Add managed_local_account_settings config surface for Apple and Windows (#48720)#49836
Draft
getvictor wants to merge 2 commits into
Draft
Add managed_local_account_settings config surface for Apple and Windows (#48720)#49836getvictor wants to merge 2 commits into
getvictor wants to merge 2 commits into
Conversation
…ws (#48720) Adds the new managed_local_account_settings object under apple_settings (macos_settings) and windows_settings for both global config and fleets, per the API contract in docs PRs #47915 and #48110 (story #43488). - The Apple fields alias the deprecated setup_experience fields (enable_create_local_admin_account, end_user_local_account_type), which remain the stored source of truth. Marshaled output (API responses and stored JSON) force-syncs the alias fields so both surfaces always agree across every write path (config PATCH, team PATCH, setup-experience PATCH, GitOps apply). - Writes on either surface converge through shared resolvers: when both surfaces are written with different values, the one that changed relative to the stored value wins (a GET-modify-PATCH round trip echoes the unchanged surface); genuinely conflicting account-type writes return 422. - Windows has no deprecated alias: WindowsSettings stores the toggle directly. editTeamFromSpec now copies it (it previously copied only CustomSettings, which would silently drop the setting on team GitOps applies), and enabling it requires Windows MDM and a premium license. - The enable/disable managed local account activities fire for the Windows toggle from the config PATCH and team apply paths, deduplicated when both platforms change in the same direction in one request. - GitOps: the client converges the apple_settings alias onto macos_setup before injecting setup-experience defaults, and defaults the Windows toggle to disabled when the key is absent so removing it from YAML turns the feature off. fleetctl generate-gitops emits the new nested fields (and end_user_local_account_type when not "admin") instead of the shared setup_experience TODO placeholder. Claude-Session: https://claude.ai/code/session_01L8PivHPDz7puhMUKMp3WA8
Member
Author
|
@coderabbitai full review |
Contributor
✅ Action performedFull review finished. |
Member
Author
|
/agentic_review |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a first-class managed_local_account_settings configuration surface for both Apple and Windows across global config, team config, and GitOps, while keeping macOS canonical storage in the existing macos_setup (setup experience) fields via alias resolution + force-sync on save/marshal.
Changes:
- Introduces
ManagedLocalAccountSettingsundermacos_settings(akaapple_settings) andwindows_settings, including alias resolution helpers and sync-on-marshal/save to keep both surfaces consistent. - Updates app config and team modify/apply flows to resolve conflicting writes, validate premium + MDM prerequisites, and deduplicate activities when both platforms change together.
- Updates fleetctl GitOps apply/generate logic and fixtures so YAML uses the new per-platform keys and removing keys declaratively disables the Windows toggle.
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| server/service/integration_enterprise_test.go | Updates integration expectations to include the new settings surfaces in team config. |
| server/service/client.go | GitOps client convergence/defaulting for new managed local account keys (macOS alias + Windows default disable). |
| server/service/appconfig.go | Global config PATCH: resolves aliases, persists Windows toggle, syncs aliases, validates license/MDM, logs activity with dedupe. |
| server/service/appconfig_test.go | Adds unit coverage for alias resolution + Windows storage semantics + activity behavior. |
| server/fleet/teams.go | Adds team PATCH payload surfaces, forces alias sync on marshal/store/spec export. |
| server/fleet/teams_test.go | Tests copy + marshal/store alias syncing behavior for teams. |
| server/fleet/app.go | Adds ManagedLocalAccountSettings, macOS settings map parsing, alias resolution helpers, and sync helper; adds WindowsSettings field. |
| server/fleet/app_test.go | Unit tests for alias sync, macOS settings map parsing, and alias resolution rules. |
| ee/server/service/teams.go | Team PATCH + team GitOps apply: alias reconciliation, Windows toggle persistence, MDM gating, activity dedupe. |
