feat: optional OneCLI/MITM proxy credential routing by jbaruch · Pull Request #17 · jbaruch/reclaim-tripit-timezones-sync

jbaruch · 2026-07-10T21:53:22Z

Summary

Add opt-in OneCLI / MITM credential-gateway mode gated on ONECLI_URL (set by onecli run)
When enabled: undici ProxyAgent for global fetch, TripIt iCal via proxied fetch, Google Calendar static Bearer with no OAuth self-refresh, placeholder TripIt/Reclaim credentials accepted for gateway injection
When ONECLI_URL is unset: behavior is unchanged; existing tests pass as before

Closes #16.

Test plan

npm test — 182 pass (proxy routing, placeholder acceptance, Google no-refresh, non-OneCLI regression)
With ONECLI_URL unset: dry-run/sync behave as today
Under onecli run: TripIt + Reclaim requests hit the gateway; placeholders swap correctly
Under OneCLI with Google Calendar connection configured + ENABLE_OOO=1: OOO works without local OAuth refresh
Under OneCLI without Google connection: 401 surfaces actionable error (or ENABLE_OOO=0 skips OOO)

Gate proxy + placeholder-credential behavior on ONECLI_URL so non-OneCLI runs stay byte-for-byte identical. When set (via `onecli run`): - install undici ProxyAgent for global fetch (Reclaim, TripIt, Telegram) - fetch TripIt iCal via proxied fetch instead of node-ical fromURL - Google Calendar uses a static Bearer with no OAuth self-refresh - accept placeholder TripIt/Reclaim credentials for gateway injection - OOO opt-in via ENABLE_OOO or GOOGLE_* placeholder presence Adds undici, lib/proxy.mjs, tests for proxy routing / Google bypass / placeholder acceptance, and README/.env.example docs.

jbaruch · 2026-07-10T21:53:36Z

@copilot review this pull request

jbaruch

Requesting Copilot review

Copilot

Pull request overview

Adds an opt-in OneCLI / MITM credential-gateway mode (gated by ONECLI_URL) so outbound HTTP can be routed through a proxy for credential injection, while keeping the non-OneCLI path unchanged.

Changes:

Installs an undici ProxyAgent dispatcher (only in OneCLI mode) so global fetch respects HTTPS_PROXY, with optional CA plumbing via NODE_EXTRA_CA_CERTS.
Updates TripIt iCal fetching to use proxied global fetch under OneCLI; updates Google Calendar client creation to avoid OAuth refresh and use a static Bearer placeholder under OneCLI.
Adds unit tests and documentation for OneCLI mode and placeholder credential behavior.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
sync.mjs	Early proxy dispatcher install; reuse a single Google Calendar client; OneCLI-specific error messaging around OOO sync.
README.md	Documents OneCLI mode usage, proxy/CA behavior, placeholder credential injection, and OOO opt-in rules.
package.json	Adds `undici` dependency for `ProxyAgent` / global dispatcher support.
package-lock.json	Locks `undici` dependency and records its Node engine requirement.
lib/tripit.mjs	Uses proxied global `fetch` + `parseICS` in OneCLI mode to avoid node-ical’s non-proxied URL fetching.
lib/proxy.mjs	New module to detect OneCLI mode and install/reset the global undici proxy dispatcher (with optional CA loading).
lib/proxy.test.mjs	New tests for OneCLI gating, fail-fast behavior, CA handling, and proxy routing for Reclaim + TripIt.
lib/google-calendar.mjs	OneCLI-mode static Bearer auth path + new `isOooOptedIn` helper; preserves OAuth refresh path outside OneCLI.
lib/google-calendar.test.mjs	Expands tests to cover OneCLI opt-in behavior and verify no OAuth token refresh network calls occur.
CHANGELOG.md	Notes the new optional OneCLI credential-gateway mode and behavior changes when gated on `ONECLI_URL`.
.env.example	Adds OneCLI-related env var documentation and OOO opt-in examples.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jbaruch · 2026-07-10T22:01:55Z

    "geo-tz": "^8.1.1",
    "googleapis": "^171.4.0",
-    "node-ical": "^0.20.1"
+    "node-ical": "^0.20.1",
+    "undici": "^8.7.0"
  },


Fixed in 7feebc9 — declared "engines": { "node": ">=22.19.0" } to match undici@8. Tried pinning undici 7 for broader Node 22, but its ProxyAgent hung the mock-proxy tests; staying on undici 8 + engines is the cleaner contract (Dockerfile already uses node:22-alpine).

