Repository navigation
Add Apps in Toss devtools workflow - #23
Conversation
|
@codex review |
|
✅ Action performedReview finished.
|
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAdds AIT devtools workflow wiring, target-ait runtime bundle loading, wrapper asset mirroring, and related docs, ignore, validation, and release metadata updates. ChangesAIT devtools workflow
AIT target bundle runtime
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/target-ait/vite.config.ts (1)
5-9: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueConsider excluding devtools during
vite previewtoo.Vite resolves
commandas'serve'for bothvite devandvite preview, differentiated only by the separateisPreviewflag. As written, runningvite preview(a production-build smoke check) would still loadaitDevtools.vite()unlessMPGD_AIT_DEVTOOLS=0is explicitly set, since onlycommand === 'serve'is checked here.♻️ Proposed guard against preview
-export default defineConfig(({ command }) => ({ +export default defineConfig(({ command, isPreview }) => ({ plugins: [ - ...(command === 'serve' && process.env.MPGD_AIT_DEVTOOLS !== '0' + ...(command === 'serve' && !isPreview && process.env.MPGD_AIT_DEVTOOLS !== '0' ? [aitDevtools.vite()] : []),🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/target-ait/vite.config.ts` around lines 5 - 9, The Vite config currently enables aitDevtools.vite() whenever command is serve, which also includes vite preview and can unintentionally load devtools in a production smoke check. Update the defineConfig callback to also check the preview flag from Vite’s config context, and only include the aitDevtools.vite() plugin when it is not a preview run and MPGD_AIT_DEVTOOLS is not set to 0.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/cli/templates/phaser-game/README.md`:
- Around line 112-124: The README example command block is missing the
`ait:wrapper:dev:plain` script that the surrounding prose describes. Update the
command list in the phaser-game README so it includes `ait:wrapper:dev:plain`
alongside the existing `ait:wrapper:dev`, `ait:wrapper:dev:phone`, and
`ait:devtools:mcp` entries, keeping the wording consistent with the explanation
of `ait:wrapper:dev` and the plain no-devtools variant.
---
Nitpick comments:
In `@apps/target-ait/vite.config.ts`:
- Around line 5-9: The Vite config currently enables aitDevtools.vite() whenever
command is serve, which also includes vite preview and can unintentionally load
devtools in a production smoke check. Update the defineConfig callback to also
check the preview flag from Vite’s config context, and only include the
aitDevtools.vite() plugin when it is not a preview run and MPGD_AIT_DEVTOOLS is
not set to 0.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 12f63cb9-21c5-4cf7-a95d-58e7b95cd355
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (6)
.sampo/changesets/ait-devtools-workflow.mdapps/target-ait/package.jsonapps/target-ait/vite.config.tspackages/cli/templates/phaser-game/README.mdpackages/cli/templates/phaser-game/package.jsonpnpm-workspace.yaml
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46534cd466
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "@apps-in-toss/web-framework": "^2.10.4" | ||
| }, | ||
| "devDependencies": { | ||
| "@ait-co/devtools": "^0.1.137", |
There was a problem hiding this comment.
@ait-co/devtools@0.1.137 declares engines: { node: '>=24' } in the updated lockfile, but the repo root still advertises Node >=22.0.0. On a documented Node 22 setup, installing or running these new AIT wrapper dev scripts either fails under engine-strict pnpm or runs an unsupported dependency before the wrapper app loads, so this should either use a Node-22-compatible devtools version or raise the workspace engine requirement.
Useful? React with 👍 / 👎.
| "scripts": { | ||
| "dev": "vite --host 0.0.0.0", | ||
| "dev:plain": "MPGD_AIT_DEVTOOLS=0 vite --host 0.0.0.0", | ||
| "dev:phone": "AIT_TUNNEL=1 vite --host 0.0.0.0", |
There was a problem hiding this comment.