| ee/server/service/teams_test.go | Tests team PATCH alias behavior and team GitOps apply persistence/regression coverage. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.yml | Updates expected YAML fixtures for new keys. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml | Updates expected YAML fixtures for new keys. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml | Updates expected YAML fixtures for new keys. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml | Updates expected YAML fixtures for new keys. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml | Updates expected YAML fixtures for new keys. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml | Updates expected YAML fixtures for new keys. |
| cmd/fleetctl/fleetctl/gitops_test.go | End-to-end GitOps test covering new keys, stability across re-apply, and declarative disable on removal. |
| cmd/fleetctl/fleetctl/generate_gitops.go | Emits new nested keys under per-platform settings; avoids setup_experience placeholder for these fields. |
| cmd/fleetctl/fleetctl/generate_gitops_test.go | Verifies generate-gitops output uses new keys and omits defaults appropriately. |
| cmd/fleetctl/fleetctl/apply_test.go | Updates apply tests to account for alias syncing/defaults. |
| cmd/fleetctl/fleetctl/apply_deprecated_test.go | Updates deprecated apply tests to account for alias syncing/defaults. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+725
to
+733
| // The Windows toggle logs the same platform-agnostic activity types; skip it when the macOS | ||
| // toggle changed in the same direction in this request to avoid two identical entries. | ||
| if windowsManagedLocalAccountUpdated && | ||
| !(macOSManagedLocalAccountUpdated && | ||
| team.Config.MDM.MacOSSetup.EnableManagedLocalAccount.Value == team.Config.MDM.WindowsSettings.ManagedLocalAccountSettings.Enabled.Value) { | ||
| if err := svc.updateMacOSSetupEnableManagedLocalAccount(ctx, team.Config.MDM.WindowsSettings.ManagedLocalAccountSettings.Enabled.Value, &team.ID, &team.Name); err != nil { | ||
| return nil, ctxerr.Wrap(ctx, err, "update windows enable managed local account") | ||
| } | ||
| } |
Contributor
WalkthroughAdds managed local account settings for macOS and Windows across fleet configuration models, API payloads, persistence, validation, team PATCH/GitOps flows, and fleetctl GitOps generation. Apple alias fields reconcile with legacy macOS setup fields, while Windows settings persist independently. GitOps output emits platform-specific settings, defaults unset values, validates licensing and Windows MDM requirements, and avoids duplicate activity events. Tests and YAML fixtures cover serialization, alias conflicts, convergence, disabling, and generated configuration. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ast-grep (0.44.1)server/service/integration_enterprise_test.goast-grep timed out on this file Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/fleetctl/fleetctl/generate_gitops_test.go`:
- Around line 2993-2995: Update the assertion in the generateControls test to
check controlsRaw for the emitted setup_experience placeholder key instead of
macos_setup, while preserving the expectation that the key is absent when only
managed local account settings are configured.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6c1f3ad0-2756-4dd6-9bc9-4e00270eb014
📒 Files selected for processing (21)
cmd/fleetctl/fleetctl/apply_deprecated_test.gocmd/fleetctl/fleetctl/apply_test.gocmd/fleetctl/fleetctl/generate_gitops.gocmd/fleetctl/fleetctl/generate_gitops_test.gocmd/fleetctl/fleetctl/gitops_test.gocmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.ymlee/server/service/teams.goee/server/service/teams_test.goserver/fleet/app.goserver/fleet/app_test.goserver/fleet/teams.goserver/fleet/teams_test.goserver/service/appconfig.goserver/service/appconfig_test.goserver/service/client.goserver/service/integration_enterprise_test.go
Comment on lines
+2993
to
+2995
| // no TODO placeholder: the managed local account settings alone must not trigger it | ||
| _, ok := controlsRaw["macos_setup"] | ||
| require.False(t, ok, "expected no macos_setup TODO placeholder") |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the generated placeholder key.
generateControls emits the placeholder as setup_experience, not macos_setup, so this assertion always passes and cannot catch the regression it describes.