jbaruch · 2026-07-10T22:01:56Z

+    try {
+      oooStats = await syncOooEvents(client, gcal, futureTrips);
+    } catch (err) {
+      // Surface OneCLI Google-connection misconfig clearly (gateway 401
+      // when the built-in Google Calendar connection isn't authorized).
+      if (process.env.ONECLI_URL && /401|unauthorized|invalid.?credential/i.test(err.message)) {
+        throw new Error(
+          `Google Calendar OOO failed under OneCLI (${err.message}). ` +
+          'Configure and authorize the OneCLI Google Calendar connection ' +
+          '(`onecli apps configure`) so the gateway can inject a real Bearer, ' +
+          'or set ENABLE_OOO=0 to skip OOO.',
+        );
+      }
+      throw err;
+    }


Fixed in 7feebc9 — safe msg extraction (err instanceof Error ? err.message : String(err)) and rethrow with { cause: err } so non-Error throws don't get swallowed as a TypeError on .message.

Copilot · 2026-07-10T22:00:20Z

@copilot review this pull request

Review complete. The implementation is well-structured and the gate on ONECLI_URL keeps non-OneCLI paths byte-for-byte unchanged. All 182 tests pass.

One fix applied (commit fix: remove unused http import in google-calendar.test.mjs):

import http from 'node:http' in lib/google-calendar.test.mjs was unused — http is only needed in proxy.test.mjs for the local test servers.

Other observations (no action needed):

ONECLI_ACCESS_TOKEN exported from google-calendar.mjs — intentional for test assertions; the value is a non-secret placeholder string.
Top-level installProxyDispatcher() in sync.mjs — unusual pattern, but the comment clearly documents that it must be the first side-effect call. All imports are hoisted in ESM, so HTTP requests (which are async) happen after the proxy is installed; the setup is correct.
isOooOptedIn non-OneCLI branch duplicates the clientId && clientSecret && refreshToken check inside createGCalClient — this is acceptable; the function is a separate utility exported for dry-run messaging and sync.mjs callers.
Regex /401|unauthorized|invalid.?credential/i in the OneCLI error handler is intentionally broad to catch gateway-flavoured 401 messages across Google API client versions.
No new security vulnerabilities introduced. Existing npm audit findings are in pre-existing transitive dependencies (axios, brace-expansion) and are unrelated to this PR.

CodeQL scan also came back clean.

- Declare engines.node >=22.19.0 to match undici@8's requirement (node:22-alpine consumers need a recent 22.x; undici 7 hung proxy tests) - Harden OneCLI OOO error wrapping: safe message extraction and Error cause

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

jbaruch · 2026-07-10T22:10:08Z

+// Spins up a local HTTP "origin" server and a local HTTP CONNECT-capable
+// proxy. With ONECLI_URL + HTTPS_PROXY pointing at the mock proxy, undici's
+// ProxyAgent must forward the request — we assert the proxy saw it and
+// the origin saw the expected placeholder credentials.


Fixed in c3d94d2 — corrected the suite header and split the suites: HTTP forward (absolute-form) vs HTTPS CONNECT. The CONNECT suite now stands up an https:// origin with an ephemeral self-signed cert (SAN=IP:127.0.0.1), a CONNECT-tunnel mock proxy, and asserts both the CONNECT target and the placeholder Bearer on the origin.

jbaruch · 2026-07-10T22:10:10Z

+    // Minimal HTTP forward proxy: rewrites absolute-form request-target
+    // to origin-form and relays to the real origin. Enough for undici
+    // ProxyAgent's non-CONNECT (http://) path.
+    proxyServer = http.createServer((req, res) => {


Fixed in c3d94d2 — added proxy routing under OneCLI mode (HTTPS CONNECT) covering Reclaim + TripIt over https:// via CONNECT, with the self-signed origin cert trusted through NODE_EXTRA_CA_CERTS / requestTls.ca. Production-relevant path is now exercised; 184 tests green.