For the documented local phone debugging flow, this script only sets AIT_TUNNEL=1, which the devtools plugin treats as a screen-preview tunnel; the CDP relay used by devtools-mcp is only added when CDP is enabled (AIT_TUNNEL_CDP=1 or an explicit tunnel: { cdp: true }). As a result, users running pnpm ait:wrapper:dev:phone alongside the new MCP command get a QR preview but no relay/page for the MCP server to attach to, so the phone debugging shortcut needs to opt into CDP or the docs need a separate CDP script.
Useful? React with 👍 / 👎.
| "dev": "__WORKSPACE_I18N_BUILD_PREFIX__vite --host 0.0.0.0", | ||
| "dev:ait": "APP_TARGET=ait APP_VERSION=0.0.0-dev BUILD_ID=ait-sandbox sh -c '__WORKSPACE_I18N_BUILD_PREFIX__vite --host 0.0.0.0'", | ||
| "build": "__WORKSPACE_I18N_BUILD_PREFIX__vite build", | ||
| "build:ait": "pnpm exec mpgd target build ait production --targets-file ./mpgd.targets.json --kit-path ${MPGD_KIT_PATH:-__DEFAULT_KIT_PATH__}", |
There was a problem hiding this comment.
In a freshly generated game following the new pnpm build:ait shortcut, this invokes mpgd target build ait without --variant wrapper; with the default generated target file, that path points at the shared kit wrapper and tools/target/build-target.ts only skips ait:build when the wrapper variant sets MPGD_AIT_PACKAGE_MODE=skip. The shortcut therefore attempts a real .ait package from the kit demo wrapper instead of the documented smoke wrapper path, which requires AIT CLI state and can use shared app metadata; add the wrapper variant here or document the real packaging prerequisites.
Useful? React with 👍 / 👎.
| typia: | ||
| specifier: rc | ||
| version: 13.0.0-rc.1(@types/node@24.13.2) | ||
| version: 13.0.1-dev.20260703.1(@types/node@24.13.2) |
There was a problem hiding this comment.
This lockfile-only drift changes the workspace typia resolution from 13.0.0-rc.1 to 13.0.1-dev.20260703.1 across multiple importers even though no package manifest or changeset in this PR mentions a typia upgrade. Because typia is a runtime/generator dependency of publishable packages, frozen installs after this commit silently change validator/runtime output for consumers in an AIT devtools workflow PR; please revert these entries or make the typia update explicit with validation and release notes.
Useful? React with 👍 / 👎.
|
Addressed the CodeRabbit feedback in 5ab5fe5:
Validation:
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ab5fe56e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "dev": "__WORKSPACE_I18N_BUILD_PREFIX__vite --host 0.0.0.0", | ||
| "dev:ait": "APP_TARGET=ait APP_VERSION=0.0.0-dev BUILD_ID=ait-sandbox sh -c '__WORKSPACE_I18N_BUILD_PREFIX__vite --host 0.0.0.0'", | ||
| "build": "__WORKSPACE_I18N_BUILD_PREFIX__vite build", | ||
| "build:ait": "pnpm exec mpgd target build ait production --targets-file ./mpgd.targets.json --kit-path ${MPGD_KIT_PATH:-__DEFAULT_KIT_PATH__}", |
There was a problem hiding this comment.
For generated games that still use the kit reference Apps in Toss wrapper, this shortcut takes the single-target CLI path without the wrapper variant, so runTargetCommand never sets MPGD_AIT_PACKAGE_MODE=skip and tools/target/build-target.ts falls through to pnpm --dir <kit>/apps/target-ait ait:build. That makes the advertised local pnpm build:ait loop try to produce a real .ait package from the shared kit wrapper instead of the wrapper-web artifact used by the documented build-all --ait-variant wrapper flow, which is the path intended for game-owned starters before they create their own AIT wrapper/config.
Useful? React with 👍 / 👎.
| "scripts": { | ||
| "dev": "vite --host 0.0.0.0", | ||
| "dev:plain": "MPGD_AIT_DEVTOOLS=0 vite --host 0.0.0.0", | ||
| "dev:phone": "AIT_TUNNEL=1 vite --host 0.0.0.0", |
There was a problem hiding this comment.