Proposed fix
- _, ok := controlsRaw["macos_setup"]
+ _, ok := controlsRaw["setup_experience"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| // no TODO placeholder: the managed local account settings alone must not trigger it | |
| _, ok := controlsRaw["macos_setup"] | |
| require.False(t, ok, "expected no macos_setup TODO placeholder") | |
| // no TODO placeholder: the managed local account settings alone must not trigger it | |
| _, ok := controlsRaw["setup_experience"] | |
| require.False(t, ok, "expected no macos_setup TODO placeholder") |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cmd/fleetctl/fleetctl/generate_gitops_test.go` around lines 2993 - 2995,
Update the assertion in the generateControls test to check controlsRaw for the
emitted setup_experience placeholder key instead of macos_setup, while
preserving the expectation that the key is absent when only managed local
account settings are configured.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #49836 +/- ##
==========================================
+ Coverage 67.88% 67.93% +0.04%
==========================================
Files 3900 3901 +1
Lines 248659 249642 +983
Branches 13222 13222
==========================================
+ Hits 168797 169585 +788
- Misses 64644 64767 +123
- Partials 15218 15290 +72
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Member
Author
|
/config |
🛠️ Wiki configuration file settings:🛠️ Local configuration file settings: # Configuration for Qodo code review tool
[github_app]
# Do not auto-run anything when a PR is opened
pr_commands = []
# Do not auto-run anything on new commits / pushes
handle_push_trigger = false
# Keep the review tool available for manual comment commands
[review_agent]
enabled = true
publish_output = true
🛠️ Global configuration file settings:🛠️ PR-Agent final configurations:==================== CONFIG ====================
config.organization_id = 'codium.ai'
config.qodo_llm_gateway_metadata_tags = True
config.second_model_for_exhaustive_mode = 'openai/openai/o4-mini'
config.model = 'openai/openai/gpt-5.6-sol'
config.model_turbo = 'openai/openai/gpt-5.6-luna'
config.model_reasoning = 'openai/vertex_ai/gemini-3.1-pro-preview'
config.fallback_models = ['openai/anthropic/claude-sonnet-5', 'openai/openai/gpt-5.6-terra', 'openai/bedrock/us.anthropic.claude-sonnet-5']
config.use_async_clone = True
config.git_provider = 'github'
config.publish_output = True
config.publish_output_no_suggestions = True
config.publish_output_progress = True
config.enable_v1_deprecation_banner = True
config.enable_legacy_command_qodo_banner = True
config.verbosity_level = 0
config.publish_logs = False
config.debug_mode = False
config.use_wiki_settings_file = True
config.use_repo_settings_file = True
config.use_global_settings_file = True
config.use_global_wiki_settings_file = False
config.disable_auto_feedback = False
config.ai_timeout = 300
config.obfuscation_max_input_chars = 200000
config.response_language = 'en-US'
config.clone_repo_instead_of_fetch = True
config.always_clone = False
config.add_repo_metadata = True
config.add_repo_metadata_resolve_references = False
config.clone_repo_time_limit = 300
config.clone_transport_retry = False
config.publish_inline_comments_fallback_batch_size = 5
config.publish_inline_comments_fallback_sleep_time = 2
config.max_model_tokens = 32000
config.custom_model_max_tokens = -1
config.patch_extension_skip_types = ['.md', '.txt']
config.extra_allowed_extensions = []
config.allow_dynamic_context = True
config.allow_forward_dynamic_context = True
config.max_extra_lines_before_dynamic_context = 12
config.patch_extra_lines_before = 5
config.patch_extra_lines_after = 1
config.ai_handler = 'litellm'
config.qodo_llm_gateway_user_header = ''
config.qodo_llm_gateway_user_header_field = 'sender'
config.cli_mode = False
config.fetch_github_apps_from_platform = False
config.disable_platform_features = False
config.trial_git_org_max_invokes_per_month = 30
config.trial_ratio_close_to_limit = 0.8
config.quota_just_exceeded_message = '### Qodo reviews are paused for this user.\n\nTroubleshooting steps vary by plan [Learn more →](https://docs.qodo.ai/subscription-plans#what-you%E2%80%99ll-see-when-reviews-are-paused)\n\n\n**On a Teams plan?**\nReviews resume once this user has a paid seat *and* their Git account is linked in Qodo.\n[Link Git account →](https://docs.qodo.ai/subscription-plans#linking-a-git-account)\n\n**Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?**\nThese require an Enterprise plan - Contact us\n[Contact us →](https://docs.qodo.ai/qodo-support#support)\n'
