Port Hyper, GitKraken AI, and Bifrost providers

[Finesssee]

Summary

Ports the upstream v0.65 provider pack for Charm Hyper, GitKraken AI, and Bifrost. Adds provider registration and settings integration, including Bifrost gateway configuration. The Bifrost virtual-key header is prevented from following gateway redirects; GitKraken shared-pool usage stays display-only.

This is the first implementation unit in the v0.65/v0.66 port plan. It depends on #610 and targets codex/integrate-reviewed-ports-20260923; retarget or rebase it onto main after #610 merges.

Validation

• Rust provider tests: 1,247 passed, 1 ignored.
• Rust formatting and Clippy passed.
• Tauri Clippy passed.
• Frontend provider tests: 22 passed.
• Frontend production build and locale parity check passed (882 keys).
• Frontend lint exited successfully with existing warnings.

Review status

Draft. CircleCI will run on this PR. Native Windows CUA proof for the Bifrost settings surface remains pending; the active desktop was left undisturbed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: aba7309c-c8c5-41c2-b1ad-590bbd9d6f11

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Thermo-nuclear code-quality review

Verdict: FINDINGS (blocking). Reviewed head 669910bdd against its base codex/integrate-reviewed-ports-20260923.

P1: The gateway is reused through a boolean mode with hardcoded English strings

To add Bifrost, the Wayfinder-specific component gets a bifrost?: boolean prop (WayfinderGatewaySection.tsx:11). That prop switches the title, label and help text to unlocalized English literals, while Wayfinder still uses t(...). The rest of the flow picks up provider-id checks as well:

• ProviderDetailPane.tsx:148 and :348 repeat providerId === "wayfinder" || providerId === "bifrost".
• provider_settings.rs gateway_provider hardcodes the set, and set_provider_gateway_url re-matches on it with unreachable! (:494).
• A new get_provider_gateway_url command (:474) plus a gatewayLoadedProviderId state exist only to load a value the detail request could return.

Adding a third gateway provider would mean editing all of these again.

Suggested restructure: make the gateway a typed capability owned by the provider. For example, ProviderId::gateway() -> Option<GatewaySpec { validate: fn(&str) -> Result<..>, title_key, label_key, help_key }>, and have the provider detail DTO carry gateway: { url, titleKey, labelKey, helpKey } | null. The frontend then renders one generic GatewaySection whenever detail.gateway is present. The id checks, the boolean prop, the unreachable!, the extra command and the loaded-id state all go away, and Bifrost gets localized strings for free.

P1: bifrost/mod.rs is a new 1,037-line file

About 835 lines of it are production code, with inline tests from :836. Hyper in this same PR already uses hyper/tests.rs; do the same here. The production half is also longer than it needs to be because it walks serde_json::Value by hand: object, array, optional_text, optional_number and optional_bool (:761–:808) reimplement typed deserialization, and quota_url_for_test (:757) is an identity wrapper. #[derive(Deserialize)] structs with Option<T> fields and #[serde(default)] would express the same fail-closed schema in a fraction of the code.

P2: Three new number formatters in one PR

bifrost::format_count (:823), gitkraken::format_number (:328) and hyper::format_balance (:265) each implement rounding, trimming and (in two of them) thousands grouping, with slightly different rules. The tree already has more than ten format_count / format_number copies. Add one shared providers::format::{count, grouped_decimal} and use it here, rather than adding three more variants.

P3: GitKraken skips the canonical validator

The GitKraken arm in validate_provider_workspace_value (provider_workspace.rs:43) hand-rolls its check, while the neighboring arms use validate_id(trimmed, label, predicate). Use the helper.

[Finesssee]

Adversarial validation passed at fe5d877

Scope: provider pack — Hyper, GitKraken AI, Bifrost (#619, upstream 0.65.0), validated as merged into release/v0.70.0 (merge fe5d877). Focused per instructions on the Hyper session-only contract plus the known glue.

Attacks (Hyper session-only contract, from the merged tree):

• Session wins in Auto: the Hyper fetch resolves an active CLI session FIRST in Auto mode; the session test pins that a live session's payload is used as-is rather than being merged with the web response — the "session wins" rule from the audit.
• Web fails closed: in Auto without a session, the web path is tried, and an invalid body / rate-limit failure fails the whole fetch rather than falling through to a fabricated zero — the audit's "invalid bodies/rate limit fail closed" is covered by the body-validation tests (malformed JSON, wrong shape, non-2xx).
• No invented merge: there is no code path that mixes session and web data; the test set covers session-only, web-only, and both-present (session wins) — the contract surface is closed.
• Glue at integration: the known tray-presentation glue (Port upstream 0.59.0: re-land stranded tray pace colors (#493) #716 pace tint into the Integrate reviewed provider, history, and tray ports #610 tray plan) is a separate 4bab448 glue commit, not buried in the provider pack; the Hyper/GitKraken/Bifrost additions register in the factory and API-key catalog (exhaustive-match arms, so a missed arm fails compile).
• Registry completeness: all three providers appear in the API-key catalog and the icons/settings sets, matching the audit's "registration set" requirement.

No defects found. READY for the un-draft rule.

[Finesssee]

Shipped in v0.70.0: this PR's head is included in main via #735 (merge commit 9d0a37a). Closing as integrated.