When users run the new phone tunnel together with devtools:mcp, this script only sets AIT_TUNNEL=1; the devtools plugin resolves that to a screen-preview tunnel, and only starts the CDP/MCP relay when AIT_TUNNEL_CDP=1 (or tunnel: { cdp: true }) is set. As a result the documented on-device MCP debugging flow has no relay URL for the MCP bridge to attach to, even though pnpm ait:wrapper:dev:phone appears to be the paired setup command.
Useful? React with 👍 / 👎.
|
|
||
| '@ait-co/devtools@0.1.137': | ||
| resolution: {integrity: sha512-HMf5bDscKkto1ZqIT5Iu5HtvGXDQfJ/lrqo0a6hNpLEfQtD6fSGeyD/PjwUbG5v7Erh5lDVORnhAt31qRSPl5Q==} | ||
| engines: {node: '>=24'} |
There was a problem hiding this comment.
This added package declares engines: { node: '>=24' }, while the root package still advertises support for Node >=22.0.0. In a supported Node 22 checkout, the new AIT devtools workflow is now outside the declared runtime support (and installs fail under engine-strict), so either the repo engine needs to move to Node 24 or this dependency should stay compatible with Node 22 before it is part of the default workspace.
Useful? React with 👍 / 👎.
| allowBuilds: | ||
| '@sentry/cli': true | ||
| '@swc/core': true | ||
| cloudflared: true |
There was a problem hiding this comment.
The cloudflared package's postinstall runs node lib/cloudflared.js bin install latest, so approving its build script here makes every workspace pnpm install --frozen-lockfile download an unpinned external binary even for CI jobs and developers that never use the phone tunnel. The devtools path already lazy-installs cloudflared when the tunnel is actually started, so this turns an optional local-debug feature into a network-dependent install step that can break restricted or reproducible installs.
Useful? React with 👍 / 👎.
| typia: | ||
| specifier: rc | ||
| version: 13.0.0-rc.1(@types/node@24.13.2) | ||
| version: 13.0.1-dev.20260703.1(@types/node@24.13.2) |
There was a problem hiding this comment.
This lockfile-only change moves the root and multiple runtime packages from typia@13.0.0-rc.1 to 13.0.1-dev.20260703.1 even though their package manifests still only say typia: rc and this PR is scoped to AIT devtools. Because typia drives runtime validation/schema generation in packages like bridge, catalog, target-config, and release-manifest, publishing this PR would also ship a dev snapshot dependency change unrelated to the reviewed feature; please revert it or make the bump explicit with the corresponding package/config updates.
Useful? React with 👍 / 👎.
|
Addressed the Codex review feedback in e233812:
Validation:
@codex review |
|
✅ Action performedReview finished.
|
|
Addressed the remaining Codex feedback in 78ec15d:
Additional validation:
Earlier validation for this patch stack remains green:
@codex review |
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 78ec15d8b4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "packageManager": "pnpm@11.7.0", | ||
| "engines": { | ||
| "node": ">=22.0.0" | ||
| "node": ">=24.0.0" |
There was a problem hiding this comment.
When developers use the repo's mise environment, .mise.toml still selects Node 22.23.1, but this change now declares the workspace requires Node >=24 and the added @ait-co/devtools lock entry also has engines: {node: '>=24'}. That leaves the documented local toolchain running under an unsupported Node version for installs/builds; update .mise.toml in the same change so the checked-in environment satisfies the new engine.
Useful? React with 👍 / 👎.
| "scripts": { | ||
| "dev": "vite --host 0.0.0.0", | ||
| "dev:plain": "MPGD_AIT_DEVTOOLS=0 vite --host 0.0.0.0", | ||
| "dev:phone": "AIT_TUNNEL=1 AIT_TUNNEL_CDP=1 vite --host 0.0.0.0", |
There was a problem hiding this comment.
When dev:phone is used, the devtools CDP path creates project-local .ait_relay (the relay TOTP secret) and .ait_urls discovery files under apps/target-ait, but the repo only ignores *.ait and not these generated files. This leaves a secret-bearing file as an untracked change that can be accidentally committed after following the new phone workflow; add the generated relay files to .gitignore before exposing this script.
Useful? React with 👍 / 👎.
|
Addressed the latest Codex review feedback in 35cb0b1:
Validation:
@codex review |
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35cb0b10ec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| export default defineConfig(({ command, isPreview }) => ({ | ||
| plugins: [ | ||
| ...(command === 'serve' && !isPreview && process.env.MPGD_AIT_DEVTOOLS !== '0' | ||
| ? [aitDevtools.vite()] |
There was a problem hiding this comment.
When the new dev:phone script is used, it only sets AIT_TUNNEL=1 AIT_TUNNEL_CDP=1, but this config still calls aitDevtools.vite() with no tunnel option. The devtools plugin documents tunnel as defaulting to false and its own fixture maps these env vars to tunnel: process.env.AIT_TUNNEL_CDP ? { cdp: true } : !!process.env.AIT_TUNNEL; without that wiring, pnpm dev:phone just starts the normal Vite server and never prints the trycloudflare URL/QR or starts the CDP relay, so the documented phone debugging flow is nonfunctional.
Useful? React with 👍 / 👎.
|
Addressed the latest Codex review feedback in 0fe4c97:
Validation:
@codex review |
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0fe4c97e7e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| allowBuilds: | ||
| '@sentry/cli': true | ||
| '@swc/core': true | ||
| cloudflared: false |
There was a problem hiding this comment.
On a fresh pnpm 11 install, this false entry denies the cloudflared install script (pnpm documents that unapproved packages are saved with false: https://pnpm.io/cli/approve-builds), but the new dev:phone tunnel path depends on @ait-co/devtools, which pulls in cloudflared in pnpm-lock.yaml. Because this is the binary dependency used for the requested Cloudflare tunnel, pnpm --dir apps/target-ait run dev:phone can install without preparing the tunnel binary and then fail to start the real-device preview tunnel; approve this dependency or avoid relying on its package-installed binary.
Useful? React with 👍 / 👎.
| const aitDevtoolsTunnel = process.env.AIT_TUNNEL | ||
| ? { cdp: Boolean(process.env.AIT_TUNNEL_CDP) } |
There was a problem hiding this comment.
The tunnel flags are exposed as opt-in environment switches, but this mapping treats any non-empty string as true. If a developer or CI job uses the common AIT_TUNNEL=0 or AIT_TUNNEL_CDP=0 override, pnpm --dir apps/target-ait dev still starts the public tunnel and/or CDP relay, which also conflicts with the adjacent MPGD_AIT_DEVTOOLS !== '0' guard. Parse these flags with the same explicit 0 handling so they can actually be disabled without unsetting them.
Useful? React with 👍 / 👎.
| "build": "vite build", | ||
| "ait:build": "ait build", | ||
| "ait:deploy": "ait deploy --api-key \"$AIT_API_KEY\"", | ||
| "devtools:mcp": "pnpm exec devtools-mcp", |
There was a problem hiding this comment.
When this script is used with the new dev:phone CDP relay, it starts devtools-mcp in its default relay-staging mode and does not provide the Vite tunnel/relay URLs. The devtools env-2 flow requires --target=mobile plus AIT_RELAY_BASE_URL and AIT_TUNNEL_BASE_URL from the Vite banner, so the documented ait:wrapper:dev:phone + ait:devtools:mcp path cannot attach to the phone preview and will target the wrong debugging mode. Please either read/pass the generated URLs here or document a separate mobile MCP command.