config.billing_trial_expiring_message = '**ⓘ Your Qodo trial ends soon.** Ask your workspace admin to set up billing to keep reviews running after the trial. [Manage billing](https://app.qodo.ai/account/billing/manage-subscription?traffic_source=pr_comment)'
config.billing_payment_failure_message = "**ⓘ A recent Qodo payment didn't go through.** Ask your workspace admin to update payment details to keep reviews running. [Manage billing](https://app.qodo.ai/account/billing/manage-subscription?traffic_source=pr_comment)"
config.trial_expiring_notice_enabled = True
config.payment_failure_notice_enabled = True
config.invite_only_mode = False
config.enable_per_org_invite_only = False
config.enable_request_access_msg_on_new_pr = False
config.check_also_invites_field = False
config.allowed_users = []
config.disable_checkboxes = False
config.output_relevant_configurations = False
config.large_patch_policy = 'clip'
config.seed = -1
config.temperature = 0.2
config.allow_dynamic_context_ab_testing = False
config.choose_dynamic_context_ab_testing_ratio = 0.5
config.ignore_pr_title = ['^\\[Auto\\]', '^Auto']
config.ignore_pr_target_branches = []
config.ignore_pr_source_branches = []
config.ignore_pr_labels = []
config.ignore_ticket_labels = []
config.allow_only_specific_folders = []
config.ignore_pr_authors = 'REDACTED'
config.ignore_repositories = []
config.ignore_bot_pr = True
config.ignore_language_framework = []
config.is_auto_command = False
config.is_new_pr = False
config.enable_ai_metadata = True
config.enable_description_image_reachability_probe = True
config.max_tickets = 10
config.max_tickets_chars = 8000
config.extract_tickets_from_pr_title = False
config.max_tickets_from_title = 1
config.title_extraction_skip_patterns = ['^revert\\b', '^merge\\b', '^release\\b', '^backport\\b', '^bump\\b']
config.prevent_any_approval = False
config.prevent_any_block = False
config.enable_comment_approval = False
config.enable_auto_approval = False
config.auto_approve_for_low_review_effort = -1
config.auto_approve_for_no_suggestions = False
config.ensure_ticket_compliance = False
config.new_diff_format = True
config.new_diff_format_add_external_references = True
config.tasks_queue_ttl_from_dequeue_in_seconds = 1200
config.pr_commands = ['/agentic_describe', '/agentic_review']
config.push_commands = ['/agentic_review']
config.handle_pr_actions = ['opened', 'reopened', 'ready_for_review']
config.handle_push_trigger = False
config.feedback_on_draft_pr = False
config.enable_custom_labels = False
config.custom_labels_discovery_prefixes = ['pr_agent:', 'qodo:']
==================== PR_REVIEWER ====================
pr_reviewer.require_score_review = False
pr_reviewer.require_tests_review = True
pr_reviewer.require_estimate_effort_to_review = True
pr_reviewer.require_can_be_split_review = False
pr_reviewer.require_security_review = True
pr_reviewer.require_todo_scan = False
pr_reviewer.require_ticket_analysis_review = True
pr_reviewer.require_ticket_labels = False
pr_reviewer.require_no_ticket_labels = False
pr_reviewer.check_pr_additional_content = False
pr_reviewer.persistent_comment = True
pr_reviewer.extra_instructions = ''
pr_reviewer.final_update_message = True
pr_reviewer.enable_review_labels_security = True
pr_reviewer.enable_review_labels_effort = True
pr_reviewer.enable_help_text = False
==================== PR_COMPLIANCE ====================
pr_compliance.enabled = True
pr_compliance.enable_rules_platform = True
pr_compliance.rule_providers = []
pr_compliance.rule_providers_max_rules = 300
pr_compliance.assign_skill_rules_to_skill_findings = True
pr_compliance.enable_security_section = True
pr_compliance.enable_ticket_section = True
pr_compliance.enable_codebase_duplication_section = True
pr_compliance.enable_custom_compliance_section = True
pr_compliance.require_ticket_analysis_review = True
pr_compliance.allow_repo_pr_compliance = True
pr_compliance.enable_global_pr_compliance = True
pr_compliance.local_wiki_compliance_str = ''
pr_compliance.global_wiki_pr_compliance = ''
pr_compliance.local_repo_compliance_str = ''
pr_compliance.global_repo_pr_compliance_str = ''
pr_compliance.global_compliance_str = ''
pr_compliance.enable_generic_custom_compliance_checklist = True
pr_compliance.persist_generic_custom_compliance_checklist = False
pr_compliance.display_no_compliance_only = False
pr_compliance.enable_security_compliance = True
pr_compliance.enable_update_pr_compliance_checkbox = True
pr_compliance.enable_todo_scan = False
pr_compliance.enable_ticket_labels = False
pr_compliance.enable_no_ticket_labels = False
pr_compliance.check_pr_additional_content = False
pr_compliance.enable_compliance_labels_security = True
pr_compliance.enable_user_defined_compliance_labels = True
pr_compliance.enable_estimate_effort_to_review = True