Address Copilot re-review: the mock proxy was documented as CONNECT-capable but only handled HTTP absolute-form. Split HTTP-forward vs HTTPS-CONNECT suites and assert CONNECT tunnels for https:// Reclaim/TripIt origins with an ephemeral self-signed cert trusted via NODE_EXTRA_CA_CERTS.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

jbaruch · 2026-07-10T22:16:29Z

+    execFileSync('openssl', [
+      'req', '-x509', '-newkey', 'rsa:2048',
+      '-keyout', keyPath, '-out', certPath,
+      '-days', '1', '-nodes',
+      '-subj', '/CN=127.0.0.1',
+      '-addext', 'subjectAltName=IP:127.0.0.1,DNS:localhost',
+    ], { stdio: 'pipe' });
+    const key = readFileSync(keyPath);
+    const cert = readFileSync(certPath);


Fixed in 13179df — openssl spawn failures (ENOENT / missing binary) now throw an actionable message that the HTTPS CONNECT suite needs openssl on PATH; other openssl failures include stderr detail.

jbaruch · 2026-07-10T22:16:30Z

+// Install undici ProxyAgent before any HTTP when running under OneCLI
+// (`ONECLI_URL` set by `onecli run`). No-op otherwise — keeps non-OneCLI
+// behavior byte-for-byte identical. Must be the first side-effect import.
+import { installProxyDispatcher } from './lib/proxy.mjs';
+installProxyDispatcher();


Fixed in 13179df — rewrote the comment to state the ESM truth: all static imports evaluate before the module body, so install is the explicit installProxyDispatcher() call (safe only because lib/* do no HTTP at load time).

Address Copilot review on c3d94d2: - Document that ESM evaluates all static imports before the module body, so proxy install is the explicit call (not import order) - Surface a clear error when openssl is missing for HTTPS CONNECT tests

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

jbaruch · 2026-07-10T22:20:21Z

+/**
+ * Whether OOO / Google Calendar is opted in under the current env.
+ * Exported for sync.mjs dry-run messaging.
+ */


Fixed in d42b596 — JSDoc now says used by createGCalClient and sync skip messaging (no false claim about dry-run importing it).

jbaruch · 2026-07-10T22:20:23Z

  if (!gcal) {
    console.log('\n  OOO blocks: skipped (Google Calendar credentials not configured)');
  } else {


Fixed in d42b596 — sync and dry-run both use oooSkipReason() so OneCLI operators see ENABLE_OOO / placeholder guidance instead of "credentials not configured".

jbaruch · 2026-07-10T22:20:24Z

+    if (futureTrips.length > 0 && gcal) {
      console.log(`\n── OOO blocks (would create) ──`);
      for (const t of futureTrips) {
        console.log(`  ${OOO_PREFIX}${t.summary}  ${t.startDate} → ${t.endDate}`);


Fixed in d42b596 — same as the sync path; dry-run now uses oooSkipReason(googleCreds).

Copilot: dry-run/sync said "credentials not configured" even when ONECLI_URL is set and OOO simply wasn't opted in. Add oooSkipReason() and use it for both skip paths; fix isOooOptedIn JSDoc.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

jbaruch · 2026-07-10T22:24:23Z

+// OneCLI mode: install undici ProxyAgent before any HTTP.
+// ESM evaluates all static imports (the whole dependency graph) before this
+// module body runs, so import order does NOT control when the agent is
+// installed — the explicit call below does. That is safe because lib/*
+// only export functions; they do not perform HTTP at load time. Any future
+// top-level HTTP in an imported module would race this and break OneCLI.
+// No-op when ONECLI_URL is unset (byte-for-byte identical non-OneCLI path).
+import { installProxyDispatcher } from './lib/proxy.mjs';
+installProxyDispatcher();


Fixed in fba32c1 — reworded: no-op is about HTTP routing (no ProxyAgent / dispatcher swap), not zero module-graph difference; undici may still load via the import.

jbaruch · 2026-07-10T22:24:24Z

+    try {
+      execFileSync('openssl', [
+        'req', '-x509', '-newkey', 'rsa:2048',
+        '-keyout', keyPath, '-out', certPath,
+        '-days', '1', '-nodes',
+        '-subj', '/CN=127.0.0.1',
+        '-addext', 'subjectAltName=IP:127.0.0.1,DNS:localhost',
+      ], { stdio: 'pipe' });
+    } catch (err) {
+      const detail = err.stderr?.toString?.() || err.message || String(err);
+      const missing = err.code === 'ENOENT'
+        || /not found|No such file|spawn openssl/i.test(detail);
+      throw new Error(


Fixed in fba32c1 — preflight openssl version; suite uses describe.skip when openssl is missing so minimal environments skip cleanly instead of hard-failing.

