-compatible agent transport - #512

fix: harden OpenAI-compatible agent transport#512
nyldn merged 3 commits into
nyldn:mainfrom
Jhacarreiro:fix/openai-compatible-agent-hardening

Jhacarreiro commented Jun 15, 2026 •
edited by coderabbitai Bot
Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 15, 2026 •
edited
Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix: harden OpenAI-compatible agent transport by Jhacarreiro · Pull Request #512 · nyldn/claude-octopus · GitHub

Repository navigation

fix: harden OpenAI-compatible agent transport - #512

fix: harden OpenAI-compatible agent transport#512nyldn merged 3 commits intonyldn:mainnyldn/claude-octopus:mainfrom Jhacarreiro:fix/openai-compatible-agent-hardeningJhacarreiro/claude-octopus:fix/openai-compatible-agent-hardeningCopy head branch name to clipboard

Conversation

Jhacarreiro commented Jun 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix: harden OpenAI-compatible agent transport#512
nyldn merged 3 commits into
nyldn:mainfrom
Jhacarreiro:fix/openai-compatible-agent-hardening

Jhacarreiro commented Jun 15, 2026 •
edited by coderabbitai Bot
Loading

coderabbitai Bot commented Jun 15, 2026 •
edited
Loading