pr_compliance.max_rag_components_to_analyze = 5
pr_compliance.min_component_size = 5
pr_compliance.persistent_comment = True
pr_compliance.enable_help_text = False
pr_compliance.extra_instructions = ''
==================== PR_DESCRIPTION ====================
pr_description.publish_labels = False
pr_description.add_original_user_description = True
pr_description.generate_ai_title = False
pr_description.extra_instructions = ''
pr_description.enable_pr_type = True
pr_description.final_update_message = True
pr_description.enable_help_text = False
pr_description.enable_help_comment = False
pr_description.bring_latest_tag = False
pr_description.enable_pr_diagram = True
pr_description.pr_diagram_direction = 'LR'
pr_description.publish_description_as_comment = False
pr_description.publish_description_as_comment_persistent = True
pr_description.enable_semantic_files_types = True
pr_description.collapsible_file_list = 'adaptive'
pr_description.collapsible_file_list_threshold = 8
pr_description.inline_file_summary = False
pr_description.use_description_markers = False
pr_description.include_generated_by_header = True
pr_description.enable_large_pr_handling = True
pr_description.max_ai_calls = 4
pr_description.auto_create_ticket = False
==================== PR_AGENTIC_DESCRIPTION ====================
pr_agentic_description.enable_file_changes_section = True
pr_agentic_description.file_listing_style = 'cards'
pr_agentic_description.publish_as_comment = True
==================== PR_CODE_SUGGESTIONS ====================
pr_code_suggestions.suggestions_depth = 'exhaustive'
pr_code_suggestions.commitable_code_suggestions = False
pr_code_suggestions.decouple_hunks = False
pr_code_suggestions.dual_publishing_score_threshold = -1
pr_code_suggestions.focus_only_on_problems = True
pr_code_suggestions.allow_thumbs_up_down = False
pr_code_suggestions.enable_suggestion_type_reuse = False
pr_code_suggestions.enable_more_suggestions_checkbox = True
pr_code_suggestions.high_level_suggestions_enabled = True
pr_code_suggestions.extra_instructions = ''
pr_code_suggestions.enable_help_text = False
pr_code_suggestions.show_extra_context = False
pr_code_suggestions.persistent_comment = True
pr_code_suggestions.max_history_len = 5
pr_code_suggestions.apply_suggestions_checkbox = True
pr_code_suggestions.enable_chat_in_code_suggestions = True
pr_code_suggestions.apply_limit_scope = True
pr_code_suggestions.suggestions_score_threshold = 0
pr_code_suggestions.new_score_mechanism = True
pr_code_suggestions.new_score_mechanism_th_high = 9
pr_code_suggestions.new_score_mechanism_th_medium = 7
pr_code_suggestions.discard_unappliable_suggestions = False
pr_code_suggestions.num_code_suggestions_per_chunk = 3
pr_code_suggestions.num_best_practice_suggestions = 2
pr_code_suggestions.max_number_of_calls = 3
pr_code_suggestions.demand_code_suggestions_self_review = False
pr_code_suggestions.code_suggestions_self_review_text = '**Author self-review**: I have reviewed the PR code suggestions, and addressed the relevant ones.'
pr_code_suggestions.approve_pr_on_self_review = False
pr_code_suggestions.fold_suggestions_on_self_review = True
pr_code_suggestions.publish_post_process_suggestion_impact = True
pr_code_suggestions.wiki_page_accepted_suggestions = True
pr_code_suggestions.simplify_response = True
==================== PR_CUSTOM_PROMPT ====================
pr_custom_prompt.prompt = 'The code suggestions should focus only on the following:\n- ...\n- ...\n...\n'
pr_custom_prompt.suggestions_score_threshold = 0
pr_custom_prompt.num_code_suggestions_per_chunk = 4
pr_custom_prompt.self_reflect_on_custom_suggestions = True
pr_custom_prompt.enable_help_text = False
==================== PR_ADD_DOCS ====================
pr_add_docs.extra_instructions = ''
pr_add_docs.docs_style = 'Sphinx'
pr_add_docs.file = ''
pr_add_docs.class_name = ''
==================== PR_UPDATE_CHANGELOG ====================
pr_update_changelog.push_changelog_changes = False
pr_update_changelog.extra_instructions = ''
pr_update_changelog.add_pr_link = True
pr_update_changelog.skip_ci_on_push = True
==================== PR_ANALYZE ====================
pr_analyze.enable_help_text = False
==================== PR_TEST ====================
pr_test.enable = True
pr_test.extra_instructions = ''
pr_test.testing_framework = ''
pr_test.num_tests = 3
pr_test.avoid_mocks = True
pr_test.file = ''
pr_test.class_name = ''
pr_test.enable_help_text = False
==================== PR_IMPROVE_COMPONENT ====================
pr_improve_component.num_code_suggestions = 4
pr_improve_component.extra_instructions = ''
pr_improve_component.file = ''
pr_improve_component.class_name = ''