- Skip HTTPS CONNECT suite when openssl is not on PATH (describe.skip) - Clarify that OneCLI off means no dispatcher swap, not zero module-graph change

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

jbaruch · 2026-07-10T22:27:26Z

+      const msg = err instanceof Error ? err.message : String(err);
+      if (process.env.ONECLI_URL && /401|unauthorized|invalid.?credential/i.test(msg)) {
+        throw new Error(
+          `Google Calendar OOO failed under OneCLI (${msg}). ` +
+          'Configure and authorize the OneCLI Google Calendar connection ' +
+          '(`onecli apps configure`) so the gateway can inject a real Bearer, ' +
+          'or set ENABLE_OOO=0 to skip OOO.',
+          { cause: err },
+        );
+      }
+      throw err;
+    }


Fixed in 9cef7da — non-Error throws are wrapped in new Error(msg, { cause }) before rethrow; top-level fatal path also uses safe message extraction.

jbaruch · 2026-07-10T22:27:27Z

+    const flag = process.env.ENABLE_OOO;
+    if (flag === '0' || flag === 'false') return false;
+    if (flag === '1' || flag === 'true') return true;


Fixed in 9cef7da — shared enableOooFlag() lowercases ENABLE_OOO; TRUE/FALSE/yes/no/on/off work.

jbaruch · 2026-07-10T22:27:28Z

+  if (process.env.ONECLI_URL) {
+    const flag = process.env.ENABLE_OOO;
+    if (flag === '0' || flag === 'false') {
+      return 'OOO disabled under OneCLI (ENABLE_OOO=0)';
+    }
+    return 'OOO not opted in under OneCLI (set ENABLE_OOO=1, or set GOOGLE_* placeholders as opt-in markers)';
+  }
+  return 'Google Calendar credentials not configured';


Fixed in 9cef7da — oooSkipReason uses the same case-insensitive enableOooFlag().

- ENABLE_OOO accepts TRUE/FALSE/etc. case-insensitively in opt-in + skip reason - OOO catch and top-level fatal path always surface a string message

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

jbaruch · 2026-07-10T22:32:12Z

+  const caPath = process.env.NODE_EXTRA_CA_CERTS;
+  if (caPath) {
+    try {
+      const ca = readFileSync(caPath);
+      agentOpts.requestTls = { ca, rejectUnauthorized: true };
+      agentOpts.proxyTls = { ca, rejectUnauthorized: true };


Fixed in b19be30 — ca: [...tls.rootCertificates, extraCa] so we append like NODE_EXTRA_CA_CERTS, not replace the default trust store.

NODE_EXTRA_CA_CERTS appends at Node startup; undici requestTls.ca replaces. Append extra CA to tls.rootCertificates so public roots stay available.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

jbaruch · 2026-07-10T22:36:02Z

+import { installProxyDispatcher } from './lib/proxy.mjs';
+installProxyDispatcher();


Fixed in 3871080 — installProxyDispatcher() now runs inside the main try after CLI/output parsing, so missing HTTPS_PROXY flows through the same fatal path (including --output=json). Verified smoke: errors array contains the actionable message.

Move installProxyDispatcher() after CLI/output setup into the main try so ONECLI_URL without HTTPS_PROXY exits via --output=json shaping.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

jbaruch · 2026-07-10T22:39:22Z

+  it('reads NODE_EXTRA_CA_CERTS into requestTls when the file exists', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'onecli-ca-'));
+    const caPath = join(dir, 'ca.pem');
+    // Minimal PEM-looking blob — ProxyAgent only needs to read the bytes
+    writeFileSync(caPath, '-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n');
+    process.env.ONECLI_URL = 'http://127.0.0.1:9999';
+    process.env.HTTPS_PROXY = 'http://127.0.0.1:8888';
+    process.env.NODE_EXTRA_CA_CERTS = caPath;
+    const agent = installProxyDispatcher();
+    assert.ok(agent instanceof ProxyAgent);
+    unlinkSync(caPath);
+  });


Fixed in 8f0714c — temp CA dir is rmSync’d in a finally block (whole dir, not just the PEM).

rmSync the whole mkdtemp dir in finally so /tmp is not left littered.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

jbaruch · 2026-07-10T22:42:00Z

+  it('routes Reclaim listEntries through the proxy with a placeholder Bearer', async () => {
+    // listEntries hardcodes api.app.reclaim.ai; we exercise the same client
+    // + dispatcher path with a fetch that targets the mock origin.
+    const client = createClient('PLACEHOLDER-RECLAIM-TOKEN');


Fixed in b4dc65c — renamed to “Reclaim-style global fetch”; comment explains why we cannot call listEntries directly without a base-URL seam.

jbaruch · 2026-07-10T22:42:01Z

+ * @returns {ProxyAgent|null} the installed agent, or null when not in OneCLI mode
+ * @throws {Error} when ONECLI_URL is set but HTTPS_PROXY is missing
+ */


Fixed in b4dc65c — @throws now also covers NODE_EXTRA_CA_CERTS missing/unreadable.