Useful? React with 👍 / 👎.
|
Addressed the latest Codex review feedback in bf72beb:
Validation:
OCR note: it asked to confirm whether @codex review |
|
✏️ Learnings added
✅ Action performedReview finished.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf72bebf90
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "build": "__WORKSPACE_I18N_BUILD_PREFIX__vite build", | ||
| "build:ait": "pnpm exec mpgd target build ait production --variant wrapper --targets-file ./mpgd.targets.json --kit-path ${MPGD_KIT_PATH:-__DEFAULT_KIT_PATH__}", | ||
| "smoke:ait": "pnpm exec mpgd target smoke ait --targets-file ./mpgd.targets.json --kit-path ${MPGD_KIT_PATH:-__DEFAULT_KIT_PATH__}", | ||
| "ait:wrapper:dev": "pnpm --dir ${MPGD_KIT_PATH:-__DEFAULT_KIT_PATH__}/apps/target-ait run dev", |
There was a problem hiding this comment.
When a generated game runs this new ait:wrapper:* flow, the command only starts the kit checkout's apps/target-ait Vite app. That wrapper currently renders its placeholder shell (apps/target-ait/index.html loads only /src/main.ts), and apps/target-ait/README.md still says the copied public/game bundle is not wired into the wrapper, so the documented phone/devtools tunnel never exercises the generated game even after pnpm build:ait. Wire the wrapper to serve/load public/game, or avoid exposing these starter debugging scripts until that handoff exists.
Useful? React with 👍 / 👎.
|
Patched the latest Codex review on commit bf72beb. The AIT wrapper now loads the copied generated game bundle from /game in the same WebView document after installing the bridge, instead of showing the placeholder shell. What changed:
Validation:
@codex review |
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7fe8d4383
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| document.title = bundleDocument.title || document.title; | ||
| app.replaceChildren(createGameMount(gameMount)); | ||
|
|
||
| await appendBundleScripts(scripts); |
There was a problem hiding this comment.
When the copied game uses root-absolute runtime assets, the wrapper loads the entry script but still leaves those URLs pointing at the wrapper root. For example the checked kit AIT target builds apps/game-phaser, whose manifest requests /assets/ui/orb.svg, while build-target copies the game output under apps/target-ait/public/game/assets; after this script runs, Phaser fetches /assets/ui/orb.svg instead of /game/assets/ui/orb.svg, so the copied game loses its assets in wrapper/devtools sessions and packaged wrapper-web output. The wrapper needs to build/rewrite runtime asset paths as relative to /game or serve /assets from the copied bundle as well.
Useful? React with 👍 / 👎.
| const normalizedPath = path.startsWith('/') && !path.startsWith(gameBundleBasePath) | ||
| ? path.slice(1) | ||
| : path; | ||
| const resolvedUrl = new URL(normalizedPath, `${window.location.origin}${gameBundleBasePath}`); |
There was a problem hiding this comment.
Because new URL() canonicalizes encoded dot segments before encodedPathname is inspected, a bundle asset like assets/%2e%2e/secret.js is accepted as /game/secret.js instead of being rejected by the encoded-traversal check. If a copied bundle is malformed or tampered with, this bypasses the intended traversal validation and can load a different file under /game; inspect the raw path segments before resolving the URL.
Useful? React with 👍 / 👎.
| export default defineConfig(({ command, isPreview }) => ({ | ||
| plugins: [ | ||
| ...(command === 'serve' && !isPreview && process.env.MPGD_AIT_DEVTOOLS !== '0' | ||
| ? [aitDevtools.vite({ tunnel: aitDevtoolsTunnel })] |
There was a problem hiding this comment.
When using the newly added devtools:mcp / ait:devtools:mcp command for the documented local devtools flow, this plugin instance never registers the devtools state endpoint: @ait-co/devtools defaults mcp to false, and the endpoint that the MCP server reads is only added with mcp: true. The command can start the MCP process, but a wrapper served by this config has no /api/ait-devtools/state endpoint for local browser mock-state debugging, so pass mcp: true when devtools are enabled.
Useful? React with 👍 / 👎.
|
Patched the latest Codex review feedback on c7fe8d4 in 2cd0de5. What changed:
Validation:
@codex review |
|
✅ Action performedReview finished.
|
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Validation
Summary by CodeRabbit