==================== REVIEW_AGENT ====================
review_agent.enable_database_persistence = False
review_agent.llm_model = 'openai/openai/gpt-5.2_thinking'
review_agent.conversion_llm_model = 'openai/openai/gpt-5.2'
review_agent.enabled = True
review_agent.ensemble_models = ['openai/openai/gpt-5.6-sol', 'openai/openai/gpt-5.6-luna']
review_agent.publish_output = True
review_agent.enable_standard_mode = True
review_agent.enable_skip_mode = False
review_agent.enable_lite_mode = False
review_agent.enable_extended_mode = False
review_agent.override_effort = ''
review_agent.push_trigger_dedup_enabled = True
review_agent.push_trigger_dedup_ttl_seconds = 60
review_agent.enable_issues_agent = True
review_agent.enable_ticket_context = True
review_agent.enable_compliance_agent = True
review_agent.enable_spec_agent = True
review_agent.enable_ui_agent = True
review_agent.enable_figma_findings_revalidation = True
review_agent.enable_persona_agent = False
review_agent.persona_identifier = ''
review_agent.persona_auto_select = True
review_agent.persona_max_count = 2
review_agent.persona_portal_base_url = 'https://app.qodo.ai'
review_agent.enable_deduplication = True
review_agent.enable_conversion_agent = True
review_agent.apply_conversion = True
review_agent.enable_precision_agent = False
review_agent.enable_unobserved_citation_filter = False
review_agent.enable_cross_repo_agent = True
review_agent.enable_smart_router = False
review_agent.a2a_pre_pr_review_enabled = True
review_agent.qodo_review_skill_carry_window_days = 14
review_agent.enable_past_bugs_collector = True
review_agent.enable_skills_agent = False
review_agent.enable_review_md = False
review_agent.serve_pr_repo_via_gitway = False
review_agent.enable_sandbox_usage = False
review_agent.sandbox_provider = 'modal'
review_agent.sandbox_configs_repo_name = 'qodo-sandbox-configs'
review_agent.sandbox_config_source = 'git_repo'
review_agent.persistent_comment = True
review_agent.persistent_comment_notification = True
review_agent.add_history_audit = True
review_agent.publish_in_progress_comment = True
review_agent.enable_incremental_review = True
review_agent.enable_a2a_auto_fix = False
review_agent.enable_review_on_fix_pr = False
review_agent.rules_enabled = True
review_agent.requirements_gap_enabled = True
review_agent.llm_call_timeout = 180
review_agent.sub_agent_timeout_seconds = 2400
review_agent.llm_call_overall_timeout = 300
review_agent.smart_router_llm_model = 'turbo'
review_agent.smart_router_max_llm_calls = 4
review_agent.smart_router_disabled_on_open_pr = False
review_agent.smart_router_extra_instructions = ''
review_agent.router_extended_floor_hunks = 18
review_agent.router_extended_floor_lines = 200
review_agent.lite_mode_llm_model = 'turbo'
review_agent.compliance_ensemble_models = []
review_agent.feedback_tool_llm_model = 'turbo'
review_agent.spec_llm_model = ''
review_agent.persona_llm_model = ''
review_agent.persona_selector_llm_model = ''
review_agent.conversion_batching_mode = 'batch'
review_agent.conversion_batch_size = 10
review_agent.cross_repo_llm_model = ''
review_agent.precision_llm_model = ''
review_agent.precision_max_llm_calls = 45
review_agent.precision_batching_mode = 'batch'
review_agent.precision_batch_size = 50
review_agent.precision_agent_vote_strategy = 'unanimous_discard'
review_agent.langsmith_project_name = 'review-agent'
review_agent.max_tokens_for_file = 'REDACTED'
review_agent.single_unified_diff_tokens_limit = 'REDACTED'
review_agent.max_llm_calls = 100
review_agent.max_llm_calls_limit = 100
review_agent.warn_when_remaining = 3
review_agent.compliance_batch_size = 0
review_agent.past_bugs_max_results = 10
review_agent.past_bugs_llm_model = 'openai/gpt-5.6-luna'
review_agent.skills_agent_dirs = ['.qodo/skills', '.claude/skills', '.cursor/skills', '.agents/skills', 'skills']
review_agent.pass_previous_findings_to_agents = True
review_agent.prepr_pass_previous_findings_to_agents = False
review_agent.deduplication_llm_max_tokens = 'REDACTED'
review_agent.publishing_action_level_rank_threshold = 0
review_agent.comments_location_policy = 'both'
review_agent.publish_inline_acknowledgment = False
review_agent.comments_routing_preset = 'custom'
review_agent.enable_commitable_suggestions = False
review_agent.commitable_suggestions_max_lines = 5
review_agent.commitable_suggestions_max_concurrency = 5
review_agent.prefer_single_line_comments = False
review_agent.issues_user_guidelines = ''
review_agent.compliance_user_guidelines = ''
review_agent.additional_repos = []
review_agent.demand_self_review = False
review_agent.self_review_text = '**Author self-review**: I have reviewed the code review findings, and addressed the relevant ones.'
review_agent.approve_pr_on_self_review = False
==================== REVIEW_AGENT_UX ====================
review_agent_ux.finding_overflow_count = 3
review_agent_ux.resolved_overflow_count = 3
review_agent_ux.expand_description = True
review_agent_ux.expand_code = True
review_agent_ux.expand_evidence = False
review_agent_ux.expand_recommendation = True
review_agent_ux.expand_prompt = False
review_agent_ux.render_description = True
review_agent_ux.render_code = True
review_agent_ux.render_recommendation = True
review_agent_ux.render_evidence = True
review_agent_ux.show_prompt = True
review_agent_ux.sub_categories_display = 'verbose'
review_agent_ux.use_images_and_animations = True
review_agent_ux.resolved_badge_display = 'both'
review_agent_ux.display_mode = 'default'
review_agent_ux.view_more = 'more_per_action_level'
review_agent_ux.trial_banner_style = 'pre'
review_agent_ux.trial_banner_position = 'footer'
==================== PR_HELP ====================
pr_help.force_local_db = False
pr_help.num_retrieved_snippets = 5
==================== PR_NEW_ISSUE ====================
pr_new_issue.label_to_prompt_part = {'general': 'general question', 'feature': 'feature request (may already be addressed in the documentation)', 'bug': 'possible bug report (may be a by design behavior)'}
pr_new_issue.supported_repos = ['qodo-ai/pr-agent']
==================== PR_HELP_DOCS ====================
pr_help_docs.repo_url = ''
pr_help_docs.repo_default_branch = 'main'
pr_help_docs.docs_path = 'docs'
pr_help_docs.exclude_root_readme = False
pr_help_docs.supported_doc_exts = ['.md', '.mdx', '.rst']
pr_help_docs.enable_help_text = False
==================== PR_SIMILAR_ISSUE ====================
pr_similar_issue.skip_comments = False
pr_similar_issue.force_update_dataset = False
pr_similar_issue.max_issues_to_scan = 500
pr_similar_issue.vectordb = 'pinecone'
==================== PR_FIND_SIMILAR_COMPONENT ====================
pr_find_similar_component.class_name = ''
pr_find_similar_component.file = ''
pr_find_similar_component.search_from_org = False
pr_find_similar_component.allow_fallback_less_words = True
pr_find_similar_component.number_of_keywords = 5
pr_find_similar_component.number_of_results = 5
==================== BEST_PRACTICES ====================
best_practices.auto_best_practices_str = ''
best_practices.wiki_best_practices_str = ''
best_practices.global_wiki_best_practices = ''
best_practices.local_repo_best_practices_str = ''
best_practices.global_repo_best_practices_str = ''
best_practices.global_best_practices_str = ''
best_practices.organization_name = ''
best_practices.max_lines_allowed = 2000
best_practices.enable_global_best_practices = True
best_practices.allow_repo_best_practices = True
best_practices.enabled = True
==================== AUTO_BEST_PRACTICES ====================
auto_best_practices.enable_auto_best_practices = True
auto_best_practices.utilize_auto_best_practices = True
auto_best_practices.extra_instructions = ''
auto_best_practices.min_suggestions_to_auto_best_practices = 10
auto_best_practices.number_of_days_to_update = 30
auto_best_practices.max_patterns = 5
auto_best_practices.minimal_date_to_update = '2025-01-26'
==================== JIRA ====================
jira.jira_client_id = 'REDACTED'
jira.jira_app_secret = 'REDACTED'
==================== LINEAR ====================
linear.linear_client_id = 'REDACTED'
==================== PR_TO_TICKET ====================
pr_to_ticket.default_base_url = ''
pr_to_ticket.default_project_key = 'REDACTED'
pr_to_ticket.fallback_to_git_provider_issues = True
pr_to_ticket.direct_update_compliance = False
==================== github_app ====================
github_app.bot_user = 'github-actions[bot]'
github_app.override_deployment_type = True
github_app.handle_pr_actions = ['opened', 'reopened', 'ready_for_review']
github_app.pr_commands = []
github_app.feedback_on_draft_pr = False
github_app.handle_push_trigger = False
github_app.push_commands = ['/agentic_review']
github_app.ignore_pr_title = []
github_app.ignore_bot_pr = True
github_app.attribute_closed_pr_to_opener = False
github_app.automatic_pr_summary = 'disabled'
github_app.automatic_code_review = 'disabled' |
Member
Author
|
/agentic_review |
Code Review by Qodo
1. Empty type not defaulted
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
Comment on lines
+1408
to
+1412
| accountType := macOSSetup.EndUserLocalAccountType | ||
| if !accountType.Valid { | ||
| accountType = optjson.SetString("admin") | ||
| } | ||
| macOSSettings.EndUserLocalAccountType = accountType |
There was a problem hiding this comment.
1. Empty type not defaulted 🐞 Bug ≡ Correctness
SyncManagedLocalAccountAliases only defaults end_user_local_account_type when the optjson value is invalid, but other new logic treats an empty stored string as the canonical "admin" default. If a legacy record has EndUserLocalAccountType set to "" (valid), API responses and stored alias fields can emit "" instead of "admin", violating the “always consistent” guarantee across surfaces.
Agent Prompt
### Issue description
`SyncManagedLocalAccountAliases` defaults `EndUserLocalAccountType` only when `!Valid`, but the new resolver/validation code treats an empty stored value as the "admin" default. This can leak `""` into marshaled `apple_settings.end_user_local_account_type` (and the stored alias fields) for legacy records.
### Issue Context
- Resolver and validation normalize empty strings to `"admin"`.
- Sync currently copies a valid-but-empty string through to alias output.
### Fix Focus Areas
- Update sync/default normalization to treat empty string as default:
- server/fleet/app.go[1408-1416]
- Ensure consistency with the resolver’s empty==admin behavior:
- server/fleet/app.go[1372-1393]
- (Recommended) Add a regression test that sets `EndUserLocalAccountType = optjson.SetString("")` and asserts marshaled output shows `"admin"`.
- server/fleet/app_test.go[916-977]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+460
to
+466
| if payload.MDM.WindowsSettings != nil && payload.MDM.WindowsSettings.ManagedLocalAccountSettings.Enabled.Valid { | ||
| newEnabled := payload.MDM.WindowsSettings.ManagedLocalAccountSettings.Enabled | ||
| windowsManagedLocalAccountUpdated = team.Config.MDM.WindowsSettings.ManagedLocalAccountSettings.Enabled.Value != newEnabled.Value | ||
| if windowsManagedLocalAccountUpdated && newEnabled.Value && !appCfg.MDM.WindowsEnabledAndConfigured { | ||
| return nil, fleet.NewInvalidArgumentError("mdm.windows_settings.managed_local_account_settings.enabled", | ||
| "Couldn't update windows_settings.managed_local_account_settings because Windows MDM isn't turned on in Fleet.") | ||
| } |
There was a problem hiding this comment.
2. Windows error field mismatch 🐞 Bug ⚙ Maintainability
ModifyTeam returns the Windows managed-local-account validation error under "mdm.windows_settings.managed_local_account_settings.enabled", while other validations for the same field use "windows_settings.managed_local_account_settings.enabled". This inconsistency makes client-side mapping of validation errors to fields brittle across endpoints.
Agent Prompt
### Issue description
Team PATCH (`ModifyTeam`) uses an inconsistent `InvalidArgumentError` field path for the Windows managed local account toggle by adding an extra `mdm.` prefix.
### Issue Context
Other server-side validations (e.g. app config `validateMDM`) use `windows_settings.managed_local_account_settings.enabled` (no `mdm.` prefix), so clients that key off the field path will need endpoint-specific handling.
### Fix Focus Areas
- Change the error field string to match other endpoints:
- ee/server/service/teams.go[460-466]
- Verify consistency against app-config validation field paths:
- server/service/appconfig.go[2027-2031]
- (Optional) Add/adjust a unit test assertion for the exact `InvalidArgumentError` field path.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the new managed_local_account_settings object under apple_settings (macos_settings) and windows_settings for both global config and fleets, per the API contract in docs PRs #47915 and #48110 (story #43488).
Claude-Session: https://claude.ai/code/session_01L8PivHPDz7puhMUKMp3WA8
Related issue: Resolves #
Checklist for submitter
If some of the following don't apply, delete the relevant line.
Changes file added for user-visible changes in
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Input data is properly validated,
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Timeouts are implemented and retries are limited to avoid infinite loops
If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes
Testing
Added/updated automated tests
Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)
QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
Database migrations
COLLATE utf8mb4_unicode_ci).New Fleet configuration settings
If you didn't check the box above, follow this checklist for GitOps-enabled settings:
fleetctl generate-gitopsfleetd/orbit/Fleet Desktop
runtime.GOOSis used as needed to isolate changesSummary by CodeRabbit