@throws

- Rename test to say global fetch, not listEntries (no base-URL seam) - Document NODE_EXTRA_CA_CERTS read failures in installProxyDispatcher @throws

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings July 10, 2026 21:53

jbaruch commented Jul 10, 2026

View reviewed changes

Copilot started reviewing on behalf of jbaruch July 10, 2026 21:54 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Copilot started work on behalf of jbaruch July 10, 2026 21:57 View session

fix: remove unused http import in google-calendar.test.mjs

73f7791

Copilot finished work on behalf of jbaruch July 10, 2026 22:00

fix: address Copilot review on OneCLI proxy PR

7feebc9

- Declare engines.node >=22.19.0 to match undici@8's requirement (node:22-alpine consumers need a recent 22.x; undici 7 hung proxy tests) - Harden OneCLI OOO error wrapping: safe message extraction and Error cause

jbaruch requested a review from Copilot July 10, 2026 22:05

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:06 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

jbaruch requested a review from Copilot July 10, 2026 22:10

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:10 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

jbaruch requested a review from Copilot July 10, 2026 22:16

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:16 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

fix: accurate OOO skip messaging under OneCLI

d42b596

Copilot: dry-run/sync said "credentials not configured" even when ONECLI_URL is set and OOO simply wasn't opted in. Add oooSkipReason() and use it for both skip paths; fix isOooOptedIn JSDoc.

jbaruch requested a review from Copilot July 10, 2026 22:20

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:20 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

fix: soft-skip HTTPS CONNECT tests; soften no-op claims

fba32c1

- Skip HTTPS CONNECT suite when openssl is not on PATH (describe.skip) - Clarify that OneCLI off means no dispatcher swap, not zero module-graph change

jbaruch requested a review from Copilot July 10, 2026 22:24

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:24 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

fix: case-insensitive ENABLE_OOO; normalize non-Error rethrows

9cef7da

- ENABLE_OOO accepts TRUE/FALSE/etc. case-insensitively in opt-in + skip reason - OOO catch and top-level fatal path always surface a string message

jbaruch requested a review from Copilot July 10, 2026 22:27

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:27 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

fix: append MITM CA to system roots, not replace them

b19be30

NODE_EXTRA_CA_CERTS appends at Node startup; undici requestTls.ca replaces. Append extra CA to tls.rootCertificates so public roots stay available.

jbaruch requested a review from Copilot July 10, 2026 22:32

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:32 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

fix: install proxy dispatcher inside try for JSON errors

3871080

Move installProxyDispatcher() after CLI/output setup into the main try so ONECLI_URL without HTTPS_PROXY exits via --output=json shaping.

jbaruch requested a review from Copilot July 10, 2026 22:36

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:36 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

test: clean up temp CA dir in proxy tests

8f0714c

rmSync the whole mkdtemp dir in finally so /tmp is not left littered.

jbaruch requested a review from Copilot July 10, 2026 22:38

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:39 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

fix: accurate Reclaim proxy test name and @throws docs

b4dc65c

- Rename test to say global fetch, not listEntries (no base-URL seam) - Document NODE_EXTRA_CA_CERTS read failures in installProxyDispatcher @throws

jbaruch requested a review from Copilot July 10, 2026 22:42

Copilot started reviewing on behalf of jbaruch July 10, 2026 22:42 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

jbaruch merged commit dc582da into main Jul 10, 2026
1 check passed

jbaruch deleted the feat/onecli-proxy-credential-routing branch July 10, 2026 23:04

jbaruch mentioned this pull request Jul 10, 2026

Verify Google Calendar OOO routes through OneCLI (gaxios proxy + CA), or wire gaxios explicitly #18

Open

5 tasks

		import { installProxyDispatcher } from './lib/proxy.mjs';
		installProxyDispatcher();

Conversation

jbaruch commented Jul 10, 2026

Summary

Test plan

Uh oh!

jbaruch commented Jul 10, 2026

Uh oh!

jbaruch left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview